Import WebKit commit 3ca7a25a550e473d60bbbe321475c6c0ef114b31

Change-Id: I480668a0cb8114dccf7a1195190a993282875759 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
author: Konstantin Tokarev <annulen@yandex.ru> 2017-06-01 15:54:01 +0300
committer: Konstantin Tokarev <annulen@yandex.ru> 2017-06-02 14:07:43 +0000
commit: 0a3506ebe5d7f431f0dd4dffa24ac32063b90ff1 (patch)
tree: f3d0b92fe7bc5b31426a838c354616fff335e82b
parent: 881da28418d380042aa95a97f0cbd42560a64f7c (diff)
download: qtwebkit-0a3506ebe5d7f431f0dd4dffa24ac32063b90ff1.tar.gz
143 files changed, 1091 insertions, 429 deletions
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
index 42ac400fc..4afdac681 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
@@ -1092,12 +1092,12 @@ public:
 
     void zeroExtend16To32(RegisterID src, RegisterID dest)
     {
-        m_assembler.uxth<64>(dest, src);
+        m_assembler.uxth<32>(dest, src);
     }
 
     void signExtend16To32(RegisterID src, RegisterID dest)
     {
-        m_assembler.sxth<64>(dest, src);
+        m_assembler.sxth<32>(dest, src);
     }
 
     void load8(ImplicitAddress address, RegisterID dest)
@@ -1152,12 +1152,12 @@ public:
 
     void zeroExtend8To32(RegisterID src, RegisterID dest)
     {
-        m_assembler.uxtb<64>(dest, src);
+        m_assembler.uxtb<32>(dest, src);
     }
 
     void signExtend8To32(RegisterID src, RegisterID dest)
     {
-        m_assembler.sxtb<64>(dest, src);
+        m_assembler.sxtb<32>(dest, src);
     }
 
     void store64(RegisterID src, ImplicitAddress address)
diff --git a/Source/JavaScriptCore/b3/B3LowerMacros.cpp b/Source/JavaScriptCore/b3/B3LowerMacros.cpp
index f71ca62ab..2e5693b01 100644
--- a/Source/JavaScriptCore/b3/B3LowerMacros.cpp
+++ b/Source/JavaScriptCore/b3/B3LowerMacros.cpp
@@ -138,6 +138,7 @@ private:
                     normalResult->setPhi(phi);
                     zeroResult->setPhi(phi);
                     m_value->replaceWithIdentity(phi);
+                    before->updatePredecessorsAfter();
                     m_changed = true;
                 } else
                     makeDivisionChill(Mod);
diff --git a/Source/JavaScriptCore/bytecode/ByValInfo.h b/Source/JavaScriptCore/bytecode/ByValInfo.h
index 20518300c..c61898fa8 100644
--- a/Source/JavaScriptCore/bytecode/ByValInfo.h
+++ b/Source/JavaScriptCore/bytecode/ByValInfo.h
@@ -204,10 +204,11 @@ inline JITArrayMode jitArrayModeForStructure(Structure* structure)
 struct ByValInfo {
     ByValInfo() { }
 
-    ByValInfo(unsigned bytecodeIndex, CodeLocationJump notIndexJump, CodeLocationJump badTypeJump, JITArrayMode arrayMode, ArrayProfile* arrayProfile, int16_t badTypeJumpToDone, int16_t badTypeJumpToNextHotPath, int16_t returnAddressToSlowPath)
+    ByValInfo(unsigned bytecodeIndex, CodeLocationJump notIndexJump, CodeLocationJump badTypeJump, CodeLocationLabel exceptionHandler, JITArrayMode arrayMode, ArrayProfile* arrayProfile, int16_t badTypeJumpToDone, int16_t badTypeJumpToNextHotPath, int16_t returnAddressToSlowPath)
         : bytecodeIndex(bytecodeIndex)
         , notIndexJump(notIndexJump)
         , badTypeJump(badTypeJump)
+        , exceptionHandler(exceptionHandler)
         , arrayMode(arrayMode)
         , arrayProfile(arrayProfile)
         , badTypeJumpToDone(badTypeJumpToDone)
@@ -223,6 +224,7 @@ struct ByValInfo {
     unsigned bytecodeIndex;
     CodeLocationJump notIndexJump;
     CodeLocationJump badTypeJump;
+    CodeLocationLabel exceptionHandler;
     JITArrayMode arrayMode; // The array mode that was baked into the inline JIT code.
     ArrayProfile* arrayProfile;
     int16_t badTypeJumpToDone;
diff --git a/Source/JavaScriptCore/bytecompiler/SetForScope.h b/Source/JavaScriptCore/bytecompiler/SetForScope.h
index eef76aef4..95a9777a4 100644
--- a/Source/JavaScriptCore/bytecompiler/SetForScope.h
+++ b/Source/JavaScriptCore/bytecompiler/SetForScope.h
@@ -59,4 +59,6 @@ private:
 
 }; // namespace JSC
 
+using JSC::SetForScope;
+
 #endif // SetForScope_h
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
index 698cc75db..e26b650bd 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
@@ -148,7 +148,6 @@ private:
             for (Node* node : *block) {
                 switch (node->op()) {
                 case GetFromArguments:
-                    DFG_ASSERT(m_graph, node, node->child1()->op() == CreateDirectArguments);
                     break;
                     
                 case GetByVal:
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 6aefe61e3..8e93a7e95 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -562,9 +562,15 @@ private:
     {
         flushDirect(operand, findArgumentPosition(operand));
     }
-    
+
     void flushDirect(VirtualRegister operand, ArgumentPosition* argumentPosition)
     {
+        addFlushOrPhantomLocal<Flush>(operand, argumentPosition);
+    }
+
+    template<NodeType nodeType>
+    void addFlushOrPhantomLocal(VirtualRegister operand, ArgumentPosition* argumentPosition)
+    {
         ASSERT(!operand.isConstant());
         
         Node* node = m_currentBlock->variablesAtTail.operand(operand);
@@ -576,12 +582,17 @@ private:
         else
             variable = newVariableAccessData(operand);
         
-        node = addToGraph(Flush, OpInfo(variable));
+        node = addToGraph(nodeType, OpInfo(variable));
         m_currentBlock->variablesAtTail.operand(operand) = node;
         if (argumentPosition)
             argumentPosition->addVariable(variable);
     }
-    
+
+    void phantomLocalDirect(VirtualRegister operand)
+    {
+        addFlushOrPhantomLocal<PhantomLocal>(operand, findArgumentPosition(operand));
+    }
+
     void flush(InlineStackEntry* inlineStackEntry)
     {
         int numArguments;
@@ -602,8 +613,32 @@ private:
 
     void flushForTerminal()
     {
-        for (InlineStackEntry* inlineStackEntry = m_inlineStackTop; inlineStackEntry; inlineStackEntry = inlineStackEntry->m_caller)
+        CodeOrigin origin = currentCodeOrigin();
+        unsigned bytecodeIndex = origin.bytecodeIndex;
+
+        for (InlineStackEntry* inlineStackEntry = m_inlineStackTop; inlineStackEntry; inlineStackEntry = inlineStackEntry->m_caller) {
             flush(inlineStackEntry);
+
+            ASSERT(origin.inlineCallFrame == inlineStackEntry->m_inlineCallFrame);
+            InlineCallFrame* inlineCallFrame = inlineStackEntry->m_inlineCallFrame;
+            CodeBlock* codeBlock = m_graph.baselineCodeBlockFor(inlineCallFrame);
+            FullBytecodeLiveness& fullLiveness = m_graph.livenessFor(codeBlock);
+            const FastBitVector& livenessAtBytecode = fullLiveness.getLiveness(bytecodeIndex);
+
+            for (unsigned local = codeBlock->m_numCalleeLocals; local--;) {
+                if (livenessAtBytecode.get(local)) {
+                    VirtualRegister reg = virtualRegisterForLocal(local);
+                    if (inlineCallFrame)
+                        reg = inlineStackEntry->remapOperand(reg);
+                    phantomLocalDirect(reg);
+                }
+            }
+
+            if (inlineCallFrame) {
+                bytecodeIndex = inlineCallFrame->directCaller.bytecodeIndex;
+                origin = inlineCallFrame->directCaller;
+            }
+        }
     }
 
     void flushForReturn()
diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
index d7ce00df5..566bc398c 100644
--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
@@ -204,6 +204,10 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
         read(JSObject_butterfly);
         ArrayMode mode = node->arrayMode();
         switch (mode.type()) {
+        case Array::ForceExit: {
+            write(SideState);
+            return;
+        }
         case Array::Int32: {
             if (mode.isInBounds()) {
                 read(Butterfly_publicLength);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 97e924df2..474f1a08a 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -3815,8 +3815,6 @@ void SpeculativeJIT::compile(Node* node)
     }
         
     case GetById: {
-        ASSERT(node->prediction());
-        
         switch (node->child1().useKind()) {
         case CellUse: {
             SpeculateCellOperand base(this, node->child1());
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index dbcdfb5f7..d5fd25d96 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -3877,8 +3877,6 @@ void SpeculativeJIT::compile(Node* node)
         break;
     }
     case GetById: {
-        ASSERT(node->prediction());
-
         switch (node->child1().useKind()) {
         case CellUse: {
             SpeculateCellOperand base(this, node->child1());
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index ac8c132aa..8f5c02177 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -671,27 +671,33 @@ CompilationResult JIT::privateCompile(JITCompilationEffort effort)
     for (unsigned i = m_putByIds.size(); i--;)
         m_putByIds[i].finalize(patchBuffer);
 
-    for (const auto& byValCompilationInfo : m_byValCompilationInfo) {
-        PatchableJump patchableNotIndexJump = byValCompilationInfo.notIndexJump;
-        CodeLocationJump notIndexJump = CodeLocationJump();
-        if (Jump(patchableNotIndexJump).isSet())
-            notIndexJump = CodeLocationJump(patchBuffer.locationOf(patchableNotIndexJump));
-        CodeLocationJump badTypeJump = CodeLocationJump(patchBuffer.locationOf(byValCompilationInfo.badTypeJump));
-        CodeLocationLabel doneTarget = patchBuffer.locationOf(byValCompilationInfo.doneTarget);
-        CodeLocationLabel nextHotPathTarget = patchBuffer.locationOf(byValCompilationInfo.nextHotPathTarget);
-        CodeLocationLabel slowPathTarget = patchBuffer.locationOf(byValCompilationInfo.slowPathTarget);
-        CodeLocationCall returnAddress = patchBuffer.locationOf(byValCompilationInfo.returnAddress);
-
-        *byValCompilationInfo.byValInfo = ByValInfo(
-            byValCompilationInfo.bytecodeIndex,
-            notIndexJump,
-            badTypeJump,
-            byValCompilationInfo.arrayMode,
-            byValCompilationInfo.arrayProfile,
-            differenceBetweenCodePtr(badTypeJump, doneTarget),
-            differenceBetweenCodePtr(badTypeJump, nextHotPathTarget),
-            differenceBetweenCodePtr(returnAddress, slowPathTarget));
+    if (m_byValCompilationInfo.size()) {
+        CodeLocationLabel exceptionHandler = patchBuffer.locationOf(m_exceptionHandler);
+
+        for (const auto& byValCompilationInfo : m_byValCompilationInfo) {
+            PatchableJump patchableNotIndexJump = byValCompilationInfo.notIndexJump;
+            CodeLocationJump notIndexJump = CodeLocationJump();
+            if (Jump(patchableNotIndexJump).isSet())
+                notIndexJump = CodeLocationJump(patchBuffer.locationOf(patchableNotIndexJump));
+            CodeLocationJump badTypeJump = CodeLocationJump(patchBuffer.locationOf(byValCompilationInfo.badTypeJump));
+            CodeLocationLabel doneTarget = patchBuffer.locationOf(byValCompilationInfo.doneTarget);
+            CodeLocationLabel nextHotPathTarget = patchBuffer.locationOf(byValCompilationInfo.nextHotPathTarget);
+            CodeLocationLabel slowPathTarget = patchBuffer.locationOf(byValCompilationInfo.slowPathTarget);
+            CodeLocationCall returnAddress = patchBuffer.locationOf(byValCompilationInfo.returnAddress);
+
+            *byValCompilationInfo.byValInfo = ByValInfo(
+                byValCompilationInfo.bytecodeIndex,
+                notIndexJump,
+                badTypeJump,
+                exceptionHandler,
+                byValCompilationInfo.arrayMode,
+                byValCompilationInfo.arrayProfile,
+                differenceBetweenCodePtr(badTypeJump, doneTarget),
+                differenceBetweenCodePtr(badTypeJump, nextHotPathTarget),
+                differenceBetweenCodePtr(returnAddress, slowPathTarget));
+        }
     }
+
     for (unsigned i = 0; i < m_callCompilationInfo.size(); ++i) {
         CallCompilationInfo& compilationInfo = m_callCompilationInfo[i];
         CallLinkInfo& info = *compilationInfo.callLinkInfo;
@@ -763,7 +769,8 @@ void JIT::privateCompileExceptionHandlers()
         jumpToExceptionHandler();
     }
 
-    if (!m_exceptionChecks.empty()) {
+    if (!m_exceptionChecks.empty() || m_byValCompilationInfo.size()) {
+        m_exceptionHandler = label();
         m_exceptionChecks.link(this);
 
         copyCalleeSavesToVMCalleeSavesBuffer();
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index e81824268..949b4b134 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -903,6 +903,7 @@ namespace JSC {
 
         JumpList m_exceptionChecks;
         JumpList m_exceptionChecksWithCallFrameRollback;
+        Label m_exceptionHandler;
 
         unsigned m_getByIdIndex;
         unsigned m_putByIdIndex;
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 3781c1df2..8b6d6ecc3 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -1256,6 +1256,8 @@ void JIT::privateCompileGetByValWithCachedId(ByValInfo* byValInfo, ReturnAddress
     patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
     patchBuffer.link(fastDoneCase, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
     patchBuffer.link(slowDoneCase, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToNextHotPath));
+    if (!m_exceptionChecks.empty())
+        patchBuffer.link(m_exceptionChecks, byValInfo->exceptionHandler);
 
     for (const auto& callSite : m_calls) {
         if (callSite.to)
@@ -1344,6 +1346,9 @@ void JIT::privateCompilePutByValWithCachedId(ByValInfo* byValInfo, ReturnAddress
     LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
     patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
     patchBuffer.link(doneCases, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
+    if (!m_exceptionChecks.empty())
+        patchBuffer.link(m_exceptionChecks, byValInfo->exceptionHandler);
+
     for (const auto& callSite : m_calls) {
         if (callSite.to)
             patchBuffer.link(callSite.from, FunctionPtr(callSite.to));
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index c672add34..d9f888fb1 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -1122,23 +1122,29 @@ EncodedJSValue JSC_HOST_CALL functionCreateRoot(ExecState* exec)
 EncodedJSValue JSC_HOST_CALL functionCreateElement(ExecState* exec)
 {
     JSLockHolder lock(exec);
-    JSValue arg = exec->argument(0);
-    return JSValue::encode(Element::create(exec->vm(), exec->lexicalGlobalObject(), arg.isNull() ? nullptr : jsCast<Root*>(exec->argument(0))));
+    Root* root = jsDynamicCast<Root*>(exec->argument(0));
+    if (!root)
+        return JSValue::encode(exec->vm().throwException(exec, createError(exec, ASCIILiteral("Cannot create Element without a Root."))));
+    return JSValue::encode(Element::create(exec->vm(), exec->lexicalGlobalObject(), root));
 }
 
 EncodedJSValue JSC_HOST_CALL functionGetElement(ExecState* exec)
 {
     JSLockHolder lock(exec);
-    Element* result = jsCast<Root*>(exec->argument(0).asCell())->element();
+    Root* root = jsDynamicCast<Root*>(exec->argument(0));
+    if (!root)
+        return JSValue::encode(jsUndefined());
+    Element* result = root->element();
     return JSValue::encode(result ? result : jsUndefined());
 }
 
 EncodedJSValue JSC_HOST_CALL functionSetElementRoot(ExecState* exec)
 {
     JSLockHolder lock(exec);
-    Element* element = jsCast<Element*>(exec->argument(0));
-    Root* root = jsCast<Root*>(exec->argument(1));
-    element->setRoot(exec->vm(), root);
+    Element* element = jsDynamicCast<Element*>(exec->argument(0));
+    Root* root = jsDynamicCast<Root*>(exec->argument(1));
+    if (element && root)
+        element->setRoot(exec->vm(), root);
     return JSValue::encode(jsUndefined());
 }
 
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index a92d55aa9..14ffda64e 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -1514,6 +1514,12 @@ _llint_op_put_by_id:
 
 .opPutByIdTransitionDirect:
     storei t1, JSCell::m_structureID[t0]
+    loadi 12[PC], t1
+    loadConstantOrVariable(t1, t2, t3)
+    loadi 20[PC], t1
+    storePropertyAtVariableOffset(t1, t0, t2, t3)
+    writeBarrierOnOperand(1)
+    dispatch(9)
 
 .opPutByIdNotTransition:
     # The only thing live right now is t0, which holds the base.
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index 85173bc82..4b3febb3f 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -1398,6 +1398,10 @@ _llint_op_put_by_id:
 
 .opPutByIdTransitionDirect:
     storei t1, JSCell::m_structureID[t0]
+    writeBarrierOnOperand(1)
+    # Reload base into t0
+    loadisFromInstruction(1, t1)
+    loadConstantOrVariable(t1, t0)
 
 .opPutByIdNotTransition:
     # The only thing live right now is t0, which holds the base.
diff --git a/Source/JavaScriptCore/runtime/ArgList.cpp b/Source/JavaScriptCore/runtime/ArgList.cpp
index 3023151bf..7813b404f 100644
--- a/Source/JavaScriptCore/runtime/ArgList.cpp
+++ b/Source/JavaScriptCore/runtime/ArgList.cpp
@@ -30,6 +30,19 @@ using std::min;
 
 namespace JSC {
 
+void MarkedArgumentBuffer::addMarkSet(JSValue v)
+{
+    if (m_markSet)
+        return;
+
+    Heap* heap = Heap::heap(v);
+    if (!heap)
+        return;
+
+    m_markSet = &heap->markListSet();
+    m_markSet->add(this);
+}
+
 void ArgList::getSlice(int startIndex, ArgList& result) const
 {
     if (startIndex <= 0 || startIndex >= m_argCount) {
@@ -51,40 +64,31 @@ void MarkedArgumentBuffer::markLists(HeapRootVisitor& heapRootVisitor, ListSet&
     }
 }
 
-void MarkedArgumentBuffer::slowAppend(JSValue v)
+void MarkedArgumentBuffer::expandCapacity()
 {
     int newCapacity = (Checked<int>(m_capacity) * 2).unsafeGet();
     size_t size = (Checked<size_t>(newCapacity) * sizeof(EncodedJSValue)).unsafeGet();
     EncodedJSValue* newBuffer = static_cast<EncodedJSValue*>(fastMalloc(size));
-    for (int i = 0; i < m_capacity; ++i)
+    for (int i = 0; i < m_capacity; ++i) {
         newBuffer[i] = m_buffer[i];
+        addMarkSet(JSValue::decode(m_buffer[i]));
+    }
 
     if (EncodedJSValue* base = mallocBase())
         fastFree(base);
 
     m_buffer = newBuffer;
     m_capacity = newCapacity;
+}
+
+void MarkedArgumentBuffer::slowAppend(JSValue v)
+{
+    if (m_size >= m_capacity)
+        expandCapacity();
 
     slotFor(m_size) = JSValue::encode(v);
     ++m_size;
-
-    if (m_markSet)
-        return;
-
-    // As long as our size stays within our Vector's inline 
-    // capacity, all our values are allocated on the stack, and 
-    // therefore don't need explicit marking. Once our size exceeds
-    // our Vector's inline capacity, though, our values move to the 
-    // heap, where they do need explicit marking.
-    for (int i = 0; i < m_size; ++i) {
-        Heap* heap = Heap::heap(JSValue::decode(slotFor(i)));
-        if (!heap)
-            continue;
-
-        m_markSet = &heap->markListSet();
-        m_markSet->add(this);
-        break;
-    }
+    addMarkSet(v);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ArgList.h b/Source/JavaScriptCore/runtime/ArgList.h
index 8ae622d07..b7e6e4a1a 100644
--- a/Source/JavaScriptCore/runtime/ArgList.h
+++ b/Source/JavaScriptCore/runtime/ArgList.h
@@ -78,7 +78,7 @@ public:
 
     void append(JSValue v)
     {
-        if (m_size >= m_capacity)
+        if (m_size >= m_capacity || mallocBase())
             return slowAppend(v);
 
         slotFor(m_size) = JSValue::encode(v);
@@ -100,6 +100,10 @@ public:
     static void markLists(HeapRootVisitor&, ListSet&);
 
 private:
+    void expandCapacity();
+
+    void addMarkSet(JSValue);
+
     JS_EXPORT_PRIVATE void slowAppend(JSValue);
         
     EncodedJSValue& slotFor(int item) const
@@ -109,7 +113,7 @@ private:
         
     EncodedJSValue* mallocBase()
     {
-        if (m_capacity == static_cast<int>(inlineCapacity))
+        if (m_buffer == m_inlineBuffer)
             return 0;
         return &slotFor(0);
     }
diff --git a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
index 5bc2ec3c8..d17a28e5b 100644
--- a/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -122,7 +122,7 @@ EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
 
     // 9. If msg is the empty String, return name.
     if (!messageString.length())
-        return JSValue::encode(name.isString() ? name : jsNontrivialString(exec, nameString));
+        return JSValue::encode(name.isString() ? name : jsString(exec, nameString));
 
     // 10. Return the result of concatenating name, ":", a single space character, and msg.
     return JSValue::encode(jsMakeNontrivialString(exec, nameString, ": ", messageString));
diff --git a/Source/JavaScriptCore/runtime/ScopedArguments.h b/Source/JavaScriptCore/runtime/ScopedArguments.h
index 8d36a1bab..5e2df3cc9 100644
--- a/Source/JavaScriptCore/runtime/ScopedArguments.h
+++ b/Source/JavaScriptCore/runtime/ScopedArguments.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -100,7 +100,7 @@ public:
         ASSERT_WITH_SECURITY_IMPLICATION(canAccessIndexQuickly(i));
         unsigned namedLength = m_table->length();
         if (i < namedLength)
-            m_scope->variableAt(m_table->get(i)).set(vm, this, value);
+            m_scope->variableAt(m_table->get(i)).set(vm, m_scope.get(), value);
         else
             overflowStorage()[i - namedLength].set(vm, this, value);
     }
diff --git a/Source/PlatformQt.cmake b/Source/PlatformQt.cmake
index afd2c2c2a..1bab6fbe5 100644
--- a/Source/PlatformQt.cmake
+++ b/Source/PlatformQt.cmake
@@ -155,7 +155,7 @@ endif ()
 query_qmake(QT_INSTALL_DOCS QT_INSTALL_DOCS)
 set(QDOC_CONFIG "${CMAKE_SOURCE_DIR}/Source/qtwebkit.qdocconf")
 set(DOC_OUTPUT_DIR "${CMAKE_BINARY_DIR}/doc")
-set(PROJECT_VERSION_TAG ${PROJECT_VERSION_MAJOR}${PROJECT_VERSION_MINOR}${PROJECT_VERSION_MICRO})
+set(PROJECT_VERSION_TAG ${PROJECT_VERSION_MAJOR}${PROJECT_VERSION_MINOR}${PROJECT_VERSION_PATCH})
 
 if (KDE_INSTALL_USE_QT_SYS_PATHS)
     set(DOC_INSTALL_DIR ${QT_INSTALL_DOCS})
diff --git a/Source/WTF/wtf/win/WorkQueueWin.cpp b/Source/WTF/wtf/win/WorkQueueWin.cpp
index 6e61cde69..2b7074a9a 100644
--- a/Source/WTF/wtf/win/WorkQueueWin.cpp
+++ b/Source/WTF/wtf/win/WorkQueueWin.cpp
@@ -84,7 +84,8 @@ void WorkQueue::performWorkOnRegisteredWorkThread()
         m_workItemQueueLock.unlock();
         for (auto& workItem : workItemQueue) {
             workItem->function()();
-            deref();
+            // QTFIMXE: Fix reference leak https://bugs.webkit.org/show_bug.cgi?id=142471
+            //deref();
         }
         m_workItemQueueLock.lock();
     }
diff --git a/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp b/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
index 641e44d19..cb148f39a 100644
--- a/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
+++ b/Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
@@ -109,7 +109,7 @@ static String buildIndexStatement(const IDBKeyRangeData& keyRange, IndexedDB::Cu
 {
     StringBuilder builder;
 
-    builder.appendLiteral("SELECT rowid, key, value FROM IndexRecords WHERE indexID = ? AND key ");
+    builder.appendLiteral("SELECT rowid, key, value FROM IndexRecords WHERE indexID = ? AND objectStoreID = ? AND key ");
     if (!keyRange.lowerKey.isNull() && !keyRange.lowerOpen)
         builder.appendLiteral(">=");
     else
@@ -257,19 +257,26 @@ bool SQLiteIDBCursor::bindArguments()
 {
     LOG(IndexedDB, "Cursor is binding lower key '%s' and upper key '%s'", m_currentLowerKey.loggingString().utf8().data(), m_currentUpperKey.loggingString().utf8().data());
 
-    if (m_statement->bindInt64(1, m_boundID) != SQLITE_OK) {
+    int currentBindArgument = 1;
+
+    if (m_statement->bindInt64(currentBindArgument++, m_boundID) != SQLITE_OK) {
         LOG_ERROR("Could not bind id argument (bound ID)");
         return false;
     }
 
+    if (m_indexID != IDBIndexInfo::InvalidId && m_statement->bindInt64(currentBindArgument++, m_objectStoreID) != SQLITE_OK) {
+        LOG_ERROR("Could not bind object store id argument for an index cursor");
+        return false;
+    }
+
     RefPtr<SharedBuffer> buffer = serializeIDBKeyData(m_currentLowerKey);
-    if (m_statement->bindBlob(2, buffer->data(), buffer->size()) != SQLITE_OK) {
+    if (m_statement->bindBlob(currentBindArgument++, buffer->data(), buffer->size()) != SQLITE_OK) {
         LOG_ERROR("Could not create cursor statement (lower key)");
         return false;
     }
 
     buffer = serializeIDBKeyData(m_currentUpperKey);
-    if (m_statement->bindBlob(3, buffer->data(), buffer->size()) != SQLITE_OK) {
+    if (m_statement->bindBlob(currentBindArgument++, buffer->data(), buffer->size()) != SQLITE_OK) {
         LOG_ERROR("Could not create cursor statement (upper key)");
         return false;
     }
diff --git a/Source/WebCore/Modules/mediasource/SourceBuffer.cpp b/Source/WebCore/Modules/mediasource/SourceBuffer.cpp
index f4a6bfed2..baed631ea 100644
--- a/Source/WebCore/Modules/mediasource/SourceBuffer.cpp
+++ b/Source/WebCore/Modules/mediasource/SourceBuffer.cpp
@@ -1411,8 +1411,12 @@ void SourceBuffer::sourceBufferPrivateDidReceiveSample(SourceBufferPrivate*, Pas
         // 1.5 Let track buffer equal the track buffer that the coded frame will be added to.
         AtomicString trackID = sample->trackID();
         auto it = m_trackBufferMap.find(trackID);
-        if (it == m_trackBufferMap.end())
-            it = m_trackBufferMap.add(trackID, TrackBuffer()).iterator;
+        if (it == m_trackBufferMap.end()) {
+            // The client managed to append a sample with a trackID not present in the initialization
+            // segment. This would be a good place to post an message to the developer console.
+            didDropSample();
+            return;
+        }
         TrackBuffer& trackBuffer = it->value;
 
         // 1.6 ↳ If last decode timestamp for track buffer is set and decode timestamp is less than last
diff --git a/Source/WebCore/Resources/missingImage@2x.png b/Source/WebCore/Resources/missingImage@2x.png
new file mode 100644
index 000000000..059844d91
--- /dev/null
+++ b/Source/WebCore/Resources/missingImage@2x.png
diff --git a/Source/WebCore/Resources/missingImage@3x.png b/Source/WebCore/Resources/missingImage@3x.png
new file mode 100644
index 000000000..23a2dba00
--- /dev/null
+++ b/Source/WebCore/Resources/missingImage@3x.png
diff --git a/Source/WebCore/Resources/nullPlugin@2x.png b/Source/WebCore/Resources/nullPlugin@2x.png
new file mode 100644
index 000000000..ccc40188a
--- /dev/null
+++ b/Source/WebCore/Resources/nullPlugin@2x.png
diff --git a/Source/WebCore/Resources/textAreaResizeCorner@2x.png b/Source/WebCore/Resources/textAreaResizeCorner@2x.png
new file mode 100644
index 000000000..7d26fbc42
--- /dev/null
+++ b/Source/WebCore/Resources/textAreaResizeCorner@2x.png
diff --git a/Source/WebCore/WebCore.qrc b/Source/WebCore/WebCore.qrc
index 90561260a..9faaa1f91 100644
--- a/Source/WebCore/WebCore.qrc
+++ b/Source/WebCore/WebCore.qrc
@@ -1,8 +1,12 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource prefix="/webkit/resources">
     <file alias="missingImage.png">Resources/missingImage.png</file>
+    <file alias="missingImage@2x.png">Resources/missingImage@2x.png</file>
+    <file alias="missingImage@3x.png">Resources/missingImage@3x.png</file>
     <file alias="nullPlugin.png">Resources/nullPlugin.png</file>
+    <file alias="nullPlugin@2x.png">Resources/nullPlugin@2x.png</file>
     <file alias="textAreaResizeCorner.png">Resources/textAreaResizeCorner.png</file>
+    <file alias="textAreaResizeCorner@2x.png">Resources/textAreaResizeCorner@2x.png</file>
     <file alias="urlIcon.png">Resources/urlIcon.png</file>
     <file alias="zoomInCursor.png">Resources/zoomInCursor.png</file>
     <file alias="zoomOutCursor.png">Resources/zoomOutCursor.png</file>
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index 720567b70..6348c887a 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -2245,7 +2245,7 @@ private:
             uint32_t length;
             if (!read(length))
                 return JSValue();
-            if (m_end < ((uint8_t*)0) + length || m_ptr > m_end - length) {
+            if (static_cast<uint32_t>(m_end - m_ptr) < length) {
                 fail();
                 return JSValue();
             }
@@ -2253,8 +2253,17 @@ private:
                 m_ptr += length;
                 return jsNull();
             }
-            RefPtr<ImageData> result = ImageData::create(IntSize(width, height));
-            memcpy(result->data()->data(), m_ptr, length);
+            IntSize imageSize(width, height);
+            RELEASE_ASSERT(!length || imageSize.area() * 4 <= length);
+            RefPtr<ImageData> result = ImageData::create(imageSize);
+            if (!result) {
+                fail();
+                return JSValue();
+            }
+            if (length)
+                memcpy(result->data()->data(), m_ptr, length);
+            else
+                result->data()->zeroFill();
             m_ptr += length;
             return getJSValue(result.get());
         }
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index c7d87bb6c..f34a1c15f 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -475,15 +475,11 @@ Document::Document(Frame* frame, const URL& url, unsigned documentClasses, unsig
     , m_xmlStandalone(StandaloneUnspecified)
     , m_hasXMLDeclaration(false)
     , m_designMode(inherit)
-#if !ASSERT_DISABLED
-    , m_inInvalidateNodeListAndCollectionCaches(false)
-#endif
 #if ENABLE(DASHBOARD_SUPPORT)
     , m_hasAnnotatedRegions(false)
     , m_annotatedRegionsDirty(false)
 #endif
     , m_createRenderers(true)
-    , m_inPageCache(false)
     , m_accessKeyMapValid(false)
     , m_documentClasses(documentClasses)
     , m_isSynthesized(constructionFlags & Synthesized)
@@ -588,7 +584,7 @@ Document::~Document()
     allDocuments().remove(this);
 
     ASSERT(!renderView());
-    ASSERT(!m_inPageCache);
+    ASSERT(m_pageCacheState != InPageCache);
     ASSERT(m_ranges.isEmpty());
     ASSERT(!m_parentTreeScope);
     ASSERT(!m_disabledFieldsetElementsCount);
@@ -665,7 +661,7 @@ void Document::removedLastRef()
         // until after removeDetachedChildren returns, so we protect ourselves.
         incrementReferencingNodeCount();
 
-        prepareForDestruction();
+        RELEASE_ASSERT(!hasLivingRenderTree());
         // We must make sure not to be retaining any of our children through
         // these extra pointers or we will create a reference cycle.
         m_focusedElement = nullptr;
@@ -1993,7 +1989,7 @@ Ref<RenderStyle> Document::styleForElementIgnoringPendingStylesheets(Element& el
     ASSERT(&element.document() == this);
 
     // On iOS request delegates called during styleForElement may result in re-entering WebKit and killing the style resolver.
-    ResourceLoadSuspender suspender;
+    Style::PostResolutionCallbackDisabler disabler(*this);
 
     TemporaryChange<bool> change(m_ignorePendingStylesheets, true);
     return element.resolveStyle(parentStyle);
@@ -2197,7 +2193,7 @@ void Document::clearStyleResolver()
 void Document::createRenderTree()
 {
     ASSERT(!renderView());
-    ASSERT(!m_inPageCache);
+    ASSERT(m_pageCacheState != InPageCache);
     ASSERT(!m_axObjectCache || this != &topDocument());
 
     if (m_isNonRenderedPlaceholder)
@@ -2261,7 +2257,7 @@ void Document::disconnectFromFrame()
 void Document::destroyRenderTree()
 {
     ASSERT(hasLivingRenderTree());
-    ASSERT(!m_inPageCache);
+    ASSERT(m_pageCacheState != InPageCache);
 
     TemporaryChange<bool> change(m_renderTreeBeingDestroyed, true);
 
@@ -2377,6 +2373,11 @@ void Document::removeAllEventListeners()
 #endif
     for (Node* node = firstChild(); node; node = NodeTraversal::next(*node))
         node->removeAllEventListeners();
+
+#if ENABLE(TOUCH_EVENTS)
+    m_touchEventTargets = nullptr;
+#endif
+    m_wheelEventTargets = nullptr;
 }
 
 void Document::suspendDeviceMotionAndOrientationUpdates()
@@ -3719,7 +3720,7 @@ bool Document::setFocusedElement(Element* element, FocusDirection direction)
     if (m_focusedElement == newFocusedElement)
         return true;
 
-    if (m_inPageCache)
+    if (inPageCache())
         return false;
 
     bool focusChangeBlocked = false;
@@ -3870,9 +3871,7 @@ void Document::unregisterNodeListForInvalidation(LiveNodeList& list)
         return;
 
     list.setRegisteredForInvalidationAtDocument(false);
-    ASSERT(m_inInvalidateNodeListAndCollectionCaches
-        ? m_listsInvalidatedAtDocument.isEmpty()
-        : m_listsInvalidatedAtDocument.contains(&list));
+    ASSERT(m_listsInvalidatedAtDocument.contains(&list));
     m_listsInvalidatedAtDocument.remove(&list);
 }
 
@@ -4539,17 +4538,18 @@ URL Document::completeURL(const String& url) const
     return completeURL(url, m_baseURL);
 }
 
-void Document::setInPageCache(bool flag)
+void Document::setPageCacheState(PageCacheState state)
 {
-    if (m_inPageCache == flag)
+    if (m_pageCacheState == state)
         return;
 
-    m_inPageCache = flag;
+    m_pageCacheState = state;
 
     FrameView* v = view();
     Page* page = this->page();
 
-    if (flag) {
+    switch (state) {
+    case InPageCache:
         if (v) {
             // FIXME: There is some scrolling related work that needs to happen whenever a page goes into the
             // page cache and similar work that needs to occur when it comes out. This is where we do the work
@@ -4571,9 +4571,13 @@ void Document::setInPageCache(bool flag)
         clearStyleResolver();
         clearSelectorQueryCache();
         clearSharedObjectPool();
-    } else {
+        break;
+    case NotInPageCache:
         if (childNeedsStyleRecalc())
             scheduleStyleRecalc();
+        break;
+    case AboutToEnterPageCache:
+        break;
     }
 }
 
@@ -4859,7 +4863,7 @@ Document& Document::topDocument() const
 {
     // FIXME: This special-casing avoids incorrectly determined top documents during the process
     // of AXObjectCache teardown or notification posting for cached or being-destroyed documents.
-    if (!m_inPageCache && !m_renderTreeBeingDestroyed) {
+    if (!inPageCache() && !m_renderTreeBeingDestroyed) {
         if (!m_frame)
             return const_cast<Document&>(*this);
         // This should always be non-null.
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index cd35b20e6..51b2e84db 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -995,8 +995,13 @@ public:
 
     void finishedParsing();
 
-    bool inPageCache() const { return m_inPageCache; }
-    void setInPageCache(bool flag);
+    enum PageCacheState { NotInPageCache, AboutToEnterPageCache, InPageCache };
+
+    PageCacheState pageCacheState() const { return m_pageCacheState; }
+    void setPageCacheState(PageCacheState);
+
+    // FIXME: Update callers to use pageCacheState() instead.
+    bool inPageCache() const { return m_pageCacheState != NotInPageCache; }
 
     // Elements can register themselves for the "suspend()" and
     // "resume()" callbacks
@@ -1566,10 +1571,6 @@ private:
 
     HashSet<LiveNodeList*> m_listsInvalidatedAtDocument;
     HashSet<HTMLCollection*> m_collectionsInvalidatedAtDocument;
-#if !ASSERT_DISABLED
-    bool m_inInvalidateNodeListAndCollectionCaches;
-#endif
-
     unsigned m_nodeListAndCollectionCounts[numNodeListInvalidationTypes];
 
     RefPtr<XPathEvaluator> m_xpathEvaluator;
@@ -1585,7 +1586,7 @@ private:
     HashMap<String, RefPtr<HTMLCanvasElement>> m_cssCanvasElements;
 
     bool m_createRenderers;
-    bool m_inPageCache;
+    PageCacheState m_pageCacheState { NotInPageCache };
 
     HashSet<Element*> m_documentSuspensionCallbackElements;
     HashSet<Element*> m_mediaVolumeCallbackElements;
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index cd85ae496..31390fb64 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -481,6 +481,19 @@ const AtomicString& Element::getAttribute(const QualifiedName& name) const
     return nullAtom;
 }
 
+Vector<String> Element::getAttributeNames() const
+{
+    Vector<String> attributesVector;
+    if (!hasAttributes())
+        return attributesVector;
+
+    auto attributes = attributesIterator();
+    attributesVector.reserveInitialCapacity(attributes.attributeCount());
+    for (auto& attribute : attributes)
+        attributesVector.uncheckedAppend(attribute.name().toString());
+    return attributesVector;
+}
+
 bool Element::isFocusable() const
 {
     if (!inDocument() || !supportsFocus())
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index eb6fe946a..b77dbdd06 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2016 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -70,6 +70,7 @@ public:
     void setAttributeWithoutSynchronization(const QualifiedName&, const AtomicString& value);
     void setSynchronizedLazyAttribute(const QualifiedName&, const AtomicString& value);
     bool removeAttribute(const QualifiedName&);
+    Vector<String> getAttributeNames() const;
 
     // Typed getters and setters for language bindings.
     int getIntegralAttribute(const QualifiedName& attributeName) const;
@@ -140,6 +141,8 @@ public:
     // to the render layer and merge bindingsOffsetParent and offsetParent.
     Element* bindingsOffsetParent();
 
+    const Element* rootElement() const;
+
     Element* offsetParent();
     double clientLeft();
     double clientTop();
@@ -631,6 +634,17 @@ inline Element* Node::parentElement() const
     return is<Element>(parent) ? downcast<Element>(parent) : nullptr;
 }
 
+inline const Element* Element::rootElement() const
+{
+    if (inDocument())
+        return document().documentElement();
+
+    const Element* highest = this;
+    while (highest->parentElement())
+        highest = highest->parentElement();
+    return highest;
+}
+
 inline bool Element::fastHasAttribute(const QualifiedName& name) const
 {
     ASSERT(fastAttributeLookupAllowed(name));
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index f3455bb2b..9cea9ceb0 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -109,6 +109,8 @@
     void blur();
     void scrollIntoView(optional boolean alignWithTop);
 
+    sequence<DOMString> getAttributeNames();
+
     // WebKit extensions
 
     void scrollIntoViewIfNeeded(optional boolean centerIfNeeded);
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index be23d49f2..60030edaf 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -812,19 +812,15 @@ bool Document::shouldInvalidateNodeListAndCollectionCaches(const QualifiedName*
 
 void Document::invalidateNodeListAndCollectionCaches(const QualifiedName* attrName)
 {
-#if !ASSERT_DISABLED
-    m_inInvalidateNodeListAndCollectionCaches = true;
-#endif
-    HashSet<LiveNodeList*> lists = WTFMove(m_listsInvalidatedAtDocument);
-    m_listsInvalidatedAtDocument.clear();
+    Vector<LiveNodeList*, 8> lists;
+    copyToVector(m_listsInvalidatedAtDocument, lists);
     for (auto* list : lists)
         list->invalidateCacheForAttribute(attrName);
-    HashSet<HTMLCollection*> collections = WTFMove(m_collectionsInvalidatedAtDocument);
+
+    Vector<HTMLCollection*, 8> collections;
+    copyToVector(m_collectionsInvalidatedAtDocument, collections);
     for (auto* collection : collections)
         collection->invalidateCacheForAttribute(attrName);
-#if !ASSERT_DISABLED
-    m_inInvalidateNodeListAndCollectionCaches = false;
-#endif
 }
 
 void Node::invalidateNodeListAndCollectionCachesInAncestors(const QualifiedName* attrName, Element* attributeOwnerElement)
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 118ce36f9..cb4b156f2 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -865,7 +865,7 @@ void DeleteSelectionCommand::doApply()
         Node* node = m_endingPosition.deprecatedNode();
         if (is<Text>(node)) {
             Text& textNode = downcast<Text>(*node);
-            if (textNode.length())
+            if (textNode.length() && textNode.renderer())
                 shouldRebalaceWhiteSpace = textNode.renderer()->style().textSecurity() == TSNONE;
         }        
     }
diff --git a/Source/WebCore/history/CachedFrame.cpp b/Source/WebCore/history/CachedFrame.cpp
index 29dbe9a59..1343355e8 100644
--- a/Source/WebCore/history/CachedFrame.cpp
+++ b/Source/WebCore/history/CachedFrame.cpp
@@ -263,7 +263,7 @@ void CachedFrame::destroy()
     // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
     m_document->removeAllEventListeners();
 
-    m_document->setInPageCache(false);
+    m_document->setPageCacheState(Document::NotInPageCache);
     m_document->prepareForDestruction();
 
     clear();
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index 84ded8cce..23749bbee 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -356,11 +356,11 @@ static String pruningReasonToDiagnosticLoggingKey(PruningReason pruningReason)
     return emptyString();
 }
 
-static void setInPageCache(Page& page, bool isInPageCache)
+static void setPageCacheState(Page& page, Document::PageCacheState pageCacheState)
 {
     for (Frame* frame = &page.mainFrame(); frame; frame = frame->tree().traverseNext()) {
         if (auto* document = frame->document())
-            document->setInPageCache(isInPageCache);
+            document->setPageCacheState(pageCacheState);
     }
 }
 
@@ -390,8 +390,7 @@ void PageCache::addIfCacheable(HistoryItem& item, Page* page)
     if (!page || !canCache(*page))
         return;
 
-    // Make sure all the documents know they are being added to the PageCache.
-    setInPageCache(*page, true);
+    setPageCacheState(*page, Document::AboutToEnterPageCache);
 
     // Focus the main frame, defocusing a focused subframe (if we have one). We do this here,
     // before the page enters the page cache, while we still can dispatch DOM blur/focus events.
@@ -404,10 +403,12 @@ void PageCache::addIfCacheable(HistoryItem& item, Page* page)
     // Check that the page is still page-cacheable after firing the pagehide event. The JS event handlers
     // could have altered the page in a way that could prevent caching.
     if (!canCache(*page)) {
-        setInPageCache(*page, false);
+        setPageCacheState(*page, Document::NotInPageCache);
         return;
     }
 
+    setPageCacheState(*page, Document::InPageCache);
+
     // Make sure we no longer fire any JS events past this point.
     NoEventDispatchAssertion assertNoEventDispatch;
 
diff --git a/Source/WebCore/html/FormAssociatedElement.cpp b/Source/WebCore/html/FormAssociatedElement.cpp
index 759390435..bb90fd402 100644
--- a/Source/WebCore/html/FormAssociatedElement.cpp
+++ b/Source/WebCore/html/FormAssociatedElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2016 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -75,6 +75,9 @@ void FormAssociatedElement::insertedInto(ContainerNode& insertionPoint)
         m_formSetByParser = nullptr;
     }
 
+    if (m_form && element.rootElement() != m_form->rootElement())
+        setForm(nullptr);
+
     if (!insertionPoint.inDocument())
         return;
 
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 8ea5b0381..0e80f23e7 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -676,7 +676,7 @@ void HTMLCanvasElement::createImageBuffer() const
         QWebPageClient* client = document().page()->chrome().platformPageClient();
         // The WebKit2 Chrome does not have a pageclient.
         QOpenGLContext* context = client ? client->openGLContextIfAvailable() : 0;
-        setImageBuffer(ImageBuffer::createCompatibleBuffer(size(), 1.0f, ColorSpaceDeviceRGB, context));
+        setImageBuffer(ImageBuffer::createCompatibleBuffer(size(), ColorSpaceDeviceRGB, context));
     } else
 #endif
     {
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 686576d51..55f9391f0 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2010, 2012-2016 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -46,6 +46,7 @@
 #include "Page.h"
 #include "RenderTextControl.h"
 #include "ScriptController.h"
+#include "SetForScope.h"
 #include "Settings.h"
 #include <limits>
 #include <wtf/Ref.h>
@@ -56,13 +57,6 @@ using namespace HTMLNames;
 
 HTMLFormElement::HTMLFormElement(const QualifiedName& tagName, Document& document)
     : HTMLElement(tagName, document)
-    , m_associatedElementsBeforeIndex(0)
-    , m_associatedElementsAfterIndex(0)
-    , m_wasUserSubmitted(false)
-    , m_isSubmittingOrPreparingForSubmission(false)
-    , m_shouldSubmit(false)
-    , m_isInResetFunction(false)
-    , m_wasDemoted(false)
 #if ENABLE(REQUEST_AUTOCOMPLETE)
     , m_requestAutocompletetimer(*this, &HTMLFormElement::requestAutocompleteTimerFired)
 #endif
@@ -372,19 +366,30 @@ void HTMLFormElement::reset()
     if (m_isInResetFunction || !frame)
         return;
 
-    m_isInResetFunction = true;
+    Ref<HTMLFormElement> protectedThis(*this);
 
-    if (!dispatchEvent(Event::create(eventNames().resetEvent, true, true))) {
-        m_isInResetFunction = false;
+    SetForScope<bool> isInResetFunctionRestorer(m_isInResetFunction, true);
+
+    if (!dispatchEvent(Event::create(eventNames().resetEvent, true, true)))
         return;
-    }
 
-    for (auto& associatedElement : m_associatedElements) {
-        if (is<HTMLFormControlElement>(*associatedElement))
-            downcast<HTMLFormControlElement>(*associatedElement).reset();
-    }
+    resetAssociatedFormControlElements();
+}
 
-    m_isInResetFunction = false;
+void HTMLFormElement::resetAssociatedFormControlElements()
+{
+    // Event handling can cause associated elements to be added or deleted while iterating
+    // over this collection. Protect these elements until we are done notifying them of
+    // the reset operation.
+    Vector<Ref<HTMLFormControlElement>> associatedFormControlElements;
+    associatedFormControlElements.reserveInitialCapacity(m_associatedElements.size());
+    for (auto* element : m_associatedElements) {
+        if (is<HTMLFormControlElement>(element))
+            associatedFormControlElements.uncheckedAppend(*downcast<HTMLFormControlElement>(element));
+    }
+    
+    for (auto& associatedFormControlElement : associatedFormControlElements)
+        associatedFormControlElement->reset();
 }
 
 #if ENABLE(IOS_AUTOCORRECT_AND_AUTOCAPITALIZE)
@@ -821,10 +826,9 @@ void HTMLFormElement::resumeFromDocumentSuspension()
 {
     ASSERT(!shouldAutocomplete());
 
-    for (auto& associatedElement : m_associatedElements) {
-        if (is<HTMLFormControlElement>(*associatedElement))
-            downcast<HTMLFormControlElement>(*associatedElement).reset();
-    }
+    Ref<HTMLFormElement> protectedThis(*this);
+
+    resetAssociatedFormControlElements();
 }
 
 void HTMLFormElement::didMoveToNewDocument(Document* oldDocument)
diff --git a/Source/WebCore/html/HTMLFormElement.h b/Source/WebCore/html/HTMLFormElement.h
index 90198b613..b27576a5c 100644
--- a/Source/WebCore/html/HTMLFormElement.h
+++ b/Source/WebCore/html/HTMLFormElement.h
@@ -177,6 +177,8 @@ private:
     virtual bool matchesValidPseudoClass() const override;
     virtual bool matchesInvalidPseudoClass() const override;
 
+    void resetAssociatedFormControlElements();
+
     typedef HashMap<RefPtr<AtomicStringImpl>, FormNamedItem*> PastNamesMap;
 
     FormSubmission::Attributes m_attributes;
@@ -184,19 +186,19 @@ private:
 
     CheckedRadioButtons m_checkedRadioButtons;
 
-    unsigned m_associatedElementsBeforeIndex;
-    unsigned m_associatedElementsAfterIndex;
+    unsigned m_associatedElementsBeforeIndex { 0 };
+    unsigned m_associatedElementsAfterIndex { 0 };
     Vector<FormAssociatedElement*> m_associatedElements;
     Vector<HTMLImageElement*> m_imageElements;
     HashSet<const HTMLFormControlElement*> m_invalidAssociatedFormControls;
 
-    bool m_wasUserSubmitted;
-    bool m_isSubmittingOrPreparingForSubmission;
-    bool m_shouldSubmit;
+    bool m_wasUserSubmitted { false };
+    bool m_isSubmittingOrPreparingForSubmission { false };
+    bool m_shouldSubmit { false };
 
-    bool m_isInResetFunction;
+    bool m_isInResetFunction { false };
 
-    bool m_wasDemoted;
+    bool m_wasDemoted { false };
 
 #if ENABLE(REQUEST_AUTOCOMPLETE)
     void requestAutocompleteTimerFired();
diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
index 488c4e6af..67675c595 100644
--- a/Source/WebCore/html/HTMLImageElement.cpp
+++ b/Source/WebCore/html/HTMLImageElement.cpp
@@ -38,6 +38,7 @@
 #include "MIMETypeRegistry.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
+#include "NodeTraversal.h"
 #include "Page.h"
 #include "RenderImage.h"
 #include "Settings.h"
@@ -303,6 +304,11 @@ Node::InsertionNotificationRequest HTMLImageElement::insertedInto(ContainerNode&
         m_form->registerImgElement(this);
     }
 
+    if (m_form && rootElement() != m_form->rootElement()) {
+        m_form->removeImgElement(this);
+        m_form = nullptr;
+    }
+
     if (!m_form) {
         m_form = HTMLFormElement::findClosestFormAncestor(*this);
         if (m_form)
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 3d3f8ab76..3d15dfa9e 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -3608,6 +3608,7 @@ void HTMLMediaElement::removeAudioTrack(AudioTrack* track)
         return;
 
     m_audioTracks->remove(track);
+    track->clearClient();
 }
 
 void HTMLMediaElement::removeTextTrack(TextTrack* track, bool scheduleEvent)
@@ -3631,6 +3632,7 @@ void HTMLMediaElement::removeVideoTrack(VideoTrack* track)
         return;
 
     m_videoTracks->remove(track);
+    track->clearClient();
 }
 
 void HTMLMediaElement::forgetResourceSpecificTracks()
diff --git a/Source/WebCore/html/ImageInputType.cpp b/Source/WebCore/html/ImageInputType.cpp
index beb105dab..8b1a7e099 100644
--- a/Source/WebCore/html/ImageInputType.cpp
+++ b/Source/WebCore/html/ImageInputType.cpp
@@ -109,6 +109,9 @@ RenderPtr<RenderElement> ImageInputType::createInputRenderer(Ref<RenderStyle>&&
 
 void ImageInputType::altAttributeChanged()
 {
+    if (!is<RenderImage>(element().renderer()))
+        return;
+
     auto* renderer = downcast<RenderImage>(element().renderer());
     if (!renderer)
         return;
diff --git a/Source/WebCore/html/parser/HTMLSourceTracker.cpp b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
index 0c9a04632..783047b7b 100644
--- a/Source/WebCore/html/parser/HTMLSourceTracker.cpp
+++ b/Source/WebCore/html/parser/HTMLSourceTracker.cpp
@@ -49,6 +49,7 @@ void HTMLSourceTracker::startToken(SegmentedString& currentInput, HTMLTokenizer&
 
     m_currentSource = currentInput;
     m_tokenStart = m_currentSource.numberOfCharactersConsumed() - m_previousSource.length();
+    tokenizer.setTokenAttributeBaseOffset(m_tokenStart);
 }
 
 void HTMLSourceTracker::endToken(SegmentedString& currentInput, HTMLTokenizer& tokenizer)
@@ -92,7 +93,7 @@ String HTMLSourceTracker::source(const HTMLToken& token)
 
 String HTMLSourceTracker::source(const HTMLToken& token, unsigned attributeStart, unsigned attributeEnd)
 {
-    return source(token).substring(attributeStart - m_tokenStart, attributeEnd - attributeStart);
+    return source(token).substring(attributeStart, attributeEnd - attributeStart);
 }
 
 }
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index ee87edc6c..0ec9359bd 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -112,6 +112,9 @@ public:
 
     void setSelfClosing();
 
+    // Used by HTMLTokenizer on behalf of HTMLSourceTracker.
+    void setAttributeBaseOffset(unsigned attributeBaseOffset) { m_attributeBaseOffset = attributeBaseOffset; }
+
 public:
     // Used by the XSSAuditor to nuke XSS-laden attributes.
     void eraseValueOfAttribute(unsigned index);
@@ -151,6 +154,8 @@ private:
 
     // For DOCTYPE
     std::unique_ptr<DoctypeData> m_doctypeData;
+
+    unsigned m_attributeBaseOffset { 0 }; // Changes across document.write() boundaries.
 };
 
 const HTMLToken::Attribute* findAttribute(const Vector<HTMLToken::Attribute>&, StringView name);
@@ -313,14 +318,14 @@ inline void HTMLToken::beginAttribute(unsigned offset)
     m_attributes.grow(m_attributes.size() + 1);
     m_currentAttribute = &m_attributes.last();
 
-    m_currentAttribute->startOffset = offset;
+    m_currentAttribute->startOffset = offset - m_attributeBaseOffset;
 }
 
 inline void HTMLToken::endAttribute(unsigned offset)
 {
     ASSERT(offset);
     ASSERT(m_currentAttribute);
-    m_currentAttribute->endOffset = offset;
+    m_currentAttribute->endOffset = offset - m_attributeBaseOffset;
 #if !ASSERT_DISABLED
     m_currentAttribute = nullptr;
 #endif
diff --git a/Source/WebCore/html/parser/HTMLTokenizer.h b/Source/WebCore/html/parser/HTMLTokenizer.h
index fed21188d..bbf5cdb9b 100644
--- a/Source/WebCore/html/parser/HTMLTokenizer.h
+++ b/Source/WebCore/html/parser/HTMLTokenizer.h
@@ -43,6 +43,9 @@ public:
     class TokenPtr;
     TokenPtr nextToken(SegmentedString&);
 
+    // Used by HTMLSourceTracker.
+    void setTokenAttributeBaseOffset(unsigned);
+
     // Returns a copy of any characters buffered internally by the tokenizer.
     // The tokenizer buffers characters when searching for the </script> token that terminates a script element.
     String bufferedCharacters() const;
@@ -282,6 +285,11 @@ inline HTMLTokenizer::TokenPtr HTMLTokenizer::nextToken(SegmentedString& source)
     return TokenPtr(processToken(source) ? &m_token : nullptr);
 }
 
+inline void HTMLTokenizer::setTokenAttributeBaseOffset(unsigned offset)
+{
+    m_token.setAttributeBaseOffset(offset);
+}
+
 inline size_t HTMLTokenizer::numberOfBufferedCharacters() const
 {
     // Notice that we add 2 to the length of the m_temporaryBuffer to
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index 63cf08d01..731d2e844 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -401,8 +401,12 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur
     ResourceError error;
     ResourceResponse response;
     unsigned long identifier = std::numeric_limits<unsigned long>::max();
-    if (m_document.frame())
-        identifier = m_document.frame()->loader().loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy(), error, response, data);
+    if (m_document.frame()) {
+        auto& frameLoader = m_document.frame()->loader();
+        if (!frameLoader.mixedContentChecker().canRunInsecureContent(m_document.securityOrigin(), requestURL))
+            return;
+        identifier = frameLoader.loadResourceSynchronously(request, m_options.allowCredentials(), m_options.clientCredentialPolicy(), error, response, data);
+    }
 
     if (!error.isNull() && response.httpStatusCode() <= 0) {
         if (requestURL.isLocalFile()) {
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 5ca806300..705b0f5a5 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -1579,7 +1579,7 @@ void FrameLoader::reload(bool endToEndReload, bool contentBlockersEnabled)
 
 void FrameLoader::stopAllLoaders(ClearProvisionalItemPolicy clearProvisionalItemPolicy)
 {
-    ASSERT(!m_frame.document() || !m_frame.document()->inPageCache());
+    ASSERT(!m_frame.document() || m_frame.document()->pageCacheState() != Document::InPageCache);
     if (m_pageDismissalEventBeingDispatched != PageDismissalType::None)
         return;
 
@@ -2081,7 +2081,7 @@ void FrameLoader::open(CachedFrameBase& cachedFrame)
 
     clear(document, true, true, cachedFrame.isMainFrame());
 
-    document->setInPageCache(false);
+    document->setPageCacheState(Document::NotInPageCache);
 
     m_needsClear = true;
     m_isComplete = false;
@@ -3100,6 +3100,8 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
     if (!mainFrame)
         return;
 
+    mainFrame->loader().forceSandboxFlags(frame->loader().effectiveSandboxFlags());
+
     if (frameName != "_blank")
         mainFrame->tree().setName(frameName);
 
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index d087341c8..a98f369db 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -227,7 +227,7 @@ public:
 
     bool checkIfFormActionAllowedByCSP(const URL&) const;
 
-    Frame* opener();
+    WEBCORE_EXPORT Frame* opener();
     WEBCORE_EXPORT void setOpener(Frame*);
 
     void resetMultipleFormSubmissionProtection();
diff --git a/Source/WebCore/loader/FrameLoaderStateMachine.h b/Source/WebCore/loader/FrameLoaderStateMachine.h
index de7f7f835..f2ae631d7 100644
--- a/Source/WebCore/loader/FrameLoaderStateMachine.h
+++ b/Source/WebCore/loader/FrameLoaderStateMachine.h
@@ -55,7 +55,7 @@ public:
     WEBCORE_EXPORT bool committingFirstRealLoad() const;
     bool committedFirstRealDocumentLoad() const;
     bool creatingInitialEmptyDocument() const;
-    bool isDisplayingInitialEmptyDocument() const;
+    WEBCORE_EXPORT bool isDisplayingInitialEmptyDocument() const;
     WEBCORE_EXPORT bool firstLayoutDone() const;
     void advanceTo(State);
 
diff --git a/Source/WebCore/loader/HistoryController.cpp b/Source/WebCore/loader/HistoryController.cpp
index a33287d41..8f7efe81b 100644
--- a/Source/WebCore/loader/HistoryController.cpp
+++ b/Source/WebCore/loader/HistoryController.cpp
@@ -265,7 +265,7 @@ void HistoryController::invalidateCurrentItemCachedPage()
     
     ASSERT(cachedPage->document() == m_frame.document());
     if (cachedPage->document() == m_frame.document()) {
-        cachedPage->document()->setInPageCache(false);
+        cachedPage->document()->setPageCacheState(Document::NotInPageCache);
         cachedPage->clear();
     }
 }
diff --git a/Source/WebCore/loader/LoaderStrategy.cpp b/Source/WebCore/loader/LoaderStrategy.cpp
index 7fe7631a2..75aae4285 100644
--- a/Source/WebCore/loader/LoaderStrategy.cpp
+++ b/Source/WebCore/loader/LoaderStrategy.cpp
@@ -34,16 +34,6 @@ LoaderStrategy::~LoaderStrategy()
 {
 }
 
-ResourceLoadSuspender::ResourceLoadSuspender()
-{
-    platformStrategies()->loaderStrategy()->suspendPendingRequests();
-}
-
-ResourceLoadSuspender::~ResourceLoadSuspender()
-{
-    platformStrategies()->loaderStrategy()->resumePendingRequests();
-}
-
 } // namespace WebCore
 
 
diff --git a/Source/WebCore/loader/LoaderStrategy.h b/Source/WebCore/loader/LoaderStrategy.h
index 35c0494c5..d01705ca8 100644
--- a/Source/WebCore/loader/LoaderStrategy.h
+++ b/Source/WebCore/loader/LoaderStrategy.h
@@ -65,12 +65,6 @@ protected:
     virtual ~LoaderStrategy();
 };
 
-class ResourceLoadSuspender {
-public:
-    ResourceLoadSuspender();
-    ~ResourceLoadSuspender();
-};
-
 } // namespace WebCore
 
 #endif // LoaderStrategy_h
diff --git a/Source/WebCore/loader/WorkerThreadableLoader.cpp b/Source/WebCore/loader/WorkerThreadableLoader.cpp
index bac254f35..4f263c4b3 100644
--- a/Source/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/Source/WebCore/loader/WorkerThreadableLoader.cpp
@@ -97,7 +97,8 @@ WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<Threadable
 
     ASSERT(securityOrigin);
     ASSERT(contentSecurityPolicy);
-    auto* contentSecurityPolicyCopy = std::make_unique<ContentSecurityPolicy>(*securityOrigin).release();
+
+    auto* contentSecurityPolicyCopy = std::make_unique<ContentSecurityPolicy>(securityOrigin->isolatedCopy()).release();
     contentSecurityPolicyCopy->copyStateFrom(contentSecurityPolicy);
 
     StringCapture capturedOutgoingReferrer(outgoingReferrer);
diff --git a/Source/WebCore/loader/icon/IconDatabaseBase.h b/Source/WebCore/loader/icon/IconDatabaseBase.h
index 025465304..35d20839c 100644
--- a/Source/WebCore/loader/icon/IconDatabaseBase.h
+++ b/Source/WebCore/loader/icon/IconDatabaseBase.h
@@ -27,6 +27,7 @@
 #define IconDatabaseBase_h
 
 #include "NativeImagePtr.h"
+#include "SharedBuffer.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassRefPtr.h>
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 9bc231ca2..e907b7df2 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -2183,9 +2183,9 @@ PassRefPtr<DOMWindow> DOMWindow::open(const String& urlString, const AtomicStrin
 #endif
 
     if (!firstWindow.allowPopUp()) {
-        // Because FrameTree::find() returns true for empty strings, we must check for empty frame names.
+        // Because FrameTree::findFrameForNavigation() returns true for empty strings, we must check for empty frame names.
         // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-        if (frameName.isEmpty() || !m_frame->tree().find(frameName))
+        if (frameName.isEmpty() || !m_frame->loader().findFrameForNavigation(frameName, activeDocument))
             return nullptr;
     }
 
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index b1b84a462..9315237af 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -245,7 +245,7 @@ void Frame::setView(RefPtr<FrameView>&& view)
     // Prepare for destruction now, so any unload event handlers get run and the DOMWindow is
     // notified. If we wait until the view is destroyed, then things won't be hooked up enough for
     // these calls to work.
-    if (!view && m_doc && !m_doc->inPageCache())
+    if (!view && m_doc && m_doc->pageCacheState() != Document::InPageCache)
         m_doc->prepareForDestruction();
     
     if (m_view)
@@ -267,7 +267,7 @@ void Frame::setDocument(RefPtr<Document>&& newDocument)
 {
     ASSERT(!newDocument || newDocument->frame() == this);
 
-    if (m_doc && !m_doc->inPageCache())
+    if (m_doc && m_doc->pageCacheState() != Document::InPageCache)
         m_doc->prepareForDestruction();
 
     m_doc = newDocument.copyRef();
diff --git a/Source/WebCore/page/History.cpp b/Source/WebCore/page/History.cpp
index d4f184ced..ff6458962 100644
--- a/Source/WebCore/page/History.cpp
+++ b/Source/WebCore/page/History.cpp
@@ -143,7 +143,8 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
 {
     // Each unique main-frame document is only allowed to send 64mb of state object payload to the UI client/process.
     static uint32_t totalStateObjectPayloadLimit = 0x4000000;
-    static unsigned perUserGestureStateObjectLimit = 100;
+    static double stateObjectTimeSpan = 30.0;
+    static unsigned perStateObjectTimeSpanLimit = 100;
 
     if (!m_frame || !m_frame->page())
         return;
@@ -173,33 +174,21 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
     if (!mainHistory)
         return;
 
-    bool processingUserGesture = ScriptController::processingUserGesture();
-    if (!processingUserGesture && mainHistory->m_nonUserGestureObjectsAdded >= perUserGestureStateObjectLimit) {
+    double currentTimestamp = currentTime();
+    if (currentTimestamp - mainHistory->m_currentStateObjectTimeSpanStart > stateObjectTimeSpan) {
+        mainHistory->m_currentStateObjectTimeSpanStart = currentTimestamp;
+        mainHistory->m_currentStateObjectTimeSpanObjectsAdded = 0;
+    }
+    
+    if (mainHistory->m_currentStateObjectTimeSpanObjectsAdded >= perStateObjectTimeSpanLimit) {
         ec.code = SECURITY_ERR;
         if (stateObjectType == StateObjectType::Replace)
-            ec.message = String::format("Attempt to use history.replaceState() more than %u times without a user gesture", perUserGestureStateObjectLimit);
+            ec.message = String::format("Attempt to use history.replaceState() more than %u times per %f seconds", perStateObjectTimeSpanLimit, stateObjectTimeSpan);
         else
-            ec.message = String::format("Attempt to use history.pushState() more than %u times without a user gesture", perUserGestureStateObjectLimit);
+            ec.message = String::format("Attempt to use history.pushState() more than %u times per %f seconds", perStateObjectTimeSpanLimit, stateObjectTimeSpan);
         return;
     }
 
-    double userGestureTimestamp = mainDocument->lastHandledUserGestureTimestamp();
-    if (processingUserGesture) {
-        if (mainHistory->m_currentUserGestureTimestamp < userGestureTimestamp) {
-            mainHistory->m_currentUserGestureTimestamp = userGestureTimestamp;
-            mainHistory->m_currentUserGestureObjectsAdded = 0;
-        }
-
-        if (mainHistory->m_currentUserGestureObjectsAdded >= perUserGestureStateObjectLimit) {
-            ec.code = SECURITY_ERR;
-            if (stateObjectType == StateObjectType::Replace)
-                ec.message = String::format("Attempt to use history.replaceState() more than %u times per gesture", perUserGestureStateObjectLimit);
-            else
-                ec.message = String::format("Attempt to use history.pushState() more than %u times per user gesture", perUserGestureStateObjectLimit);
-            return;
-        }
-    }
-
     Checked<unsigned> titleSize = title.length();
     titleSize *= 2;
 
@@ -228,10 +217,7 @@ void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const Str
     m_mostRecentStateObjectUsage = payloadSize.unsafeGet();
 
     mainHistory->m_totalStateObjectUsage = newTotalUsage.unsafeGet();
-    if (processingUserGesture)
-        ++mainHistory->m_currentUserGestureObjectsAdded;
-    else
-        ++mainHistory->m_nonUserGestureObjectsAdded;
+    ++mainHistory->m_currentStateObjectTimeSpanObjectsAdded;
 
     if (!urlString.isEmpty())
         m_frame->document()->updateURLForPushOrReplaceState(fullURL);
diff --git a/Source/WebCore/page/History.h b/Source/WebCore/page/History.h
index ae37fc387..7e2a246f7 100644
--- a/Source/WebCore/page/History.h
+++ b/Source/WebCore/page/History.h
@@ -73,9 +73,8 @@ private:
 
     RefPtr<SerializedScriptValue> m_lastStateObjectRequested;
 
-    unsigned m_nonUserGestureObjectsAdded { 0 };
-    unsigned m_currentUserGestureObjectsAdded { 0 };
-    double m_currentUserGestureTimestamp { 0 };
+    unsigned m_currentStateObjectTimeSpanObjectsAdded { 0 };
+    double m_currentStateObjectTimeSpanStart { 0.0 };
 
     // For the main frame's History object to keep track of all state object usage.
     uint64_t m_totalStateObjectUsage { 0 };
diff --git a/Source/WebCore/page/scrolling/ScrollingStateTree.cpp b/Source/WebCore/page/scrolling/ScrollingStateTree.cpp
index 3bec4360c..2a6cd8bea 100644
--- a/Source/WebCore/page/scrolling/ScrollingStateTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingStateTree.cpp
@@ -83,21 +83,33 @@ PassRefPtr<ScrollingStateNode> ScrollingStateTree::createNode(ScrollingNodeType
     return nullptr;
 }
 
+bool ScrollingStateTree::nodeTypeAndParentMatch(ScrollingStateNode& node, ScrollingNodeType nodeType, ScrollingNodeID parentID) const
+{
+    if (node.nodeType() != nodeType)
+        return false;
+
+    ScrollingStateNode* parent = stateNodeForID(parentID);
+    if (!parent)
+        return true;
+
+    return node.parent() == parent;
+}
+
 ScrollingNodeID ScrollingStateTree::attachNode(ScrollingNodeType nodeType, ScrollingNodeID newNodeID, ScrollingNodeID parentID)
 {
     ASSERT(newNodeID);
-    if (ScrollingStateNode* node = stateNodeForID(newNodeID)) {
-        if (!parentID)
-            return newNodeID;
 
-        ScrollingStateNode* parent = stateNodeForID(parentID);
-        if (!parent)
+    if (ScrollingStateNode* node = stateNodeForID(newNodeID)) {
+        if (nodeTypeAndParentMatch(*node, nodeType, parentID))
             return newNodeID;
 
-        if (node->parent() == parent)
-            return newNodeID;
+#if ENABLE(ASYNC_SCROLLING)
+        // If the type has changed, we need to destroy and recreate the node with a new ID.
+        if (nodeType != node->nodeType())
+            newNodeID = m_scrollingCoordinator->uniqueScrollLayerID();
+#endif
 
-        // The node is being re-parented. To do that, we'll remove it, and then re-create a new node.
+        // The node is being re-parented. To do that, we'll remove it, and then create a new node.
         removeNodeAndAllDescendants(node, SubframeNodeRemoval::Orphan);
     }
 
@@ -236,7 +248,7 @@ void ScrollingStateTree::setRemovedNodes(HashSet<ScrollingNodeID> nodes)
     m_nodesRemovedSinceLastCommit = WTFMove(nodes);
 }
 
-ScrollingStateNode* ScrollingStateTree::stateNodeForID(ScrollingNodeID scrollLayerID)
+ScrollingStateNode* ScrollingStateTree::stateNodeForID(ScrollingNodeID scrollLayerID) const
 {
     if (!scrollLayerID)
         return 0;
diff --git a/Source/WebCore/page/scrolling/ScrollingStateTree.h b/Source/WebCore/page/scrolling/ScrollingStateTree.h
index 79a65a5f4..e10bf985d 100644
--- a/Source/WebCore/page/scrolling/ScrollingStateTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingStateTree.h
@@ -48,7 +48,7 @@ public:
     WEBCORE_EXPORT ~ScrollingStateTree();
 
     ScrollingStateFrameScrollingNode* rootStateNode() const { return m_rootStateNode.get(); }
-    WEBCORE_EXPORT ScrollingStateNode* stateNodeForID(ScrollingNodeID);
+    WEBCORE_EXPORT ScrollingStateNode* stateNodeForID(ScrollingNodeID) const;
 
     WEBCORE_EXPORT ScrollingNodeID attachNode(ScrollingNodeType, ScrollingNodeID, ScrollingNodeID parentID);
     void detachNode(ScrollingNodeID);
@@ -79,7 +79,9 @@ private:
     void addNode(ScrollingStateNode*);
 
     PassRefPtr<ScrollingStateNode> createNode(ScrollingNodeType, ScrollingNodeID);
-    
+
+    bool nodeTypeAndParentMatch(ScrollingStateNode&, ScrollingNodeType, ScrollingNodeID parentID) const;
+
     enum class SubframeNodeRemoval {
         Delete,
         Orphan
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index 6f48d3db9..5909bed02 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -87,7 +87,7 @@ public:
 
     static std::unique_ptr<ImageBuffer> createCompatibleBuffer(const FloatSize&, float resolutionScale, ColorSpace, const GraphicsContext&, bool hasAlpha);
 #if PLATFORM(QT) && ENABLE(ACCELERATED_2D_CANVAS)
-    static std::unique_ptr<ImageBuffer> createCompatibleBuffer(const IntSize&, float resolutionScale, ColorSpace, QOpenGLContext*);
+    static std::unique_ptr<ImageBuffer> createCompatibleBuffer(const IntSize&, ColorSpace, QOpenGLContext*);
 #endif
 
     WEBCORE_EXPORT ~ImageBuffer();
@@ -174,7 +174,7 @@ private:
     // so that create() knows when it should return failure.
     WEBCORE_EXPORT ImageBuffer(const FloatSize&, float resolutionScale, ColorSpace, RenderingMode, bool& success);
 #if PLATFORM(QT) && ENABLE(ACCELERATED_2D_CANVAS)
-    ImageBuffer(const IntSize&, float resolutionScale, ColorSpace, QOpenGLContext*, bool& success);
+    ImageBuffer(const IntSize&, ColorSpace, QOpenGLContext*, bool& success);
 #endif
 };
 
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index c560492fb..59519398e 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -500,7 +500,6 @@ void GraphicsContext::drawEllipse(const FloatRect& rect)
     m_data->p()->drawEllipse(rect);
 }
 
-
 void GraphicsContext::drawPattern(Image& image, const FloatRect& tileRect, const AffineTransform& patternTransform,
     const FloatPoint& phase, const FloatSize& spacing, CompositeOperator op, const FloatRect &destRect, BlendMode blendMode)
 {
@@ -541,13 +540,17 @@ void GraphicsContext::drawPattern(Image& image, const FloatRect& tileRect, const
     QPainter* p = platformContext();
     QTransform transform(patternTransform);
 
+    QTransform combinedTransform = p->combinedTransform();
+    QTransform targetScaleTransform = QTransform::fromScale(combinedTransform.m11(), combinedTransform.m22());
+    QTransform transformWithTargetScale = transform * targetScaleTransform;
+
     // If this would draw more than one scaled tile, we scale the pixmap first and then use the result to draw.
-    if (transform.type() == QTransform::TxScale && p->transform().type() < QTransform::TxScale) {
-        QRectF tileRectInTargetCoords = (transform * QTransform().translate(phase.x(), phase.y())).mapRect(tr);
+    if (transformWithTargetScale.type() == QTransform::TxScale) {
+        QRectF tileRectInTargetCoords = (transformWithTargetScale * QTransform().translate(phase.x(), phase.y())).mapRect(tr);
 
         bool tileWillBePaintedOnlyOnce = tileRectInTargetCoords.contains(dr);
         if (!tileWillBePaintedOnlyOnce) {
-            QSizeF scaledSize(float(pixmap.width()) * transform.m11(), float(pixmap.height()) * transform.m22());
+            QSizeF scaledSize(qreal(pixmap.width()) * transformWithTargetScale.m11(), qreal(pixmap.height()) * transformWithTargetScale.m22());
             QPixmap scaledPixmap(scaledSize.toSize());
             if (pixmap.hasAlpha())
                 scaledPixmap.fill(Qt::transparent);
@@ -558,8 +561,8 @@ void GraphicsContext::drawPattern(Image& image, const FloatRect& tileRect, const
                 painter.drawPixmap(QRect(0, 0, scaledPixmap.width(), scaledPixmap.height()), pixmap);
             }
             pixmap = scaledPixmap;
-            trTopLeft = transform.map(trTopLeft);
-            transform = QTransform::fromTranslate(transform.dx(), transform.dy());
+            trTopLeft = transformWithTargetScale.map(trTopLeft);
+            transform = targetScaleTransform.inverted().translate(transform.dx(), transform.dy());
         }
     }
 
@@ -746,16 +749,14 @@ void GraphicsContext::strokePath(const Path& path)
         fillPathStroke(p, platformPath, pen);
 }
 
-static inline void drawRepeatPattern(QPainter* p, PassRefPtr<Pattern> pattern, const FloatRect& rect)
+static inline void drawRepeatPattern(QPainter* p, Pattern& pattern, const FloatRect& rect)
 {
-    ASSERT(pattern);
-
-    const QBrush brush = pattern->createPlatformPattern();
+    const QBrush brush = pattern.createPlatformPattern();
     if (brush.style() != Qt::TexturePattern)
         return;
 
-    const bool repeatX = pattern->repeatX();
-    const bool repeatY = pattern->repeatY();
+    const bool repeatX = pattern.repeatX();
+    const bool repeatY = pattern.repeatY();
     // Patterns must be painted so that the top left of the first image is anchored at
     // the origin of the coordinate space
 
@@ -803,11 +804,11 @@ void GraphicsContext::fillRect(const FloatRect& rect)
             GraphicsContext* shadowContext = shadow.beginShadowLayer(*this, normalizedRect);
             if (shadowContext) {
                 QPainter* shadowPainter = shadowContext->platformContext();
-                drawRepeatPattern(shadowPainter, m_state.fillPattern, normalizedRect);
+                drawRepeatPattern(shadowPainter, *m_state.fillPattern, normalizedRect);
                 shadow.endShadowLayer(*this);
             }
         }
-        drawRepeatPattern(p, m_state.fillPattern, normalizedRect);
+        drawRepeatPattern(p, *m_state.fillPattern, normalizedRect);
     } else if (m_state.fillGradient) {
         QBrush brush(*m_state.fillGradient->platformGradient());
         brush.setTransform(m_state.fillGradient->gradientSpaceTransform());
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.cpp
index b277fd421..e76572134 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.cpp
@@ -127,7 +127,7 @@ private:
 // ---------------------- ImageBufferDataPrivateAccelerated
 
 struct ImageBufferDataPrivateAccelerated final : public TextureMapperPlatformLayer, public ImageBufferDataPrivate {
-    ImageBufferDataPrivateAccelerated(const IntSize&, QOpenGLContext* sharedContext);
+    ImageBufferDataPrivateAccelerated(const FloatSize&, QOpenGLContext* sharedContext);
     virtual ~ImageBufferDataPrivateAccelerated();
 
     QPaintDevice* paintDevice() final { return m_paintDevice; }
@@ -160,12 +160,12 @@ private:
     ImageBufferContext* m_context;
 };
 
-ImageBufferDataPrivateAccelerated::ImageBufferDataPrivateAccelerated(const IntSize& size, QOpenGLContext* sharedContext)
+ImageBufferDataPrivateAccelerated::ImageBufferDataPrivateAccelerated(const FloatSize& size, QOpenGLContext* sharedContext)
 {
     m_context = new ImageBufferContext(sharedContext);
     m_context->makeCurrentIfNeeded();
 
-    m_paintDevice = new QFramebufferPaintDevice(size);
+    m_paintDevice = new QFramebufferPaintDevice(IntSize(size));
 }
 
 ImageBufferDataPrivateAccelerated::~ImageBufferDataPrivateAccelerated()
@@ -351,7 +351,7 @@ GraphicsSurfaceToken ImageBufferDataPrivateAccelerated::graphicsSurfaceToken() c
 // ---------------------- ImageBufferDataPrivateUnaccelerated
 
 struct ImageBufferDataPrivateUnaccelerated final : public ImageBufferDataPrivate {
-    ImageBufferDataPrivateUnaccelerated(const IntSize&);
+    ImageBufferDataPrivateUnaccelerated(const FloatSize&, float scale);
     QPaintDevice* paintDevice() final { return m_pixmap.isNull() ? 0 : &m_pixmap; }
     QImage toQImage() const final;
     RefPtr<Image> image() const final;
@@ -371,11 +371,12 @@ struct ImageBufferDataPrivateUnaccelerated final : public ImageBufferDataPrivate
     RefPtr<Image> m_image;
 };
 
-ImageBufferDataPrivateUnaccelerated::ImageBufferDataPrivateUnaccelerated(const IntSize& size)
-    : m_pixmap(size)
+ImageBufferDataPrivateUnaccelerated::ImageBufferDataPrivateUnaccelerated(const FloatSize& size, float scale)
+    : m_pixmap(IntSize(size * scale))
     , m_image(StillImage::createForRendering(&m_pixmap))
 {
     m_pixmap.fill(QColor(Qt::transparent));
+    m_pixmap.setDevicePixelRatio(scale);
 }
 
 QImage ImageBufferDataPrivateUnaccelerated::toQImage() const
@@ -474,11 +475,11 @@ void ImageBufferDataPrivateUnaccelerated::platformTransformColorSpace(const Vect
 
 // ---------------------- ImageBufferData
 
-ImageBufferData::ImageBufferData(const IntSize& size)
+ImageBufferData::ImageBufferData(const FloatSize& size, float resolutionScale)
 {
     m_painter = new QPainter;
 
-    m_impl = new ImageBufferDataPrivateUnaccelerated(size);
+    m_impl = new ImageBufferDataPrivateUnaccelerated(size, resolutionScale);
 
     if (!m_impl->paintDevice())
         return;
@@ -489,7 +490,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
 }
 
 #if ENABLE(ACCELERATED_2D_CANVAS)
-ImageBufferData::ImageBufferData(const IntSize& size, QOpenGLContext* compatibleContext)
+ImageBufferData::ImageBufferData(const FloatSize& size, QOpenGLContext* compatibleContext)
 {
     m_painter = new QPainter;
 
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.h b/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.h
index 2ead943ca..14f21234d 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.h
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferDataQt.h
@@ -65,9 +65,9 @@ struct ImageBufferDataPrivate {
 
 class ImageBufferData {
 public:
-    ImageBufferData(const IntSize&);
+    ImageBufferData(const FloatSize&, float resolutionScale);
 #if ENABLE(ACCELERATED_2D_CANVAS)
-    ImageBufferData(const IntSize&, QOpenGLContext*);
+    ImageBufferData(const FloatSize&, QOpenGLContext*);
 #endif
     ~ImageBufferData();
     QPainter* m_painter;
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 885c43f92..380d22bb5 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -51,10 +51,11 @@
 namespace WebCore {
 
 #if ENABLE(ACCELERATED_2D_CANVAS)
-ImageBuffer::ImageBuffer(const IntSize& size, float /* resolutionScale */, ColorSpace, QOpenGLContext* compatibleContext, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, QOpenGLContext* compatibleContext, bool& success)
     : m_data(size, compatibleContext)
     , m_size(size)
     , m_logicalSize(size)
+    , m_resolutionScale(1.0)
 {
     success = m_data.m_painter && m_data.m_painter->isActive();
     if (!success)
@@ -64,10 +65,11 @@ ImageBuffer::ImageBuffer(const IntSize& size, float /* resolutionScale */, Color
 }
 #endif
 
-ImageBuffer::ImageBuffer(const FloatSize& size, float /* resolutionScale */, ColorSpace, RenderingMode /*renderingMode*/, bool& success)
-    : m_data(IntSize(size))
-    , m_size(size)
+ImageBuffer::ImageBuffer(const FloatSize& size, float resolutionScale, ColorSpace, RenderingMode /*renderingMode*/, bool& success)
+    : m_data(size, resolutionScale)
+    , m_size(size * resolutionScale)
     , m_logicalSize(size)
+    , m_resolutionScale(resolutionScale)
 {
     success = m_data.m_painter && m_data.m_painter->isActive();
     if (!success)
@@ -81,10 +83,10 @@ ImageBuffer::~ImageBuffer()
 }
 
 #if ENABLE(ACCELERATED_2D_CANVAS)
-std::unique_ptr<ImageBuffer> ImageBuffer::createCompatibleBuffer(const IntSize& size, float resolutionScale, ColorSpace colorSpace, QOpenGLContext* context)
+std::unique_ptr<ImageBuffer> ImageBuffer::createCompatibleBuffer(const IntSize& size, ColorSpace colorSpace, QOpenGLContext* context)
 {
     bool success = false;
-    std::unique_ptr<ImageBuffer> buf(new ImageBuffer(size, resolutionScale, colorSpace, context, success));
+    std::unique_ptr<ImageBuffer> buf(new ImageBuffer(size, colorSpace, context, success));
     if (!success)
         return nullptr;
     return buf;
@@ -139,8 +141,14 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
 }
 
 template <Multiply multiplied>
-PassRefPtr<Uint8ClampedArray> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size)
+PassRefPtr<Uint8ClampedArray> getImageData(const IntRect& unscaledRect, float scale, const ImageBufferData& imageData, const IntSize& size,
+    ImageBuffer::CoordinateSystem coordinateSystem)
 {
+    IntRect rect(unscaledRect);
+
+    if (coordinateSystem == ImageBuffer::LogicalCoordinateSystem)
+        rect.scale(scale);
+
     float area = 4.0f * rect.width() * rect.height();
     if (area > static_cast<float>(std::numeric_limits<int>::max()))
         return 0;
@@ -149,6 +157,8 @@ PassRefPtr<Uint8ClampedArray> getImageData(const IntRect& rect, const ImageBuffe
 
     QImage::Format format = (multiplied == Unmultiplied) ? QImage::Format_RGBA8888 : QImage::Format_RGBA8888_Premultiplied;
     QImage image(result->data(), rect.width(), rect.height(), format);
+    if (coordinateSystem == ImageBuffer::LogicalCoordinateSystem)
+        image.setDevicePixelRatio(scale);
     if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > size.width() || rect.maxY() > size.height())
         image.fill(0);
 
@@ -162,17 +172,17 @@ PassRefPtr<Uint8ClampedArray> getImageData(const IntRect& rect, const ImageBuffe
     return result.release();
 }
 
-PassRefPtr<Uint8ClampedArray> ImageBuffer::getUnmultipliedImageData(const IntRect& rect, CoordinateSystem) const
+PassRefPtr<Uint8ClampedArray> ImageBuffer::getUnmultipliedImageData(const IntRect& rect, CoordinateSystem coordinateSystem) const
 {
-    return getImageData<Unmultiplied>(rect, m_data, m_size);
+    return getImageData<Unmultiplied>(rect, m_resolutionScale, m_data, m_size, coordinateSystem);
 }
 
-PassRefPtr<Uint8ClampedArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect, CoordinateSystem) const
+PassRefPtr<Uint8ClampedArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect, CoordinateSystem coordinateSystem) const
 {
-    return getImageData<Premultiplied>(rect, m_data, m_size);
+    return getImageData<Premultiplied>(rect, m_resolutionScale, m_data, m_size, coordinateSystem);
 }
 
-void ImageBuffer::putByteArray(Multiply multiplied, Uint8ClampedArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint, CoordinateSystem)
+void ImageBuffer::putByteArray(Multiply multiplied, Uint8ClampedArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint, CoordinateSystem coordinateSystem)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -189,12 +199,21 @@ void ImageBuffer::putByteArray(Multiply multiplied, Uint8ClampedArray* source, c
         m_data.m_painter->setClipping(false);
     }
 
+    // source rect & size need scaling from the device coords to image coords
+    IntSize scaledSourceSize(sourceSize);
+    IntRect scaledSourceRect(sourceRect);
+    if (coordinateSystem == LogicalCoordinateSystem) {
+        scaledSourceSize.scale(m_resolutionScale);
+        scaledSourceRect.scale(m_resolutionScale);
+    }
+
     // Let drawImage deal with the conversion.
     QImage::Format format = (multiplied == Unmultiplied) ? QImage::Format_RGBA8888 : QImage::Format_RGBA8888_Premultiplied;
-    QImage image(source->data(), sourceSize.width(), sourceSize.height(), format);
+    QImage image(source->data(), scaledSourceSize.width(), scaledSourceSize.height(), format);
+    image.setDevicePixelRatio(m_resolutionScale);
 
     m_data.m_painter->setCompositionMode(QPainter::CompositionMode_Source);
-    m_data.m_painter->drawImage(destPoint + sourceRect.location(), image, sourceRect);
+    m_data.m_painter->drawImage(destPoint + sourceRect.location(), image, scaledSourceRect);
 
     if (!isPainting)
         m_data.m_painter->end();
diff --git a/Source/WebCore/platform/graphics/qt/ImageQt.cpp b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
index 31a7da8a6..a2e0215cc 100644
--- a/Source/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -40,7 +40,6 @@
 #include "ShadowBlur.h"
 #include "StillImageQt.h"
 #include "Timer.h"
-#include <wtf/text/WTFString.h>
 
 #include <QCoreApplication>
 #include <QImage>
@@ -51,8 +50,8 @@
 #include <QPixmapCache>
 #include <QTransform>
 #include <private/qhexstring_p.h>
-
-#include <math.h>
+#include <wtf/NeverDestroyed.h>
+#include <wtf/text/WTFString.h>
 
 #if OS(WINDOWS)
 QT_BEGIN_NAMESPACE
@@ -60,40 +59,68 @@ Q_GUI_EXPORT QPixmap qt_pixmapFromWinHBITMAP(HBITMAP, int hbitmapFormat = 0);
 QT_END_NAMESPACE
 #endif
 
-typedef QHash<QByteArray, QPixmap> WebGraphicHash;
-Q_GLOBAL_STATIC(WebGraphicHash, _graphics)
+typedef Vector<QPixmap, 3> WebGraphicVector;
+typedef HashMap<CString, WebGraphicVector> WebGraphicHash;
 
-static void earlyClearGraphics()
+static WebGraphicHash& graphics()
 {
-    _graphics()->clear();
-}
-
-static WebGraphicHash* graphics()
-{
-    WebGraphicHash* hash = _graphics();
-
-    if (hash->isEmpty()) {
-
-        // prevent ~QPixmap running after ~QApplication (leaks native pixmaps)
-        qAddPostRoutine(earlyClearGraphics);
+    static NeverDestroyed<WebGraphicHash> hash;
 
+    if (hash.get().isEmpty()) {
         // QWebSettings::MissingImageGraphic
-        hash->insert("missingImage", QPixmap(QStringLiteral(":webkit/resources/missingImage.png")));
+        hash.get().add("missingImage", WebGraphicVector { {
+            QPixmap(QStringLiteral(":webkit/resources/missingImage.png")),
+            QPixmap(QStringLiteral(":webkit/resources/missingImage@2x.png")),
+            QPixmap(QStringLiteral(":webkit/resources/missingImage@3x.png"))
+        } });
+
         // QWebSettings::MissingPluginGraphic
-        hash->insert("nullPlugin", QPixmap(QStringLiteral(":webkit/resources/nullPlugin.png")));
+        hash.get().add("nullPlugin", WebGraphicVector { {
+            QPixmap(QStringLiteral(":webkit/resources/nullPlugin.png")),
+            QPixmap(QStringLiteral(":webkit/resources/nullPlugin@2x.png"))
+        } });
+
         // QWebSettings::DefaultFrameIconGraphic
-        hash->insert("urlIcon", QPixmap(QStringLiteral(":webkit/resources/urlIcon.png")));
+        hash.get().add("urlIcon", WebGraphicVector { {
+            QPixmap(QStringLiteral(":webkit/resources/urlIcon.png"))
+        } });
+
         // QWebSettings::TextAreaSizeGripCornerGraphic
-        hash->insert("textAreaResizeCorner", QPixmap(QStringLiteral(":webkit/resources/textAreaResizeCorner.png")));
+        hash.get().add("textAreaResizeCorner", WebGraphicVector { {
+            QPixmap(QStringLiteral(":webkit/resources/textAreaResizeCorner.png")),
+            QPixmap(QStringLiteral(":webkit/resources/textAreaResizeCorner@2x.png"))
+        } });
     }
 
     return hash;
 }
 
-// This function loads resources into WebKit
-static QPixmap loadResourcePixmap(const char *name)
+static QPixmap loadResourcePixmapForScale(const CString& name, size_t scale)
 {
-    return graphics()->value(name);
+    const auto& iterator = graphics().find(name);
+    if (iterator == graphics().end())
+        return QPixmap();
+
+    WebGraphicVector v = iterator->value;
+    if (scale <= v.size())
+        return v[scale - 1];
+
+    return v.last();
+}
+
+static QPixmap loadResourcePixmap(const char* name)
+{
+    int length = strlen(name);
+
+    // Handle "name@2x" and "name@3x"
+    if (length > 3 && name[length - 1] == 'x' && name[length - 3] == '@' && isASCIIDigit(name[length - 2])) {
+        CString nameWithoutScale(name, length - 3);
+        char digit = name[length - 2];
+        size_t scale = digit - '0';
+        return loadResourcePixmapForScale(nameWithoutScale, scale);
+    }
+
+    return loadResourcePixmapForScale(CString(name, length), 1);
 }
 
 namespace WebCore {
@@ -126,11 +153,10 @@ PassRefPtr<Image> Image::loadPlatformResource(const char* name)
 
 void Image::setPlatformResource(const char* name, const QPixmap& pixmap)
 {
-    WebGraphicHash* h = graphics();
     if (pixmap.isNull())
-        h->remove(name);
+        graphics().remove(name);
     else
-        h->insert(name, pixmap);
+        graphics().add(name, WebGraphicVector { pixmap });
 }
 
 void Image::drawPattern(GraphicsContext& ctxt, const FloatRect& tileRect, const AffineTransform& patternTransform,
diff --git a/Source/WebCore/platform/graphics/qt/StillImageQt.cpp b/Source/WebCore/platform/graphics/qt/StillImageQt.cpp
index be0dfa7eb..5569474f0 100644
--- a/Source/WebCore/platform/graphics/qt/StillImageQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/StillImageQt.cpp
@@ -83,6 +83,9 @@ void StillImage::draw(GraphicsContext& ctxt, const FloatRect& dst,
     FloatRect normalizedSrc = src.normalized();
     FloatRect normalizedDst = dst.normalized();
 
+    // source rect needs scaling from the device coords to image coords
+    normalizedSrc.scale(m_pixmap->devicePixelRatio());
+
     CompositeOperator previousOperator = ctxt.compositeOperation();
     BlendMode previousBlendMode = ctxt.blendModeOperation();
     ctxt.setCompositeOperation(op, blendMode);
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index f97292c11..4d1f0bff8 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -1501,8 +1501,11 @@ void TransformationMatrix::blend2(const TransformationMatrix& from, double progr
 {
     Decomposed2Type fromDecomp;
     Decomposed2Type toDecomp;
-    from.decompose2(fromDecomp);
-    decompose2(toDecomp);
+    if (!from.decompose2(fromDecomp) || !decompose2(toDecomp)) {
+        if (progress < 0.5)
+            *this = from;
+        return;
+    }
 
     // If x-axis of one is flipped, and y-axis of the other, convert to an unflipped rotation.
     if ((fromDecomp.scaleX < 0 && toDecomp.scaleY < 0) || (fromDecomp.scaleY < 0 && toDecomp.scaleX < 0)) {
@@ -1541,8 +1544,11 @@ void TransformationMatrix::blend4(const TransformationMatrix& from, double progr
 {
     Decomposed4Type fromDecomp;
     Decomposed4Type toDecomp;
-    from.decompose4(fromDecomp);
-    decompose4(toDecomp);
+    if (!from.decompose4(fromDecomp) || !decompose4(toDecomp)) {
+        if (progress < 0.5)
+            *this = from;
+        return;
+    }
 
     blendFloat(fromDecomp.scaleX, toDecomp.scaleX, progress);
     blendFloat(fromDecomp.scaleY, toDecomp.scaleY, progress);
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index 258922614..5d0446ef9 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -302,7 +302,7 @@ public:
     bool decompose4(Decomposed4Type&) const;
     void recompose4(const Decomposed4Type&);
 
-    void blend(const TransformationMatrix& from, double progress);
+    WEBCORE_EXPORT void blend(const TransformationMatrix& from, double progress);
     void blend2(const TransformationMatrix& from, double progress);
     void blend4(const TransformationMatrix& from, double progress);
 
diff --git a/Source/WebCore/rendering/PaintPhase.h b/Source/WebCore/rendering/PaintPhase.h
index d46fc4ed4..6e8033047 100644
--- a/Source/WebCore/rendering/PaintPhase.h
+++ b/Source/WebCore/rendering/PaintPhase.h
@@ -54,15 +54,16 @@ enum PaintPhase {
 };
 
 enum PaintBehaviorFlags {
-    PaintBehaviorNormal = 0,
-    PaintBehaviorSelectionOnly = 1 << 0,
-    PaintBehaviorForceBlackText = 1 << 1,
-    PaintBehaviorForceWhiteText = 1 << 2,
-    PaintBehaviorFlattenCompositingLayers = 1 << 3,
-    PaintBehaviorRenderingSVGMask = 1 << 4,
-    PaintBehaviorSkipRootBackground = 1 << 5,
-    PaintBehaviorRootBackgroundOnly = 1 << 6,
-    PaintBehaviorSelectionAndBackgroundsOnly = 1 << 7,
+    PaintBehaviorNormal                      = 0,
+    PaintBehaviorSelectionOnly               = 1 << 0,
+    PaintBehaviorSkipSelectionHighlight      = 1 << 1,
+    PaintBehaviorForceBlackText              = 1 << 2,
+    PaintBehaviorForceWhiteText              = 1 << 3,
+    PaintBehaviorFlattenCompositingLayers    = 1 << 4,
+    PaintBehaviorRenderingSVGMask            = 1 << 5,
+    PaintBehaviorSkipRootBackground          = 1 << 6,
+    PaintBehaviorRootBackgroundOnly          = 1 << 7,
+    PaintBehaviorSelectionAndBackgroundsOnly = 1 << 8,
 };
 
 typedef unsigned PaintBehavior;
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index 749bee2bf..c96929db8 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -2571,9 +2571,11 @@ void RenderBoxModelObject::moveChildrenTo(RenderBoxModelObject* toBoxModelObject
         // Save our next sibling as moveChildTo will clear it.
         RenderObject* nextSibling = child->nextSibling();
         
+        // FIXME: This logic here fails to detect the first letter in certain cases
+        // and skips a valid sibling renderer (see webkit.org/b/163737).
         // Check to make sure we're not saving the firstLetter as the nextSibling.
         // When the |child| object will be moved, its firstLetter will be recreated,
-        // so saving it now in nextSibling would let us with a destroyed object.
+        // so saving it now in nextSibling would leave us with a stale object.
         if (is<RenderTextFragment>(*child) && is<RenderText>(nextSibling)) {
             RenderObject* firstLetterObj = nullptr;
             if (RenderBlock* block = downcast<RenderTextFragment>(*child).blockForAccompanyingFirstLetter()) {
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index f9c8ff1ce..9ce483c2b 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -273,6 +273,11 @@ void RenderListItem::insertOrMoveMarkerRendererIfNeeded()
     if (!m_marker)
         return;
 
+    // FIXME: Do not even try reposition the marker when we are not in layout
+    // until after we fixed webkit.org/b/163789.
+    if (!view().frameView().isInRenderTreeLayout())
+        return;
+
     RenderElement* currentParent = m_marker->parent();
     RenderBlock* newParent = getParentOfFirstLineBox(*this, *m_marker);
     if (!newParent) {
diff --git a/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp b/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp
index b212f632d..06ff8cd3c 100644
--- a/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderMultiColumnFlowThread.cpp
@@ -270,10 +270,34 @@ static bool isValidColumnSpanner(RenderMultiColumnFlowThread* flowThread, Render
     return false;
 }
 
+static RenderObject* spannerPlacehoderCandidate(const RenderObject& renderer, const RenderMultiColumnFlowThread& stayWithin)
+{
+    // Spanner candidate is a next sibling/ancestor's next child within the flow thread and
+    // it is in the same inflow/out-of-flow layout context.
+    if (renderer.isOutOfFlowPositioned())
+        return nullptr;
+
+    ASSERT(renderer.isDescendantOf(&stayWithin));
+    auto* current = &renderer;
+    while (true) {
+        // Skip to the first in-flow sibling.
+        auto* nextSibling = current->nextSibling();
+        while (nextSibling && nextSibling->isOutOfFlowPositioned())
+            nextSibling = nextSibling->nextSibling();
+        if (nextSibling)
+            return nextSibling;
+        // No sibling candidate, jump to the parent and check its siblings.
+        current = current->parent();
+        if (!current || current == &stayWithin || current->isOutOfFlowPositioned())
+            return nullptr;
+    }
+    return nullptr;
+}
+
 RenderObject* RenderMultiColumnFlowThread::processPossibleSpannerDescendant(RenderObject*& subtreeRoot, RenderObject* descendant)
 {
     RenderBlockFlow* multicolContainer = multiColumnBlockFlow();
-    RenderObject* nextRendererInFlowThread = descendant->nextInPreOrderAfterChildren(this);
+    RenderObject* nextRendererInFlowThread = spannerPlacehoderCandidate(*descendant, *this);
     RenderObject* insertBeforeMulticolChild = nullptr;
     RenderObject* nextDescendant = descendant;
 
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index df2cd277d..ca6427995 100644
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -1243,7 +1243,11 @@ void RenderObject::showRenderObject(bool mark, int depth) const
                 fprintf(stderr, " \"%s\"", value.utf8().data());
         }
     }
-
+    if (is<RenderBoxModelObject>(*this)) {
+        auto& renderer = downcast<RenderBoxModelObject>(*this);
+        if (renderer.hasContinuation())
+            fprintf(stderr, " continuation->(%p)", renderer.continuation());
+    }
     showRegionsInformation();
     fprintf(stderr, "\n");
 }
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index ad2583619..efe708c3b 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -463,7 +463,7 @@ public:
         // RenderBlock::createAnonymousBlock(). This includes creating an anonymous
         // RenderBlock having a BLOCK or BOX display. Other classes such as RenderTextFragment
         // are not RenderBlocks and will return false. See https://bugs.webkit.org/show_bug.cgi?id=56709. 
-        return isAnonymous() && (style().display() == BLOCK || style().display() == BOX) && style().styleType() == NOPSEUDO && isRenderBlock() && !isListMarker() && !isRenderFlowThread() && !isRenderMultiColumnSet() && !isRenderView()
+        return isAnonymous() && (style().display() == BLOCK || style().display() == BOX) && style().styleType() == NOPSEUDO && isRenderBlock() && !isListMarker() && !isRenderFlowThread() && !isRenderNamedFlowFragment() && !isRenderMultiColumnSet() && !isRenderView()
 #if ENABLE(FULLSCREEN_API)
             && !isRenderFullScreen()
             && !isRenderFullScreenPlaceholder()
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index 2bcb4eb1e..3ae703edc 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -128,10 +128,21 @@ void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
             }
         }
 
-        // If beforeChild is inside an anonymous cell, insert into the cell.
-        if (last && !is<RenderTableCell>(*last) && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
-            last->parent()->addChild(child, beforeChild);
-            return;
+        // Try to find an anonymous container for the child.
+        if (last && last->parent() && last->parent()->isAnonymous() && !last->parent()->isBeforeOrAfterContent()) {
+            // If beforeChild is inside an anonymous cell, insert into the cell.
+            if (!is<RenderTableCell>(*last)) {
+                last->parent()->addChild(child, beforeChild);
+                return;
+            }
+            // If beforeChild is inside an anonymous row, insert into the row.
+            auto& parent = *last->parent();
+            if (is<RenderTableRow>(parent)) {
+                RenderTableCell* cell = RenderTableCell::createAnonymousWithParentRenderer(this);
+                parent.addChild(cell, beforeChild);
+                cell->addChild(child);
+                return;
+            }
         }
 
         RenderTableCell* cell = RenderTableCell::createAnonymousWithParentRenderer(this);
diff --git a/Source/WebCore/rendering/RenderTextFragment.cpp b/Source/WebCore/rendering/RenderTextFragment.cpp
index 5d29b4457..744d47461 100644
--- a/Source/WebCore/rendering/RenderTextFragment.cpp
+++ b/Source/WebCore/rendering/RenderTextFragment.cpp
@@ -25,6 +25,7 @@
 
 #include "RenderBlock.h"
 #include "RenderIterator.h"
+#include "RenderMultiColumnFlowThread.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -112,6 +113,8 @@ RenderBlock* RenderTextFragment::blockForAccompanyingFirstLetter()
     if (!m_firstLetter)
         return nullptr;
     for (auto& block : ancestorsOfType<RenderBlock>(*m_firstLetter)) {
+        if (is<RenderMultiColumnFlowThread>(block))
+            break;
         if (block.style().hasPseudoStyle(FIRST_LETTER) && block.canHaveChildren())
             return &block;
     }
diff --git a/Source/WebCore/rendering/RenderVTTCue.cpp b/Source/WebCore/rendering/RenderVTTCue.cpp
index f97ba1c17..92f9007a6 100644
--- a/Source/WebCore/rendering/RenderVTTCue.cpp
+++ b/Source/WebCore/rendering/RenderVTTCue.cpp
@@ -70,6 +70,8 @@ void RenderVTTCue::layout()
 bool RenderVTTCue::initializeLayoutParameters(InlineFlowBox*& firstLineBox, LayoutUnit& step, LayoutUnit& position)
 {
     ASSERT(firstChild());
+    if (!firstChild())
+        return false;
 
     RenderBlock* parentBlock = containingBlock();
 
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 433630039..3c10cb5cf 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -612,7 +612,11 @@ void RenderView::repaintRootContents()
         layer()->setBackingNeedsRepaint(GraphicsLayer::DoNotClipToLayer);
         return;
     }
-    repaint();
+
+    // Always use layoutOverflowRect() to fix rdar://problem/27182267.
+    // This should be cleaned up via webkit.org/b/159913 and webkit.org/b/159914.
+    RenderLayerModelObject* repaintContainer = containerForRepaint();
+    repaintUsingContainer(repaintContainer, computeRectForRepaint(layoutOverflowRect(), repaintContainer));
 }
 
 void RenderView::repaintViewRectangle(const LayoutRect& repaintRect) const
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
index ddf4a8f5f..669066fdf 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -249,6 +249,7 @@ void SVGInlineTextBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffse
     auto& parentRenderer = parent()->renderer();
 
     bool paintSelectedTextOnly = paintInfo.phase == PaintPhaseSelection;
+    bool shouldPaintSelectionHighlight = !(paintInfo.paintBehavior & PaintBehaviorSkipSelectionHighlight);
     bool hasSelection = !parentRenderer.document().printing() && selectionState() != RenderObject::SelectionNone;
     if (!hasSelection && paintSelectedTextOnly)
         return;
@@ -264,7 +265,7 @@ void SVGInlineTextBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffse
     bool hasVisibleStroke = svgStyle.hasVisibleStroke();
 
     RenderStyle* selectionStyle = &style;
-    if (hasSelection) {
+    if (hasSelection && shouldPaintSelectionHighlight) {
         selectionStyle = parentRenderer.getCachedPseudoStyle(SELECTION);
         if (selectionStyle) {
             const SVGRenderStyle& svgSelectionStyle = selectionStyle->svgStyle();
diff --git a/Source/WebCore/rendering/svg/SVGRenderingContext.cpp b/Source/WebCore/rendering/svg/SVGRenderingContext.cpp
index 879513cb9..2dba13672 100644
--- a/Source/WebCore/rendering/svg/SVGRenderingContext.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderingContext.cpp
@@ -295,7 +295,9 @@ void SVGRenderingContext::renderSubtreeToImageBuffer(ImageBuffer* image, RenderE
 {
     ASSERT(image);
 
-    PaintInfo info(image->context(), LayoutRect::infiniteRect(), PaintPhaseForeground, PaintBehaviorNormal);
+    // Rendering into a buffer implies we're being used for masking, clipping, patterns or filters. In each of these
+    // cases we don't want to paint the selection.
+    PaintInfo info(image->context(), LayoutRect::infiniteRect(), PaintPhaseForeground, PaintBehaviorSkipSelectionHighlight);
 
     AffineTransform& contentTransformation = currentContentTransformation();
     AffineTransform savedContentTransformation = contentTransformation;
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
index be67d7484..c6d23f57c 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
@@ -53,9 +53,10 @@ void SVGRootInlineBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffse
 
     bool isPrinting = renderSVGText().document().printing();
     bool hasSelection = !isPrinting && selectionState() != RenderObject::SelectionNone;
+    bool shouldPaintSelectionHighlight = !(paintInfo.paintBehavior & PaintBehaviorSkipSelectionHighlight);
 
     PaintInfo childPaintInfo(paintInfo);
-    if (hasSelection) {
+    if (hasSelection && shouldPaintSelectionHighlight) {
         for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
             if (is<SVGInlineTextBox>(*child))
                 downcast<SVGInlineTextBox>(*child).paintSelectionBackground(childPaintInfo);
diff --git a/Source/WebInspectorUI/PlatformQt.cmake b/Source/WebInspectorUI/PlatformQt.cmake
index e11db4bc2..40026f94c 100644
--- a/Source/WebInspectorUI/PlatformQt.cmake
+++ b/Source/WebInspectorUI/PlatformQt.cmake
@@ -29,7 +29,7 @@ file(GLOB InspectorFilesDependencies
 add_custom_command(
     OUTPUT ${DERIVED_SOURCES_WEBINSPECTORUI_DIR}/UserInterface/Protocol/InspectorBackendCommands.js
     DEPENDS ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendCommands.js
-    COMMAND cmake -E copy ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendCommands.js ${DERIVED_SOURCES_WEBINSPECTORUI_DIR}/UserInterface/Protocol/InspectorBackendCommands.js
+    COMMAND ${CMAKE_COMMAND} -E copy ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/inspector/InspectorBackendCommands.js ${DERIVED_SOURCES_WEBINSPECTORUI_DIR}/UserInterface/Protocol/InspectorBackendCommands.js
 )
 
 get_target_property(RCC_EXECUTABLE ${Qt5Core_RCC_EXECUTABLE} IMPORTED_LOCATION)
diff --git a/Source/WebKit/PlatformQt.cmake b/Source/WebKit/PlatformQt.cmake
index bd72a04bb..da199aeaf 100644
--- a/Source/WebKit/PlatformQt.cmake
+++ b/Source/WebKit/PlatformQt.cmake
@@ -8,6 +8,14 @@ macro(generate_header _file _var _content)
     set_source_files_properties(${_file} PROPERTIES GENERATED TRUE)
 endmacro()
 
+macro(generate_version_header _file _var _prefix)
+    set(HEADER_PREFIX ${_prefix})
+    configure_file(VersionHeader.h.in ${_file} @ONLY)
+    unset(HEADER_PREFIX)
+    list(APPEND ${_var} ${_file})
+    set_source_files_properties(${_file} PROPERTIES GENERATED TRUE)
+endmacro()
+
 if (${JavaScriptCore_LIBRARY_TYPE} MATCHES STATIC)
     add_definitions(-DSTATICALLY_LINKED_WITH_WTF -DSTATICALLY_LINKED_WITH_JavaScriptCore)
 endif ()
@@ -372,16 +380,10 @@ set(WebKit_PUBLIC_HEADERS
     ${QtWebKit_FORWARDING_HEADERS}
 )
 
-generate_header("${FORWARDING_HEADERS_DIR}/QtWebKit/qtwebkitversion.h"
+generate_version_header("${FORWARDING_HEADERS_DIR}/QtWebKit/qtwebkitversion.h"
     WebKit_PUBLIC_HEADERS
-    "#ifndef QT_QTWEBKIT_VERSION_H
-#define QT_QTWEBKIT_VERSION_H
-
-#define QTWEBKIT_VERSION_STR \"${PROJECT_VERSION_STRING}\"
-#define QTWEBKIT_VERSION 0x05f00${PROJECT_VERSION_MICRO}
-
-#endif
-")
+    QTWEBKIT
+)
 
 generate_header("${FORWARDING_HEADERS_DIR}/QtWebKit/QtWebKitVersion"
     WebKit_PUBLIC_HEADERS
@@ -627,16 +629,10 @@ set(WebKitWidgets_PUBLIC_HEADERS
     ${QtWebKitWidgets_FORWARDING_HEADERS}
 )
 
-generate_header("${FORWARDING_HEADERS_DIR}/QtWebKitWidgets/qtwebkitwidgetsversion.h"
+generate_version_header("${FORWARDING_HEADERS_DIR}/QtWebKitWidgets/qtwebkitwidgetsversion.h"
     WebKitWidgets_PUBLIC_HEADERS
-    "#ifndef QT_QTWEBKITWIDGETS_VERSION_H
-#define QT_QTWEBKITWIDGETS_VERSION_H
-
-#define QTWEBKITWIDGETS_VERSION_STR \"${PROJECT_VERSION_STRING}\"
-#define QTWEBKITWIDGETS_VERSION 0x05f00${PROJECT_VERSION_MICRO}
-
-#endif
-")
+    QTWEBKITWIDGETS
+)
 
 generate_header("${FORWARDING_HEADERS_DIR}/QtWebKitWidgets/QtWebKitWidgetsVersion"
     WebKitWidgets_PUBLIC_HEADERS
diff --git a/Source/WebKit/VersionHeader.h.in b/Source/WebKit/VersionHeader.h.in
new file mode 100644
index 000000000..497d4fbcd
--- /dev/null
+++ b/Source/WebKit/VersionHeader.h.in
@@ -0,0 +1,10 @@
+#ifndef QT_@HEADER_PREFIX@_VERSION_H
+#define QT_@HEADER_PREFIX@_VERSION_H
+
+#define @HEADER_PREFIX@_VERSION_STR "@PROJECT_VERSION@"
+#define @HEADER_PREFIX@_VERSION_MAJOR @PROJECT_VERSION_MAJOR@
+#define @HEADER_PREFIX@_VERSION_MINOR @PROJECT_VERSION_MINOR@
+#define @HEADER_PREFIX@_VERSION_PATCH @PROJECT_VERSION_PATCH@
+#define @HEADER_PREFIX@_VERSION ((@PROJECT_VERSION_MAJOR@<<16)|(@PROJECT_VERSION_MINOR@<<8)|(@PROJECT_VERSION_PATCH@))
+
+#endif
diff --git a/Source/WebKit/qt/Api/qwebkitglobal.h b/Source/WebKit/qt/Api/qwebkitglobal.h
index 4963ce3af..77872ccf1 100644
--- a/Source/WebKit/qt/Api/qwebkitglobal.h
+++ b/Source/WebKit/qt/Api/qwebkitglobal.h
@@ -25,7 +25,7 @@
 #include <QtCore/qstring.h>
 
 #ifndef QT_STATIC
-#  if !defined(BUILDING_WebKitWidgets) && defined(BUILDING_WebKit)
+#  if !defined(BUILDING_WebKitWidgets) && (defined(BUILDING_WebKit) || defined(BUILDING_WebKit2))
 #      define QWEBKIT_EXPORT Q_DECL_EXPORT
 #  else
 #      define QWEBKIT_EXPORT Q_DECL_IMPORT
diff --git a/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp b/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp
index 084d5069d..ab9fb1382 100644
--- a/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.cpp
@@ -1382,6 +1382,11 @@ void QWebPageAdapter::setDevicePixelRatio(float devicePixelRatio)
     page->setDeviceScaleFactor(devicePixelRatio);
 }
 
+float QWebPageAdapter::devicePixelRatio()
+{
+    return page->deviceScaleFactor();
+}
+
 bool QWebPageAdapter::isPlayingAudio() const
 {
     return page->mediaState() & MediaProducer::IsPlayingAudio;
diff --git a/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.h b/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.h
index 33e9bcad8..969ce8700 100644
--- a/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.h
+++ b/Source/WebKit/qt/WebCoreSupport/QWebPageAdapter.h
@@ -387,6 +387,7 @@ public:
 
     ViewportAttributes viewportAttributesForSize(const QSize& availableSize, const QSize& deviceSize) const;
     void setDevicePixelRatio(float devicePixelRatio);
+    float devicePixelRatio();
 
     bool isPlayingAudio() const;
 
diff --git a/Source/WebKit/qt/WidgetApi/qwebpage.cpp b/Source/WebKit/qt/WidgetApi/qwebpage.cpp
index 56ecaa0c1..be8bd3edb 100644
--- a/Source/WebKit/qt/WidgetApi/qwebpage.cpp
+++ b/Source/WebKit/qt/WidgetApi/qwebpage.cpp
@@ -178,6 +178,18 @@ static const char* editorCommandWebActions[] =
 
     0, // OpenLinkInThisWindow,
 
+    0, // DownloadMediaToDisk,
+    0, // CopyMediaUrlToClipboard,
+    0, // ToggleMediaControls,
+    0, // ToggleMediaLoop,
+    0, // ToggleMediaPlayPause,
+    0, // ToggleMediaMute,
+    0, // ToggleVideoFullscreen,
+
+    0, // RequestClose,
+
+    "Unselect", // Unselect,
+
     0 // WebActionCount
 };
 
@@ -476,6 +488,9 @@ QMenu *createContextMenu(QWebPage* page, const QList<MenuItem>& items, QBitArray
     for (int i = 0; i < items.count(); ++i) {
         const MenuItem &item = items.at(i);
         switch (item.type) {
+        case MenuItem::NoType:
+            Q_UNREACHABLE();
+            break;
         case MenuItem::Action: {
             QAction* a = nullptr;
             if (item.action < QWebPageAdapter::ActionCount) {
@@ -746,6 +761,7 @@ void QWebPagePrivate::updateEditorActions()
     updateAction(QWebPage::AlignJustified);
     updateAction(QWebPage::AlignLeft);
     updateAction(QWebPage::AlignRight);
+    updateAction(QWebPage::Unselect);
 }
 
 void QWebPagePrivate::timerEvent(QTimerEvent *ev)
@@ -832,6 +848,7 @@ QWebPage::WebAction QWebPagePrivate::editorActionForKeyEvent(QKeyEvent* event)
         { QKeySequence::InsertParagraphSeparator, QWebPage::InsertParagraphSeparator },
         { QKeySequence::InsertLineSeparator, QWebPage::InsertLineSeparator },
         { QKeySequence::SelectAll, QWebPage::SelectAll },
+        { QKeySequence::Deselect, QWebPage::Unselect },
         { QKeySequence::UnknownKey, QWebPage::NoWebAction }
     };
 
@@ -1209,6 +1226,7 @@ QWebInspector* QWebPagePrivate::getOrCreateInspector()
     \value ToggleMediaMute Mutes or unmutes the hovered audio or video element. (Added in Qt 5.2)
     \value ToggleVideoFullscreen Switches the hovered video element into or out of fullscreen mode. (Added in Qt 5.2)
     \value RequestClose Request to close the web page. If defined, the window.onbeforeunload handler is run, and the user can confirm or reject to close the page. If the close request is confirmed, windowCloseRequested is emitted. (Added in ?)
+    \value Unselect Deselects existing selection. (Added in QtWebKit 5.9)
 
     \omitvalue WebActionCount
 
@@ -2042,10 +2060,27 @@ void QWebPagePrivate::updateWindow()
 
 void QWebPagePrivate::_q_updateScreen(QScreen* screen)
 {
-    if (screen)
+    if (screen && !m_customDevicePixelRatioIsSet)
         setDevicePixelRatio(screen->devicePixelRatio());
 }
 
+void QWebPage::setDevicePixelRatio(qreal ratio)
+{
+    d->setDevicePixelRatio(ratio);
+    d->m_customDevicePixelRatioIsSet = true;
+}
+
+qreal QWebPage::devicePixelRatio() const
+{
+    return d->devicePixelRatio();
+}
+
+void QWebPage::resetDevicePixelRatio()
+{
+    d->m_customDevicePixelRatioIsSet = false;
+    d->updateWindow();
+}
+
 static int getintenv(const char* variable)
 {
     bool ok;
diff --git a/Source/WebKit/qt/WidgetApi/qwebpage.h b/Source/WebKit/qt/WidgetApi/qwebpage.h
index c67830c6c..bff0852d7 100644
--- a/Source/WebKit/qt/WidgetApi/qwebpage.h
+++ b/Source/WebKit/qt/WidgetApi/qwebpage.h
@@ -195,6 +195,8 @@ public:
 
         RequestClose,
 
+        Unselect,
+
         WebActionCount
     };
 
@@ -334,6 +336,10 @@ public:
 #endif
     virtual void triggerAction(WebAction action, bool checked = false);
 
+    void setDevicePixelRatio(qreal ratio);
+    qreal devicePixelRatio() const;
+    void resetDevicePixelRatio();
+
     QSize viewportSize() const;
     void setViewportSize(const QSize &size) const;
     ViewportAttributes viewportAttributesForSize(const QSize& availableSize) const;
diff --git a/Source/WebKit/qt/WidgetApi/qwebpage_p.h b/Source/WebKit/qt/WidgetApi/qwebpage_p.h
index 7b2c7ff6f..3e6743915 100644
--- a/Source/WebKit/qt/WidgetApi/qwebpage_p.h
+++ b/Source/WebKit/qt/WidgetApi/qwebpage_p.h
@@ -213,6 +213,7 @@ public:
     Qt::DropAction m_lastDropAction;
 
     QMetaMethod m_fullScreenRequested;
+    bool m_customDevicePixelRatioIsSet { false };
 };
 
 #endif
diff --git a/Source/WebKit/qt/declarative/experimental/plugin.cpp b/Source/WebKit/qt/declarative/experimental/plugin.cpp
index 9d483cd38..c974502d2 100644
--- a/Source/WebKit/qt/declarative/experimental/plugin.cpp
+++ b/Source/WebKit/qt/declarative/experimental/plugin.cpp
@@ -19,6 +19,10 @@
 
 #include "config.h"
 
+#if OS(WINDOWS)
+#include <windows.h>
+#endif
+
 #include "private/qquicknetworkreply_p.h"
 #include "private/qquicknetworkrequest_p.h"
 #include "private/qquickwebpage_p.h"
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index 9af82650b..e5d08ed68 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -768,7 +768,9 @@ add_webkit2_prefix_header(WebKit2)
 QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT(WebKit2)
 
 # Suppress unused parameter warnings for sources in WebKit2.
-ADD_TARGET_PROPERTIES(WebKit2 COMPILE_FLAGS "-Wno-unused-parameter")
+if (COMPILER_IS_GCC_OR_CLANG)
+    ADD_TARGET_PROPERTIES(WebKit2 COMPILE_FLAGS "-Wno-unused-parameter")
+endif ()
 
 if (WebKit2_VERSION_SCRIPT)
     ADD_TARGET_PROPERTIES(WebKit2 LINK_FLAGS "${WebKit2_VERSION_SCRIPT}")
diff --git a/Source/WebKit2/DatabaseProcess/DatabaseProcess.cpp b/Source/WebKit2/DatabaseProcess/DatabaseProcess.cpp
index e267130e8..dbd85b631 100644
--- a/Source/WebKit2/DatabaseProcess/DatabaseProcess.cpp
+++ b/Source/WebKit2/DatabaseProcess/DatabaseProcess.cpp
@@ -175,6 +175,14 @@ void DatabaseProcess::createDatabaseToWebProcessConnection()
     IPC::Connection::SocketPair socketPair = IPC::Connection::createPlatformConnection();
     m_databaseToWebProcessConnections.append(DatabaseToWebProcessConnection::create(socketPair.server));
     parentProcessConnection()->send(Messages::DatabaseProcessProxy::DidCreateDatabaseToWebProcessConnection(IPC::Attachment(socketPair.client)), 0);
+#elif OS(WINDOWS)
+    IPC::Connection::Identifier serverIdentifier, clientIdentifier;
+    if (!IPC::Connection::createServerAndClientIdentifiers(serverIdentifier, clientIdentifier)) {
+        // log it?
+        return;
+    }
+    m_databaseToWebProcessConnections.append(DatabaseToWebProcessConnection::create(serverIdentifier));
+    parentProcessConnection()->send(Messages::DatabaseProcessProxy::DidCreateDatabaseToWebProcessConnection(IPC::Attachment(clientIdentifier)), 0);
 #elif OS(DARWIN)
     // Create the listening port.
     mach_port_t listeningPort;
diff --git a/Source/WebKit2/DatabaseProcess/DatabaseProcess.h b/Source/WebKit2/DatabaseProcess/DatabaseProcess.h
index d87966c92..f3f3deaa2 100644
--- a/Source/WebKit2/DatabaseProcess/DatabaseProcess.h
+++ b/Source/WebKit2/DatabaseProcess/DatabaseProcess.h
@@ -65,9 +65,9 @@ public:
 
     void postDatabaseTask(std::unique_ptr<WebCore::CrossThreadTask>);
 
-private:
     DatabaseProcess();
 
+private:
     // ChildProcess
     virtual void initializeProcess(const ChildProcessInitializationParameters&) override;
     virtual void initializeProcessName(const ChildProcessInitializationParameters&) override;
diff --git a/Source/WebKit2/NetworkProcess/NetworkProcess.cpp b/Source/WebKit2/NetworkProcess/NetworkProcess.cpp
index 75ce5d4a2..4e3a2673c 100644
--- a/Source/WebKit2/NetworkProcess/NetworkProcess.cpp
+++ b/Source/WebKit2/NetworkProcess/NetworkProcess.cpp
@@ -239,6 +239,18 @@ void NetworkProcess::createNetworkConnectionToWebProcess()
 
     IPC::Attachment clientSocket(socketPair.client);
     parentProcessConnection()->send(Messages::NetworkProcessProxy::DidCreateNetworkConnectionToWebProcess(clientSocket), 0);
+#elif OS(WINDOWS)
+    IPC::Connection::Identifier serverIdentifier, clientIdentifier;
+    if (!IPC::Connection::createServerAndClientIdentifiers(serverIdentifier, clientIdentifier)) {
+        // log it?
+        return;
+    }
+
+    RefPtr<NetworkConnectionToWebProcess> connection = NetworkConnectionToWebProcess::create(serverIdentifier);
+    m_webProcessConnections.append(connection.release());
+
+    IPC::Attachment clientSocket(clientIdentifier);
+    parentProcessConnection()->send(Messages::NetworkProcessProxy::DidCreateNetworkConnectionToWebProcess(clientSocket), 0);
 #elif OS(DARWIN)
     // Create the listening port.
     mach_port_t listeningPort;
diff --git a/Source/WebKit2/NetworkProcess/NetworkProcess.h b/Source/WebKit2/NetworkProcess/NetworkProcess.h
index 4b573b9b5..ac10c53fd 100644
--- a/Source/WebKit2/NetworkProcess/NetworkProcess.h
+++ b/Source/WebKit2/NetworkProcess/NetworkProcess.h
@@ -59,7 +59,7 @@ class NetworkConnectionToWebProcess;
 class NetworkProcessSupplement;
 struct NetworkProcessCreationParameters;
 
-class NetworkProcess : public ChildProcess, private DownloadManager::Client {
+class NetworkProcess : public ChildProcess, public DownloadManager::Client {
     WTF_MAKE_NONCOPYABLE(NetworkProcess);
     friend class NeverDestroyed<NetworkProcess>;
     friend class NeverDestroyed<DownloadManager>;
@@ -109,8 +109,9 @@ public:
 
     void prefetchDNS(const String&);
 
-private:
     NetworkProcess();
+
+private:
     ~NetworkProcess();
 
     void platformInitializeNetworkProcess(const NetworkProcessCreationParameters&);
diff --git a/Source/WebKit2/Platform/IPC/Arguments.h b/Source/WebKit2/Platform/IPC/Arguments.h
index d7bf21774..64ecd8677 100644
--- a/Source/WebKit2/Platform/IPC/Arguments.h
+++ b/Source/WebKit2/Platform/IPC/Arguments.h
@@ -29,6 +29,8 @@
 #include "ArgumentDecoder.h"
 #include "ArgumentEncoder.h"
 
+#include <tuple>
+
 namespace IPC {
 
 template<size_t index, typename... Elements>
diff --git a/Source/WebKit2/Platform/IPC/Attachment.cpp b/Source/WebKit2/Platform/IPC/Attachment.cpp
index 59033de38..366749816 100644
--- a/Source/WebKit2/Platform/IPC/Attachment.cpp
+++ b/Source/WebKit2/Platform/IPC/Attachment.cpp
@@ -33,6 +33,9 @@ namespace IPC {
 
 Attachment::Attachment()
     : m_type(Uninitialized)
+#if OS(WINDOWS)
+    , m_handle(0)
+#endif
 {
 }
 
@@ -50,6 +53,7 @@ void Attachment::release()
 }
 #endif
 
+#if !OS(WINDOWS)
 void Attachment::encode(ArgumentEncoder& encoder) const
 {
     encoder.addAttachment(WTFMove(*const_cast<Attachment*>(this)));
@@ -61,5 +65,6 @@ bool Attachment::decode(ArgumentDecoder& decoder, Attachment& attachment)
         return false;
     return true;
 }
+#endif
 
 } // namespace IPC
diff --git a/Source/WebKit2/Platform/IPC/Attachment.h b/Source/WebKit2/Platform/IPC/Attachment.h
index 10e66c298..9165a1998 100644
--- a/Source/WebKit2/Platform/IPC/Attachment.h
+++ b/Source/WebKit2/Platform/IPC/Attachment.h
@@ -58,6 +58,10 @@ public:
     ~Attachment();
 #elif OS(DARWIN)
     Attachment(mach_port_name_t, mach_msg_type_name_t disposition);
+#elif OS(WINDOWS)
+    Attachment(HANDLE handle)
+        : m_handle(handle)
+    { }
 #endif
 
     Type type() const { return m_type; }
@@ -73,6 +77,8 @@ public:
     // MachPortType
     mach_port_name_t port() const { return m_port; }
     mach_msg_type_name_t disposition() const { return m_disposition; }
+#elif OS(WINDOWS)
+    HANDLE handle() const { return m_handle; }
 #endif
 
     void encode(ArgumentEncoder&) const;
@@ -87,6 +93,8 @@ private:
 #elif OS(DARWIN)
     mach_port_name_t m_port;
     mach_msg_type_name_t m_disposition;
+#elif OS(WINDOWS)
+    HANDLE m_handle;
 #endif
 };
 
diff --git a/Source/WebKit2/Platform/IPC/mac/ConnectionMac.mm b/Source/WebKit2/Platform/IPC/mac/ConnectionMac.mm
index b7ac61a9d..a12e25431 100644
--- a/Source/WebKit2/Platform/IPC/mac/ConnectionMac.mm
+++ b/Source/WebKit2/Platform/IPC/mac/ConnectionMac.mm
@@ -111,8 +111,19 @@ private:
     
 void Connection::platformInvalidate()
 {
-    if (!m_isConnected)
+    if (!m_isConnected) {
+        if (m_sendPort) {
+            mach_port_deallocate(mach_task_self(), m_sendPort);
+            m_sendPort = MACH_PORT_NULL;
+        }
+
+        if (m_receivePort) {
+            mach_port_mod_refs(mach_task_self(), m_receivePort, MACH_PORT_RIGHT_RECEIVE, -1);
+            m_receivePort = MACH_PORT_NULL;
+        }
+
         return;
+    }
 
     m_isConnected = false;
 
@@ -138,8 +149,6 @@ void Connection::platformInvalidate()
         m_exceptionPort = MACH_PORT_NULL;
     }
 #endif
-
-    m_xpcConnection = nullptr;
 }
     
 void Connection::terminateSoon(double intervalInSeconds)
diff --git a/Source/WebKit2/Platform/IPC/win/AttachmentWin.cpp b/Source/WebKit2/Platform/IPC/win/AttachmentWin.cpp
new file mode 100644
index 000000000..a81b22623
--- /dev/null
+++ b/Source/WebKit2/Platform/IPC/win/AttachmentWin.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2017 Konstantin Tokarev <annulen@yandex.ru>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Attachment.h"
+
+#include "ArgumentDecoder.h"
+#include "ArgumentEncoder.h"
+
+// FIXME: This code is duplicated with SharedMemory::Handle implementation for Win
+
+namespace IPC {
+
+void Attachment::encode(ArgumentEncoder& encoder) const
+{
+    // Hand off ownership of our HANDLE to the receiving process. It will close it for us.
+    // FIXME: If the receiving process crashes before it receives the memory, the memory will be
+    // leaked. See <http://webkit.org/b/47502>.
+    encoder << reinterpret_cast<uint64_t>(m_handle);
+
+    // Send along our PID so that the receiving process can duplicate the HANDLE for its own use.
+    encoder << static_cast<uint32_t>(::GetCurrentProcessId());
+}
+
+static bool getDuplicatedHandle(HANDLE sourceHandle, DWORD sourcePID, HANDLE& duplicatedHandle)
+{
+    duplicatedHandle = 0;
+    if (!sourceHandle)
+        return true;
+
+    HANDLE sourceProcess = ::OpenProcess(PROCESS_DUP_HANDLE, FALSE, sourcePID);
+    if (!sourceProcess)
+        return false;
+
+    // Copy the handle into our process and close the handle that the sending process created for us.
+    BOOL success = ::DuplicateHandle(sourceProcess, sourceHandle, ::GetCurrentProcess(), &duplicatedHandle, 0, FALSE, DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE);
+    ASSERT_WITH_MESSAGE(success, "::DuplicateHandle failed with error %lu", ::GetLastError());
+
+    ::CloseHandle(sourceProcess);
+
+    return success;
+}
+
+bool Attachment::decode(ArgumentDecoder& decoder, Attachment& attachment)
+{
+    ASSERT_ARG(attachment, !attachment.m_handle);
+
+    uint64_t sourceHandle;
+    if (!decoder.decode(sourceHandle))
+        return false;
+
+    uint32_t sourcePID;
+    if (!decoder.decode(sourcePID))
+        return false;
+
+    HANDLE duplicatedHandle;
+    if (!getDuplicatedHandle(reinterpret_cast<HANDLE>(sourceHandle), sourcePID, duplicatedHandle))
+        return false;
+
+    attachment.m_handle = duplicatedHandle;
+    return true;
+}
+
+} // namespace IPC
diff --git a/Source/WebKit2/Platform/IPC/win/ConnectionWin.cpp b/Source/WebKit2/Platform/IPC/win/ConnectionWin.cpp
index a2730ca69..7ea5ba0f5 100644
--- a/Source/WebKit2/Platform/IPC/win/ConnectionWin.cpp
+++ b/Source/WebKit2/Platform/IPC/win/ConnectionWin.cpp
@@ -27,7 +27,6 @@
 #include "Connection.h"
 
 #include "DataReference.h"
-#include <wtf/Functional.h>
 #include <wtf/RandomNumber.h>
 #include <wtf/text/WTFString.h>
 #include <wtf/threads/BinarySemaphore.h>
@@ -161,8 +160,8 @@ void Connection::readEventHandler()
         if (!m_readBuffer.isEmpty()) {
             // We have a message, let's dispatch it.
 
-            OwnPtr<MessageDecoder> decoder = MessageDecoder::create(DataReference(m_readBuffer.data(), m_readBuffer.size()));
-            processIncomingMessage(decoder.release());
+            auto decoder = std::make_unique<MessageDecoder>(DataReference(m_readBuffer.data(), m_readBuffer.size()), Vector<Attachment>());
+            processIncomingMessage(WTFMove(decoder));
         }
 
         // Find out the size of the next message in the pipe (if there is one) so that we can read
@@ -250,12 +249,21 @@ bool Connection::open()
     // We connected the two ends of the pipe in createServerAndClientIdentifiers.
     m_isConnected = true;
 
+    RefPtr<Connection> protectedThis(this);
+
     // Start listening for read and write state events.
-    m_connectionQueue->registerHandle(m_readState.hEvent, bind(&Connection::readEventHandler, this));
-    m_connectionQueue->registerHandle(m_writeState.hEvent, bind(&Connection::writeEventHandler, this));
+    m_connectionQueue->registerHandle(m_readState.hEvent, [protectedThis] {
+        protectedThis->readEventHandler();
+    });
+
+    m_connectionQueue->registerHandle(m_writeState.hEvent, [protectedThis] {
+        protectedThis->writeEventHandler();
+    });
 
     // Schedule a read.
-    m_connectionQueue->dispatch(bind(&Connection::readEventHandler, this));
+    m_connectionQueue->dispatch([protectedThis] {
+        protectedThis->readEventHandler();
+    });
 
     return true;
 }
@@ -268,7 +276,7 @@ bool Connection::platformCanSendOutgoingMessages() const
     return !m_pendingWriteEncoder;
 }
 
-bool Connection::sendOutgoingMessage(PassOwnPtr<MessageEncoder> encoder)
+bool Connection::sendOutgoingMessage(std::unique_ptr<MessageEncoder> encoder)
 {
     ASSERT(!m_pendingWriteEncoder);
 
@@ -301,7 +309,7 @@ bool Connection::sendOutgoingMessage(PassOwnPtr<MessageEncoder> encoder)
 
     // The message will be sent soon. Hold onto the encoder so that it won't be destroyed
     // before the write completes.
-    m_pendingWriteEncoder = encoder;
+    m_pendingWriteEncoder = WTFMove(encoder);
 
     // We can only send one asynchronous message at a time (see comment in platformCanSendOutgoingMessages).
     return false;
@@ -348,4 +356,14 @@ bool Connection::dispatchSentMessagesUntil(const Vector<HWND>& windows, WTF::Bin
     }
 }
 
+void Connection::willSendSyncMessage(unsigned flags)
+{
+    UNUSED_PARAM(flags);
+}
+
+void Connection::didReceiveSyncReply(unsigned flags)
+{
+    UNUSED_PARAM(flags);
+}
+
 } // namespace IPC
diff --git a/Source/WebKit2/Platform/SharedMemory.h b/Source/WebKit2/Platform/SharedMemory.h
index 165ecfae5..4174e5cfb 100644
--- a/Source/WebKit2/Platform/SharedMemory.h
+++ b/Source/WebKit2/Platform/SharedMemory.h
@@ -82,6 +82,7 @@ public:
         size_t m_size;
 #elif OS(WINDOWS)
         mutable HANDLE m_handle;
+        size_t m_size;
 #endif
     };
 
@@ -93,7 +94,7 @@ public:
 #endif
 
 #if OS(WINDOWS)
-    static PassRefPtr<SharedMemory> adopt(HANDLE, size_t, Protection);
+    static RefPtr<SharedMemory> adopt(HANDLE, size_t, Protection);
 #endif
 
     ~SharedMemory();
diff --git a/Source/WebKit2/Platform/win/SharedMemoryWin.cpp b/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
index acf37be83..dff1339ef 100644
--- a/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
+++ b/Source/WebKit2/Platform/win/SharedMemoryWin.cpp
@@ -40,6 +40,11 @@ SharedMemory::Handle::Handle()
 
 SharedMemory::Handle::~Handle()
 {
+    clear();
+}
+
+void SharedMemory::Handle::clear()
+{
     if (!m_handle)
         return;
 
@@ -110,16 +115,16 @@ bool SharedMemory::Handle::decode(IPC::ArgumentDecoder& decoder, Handle& handle)
     return true;
 }
 
-PassRefPtr<SharedMemory> SharedMemory::create(size_t size)
+RefPtr<SharedMemory> SharedMemory::allocate(size_t size)
 {
     HANDLE handle = ::CreateFileMappingW(INVALID_HANDLE_VALUE, 0, PAGE_READWRITE, 0, size, 0);
     if (!handle)
-        return 0;
+        return nullptr;
 
     void* baseAddress = ::MapViewOfFile(handle, FILE_MAP_ALL_ACCESS, 0, 0, size);
     if (!baseAddress) {
         ::CloseHandle(handle);
-        return 0;
+        return nullptr;
     }
 
     RefPtr<SharedMemory> memory = adoptRef(new SharedMemory);
@@ -127,15 +132,15 @@ PassRefPtr<SharedMemory> SharedMemory::create(size_t size)
     memory->m_data = baseAddress;
     memory->m_handle = handle;
 
-    return memory.release();
+    return memory;
 }
 
 static DWORD accessRights(SharedMemory::Protection protection)
 {
     switch (protection) {
-    case SharedMemory::ReadOnly:
+    case SharedMemory::Protection::ReadOnly:
         return FILE_MAP_READ;
-    case SharedMemory::ReadWrite:
+    case SharedMemory::Protection::ReadWrite:
         return FILE_MAP_READ | FILE_MAP_WRITE;
     }
 
@@ -143,36 +148,36 @@ static DWORD accessRights(SharedMemory::Protection protection)
     return 0;
 }
 
-PassRefPtr<SharedMemory> SharedMemory::create(const Handle& handle, Protection protection)
+RefPtr<SharedMemory> SharedMemory::map(const Handle& handle, Protection protection)
 {
     RefPtr<SharedMemory> memory = adopt(handle.m_handle, handle.m_size, protection);
     if (!memory)
-        return 0;
+        return nullptr;
 
     // The SharedMemory object now owns the HANDLE.
     handle.m_handle = 0;
 
-    return memory.release();
+    return memory;
 }
 
-PassRefPtr<SharedMemory> SharedMemory::adopt(HANDLE handle, size_t size, Protection protection)
+RefPtr<SharedMemory> SharedMemory::adopt(HANDLE handle, size_t size, Protection protection)
 {
     if (!handle)
-        return 0;
+        return nullptr;
 
     DWORD desiredAccess = accessRights(protection);
 
     void* baseAddress = ::MapViewOfFile(handle, desiredAccess, 0, 0, size);
     ASSERT_WITH_MESSAGE(baseAddress, "::MapViewOfFile failed with error %lu", ::GetLastError());
     if (!baseAddress)
-        return 0;
+        return nullptr;
 
     RefPtr<SharedMemory> memory = adoptRef(new SharedMemory);
     memory->m_size = size;
     memory->m_data = baseAddress;
     memory->m_handle = handle;
 
-    return memory.release();
+    return memory;
 }
 
 SharedMemory::~SharedMemory()
@@ -200,31 +205,6 @@ bool SharedMemory::createHandle(Handle& handle, Protection protection)
     return true;
 }
 
-PassRefPtr<SharedMemory> SharedMemory::createCopyOnWriteCopy(size_t size) const
-{
-    ASSERT_ARG(size, size <= this->size());
-
-    HANDLE duplicatedHandle;
-    BOOL result = ::DuplicateHandle(::GetCurrentProcess(), m_handle, ::GetCurrentProcess(), &duplicatedHandle, 0, FALSE, DUPLICATE_SAME_ACCESS);
-    ASSERT_WITH_MESSAGE(result, "::DuplicateHandle failed with error %lu", ::GetLastError());
-    if (!result)
-        return 0;
-
-    void* newMapping = ::MapViewOfFile(duplicatedHandle, FILE_MAP_COPY, 0, 0, size);
-    ASSERT_WITH_MESSAGE(newMapping, "::MapViewOfFile failed with error %lu", ::GetLastError());
-    if (!newMapping) {
-        ::CloseHandle(duplicatedHandle);
-        return 0;
-    }
-
-    RefPtr<SharedMemory> memory = adoptRef(new SharedMemory);
-    memory->m_size = size;
-    memory->m_data = newMapping;
-    memory->m_handle = duplicatedHandle;
-
-    return memory.release();
-}
-
 unsigned SharedMemory::systemPageSize()
 {
     static unsigned pageSize = 0;
diff --git a/Source/WebKit2/PlatformQt.cmake b/Source/WebKit2/PlatformQt.cmake
index ec36a4247..5243ef2d8 100644
--- a/Source/WebKit2/PlatformQt.cmake
+++ b/Source/WebKit2/PlatformQt.cmake
@@ -11,6 +11,8 @@ else ()
     set(WebKit2_LIBRARY_TYPE STATIC)
 endif ()
 
+add_definitions(-DBUILDING_WEBKIT)
+
 if (${JavaScriptCore_LIBRARY_TYPE} MATCHES STATIC)
     add_definitions(-DSTATICALLY_LINKED_WITH_WTF -DSTATICALLY_LINKED_WITH_JavaScriptCore)
 endif ()
@@ -230,6 +232,7 @@ if (USE_MACH_PORTS)
     )
 elseif (WIN32)
     list(APPEND WebKit2_SOURCES
+        Platform/IPC/win/AttachmentWin.cpp
         Platform/IPC/win/ConnectionWin.cpp
 
         Platform/win/SharedMemoryWin.cpp
diff --git a/Source/WebKit2/PluginProcess/PluginProcess.h b/Source/WebKit2/PluginProcess/PluginProcess.h
index 1cc4bf71a..6a545618f 100644
--- a/Source/WebKit2/PluginProcess/PluginProcess.h
+++ b/Source/WebKit2/PluginProcess/PluginProcess.h
@@ -72,8 +72,9 @@ public:
 
     CountedUserActivity& connectionActivity() { return m_connectionActivity; }
 
-private:
     PluginProcess();
+
+private:
     ~PluginProcess();
 
     // ChildProcess
diff --git a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
index bb858d0a0..24416cf14 100644
--- a/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
+++ b/Source/WebKit2/PluginProcess/WebProcessConnection.cpp
@@ -38,14 +38,24 @@
 #include "PluginProcessConnectionMessages.h"
 #include "PluginProxyMessages.h"
 #include "WebProcessConnectionMessages.h"
-#include <unistd.h>
 #include <wtf/RunLoop.h>
 #include <wtf/TemporaryChange.h>
 
+#if OS(UNIX)
+#include <unistd.h>
+#endif
+
 using namespace WebCore;
 
 namespace WebKit {
 
+#if OS(WINDOWS)
+static void sleep(unsigned seconds)
+{
+    ::Sleep(seconds * 1000);
+}
+#endif
+
 static IPC::Connection* currentConnection;
 
 RefPtr<WebProcessConnection> WebProcessConnection::create(IPC::Connection::Identifier connectionIdentifier)
diff --git a/Source/WebKit2/UIProcess/Databases/DatabaseProcessProxy.cpp b/Source/WebKit2/UIProcess/Databases/DatabaseProcessProxy.cpp
index 7ed02d6dc..f1f8a86c6 100644
--- a/Source/WebKit2/UIProcess/Databases/DatabaseProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Databases/DatabaseProcessProxy.cpp
@@ -133,7 +133,7 @@ void DatabaseProcessProxy::didClose(IPC::Connection&)
     while (!m_pendingConnectionReplies.isEmpty()) {
         auto reply = m_pendingConnectionReplies.takeFirst();
 
-#if USE(UNIX_DOMAIN_SOCKETS)
+#if USE(UNIX_DOMAIN_SOCKETS) || OS(WINDOWS)
         reply->send(IPC::Attachment());
 #elif OS(DARWIN)
         reply->send(IPC::Attachment(0, MACH_MSG_TYPE_MOVE_SEND));
@@ -168,7 +168,7 @@ void DatabaseProcessProxy::didCreateDatabaseToWebProcessConnection(const IPC::At
 
     RefPtr<Messages::WebProcessProxy::GetDatabaseProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
-#if USE(UNIX_DOMAIN_SOCKETS)
+#if USE(UNIX_DOMAIN_SOCKETS) || OS(WINDOWS)
     reply->send(connectionIdentifier);
 #elif OS(DARWIN)
     reply->send(IPC::Attachment(connectionIdentifier.port(), MACH_MSG_TYPE_MOVE_SEND));
diff --git a/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp b/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp
index 3fb4855d8..f448ef5fd 100644
--- a/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Network/NetworkProcessProxy.cpp
@@ -167,7 +167,7 @@ void NetworkProcessProxy::networkProcessCrashedOrFailedToLaunch()
     while (!m_pendingConnectionReplies.isEmpty()) {
         RefPtr<Messages::WebProcessProxy::GetNetworkProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
-#if USE(UNIX_DOMAIN_SOCKETS)
+#if USE(UNIX_DOMAIN_SOCKETS) || OS(WINDOWS)
         reply->send(IPC::Attachment());
 #elif OS(DARWIN)
         reply->send(IPC::Attachment(0, MACH_MSG_TYPE_MOVE_SEND));
@@ -233,7 +233,7 @@ void NetworkProcessProxy::didCreateNetworkConnectionToWebProcess(const IPC::Atta
     // Grab the first pending connection reply.
     RefPtr<Messages::WebProcessProxy::GetNetworkProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
-#if USE(UNIX_DOMAIN_SOCKETS)
+#if USE(UNIX_DOMAIN_SOCKETS) || OS(WINDOWS)
     reply->send(connectionIdentifier);
 #elif OS(DARWIN)
     reply->send(IPC::Attachment(connectionIdentifier.port(), MACH_MSG_TYPE_MOVE_SEND));
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
index 8152125da..be5728c56 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessManager.h
@@ -71,9 +71,9 @@ public:
     void updateProcessSuppressionDisabled(bool);
 #endif
 
-private:
     PluginProcessManager();
 
+private:
     PluginProcessProxy* getOrCreatePluginProcess(uint64_t pluginProcessToken);
 
     Vector<std::pair<PluginProcessAttributes, uint64_t>> m_pluginProcessTokens;
diff --git a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
index 9bc7a04c7..41df0e27f 100644
--- a/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/Plugins/PluginProcessProxy.cpp
@@ -154,7 +154,7 @@ void PluginProcessProxy::pluginProcessCrashedOrFailedToLaunch()
     while (!m_pendingConnectionReplies.isEmpty()) {
         RefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
-#if USE(UNIX_DOMAIN_SOCKETS)
+#if USE(UNIX_DOMAIN_SOCKETS) || OS(WINDOWS)
         reply->send(IPC::Attachment(), false);
 #elif OS(DARWIN)
         reply->send(IPC::Attachment(0, MACH_MSG_TYPE_MOVE_SEND), false);
@@ -270,7 +270,7 @@ void PluginProcessProxy::didCreateWebProcessConnection(const IPC::Attachment& co
     // Grab the first pending connection reply.
     RefPtr<Messages::WebProcessProxy::GetPluginProcessConnection::DelayedReply> reply = m_pendingConnectionReplies.takeFirst();
 
-#if USE(UNIX_DOMAIN_SOCKETS)
+#if USE(UNIX_DOMAIN_SOCKETS) || OS(WINDOWS)
     reply->send(connectionIdentifier, supportsAsynchronousPluginInitialization);
 #elif OS(DARWIN)
     reply->send(IPC::Attachment(connectionIdentifier.port(), MACH_MSG_TYPE_MOVE_SEND), supportsAsynchronousPluginInitialization);
diff --git a/Source/WebKit2/UIProcess/ProcessAssertion.cpp b/Source/WebKit2/UIProcess/ProcessAssertion.cpp
index e0279bd8a..e1ad6bac2 100644
--- a/Source/WebKit2/UIProcess/ProcessAssertion.cpp
+++ b/Source/WebKit2/UIProcess/ProcessAssertion.cpp
@@ -30,7 +30,7 @@
 
 namespace WebKit {
 
-ProcessAssertion::ProcessAssertion(pid_t, AssertionState assertionState)
+ProcessAssertion::ProcessAssertion(PlatformProcessIdentifier, AssertionState assertionState)
     : m_assertionState(assertionState)
 {
 }
@@ -47,7 +47,7 @@ void ProcessAssertion::setState(AssertionState assertionState)
     m_assertionState = assertionState;
 }
 
-ProcessAndUIAssertion::ProcessAndUIAssertion(pid_t pid, AssertionState assertionState)
+ProcessAndUIAssertion::ProcessAndUIAssertion(PlatformProcessIdentifier pid, AssertionState assertionState)
     : ProcessAssertion(pid, assertionState)
 {
 }
diff --git a/Source/WebKit2/UIProcess/ProcessAssertion.h b/Source/WebKit2/UIProcess/ProcessAssertion.h
index 95c97c13e..75d396ad9 100644
--- a/Source/WebKit2/UIProcess/ProcessAssertion.h
+++ b/Source/WebKit2/UIProcess/ProcessAssertion.h
@@ -26,6 +26,8 @@
 #ifndef ProcessAssertion_h
 #define ProcessAssertion_h
 
+#include "PlatformProcessIdentifier.h"
+
 #if PLATFORM(IOS) && !PLATFORM(IOS_SIMULATOR)
 #include <wtf/RetainPtr.h>
 OBJC_CLASS BKSProcessAssertion;
@@ -47,7 +49,7 @@ public:
 
 class ProcessAssertion {
 public:
-    ProcessAssertion(pid_t, AssertionState);
+    ProcessAssertion(PlatformProcessIdentifier, AssertionState);
     ~ProcessAssertion();
 
     void setClient(ProcessAssertionClient& client) { m_client = &client; }
@@ -66,7 +68,7 @@ private:
     
 class ProcessAndUIAssertion : public ProcessAssertion {
 public:
-    ProcessAndUIAssertion(pid_t, AssertionState);
+    ProcessAndUIAssertion(PlatformProcessIdentifier, AssertionState);
     ~ProcessAndUIAssertion();
 
     void setClient(ProcessAssertionClient&);
diff --git a/Source/WebKit2/UIProcess/ProcessThrottler.cpp b/Source/WebKit2/UIProcess/ProcessThrottler.cpp
index b4b017960..3af224c74 100644
--- a/Source/WebKit2/UIProcess/ProcessThrottler.cpp
+++ b/Source/WebKit2/UIProcess/ProcessThrottler.cpp
@@ -87,7 +87,7 @@ void ProcessThrottler::updateAssertion()
     updateAssertionNow();
 }
 
-void ProcessThrottler::didConnectToProcess(pid_t pid)
+void ProcessThrottler::didConnectToProcess(PlatformProcessIdentifier pid)
 {
     m_suspendTimer.stop();
     m_assertion = std::make_unique<ProcessAndUIAssertion>(pid, assertionState());
diff --git a/Source/WebKit2/UIProcess/ProcessThrottler.h b/Source/WebKit2/UIProcess/ProcessThrottler.h
index 3878d0ae8..e4b569149 100644
--- a/Source/WebKit2/UIProcess/ProcessThrottler.h
+++ b/Source/WebKit2/UIProcess/ProcessThrottler.h
@@ -53,7 +53,7 @@ public:
     inline ForegroundActivityToken foregroundActivityToken() const;
     inline BackgroundActivityToken backgroundActivityToken() const;
     
-    void didConnectToProcess(pid_t);
+    void didConnectToProcess(PlatformProcessIdentifier);
     void processReadyToSuspend();
     void didCancelProcessSuspension();
 
diff --git a/Source/WebKit2/UIProcess/WebBackForwardList.cpp b/Source/WebKit2/UIProcess/WebBackForwardList.cpp
index 273431232..033b392b5 100644
--- a/Source/WebKit2/UIProcess/WebBackForwardList.cpp
+++ b/Source/WebKit2/UIProcess/WebBackForwardList.cpp
@@ -416,6 +416,8 @@ BackForwardListState WebBackForwardList::backForwardListState(const std::functio
 
     if (backForwardListState.items.isEmpty())
         backForwardListState.currentIndex = Nullopt;
+    else if (backForwardListState.items.size() <= backForwardListState.currentIndex.value())
+        backForwardListState.currentIndex = backForwardListState.items.size() - 1;
 
     return backForwardListState;
 }
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 3bb4a0134..5f6a16f70 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -237,8 +237,9 @@ public:
     bool areBeingProcessed() const { return !!m_currentRecord; }
     Record* next();
 
-private:
     ExceededDatabaseQuotaRecords() { }
+
+private:
     ~ExceededDatabaseQuotaRecords() { }
 
     Deque<std::unique_ptr<Record>> m_records;
@@ -873,6 +874,7 @@ void WebPageProxy::close()
     resetState(ResetStateReason::PageInvalidated);
 
     m_loaderClient = std::make_unique<API::LoaderClient>();
+    m_navigationClient = nullptr;
     m_policyClient = std::make_unique<API::PolicyClient>();
     m_formClient = std::make_unique<API::FormClient>();
     m_uiClient = std::make_unique<API::UIClient>();
diff --git a/Source/WebKit2/UIProcess/WebPasteboardProxy.h b/Source/WebKit2/UIProcess/WebPasteboardProxy.h
index 494aac9f8..4a5cd15b0 100644
--- a/Source/WebKit2/UIProcess/WebPasteboardProxy.h
+++ b/Source/WebKit2/UIProcess/WebPasteboardProxy.h
@@ -50,9 +50,9 @@ public:
 
     void addWebProcessProxy(WebProcessProxy&);
 
-private:
     WebPasteboardProxy();
 
+private:
     virtual void didReceiveMessage(IPC::Connection&, IPC::MessageDecoder&) override;
     virtual void didReceiveSyncMessage(IPC::Connection&, IPC::MessageDecoder&, std::unique_ptr<IPC::MessageEncoder>&) override;
 
diff --git a/Source/WebKit2/UIProcess/WebProcessPool.cpp b/Source/WebKit2/UIProcess/WebProcessPool.cpp
index 352a1f7ca..3337b25c3 100644
--- a/Source/WebKit2/UIProcess/WebProcessPool.cpp
+++ b/Source/WebKit2/UIProcess/WebProcessPool.cpp
@@ -97,11 +97,28 @@
 #include <wtf/RefCountedLeakCounter.h>
 #endif
 
+#if PLATFORM(QT)
+#include <QProcess>
+#endif
+
 using namespace WebCore;
 using namespace WebKit;
 
 namespace WebKit {
 
+#if PLATFORM(QT)
+static int qProcessId(QProcess* process)
+{
+#if QT_VERSION >= QT_VERSION_CHECK(5, 3, 0)
+    return static_cast<int>(process->processId());
+#elif OS(WINDOWS)
+    return static_cast<int>(process->pid()->dwProcessId);
+#else
+    return static_cast<int>(process->pid());
+#endif
+}
+#endif
+
 DEFINE_DEBUG_ONLY_GLOBAL(WTF::RefCountedLeakCounter, processPoolCounter, ("WebProcessPool"));
 
 Ref<WebProcessPool> WebProcessPool::create(API::ProcessPoolConfiguration& configuration)
@@ -699,7 +716,11 @@ void WebProcessPool::processDidFinishLaunching(WebProcessProxy* process)
     if (m_memorySamplerEnabled) {
         SandboxExtension::Handle sampleLogSandboxHandle;        
         double now = WTF::currentTime();
+#if PLATFORM(QT)
+        String sampleLogFilePath = String::format("WebProcess%llupid%d", static_cast<unsigned long long>(now), qProcessId(process->processIdentifier()));
+#else
         String sampleLogFilePath = String::format("WebProcess%llupid%d", static_cast<unsigned long long>(now), process->processIdentifier());
+#endif
         sampleLogFilePath = SandboxExtension::createHandleForTemporaryFile(sampleLogFilePath, SandboxExtension::ReadWrite, sampleLogSandboxHandle);
         
         process->send(Messages::WebProcess::StartMemorySampler(sampleLogSandboxHandle, sampleLogFilePath, m_memorySamplerInterval), 0);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp
index 8a945149b..dcb73b3ff 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp
@@ -29,6 +29,7 @@
 #include "ShareableBitmap.h"
 #include "WebImage.h"
 #include <JavaScriptCore/APICast.h>
+#include <WebCore/DOMWrapperWorld.h>
 #include <WebCore/Document.h>
 #include <WebCore/FloatRect.h>
 #include <WebCore/Frame.h>
diff --git a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
index 4afd106ac..77aaa9c32 100644
--- a/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/PluginProcessConnectionManager.cpp
@@ -78,6 +78,8 @@ PluginProcessConnection* PluginProcessConnectionManager::getPluginProcessConnect
     IPC::Connection::Identifier connectionIdentifier = encodedConnectionIdentifier.releaseFileDescriptor();
 #elif OS(DARWIN)
     IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.port());
+#elif OS(WINDOWS)
+    IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.handle());
 #endif
     if (IPC::Connection::identifierIsNull(connectionIdentifier))
         return nullptr;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
index 09e32628b..0e3363999 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp
@@ -366,8 +366,19 @@ void WebChromeClient::closeWindowSoon()
     m_page->sendClose();
 }
 
+static bool shouldSuppressJavaScriptDialogs(Frame& frame)
+{
+    if (frame.loader().opener() && frame.loader().stateMachine().isDisplayingInitialEmptyDocument() && frame.loader().provisionalDocumentLoader())
+        return true;
+
+    return false;
+}
+
 void WebChromeClient::runJavaScriptAlert(Frame* frame, const String& alertText)
 {
+    if (shouldSuppressJavaScriptDialogs(*frame))
+        return;
+
     WebFrame* webFrame = WebFrame::fromCoreFrame(*frame);
     ASSERT(webFrame);
 
@@ -381,6 +392,9 @@ void WebChromeClient::runJavaScriptAlert(Frame* frame, const String& alertText)
 
 bool WebChromeClient::runJavaScriptConfirm(Frame* frame, const String& message)
 {
+    if (shouldSuppressJavaScriptDialogs(*frame))
+        return false;
+
     WebFrame* webFrame = WebFrame::fromCoreFrame(*frame);
     ASSERT(webFrame);
 
@@ -398,6 +412,9 @@ bool WebChromeClient::runJavaScriptConfirm(Frame* frame, const String& message)
 
 bool WebChromeClient::runJavaScriptPrompt(Frame* frame, const String& message, const String& defaultValue, String& result)
 {
+    if (shouldSuppressJavaScriptDialogs(*frame))
+        return false;
+
     WebFrame* webFrame = WebFrame::fromCoreFrame(*frame);
     ASSERT(webFrame);
 
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
index 176898d8f..617f83f92 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h
@@ -41,9 +41,9 @@ class WebPlatformStrategies : public WebCore::PlatformStrategies, private WebCor
 public:
     static void initialize();
     
-private:
     WebPlatformStrategies();
     
+private:
     // WebCore::PlatformStrategies
     virtual WebCore::CookiesStrategy* createCookiesStrategy() override;
     virtual WebCore::LoaderStrategy* createLoaderStrategy() override;
diff --git a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
index 76b29b238..35c4182a8 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebBackForwardListProxy.cpp
@@ -100,7 +100,7 @@ void WebBackForwardListProxy::addItemFromUIProcess(uint64_t itemID, Ref<HistoryI
     ASSERT(!historyItemToIDMap().contains(item.ptr()));
     ASSERT(!idToHistoryItemMap().contains(itemID));
 
-    historyItemToIDMap().set<ItemAndPageID>(item.ptr(), { .itemID = itemID, .pageID = pageID });
+    historyItemToIDMap().set<ItemAndPageID>(item.ptr(), { itemID, pageID });
     idToHistoryItemMap().set(itemID, item.ptr());
 }
 
@@ -154,7 +154,7 @@ void WebBackForwardListProxy::addItem(Ref<HistoryItem>&& item)
 
     m_associatedItemIDs.add(itemID);
 
-    historyItemToIDMap().set<ItemAndPageID>(item.ptr(), { .itemID = itemID, .pageID = m_page->pageID() });
+    historyItemToIDMap().set<ItemAndPageID>(item.ptr(), { itemID, m_page->pageID() });
     idToHistoryItemMap().set(itemID, item.ptr());
 
     updateBackForwardItem(itemID, m_page->pageID(), item.ptr());
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
index 7337ac414..b22d5160f 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspector.cpp
@@ -76,6 +76,13 @@ void WebInspector::openFrontendConnection(bool underTest)
     IPC::Connection::SocketPair socketPair = IPC::Connection::createPlatformConnection();
     IPC::Connection::Identifier connectionIdentifier(socketPair.server);
     IPC::Attachment connectionClientPort(socketPair.client);
+#elif OS(WINDOWS)
+    IPC::Connection::Identifier connectionIdentifier, clientIdentifier;
+    if (!IPC::Connection::createServerAndClientIdentifiers(connectionIdentifier, clientIdentifier)) {
+        // log it?
+        return;
+    }
+    IPC::Attachment connectionClientPort(clientIdentifier);
 #elif OS(DARWIN)
     mach_port_t listeningPort;
     mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &listeningPort);
diff --git a/Source/WebKit2/WebProcess/WebPage/WebInspectorUI.cpp b/Source/WebKit2/WebProcess/WebPage/WebInspectorUI.cpp
index 7dbefe7f2..b9264f802 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebInspectorUI.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebInspectorUI.cpp
@@ -58,6 +58,8 @@ void WebInspectorUI::establishConnection(IPC::Attachment encodedConnectionIdenti
     IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.releaseFileDescriptor());
 #elif OS(DARWIN)
     IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.port());
+#elif OS(WINDOWS)
+    IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.handle());
 #else
     notImplemented();
     return;
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index 0ca88c527..eef2b1d2e 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -381,6 +381,8 @@ void WebProcess::ensureNetworkProcessConnection()
     IPC::Connection::Identifier connectionIdentifier = encodedConnectionIdentifier.releaseFileDescriptor();
 #elif OS(DARWIN)
     IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.port());
+#elif OS(WINDOWS)
+    IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.handle());
 #else
     ASSERT_NOT_REACHED();
 #endif
@@ -1052,6 +1054,8 @@ void WebProcess::ensureWebToDatabaseProcessConnection()
     IPC::Connection::Identifier connectionIdentifier = encodedConnectionIdentifier.releaseFileDescriptor();
 #elif OS(DARWIN)
     IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.port());
+#elif OS(WINDOWS)
+    IPC::Connection::Identifier connectionIdentifier(encodedConnectionIdentifier.handle());
 #else
     ASSERT_NOT_REACHED();
 #endif
diff --git a/Source/WebKit2/config.h b/Source/WebKit2/config.h
index 61cdcffa6..668012f59 100644
--- a/Source/WebKit2/config.h
+++ b/Source/WebKit2/config.h
@@ -49,11 +49,12 @@
 #define _WINSOCKAPI_ /* Prevent inclusion of winsock.h in windows.h */
 #endif
 
-#if !PLATFORM(QT)
 #include <WebCore/config.h>
-#endif
 #include <windows.h>
 
+#undef WEBCORE_EXPORT
+#define WEBCORE_EXPORT WTF_EXPORT_DECLARATION
+
 #if USE(CG)
 #include <CoreGraphics/CoreGraphics.h>
 #endif
diff --git a/Source/cmake/OptionsQt.cmake b/Source/cmake/OptionsQt.cmake
index 27620f509..6dc423109 100644
--- a/Source/cmake/OptionsQt.cmake
+++ b/Source/cmake/OptionsQt.cmake
@@ -3,6 +3,12 @@ include(ECMPackageConfigHelpers)
 
 set(ECM_MODULE_DIR ${CMAKE_MODULE_PATH})
 
+set(PROJECT_VERSION_MAJOR 5)
+set(PROJECT_VERSION_MINOR 212)
+set(PROJECT_VERSION_PATCH 0)
+set(PROJECT_VERSION ${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH})
+set(PROJECT_VERSION_STRING "${PROJECT_VERSION}")
+
 set(QT_CONAN_DIR "" CACHE PATH "Directory containing conanbuildinfo.cmake and conanfile.txt")
 if (QT_CONAN_DIR)
     include("${QT_CONAN_DIR}/conanbuildinfo.cmake")
@@ -53,12 +59,6 @@ macro(QT_ADD_EXTRA_WEBKIT_TARGET_EXPORT target)
     endif ()
 endmacro()
 
-set(PROJECT_VERSION_MAJOR 5)
-set(PROJECT_VERSION_MINOR 602)
-set(PROJECT_VERSION_MICRO 3)
-set(PROJECT_VERSION ${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_MICRO})
-set(PROJECT_VERSION_STRING "${PROJECT_VERSION}")
-
 set(CMAKE_MACOSX_RPATH ON)
 
 add_definitions(-DBUILDING_QT__=1)
@@ -98,12 +98,6 @@ else ()
     set(USE_QT_MULTIMEDIA_DEFAULT OFF)
 endif ()
 
-if (WIN32)
-    set(ENABLE_WEBKIT2_DEFAULT OFF)
-else ()
-    set(ENABLE_WEBKIT2_DEFAULT ON)
-endif ()
-
 if (CMAKE_SYSTEM_NAME MATCHES "Linux")
     set(ENABLE_GAMEPAD_DEPRECATED_DEFAULT ON)
 else ()
@@ -144,7 +138,7 @@ WEBKIT_OPTION_DEFINE(ENABLE_OPENGL "Whether to use OpenGL." PUBLIC ON)
 WEBKIT_OPTION_DEFINE(ENABLE_PRINT_SUPPORT "Enable support for printing web pages" PUBLIC ON)
 WEBKIT_OPTION_DEFINE(ENABLE_QT_GESTURE_EVENTS "Enable support for gesture events (required for mouse in WK2)" PUBLIC ON)
 WEBKIT_OPTION_DEFINE(ENABLE_QT_WEBCHANNEL "Enable support for Qt WebChannel" PUBLIC ON)
-WEBKIT_OPTION_DEFINE(ENABLE_WEBKIT2 "Enable WebKit2 (QML API)" PUBLIC ${ENABLE_WEBKIT2_DEFAULT})
+WEBKIT_OPTION_DEFINE(ENABLE_WEBKIT2 "Enable WebKit2 (QML API)" PUBLIC ON)
 WEBKIT_OPTION_DEFINE(ENABLE_X11_TARGET "Whether to enable support for the X11 windowing target." PUBLIC ${ENABLE_X11_TARGET_DEFAULT})
 
 option(GENERATE_DOCUMENTATION "Generate HTML and QCH documentation" OFF)
@@ -437,6 +431,10 @@ if (ENABLE_WEBKIT2)
     )
     SET_AND_EXPOSE_TO_BUILD(USE_COORDINATED_GRAPHICS TRUE)
     SET_AND_EXPOSE_TO_BUILD(USE_COORDINATED_GRAPHICS_MULTIPROCESS TRUE)
+
+    if (ENABLE_INDEXED_DATABASE AND NOT ENABLE_DATABASE_PROCESS)
+        message(FATAL_ERROR "Using IndexedDB with WebKit2 requires ENABLE_DATABASE_PROCESS")
+    endif ()
 endif ()
 
 # Mach ports and Unix sockets are currently used by WK2, but their USE() values
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index e72ee703a..8f1829e3f 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -1019,7 +1019,8 @@ void DumpRenderTree::dump()
 
         QImage image;
         if (!m_jscController->isPrinting()) {
-            image = QImage(m_page->viewportSize(), QImage::Format_ARGB32);
+            image = QImage(m_page->viewportSize() * m_page->devicePixelRatio(), QImage::Format_ARGB32);
+            image.setDevicePixelRatio(m_page->devicePixelRatio());
             image.fill(Qt::white);
             QPainter painter(&image);
             painter.setRenderHints(renderHints);
diff --git a/Tools/DumpRenderTree/qt/TestRunnerQt.cpp b/Tools/DumpRenderTree/qt/TestRunnerQt.cpp
index 09f1d09dc..145a4f01a 100644
--- a/Tools/DumpRenderTree/qt/TestRunnerQt.cpp
+++ b/Tools/DumpRenderTree/qt/TestRunnerQt.cpp
@@ -71,6 +71,8 @@ void TestRunnerQt::reset()
     m_geolocationPermission = false;
     m_audioData.clear();
 
+    m_drt->webPage()->setDevicePixelRatio(1);
+
     DumpRenderTreeSupportQt::dumpEditingCallbacks(false);
     DumpRenderTreeSupportQt::dumpFrameLoader(false);
     DumpRenderTreeSupportQt::dumpProgressFinishedCallback(false);
@@ -869,8 +871,9 @@ void TestRunner::focusWebView()
 {
 }
 
-void TestRunner::setBackingScaleFactor(double)
+void TestRunner::setBackingScaleFactor(double scale)
 {
+    DumpRenderTree::instance()->webPage()->setDevicePixelRatio(scale);
 }
 
 void TestRunner::removeChromeInputField()
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
index 7dbb4c519..f36621922 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.cpp
@@ -303,6 +303,7 @@ static void printHelp(const QString& programName)
     qDebug() << "Usage:" << programName.toLatin1().data()
          << "[--desktop]"
          << "[-r list]"
+         << "[--remote-inspector [port|addr]]"
          << "[--robot-timeout seconds]"
          << "[--robot-extra-time seconds]"
          << "[--window-size (width)x(height)]"
@@ -348,6 +349,12 @@ void MiniBrowserApplication::handleUserOptions()
             m_windowOptions.setRequestedWindowSize(QSize(list.at(0).toInt(), list.at(1).toInt()));
     }
 
+    if (args.contains("--remote-inspector")) {
+        QString value = takeOptionValue(&args, "--remote-inspector");
+        if (!value.isEmpty())
+            qputenv("QTWEBKIT_INSPECTOR_SERVER", value.toUtf8());
+    }
+
 #if HAVE(QTTESTSUPPORT)
     if (takeOptionFlag(&args, QStringLiteral("--use-test-fonts")))
         WebKit::QtTestSupport::initializeTestFonts();
diff --git a/Tools/QtTestBrowser/launcherwindow.cpp b/Tools/QtTestBrowser/launcherwindow.cpp
index 3d3414272..26b6dce79 100644
--- a/Tools/QtTestBrowser/launcherwindow.cpp
+++ b/Tools/QtTestBrowser/launcherwindow.cpp
@@ -262,6 +262,7 @@ void LauncherWindow::createChrome()
     editMenu->addAction(page()->action(QWebPage::Paste));
     editMenu->addSeparator();
     editMenu->addAction(page()->action(QWebPage::SelectAll));
+    editMenu->addAction("Unselect", this, SLOT(clearPageSelection()), QKeySequence::Deselect);
     editMenu->addSeparator();
 #ifndef QT_NO_LINEEDIT
     editMenu->addAction("&Find", this, SLOT(showFindBar()), QKeySequence(Qt::CTRL | Qt::Key_F));
@@ -1178,6 +1179,11 @@ void LauncherWindow::clearMemoryCaches()
     qDebug() << "Memory caches were cleared";
 }
 
+void LauncherWindow::clearPageSelection()
+{
+    page()->triggerAction(QWebPage::Unselect);
+}
+
 void LauncherWindow::updateFPS(int fps)
 {
     QString fpsStatusText = QString("Current FPS: %1").arg(fps);
diff --git a/Tools/QtTestBrowser/launcherwindow.h b/Tools/QtTestBrowser/launcherwindow.h
index 9020109db..0b5ea32db 100644
--- a/Tools/QtTestBrowser/launcherwindow.h
+++ b/Tools/QtTestBrowser/launcherwindow.h
@@ -176,6 +176,7 @@ protected Q_SLOTS:
 #endif
 
     void clearMemoryCaches();
+    void clearPageSelection();
 
 public Q_SLOTS:
     LauncherWindow* newWindow();
diff --git a/Tools/Scripts/build-webkit b/Tools/Scripts/build-webkit
index d9ea259c7..b8a4bd1e2 100755
--- a/Tools/Scripts/build-webkit
+++ b/Tools/Scripts/build-webkit
@@ -56,6 +56,7 @@ my $minimal = 0;
 my $installHeaders;
 my $installLibs;
 my $prefixPath;
+my $shouldInstall = 0;
 my $makeArgs = "";
 my $cmakeArgs = "";
 my $onlyWebKitProject = 0;
@@ -100,14 +101,14 @@ Usage: $programName [options] [options to pass to build system]
 
   --inspector-frontend              Copy Web Inspector user interface resources to the build directory
 
-  --prefix=<path>                   Set installation prefix to the given path (Gtk/Efl only)
+  --prefix=<path>                   Set installation prefix to the given path (Gtk/Efl/Qt only)
+  --install                         Install into given prefix after compilation
   --makeargs=<arguments>            Optional Makefile flags
   --cmakeargs=<arguments>           Optional CMake flags (e.g. --cmakeargs="-DFOO=bar -DCMAKE_PREFIX_PATH=/usr/local")
 
   --minimal                         No optional features, unless explicitly enabled
 
   --only-webkit                     Build only the WebKit project
-
 EOF
 
 my %options = (
@@ -116,6 +117,7 @@ my %options = (
     'install-headers=s' => \$installHeaders,
     'install-libs=s' => \$installLibs,
     'prefix=s' => \$prefixPath,
+    'install' => \$shouldInstall,
     'makeargs=s' => \$makeArgs,
     'cmakeargs=s' => \$cmakeArgs,
     'minimal' => \$minimal,
@@ -238,6 +240,9 @@ if (isInspectorFrontend()) {
 }
 
 if (isCMakeBuild() && (!isAnyWindows() || isQt())) {
+    if ($shouldInstall) {
+        $makeArgs .= ($makeArgs ? " " : "") . "install";
+    }
 
     # Visual Studio generator doesn't support -j switch
     if (canUseNinja() || !isAnyWindows()) {
diff --git a/Tools/TestWebKitAPI/Tests/WebCore/TransformationMatrix.cpp b/Tools/TestWebKitAPI/Tests/WebCore/TransformationMatrix.cpp
new file mode 100644
index 000000000..67c85e0e0
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebCore/TransformationMatrix.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2013, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include <WebCore/TransformationMatrix.h>
+
+using namespace WebCore;
+
+namespace TestWebKitAPI {
+
+TEST(TransformationMatrix, NonInvertableBlend)
+{
+    TransformationMatrix from;
+    TransformationMatrix to(2.7133590938, 0.0, 0.0, 0.0, 0.0, 2.4645137761, 0.0, 0.0, 0.0, 0.0, 0.00, 0.01, 0.02, 0.03, 0.04, 0.05);
+    TransformationMatrix result;
+
+    result = to;
+    result.blend(from, 0.25);
+    EXPECT_TRUE(result == from);
+
+    result = to;
+    result.blend(from, 0.75);
+    EXPECT_TRUE(result == to);
+}
+
+}
diff --git a/Tools/qmake/projects/generate_forwarding_pris.pro b/Tools/qmake/projects/generate_forwarding_pris.pro
new file mode 100644
index 000000000..3618699d8
--- /dev/null
+++ b/Tools/qmake/projects/generate_forwarding_pris.pro
@@ -0,0 +1,44 @@
+load(functions)
+load(qt_build_paths)
+
+TEMPLATE = aux
+
+qtConfig(debug_and_release): CONFIG += debug_and_release build_all
+
+defineTest(writeForwardingPri) {
+    module = $$1
+    configuration = $$2
+    cmake_build_dir = $$ROOT_BUILD_DIR/$$configuration
+    forwarding_pri_name = $$MODULE_QMAKE_OUTDIR/mkspecs/modules/qt_lib_$${module}.pri
+
+    FORWARDING_PRI_CONTENTS += \
+        "QT_MODULE_BIN_BASE = $$cmake_build_dir/bin" \
+        "QT_MODULE_INCLUDE_BASE = $$cmake_build_dir/DerivedSources/ForwardingHeaders" \
+        "QT_MODULE_LIB_BASE = $$cmake_build_dir/lib" \
+        "QT_MODULE_HOST_LIB_BASE = $$cmake_build_dir/lib" \
+        "include($$cmake_build_dir/Source/WebKit/qt_lib_$${module}.pri)"
+
+    FORWARDING_PRI_CONTENTS += \
+        "QT.$${module}.priority = 1" \
+        "QT.$${module}.includes += $$ROOT_WEBKIT_DIR/Source"
+
+    message("Writing $$forwarding_pri_name")
+    write_file($$forwarding_pri_name, FORWARDING_PRI_CONTENTS)|error()
+}
+
+
+debug_and_release {
+    !build_pass {
+        # Use release build in case of debug_and_release
+        writeForwardingPri(webkit, release)
+        writeForwardingPri(webkitwidgets, release)
+    }
+} else {
+    CONFIG(debug, debug|release) {
+        configuration = debug
+    } else {
+        configuration = release
+    }
+    writeForwardingPri(webkit, $$configuration)
+    writeForwardingPri(webkitwidgets, $$configuration)
+}
diff --git a/Tools/qt/manifest.txt b/Tools/qt/manifest.txt
index cd60a6299..b7aeadcea 100644
--- a/Tools/qt/manifest.txt
+++ b/Tools/qt/manifest.txt
@@ -111,8 +111,12 @@ file Source/WebCore/Resources/plugIns.js
 
 # WebCore.qrc
 file Source/WebCore/Resources/missingImage.png
+file Source/WebCore/Resources/missingImage@2x.png
+file Source/WebCore/Resources/missingImage@3x.png
 file Source/WebCore/Resources/nullPlugin.png
+file Source/WebCore/Resources/nullPlugin@2x.png
 file Source/WebCore/Resources/textAreaResizeCorner.png
+file Source/WebCore/Resources/textAreaResizeCorner@2x.png
 file Source/WebCore/Resources/urlIcon.png
 file Source/WebCore/Resources/zoomInCursor.png
 file Source/WebCore/Resources/zoomOutCursor.png
diff --git a/WebKit.pro b/WebKit.pro
index 375d4d77b..ca3b009aa 100644
--- a/WebKit.pro
+++ b/WebKit.pro
@@ -14,6 +14,7 @@ isPlatformSupported() {
 
     SUBDIRS += \
         $$PROJECTS_DIR/generate_cmake_toolchain_file.pro \
+        $$PROJECTS_DIR/generate_forwarding_pris.pro \
         $$PROJECTS_DIR/run_cmake.pro
 } else {
     !build_pass: log("$${EOL}The WebKit build was disabled for the following reasons: $$skipBuildReason $${EOL}$${EOL}")
author	Konstantin Tokarev <annulen@yandex.ru>	2017-06-01 15:54:01 +0300
committer	Konstantin Tokarev <annulen@yandex.ru>	2017-06-02 14:07:43 +0000
commit	0a3506ebe5d7f431f0dd4dffa24ac32063b90ff1 (patch)
tree	f3d0b92fe7bc5b31426a838c354616fff335e82b
parent	881da28418d380042aa95a97f0cbd42560a64f7c (diff)
download	qtwebkit-0a3506ebe5d7f431f0dd4dffa24ac32063b90ff1.tar.gz