Imported WebKit commit a5ae8a56a48e44ebfb9b81aaa5488affaffdb175 (http://svn.webkit.org/repository/webkit/trunk@126420)

New snapshot with OS X 10.6 build fix

562 files changed, 14024 insertions, 6390 deletions

diff --git a/ChangeLog b/ChangeLog
index d39722db4..ce7844339 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,29 @@
+2012-08-22  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=94401
+        Add support for making a web site become paginated using overflow: 
+        paged-x | paged-y
+        -and corresponding-
+        <rdar://problem/11831783> 
+
+        Reviewed by Dave Hyatt.
+
+        * Source/autotools/symbols.filter:
+
+2012-08-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Split WebCore/platform into a separate library
+        https://bugs.webkit.org/show_bug.cgi?id=94435
+
+        Reviewed by Martin Robinson.
+
+        More people have been reporting problems when linking WebCore because
+        the command line limit is being exceeded. Splitting WebCore a bit more
+        is in order.
+
+        * GNUmakefile.am: add variable that will hold the list of source files
+        for libWebCorePlatform .
+
 2012-08-21  Thiago Marcos P. Santos  <thiago.santos@intel.com>
 
         [EFL] Enable CSS Text Decoration by default
diff --git a/GNUmakefile.am b/GNUmakefile.am
index 8eeb9ffe9..ff748ec8a 100644
--- a/GNUmakefile.am
+++ b/GNUmakefile.am
@@ -70,6 +70,7 @@ javascriptcore_built_nosources :=
 llint_nosources :=
 offlineasm_nosources :=
 webcore_cppflags :=
+webcore_platform_sources :=
 webcore_modules_sources :=
 webcore_sources :=
 webcore_libadd :=
@@ -98,6 +99,7 @@ minibrowser_built_sources :=
 global_cppflags :=
 global_cflags :=
 global_cxxflags :=
+common_webcore_shards_cppflags :=
 JSCORE_GIRSOURCES :=
 WEBKIT_GIRSOURCES :=
 FEATURE_DEFINES :=
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 9c18f5b03..2689bce5c 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -66,6 +66,7 @@ SET(JavaScriptCore_SOURCES
 
     dfg/DFGAbstractState.cpp
     dfg/DFGArgumentsSimplificationPhase.cpp
+    dfg/DFGArrayMode.cpp
     dfg/DFGAssemblyHelpers.cpp
     dfg/DFGByteCodeParser.cpp
     dfg/DFGCapabilities.cpp
@@ -107,6 +108,7 @@ SET(JavaScriptCore_SOURCES
     heap/CopiedSpace.cpp
     heap/ConservativeRoots.cpp
     heap/DFGCodeBlocks.cpp
+    heap/GCThreadSharedData.cpp
     heap/HandleSet.cpp
     heap/HandleStack.cpp
     heap/Heap.cpp
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index ac3aae5ff..987ca8ecf 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,171 @@
+2012-08-22  Filip Pizlo  <fpizlo@apple.com>
+
+        Array accesses should remember what kind of array they are predicted to access
+        https://bugs.webkit.org/show_bug.cgi?id=94448
+
+        Reviewed by Gavin Barraclough.
+
+        Introduced the notion of DFG::Array::Mode, stored in node.arrayMode(), which allows nodes
+        to remember how they decided to access arrays. This permits the bytecode parser to "lock in"
+        the mode of access if it has profiling at its disposal, and it also allows the prediction
+        propagator to do a fixup of the array mode later in the optimization fixpoint.
+        
+        This patch adds a healthy amount of new capability (specifically the ability of the parser
+        to lock in an array mode regardless of type predictions) and it also blows away a lot of
+        messy code.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGArrayMode.cpp: Added.
+        (DFG):
+        (JSC::DFG::fromObserved):
+        (JSC::DFG::refineArrayMode):
+        (JSC::DFG::modeAlreadyChecked):
+        (JSC::DFG::modeToString):
+        * dfg/DFGArrayMode.h: Added.
+        (DFG):
+        (JSC::DFG::canCSEStorage):
+        (JSC::DFG::modeForPut):
+        (JSC::DFG::modesCompatibleForStorageLoad):
+        (JSC::DFG::modeSupportsLength):
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::getArrayModeWithoutOSRExit):
+        (JSC::DFG::ByteCodeParser::getArrayMode):
+        (JSC::DFG::ByteCodeParser::handleIntrinsic):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::getByValLoadElimination):
+        (JSC::DFG::CSEPhase::checkStructureLoadElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::getByOffsetLoadElimination):
+        (JSC::DFG::CSEPhase::putByOffsetStoreElimination):
+        (JSC::DFG::CSEPhase::getPropertyStorageLoadElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dump):
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::byValIsPure):
+        (JSC::DFG::Graph::clobbersWorld):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::hasArrayMode):
+        (Node):
+        (JSC::DFG::Node::arrayMode):
+        (JSC::DFG::Node::setArrayMode):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::typedArrayDescriptor):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::speculateArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):
+        (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+        (JSC::DFG::SpeculativeJIT::compileGetArrayLength):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureCheckHoistingPhase.cpp:
+        (JSC::DFG::StructureCheckHoistingPhase::run):
+
+2012-08-22  Geoffrey Garen  <ggaren@apple.com>
+
+        ThreadRestrictionVerifier should be opt-in, not opt-out
+        https://bugs.webkit.org/show_bug.cgi?id=94761
+
+        Reviewed by Mark Hahnenberg.
+
+        Removed explicit calls to disable the verifier, since it's off by default now.
+
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (SourceProvider):
+        * runtime/SymbolTable.h:
+        (JSC::SharedSymbolTable::SharedSymbolTable):
+
+2012-08-22  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Separate MarkStackThreadSharedData from MarkStack
+        https://bugs.webkit.org/show_bug.cgi?id=94294
+
+        Reviewed by Filip Pizlo.
+
+        MarkStackThreadSharedData is soon going to have data to allow for a parallel copying 
+        mode too, so to separate our concerns we should split it out into its own set of files 
+        and rename it to GCThreadSharedData. For now this is purely a cosmetic refactoring.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * heap/GCThreadSharedData.cpp: Added.
+        (JSC):
+        (JSC::GCThreadSharedData::resetChildren):
+        (JSC::GCThreadSharedData::childVisitCount):
+        (JSC::GCThreadSharedData::markingThreadMain):
+        (JSC::GCThreadSharedData::markingThreadStartFunc):
+        (JSC::GCThreadSharedData::GCThreadSharedData):
+        (JSC::GCThreadSharedData::~GCThreadSharedData):
+        (JSC::GCThreadSharedData::reset):
+        * heap/GCThreadSharedData.h: Added.
+        (JSC):
+        (GCThreadSharedData):
+        * heap/Heap.h:
+        (Heap):
+        * heap/ListableHandler.h:
+        (ListableHandler):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStack::MarkStack):
+        (JSC::MarkStack::~MarkStack):
+        * heap/MarkStack.h:
+        (JSC):
+        (MarkStack):
+        (JSC::MarkStack::sharedData):
+        * heap/MarkStackInlineMethods.h: Added.
+        (JSC):
+        (JSC::MarkStack::append):
+        (JSC::MarkStack::appendUnbarrieredPointer):
+        (JSC::MarkStack::appendUnbarrieredValue):
+        (JSC::MarkStack::internalAppend):
+        (JSC::MarkStack::addWeakReferenceHarvester):
+        (JSC::MarkStack::addUnconditionalFinalizer):
+        (JSC::MarkStack::addOpaqueRoot):
+        (JSC::MarkStack::containsOpaqueRoot):
+        (JSC::MarkStack::opaqueRootCount):
+        * heap/SlotVisitor.h:
+        (JSC):
+        (SlotVisitor):
+        (JSC::SlotVisitor::SlotVisitor):
+
+2012-08-22  Gabor Ballabas  <gaborb@inf.u-szeged.hu>
+
+        Fix JSC build when DFG-JIT is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=94694
+
+        Reviewed by Csaba Osztrogonác.
+
+        Adding an appropriate guard for fixing the build.
+
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC):
+
 2012-08-21  Mark Lam  <mark.lam@apple.com>
 
         Introducing the VMInspector for VM debugging use.
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index ed79e6873..b0c31599c 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -155,6 +155,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGArgumentPosition.h \
 	Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp \
 	Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.h \
+	Source/JavaScriptCore/dfg/DFGArrayMode.cpp \
+	Source/JavaScriptCore/dfg/DFGArrayMode.h \
 	Source/JavaScriptCore/dfg/DFGAssemblyHelpers.cpp \
 	Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h \
 	Source/JavaScriptCore/dfg/DFGBasicBlock.h \
@@ -273,6 +275,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/heap/HandleTypes.h \
 	Source/JavaScriptCore/heap/BlockAllocator.cpp \
 	Source/JavaScriptCore/heap/BlockAllocator.h \
+    Source/JavaScriptCore/heap/GCThreadSharedData.cpp \
+    Source/JavaScriptCore/heap/GCThreadSharedData.h \
 	Source/JavaScriptCore/heap/Heap.cpp \
 	Source/JavaScriptCore/heap/Heap.h \
 	Source/JavaScriptCore/heap/JITStubRoutineSet.cpp \
@@ -284,6 +288,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/heap/MachineStackMarker.h \
 	Source/JavaScriptCore/heap/MarkStack.cpp \
 	Source/JavaScriptCore/heap/MarkStack.h \
+    Source/JavaScriptCore/heap/MarkStackInlineMethods.h \
 	Source/JavaScriptCore/heap/HeapRootVisitor.h \
 	Source/JavaScriptCore/heap/MarkedAllocator.cpp \
 	Source/JavaScriptCore/heap/MarkedAllocator.h \
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 8695a7557..78c44feb5 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -2326,6 +2326,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\heap\GCThreadSharedData.cpp"
+				>
+			</File>
+			<File
+    			RelativePath="..\..\heap\GCThreadSharedData.h"
+    			>
+			</File>
+			<File
 				RelativePath="..\..\heap\Heap.cpp"
 				>
 			</File>
@@ -2390,6 +2398,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\heap\MarkStackInlineMethods.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\heap\Strong.h"
 				>
 			</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 7dd87fee0..da029cc08 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -142,6 +142,8 @@
 		0F63944015C75F1D006A597C /* DFGStructureCheckHoistingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63943C15C75F14006A597C /* DFGStructureCheckHoistingPhase.cpp */; };
 		0F63945415D07055006A597C /* ArrayProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63945115D07051006A597C /* ArrayProfile.cpp */; };
 		0F63945515D07057006A597C /* ArrayProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63945215D07051006A597C /* ArrayProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F63948115E48114006A597C /* DFGArrayMode.cpp */; };
+		0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63948215E48114006A597C /* DFGArrayMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F66E16C14DF3F1600B7B2E4 /* DFGEdge.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -690,6 +692,9 @@
 		BCF605140E203EF800B9A64D /* ArgList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF605120E203EF800B9A64D /* ArgList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD8C900EEB2EE700283848 /* JumpTable.cpp */; };
 		BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD8C910EEB2EE700283848 /* JumpTable.h */; };
+		C21122E115DD9AB300790E3A /* GCThreadSharedData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C21122DE15DD9AB300790E3A /* GCThreadSharedData.cpp */; };
+		C21122E215DD9AB300790E3A /* GCThreadSharedData.h in Headers */ = {isa = PBXBuildFile; fileRef = C21122DF15DD9AB300790E3A /* GCThreadSharedData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C21122E315DD9AB300790E3A /* MarkStackInlineMethods.h in Headers */ = {isa = PBXBuildFile; fileRef = C21122E015DD9AB300790E3A /* MarkStackInlineMethods.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F77008E1402FDD60078EB39 /* SamplingCounter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C240305514B404E60079EB64 /* CopiedSpace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C240305314B404C90079EB64 /* CopiedSpace.cpp */; };
 		C25F8BCD157544A900245B71 /* IncrementalSweeper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */; };
@@ -896,6 +901,8 @@
 		0F63943D15C75F14006A597C /* DFGStructureCheckHoistingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureCheckHoistingPhase.h; path = dfg/DFGStructureCheckHoistingPhase.h; sourceTree = "<group>"; };
 		0F63945115D07051006A597C /* ArrayProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayProfile.cpp; sourceTree = "<group>"; };
 		0F63945215D07051006A597C /* ArrayProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayProfile.h; sourceTree = "<group>"; };
+		0F63948115E48114006A597C /* DFGArrayMode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGArrayMode.cpp; path = dfg/DFGArrayMode.cpp; sourceTree = "<group>"; };
+		0F63948215E48114006A597C /* DFGArrayMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayMode.h; path = dfg/DFGArrayMode.h; sourceTree = "<group>"; };
 		0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureAbstractValue.h; path = dfg/DFGStructureAbstractValue.h; sourceTree = "<group>"; };
 		0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdjacencyList.h; path = dfg/DFGAdjacencyList.h; sourceTree = "<group>"; };
 		0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdge.h; path = dfg/DFGEdge.h; sourceTree = "<group>"; };
@@ -1447,6 +1454,9 @@
 		BCF605120E203EF800B9A64D /* ArgList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArgList.h; sourceTree = "<group>"; };
 		BCFD8C900EEB2EE700283848 /* JumpTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JumpTable.cpp; sourceTree = "<group>"; };
 		BCFD8C910EEB2EE700283848 /* JumpTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JumpTable.h; sourceTree = "<group>"; };
+		C21122DE15DD9AB300790E3A /* GCThreadSharedData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCThreadSharedData.cpp; sourceTree = "<group>"; };
+		C21122DF15DD9AB300790E3A /* GCThreadSharedData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCThreadSharedData.h; sourceTree = "<group>"; };
+		C21122E015DD9AB300790E3A /* MarkStackInlineMethods.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkStackInlineMethods.h; sourceTree = "<group>"; };
 		C240305314B404C90079EB64 /* CopiedSpace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CopiedSpace.cpp; sourceTree = "<group>"; };
 		C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IncrementalSweeper.cpp; sourceTree = "<group>"; };
 		C25F8BCC157544A900245B71 /* IncrementalSweeper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IncrementalSweeper.h; sourceTree = "<group>"; };
@@ -1772,6 +1782,9 @@
 		142E312A134FF0A600AFADB5 /* heap */ = {
 			isa = PBXGroup;
 			children = (
+				C21122DE15DD9AB300790E3A /* GCThreadSharedData.cpp */,
+				C21122DF15DD9AB300790E3A /* GCThreadSharedData.h */,
+				C21122E015DD9AB300790E3A /* MarkStackInlineMethods.h */,
 				C2E526BB1590EF000054E48D /* HeapTimer.cpp */,
 				C2E526BC1590EF000054E48D /* HeapTimer.h */,
 				C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */,
@@ -2257,12 +2270,15 @@
 		86EC9DB31328DF44002B2AD7 /* dfg */ = {
 			isa = PBXGroup;
 			children = (
-				0F1E3A431534CBAD000F9456 /* DFGArgumentPosition.h */,
-				0F16015A156198BF00C2587C /* DFGArgumentsSimplificationPhase.cpp */,
-				0F16015B156198BF00C2587C /* DFGArgumentsSimplificationPhase.h */,
 				0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */,
 				0F62016E143FCD2F0068B77C /* DFGAbstractState.h */,
 				0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */,
+				0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */,
+				0F1E3A431534CBAD000F9456 /* DFGArgumentPosition.h */,
+				0F16015A156198BF00C2587C /* DFGArgumentsSimplificationPhase.cpp */,
+				0F16015B156198BF00C2587C /* DFGArgumentsSimplificationPhase.h */,
+				0F63948115E48114006A597C /* DFGArrayMode.cpp */,
+				0F63948215E48114006A597C /* DFGArrayMode.h */,
 				0FC0976B1468AB4A00CF2442 /* DFGAssemblyHelpers.cpp */,
 				0FC0976C1468AB4A00CF2442 /* DFGAssemblyHelpers.h */,
 				0F620170143FCD2F0068B77C /* DFGBasicBlock.h */,
@@ -2306,7 +2322,6 @@
 				86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */,
 				0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */,
 				0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */,
-				0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */,
 				0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */,
 				0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */,
 				86EC9DBF1328DF82002B2AD7 /* DFGOperations.cpp */,
@@ -2513,7 +2528,9 @@
 				86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
 				C2EAD2FC14F0249800A4B159 /* CopiedAllocator.h in Headers */,
 				C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
+				C21122E215DD9AB300790E3A /* GCThreadSharedData.h in Headers */,
 				C2E526BE1590EF000054E48D /* HeapTimer.h in Headers */,
+				C21122E315DD9AB300790E3A /* MarkStackInlineMethods.h in Headers */,
 				C25F8BCE157544A900245B71 /* IncrementalSweeper.h in Headers */,
 				BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */,
 				BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */,
@@ -2884,6 +2901,7 @@
 				FE4A332015BD2E07006F54F3 /* VMInspector.h in Headers */,
 				0F63943F15C75F19006A597C /* DFGStructureCheckHoistingPhase.h in Headers */,
 				0F63945515D07057006A597C /* ArrayProfile.h in Headers */,
+				0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */,
 				0F63947815DCE34B006A597C /* DFGStructureAbstractValue.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -3485,6 +3503,8 @@
 				FE4A331F15BD2E07006F54F3 /* VMInspector.cpp in Sources */,
 				0F63944015C75F1D006A597C /* DFGStructureCheckHoistingPhase.cpp in Sources */,
 				0F63945415D07055006A597C /* ArrayProfile.cpp in Sources */,
+				0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
+				C21122E115DD9AB300790E3A /* GCThreadSharedData.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index e8622363c..c7e41ab3a 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -79,6 +79,7 @@ SOURCES += \
     heap/HandleSet.cpp \
     heap/HandleStack.cpp \
     heap/BlockAllocator.cpp \
+    heap/GCThreadSharedData.cpp \
     heap/Heap.cpp \
     heap/HeapTimer.cpp \
     heap/IncrementalSweeper.cpp \
@@ -95,6 +96,7 @@ SOURCES += \
     debugger/Debugger.cpp \
     dfg/DFGAbstractState.cpp \
     dfg/DFGArgumentsSimplificationPhase.cpp \
+    dfg/DFGArrayMode.cpp \
     dfg/DFGAssemblyHelpers.cpp \
     dfg/DFGByteCodeParser.cpp \
     dfg/DFGCapabilities.cpp \
diff --git a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
index ddc7700c6..783e7c615 100644
--- a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
@@ -32,7 +32,7 @@
 
 namespace JSC {
 
-#if ENABLE(LLINT) || ENABLE(JIT)
+#if ENABLE(LLINT) || (ENABLE(JIT) && ENABLE(VALUE_PROFILER))
 static ResolveGlobalStatus computeForStructure(CodeBlock* codeBlock, Structure* structure, Identifier& identifier)
 {
     unsigned attributesIgnored;
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 5c53f6d78..cfe915947 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -868,65 +868,66 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case GetByVal: {
         node.setCanExit(true);
-        if (!node.prediction() || !m_graph[node.child1()].prediction() || !m_graph[node.child2()].prediction()) {
+        switch (node.arrayMode()) {
+        case Array::Undecided:
+            ASSERT_NOT_REACHED();
+            break;
+        case Array::ForceExit:
             m_isValid = false;
             break;
-        }
-        if (!m_graph[node.child2()].shouldSpeculateInteger() || (!node.child3() && !m_graph[node.child1()].shouldSpeculateArguments())) {
+        case Array::Generic:
             clobberWorld(node.codeOrigin, indexInBlock);
             forNode(nodeIndex).makeTop();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateArguments()) {
+        case Array::String:
+            forNode(node.child1()).filter(SpecString);
+            forNode(node.child2()).filter(SpecInt32);
+            forNode(nodeIndex).set(SpecString);
+            break;
+        case Array::Arguments:
             forNode(node.child1()).filter(SpecArguments);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).makeTop();
             break;
-        }
-        if (m_graph[node.child1()].prediction() == SpecString) {
-            forNode(node.child1()).filter(SpecString);
+        case Array::JSArray:
+        case Array::JSArrayOutOfBounds:
+            // FIXME: We should have more conservative handling of the out-of-bounds
+            // case.
+            forNode(node.child1()).filter(SpecCell);
             forNode(node.child2()).filter(SpecInt32);
-            forNode(nodeIndex).set(SpecString);
+            forNode(nodeIndex).makeTop();
             break;
-        }
-        
-        if (m_graph[node.child1()].shouldSpeculateInt8Array()) {
+        case Array::Int8Array:
             forNode(node.child1()).filter(SpecInt8Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateInt16Array()) {
+        case Array::Int16Array:
             forNode(node.child1()).filter(SpecInt16Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateInt32Array()) {
+        case Array::Int32Array:
             forNode(node.child1()).filter(SpecInt32Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint8Array()) {
+        case Array::Uint8Array:
             forNode(node.child1()).filter(SpecUint8Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint8ClampedArray()) {
+        case Array::Uint8ClampedArray:
             forNode(node.child1()).filter(SpecUint8ClampedArray);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint16Array()) {
+        case Array::Uint16Array:
             forNode(node.child1()).filter(SpecUint16Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecInt32);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint32Array()) {
+        case Array::Uint32Array:
             forNode(node.child1()).filter(SpecUint32Array);
             forNode(node.child2()).filter(SpecInt32);
             if (node.shouldSpeculateInteger())
@@ -934,55 +935,47 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(nodeIndex).set(SpecDouble);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateFloat32Array()) {
+        case Array::Float32Array:
             forNode(node.child1()).filter(SpecFloat32Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecDouble);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateFloat64Array()) {
+        case Array::Float64Array:
             forNode(node.child1()).filter(SpecFloat64Array);
             forNode(node.child2()).filter(SpecInt32);
             forNode(nodeIndex).set(SpecDouble);
             break;
         }
-        forNode(node.child1()).filter(SpecCell);
-        forNode(node.child2()).filter(SpecInt32);
-        forNode(nodeIndex).makeTop();
         break;
     }
             
     case PutByVal:
-    case PutByValAlias:
-    case PutByValSafe: {
+    case PutByValAlias: {
         node.setCanExit(true);
-
         Edge child1 = m_graph.varArgChild(node, 0);
         Edge child2 = m_graph.varArgChild(node, 1);
         Edge child3 = m_graph.varArgChild(node, 2);
-            
-        if (!m_graph[child1].prediction() || !m_graph[child2].prediction()) {
+        switch (modeForPut(node.arrayMode())) {
+        case Array::ForceExit:
             m_isValid = false;
             break;
-        }
-        if (!m_graph[child2].shouldSpeculateInteger()
-#if USE(JSVALUE32_64)
-            || m_graph[child1].shouldSpeculateArguments()
-#endif
-            ) {
-            ASSERT(node.op() == PutByVal || node.op() == PutByValSafe);
+        case Array::Generic:
             clobberWorld(node.codeOrigin, indexInBlock);
-            forNode(nodeIndex).makeTop();
             break;
-        }
-        
-        if (m_graph[child1].shouldSpeculateArguments()) {
+        case Array::JSArray:
+            forNode(child1).filter(SpecCell);
+            forNode(child2).filter(SpecInt32);
+            break;
+        case Array::JSArrayOutOfBounds:
+            forNode(child1).filter(SpecCell);
+            forNode(child2).filter(SpecInt32);
+            clobberWorld(node.codeOrigin, indexInBlock);
+            break;
+        case Array::Arguments:
             forNode(child1).filter(SpecArguments);
             forNode(child2).filter(SpecInt32);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateInt8Array()) {
+        case Array::Int8Array:
             forNode(child1).filter(SpecInt8Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
@@ -990,8 +983,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateInt16Array()) {
+        case Array::Int16Array:
             forNode(child1).filter(SpecInt16Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
@@ -999,8 +991,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateInt32Array()) {
+        case Array::Int32Array:
             forNode(child1).filter(SpecInt32Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
@@ -1008,8 +999,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateUint8Array()) {
+        case Array::Uint8Array:
             forNode(child1).filter(SpecUint8Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
@@ -1017,8 +1007,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateUint8ClampedArray()) {
+        case Array::Uint8ClampedArray:
             forNode(child1).filter(SpecUint8ClampedArray);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
@@ -1026,8 +1015,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateUint16Array()) {
+        case Array::Uint16Array:
             forNode(child1).filter(SpecUint16Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
@@ -1035,8 +1023,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateUint32Array()) {
+        case Array::Uint32Array:
             forNode(child1).filter(SpecUint32Array);
             forNode(child2).filter(SpecInt32);
             if (m_graph[child3].shouldSpeculateInteger())
@@ -1044,23 +1031,20 @@ bool AbstractState::execute(unsigned indexInBlock)
             else
                 forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateFloat32Array()) {
+        case Array::Float32Array:
             forNode(child1).filter(SpecFloat32Array);
             forNode(child2).filter(SpecInt32);
             forNode(child3).filter(SpecNumber);
             break;
-        }
-        if (m_graph[child1].shouldSpeculateFloat64Array()) {
+        case Array::Float64Array:
             forNode(child1).filter(SpecFloat64Array);
             forNode(child2).filter(SpecInt32);
             forNode(child3).filter(SpecNumber);
             break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
         }
-        forNode(child1).filter(SpecCell);
-        forNode(child2).filter(SpecInt32);
-        if (node.op() == PutByValSafe)
-            clobberWorld(node.codeOrigin, indexInBlock);
         break;
     }
             
@@ -1356,69 +1340,82 @@ bool AbstractState::execute(unsigned indexInBlock)
         break;
             
     case GetArrayLength:
-        node.setCanExit(true);
-        forNode(node.child1()).filter(SpecCell);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-
-    case GetArgumentsLength:
-        node.setCanExit(true);
-        forNode(node.child1()).filter(SpecArguments);
-        forNode(nodeIndex).set(SpecInt32);
+        switch (node.arrayMode()) {
+        case Array::Undecided:
+            ASSERT_NOT_REACHED();
+            break;
+        case Array::ForceExit:
+            m_isValid = false;
+            break;
+        case Array::Generic:
+            ASSERT_NOT_REACHED();
+            break;
+        case Array::String:
+            node.setCanExit(!isStringSpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecString);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::JSArray:
+            node.setCanExit(true);
+            forNode(node.child1()).filter(SpecCell);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::JSArrayOutOfBounds:
+            ASSERT_NOT_REACHED();
+            break;
+        case Array::Arguments:
+            node.setCanExit(true);
+            forNode(node.child1()).filter(SpecArguments);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Int8Array:
+            node.setCanExit(!isInt8ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecInt8Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Int16Array:
+            node.setCanExit(!isInt16ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecInt16Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Int32Array:
+            node.setCanExit(!isInt32ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecInt32Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Uint8Array:
+            node.setCanExit(!isUint8ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecUint8Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Uint8ClampedArray:
+            node.setCanExit(!isUint8ClampedArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecUint8ClampedArray);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Uint16Array:
+            node.setCanExit(!isUint16ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecUint16Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Uint32Array:
+            node.setCanExit(!isUint32ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecUint32Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Float32Array:
+            node.setCanExit(!isFloat32ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecFloat32Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        case Array::Float64Array:
+            node.setCanExit(!isFloat64ArraySpeculation(forNode(node.child1()).m_type));
+            forNode(node.child1()).filter(SpecFloat64Array);
+            forNode(nodeIndex).set(SpecInt32);
+            break;
+        }
         break;
 
-    case GetStringLength:
-        node.setCanExit(!isStringSpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecString);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-        
-    case GetInt8ArrayLength:
-        node.setCanExit(!isInt8ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecInt8Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetInt16ArrayLength:
-        node.setCanExit(!isInt16ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecInt16Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetInt32ArrayLength:
-        node.setCanExit(!isInt32ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecInt32Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetUint8ArrayLength:
-        node.setCanExit(!isUint8ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecUint8Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetUint8ClampedArrayLength:
-        node.setCanExit(!isUint8ClampedArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecUint8ClampedArray);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetUint16ArrayLength:
-        node.setCanExit(!isUint16ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecUint16Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetUint32ArrayLength:
-        node.setCanExit(!isUint32ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecUint32Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetFloat32ArrayLength:
-        node.setCanExit(!isFloat32ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecFloat32Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-    case GetFloat64ArrayLength:
-        node.setCanExit(!isFloat64ArraySpeculation(forNode(node.child1()).m_type));
-        forNode(node.child1()).filter(SpecFloat64Array);
-        forNode(nodeIndex).set(SpecInt32);
-        break;
-            
     case CheckStructure:
     case ForwardCheckStructure: {
         // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
@@ -1489,65 +1486,48 @@ bool AbstractState::execute(unsigned indexInBlock)
         forNode(nodeIndex).clear(); // The result is not a JS value.
         break;
     case GetIndexedPropertyStorage: {
-        ASSERT(m_graph[node.child1()].prediction());
-        ASSERT(m_graph[node.child2()].shouldSpeculateInteger());
         node.setCanExit(true); // Lies, but this is (almost) always followed by GetByVal, which does exit. So no point in trying to be more precise.
-        if (m_graph[node.child1()].shouldSpeculateArguments()) {
-            ASSERT_NOT_REACHED();
-            break;
-        }
-        if (m_graph[node.child1()].prediction() == SpecString) {
+        switch (node.arrayMode()) {
+        case Array::String:
             forNode(node.child1()).filter(SpecString);
-            forNode(nodeIndex).clear();
             break;
-        }
-        
-        if (m_graph[node.child1()].shouldSpeculateInt8Array()) {
+        case Array::JSArray:
+        case Array::JSArrayOutOfBounds:
+            // This doesn't filter anything meaningful right now. We may want to add
+            // CFA tracking of array mode speculations, but we don't have that, yet.
+            forNode(node.child1()).filter(SpecCell);
+            break;
+        case Array::Int8Array:
             forNode(node.child1()).filter(SpecInt8Array);
-            forNode(nodeIndex).clear();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateInt16Array()) {
+        case Array::Int16Array:
             forNode(node.child1()).filter(SpecInt16Array);
-            forNode(nodeIndex).clear();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateInt32Array()) {
+        case Array::Int32Array:
             forNode(node.child1()).filter(SpecInt32Array);
-            forNode(nodeIndex).clear();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint8Array()) {
+        case Array::Uint8Array:
             forNode(node.child1()).filter(SpecUint8Array);
-            forNode(nodeIndex).clear();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint8ClampedArray()) {
+        case Array::Uint8ClampedArray:
             forNode(node.child1()).filter(SpecUint8ClampedArray);
-            forNode(nodeIndex).clear();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint16Array()) {
+        case Array::Uint16Array:
             forNode(node.child1()).filter(SpecUint16Array);
-            forNode(nodeIndex).set(SpecOther);
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateUint32Array()) {
+        case Array::Uint32Array:
             forNode(node.child1()).filter(SpecUint32Array);
-            forNode(nodeIndex).clear();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateFloat32Array()) {
+        case Array::Float32Array:
             forNode(node.child1()).filter(SpecFloat32Array);
-            forNode(nodeIndex).clear();
             break;
-        }
-        if (m_graph[node.child1()].shouldSpeculateFloat64Array()) {
+        case Array::Float64Array:
             forNode(node.child1()).filter(SpecFloat64Array);
-            forNode(nodeIndex).clear();
+            break;
+        default:
+            ASSERT_NOT_REACHED();
             break;
         }
-        forNode(node.child1()).filter(SpecCell);
         forNode(nodeIndex).clear();
         break; 
     }
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
index 000e1a938..2f535ba22 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
@@ -145,7 +145,7 @@ public:
         }
         
         // Figure out which variables alias the arguments and nothing else, and are
-        // used only for GetByVal and GetArgumentsLength accesses. At the same time,
+        // used only for GetByVal and GetArrayLength accesses. At the same time,
         // identify uses of CreateArguments that are not consistent with the arguments
         // being aliased only to variables that satisfy these constraints.
         for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
@@ -277,34 +277,25 @@ public:
                 }
                     
                 case GetByVal: {
-                    if (!node.prediction()
-                        || !m_graph[node.child1()].prediction()
-                        || !m_graph[node.child2()].prediction()) {
+                    if (node.arrayMode() != Array::Arguments) {
                         observeBadArgumentsUses(node);
                         break;
                     }
+
+                    // That's so awful and pretty much impossible since it would
+                    // imply that the arguments were predicted integer, but it's
+                    // good to be defensive and thorough.
+                    observeBadArgumentsUse(node.child2());
+                    observeProperArgumentsUse(node, node.child1());
+                    break;
+                }
                     
-                    if (!isActionableArraySpeculation(m_graph[node.child1()].prediction())
-                        || !m_graph[node.child2()].shouldSpeculateInteger()) {
+                case GetArrayLength: {
+                    if (node.arrayMode() != Array::Arguments) {
                         observeBadArgumentsUses(node);
                         break;
                     }
-                    
-                    if (m_graph[node.child1()].shouldSpeculateArguments()) {
-                        // If arguments is used as an index, then it's an escaping use.
-                        // That's so awful and pretty much impossible since it would
-                        // imply that the arguments were predicted integer, but it's
-                        // good to be defensive and thorough.
-                        observeBadArgumentsUse(node.child2());
-                        observeProperArgumentsUse(node, node.child1());
-                        break;
-                    }
-                    
-                    observeBadArgumentsUses(node);
-                    break;
-                }
-                    
-                case GetArgumentsLength: {
+                        
                     observeProperArgumentsUse(node, node.child1());
                     break;
                 }
@@ -496,38 +487,32 @@ public:
                 }
                     
                 case GetByVal: {
-                    if (!node.prediction()
-                        || !m_graph[node.child1()].prediction()
-                        || !m_graph[node.child2()].prediction())
+                    if (node.arrayMode() != Array::Arguments)
                         break;
+
+                    // This can be simplified to GetMyArgumentByVal if we know that
+                    // it satisfies either condition (1) or (2):
+                    // 1) Its first child is a valid ArgumentsAliasingData and the
+                    //    InlineCallFrame* is not marked as creating arguments.
+                    // 2) Its first child is CreateArguments and its InlineCallFrame*
+                    //    is not marked as creating arguments.
                     
-                    if (!isActionableArraySpeculation(m_graph[node.child1()].prediction())
-                        || !m_graph[node.child2()].shouldSpeculateInteger())
+                    if (!isOKToOptimize(m_graph[node.child1()]))
                         break;
                     
-                    if (m_graph[node.child1()].shouldSpeculateArguments()) {
-                        // This can be simplified to GetMyArgumentByVal if we know that
-                        // it satisfies either condition (1) or (2):
-                        // 1) Its first child is a valid ArgumentsAliasingData and the
-                        //    InlineCallFrame* is not marked as creating arguments.
-                        // 2) Its first child is CreateArguments and its InlineCallFrame*
-                        //    is not marked as creating arguments.
-                        
-                        if (!isOKToOptimize(m_graph[node.child1()]))
-                            break;
-                        
-                        m_graph.deref(node.child1());
-                        node.children.child1() = node.children.child2();
-                        node.children.child2() = Edge();
-                        node.setOpAndDefaultFlags(GetMyArgumentByVal);
-                        changed = true;
-                        --indexInBlock; // Force reconsideration of this op now that it's a GetMyArgumentByVal.
-                        break;
-                    }
+                    m_graph.deref(node.child1());
+                    node.children.child1() = node.children.child2();
+                    node.children.child2() = Edge();
+                    node.setOpAndDefaultFlags(GetMyArgumentByVal);
+                    changed = true;
+                    --indexInBlock; // Force reconsideration of this op now that it's a GetMyArgumentByVal.
                     break;
                 }
                     
-                case GetArgumentsLength: {
+                case GetArrayLength: {
+                    if (node.arrayMode() != Array::Arguments)
+                        break;
+                    
                     if (!isOKToOptimize(m_graph[node.child1()]))
                         break;
                     
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.cpp b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
new file mode 100644
index 000000000..ec4edc2e8
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
@@ -0,0 +1,217 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGArrayMode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGAbstractValue.h"
+
+namespace JSC { namespace DFG {
+
+Array::Mode fromObserved(ArrayModes modes, bool makeSafe)
+{
+    // FIXME: we may want to add some polymorphic support in the future. That's why this
+    // is a switch statement right now.
+    
+    switch (modes) {
+    case 0:
+        return Array::Undecided;
+    case IsJSArray:
+        return makeSafe ? Array::JSArrayOutOfBounds : Array::JSArray;
+    default:
+        // We know that this is possibly a kind of array for which, though there is no
+        // useful data in the array profile, we may be able to extract useful data from
+        // the value profiles of the inputs. Hence, we leave it as undecided, and let
+        // the predictions propagator decide later.
+        return Array::Undecided;
+    }
+}
+
+Array::Mode refineArrayMode(Array::Mode arrayMode, SpeculatedType base, SpeculatedType index)
+{
+    if (!base || !index) {
+        // It can be that we had a legitimate arrayMode but no incoming predictions. That'll
+        // happen if we inlined code based on, say, a global variable watchpoint, but later
+        // realized that the callsite could not have possibly executed. It may be worthwhile
+        // to fix that, but for now I'm leaving it as-is.
+        return Array::ForceExit;
+    }
+    
+    if (!isInt32Speculation(index) || !isCellSpeculation(base))
+        return Array::Generic;
+    
+    // Pass through any array modes that would have been decided by the array profile, since
+    // the predictions of the inputs will not tell us anything useful that we didn't already
+    // get from the array profile.
+    switch (arrayMode) {
+    case Array::ForceExit:
+    case Array::JSArray:
+    case Array::JSArrayOutOfBounds:
+        return arrayMode;
+    default:
+        break;
+    }
+    
+    if (isStringSpeculation(base))
+        return Array::String;
+    
+    if (isArgumentsSpeculation(base))
+        return Array::Arguments;
+    
+    if (isInt8ArraySpeculation(base))
+        return Array::Int8Array;
+    
+    if (isInt16ArraySpeculation(base))
+        return Array::Int16Array;
+    
+    if (isInt32ArraySpeculation(base))
+        return Array::Int32Array;
+    
+    if (isUint8ArraySpeculation(base))
+        return Array::Uint8Array;
+    
+    if (isUint8ClampedArraySpeculation(base))
+        return Array::Uint8ClampedArray;
+    
+    if (isUint16ArraySpeculation(base))
+        return Array::Uint16Array;
+    
+    if (isUint32ArraySpeculation(base))
+        return Array::Uint32Array;
+    
+    if (isFloat32ArraySpeculation(base))
+        return Array::Float32Array;
+    
+    if (isFloat64ArraySpeculation(base))
+        return Array::Float64Array;
+    
+    return Array::Generic;
+}
+
+bool modeAlreadyChecked(AbstractValue& value, Array::Mode arrayMode)
+{
+    switch (arrayMode) {
+    case Array::Generic:
+        return true;
+        
+    case Array::ForceExit:
+        return false;
+        
+    case Array::String:
+        return isStringSpeculation(value.m_type);
+        
+    case Array::JSArray:
+    case Array::JSArrayOutOfBounds:
+        return value.m_currentKnownStructure.hasSingleton()
+            && value.m_currentKnownStructure.singleton()->classInfo() == &JSArray::s_info;
+        
+    case Array::Arguments:
+        return isArgumentsSpeculation(value.m_type);
+        
+    case Array::Int8Array:
+        return isInt8ArraySpeculation(value.m_type);
+        
+    case Array::Int16Array:
+        return isInt16ArraySpeculation(value.m_type);
+        
+    case Array::Int32Array:
+        return isInt32ArraySpeculation(value.m_type);
+        
+    case Array::Uint8Array:
+        return isUint8ArraySpeculation(value.m_type);
+        
+    case Array::Uint8ClampedArray:
+        return isUint8ClampedArraySpeculation(value.m_type);
+        
+    case Array::Uint16Array:
+        return isUint16ArraySpeculation(value.m_type);
+        
+    case Array::Uint32Array:
+        return isUint32ArraySpeculation(value.m_type);
+
+    case Array::Float32Array:
+        return isFloat32ArraySpeculation(value.m_type);
+
+    case Array::Float64Array:
+        return isFloat64ArraySpeculation(value.m_type);
+        
+    case Array::Undecided:
+        break;
+    }
+    
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+const char* modeToString(Array::Mode mode)
+{
+    switch (mode) {
+    case Array::Undecided:
+        return "Undecided";
+    case Array::Generic:
+        return "Generic";
+    case Array::ForceExit:
+        return "ForceExit";
+    case Array::String:
+        return "String";
+    case Array::JSArray:
+        return "JSArray";
+    case Array::JSArrayOutOfBounds:
+        return "JSArrayOutOfBounds";
+    case Array::Arguments:
+        return "Arguments";
+    case Array::Int8Array:
+        return "Int8Array";
+    case Array::Int16Array:
+        return "Int16Array";
+    case Array::Int32Array:
+        return "Int32Array";
+    case Array::Uint8Array:
+        return "Uint8Array";
+    case Array::Uint8ClampedArray:
+        return "Uint8ClampedArray";
+    case Array::Uint16Array:
+        return "Uint16Array";
+    case Array::Uint32Array:
+        return "Uint32Array";
+    case Array::Float32Array:
+        return "Float32Array";
+    case Array::Float64Array:
+        return "Float64Array";
+    default:
+        // Better to return something then it is to crash. Remember, this method
+        // is being called from our main diagnostic tool, the IR dumper. It's like
+        // a stack trace. So if we get here then probably something has already
+        // gone wrong.
+        return "Unknown!";
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGArrayMode.h b/Source/JavaScriptCore/dfg/DFGArrayMode.h
new file mode 100644
index 000000000..6ce62ae72
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGArrayMode.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGArrayMode_h
+#define DFGArrayMode_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "ArrayProfile.h"
+#include "SpeculatedType.h"
+
+namespace JSC { namespace DFG {
+
+struct AbstractValue;
+
+// Use a namespace + enum instead of enum alone to avoid the namespace collision
+// that would otherwise occur, since we say things like "Int8Array" and "JSArray"
+// in lots of other places, to mean subtly different things.
+namespace Array {
+enum Mode {
+    Undecided, // Implies that we need predictions to decide. We will never get to the backend in this mode.
+    ForceExit, // Implies that we have no idea how to execute this operation, so we should just give up.
+    Generic,
+    String,
+    JSArray,
+    JSArrayOutOfBounds,
+    Arguments,
+    Int8Array,
+    Int16Array,
+    Int32Array,
+    Uint8Array,
+    Uint8ClampedArray,
+    Uint16Array,
+    Uint32Array,
+    Float32Array,
+    Float64Array
+};
+} // namespace Array
+
+Array::Mode fromObserved(ArrayModes modes, bool makeSafe);
+
+Array::Mode refineArrayMode(Array::Mode, SpeculatedType base, SpeculatedType index);
+
+bool modeAlreadyChecked(AbstractValue&, Array::Mode);
+
+const char* modeToString(Array::Mode);
+
+inline bool canCSEStorage(Array::Mode arrayMode)
+{
+    switch (arrayMode) {
+    case Array::Undecided:
+    case Array::ForceExit:
+    case Array::Generic:
+    case Array::Arguments:
+        return false;
+    default:
+        return true;
+    }
+}
+
+inline Array::Mode modeForPut(Array::Mode arrayMode)
+{
+    switch (arrayMode) {
+    case Array::String:
+        return Array::Generic;
+#if USE(JSVALUE32_64)
+    case Array::Arguments:
+        return Array::Generic;
+#endif
+    default:
+        return arrayMode;
+    }
+}
+
+inline bool modesCompatibleForStorageLoad(Array::Mode left, Array::Mode right)
+{
+    if (left == right)
+        return true;
+    
+    bool leftIsJSArray =
+        left == Array::JSArray
+        || left == Array::JSArrayOutOfBounds;
+    
+    bool rightIsJSArray =
+        right == Array::JSArray
+        || right == Array::JSArrayOutOfBounds;
+    
+    if (leftIsJSArray && rightIsJSArray)
+        return true;
+    
+    return false;
+}
+
+inline bool modeSupportsLength(Array::Mode mode)
+{
+    switch (mode) {
+    case Array::Undecided:
+    case Array::ForceExit:
+    case Array::Generic:
+        return false;
+    default:
+        return true;
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGArrayMode_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index f7536f87f..f9b1db9ab 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -31,6 +31,7 @@
 #include "ArrayConstructor.h"
 #include "CallLinkStatus.h"
 #include "CodeBlock.h"
+#include "DFGArrayMode.h"
 #include "DFGByteCodeCache.h"
 #include "DFGCapabilities.h"
 #include "GetByIdStatus.h"
@@ -816,6 +817,36 @@ private:
     {
         return getPrediction(m_graph.size(), m_currentProfilingIndex);
     }
+    
+    Array::Mode getArrayModeWithoutOSRExit(Instruction* currentInstruction, NodeIndex base)
+    {
+        ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+        profile->computeUpdatedPrediction();
+        if (profile->hasDefiniteStructure())
+            addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(profile->expectedStructure())), base);
+        
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+        if (m_inlineStackTop->m_profiledBlock->numberOfRareCaseProfiles())
+            dataLog("Slow case profile for bc#%u: %u\n", m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter);
+        dataLog("Array profile for bc#%u: %p%s, %u\n", m_currentIndex, profile->expectedStructure(), profile->structureIsPolymorphic() ? " (polymorphic)" : "", profile->observedArrayModes());
+#endif
+        
+        bool makeSafe =
+            m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
+            || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, OutOfBounds);
+        
+        return fromObserved(profile->observedArrayModes(), makeSafe);
+    }
+    
+    Array::Mode getArrayMode(Instruction* currentInstruction, NodeIndex base)
+    {
+        Array::Mode result = getArrayModeWithoutOSRExit(currentInstruction, base);
+        
+        if (result == Array::ForceExit)
+            addToGraph(ForceOSRExit);
+        
+        return result;
+    }
 
     NodeIndex makeSafe(NodeIndex nodeIndex)
     {
@@ -1548,8 +1579,7 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
             return false;
         
         int indexOperand = registerOffset + argumentToOperand(1);
-        NodeIndex storage = addToGraph(GetIndexedPropertyStorage, get(thisOperand), getToInt32(indexOperand));
-        NodeIndex charCode = addToGraph(StringCharCodeAt, get(thisOperand), getToInt32(indexOperand), storage);
+        NodeIndex charCode = addToGraph(StringCharCodeAt, OpInfo(Array::String), get(thisOperand), getToInt32(indexOperand));
 
         if (usesResult)
             set(resultOperand, charCode);
@@ -1565,8 +1595,7 @@ bool ByteCodeParser::handleIntrinsic(bool usesResult, int resultOperand, Intrins
             return false;
 
         int indexOperand = registerOffset + argumentToOperand(1);
-        NodeIndex storage = addToGraph(GetIndexedPropertyStorage, get(thisOperand), getToInt32(indexOperand));
-        NodeIndex charCode = addToGraph(StringCharAt, get(thisOperand), getToInt32(indexOperand), storage);
+        NodeIndex charCode = addToGraph(StringCharAt, OpInfo(Array::String), get(thisOperand), getToInt32(indexOperand));
 
         if (usesResult)
             set(resultOperand, charCode);
@@ -2148,13 +2177,9 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             SpeculatedType prediction = getPrediction();
             
             NodeIndex base = get(currentInstruction[2].u.operand);
+            Array::Mode arrayMode = getArrayMode(currentInstruction, base);
             NodeIndex property = get(currentInstruction[3].u.operand);
-            ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
-            profile->computeUpdatedPrediction();
-            if (profile->hasDefiniteStructure())
-                addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(profile->expectedStructure())), base);
-            NodeIndex propertyStorage = addToGraph(GetIndexedPropertyStorage, base, property);
-            NodeIndex getByVal = addToGraph(GetByVal, OpInfo(0), OpInfo(prediction), base, property, propertyStorage);
+            NodeIndex getByVal = addToGraph(GetByVal, OpInfo(arrayMode), OpInfo(prediction), base, property);
             set(currentInstruction[1].u.operand, getByVal);
 
             NEXT_OPCODE(op_get_by_val);
@@ -2162,26 +2187,16 @@ bool ByteCodeParser::parseBlock(unsigned limit)
 
         case op_put_by_val: {
             NodeIndex base = get(currentInstruction[1].u.operand);
+
+            Array::Mode arrayMode = getArrayMode(currentInstruction, base);
+            
             NodeIndex property = get(currentInstruction[2].u.operand);
             NodeIndex value = get(currentInstruction[3].u.operand);
             
-            ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
-            profile->computeUpdatedPrediction();
-            if (profile->hasDefiniteStructure())
-                addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(profile->expectedStructure())), base);
-
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            dataLog("Slow case profile for bc#%u: %u\n", m_currentIndex, m_inlineStackTop->m_profiledBlock->rareCaseProfileForBytecodeOffset(m_currentIndex)->m_counter);
-#endif
-
-            bool makeSafe =
-                m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
-                || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, OutOfBounds);
-            
             addVarArgChild(base);
             addVarArgChild(property);
             addVarArgChild(value);
-            addToGraph(Node::VarArg, makeSafe ? PutByValSafe : PutByVal, OpInfo(0), OpInfo(0));
+            addToGraph(Node::VarArg, PutByVal, OpInfo(arrayMode), OpInfo(0));
 
             NEXT_OPCODE(op_put_by_val);
         }
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index b78ddc89d..dce57d520 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -284,8 +284,7 @@ private:
                     return index;
                 break;
             case PutByVal:
-            case PutByValAlias:
-            case PutByValSafe: {
+            case PutByValAlias: {
                 if (!m_graph.byValIsPure(node))
                     return NoNode;
                 if (m_graph.varArgChild(node, 0) == child1 && canonicalize(m_graph.varArgChild(node, 1)) == canonicalize(child2))
@@ -365,7 +364,6 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
-            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -409,7 +407,6 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
-            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -515,7 +512,6 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
-            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -560,7 +556,6 @@ private:
             case PutByVal:
             case PutByValAlias:
             case GetByVal:
-            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -613,7 +608,6 @@ private:
                 
             case PutByVal:
             case PutByValAlias:
-            case PutByValSafe:
                 if (m_graph.byValIsPure(node)) {
                     // If PutByVal speculates that it's accessing an array with an
                     // integer index, then it's impossible for it to cause a structure
@@ -925,17 +919,7 @@ private:
         case ArithMin:
         case ArithMax:
         case ArithSqrt:
-        case GetInt8ArrayLength:
-        case GetInt16ArrayLength:
-        case GetInt32ArrayLength:
-        case GetUint8ArrayLength:
-        case GetUint8ClampedArrayLength:
-        case GetUint16ArrayLength:
-        case GetUint32ArrayLength:
-        case GetFloat32ArrayLength:
-        case GetFloat64ArrayLength:
         case GetCallee:
-        case GetStringLength:
         case StringCharAt:
         case StringCharCodeAt:
         case Int32ToDouble:
@@ -1103,8 +1087,7 @@ private:
                 setReplacement(getByValLoadElimination(node.child1().index(), node.child2().index()));
             break;
             
-        case PutByVal:
-        case PutByValSafe: {
+        case PutByVal: {
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
             if (isActionableMutableArraySpeculation(m_graph[child1].prediction())
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index f7b10fc43..fe7cae8a9 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -74,97 +74,89 @@ private:
         
         switch (op) {
         case GetById: {
+            Node* nodePtr = &node;
+            
             if (!isInt32Speculation(m_graph[m_compileIndex].prediction()))
                 break;
-            if (codeBlock()->identifier(node.identifierNumber()) != globalData().propertyNames->length)
-                break;
-            bool isArray = isArraySpeculation(m_graph[node.child1()].prediction());
-            bool isArguments = isArgumentsSpeculation(m_graph[node.child1()].prediction());
-            bool isString = isStringSpeculation(m_graph[node.child1()].prediction());
-            bool isInt8Array = m_graph[node.child1()].shouldSpeculateInt8Array();
-            bool isInt16Array = m_graph[node.child1()].shouldSpeculateInt16Array();
-            bool isInt32Array = m_graph[node.child1()].shouldSpeculateInt32Array();
-            bool isUint8Array = m_graph[node.child1()].shouldSpeculateUint8Array();
-            bool isUint8ClampedArray = m_graph[node.child1()].shouldSpeculateUint8ClampedArray();
-            bool isUint16Array = m_graph[node.child1()].shouldSpeculateUint16Array();
-            bool isUint32Array = m_graph[node.child1()].shouldSpeculateUint32Array();
-            bool isFloat32Array = m_graph[node.child1()].shouldSpeculateFloat32Array();
-            bool isFloat64Array = m_graph[node.child1()].shouldSpeculateFloat64Array();
-            if (!isArray && !isArguments && !isString && !isInt8Array && !isInt16Array && !isInt32Array && !isUint8Array && !isUint8ClampedArray && !isUint16Array && !isUint32Array && !isFloat32Array && !isFloat64Array)
+            if (codeBlock()->identifier(nodePtr->identifierNumber()) != globalData().propertyNames->length)
                 break;
-            
-#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
-            dataLog("  @%u -> %s", m_compileIndex, isArray ? "GetArrayLength" : "GetStringLength");
-#endif
-            if (isArray) {
-                node.setOp(GetArrayLength);
-                ASSERT(node.flags() & NodeMustGenerate);
-                node.clearFlags(NodeMustGenerate);
-                m_graph.deref(m_compileIndex);
-                
-                ArrayProfile* arrayProfile = 
-                    m_graph.baselineCodeBlockFor(node.codeOrigin)->getArrayProfile(
-                        node.codeOrigin.bytecodeIndex);
-                if (!arrayProfile)
-                    break;
+            ArrayProfile* arrayProfile = 
+                m_graph.baselineCodeBlockFor(nodePtr->codeOrigin)->getArrayProfile(
+                    nodePtr->codeOrigin.bytecodeIndex);
+            Array::Mode arrayMode = Array::Undecided;
+            if (arrayProfile) {
                 arrayProfile->computeUpdatedPrediction();
-                if (!arrayProfile->hasDefiniteStructure())
-                    break;
-                m_graph.ref(node.child1());
-                Node checkStructure(CheckStructure, node.codeOrigin, OpInfo(m_graph.addStructureSet(arrayProfile->expectedStructure())), node.child1().index());
-                checkStructure.ref();
-                NodeIndex checkStructureIndex = m_graph.size();
-                m_graph.append(checkStructure);
-                m_insertionSet.append(m_indexInBlock, checkStructureIndex);
-                break;
+                arrayMode = refineArrayMode(
+                    fromObserved(arrayProfile->observedArrayModes(), false),
+                    m_graph[node.child1()].prediction(),
+                    m_graph[m_compileIndex].prediction());                    
+                if (modeSupportsLength(arrayMode)
+                    && arrayProfile->hasDefiniteStructure()) {
+                    m_graph.ref(nodePtr->child1());
+                    Node checkStructure(CheckStructure, nodePtr->codeOrigin, OpInfo(m_graph.addStructureSet(arrayProfile->expectedStructure())), nodePtr->child1().index());
+                    checkStructure.ref();
+                    NodeIndex checkStructureIndex = m_graph.size();
+                    m_graph.append(checkStructure);
+                    m_insertionSet.append(m_indexInBlock, checkStructureIndex);
+                    nodePtr = &m_graph[m_compileIndex];
+                }
+            } else {
+                arrayMode = refineArrayMode(
+                    arrayMode,
+                    m_graph[node.child1()].prediction(),
+                    m_graph[m_compileIndex].prediction());
             }
-            if (isArguments)
-                node.setOp(GetArgumentsLength);
-            else if (isString)
-                node.setOp(GetStringLength);
-            else if (isInt8Array)
-                node.setOp(GetInt8ArrayLength);
-            else if (isInt16Array)
-                node.setOp(GetInt16ArrayLength);
-            else if (isInt32Array)
-                node.setOp(GetInt32ArrayLength);
-            else if (isUint8Array)
-                node.setOp(GetUint8ArrayLength);
-            else if (isUint8ClampedArray)
-                node.setOp(GetUint8ClampedArrayLength);
-            else if (isUint16Array)
-                node.setOp(GetUint16ArrayLength);
-            else if (isUint32Array)
-                node.setOp(GetUint32ArrayLength);
-            else if (isFloat32Array)
-                node.setOp(GetFloat32ArrayLength);
-            else if (isFloat64Array)
-                node.setOp(GetFloat64ArrayLength);
-            else
-                ASSERT_NOT_REACHED();
-            // No longer MustGenerate
-            ASSERT(node.flags() & NodeMustGenerate);
-            node.clearFlags(NodeMustGenerate);
+            if (!modeSupportsLength(arrayMode))
+                break;
+            nodePtr->setOp(GetArrayLength);
+            ASSERT(nodePtr->flags() & NodeMustGenerate);
+            nodePtr->clearFlags(NodeMustGenerate);
             m_graph.deref(m_compileIndex);
+            nodePtr->setArrayMode(arrayMode);
             break;
         }
         case GetIndexedPropertyStorage: {
-            if (!m_graph[node.child1()].prediction()
-                || !m_graph[node.child2()].shouldSpeculateInteger()
-                || m_graph[node.child1()].shouldSpeculateArguments()) {
-                node.setOpAndDefaultFlags(Nop);
-                m_graph.clearAndDerefChild1(node);
-                m_graph.clearAndDerefChild2(node);
-                m_graph.clearAndDerefChild3(node);
-                node.setRefCount(0);
-            }
+            node.setArrayMode(
+                refineArrayMode(
+                    node.arrayMode(),
+                    m_graph[node.child1()].prediction(),
+                    m_graph[node.child2()].prediction()));
+            // Predictions should only become more, rather than less, refined. Hence
+            // if we were ever able to CSE the storage pointer for this operation,
+            // then we should always continue to be able to do so.
+            ASSERT(canCSEStorage(node.arrayMode()));
             break;
         }
         case GetByVal:
         case StringCharAt:
         case StringCharCodeAt: {
-            if (!!node.child3() && m_graph[node.child3()].op() == Nop)
-                node.children.child3() = Edge();
+            node.setArrayMode(
+                refineArrayMode(
+                    node.arrayMode(),
+                    m_graph[node.child1()].prediction(),
+                    m_graph[node.child2()].prediction()));
+            
+            if (canCSEStorage(node.arrayMode())) {
+                if (node.child3()) {
+                    ASSERT(m_graph[node.child3()].op() == GetIndexedPropertyStorage);
+                    ASSERT(modesCompatibleForStorageLoad(m_graph[node.child3()].arrayMode(), node.arrayMode()));
+                } else {
+                    // Make sure we don't use the node reference after we do the append.
+                    Node getIndexedPropertyStorage(
+                        GetIndexedPropertyStorage, node.codeOrigin, OpInfo(node.arrayMode()),
+                        node.child1().index(), node.child2().index());
+                    NodeIndex getIndexedPropertyStorageIndex = m_graph.size();
+                    node.children.child3() = Edge(getIndexedPropertyStorageIndex);
+                    m_graph.append(getIndexedPropertyStorage);
+                    m_graph.ref(getIndexedPropertyStorageIndex); // Once because it's MustGenerate.
+                    m_graph.ref(getIndexedPropertyStorageIndex); // And again because it's referenced from the GetByVal.
+                    m_insertionSet.append(m_indexInBlock, getIndexedPropertyStorageIndex);
+                }
+            } else {
+                // See above. Continued fixup of the graph should not regress our ability
+                // to speculate.
+                ASSERT(!node.child3());
+            }
             break;
         }
             
@@ -334,24 +326,30 @@ private:
         }
             
         case PutByVal:
-        case PutByValSafe: {
+        case PutByValAlias: {
             Edge child1 = m_graph.varArgChild(node, 0);
             Edge child2 = m_graph.varArgChild(node, 1);
             Edge child3 = m_graph.varArgChild(node, 2);
-            if (!m_graph[child1].prediction() || !m_graph[child2].prediction())
-                break;
-            if (!m_graph[child2].shouldSpeculateInteger())
+            node.setArrayMode(
+                refineArrayMode(
+                    node.arrayMode(), m_graph[child1].prediction(), m_graph[child2].prediction()));
+            
+            switch (modeForPut(node.arrayMode())) {
+            case Array::Int8Array:
+            case Array::Int16Array:
+            case Array::Int32Array:
+            case Array::Uint8Array:
+            case Array::Uint8ClampedArray:
+            case Array::Uint16Array:
+            case Array::Uint32Array:
+                if (!m_graph[child3].shouldSpeculateInteger())
+                    fixDoubleEdge(2);
                 break;
-            if (isActionableIntMutableArraySpeculation(m_graph[child1].prediction())) {
-                if (m_graph[child3].isConstant())
-                    break;
-                if (m_graph[child3].shouldSpeculateInteger())
-                    break;
+            case Array::Float32Array:
+            case Array::Float64Array:
                 fixDoubleEdge(2);
                 break;
-            }
-            if (isActionableFloatMutableArraySpeculation(m_graph[child1].prediction())) {
-                fixDoubleEdge(2);
+            default:
                 break;
             }
             break;
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index 9ae0648b8..8e80ff2fc 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -211,6 +211,10 @@ void Graph::dump(const char* prefix, NodeIndex nodeIndex)
         dataLog("%s%s", hasPrinted ? ", " : "", nodeFlagsAsString(node.flags()));
         hasPrinted = true;
     }
+    if (node.hasArrayMode()) {
+        dataLog("%s%s", hasPrinted ? ", " : "", modeToString(node.arrayMode()));
+        hasPrinted = true;
+    }
     if (node.hasVarNumber()) {
         dataLog("%svar%u", hasPrinted ? ", " : "", node.varNumber());
         hasPrinted = true;
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index 8d164a299..ba5d86f81 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -488,48 +488,20 @@ public:
     
     bool byValIsPure(Node& node)
     {
-        switch (node.op()) {
-        case PutByVal: {
-            if (!at(varArgChild(node, 1)).shouldSpeculateInteger())
-                return false;
-            SpeculatedType prediction = at(varArgChild(node, 0)).prediction();
-            if (!isActionableMutableArraySpeculation(prediction))
-                return false;
-            return true;
-        }
-            
-        case PutByValSafe: {
-            if (!at(varArgChild(node, 1)).shouldSpeculateInteger())
-                return false;
-            SpeculatedType prediction = at(varArgChild(node, 0)).prediction();
-            if (!isActionableMutableArraySpeculation(prediction))
-                return false;
-            if (isArraySpeculation(prediction))
-                return false;
-            return true;
-        }
-            
-        case PutByValAlias: {
-            if (!at(varArgChild(node, 1)).shouldSpeculateInteger())
-                return false;
-            SpeculatedType prediction = at(varArgChild(node, 0)).prediction();
-            if (!isActionableMutableArraySpeculation(prediction))
-                return false;
-            return true;
-        }
-            
-        case GetByVal: {
-            if (!at(node.child2()).shouldSpeculateInteger())
-                return false;
-            SpeculatedType prediction = at(node.child1()).prediction();
-            if (!isActionableArraySpeculation(prediction))
-                return false;
-            return true;
-        }
-            
-        default:
-            ASSERT_NOT_REACHED();
+        switch (node.arrayMode()) {
+        case Array::Generic:
+        case Array::JSArrayOutOfBounds:
             return false;
+        case Array::String:
+            return node.op() == GetByVal;
+#if USE(JSVALUE32_64)
+        case Array::Arguments:
+            if (node.op() == GetByVal)
+                return true;
+            return false;
+#endif // USE(JSVALUE32_64)
+        default:
+            return true;
         }
     }
     
@@ -549,7 +521,6 @@ public:
             return !isPredictedNumerical(node);
         case GetByVal:
         case PutByVal:
-        case PutByValSafe:
         case PutByValAlias:
             return !byValIsPure(node);
         default:
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index dac855be0..7ca4d8d48 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -33,6 +33,7 @@
 #include "CodeBlock.h"
 #include "CodeOrigin.h"
 #include "DFGAdjacencyList.h"
+#include "DFGArrayMode.h"
 #include "DFGCommon.h"
 #include "DFGNodeFlags.h"
 #include "DFGNodeType.h"
@@ -732,6 +733,34 @@ struct Node {
         return m_opInfo;
     }
     
+    bool hasArrayMode()
+    {
+        switch (op()) {
+        case GetIndexedPropertyStorage:
+        case GetArrayLength:
+        case PutByVal:
+        case PutByValAlias:
+        case GetByVal:
+        case StringCharAt:
+        case StringCharCodeAt:
+            return true;
+        default:
+            return false;
+        }
+    }
+    
+    Array::Mode arrayMode()
+    {
+        ASSERT(hasArrayMode());
+        return static_cast<Array::Mode>(m_opInfo);
+    }
+    
+    void setArrayMode(Array::Mode arrayMode)
+    {
+        ASSERT(hasArrayMode());
+        m_opInfo = arrayMode;
+    }
+    
     bool hasVirtualRegister()
     {
         return m_virtualRegister != InvalidVirtualRegister;
diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
index f0f8cb1d0..ee5ad9013 100644
--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
@@ -113,7 +113,6 @@ namespace JSC { namespace DFG {
     /* opcodes use VarArgs beause they may have up to 4 children. */\
     macro(GetByVal, NodeResultJS | NodeMustGenerate | NodeMightClobber) \
     macro(PutByVal, NodeMustGenerate | NodeHasVarArgs | NodeMightClobber) \
-    macro(PutByValSafe, NodeMustGenerate | NodeHasVarArgs | NodeMightClobber) \
     macro(PutByValAlias, NodeMustGenerate | NodeHasVarArgs | NodeMightClobber) \
     macro(GetById, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
     macro(GetByIdFlush, NodeResultJS | NodeMustGenerate | NodeClobbersWorld) \
@@ -143,17 +142,6 @@ namespace JSC { namespace DFG {
     macro(GetByOffset, NodeResultJS) \
     macro(PutByOffset, NodeMustGenerate) \
     macro(GetArrayLength, NodeResultInt32) \
-    macro(GetArgumentsLength, NodeResultInt32) \
-    macro(GetStringLength, NodeResultInt32) \
-    macro(GetInt8ArrayLength, NodeResultInt32) \
-    macro(GetInt16ArrayLength, NodeResultInt32) \
-    macro(GetInt32ArrayLength, NodeResultInt32) \
-    macro(GetUint8ArrayLength, NodeResultInt32) \
-    macro(GetUint8ClampedArrayLength, NodeResultInt32) \
-    macro(GetUint16ArrayLength, NodeResultInt32) \
-    macro(GetUint32ArrayLength, NodeResultInt32) \
-    macro(GetFloat32ArrayLength, NodeResultInt32) \
-    macro(GetFloat64ArrayLength, NodeResultInt32) \
     macro(GetScopeChain, NodeResultJS) \
     macro(GetScopedVar, NodeResultJS | NodeMustGenerate) \
     macro(PutScopedVar, NodeMustGenerate | NodeClobbersWorld) \
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index 1247528e8..258d1199a 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -612,17 +612,6 @@ private:
             
         case PutByValAlias:
         case GetArrayLength:
-        case GetArgumentsLength:
-        case GetInt8ArrayLength:
-        case GetInt16ArrayLength:
-        case GetInt32ArrayLength:
-        case GetUint8ArrayLength:
-        case GetUint8ClampedArrayLength:
-        case GetUint16ArrayLength:
-        case GetUint32ArrayLength:
-        case GetFloat32ArrayLength:
-        case GetFloat64ArrayLength:
-        case GetStringLength:
         case Int32ToDouble:
         case DoubleAsInt32:
         case GetLocalUnlinked:
@@ -637,7 +626,6 @@ private:
         }
         
         case PutByVal:
-        case PutByValSafe:
             changed |= m_graph[m_graph.varArgChild(node, 0)].mergeFlags(NodeUsedAsValue);
             changed |= m_graph[m_graph.varArgChild(node, 1)].mergeFlags(NodeUsedAsNumber | NodeUsedAsInt);
             changed |= m_graph[m_graph.varArgChild(node, 2)].mergeFlags(NodeUsedAsValue);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 6c6615716..d74207420 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -269,12 +269,82 @@ void SpeculativeJIT::clearGenerationInfo()
     m_fprs = RegisterBank<FPRInfo>();
 }
 
-void SpeculativeJIT::speculateArray(Edge edge, GPRReg baseReg)
+const TypedArrayDescriptor* SpeculativeJIT::typedArrayDescriptor(Array::Mode arrayMode)
+{
+    switch (arrayMode) {
+    case Array::Int8Array:
+        return &m_jit.globalData()->int8ArrayDescriptor();
+    case Array::Int16Array:
+        return &m_jit.globalData()->int16ArrayDescriptor();
+    case Array::Int32Array:
+        return &m_jit.globalData()->int32ArrayDescriptor();
+    case Array::Uint8Array:
+        return &m_jit.globalData()->uint8ArrayDescriptor();
+    case Array::Uint8ClampedArray:
+        return &m_jit.globalData()->uint8ClampedArrayDescriptor();
+    case Array::Uint16Array:
+        return &m_jit.globalData()->uint16ArrayDescriptor();
+    case Array::Uint32Array:
+        return &m_jit.globalData()->uint32ArrayDescriptor();
+    case Array::Float32Array:
+        return &m_jit.globalData()->float32ArrayDescriptor();
+    case Array::Float64Array:
+        return &m_jit.globalData()->float32ArrayDescriptor();
+    default:
+        return 0;
+    }
+}
+
+const TypedArrayDescriptor* SpeculativeJIT::speculateArray(Array::Mode arrayMode, Edge edge, GPRReg baseReg)
 {
-    AbstractValue& arrayValue = m_state.forNode(edge);
-    if (arrayValue.m_currentKnownStructure.hasSingleton()
-        && arrayValue.m_currentKnownStructure.singleton()->classInfo() == &JSArray::s_info)
-        return;
+    const TypedArrayDescriptor* result = typedArrayDescriptor(arrayMode);
+    
+    if (modeAlreadyChecked(m_state.forNode(edge), arrayMode))
+        return result;
+    
+    const ClassInfo* expectedClassInfo = 0;
+    
+    switch (arrayMode) {
+    case Array::ForceExit:
+        ASSERT_NOT_REACHED();
+        terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
+        return result;
+    case Array::String:
+        expectedClassInfo = &JSString::s_info;
+        break;
+    case Array::JSArray:
+    case Array::JSArrayOutOfBounds: {
+        // This code duplicates the code below in anticipation of this code being
+        // substantially changed in the future.
+        GPRTemporary temp(this);
+        m_jit.loadPtr(
+            MacroAssembler::Address(baseReg, JSCell::structureOffset()), temp.gpr());
+        speculationCheck(
+            Uncountable, JSValueRegs(), NoNode,
+            m_jit.branchPtr(
+                MacroAssembler::NotEqual,
+                MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
+                MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+        return result;
+    }
+    case Array::Arguments:
+        expectedClassInfo = &Arguments::s_info;
+        break;
+    case Array::Int8Array:
+    case Array::Int16Array:
+    case Array::Int32Array:
+    case Array::Uint8Array:
+    case Array::Uint8ClampedArray:
+    case Array::Uint16Array:
+    case Array::Uint32Array:
+    case Array::Float32Array:
+    case Array::Float64Array:
+        expectedClassInfo = result->m_classInfo;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
     
     GPRTemporary temp(this);
     m_jit.loadPtr(
@@ -284,7 +354,9 @@ void SpeculativeJIT::speculateArray(Edge edge, GPRReg baseReg)
         m_jit.branchPtr(
             MacroAssembler::NotEqual,
             MacroAssembler::Address(temp.gpr(), Structure::classInfoOffset()),
-            MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
+            MacroAssembler::TrustedImmPtr(expectedClassInfo)));
+    
+    return result;
 }
 
 GPRReg SpeculativeJIT::fillStorage(NodeIndex nodeIndex)
@@ -1620,11 +1692,7 @@ void SpeculativeJIT::compileGetByValOnString(Node& node)
     GPRReg propertyReg = property.gpr();
     GPRReg storageReg = storage.gpr();
 
-    if (!isStringSpeculation(m_state.forNode(node.child1()).m_type)) {
-        terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
-        noResult(m_compileIndex);
-        return;
-    }
+    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), Array::String));
 
     // unsigned comparison so we can filter out negative indices and indices that are too large
     speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSString::offsetOfLength())));
@@ -2018,23 +2086,7 @@ static void compileClampDoubleToByte(JITCompiler& jit, GPRReg result, FPRReg sou
 
 }
 
-void SpeculativeJIT::compileGetTypedArrayLength(const TypedArrayDescriptor& descriptor, Node& node, bool needsSpeculationCheck)
-{
-    SpeculateCellOperand base(this, node.child1());
-    GPRTemporary result(this);
-    
-    GPRReg baseGPR = base.gpr();
-    GPRReg resultGPR = result.gpr();
-    
-    if (needsSpeculationCheck)
-        speculationCheck(BadType, JSValueSource::unboxedCell(baseGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-    
-    m_jit.load32(MacroAssembler::Address(baseGPR, descriptor.m_lengthOffset), resultGPR);
-    
-    integerResult(resultGPR, m_compileIndex);
-}
-
-void SpeculativeJIT::compileGetByValOnIntTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness)
+void SpeculativeJIT::compileGetByValOnIntTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySignedness signedness)
 {
     SpeculateCellOperand base(this, node.child1());
     SpeculateStrictInt32Operand property(this, node.child2());
@@ -2047,12 +2099,7 @@ void SpeculativeJIT::compileGetByValOnIntTypedArray(const TypedArrayDescriptor&
     GPRTemporary result(this);
     GPRReg resultReg = result.gpr();
 
-    if (speculationRequirements != NoTypedArrayTypeSpecCheck) {
-        ASSERT_NOT_REACHED();
-        terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
-        noResult(m_compileIndex);
-        return;
-    }
+    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()));
 
     speculationCheck(
         Uncountable, JSValueRegs(), NoNode,
@@ -2097,13 +2144,10 @@ void SpeculativeJIT::compileGetByValOnIntTypedArray(const TypedArrayDescriptor&
     doubleResult(fresult.fpr(), m_compileIndex);
 }
 
-void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements, TypedArraySignedness signedness, TypedArrayRounding rounding)
+void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySignedness signedness, TypedArrayRounding rounding)
 {
-    Edge baseUse = m_jit.graph().varArgChild(node, 0);
     Edge valueUse = m_jit.graph().varArgChild(node, 2);
     
-    if (speculationRequirements != NoTypedArrayTypeSpecCheck)
-        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseUse, m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
     GPRTemporary value;
     GPRReg valueGPR;
     
@@ -2174,7 +2218,7 @@ void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor&
     ASSERT(valueGPR != storageReg);
     m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
     MacroAssembler::Jump outOfBounds;
-    if (speculationRequirements != NoTypedArraySpecCheck)
+    if (node.op() == PutByVal)
         outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
 
     switch (elementSize) {
@@ -2190,12 +2234,12 @@ void SpeculativeJIT::compilePutByValForIntTypedArray(const TypedArrayDescriptor&
     default:
         ASSERT_NOT_REACHED();
     }
-    if (speculationRequirements != NoTypedArraySpecCheck)
+    if (node.op() == PutByVal)
         outOfBounds.link(&m_jit);
     noResult(m_compileIndex);
 }
 
-void SpeculativeJIT::compileGetByValOnFloatTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
+void SpeculativeJIT::compileGetByValOnFloatTypedArray(const TypedArrayDescriptor& descriptor, Node& node, size_t elementSize)
 {
     SpeculateCellOperand base(this, node.child1());
     SpeculateStrictInt32Operand property(this, node.child2());
@@ -2204,17 +2248,11 @@ void SpeculativeJIT::compileGetByValOnFloatTypedArray(const TypedArrayDescriptor
     GPRReg baseReg = base.gpr();
     GPRReg propertyReg = property.gpr();
     GPRReg storageReg = storage.gpr();
-    
-    if (speculationRequirements != NoTypedArrayTypeSpecCheck) {
-        ASSERT_NOT_REACHED();
-        terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
-        noResult(m_compileIndex);
-        return;
-    }
+
+    ASSERT(modeAlreadyChecked(m_state.forNode(node.child1()), node.arrayMode()));
 
     FPRTemporary result(this);
     FPRReg resultReg = result.fpr();
-    ASSERT(speculationRequirements != NoTypedArraySpecCheck);
     speculationCheck(
         Uncountable, JSValueRegs(), NoNode,
         m_jit.branch32(
@@ -2238,15 +2276,14 @@ void SpeculativeJIT::compileGetByValOnFloatTypedArray(const TypedArrayDescriptor
     doubleResult(resultReg, m_compileIndex);
 }
 
-void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize, TypedArraySpeculationRequirements speculationRequirements)
+void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescriptor& descriptor, GPRReg base, GPRReg property, Node& node, size_t elementSize)
 {
     Edge baseUse = m_jit.graph().varArgChild(node, 0);
     Edge valueUse = m_jit.graph().varArgChild(node, 2);
     
     SpeculateDoubleOperand valueOp(this, valueUse);
     
-    if (speculationRequirements != NoTypedArrayTypeSpecCheck)
-        speculationCheck(BadType, JSValueSource::unboxedCell(base), baseUse.index(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(base, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
+    ASSERT_UNUSED(baseUse, modeAlreadyChecked(m_state.forNode(baseUse), node.arrayMode()));
     
     GPRTemporary result(this);
     
@@ -2255,7 +2292,7 @@ void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescripto
     
     m_jit.loadPtr(MacroAssembler::Address(base, descriptor.m_storageOffset), storageReg);
     MacroAssembler::Jump outOfBounds;
-    if (speculationRequirements != NoTypedArraySpecCheck)
+    if (node.op() == PutByVal)
         outOfBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, property, MacroAssembler::Address(base, descriptor.m_lengthOffset));
     
     switch (elementSize) {
@@ -2272,7 +2309,7 @@ void SpeculativeJIT::compilePutByValForFloatTypedArray(const TypedArrayDescripto
     default:
         ASSERT_NOT_REACHED();
     }
-    if (speculationRequirements != NoTypedArraySpecCheck)
+    if (node.op() == PutByVal)
         outOfBounds.link(&m_jit);
     noResult(m_compileIndex);
 }
@@ -3066,75 +3103,36 @@ bool SpeculativeJIT::compileStrictEq(Node& node)
 
 void SpeculativeJIT::compileGetIndexedPropertyStorage(Node& node)
 {
-    ASSERT(at(node.child1()).prediction());
-    ASSERT(at(node.child2()).shouldSpeculateInteger());
-        
     SpeculateCellOperand base(this, node.child1());
     GPRReg baseReg = base.gpr();
     
     GPRTemporary storage(this);
     GPRReg storageReg = storage.gpr();
-    if (at(node.child1()).shouldSpeculateArguments()) {
-        ASSERT_NOT_REACHED();
-    } else if (at(node.child1()).prediction() == SpecString) {
-        if (!isStringSpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
-
+    
+    const TypedArrayDescriptor* descriptor =
+        speculateArray(node.arrayMode(), node.child1(), baseReg);
+    
+    switch (node.arrayMode()) {
+    case Array::String:
         m_jit.loadPtr(MacroAssembler::Address(baseReg, JSString::offsetOfValue()), storageReg);
         
         // Speculate that we're not accessing a rope
         speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTest32(MacroAssembler::Zero, storageReg));
 
         m_jit.loadPtr(MacroAssembler::Address(storageReg, StringImpl::dataOffset()), storageReg);
-    } else if (at(node.child1()).shouldSpeculateInt8Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->int8ArrayDescriptor();
-        if (!isInt8ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateInt16Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->int16ArrayDescriptor();
-        if (!isInt16ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateInt32Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->int32ArrayDescriptor();
-        if (!isInt32ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateUint8Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->uint8ArrayDescriptor();
-        if (!isUint8ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateUint8ClampedArray()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->uint8ClampedArrayDescriptor();
-        if (!isUint8ClampedArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateUint16Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->uint16ArrayDescriptor();
-        if (!isUint16ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateUint32Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->uint32ArrayDescriptor();
-        if (!isUint32ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateFloat32Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->float32ArrayDescriptor();
-        if (!isFloat32ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else if (at(node.child1()).shouldSpeculateFloat64Array()) {
-        const TypedArrayDescriptor& descriptor = m_jit.globalData()->float64ArrayDescriptor();
-        if (!isFloat64ArraySpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseReg), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseReg, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(descriptor.m_classInfo)));
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor.m_storageOffset), storageReg);
-    } else {
-        speculateArray(node.child1(), baseReg);
+        break;
+        
+    case Array::JSArray:
+    case Array::JSArrayOutOfBounds:
         m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+        break;
+        
+    default:
+        ASSERT(descriptor);
+        m_jit.loadPtr(MacroAssembler::Address(baseReg, descriptor->m_storageOffset), storageReg);
+        break;
     }
+    
     storageResult(storageReg, m_compileIndex);
 }
 
@@ -3252,6 +3250,42 @@ void SpeculativeJIT::compileGetArgumentsLength(Node& node)
     integerResult(resultReg, m_compileIndex);
 }
 
+void SpeculativeJIT::compileGetArrayLength(Node& node)
+{
+    SpeculateCellOperand base(this, node.child1());
+    GPRTemporary result(this);
+        
+    GPRReg baseGPR = base.gpr();
+    GPRReg resultGPR = result.gpr();
+        
+    const TypedArrayDescriptor* descriptor =
+        speculateArray(node.arrayMode(), node.child1(), baseGPR);
+
+    switch (node.arrayMode()) {
+    case Array::JSArray:
+    case Array::JSArrayOutOfBounds:
+        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), resultGPR);
+        m_jit.load32(MacroAssembler::Address(resultGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), resultGPR);
+            
+        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::LessThan, resultGPR, MacroAssembler::TrustedImm32(0)));
+            
+        integerResult(resultGPR, m_compileIndex);
+        break;
+    case Array::String:
+        m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR);
+        integerResult(resultGPR, m_compileIndex);
+        break;
+    case Array::Arguments:
+        compileGetArgumentsLength(node);
+        break;
+    default:
+        ASSERT(descriptor);
+        m_jit.load32(MacroAssembler::Address(baseGPR, descriptor->m_lengthOffset), resultGPR);
+        integerResult(resultGPR, m_compileIndex);
+        break;
+    }
+}
+
 void SpeculativeJIT::compileNewFunctionNoCheck(Node& node)
 {
     GPRResult result(this);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 073dbb42c..69a30a974 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -2082,6 +2082,8 @@ public:
     void compileGetByValOnArguments(Node&);
     void compileGetArgumentsLength(Node&);
     
+    void compileGetArrayLength(Node&);
+    
     void compileValueToInt32(Node&);
     void compileUInt32ToNumber(Node&);
     void compileDoubleAsInt32(Node&);
@@ -2095,12 +2097,6 @@ public:
 #endif
     void compileArithMod(Node&);
     void compileSoftModulo(Node&);
-    void compileGetTypedArrayLength(const TypedArrayDescriptor&, Node&, bool needsSpeculationCheck);
-    enum TypedArraySpeculationRequirements {
-        NoTypedArraySpecCheck,
-        NoTypedArrayTypeSpecCheck,
-        AllTypedArraySpecChecks
-    };
     enum TypedArraySignedness {
         SignedTypedArray,
         UnsignedTypedArray
@@ -2110,10 +2106,10 @@ public:
         ClampRounding
     };
     void compileGetIndexedPropertyStorage(Node&);
-    void compileGetByValOnIntTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySpeculationRequirements, TypedArraySignedness);
-    void compilePutByValForIntTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize, TypedArraySpeculationRequirements, TypedArraySignedness, TypedArrayRounding = TruncateRounding);
-    void compileGetByValOnFloatTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySpeculationRequirements);
-    void compilePutByValForFloatTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize, TypedArraySpeculationRequirements);
+    void compileGetByValOnIntTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize, TypedArraySignedness);
+    void compilePutByValForIntTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize, TypedArraySignedness, TypedArrayRounding = TruncateRounding);
+    void compileGetByValOnFloatTypedArray(const TypedArrayDescriptor&, Node&, size_t elementSize);
+    void compilePutByValForFloatTypedArray(const TypedArrayDescriptor&, GPRReg base, GPRReg property, Node&, size_t elementSize);
     void compileNewFunctionNoCheck(Node&);
     void compileNewFunctionExpression(Node&);
     bool compileRegExpExec(Node&);
@@ -2199,7 +2195,9 @@ public:
     JumpReplacementWatchpoint* forwardSpeculationWatchpoint(ExitKind = UncountableWatchpoint);
     JumpReplacementWatchpoint* speculationWatchpointWithConditionalDirection(ExitKind, bool isForward);
     
-    void speculateArray(Edge baseEdge, GPRReg baseReg);
+    const TypedArrayDescriptor* typedArrayDescriptor(Array::Mode);
+    
+    const TypedArrayDescriptor* speculateArray(Array::Mode, Edge baseEdge, GPRReg baseReg);
     
     template<bool strict>
     GPRReg fillSpeculateIntInternal(NodeIndex, DataFormat& returnFormat);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 7a9ba1e41..26a48dcec 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -2341,12 +2341,13 @@ void SpeculativeJIT::compile(Node& node)
     }
 
     case GetByVal: {
-        if (!node.prediction() || !at(node.child1()).prediction() || !at(node.child2()).prediction()) {
+        switch (node.arrayMode()) {
+        case Array::Undecided:
+        case Array::ForceExit:
+            ASSERT_NOT_REACHED();
             terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
             break;
-        }
-        
-        if (!at(node.child2()).shouldSpeculateInteger() || (!node.child3() && !at(node.child1()).shouldSpeculateArguments())) {
+        case Array::Generic: {
             SpeculateCellOperand base(this, node.child1()); // Save a register, speculate cell. We'll probably be right.
             JSValueOperand property(this, node.child2());
             GPRReg baseGPR = base.gpr();
@@ -2361,125 +2362,94 @@ void SpeculativeJIT::compile(Node& node)
             jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
             break;
         }
+        case Array::JSArray:
+        case Array::JSArrayOutOfBounds: {
+            SpeculateStrictInt32Operand property(this, node.child2());
+            StorageOperand storage(this, node.child3());
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
         
-        if (at(node.child1()).shouldSpeculateArguments()) {
-            compileGetByValOnArguments(node);
             if (!m_compileOkay)
                 return;
+
+            // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
+            // If we have predicted the base to be type array, we can skip the check.
+            {
+                SpeculateCellOperand base(this, node.child1());
+                GPRReg baseReg = base.gpr();
+                // We've already speculated that it's some kind of array, at this point.
+                speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+            }
+
+            GPRTemporary resultTag(this);
+            GPRTemporary resultPayload(this);
+
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
+            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
+            m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
+
+            jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
             break;
         }
-
-        if (at(node.child1()).prediction() == SpecString) {
+        case Array::String:
             compileGetByValOnString(node);
-            if (!m_compileOkay)
-                return;
             break;
-        }
-        
-        if (at(node.child1()).shouldSpeculateInt8Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), isInt8ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateInt16Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), isInt16ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateInt32Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), isInt32ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateUint8Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), isUint8ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-
-        if (at(node.child1()).shouldSpeculateUint8ClampedArray()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), node, sizeof(uint8_t), isUint8ClampedArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
+        case Array::Arguments:
+            compileGetByValOnArguments(node);
+            break;
+        case Array::Int8Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), SignedTypedArray);
+            break;
+        case Array::Int16Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), SignedTypedArray);
+            break;
+        case Array::Int32Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), SignedTypedArray);
+            break;
+        case Array::Uint8Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), UnsignedTypedArray);
+            break;
+        case Array::Uint8ClampedArray:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), node, sizeof(uint8_t), UnsignedTypedArray);
+            break;
+        case Array::Uint16Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), UnsignedTypedArray);
+            break;
+        case Array::Uint32Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), UnsignedTypedArray);
+            break;
+        case Array::Float32Array:
+            compileGetByValOnFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float));
+            break;
+        case Array::Float64Array:
+            compileGetByValOnFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
             break;
         }
-
-        if (at(node.child1()).shouldSpeculateUint16Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), isUint16ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateUint32Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), isUint32ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateFloat32Array()) {
-            compileGetByValOnFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float), isFloat32ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateFloat64Array()) {
-            compileGetByValOnFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double), isFloat64ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        SpeculateStrictInt32Operand property(this, node.child2());
-        StorageOperand storage(this, node.child3());
-        GPRReg propertyReg = property.gpr();
-        GPRReg storageReg = storage.gpr();
-        
-        if (!m_compileOkay)
-            return;
-
-        // Check that base is an array, and that property is contained within m_vector (< m_vectorLength).
-        // If we have predicted the base to be type array, we can skip the check.
-        {
-            SpeculateCellOperand base(this, node.child1());
-            GPRReg baseReg = base.gpr();
-            // We've already speculated that it's some kind of array, at this point.
-            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
-        }
-
-        GPRTemporary resultTag(this);
-        GPRTemporary resultPayload(this);
-
-        m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag.gpr());
-        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::Equal, resultTag.gpr(), TrustedImm32(JSValue::EmptyValueTag)));
-        m_jit.load32(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload.gpr());
-
-        jsValueResult(resultTag.gpr(), resultPayload.gpr(), m_compileIndex);
         break;
     }
 
     case PutByVal:
-    case PutByValSafe: {
+    case PutByValAlias: {
         Edge child1 = m_jit.graph().varArgChild(node, 0);
         Edge child2 = m_jit.graph().varArgChild(node, 1);
         Edge child3 = m_jit.graph().varArgChild(node, 2);
         
-        if (!at(child1).prediction() || !at(child2).prediction()) {
+        Array::Mode arrayMode = modeForPut(node.arrayMode());
+        bool alreadyHandled = false;
+        
+        switch (arrayMode) {
+        case Array::Undecided:
+        case Array::ForceExit:
+            ASSERT_NOT_REACHED();
             terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
+            alreadyHandled = true;
             break;
-        }
-        
-        if (!at(child2).shouldSpeculateInteger()
-            || at(child1).shouldSpeculateArguments()) {
+        case Array::Generic: {
+            ASSERT(node.op() == PutByVal);
+            
             SpeculateCellOperand base(this, child1); // Save a register, speculate cell. We'll probably be right.
             JSValueOperand property(this, child2);
             JSValueOperand value(this, child3);
@@ -2493,233 +2463,144 @@ void SpeculativeJIT::compile(Node& node)
             callOperation(m_jit.codeBlock()->isStrictMode() ? operationPutByValCellStrict : operationPutByValCellNonStrict, baseGPR, propertyTagGPR, propertyPayloadGPR, valueTagGPR, valuePayloadGPR);
             
             noResult(m_compileIndex);
+            alreadyHandled = true;
             break;
         }
-
-        SpeculateCellOperand base(this, child1);
-        SpeculateStrictInt32Operand property(this, child2);
-        if (at(child1).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), isInt8ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), isInt16ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), isInt32ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), isUint8ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint8ClampedArray()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), isUint8ClampedArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray, ClampRounding);
-            if (!m_compileOkay)
-                return;
+        default:
             break;
         }
-
-        if (at(child1).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), isUint16ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
         
-        if (at(child1).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), isUint32ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), isFloat32ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
+        if (alreadyHandled)
+            break;
         
-        if (at(child1).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), isFloat64ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
+        SpeculateCellOperand base(this, child1);
+        SpeculateStrictInt32Operand property(this, child2);
         
-        JSValueOperand value(this, child3);
-        // Map base, property & value into registers, allocate a scratch register.
         GPRReg baseReg = base.gpr();
         GPRReg propertyReg = property.gpr();
-        GPRReg valueTagReg = value.tagGPR();
-        GPRReg valuePayloadReg = value.payloadGPR();
-        
-        if (!m_compileOkay)
-            return;
 
-        {
-            GPRTemporary scratch(this);
-            GPRReg scratchReg = scratch.gpr();
-            writeBarrier(baseReg, valueTagReg, child3, WriteBarrierForPropertyAccess, scratchReg);
-        }
+        speculateArray(arrayMode, child1, baseReg);
 
-        speculateArray(child1, baseReg);
-
-        MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
-        if (node.op() == PutByVal)
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
-
-        base.use();
-        property.use();
-        value.use();
-        
-        // Get the array storage.
-        GPRTemporary storage(this);
-        GPRReg storageReg = storage.gpr();
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
-        // Check if we're writing to a hole; if so increment m_numValuesInVector.
-        MacroAssembler::Jump notHoleValue = m_jit.branch32(MacroAssembler::NotEqual, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
-        m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
-
-        // If we're writing to a hole we might be growing the array; 
-        MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-        m_jit.add32(TrustedImm32(1), propertyReg);
-        m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-        m_jit.sub32(TrustedImm32(1), propertyReg);
-
-        lengthDoesNotNeedUpdate.link(&m_jit);
-        notHoleValue.link(&m_jit);
+        switch (arrayMode) {
+        case Array::JSArray:
+        case Array::JSArrayOutOfBounds: {
+            JSValueOperand value(this, child3);
 
-        // Store the value to the array.
-        m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-        m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-        
-        if (node.op() == PutByValSafe) {
-            addSlowPathGenerator(
-                slowPathCall(
-                    beyondArrayBounds, this,
-                    m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
-                    NoResult, baseReg, propertyReg, valueTagReg, valuePayloadReg));
-        }
+            GPRReg valueTagReg = value.tagGPR();
+            GPRReg valuePayloadReg = value.payloadGPR();
             
-        noResult(m_compileIndex, UseChildrenCalledExplicitly);
-        break;
-    }
-
-    case PutByValAlias: {
-        Edge child1 = m_jit.graph().varArgChild(node, 0);
-        Edge child2 = m_jit.graph().varArgChild(node, 1);
-        Edge child3 = m_jit.graph().varArgChild(node, 2);
-        
-        if (!at(child1).prediction() || !at(child2).prediction()) {
-            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
-            break;
-        }
-        
-        ASSERT(isActionableMutableArraySpeculation(at(child1).prediction()));
-        ASSERT(at(child2).shouldSpeculateInteger());
-
-        SpeculateCellOperand base(this, child1);
-        SpeculateStrictInt32Operand property(this, child2);
-
-        if (at(child1).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), NoTypedArraySpecCheck, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), NoTypedArraySpecCheck, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), NoTypedArraySpecCheck, SignedTypedArray);
             if (!m_compileOkay)
                 return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
+            
+            {
+                GPRTemporary scratch(this);
+                GPRReg scratchReg = scratch.gpr();
+                writeBarrier(baseReg, valueTagReg, child3, WriteBarrierForPropertyAccess, scratchReg);
+            }
 
-        if (at(child1).shouldSpeculateUint8ClampedArray()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray, ClampRounding);
-            if (!m_compileOkay)
-                return;
-            break;
-        }
+            if (node.op() == PutByValAlias) {
+                // Get the array storage.
+                GPRTemporary storage(this);
+                GPRReg storageReg = storage.gpr();
+                m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+                
+                // Store the value to the array.
+                GPRReg propertyReg = property.gpr();
+                m_jit.store32(value.tagGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+                m_jit.store32(value.payloadGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+                
+                noResult(m_compileIndex);
+                break;
+            }
 
-        if (at(child1).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), NoTypedArraySpecCheck, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), NoTypedArraySpecCheck, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), NoTypedArraySpecCheck);
-            if (!m_compileOkay)
-                return;
-            break;            
+            MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
+            if (arrayMode == Array::JSArray)
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
+            
+            base.use();
+            property.use();
+            value.use();
+            
+            // Get the array storage.
+            GPRTemporary storage(this);
+            GPRReg storageReg = storage.gpr();
+            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+
+            // Check if we're writing to a hole; if so increment m_numValuesInVector.
+            MacroAssembler::Jump notHoleValue = m_jit.branch32(MacroAssembler::NotEqual, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), TrustedImm32(JSValue::EmptyValueTag));
+            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+
+            // If we're writing to a hole we might be growing the array; 
+            MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+            m_jit.add32(TrustedImm32(1), propertyReg);
+            m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+            m_jit.sub32(TrustedImm32(1), propertyReg);
+
+            lengthDoesNotNeedUpdate.link(&m_jit);
+            notHoleValue.link(&m_jit);
+
+            // Store the value to the array.
+            m_jit.store32(valueTagReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
+            m_jit.store32(valuePayloadReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
+        
+            if (arrayMode == Array::JSArrayOutOfBounds) {
+                addSlowPathGenerator(
+                    slowPathCall(
+                        beyondArrayBounds, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, valueTagReg, valuePayloadReg));
+            }
+            
+            noResult(m_compileIndex, UseChildrenCalledExplicitly);
+            break;
         }
-        
-        if (at(child1).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), NoTypedArraySpecCheck);
-            if (!m_compileOkay)
-                return;
-            break;            
+            
+        case Array::Arguments:
+            // FIXME: we could at some point make this work. Right now we're assuming that the register
+            // pressure would be too great.
+            ASSERT_NOT_REACHED();
+            break;
+            
+        case Array::Int8Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), SignedTypedArray);
+            break;
+            
+        case Array::Int16Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), SignedTypedArray);
+            break;
+            
+        case Array::Int32Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), SignedTypedArray);
+            break;
+            
+        case Array::Uint8Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), UnsignedTypedArray);
+            break;
+            
+        case Array::Uint8ClampedArray:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), UnsignedTypedArray, ClampRounding);
+            break;
+            
+        case Array::Uint16Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), UnsignedTypedArray);
+            break;
+            
+        case Array::Uint32Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), UnsignedTypedArray);
+            break;
+            
+        case Array::Float32Array:
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float));
+            break;
+            
+        case Array::Float64Array:
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double));
+            break;
+            
+        default:
+            ASSERT_NOT_REACHED();
+            break;
         }
-
-        ASSERT(at(child1).shouldSpeculateArray());
-
-        JSValueOperand value(this, child3);
-        GPRTemporary scratch(this, base);
-        
-        GPRReg baseReg = base.gpr();
-        GPRReg scratchReg = scratch.gpr();
-
-        writeBarrier(baseReg, value.tagGPR(), child3, WriteBarrierForPropertyAccess, scratchReg);
-
-        // Get the array storage.
-        GPRReg storageReg = scratchReg;
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
-        // Store the value to the array.
-        GPRReg propertyReg = property.gpr();
-        m_jit.store32(value.tagGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-        m_jit.store32(value.payloadGPR(), MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-
-        noResult(m_compileIndex);
         break;
     }
 
@@ -2787,7 +2668,7 @@ void SpeculativeJIT::compile(Node& node)
             writeBarrier(baseGPR, valueTagGPR, node.child2(), WriteBarrierForPropertyAccess, scratch.gpr(), storageLengthGPR);
         }
 
-        speculateArray(node.child1(), baseGPR);
+        speculateArray(Array::JSArray, node.child1(), baseGPR);
         
         GPRTemporary storage(this);
         GPRReg storageGPR = storage.gpr();
@@ -2827,7 +2708,7 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg storageGPR = storage.gpr();
         GPRReg storageLengthGPR = storageLength.gpr();
         
-        speculateArray(node.child1(), baseGPR);
+        speculateArray(Array::JSArray, node.child1(), baseGPR);
         
         m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), storageGPR);
         m_jit.load32(MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), storageLengthGPR);
@@ -3373,82 +3254,10 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
 
-    case GetArrayLength: {
-        SpeculateCellOperand base(this, node.child1());
-        GPRReg baseGPR = base.gpr();
-        
-        speculateArray(node.child1(), baseGPR);
-        
-        GPRTemporary result(this);
-        GPRReg resultGPR = result.gpr();
-
-        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), resultGPR);
-        m_jit.load32(MacroAssembler::Address(resultGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), resultGPR);
-        
-        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::LessThan, resultGPR, MacroAssembler::TrustedImm32(0)));
-        
-        integerResult(resultGPR, m_compileIndex);
+    case GetArrayLength:
+        compileGetArrayLength(node);
         break;
-    }
-        
-    case GetArgumentsLength: {
-        compileGetArgumentsLength(node);
-        break;
-    }
-
-    case GetStringLength: {
-        SpeculateCellOperand base(this, node.child1());
-        GPRTemporary result(this);
-        
-        GPRReg baseGPR = base.gpr();
-        GPRReg resultGPR = result.gpr();
-        
-        if (!isStringSpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueSource::unboxedCell(baseGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
         
-        m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR);
-
-        integerResult(resultGPR, m_compileIndex);
-        break;
-    }
-
-    case GetInt8ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->int8ArrayDescriptor(), node, !isInt8ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetInt16ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->int16ArrayDescriptor(), node, !isInt16ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetInt32ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->int32ArrayDescriptor(), node, !isInt32ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint8ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint8ArrayDescriptor(), node, !isUint8ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint8ClampedArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint8ClampedArrayDescriptor(), node, !isUint8ClampedArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint16ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint16ArrayDescriptor(), node, !isUint16ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint32ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint32ArrayDescriptor(), node, !isUint32ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetFloat32ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->float32ArrayDescriptor(), node, !isFloat32ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetFloat64ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->float64ArrayDescriptor(), node, !isFloat64ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-
     case CheckFunction: {
         SpeculateCellOperand function(this, node.child1());
         speculationCheck(BadCache, JSValueRegs(), NoNode, m_jit.branchWeakPtr(JITCompiler::NotEqual, function.gpr(), node.function()));
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index c2151088c..c2e207264 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -2374,12 +2374,13 @@ void SpeculativeJIT::compile(Node& node)
     }
 
     case GetByVal: {
-        if (!node.prediction() || !at(node.child1()).prediction() || !at(node.child2()).prediction()) {
+        switch (node.arrayMode()) {
+        case Array::Undecided:
+        case Array::ForceExit:
+            ASSERT_NOT_REACHED();
             terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
             break;
-        }
-        
-        if (!at(node.child2()).shouldSpeculateInteger() || (!node.child3() && !at(node.child1()).shouldSpeculateArguments())) {
+        case Array::Generic: {
             JSValueOperand base(this, node.child1());
             JSValueOperand property(this, node.child2());
             GPRReg baseGPR = base.gpr();
@@ -2392,120 +2393,90 @@ void SpeculativeJIT::compile(Node& node)
             jsValueResult(result.gpr(), m_compileIndex);
             break;
         }
-        
-        if (at(node.child1()).shouldSpeculateArguments()) {
-            compileGetByValOnArguments(node);
+        case Array::JSArray:
+        case Array::JSArrayOutOfBounds: {
+            SpeculateCellOperand base(this, node.child1());
+            SpeculateStrictInt32Operand property(this, node.child2());
+            StorageOperand storage(this, node.child3());
+            
+            GPRReg baseReg = base.gpr();
+            GPRReg propertyReg = property.gpr();
+            GPRReg storageReg = storage.gpr();
+            
             if (!m_compileOkay)
                 return;
+            
+            // We will have already speculated that the base is some kind of array,
+            // at this point.
+            
+            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
+            
+            GPRTemporary result(this);
+            m_jit.loadPtr(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.gpr());
+            speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::Zero, result.gpr()));
+            
+            jsValueResult(result.gpr(), m_compileIndex);
             break;
         }
-        
-        if (at(node.child1()).prediction() == SpecString) {
+        case Array::String:
             compileGetByValOnString(node);
-            if (!m_compileOkay)
-                return;
             break;
-        }
-
-        if (at(node.child1()).shouldSpeculateInt8Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), isInt8ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateInt16Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), isInt16ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateInt32Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), isInt32ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-
-        if (at(node.child1()).shouldSpeculateUint8Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), isUint8ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-
-        if (at(node.child1()).shouldSpeculateUint8ClampedArray()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), node, sizeof(uint8_t), isUint8ClampedArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
+        case Array::Arguments:
+            compileGetByValOnArguments(node);
+            break;
+        case Array::Int8Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), node, sizeof(int8_t), SignedTypedArray);
+            break;
+        case Array::Int16Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), node, sizeof(int16_t), SignedTypedArray);
+            break;
+        case Array::Int32Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), node, sizeof(int32_t), SignedTypedArray);
+            break;
+        case Array::Uint8Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), node, sizeof(uint8_t), UnsignedTypedArray);
+            break;
+        case Array::Uint8ClampedArray:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), node, sizeof(uint8_t), UnsignedTypedArray);
+            break;
+        case Array::Uint16Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), UnsignedTypedArray);
+            break;
+        case Array::Uint32Array:
+            compileGetByValOnIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), UnsignedTypedArray);
+            break;
+        case Array::Float32Array:
+            compileGetByValOnFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float));
+            break;
+        case Array::Float64Array:
+            compileGetByValOnFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
             break;
         }
-
-        if (at(node.child1()).shouldSpeculateUint16Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), node, sizeof(uint16_t), isUint16ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateUint32Array()) {
-            compileGetByValOnIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), node, sizeof(uint32_t), isUint32ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateFloat32Array()) {
-            compileGetByValOnFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), node, sizeof(float), isFloat32ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(node.child1()).shouldSpeculateFloat64Array()) {
-            compileGetByValOnFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), node, sizeof(double), isFloat64ArraySpeculation(m_state.forNode(node.child1()).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        SpeculateCellOperand base(this, node.child1());
-        SpeculateStrictInt32Operand property(this, node.child2());
-        StorageOperand storage(this, node.child3());
-
-        GPRReg baseReg = base.gpr();
-        GPRReg propertyReg = property.gpr();
-        GPRReg storageReg = storage.gpr();
-        
-        if (!m_compileOkay)
-            return;
-
-        // We will have already speculated that the base is some kind of array,
-        // at this point.
-        
-        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset())));
-
-        GPRTemporary result(this);
-        m_jit.loadPtr(MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), result.gpr());
-        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branchTestPtr(MacroAssembler::Zero, result.gpr()));
-
-        jsValueResult(result.gpr(), m_compileIndex);
         break;
     }
 
     case PutByVal:
-    case PutByValSafe: {
+    case PutByValAlias: {
         Edge child1 = m_jit.graph().varArgChild(node, 0);
         Edge child2 = m_jit.graph().varArgChild(node, 1);
         Edge child3 = m_jit.graph().varArgChild(node, 2);
         
-        if (!at(child1).prediction() || !at(child2).prediction()) {
+        Array::Mode arrayMode = modeForPut(node.arrayMode());
+        bool alreadyHandled = false;
+        
+        switch (arrayMode) {
+        case Array::Undecided:
+        case Array::ForceExit:
+            ASSERT_NOT_REACHED();
             terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
+            alreadyHandled = true;
             break;
-        }
-        
-        if (!at(child2).shouldSpeculateInteger()) {
+        case Array::Generic: {
+            ASSERT(node.op() == PutByVal);
+            
             JSValueOperand arg1(this, child1);
             JSValueOperand arg2(this, child2);
             JSValueOperand arg3(this, child3);
@@ -2517,19 +2488,97 @@ void SpeculativeJIT::compile(Node& node)
             callOperation(m_jit.strictModeFor(node.codeOrigin) ? operationPutByValStrict : operationPutByValNonStrict, arg1GPR, arg2GPR, arg3GPR);
             
             noResult(m_compileIndex);
+            alreadyHandled = true;
             break;
         }
-
+        default:
+            break;
+        }
+        
+        if (alreadyHandled)
+            break;
+        
         SpeculateCellOperand base(this, child1);
         SpeculateStrictInt32Operand property(this, child2);
-        if (at(child1).shouldSpeculateArguments()) {
-            dataLog(" in here ");
+        
+        GPRReg baseReg = base.gpr();
+        GPRReg propertyReg = property.gpr();
+
+        speculateArray(arrayMode, child1, baseReg);
+
+        switch (arrayMode) {
+        case Array::JSArray:
+        case Array::JSArrayOutOfBounds: {
+            JSValueOperand value(this, child3);
+            GPRTemporary scratch(this);
+
+            // Map base, property & value into registers, allocate a scratch register.
+            GPRReg valueReg = value.gpr();
+            GPRReg scratchReg = scratch.gpr();
+        
+            if (!m_compileOkay)
+                return;
+        
+            writeBarrier(baseReg, value.gpr(), child3, WriteBarrierForPropertyAccess, scratchReg);
+
+            if (node.op() == PutByValAlias) {
+                GPRReg storageReg = scratchReg;
+                m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+                
+                // Store the value to the array.
+                GPRReg propertyReg = property.gpr();
+                GPRReg valueReg = value.gpr();
+                m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+                
+                noResult(m_compileIndex);
+                break;
+            }
+            
+            MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
+            if (arrayMode == Array::JSArray)
+                speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
+
+            base.use();
+            property.use();
+            value.use();
+        
+            // Get the array storage.
+            GPRReg storageReg = scratchReg;
+            m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
+
+            // Check if we're writing to a hole; if so increment m_numValuesInVector.
+            MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+            m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
+
+            // If we're writing to a hole we might be growing the array; 
+            MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+            m_jit.add32(TrustedImm32(1), propertyReg);
+            m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
+            m_jit.sub32(TrustedImm32(1), propertyReg);
+
+            lengthDoesNotNeedUpdate.link(&m_jit);
+            notHoleValue.link(&m_jit);
+
+            // Store the value to the array.
+            m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+
+            if (arrayMode == Array::JSArrayOutOfBounds) {
+                addSlowPathGenerator(
+                    slowPathCall(
+                        beyondArrayBounds, this,
+                        m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
+                        NoResult, baseReg, propertyReg, valueReg));
+            }
+
+            noResult(m_compileIndex, UseChildrenCalledExplicitly);
+            break;
+        }
+            
+        case Array::Arguments: {
             JSValueOperand value(this, child3);
             GPRTemporary scratch(this);
             GPRTemporary scratch2(this);
             
-            GPRReg baseReg = base.gpr();
-            GPRReg propertyReg = property.gpr();
             GPRReg valueReg = value.gpr();
             GPRReg scratchReg = scratch.gpr();
             GPRReg scratch2Reg = scratch2.gpr();
@@ -2537,15 +2586,6 @@ void SpeculativeJIT::compile(Node& node)
             if (!m_compileOkay)
                 return;
 
-            if (!isArgumentsSpeculation(m_state.forNode(child1).m_type)) {
-                speculationCheck(
-                    BadType, JSValueSource::unboxedCell(baseReg), child1,
-                    m_jit.branchPtr(
-                        MacroAssembler::NotEqual,
-                        MacroAssembler::Address(baseReg, JSCell::classInfoOffset()),
-                        MacroAssembler::TrustedImmPtr(&Arguments::s_info)));
-            }
-    
             m_jit.loadPtr(
                 MacroAssembler::Address(baseReg, Arguments::offsetOfData()),
                 scratchReg);
@@ -2579,225 +2619,51 @@ void SpeculativeJIT::compile(Node& node)
             noResult(m_compileIndex);
             break;
         }
-        
-        if (at(child1).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), isInt8ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), isInt16ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-
-        if (at(child1).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), isInt32ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), isUint8ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-
-        if (at(child1).shouldSpeculateUint8ClampedArray()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), isUint8ClampedArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray, ClampRounding);
+            
+        case Array::Int8Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), SignedTypedArray);
             break;
-        }
-
-        if (at(child1).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), isUint16ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), isUint32ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), isFloat32ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), isFloat64ArraySpeculation(m_state.forNode(child1).m_type) ? NoTypedArrayTypeSpecCheck : AllTypedArraySpecChecks);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
             
-        JSValueOperand value(this, child3);
-        GPRTemporary scratch(this);
-
-        // Map base, property & value into registers, allocate a scratch register.
-        GPRReg baseReg = base.gpr();
-        GPRReg propertyReg = property.gpr();
-        GPRReg valueReg = value.gpr();
-        GPRReg scratchReg = scratch.gpr();
-        
-        if (!m_compileOkay)
-            return;
-        
-        writeBarrier(baseReg, value.gpr(), child3, WriteBarrierForPropertyAccess, scratchReg);
-
-        speculateArray(child1, baseReg);
-
-        MacroAssembler::Jump beyondArrayBounds = m_jit.branch32(MacroAssembler::AboveOrEqual, propertyReg, MacroAssembler::Address(baseReg, JSArray::vectorLengthOffset()));
-        if (node.op() == PutByVal)
-            speculationCheck(OutOfBounds, JSValueRegs(), NoNode, beyondArrayBounds);
-
-        base.use();
-        property.use();
-        value.use();
-        
-        // Get the array storage.
-        GPRReg storageReg = scratchReg;
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
-        // Check if we're writing to a hole; if so increment m_numValuesInVector.
-        MacroAssembler::Jump notHoleValue = m_jit.branchTestPtr(MacroAssembler::NonZero, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
-        m_jit.add32(TrustedImm32(1), MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_numValuesInVector)));
-
-        // If we're writing to a hole we might be growing the array; 
-        MacroAssembler::Jump lengthDoesNotNeedUpdate = m_jit.branch32(MacroAssembler::Below, propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-        m_jit.add32(TrustedImm32(1), propertyReg);
-        m_jit.store32(propertyReg, MacroAssembler::Address(storageReg, OBJECT_OFFSETOF(ArrayStorage, m_length)));
-        m_jit.sub32(TrustedImm32(1), propertyReg);
-
-        lengthDoesNotNeedUpdate.link(&m_jit);
-        notHoleValue.link(&m_jit);
-
-        // Store the value to the array.
-        m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
-
-        if (node.op() == PutByValSafe) {
-            addSlowPathGenerator(
-                slowPathCall(
-                    beyondArrayBounds, this,
-                    m_jit.codeBlock()->isStrictMode() ? operationPutByValBeyondArrayBoundsStrict : operationPutByValBeyondArrayBoundsNonStrict,
-                    NoResult, baseReg, propertyReg, valueReg));
-        }
-
-        noResult(m_compileIndex, UseChildrenCalledExplicitly);
-        break;
-    }
-
-    case PutByValAlias: {
-        Edge child1 = m_jit.graph().varArgChild(node, 0);
-        Edge child2 = m_jit.graph().varArgChild(node, 1);
-        Edge child3 = m_jit.graph().varArgChild(node, 2);
-        
-        if (!at(child1).prediction() || !at(child2).prediction()) {
-            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), NoNode);
+        case Array::Int16Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), SignedTypedArray);
             break;
-        }
-        
-        ASSERT(isActionableMutableArraySpeculation(at(child1).prediction()));
-        ASSERT(at(child2).shouldSpeculateInteger());
-
-        SpeculateCellOperand base(this, child1);
-        SpeculateStrictInt32Operand property(this, child2);
-        if (at(child1).shouldSpeculateInt8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int8_t), NoTypedArraySpecCheck, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateInt16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int16_t), NoTypedArraySpecCheck, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateInt32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), NoTypedArraySpecCheck, SignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint8Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-
-        if (at(child1).shouldSpeculateUint8ClampedArray()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), NoTypedArraySpecCheck, UnsignedTypedArray, ClampRounding);
-            if (!m_compileOkay)
-                return;
+            
+        case Array::Int32Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->int32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(int32_t), SignedTypedArray);
+            break;
+            
+        case Array::Uint8Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), UnsignedTypedArray);
+            break;
+            
+        case Array::Uint8ClampedArray:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint8ClampedArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint8_t), UnsignedTypedArray, ClampRounding);
+            break;
+            
+        case Array::Uint16Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), UnsignedTypedArray);
+            break;
+            
+        case Array::Uint32Array:
+            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), UnsignedTypedArray);
+            break;
+            
+        case Array::Float32Array:
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float));
+            break;
+            
+        case Array::Float64Array:
+            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double));
+            break;
+            
+        default:
+            ASSERT_NOT_REACHED();
             break;
         }
 
-        if (at(child1).shouldSpeculateUint16Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint16ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint16_t), NoTypedArraySpecCheck, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateUint32Array()) {
-            compilePutByValForIntTypedArray(m_jit.globalData()->uint32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(uint32_t), NoTypedArraySpecCheck, UnsignedTypedArray);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateFloat32Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float32ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(float), NoTypedArraySpecCheck);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        if (at(child1).shouldSpeculateFloat64Array()) {
-            compilePutByValForFloatTypedArray(m_jit.globalData()->float64ArrayDescriptor(), base.gpr(), property.gpr(), node, sizeof(double), NoTypedArraySpecCheck);
-            if (!m_compileOkay)
-                return;
-            break;            
-        }
-        
-        ASSERT(at(child1).shouldSpeculateArray());
-
-        JSValueOperand value(this, child3);
-        GPRTemporary scratch(this);
-        
-        GPRReg baseReg = base.gpr();
-        GPRReg scratchReg = scratch.gpr();
-
-        writeBarrier(base.gpr(), value.gpr(), child3, WriteBarrierForPropertyAccess, scratchReg);
-
-        // Get the array storage.
-        GPRReg storageReg = scratchReg;
-        m_jit.loadPtr(MacroAssembler::Address(baseReg, JSArray::storageOffset()), storageReg);
-
-        // Store the value to the array.
-        GPRReg propertyReg = property.gpr();
-        GPRReg valueReg = value.gpr();
-        m_jit.storePtr(valueReg, MacroAssembler::BaseIndex(storageReg, propertyReg, MacroAssembler::ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
-
-        noResult(m_compileIndex);
         break;
     }
-        
+
     case RegExpExec: {
         if (compileRegExpExec(node))
             return;
@@ -2859,7 +2725,7 @@ void SpeculativeJIT::compile(Node& node)
         
         writeBarrier(baseGPR, valueGPR, node.child2(), WriteBarrierForPropertyAccess, storageGPR, storageLengthGPR);
 
-        speculateArray(node.child1(), baseGPR);
+        speculateArray(Array::JSArray, node.child1(), baseGPR);
 
         m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), storageGPR);
         m_jit.load32(MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), storageLengthGPR);
@@ -2896,7 +2762,7 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg storageGPR = storage.gpr();
         GPRReg storageLengthGPR = storageLength.gpr();
         
-        speculateArray(node.child1(), baseGPR);
+        speculateArray(Array::JSArray, node.child1(), baseGPR);
 
         m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), storageGPR);
         m_jit.load32(MacroAssembler::Address(storageGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), storageLengthGPR);
@@ -3386,81 +3252,10 @@ void SpeculativeJIT::compile(Node& node)
         break;
     }
 
-    case GetArrayLength: {
-        SpeculateCellOperand base(this, node.child1());
-        GPRTemporary result(this);
-        
-        GPRReg baseGPR = base.gpr();
-        GPRReg resultGPR = result.gpr();
-        
-        speculateArray(node.child1(), baseGPR);
-
-        m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArray::storageOffset()), resultGPR);
-        m_jit.load32(MacroAssembler::Address(resultGPR, OBJECT_OFFSETOF(ArrayStorage, m_length)), resultGPR);
-        
-        speculationCheck(Uncountable, JSValueRegs(), NoNode, m_jit.branch32(MacroAssembler::LessThan, resultGPR, MacroAssembler::TrustedImm32(0)));
-        
-        integerResult(resultGPR, m_compileIndex);
+    case GetArrayLength:
+        compileGetArrayLength(node);
         break;
-    }
         
-    case GetArgumentsLength: {
-        compileGetArgumentsLength(node);
-        break;
-    }
-
-    case GetStringLength: {
-        SpeculateCellOperand base(this, node.child1());
-        GPRTemporary result(this);
-        
-        GPRReg baseGPR = base.gpr();
-        GPRReg resultGPR = result.gpr();
-        
-        if (!isStringSpeculation(m_state.forNode(node.child1()).m_type))
-            speculationCheck(BadType, JSValueRegs(baseGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(baseGPR, JSCell::structureOffset()), MacroAssembler::TrustedImmPtr(m_jit.globalData()->stringStructure.get())));
-        
-        m_jit.load32(MacroAssembler::Address(baseGPR, JSString::offsetOfLength()), resultGPR);
-
-        integerResult(resultGPR, m_compileIndex);
-        break;
-    }
-
-    case GetInt8ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->int8ArrayDescriptor(), node, !isInt8ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetInt16ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->int16ArrayDescriptor(), node, !isInt16ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetInt32ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->int32ArrayDescriptor(), node, !isInt32ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint8ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint8ArrayDescriptor(), node, !isUint8ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint8ClampedArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint8ClampedArrayDescriptor(), node, !isUint8ClampedArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint16ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint16ArrayDescriptor(), node, !isUint16ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetUint32ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->uint32ArrayDescriptor(), node, !isUint32ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetFloat32ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->float32ArrayDescriptor(), node, !isFloat32ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
-    case GetFloat64ArrayLength: {
-        compileGetTypedArrayLength(m_jit.globalData()->float64ArrayDescriptor(), node, !isFloat64ArraySpeculation(m_state.forNode(node.child1()).m_type));
-        break;
-    }
     case CheckFunction: {
         SpeculateCellOperand function(this, node.child1());
         speculationCheck(BadCache, JSValueRegs(), NoNode, m_jit.branchWeakPtr(JITCompiler::NotEqual, function.gpr(), node.function()));
diff --git a/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
index 68627f95c..eb04a6747 100644
--- a/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGStructureCheckHoistingPhase.cpp
@@ -98,7 +98,6 @@ public:
                 case GetByVal:
                 case PutByVal:
                 case PutByValAlias:
-                case PutByValSafe:
                 case GetArrayLength:
                 case Phantom:
                     // Don't count these uses.
@@ -215,53 +214,12 @@ public:
                 }
                     
                 case GetByVal:
-                    if (!node.prediction() || !m_graph[node.child1()].prediction() || !m_graph[node.child2()].prediction())
-                        break;
-                    if (!isActionableArraySpeculation(m_graph[node.child1()].prediction()) || !m_graph[node.child2()].shouldSpeculateInteger())
-                        clobber(live);
-                    break;
-                    
                 case PutByVal:
                 case PutByValAlias:
-                case PutByValSafe: {
-                    Edge child1 = m_graph.varArgChild(node, 0);
-                    Edge child2 = m_graph.varArgChild(node, 1);
-                    
-                    if (!m_graph[child1].prediction() || !m_graph[child2].prediction())
-                        break;
-                    if (!m_graph[child2].shouldSpeculateInteger()
-#if USE(JSVALUE32_64)
-                        || m_graph[child1].shouldSpeculateArguments()
-#endif
-                        ) {
-                        clobber(live);
-                        break;
-                    }
-                    if (node.op() != PutByValSafe)
-                        break;
-                    if (m_graph[child1].shouldSpeculateArguments())
-                        break;
-                    if (m_graph[child1].shouldSpeculateInt8Array())
-                        break;
-                    if (m_graph[child1].shouldSpeculateInt16Array())
-                        break;
-                    if (m_graph[child1].shouldSpeculateInt32Array())
-                        break;
-                    if (m_graph[child1].shouldSpeculateUint8Array())
-                        break;
-                    if (m_graph[child1].shouldSpeculateUint8ClampedArray())
-                        break;
-                    if (m_graph[child1].shouldSpeculateUint16Array())
-                        break;
-                    if (m_graph[child1].shouldSpeculateUint32Array())
-                        break;
-                    if (m_graph[child1].shouldSpeculateFloat32Array())
-                        break;
-                    if (m_graph[child1].shouldSpeculateFloat64Array())
+                    if (m_graph.byValIsPure(node))
                         break;
                     clobber(live);
                     break;
-                }
                     
                 case GetMyArgumentsLengthSafe:
                 case GetMyArgumentByValSafe:
diff --git a/Source/JavaScriptCore/heap/GCThreadSharedData.cpp b/Source/JavaScriptCore/heap/GCThreadSharedData.cpp
new file mode 100644
index 000000000..82c52d22e
--- /dev/null
+++ b/Source/JavaScriptCore/heap/GCThreadSharedData.cpp
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GCThreadSharedData.h"
+
+#include "JSGlobalData.h"
+#include "MarkStack.h"
+#include "SlotVisitor.h"
+#include <wtf/MainThread.h>
+
+namespace JSC {
+
+#if ENABLE(PARALLEL_GC)
+void GCThreadSharedData::resetChildren()
+{
+    for (unsigned i = 0; i < m_markingThreadsMarkStack.size(); ++i)
+        m_markingThreadsMarkStack[i]->reset();
+}
+
+size_t GCThreadSharedData::childVisitCount()
+{       
+    unsigned long result = 0;
+    for (unsigned i = 0; i < m_markingThreadsMarkStack.size(); ++i)
+        result += m_markingThreadsMarkStack[i]->visitCount();
+    return result;
+}
+
+void GCThreadSharedData::markingThreadMain(SlotVisitor* slotVisitor)
+{
+    WTF::registerGCThread();
+    {
+        ParallelModeEnabler enabler(*slotVisitor);
+        slotVisitor->drainFromShared(SlotVisitor::SlaveDrain);
+    }
+    delete slotVisitor;
+}
+
+void GCThreadSharedData::markingThreadStartFunc(void* myVisitor)
+{               
+    SlotVisitor* slotVisitor = static_cast<SlotVisitor*>(myVisitor);
+
+    slotVisitor->sharedData().markingThreadMain(slotVisitor);
+}
+#endif
+
+GCThreadSharedData::GCThreadSharedData(JSGlobalData* globalData)
+    : m_globalData(globalData)
+    , m_copiedSpace(&globalData->heap.m_storageSpace)
+    , m_shouldHashConst(false)
+    , m_sharedMarkStack(m_segmentAllocator)
+    , m_numberOfActiveParallelMarkers(0)
+    , m_parallelMarkersShouldExit(false)
+{
+#if ENABLE(PARALLEL_GC)
+    for (unsigned i = 1; i < Options::numberOfGCMarkers(); ++i) {
+        SlotVisitor* slotVisitor = new SlotVisitor(*this);
+        m_markingThreadsMarkStack.append(slotVisitor);
+        m_markingThreads.append(createThread(markingThreadStartFunc, slotVisitor, "JavaScriptCore::Marking"));
+        ASSERT(m_markingThreads.last());
+    }
+#endif
+}
+
+GCThreadSharedData::~GCThreadSharedData()
+{
+#if ENABLE(PARALLEL_GC)    
+    // Destroy our marking threads.
+    {
+        MutexLocker locker(m_markingLock);
+        m_parallelMarkersShouldExit = true;
+        m_markingCondition.broadcast();
+    }
+    for (unsigned i = 0; i < m_markingThreads.size(); ++i)
+        waitForThreadCompletion(m_markingThreads[i]);
+#endif
+}
+    
+void GCThreadSharedData::reset()
+{
+    ASSERT(!m_numberOfActiveParallelMarkers);
+    ASSERT(!m_parallelMarkersShouldExit);
+    ASSERT(m_sharedMarkStack.isEmpty());
+    
+#if ENABLE(PARALLEL_GC)
+    m_segmentAllocator.shrinkReserve();
+    m_opaqueRoots.clear();
+#else
+    ASSERT(m_opaqueRoots.isEmpty());
+#endif
+    m_weakReferenceHarvesters.removeAll();
+
+    if (m_shouldHashConst) {
+        m_globalData->resetNewStringsSinceLastHashConst();
+        m_shouldHashConst = false;
+    }
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/heap/GCThreadSharedData.h b/Source/JavaScriptCore/heap/GCThreadSharedData.h
new file mode 100644
index 000000000..8868b440c
--- /dev/null
+++ b/Source/JavaScriptCore/heap/GCThreadSharedData.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GCThreadSharedData_h
+#define GCThreadSharedData_h
+
+#include "MarkStack.h"
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JSGlobalData;
+class CopiedSpace;
+
+class GCThreadSharedData {
+public:
+    GCThreadSharedData(JSGlobalData*);
+    ~GCThreadSharedData();
+    
+    void reset();
+
+#if ENABLE(PARALLEL_GC)
+    void resetChildren();
+    size_t childVisitCount();
+    size_t childDupStrings();
+#endif
+    
+private:
+    friend class MarkStack;
+    friend class SlotVisitor;
+
+#if ENABLE(PARALLEL_GC)
+    void markingThreadMain(SlotVisitor*);
+    static void markingThreadStartFunc(void* heap);
+#endif
+
+    JSGlobalData* m_globalData;
+    CopiedSpace* m_copiedSpace;
+    
+    MarkStackSegmentAllocator m_segmentAllocator;
+    
+    bool m_shouldHashConst;
+
+    Vector<ThreadIdentifier> m_markingThreads;
+    Vector<MarkStack*> m_markingThreadsMarkStack;
+    
+    Mutex m_markingLock;
+    ThreadCondition m_markingCondition;
+    MarkStackArray m_sharedMarkStack;
+    unsigned m_numberOfActiveParallelMarkers;
+    bool m_parallelMarkersShouldExit;
+
+    Mutex m_opaqueRootsLock;
+    HashSet<void*> m_opaqueRoots;
+
+    ListableHandler<WeakReferenceHarvester>::List m_weakReferenceHarvesters;
+    ListableHandler<UnconditionalFinalizer>::List m_unconditionalFinalizers;
+};
+
+} // namespace JSC
+
+#endif
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index f3474f2ea..6f13afb72 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -24,6 +24,7 @@
 
 #include "BlockAllocator.h"
 #include "DFGCodeBlocks.h"
+#include "GCThreadSharedData.h"
 #include "HandleSet.h"
 #include "HandleStack.h"
 #include "JITStubRoutineSet.h"
@@ -74,7 +75,7 @@ namespace JSC {
         WTF_MAKE_NONCOPYABLE(Heap);
     public:
         friend class JIT;
-        friend class MarkStackThreadSharedData;
+        friend class GCThreadSharedData;
         static Heap* heap(const JSValue); // 0 for immediate values
         static Heap* heap(const JSCell*);
 
@@ -231,7 +232,7 @@ namespace JSC {
 
         MachineThreads m_machineThreads;
         
-        MarkStackThreadSharedData m_sharedData;
+        GCThreadSharedData m_sharedData;
         SlotVisitor m_slotVisitor;
 
         HandleSet m_handleSet;
diff --git a/Source/JavaScriptCore/heap/ListableHandler.h b/Source/JavaScriptCore/heap/ListableHandler.h
index 2cb03251f..16c34146c 100644
--- a/Source/JavaScriptCore/heap/ListableHandler.h
+++ b/Source/JavaScriptCore/heap/ListableHandler.h
@@ -52,7 +52,7 @@ protected:
 private:
     // Allow these classes to use ListableHandler::List.
     friend class MarkStack;
-    friend class MarkStackThreadSharedData;
+    friend class GCThreadSharedData;
     friend class SlotVisitor;
     
     class List {
diff --git a/Source/JavaScriptCore/heap/MarkStack.cpp b/Source/JavaScriptCore/heap/MarkStack.cpp
index 02a13077d..9d3062154 100644
--- a/Source/JavaScriptCore/heap/MarkStack.cpp
+++ b/Source/JavaScriptCore/heap/MarkStack.cpp
@@ -25,6 +25,7 @@
 
 #include "config.h"
 #include "MarkStack.h"
+#include "MarkStackInlineMethods.h"
 
 #include "CopiedSpace.h"
 #include "CopiedSpaceInlineMethods.h"
@@ -223,89 +224,22 @@ void MarkStackArray::stealSomeCellsFrom(MarkStackArray& other, size_t idleThread
         append(other.removeLast());
 }
 
-#if ENABLE(PARALLEL_GC)
-void MarkStackThreadSharedData::resetChildren()
-{
-    for (unsigned i = 0; i < m_markingThreadsMarkStack.size(); ++i)
-        m_markingThreadsMarkStack[i]->reset();
-}
-
-size_t MarkStackThreadSharedData::childVisitCount()
-{       
-    unsigned long result = 0;
-    for (unsigned i = 0; i < m_markingThreadsMarkStack.size(); ++i)
-        result += m_markingThreadsMarkStack[i]->visitCount();
-    return result;
-}
-
-void MarkStackThreadSharedData::markingThreadMain(SlotVisitor* slotVisitor)
-{
-    WTF::registerGCThread();
-    {
-        ParallelModeEnabler enabler(*slotVisitor);
-        slotVisitor->drainFromShared(SlotVisitor::SlaveDrain);
-    }
-    delete slotVisitor;
-}
-
-void MarkStackThreadSharedData::markingThreadStartFunc(void* myVisitor)
-{               
-    SlotVisitor* slotVisitor = static_cast<SlotVisitor*>(myVisitor);
-
-    slotVisitor->sharedData().markingThreadMain(slotVisitor);
-}
+MarkStack::MarkStack(GCThreadSharedData& shared)
+    : m_stack(shared.m_segmentAllocator)
+#if !ASSERT_DISABLED
+    , m_isCheckingForDefaultMarkViolation(false)
+    , m_isDraining(false)
 #endif
-
-MarkStackThreadSharedData::MarkStackThreadSharedData(JSGlobalData* globalData)
-    : m_globalData(globalData)
-    , m_copiedSpace(&globalData->heap.m_storageSpace)
+    , m_visitCount(0)
+    , m_isInParallelMode(false)
+    , m_shared(shared)
     , m_shouldHashConst(false)
-    , m_sharedMarkStack(m_segmentAllocator)
-    , m_numberOfActiveParallelMarkers(0)
-    , m_parallelMarkersShouldExit(false)
 {
-#if ENABLE(PARALLEL_GC)
-    for (unsigned i = 1; i < Options::numberOfGCMarkers(); ++i) {
-        SlotVisitor* slotVisitor = new SlotVisitor(*this);
-        m_markingThreadsMarkStack.append(slotVisitor);
-        m_markingThreads.append(createThread(markingThreadStartFunc, slotVisitor, "JavaScriptCore::Marking"));
-        ASSERT(m_markingThreads.last());
-    }
-#endif
 }
 
-MarkStackThreadSharedData::~MarkStackThreadSharedData()
+MarkStack::~MarkStack()
 {
-#if ENABLE(PARALLEL_GC)    
-    // Destroy our marking threads.
-    {
-        MutexLocker locker(m_markingLock);
-        m_parallelMarkersShouldExit = true;
-        m_markingCondition.broadcast();
-    }
-    for (unsigned i = 0; i < m_markingThreads.size(); ++i)
-        waitForThreadCompletion(m_markingThreads[i]);
-#endif
-}
-    
-void MarkStackThreadSharedData::reset()
-{
-    ASSERT(!m_numberOfActiveParallelMarkers);
-    ASSERT(!m_parallelMarkersShouldExit);
-    ASSERT(m_sharedMarkStack.isEmpty());
-    
-#if ENABLE(PARALLEL_GC)
-    m_segmentAllocator.shrinkReserve();
-    m_opaqueRoots.clear();
-#else
-    ASSERT(m_opaqueRoots.isEmpty());
-#endif
-    m_weakReferenceHarvesters.removeAll();
-
-    if (m_shouldHashConst) {
-        m_globalData->resetNewStringsSinceLastHashConst();
-        m_shouldHashConst = false;
-    }
+    ASSERT(m_stack.isEmpty());
 }
 
 void MarkStack::setup()
diff --git a/Source/JavaScriptCore/heap/MarkStack.h b/Source/JavaScriptCore/heap/MarkStack.h
index 467a5bf46..54ae1cb02 100644
--- a/Source/JavaScriptCore/heap/MarkStack.h
+++ b/Source/JavaScriptCore/heap/MarkStack.h
@@ -74,6 +74,7 @@ namespace JSC {
     class ConservativeRoots;
     class JSGlobalData;
     class MarkStack;
+    class GCThreadSharedData;
     class ParallelModeEnabler;
     class Register;
     class SlotVisitor;
@@ -192,57 +193,12 @@ namespace JSC {
 #endif
     };
 
-    class MarkStackThreadSharedData {
-    public:
-        MarkStackThreadSharedData(JSGlobalData*);
-        ~MarkStackThreadSharedData();
-        
-        void reset();
-
-#if ENABLE(PARALLEL_GC)
-        void resetChildren();
-        size_t childVisitCount();
-        size_t childDupStrings();
-#endif
-    
-    private:
-        friend class MarkStack;
-        friend class SlotVisitor;
-
-#if ENABLE(PARALLEL_GC)
-        void markingThreadMain(SlotVisitor*);
-        static void markingThreadStartFunc(void* heap);
-#endif
-
-        JSGlobalData* m_globalData;
-        CopiedSpace* m_copiedSpace;
-        
-        MarkStackSegmentAllocator m_segmentAllocator;
-        
-        bool m_shouldHashConst;
-
-        Vector<ThreadIdentifier> m_markingThreads;
-        Vector<MarkStack*> m_markingThreadsMarkStack;
-        
-        Mutex m_markingLock;
-        ThreadCondition m_markingCondition;
-        MarkStackArray m_sharedMarkStack;
-        unsigned m_numberOfActiveParallelMarkers;
-        bool m_parallelMarkersShouldExit;
-
-        Mutex m_opaqueRootsLock;
-        HashSet<void*> m_opaqueRoots;
-
-        ListableHandler<WeakReferenceHarvester>::List m_weakReferenceHarvesters;
-        ListableHandler<UnconditionalFinalizer>::List m_unconditionalFinalizers;
-    };
-
     class MarkStack {
         WTF_MAKE_NONCOPYABLE(MarkStack);
         friend class HeapRootVisitor; // Allowed to mark a JSValue* or JSCell** directly.
 
     public:
-        MarkStack(MarkStackThreadSharedData&);
+        MarkStack(GCThreadSharedData&);
         ~MarkStack();
 
         void append(ConservativeRoots&);
@@ -259,7 +215,7 @@ namespace JSC {
         bool containsOpaqueRoot(void*);
         int opaqueRootCount();
 
-        MarkStackThreadSharedData& sharedData() { return m_shared; }
+        GCThreadSharedData& sharedData() { return m_shared; }
         bool isEmpty() { return m_stack.isEmpty(); }
 
         void setup();
@@ -271,15 +227,8 @@ namespace JSC {
         VTableSpectrum m_visitedTypeCounts;
 #endif
 
-        void addWeakReferenceHarvester(WeakReferenceHarvester* weakReferenceHarvester)
-        {
-            m_shared.m_weakReferenceHarvesters.addThreadSafe(weakReferenceHarvester);
-        }
-        
-        void addUnconditionalFinalizer(UnconditionalFinalizer* unconditionalFinalizer)
-        {
-            m_shared.m_unconditionalFinalizers.addThreadSafe(unconditionalFinalizer);
-        }
+        void addWeakReferenceHarvester(WeakReferenceHarvester*);
+        void addUnconditionalFinalizer(UnconditionalFinalizer*);
 
 #if ENABLE(OBJECT_MARK_LOGGING)
         inline void resetChildCount() { m_logChildCount = 0; }
@@ -328,7 +277,7 @@ namespace JSC {
         size_t m_visitCount;
         bool m_isInParallelMode;
         
-        MarkStackThreadSharedData& m_shared;
+        GCThreadSharedData& m_shared;
 
         bool m_shouldHashConst; // Local per-thread copy of shared flag for performance reasons
         typedef HashMap<StringImpl*, JSValue> UniqueStringMap;
@@ -339,63 +288,6 @@ namespace JSC {
 #endif
     };
 
-    inline MarkStack::MarkStack(MarkStackThreadSharedData& shared)
-        : m_stack(shared.m_segmentAllocator)
-#if !ASSERT_DISABLED
-        , m_isCheckingForDefaultMarkViolation(false)
-        , m_isDraining(false)
-#endif
-        , m_visitCount(0)
-        , m_isInParallelMode(false)
-        , m_shared(shared)
-        , m_shouldHashConst(false)
-    {
-    }
-
-    inline MarkStack::~MarkStack()
-    {
-        ASSERT(m_stack.isEmpty());
-    }
-
-    inline void MarkStack::addOpaqueRoot(void* root)
-    {
-#if ENABLE(PARALLEL_GC)
-        if (Options::numberOfGCMarkers() == 1) {
-            // Put directly into the shared HashSet.
-            m_shared.m_opaqueRoots.add(root);
-            return;
-        }
-        // Put into the local set, but merge with the shared one every once in
-        // a while to make sure that the local sets don't grow too large.
-        mergeOpaqueRootsIfProfitable();
-        m_opaqueRoots.add(root);
-#else
-        m_opaqueRoots.add(root);
-#endif
-    }
-
-    inline bool MarkStack::containsOpaqueRoot(void* root)
-    {
-        ASSERT(!m_isInParallelMode);
-#if ENABLE(PARALLEL_GC)
-        ASSERT(m_opaqueRoots.isEmpty());
-        return m_shared.m_opaqueRoots.contains(root);
-#else
-        return m_opaqueRoots.contains(root);
-#endif
-    }
-
-    inline int MarkStack::opaqueRootCount()
-    {
-        ASSERT(!m_isInParallelMode);
-#if ENABLE(PARALLEL_GC)
-        ASSERT(m_opaqueRoots.isEmpty());
-        return m_shared.m_opaqueRoots.size();
-#else
-        return m_opaqueRoots.size();
-#endif
-    }
-
     inline void MarkStackArray::append(const JSCell* cell)
     {
         if (m_top == m_segmentCapacity)
@@ -429,51 +321,6 @@ namespace JSC {
         return m_top + m_segmentCapacity * m_numberOfPreviousSegments;
     }
 
-    ALWAYS_INLINE void MarkStack::append(JSValue* slot, size_t count)
-    {
-        for (size_t i = 0; i < count; ++i) {
-            JSValue& value = slot[i];
-            if (!value)
-                continue;
-            internalAppend(value);
-        }
-    }
-
-    template<typename T>
-    inline void MarkStack::appendUnbarrieredPointer(T** slot)
-    {
-        ASSERT(slot);
-        JSCell* cell = *slot;
-        if (cell)
-            internalAppend(cell);
-    }
-    
-    ALWAYS_INLINE void MarkStack::append(JSValue* slot)
-    {
-        ASSERT(slot);
-        internalAppend(*slot);
-    }
-
-    ALWAYS_INLINE void MarkStack::appendUnbarrieredValue(JSValue* slot)
-    {
-        ASSERT(slot);
-        internalAppend(*slot);
-    }
-
-    ALWAYS_INLINE void MarkStack::append(JSCell** slot)
-    {
-        ASSERT(slot);
-        internalAppend(*slot);
-    }
-
-    ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
-    {
-        ASSERT(value);
-        if (!value.isCell())
-            return;
-        internalAppend(value.asCell());
-    }
-
     class ParallelModeEnabler {
     public:
         ParallelModeEnabler(MarkStack& stack)
diff --git a/Source/JavaScriptCore/heap/MarkStackInlineMethods.h b/Source/JavaScriptCore/heap/MarkStackInlineMethods.h
new file mode 100644
index 000000000..8b420d637
--- /dev/null
+++ b/Source/JavaScriptCore/heap/MarkStackInlineMethods.h
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2009, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MarkStackInlineMethods_h
+#define MarkStackInlineMethods_h
+
+#include "GCThreadSharedData.h"
+#include "MarkStack.h"
+
+namespace JSC {
+
+ALWAYS_INLINE void MarkStack::append(JSValue* slot, size_t count)
+{
+    for (size_t i = 0; i < count; ++i) {
+        JSValue& value = slot[i];
+        if (!value)
+            continue;
+        internalAppend(value);
+    }
+}
+
+template<typename T>
+inline void MarkStack::appendUnbarrieredPointer(T** slot)
+{
+    ASSERT(slot);
+    JSCell* cell = *slot;
+    if (cell)
+        internalAppend(cell);
+}
+
+ALWAYS_INLINE void MarkStack::append(JSValue* slot)
+{
+    ASSERT(slot);
+    internalAppend(*slot);
+}
+
+ALWAYS_INLINE void MarkStack::appendUnbarrieredValue(JSValue* slot)
+{
+    ASSERT(slot);
+    internalAppend(*slot);
+}
+
+ALWAYS_INLINE void MarkStack::append(JSCell** slot)
+{
+    ASSERT(slot);
+    internalAppend(*slot);
+}
+
+ALWAYS_INLINE void MarkStack::internalAppend(JSValue value)
+{
+    ASSERT(value);
+    if (!value.isCell())
+        return;
+    internalAppend(value.asCell());
+}
+
+inline void MarkStack::addWeakReferenceHarvester(WeakReferenceHarvester* weakReferenceHarvester)
+{
+    m_shared.m_weakReferenceHarvesters.addThreadSafe(weakReferenceHarvester);
+}
+
+inline void MarkStack::addUnconditionalFinalizer(UnconditionalFinalizer* unconditionalFinalizer)
+{
+    m_shared.m_unconditionalFinalizers.addThreadSafe(unconditionalFinalizer);
+}
+
+inline void MarkStack::addOpaqueRoot(void* root)
+{
+#if ENABLE(PARALLEL_GC)
+    if (Options::numberOfGCMarkers() == 1) {
+        // Put directly into the shared HashSet.
+        m_shared.m_opaqueRoots.add(root);
+        return;
+    }
+    // Put into the local set, but merge with the shared one every once in
+    // a while to make sure that the local sets don't grow too large.
+    mergeOpaqueRootsIfProfitable();
+    m_opaqueRoots.add(root);
+#else
+    m_opaqueRoots.add(root);
+#endif
+}
+
+inline bool MarkStack::containsOpaqueRoot(void* root)
+{
+    ASSERT(!m_isInParallelMode);
+#if ENABLE(PARALLEL_GC)
+    ASSERT(m_opaqueRoots.isEmpty());
+    return m_shared.m_opaqueRoots.contains(root);
+#else
+    return m_opaqueRoots.contains(root);
+#endif
+}
+
+inline int MarkStack::opaqueRootCount()
+{
+    ASSERT(!m_isInParallelMode);
+#if ENABLE(PARALLEL_GC)
+    ASSERT(m_opaqueRoots.isEmpty());
+    return m_shared.m_opaqueRoots.size();
+#else
+    return m_opaqueRoots.size();
+#endif
+}
+
+} // namespace JSC
+
+#endif
diff --git a/Source/JavaScriptCore/heap/SlotVisitor.h b/Source/JavaScriptCore/heap/SlotVisitor.h
index a31e88c08..6364b23e4 100644
--- a/Source/JavaScriptCore/heap/SlotVisitor.h
+++ b/Source/JavaScriptCore/heap/SlotVisitor.h
@@ -28,15 +28,17 @@
 
 #include "CopiedSpace.h"
 #include "MarkStack.h"
+#include "MarkStackInlineMethods.h"
 
 namespace JSC {
 
 class Heap;
+class GCThreadSharedData;
 
 class SlotVisitor : public MarkStack {
     friend class HeapRootVisitor;
 public:
-    SlotVisitor(MarkStackThreadSharedData&);
+    SlotVisitor(GCThreadSharedData&);
 
     void donate()
     {
@@ -85,7 +87,7 @@ private:
     CopiedAllocator m_copiedAllocator;
 };
 
-inline SlotVisitor::SlotVisitor(MarkStackThreadSharedData& shared)
+inline SlotVisitor::SlotVisitor(GCThreadSharedData& shared)
     : MarkStack(shared)
 {
 }
diff --git a/Source/JavaScriptCore/parser/SourceProvider.h b/Source/JavaScriptCore/parser/SourceProvider.h
index 946792b2c..2e7f71785 100644
--- a/Source/JavaScriptCore/parser/SourceProvider.h
+++ b/Source/JavaScriptCore/parser/SourceProvider.h
@@ -49,8 +49,8 @@ namespace JSC {
             , m_cache(cache ? cache : new SourceProviderCache)
             , m_cacheOwned(!cache)
         {
-            turnOffVerifier();
         }
+
         virtual ~SourceProvider()
         {
             if (m_cacheOwned)
diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
index 9ddc32c8c..8b017efbc 100644
--- a/Source/JavaScriptCore/runtime/SymbolTable.h
+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
@@ -330,7 +330,7 @@ namespace JSC {
     public:
         static PassRefPtr<SharedSymbolTable> create() { return adoptRef(new SharedSymbolTable); }
     private:
-        SharedSymbolTable() { turnOffVerifier(); }
+        SharedSymbolTable() { }
     };
     
 } // namespace JSC
diff --git a/Source/Platform/ChangeLog b/Source/Platform/ChangeLog
index fa415296d..12aa87c4a 100644
--- a/Source/Platform/ChangeLog
+++ b/Source/Platform/ChangeLog
@@ -1,3 +1,37 @@
+2012-08-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Change WebLayer from a concrete type to a pure virtual interface
+        https://bugs.webkit.org/show_bug.cgi?id=94174
+
+        Reviewed by Adrienne Walker.
+
+        This changes WebLayer from a value type to a pure virtual interface and changes Web*Layers from subtypes to
+        standalone types that have a WebLayer. This better isolates the implementation from the interface and, since
+        it's not possible to re-wrap an existing layer, makes cleanup explicit instead of requiring the caller to
+        invoke special cleanup methods before shutdown.
+
+        * chromium/public/WebContentLayer.h:
+        (WebContentLayer):
+        * chromium/public/WebExternalTextureLayer.h:
+        (WebExternalTextureLayer):
+        * chromium/public/WebIOSurfaceLayer.h:
+        (WebIOSurfaceLayer):
+        * chromium/public/WebImageLayer.h:
+        (WebImageLayer):
+        * chromium/public/WebLayer.h:
+        (WebKit):
+        (WebLayer):
+        (WebKit::WebLayer::~WebLayer):
+        * chromium/public/WebScrollableLayer.h: Removed.
+        * chromium/public/WebScrollbarLayer.h:
+        (WebScrollbarLayer):
+        * chromium/public/WebSolidColorLayer.h:
+        (WebKit):
+        (WebSolidColorLayer):
+        (WebKit::WebSolidColorLayer::~WebSolidColorLayer):
+        * chromium/public/WebVideoLayer.h:
+        (WebVideoLayer):
+
 2012-08-21  Benjamin Poulain  <bpoulain@apple.com>
 
         Store CString data in the CStringBuffer to avoid the double indirection
diff --git a/Source/Platform/chromium/public/WebContentLayer.h b/Source/Platform/chromium/public/WebContentLayer.h
index 7336bfabc..312107f9c 100644
--- a/Source/Platform/chromium/public/WebContentLayer.h
+++ b/Source/Platform/chromium/public/WebContentLayer.h
@@ -27,55 +27,37 @@
 #define WebContentLayer_h
 
 #include "WebCommon.h"
-#include "WebScrollableLayer.h"
-
-namespace WebCore {
-class ContentLayerChromium;
-}
 
 namespace WebKit {
 class WebContentLayerClient;
-class WebContentLayerImpl;
 
-class WebContentLayer : public WebScrollableLayer {
+class WebContentLayer {
 public:
-    WEBKIT_EXPORT static WebContentLayer create(WebContentLayerClient*);
+    // The client must outlive the WebContentLayer.
+    WEBKIT_EXPORT static WebContentLayer* create(WebContentLayerClient*);
 
-    WebContentLayer() { }
-    WebContentLayer(const WebContentLayer& layer) : WebScrollableLayer(layer) { }
     virtual ~WebContentLayer() { }
-    WebContentLayer& operator=(const WebContentLayer& layer)
-    {
-        WebLayer::assign(layer);
-        return *this;
-    }
 
-    // Called when the WebContentLayerClient is going away and should not be used.
-    WEBKIT_EXPORT void clearClient();
+    // The WebContentLayer has ownership of this wrapper.
+    virtual WebLayer* layer() = 0;
 
     // Set to true if the backside of this layer's contents should be visible when composited.
     // Defaults to false.
-    WEBKIT_EXPORT void setDoubleSided(bool);
+    virtual void setDoubleSided(bool) = 0;
 
     // Set to apply a scale factor used when painting and drawing this layer's content. Defaults to 1.0.
-    WEBKIT_EXPORT void setContentsScale(float);
+    virtual void setContentsScale(float) = 0;
 
     // Set to render text in this layer with LCD antialiasing. Only set if you know that this layer will be
     // drawn in a way where this makes sense - i.e. opaque background, not rotated or scaled, etc.
     // Defaults to false;
-    WEBKIT_EXPORT void setUseLCDText(bool);
+    virtual void setUseLCDText(bool) = 0;
 
     // Set to draw a system-defined checkerboard if the compositor would otherwise draw a tile in this layer
     // and the actual contents are unavailable. If false, the compositor will draw the layer's background color
     // for these tiles.
     // Defaults to false.
-    WEBKIT_EXPORT void setDrawCheckerboardForMissingTiles(bool);
-
-#if WEBKIT_IMPLEMENTATION
-    WebContentLayer(const WTF::PassRefPtr<WebCore::ContentLayerChromium>&);
-    WebContentLayer& operator=(const WTF::PassRefPtr<WebCore::ContentLayerChromium>&);
-    operator WTF::PassRefPtr<WebCore::ContentLayerChromium>() const;
-#endif
+    virtual void setDrawCheckerboardForMissingTiles(bool) = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebExternalTextureLayer.h b/Source/Platform/chromium/public/WebExternalTextureLayer.h
index b19c05f3e..92d2c4fee 100644
--- a/Source/Platform/chromium/public/WebExternalTextureLayer.h
+++ b/Source/Platform/chromium/public/WebExternalTextureLayer.h
@@ -30,10 +30,6 @@
 #include "WebFloatRect.h"
 #include "WebLayer.h"
 
-namespace WebCore {
-class TextureLayerChromium;
-}
-
 namespace WebKit {
 
 class WebExternalTextureLayerClient;
@@ -44,49 +40,43 @@ class WebExternalTextureLayerClient;
 // When in single-thread mode, this means during WebLayerTreeView::composite().
 // When using the threaded compositor, this can mean at an arbitrary time until
 // the WebLayerTreeView is destroyed.
-class WebExternalTextureLayer : public WebLayer {
+class WebExternalTextureLayer {
 public:
     // The owner of this layer may optionally provide a client. This client will
     // be called whenever the compositor wishes to produce a new frame and can
     // provide a new front buffer texture ID. This is useful if the client wants to
     // implement a double-buffering scheme that is synchronized with the compositor, for instance.
-    WEBKIT_EXPORT static WebExternalTextureLayer create(WebExternalTextureLayerClient* = 0);
-
-    // Indicates that the client for this layer is going away and shouldn't be used.
-    WEBKIT_EXPORT void clearClient();
+    // The client must outlive the WebExternalTextureLayer.
+    WEBKIT_EXPORT static WebExternalTextureLayer* create(WebExternalTextureLayerClient* = 0);
 
-    WebExternalTextureLayer() { }
     virtual ~WebExternalTextureLayer() { }
 
+    virtual WebLayer* layer() = 0;
+
     // Sets the texture id that represents the layer, in the namespace of the
     // compositor context.
-    WEBKIT_EXPORT void setTextureId(unsigned);
+    virtual void setTextureId(unsigned) = 0;
 
     // Sets whether or not the texture should be flipped in the Y direction when
     // rendered.
-    WEBKIT_EXPORT void setFlipped(bool);
+    virtual void setFlipped(bool) = 0;
 
     // Sets the rect in UV space of the texture that is mapped to the layer
     // bounds.
-    WEBKIT_EXPORT void setUVRect(const WebFloatRect&);
+    virtual void setUVRect(const WebFloatRect&) = 0;
 
     // Sets whether every pixel in this layer is opaque. Defaults to false.
-    WEBKIT_EXPORT void setOpaque(bool);
+    virtual void setOpaque(bool) = 0;
 
     // Sets whether this layer's texture has premultiplied alpha or not. Defaults to true.
-    WEBKIT_EXPORT void setPremultipliedAlpha(bool);
+    virtual void setPremultipliedAlpha(bool) = 0;
 
     // Indicates that the most recently provided texture ID is about to be modified externally.
-    WEBKIT_EXPORT void willModifyTexture();
+    virtual void willModifyTexture() = 0;
 
     // Sets whether this context should be rate limited by the compositor. Rate limiting works by blocking
     // invalidate() and invalidateRect() calls if the compositor is too many frames behind.
-    WEBKIT_EXPORT void setRateLimitContext(bool);
-
-private:
-#if WEBKIT_IMPLEMENTATION
-    explicit WebExternalTextureLayer(PassRefPtr<WebCore::TextureLayerChromium>);
-#endif
+    virtual void setRateLimitContext(bool) = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebIOSurfaceLayer.h b/Source/Platform/chromium/public/WebIOSurfaceLayer.h
index 37a4c6792..bcf14112a 100644
--- a/Source/Platform/chromium/public/WebIOSurfaceLayer.h
+++ b/Source/Platform/chromium/public/WebIOSurfaceLayer.h
@@ -30,27 +30,19 @@
 #include "WebLayer.h"
 #include "WebSize.h"
 
-namespace WebCore {
-class IOSurfaceLayerChromium;
-}
-
 namespace WebKit {
 
 // This class represents a layer that renders an externally managed IOSurface.
-class WebIOSurfaceLayer : public WebLayer {
+class WebIOSurfaceLayer {
 public:
-    WEBKIT_EXPORT static WebIOSurfaceLayer create();
+    WEBKIT_EXPORT static WebIOSurfaceLayer* create();
 
-    WebIOSurfaceLayer() { }
     virtual ~WebIOSurfaceLayer() { }
 
-    // Sets the IO surface id that represents this layer's contents.
-    WEBKIT_EXPORT void setIOSurfaceProperties(unsigned ioSurfaceId, WebSize);
+    virtual WebLayer* layer() = 0;
 
-private:
-#if WEBKIT_IMPLEMENTATION
-    explicit WebIOSurfaceLayer(PassRefPtr<WebCore::IOSurfaceLayerChromium>);
-#endif
+    // Sets the IO surface id that represents this layer's contents.
+    virtual void setIOSurfaceProperties(unsigned ioSurfaceId, WebSize) = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebImageLayer.h b/Source/Platform/chromium/public/WebImageLayer.h
index a916835f2..c7737f31a 100644
--- a/Source/Platform/chromium/public/WebImageLayer.h
+++ b/Source/Platform/chromium/public/WebImageLayer.h
@@ -30,24 +30,16 @@
 #include "WebCommon.h"
 #include "WebLayer.h"
 
-namespace WebCore {
-class ImageLayerChromium;
-}
-
 namespace WebKit {
 
-class WebImageLayer : public WebLayer {
+class WebImageLayer {
 public:
-    WEBKIT_EXPORT static WebImageLayer create();
+    WEBKIT_EXPORT static WebImageLayer* create();
 
-    WebImageLayer() { }
     virtual ~WebImageLayer() { }
 
-    WEBKIT_EXPORT void setBitmap(SkBitmap);
-
-#if WEBKIT_IMPLEMENTATION
-    explicit WebImageLayer(PassRefPtr<WebCore::ImageLayerChromium>);
-#endif
+    virtual WebLayer* layer() = 0;
+    virtual void setBitmap(SkBitmap) = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebLayer.h b/Source/Platform/chromium/public/WebLayer.h
index 6431f848c..60ed69423 100644
--- a/Source/Platform/chromium/public/WebLayer.h
+++ b/Source/Platform/chromium/public/WebLayer.h
@@ -29,12 +29,13 @@
 #include "WebAnimation.h"
 #include "WebColor.h"
 #include "WebCommon.h"
+#include "WebPoint.h"
 #include "WebPrivatePtr.h"
+#include "WebRect.h"
 #include "WebString.h"
 #include "WebVector.h"
 
 class SkMatrix44;
-namespace WebCore { class LayerChromium; }
 
 namespace WebKit {
 class WebAnimationDelegate;
@@ -44,73 +45,69 @@ struct WebFloatPoint;
 struct WebFloatRect;
 struct WebSize;
 
+class WebLayerImpl;
+
 class WebLayer {
 public:
-    WEBKIT_EXPORT static WebLayer create();
-
-    WebLayer() { }
-    WebLayer(const WebLayer& layer) { assign(layer); }
-    virtual ~WebLayer() { reset(); }
-    WebLayer& operator=(const WebLayer& layer)
-    {
-        assign(layer);
-        return *this;
-    }
-    bool isNull() const { return m_private.isNull(); }
-    WEBKIT_EXPORT void reset();
-    WEBKIT_EXPORT void assign(const WebLayer&);
-    WEBKIT_EXPORT bool equals(const WebLayer&) const;
+#define WEBLAYER_IS_PURE_VIRTUAL
+    WEBKIT_EXPORT static WebLayer* create();
+
+    virtual ~WebLayer() { }
+
+    // Returns a positive ID that will be unique across all WebLayers allocated in this process.
+    virtual int id() const = 0;
 
     // Sets a region of the layer as invalid, i.e. needs to update its content.
-    WEBKIT_EXPORT void invalidateRect(const WebFloatRect&);
+    virtual void invalidateRect(const WebFloatRect&) = 0;
 
     // Sets the entire layer as invalid, i.e. needs to update its content.
-    WEBKIT_EXPORT void invalidate();
+    virtual void invalidate() = 0;
 
-    WEBKIT_EXPORT void addChild(const WebLayer&);
-    WEBKIT_EXPORT void insertChild(const WebLayer&, size_t index);
-    WEBKIT_EXPORT void replaceChild(const WebLayer& reference, const WebLayer& newLayer);
-    WEBKIT_EXPORT void setChildren(const WebVector<WebLayer>&);
-    WEBKIT_EXPORT void removeFromParent();
-    WEBKIT_EXPORT void removeAllChildren();
+    // These functions do not take ownership of the WebLayer* parameter.
+    virtual void addChild(WebLayer*) = 0;
+    virtual void insertChild(WebLayer*, size_t index) = 0;
+    virtual void replaceChild(WebLayer* reference, WebLayer* newLayer) = 0;
+    virtual void setChildren(const WebVector<WebLayer*>&) = 0;
+    virtual void removeFromParent() = 0;
+    virtual void removeAllChildren() = 0;
 
-    WEBKIT_EXPORT void setAnchorPoint(const WebFloatPoint&);
-    WEBKIT_EXPORT WebFloatPoint anchorPoint() const;
+    virtual void setAnchorPoint(const WebFloatPoint&) = 0;
+    virtual WebFloatPoint anchorPoint() const = 0;
 
-    WEBKIT_EXPORT void setAnchorPointZ(float);
-    WEBKIT_EXPORT float anchorPointZ() const;
+    virtual void setAnchorPointZ(float) = 0;
+    virtual float anchorPointZ() const = 0;
 
-    WEBKIT_EXPORT void setBounds(const WebSize&);
-    WEBKIT_EXPORT WebSize bounds() const;
+    virtual void setBounds(const WebSize&) = 0;
+    virtual WebSize bounds() const = 0;
 
-    WEBKIT_EXPORT void setMasksToBounds(bool);
-    WEBKIT_EXPORT bool masksToBounds() const;
+    virtual void setMasksToBounds(bool) = 0;
+    virtual bool masksToBounds() const = 0;
 
-    WEBKIT_EXPORT void setMaskLayer(const WebLayer&);
-    WEBKIT_EXPORT void setReplicaLayer(const WebLayer&);
+    virtual void setMaskLayer(WebLayer*) = 0;
+    virtual void setReplicaLayer(WebLayer*) = 0;
 
-    WEBKIT_EXPORT void setOpacity(float);
-    WEBKIT_EXPORT float opacity() const;
+    virtual void setOpacity(float) = 0;
+    virtual float opacity() const = 0;
 
-    WEBKIT_EXPORT void setOpaque(bool);
-    WEBKIT_EXPORT bool opaque() const;
+    virtual void setOpaque(bool) = 0;
+    virtual bool opaque() const = 0;
 
-    WEBKIT_EXPORT void setPosition(const WebFloatPoint&);
-    WEBKIT_EXPORT WebFloatPoint position() const;
+    virtual void setPosition(const WebFloatPoint&) = 0;
+    virtual WebFloatPoint position() const = 0;
 
-    WEBKIT_EXPORT void setSublayerTransform(const SkMatrix44&);
-    WEBKIT_EXPORT void setSublayerTransform(const WebTransformationMatrix&);
-    WEBKIT_EXPORT SkMatrix44 sublayerTransform() const;
+    virtual void setSublayerTransform(const SkMatrix44&) = 0;
+    virtual void setSublayerTransform(const WebTransformationMatrix&) = 0;
+    virtual SkMatrix44 sublayerTransform() const = 0;
 
-    WEBKIT_EXPORT void setTransform(const SkMatrix44&);
-    WEBKIT_EXPORT void setTransform(const WebTransformationMatrix&);
-    WEBKIT_EXPORT SkMatrix44 transform() const;
+    virtual void setTransform(const SkMatrix44&) = 0;
+    virtual void setTransform(const WebTransformationMatrix&) = 0;
+    virtual SkMatrix44 transform() const = 0;
 
     // Sets whether the layer draws its content when compositing.
-    WEBKIT_EXPORT void setDrawsContent(bool);
-    WEBKIT_EXPORT bool drawsContent() const;
+    virtual void setDrawsContent(bool) = 0;
+    virtual bool drawsContent() const = 0;
 
-    WEBKIT_EXPORT void setPreserves3D(bool);
+    virtual void setPreserves3D(bool) = 0;
 
     // Mark that this layer should use its parent's transform and double-sided
     // properties in determining this layer's backface visibility instead of
@@ -119,105 +116,68 @@ public:
     // Note: This API is to work around issues with visibility the handling of
     // WebKit layers that have a contents layer (canvas, plugin, WebGL, video,
     // etc).
-    WEBKIT_EXPORT void setUseParentBackfaceVisibility(bool);
+    virtual void setUseParentBackfaceVisibility(bool) = 0;
 
-    WEBKIT_EXPORT void setBackgroundColor(WebColor);
+    virtual void setBackgroundColor(WebColor) = 0;
 
     // Clear the filters in use by passing in a newly instantiated
     // WebFilterOperations object.
-    WEBKIT_EXPORT void setFilters(const WebFilterOperations&);
+    virtual void setFilters(const WebFilterOperations&) = 0;
 
     // Apply filters to pixels that show through the background of this layer.
     // Note: These filters are only possible on layers that are drawn directly
     // to a root render surface with an opaque background. This means if an
     // ancestor of the background-filtered layer sets certain properties
     // (opacity, transforms), it may conflict and hide the background filters.
-    WEBKIT_EXPORT void setBackgroundFilters(const WebFilterOperations&);
+    virtual void setBackgroundFilters(const WebFilterOperations&) = 0;
 
-    WEBKIT_EXPORT void setDebugBorderColor(const WebColor&);
-    WEBKIT_EXPORT void setDebugBorderWidth(float);
-    WEBKIT_EXPORT void setDebugName(WebString);
+    virtual void setDebugBorderColor(const WebColor&) = 0;
+    virtual void setDebugBorderWidth(float) = 0;
+    virtual void setDebugName(WebString) = 0;
 
     // An animation delegate is notified when animations are started and
     // stopped. The WebLayer does not take ownership of the delegate, and it is
     // the responsibility of the client to reset the layer's delegate before
     // deleting the delegate.
-    WEBKIT_EXPORT void setAnimationDelegate(WebAnimationDelegate*);
+    virtual void setAnimationDelegate(WebAnimationDelegate*) = 0;
 
     // Returns false if the animation cannot be added.
-    WEBKIT_EXPORT bool addAnimation(WebAnimation*);
+    virtual bool addAnimation(WebAnimation*) = 0;
 
     // Removes all animations with the given id.
-    WEBKIT_EXPORT void removeAnimation(int animationId);
+    virtual void removeAnimation(int animationId) = 0;
 
     // Removes all animations with the given id targeting the given property.
-    WEBKIT_EXPORT void removeAnimation(int animationId, WebAnimation::TargetProperty);
+    virtual void removeAnimation(int animationId, WebAnimation::TargetProperty) = 0;
 
     // Pauses all animations with the given id.
-    WEBKIT_EXPORT void pauseAnimation(int animationId, double timeOffset);
+    virtual void pauseAnimation(int animationId, double timeOffset) = 0;
 
     // The following functions suspend and resume all animations. The given time
     // is assumed to use the same time base as monotonicallyIncreasingTime().
-    WEBKIT_EXPORT void suspendAnimations(double monotonicTime);
-    WEBKIT_EXPORT void resumeAnimations(double monotonicTime);
+    virtual void suspendAnimations(double monotonicTime) = 0;
+    virtual void resumeAnimations(double monotonicTime) = 0;
 
     // Returns true if this layer has any active animations - useful for tests.
-    WEBKIT_EXPORT bool hasActiveAnimation();
+    virtual bool hasActiveAnimation() = 0;
 
     // Transfers all animations running on the current layer.
-    WEBKIT_EXPORT void transferAnimationsTo(WebLayer*);
+    virtual void transferAnimationsTo(WebLayer*) = 0;
+
+    // Scrolling
+    virtual void setScrollPosition(WebPoint) = 0;
+    virtual void setScrollable(bool) = 0;
+    virtual void setHaveWheelEventHandlers(bool) = 0;
+    virtual void setShouldScrollOnMainThread(bool) = 0;
+    virtual void setNonFastScrollableRegion(const WebVector<WebRect>&) = 0;
+    virtual void setIsContainerForFixedPositionLayers(bool) = 0;
+    virtual void setFixedToContainerLayer(bool) = 0;
 
     // Forces this layer to use a render surface. There is no benefit in doing
     // so, but this is to facilitate benchmarks and tests.
-    WEBKIT_EXPORT void setForceRenderSurface(bool);
-
-    // Drops this layer's render surface, if it has one. Used to break cycles in some
-    // cases - if you aren't sure, you don't need to call this.
-    WEBKIT_EXPORT void clearRenderSurface();
-
-    template<typename T> T to()
-    {
-        T res;
-        res.WebLayer::assign(*this);
-        return res;
-    }
-
-    template<typename T> const T toConst() const
-    {
-        T res;
-        res.WebLayer::assign(*this);
-        return res;
-    }
-
-#if WEBKIT_IMPLEMENTATION
-    WebLayer(const WTF::PassRefPtr<WebCore::LayerChromium>&);
-    WebLayer& operator=(const WTF::PassRefPtr<WebCore::LayerChromium>&);
-    operator WTF::PassRefPtr<WebCore::LayerChromium>() const;
-    template<typename T> T* unwrap() const
-    {
-        return static_cast<T*>(m_private.get());
-    }
-
-    template<typename T> const T* constUnwrap() const
-    {
-        return static_cast<const T*>(m_private.get());
-    }
-#endif
-
-protected:
-    WebPrivatePtr<WebCore::LayerChromium> m_private;
+    virtual void setForceRenderSurface(bool) = 0;
 };
 
-inline bool operator==(const WebLayer& a, const WebLayer& b)
-{
-    return a.equals(b);
-}
-
-inline bool operator!=(const WebLayer& a, const WebLayer& b)
-{
-    return !(a == b);
-}
-
 } // namespace WebKit
 
 #endif // WebLayer_h
diff --git a/Source/Platform/chromium/public/WebScrollbarLayer.h b/Source/Platform/chromium/public/WebScrollbarLayer.h
index 1bfe7d6ab..451a0b9c1 100644
--- a/Source/Platform/chromium/public/WebScrollbarLayer.h
+++ b/Source/Platform/chromium/public/WebScrollbarLayer.h
@@ -32,29 +32,20 @@
 
 namespace WebCore {
 class Scrollbar;
-class ScrollbarLayerChromium;
 }
 
 namespace WebKit {
 
-class WebScrollbarLayer : public WebLayer {
+class WebScrollbarLayer {
 public:
-    WebScrollbarLayer() { }
-    WebScrollbarLayer(const WebScrollbarLayer& layer) : WebLayer(layer) { }
     virtual ~WebScrollbarLayer() { }
-    WebScrollbarLayer& operator=(const WebScrollbarLayer& layer)
-    {
-        WebLayer::assign(layer);
-        return *this;
-    }
 
-    WEBKIT_EXPORT void setScrollLayer(const WebLayer);
+    virtual WebLayer* layer() = 0;
+
+    virtual void setScrollLayer(WebLayer*) = 0;
 
 #if WEBKIT_IMPLEMENTATION
-    static WebScrollbarLayer create(WebCore::Scrollbar*, WebScrollbarThemePainter, PassOwnPtr<WebScrollbarThemeGeometry>);
-    explicit WebScrollbarLayer(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>&);
-    WebScrollbarLayer& operator=(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>&);
-    operator WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>() const;
+    WEBKIT_EXPORT static WebScrollbarLayer* create(WebCore::Scrollbar*, WebScrollbarThemePainter, PassOwnPtr<WebScrollbarThemeGeometry>);
 #endif
 };
 
diff --git a/Source/Platform/chromium/public/WebSolidColorLayer.h b/Source/Platform/chromium/public/WebSolidColorLayer.h
index ad9123d96..02e46f047 100644
--- a/Source/Platform/chromium/public/WebSolidColorLayer.h
+++ b/Source/Platform/chromium/public/WebSolidColorLayer.h
@@ -26,21 +26,20 @@
 #ifndef WebSolidColorLayer_h
 #define WebSolidColorLayer_h
 
+#include "WebColor.h"
 #include "WebCommon.h"
-#include "WebFloatRect.h"
-#include "WebLayer.h"
 
 namespace WebKit {
-class WebSolidColorLayerImpl;
+class WebLayer;
 
-class WebSolidColorLayer : public WebLayer {
+class WebSolidColorLayer {
 public:
-    WEBKIT_EXPORT static WebSolidColorLayer create();
-    WEBKIT_EXPORT void setBackgroundColor(const WebColor&);
+    WEBKIT_EXPORT static WebSolidColorLayer* create();
 
-#if WEBKIT_IMPLEMENTATION
-    WebSolidColorLayer(const WTF::PassRefPtr<WebSolidColorLayerImpl>&);
-#endif
+    virtual ~WebSolidColorLayer() { }
+
+    virtual WebLayer* layer() = 0;
+    virtual void setBackgroundColor(WebColor) = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebVideoLayer.h b/Source/Platform/chromium/public/WebVideoLayer.h
index 54da3454b..1acfff54a 100644
--- a/Source/Platform/chromium/public/WebVideoLayer.h
+++ b/Source/Platform/chromium/public/WebVideoLayer.h
@@ -29,27 +29,20 @@
 #include "WebCommon.h"
 #include "WebLayer.h"
 
-namespace WebCore {
-class VideoLayerChromium;
-}
-
 namespace WebKit {
 
 class WebVideoFrameProvider;
 
-class WebVideoLayer : public WebLayer {
+class WebVideoLayer {
 public:
-    WEBKIT_EXPORT static WebVideoLayer create(WebVideoFrameProvider*);
+    WEBKIT_EXPORT static WebVideoLayer* create(WebVideoFrameProvider*);
 
-    WebVideoLayer() { }
     virtual ~WebVideoLayer() { }
 
-    // Returns true if this layer is actively rendering (e.g. currently attached to a WebLayerTreeView).
-    WEBKIT_EXPORT bool active() const;
+    virtual WebLayer* layer() = 0;
 
-#if WEBKIT_IMPLEMENTATION
-    explicit WebVideoLayer(PassRefPtr<WebCore::VideoLayerChromium>);
-#endif
+    // Returns true if this layer is actively rendering (e.g. currently attached to a WebLayerTreeView).
+    virtual bool active() const = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index 0a9054705..56c76934e 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,3 +1,38 @@
+2012-08-22  Geoffrey Garen  <ggaren@apple.com>
+
+        ThreadRestrictionVerifier should be opt-in, not opt-out
+        https://bugs.webkit.org/show_bug.cgi?id=94761
+
+        Reviewed by Mark Hahnenberg.
+
+        WebKit's JavaScript engine supports use on multiple threads, so default-on
+        is not appropriate for most of our objects, and it causes lots of suprious
+        assertions.
+
+        * wtf/MetaAllocator.cpp:
+        (WTF::MetaAllocatorHandle::MetaAllocatorHandle): No need to turn off
+        explicitly, since it's off by default now.
+
+        * wtf/ThreadRestrictionVerifier.h:
+        (WTF::ThreadRestrictionVerifier::ThreadRestrictionVerifier): Turn off by default.
+
+        (WTF::ThreadRestrictionVerifier::setMutexMode):
+        (WTF::ThreadRestrictionVerifier::setDispatchQueueMode):
+        (WTF::ThreadRestrictionVerifier::turnOffVerification): These assertions
+        about state transitions were inconsistent with each other, and impossible
+        to maintain with default off, so I removed them.
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Optionally support smooth-scrolling on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=74926
+
+        Reviewed by Simon Hausmann.
+
+        Initialize GESTURE_ANIMATION feature flag.
+
+        * wtf/Platform.h:
+
 2012-08-21  Mark Hahnenberg  <mhahnenberg@apple.com>
 
         WTF Threading leaks kernel objects on platforms that use pthreads
diff --git a/Source/WTF/wtf/MetaAllocator.cpp b/Source/WTF/wtf/MetaAllocator.cpp
index 0a7a31e17..9efcff2eb 100644
--- a/Source/WTF/wtf/MetaAllocator.cpp
+++ b/Source/WTF/wtf/MetaAllocator.cpp
@@ -79,7 +79,6 @@ MetaAllocatorHandle::MetaAllocatorHandle(MetaAllocator* allocator, void* start,
     ASSERT(allocator);
     ASSERT(start);
     ASSERT(sizeInBytes);
-    turnOffVerifier();
 }
 
 MetaAllocatorHandle::~MetaAllocatorHandle()
diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
index b426816f4..d1383df29 100644
--- a/Source/WTF/wtf/Platform.h
+++ b/Source/WTF/wtf/Platform.h
@@ -826,6 +826,14 @@
 #endif
 #endif
 
+#if !defined(ENABLE_GESTURE_ANIMATION)
+#if PLATFORM(QT) || !ENABLE(SMOOTH_SCROLLING)
+#define ENABLE_GESTURE_ANIMATION 0
+#else
+#define ENABLE_GESTURE_ANIMATION 1
+#endif
+#endif
+
 #define ENABLE_DEBUG_WITH_BREAKPOINT 0
 #define ENABLE_SAMPLING_COUNTERS 0
 #define ENABLE_SAMPLING_FLAGS 0
diff --git a/Source/WTF/wtf/ThreadRestrictionVerifier.h b/Source/WTF/wtf/ThreadRestrictionVerifier.h
index 0eeac8e62..58bfbc410 100644
--- a/Source/WTF/wtf/ThreadRestrictionVerifier.h
+++ b/Source/WTF/wtf/ThreadRestrictionVerifier.h
@@ -50,7 +50,11 @@ namespace WTF {
 class ThreadRestrictionVerifier {
 public:
     ThreadRestrictionVerifier()
+#if USE(JSC)
+        : m_mode(NoVerificationMode)
+#else
         : m_mode(SingleThreadVerificationMode)
+#endif
         , m_shared(false)
         , m_owningThread(0)
         , m_mutex(0)
@@ -70,7 +74,6 @@ public:
 
     void setMutexMode(Mutex& mutex)
     {
-        ASSERT(m_mode == SingleThreadVerificationMode || (m_mode == MutexVerificationMode && &mutex == m_mutex));
         m_mode = MutexVerificationMode;
         m_mutex = &mutex;
     }
@@ -78,7 +81,6 @@ public:
 #if HAVE(DISPATCH_H)
     void setDispatchQueueMode(dispatch_queue_t queue)
     {
-        ASSERT(m_mode == SingleThreadVerificationMode);
         m_mode = SingleDispatchQueueVerificationMode;
         m_owningQueue = queue;
         dispatch_retain(m_owningQueue);
@@ -87,7 +89,6 @@ public:
 
     void turnOffVerification()
     {
-        ASSERT(m_mode == SingleThreadVerificationMode);
         m_mode = NoVerificationMode;
     }
 
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index a7ae94f61..a14c5bea5 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -222,7 +222,9 @@ SET(WebCore_IDL_FILES
     Modules/mediastream/NavigatorUserMediaErrorCallback.idl
     Modules/mediastream/NavigatorUserMediaSuccessCallback.idl
     Modules/mediastream/PeerConnection00.idl
+    Modules/mediastream/RTCIceCandidate.idl
     Modules/mediastream/RTCPeerConnection.idl
+    Modules/mediastream/RTCSessionDescription.idl
     Modules/mediastream/SessionDescription.idl
 
     Modules/networkinfo/NavigatorNetworkInfoConnection.idl
@@ -850,7 +852,9 @@ SET(WebCore_SOURCES
     Modules/mediastream/MediaStreamTrackList.cpp
     Modules/mediastream/NavigatorMediaStream.cpp
     Modules/mediastream/PeerConnection00.cpp
+    Modules/mediastream/RTCIceCandidate.cpp
     Modules/mediastream/RTCPeerConnection.cpp
+    Modules/mediastream/RTCSessionDescription.cpp
     Modules/mediastream/SessionDescription.cpp
     Modules/mediastream/UserMediaController.cpp
     Modules/mediastream/UserMediaRequest.cpp
@@ -1922,7 +1926,9 @@ SET(WebCore_SOURCES
     platform/mediastream/MediaHints.cpp
     platform/mediastream/MediaStreamCenter.cpp
     platform/mediastream/PeerConnection00Handler.cpp
+    platform/mediastream/RTCIceCandidateDescriptor.cpp
     platform/mediastream/RTCPeerConnectionHandler.cpp
+    platform/mediastream/RTCSessionDescriptionDescriptor.cpp
     platform/mediastream/SessionDescriptionDescriptor.cpp
 
     platform/mock/DeviceMotionClientMock.cpp
@@ -2027,6 +2033,7 @@ SET(WebCore_SOURCES
     rendering/RenderFlexibleBox.cpp
     rendering/RenderGrid.cpp
     rendering/RenderFlowThread.cpp
+    rendering/RenderFlowThreadContainer.cpp
     rendering/RenderFrame.cpp
     rendering/RenderFrameBase.cpp
     rendering/RenderFrameSet.cpp
@@ -2083,6 +2090,7 @@ SET(WebCore_SOURCES
     rendering/RenderTextControlMultiLine.cpp
     rendering/RenderTextControlSingleLine.cpp
     rendering/RenderTextFragment.cpp
+    rendering/RenderTextTrackCue.cpp
     rendering/RenderTheme.cpp
     rendering/RenderTreeAsText.cpp
     rendering/RenderVideo.cpp
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 62be85eb2..32cd892c8 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,2540 @@
+2012-08-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed trivial build fix for Qt/Mac on OS X 10.6: Avoid using an
+        enum value that clashes with an existing class name that's used in the
+        same file.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+        (JSC::Bindings::convertValueToQVariant):
+
+2012-08-22  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for WinCE after r126359.
+
+        * rendering/RenderThemeWinCE.cpp:
+
+2012-08-23  Dominic Cooney  <dominicc@chromium.org>
+
+        Unreviewed, rolling out r126391.
+        http://trac.webkit.org/changeset/126391
+        https://bugs.webkit.org/show_bug.cgi?id=94302
+
+        Breaks Chromium browser_tests AccessibilityFooter,
+        AccessibilityListMarkers, AccessibilityUI
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        * accessibility/AccessibilityNodeObject.h:
+        (AccessibilityNodeObject):
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+        (AccessibilityObject):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isDescendantOfElementType):
+        * accessibility/AccessibilityRenderObject.h:
+        (AccessibilityRenderObject):
+
+2012-08-23  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [WebGL] Allow collecting calls for Resource objects affecting their states
+        https://bugs.webkit.org/show_bug.cgi?id=94686
+
+        Reviewed by Pavel Feldman.
+
+        Allow collecting calls for WebGL Resource objects affecting their states.
+        Clone Call's mutable arguments before pushing it to the log.
+
+        * inspector/InjectedScriptWebGLModuleSource.js:
+        (.):
+
+2012-08-23  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] draw <video> on <canvas> does not work
+        https://bugs.webkit.org/show_bug.cgi?id=94791
+        PR #195866
+
+        Reviewed by George Staikos.
+
+        Re-implement MediaPlayerPrivate::paintCurrentFrameInContext() in the
+        blackberry port. This method is mainly called from <canvas>, and it
+        is supposed to paint video frames using software rendering path.
+
+        On the other hand, MediaPlayerPrivate::paint() will choose accelerated
+        rendering if possible.
+
+        media/video-canvas-alpha.html covers this.
+
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore):
+        (WebCore::MediaPlayerPrivate::paintCurrentFrameInContext):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h:
+        (MediaPlayerPrivate):
+
+2012-08-23  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Build fix for r126399.
+
+        * bindings/v8/ScriptInstance.cpp:
+
+2012-08-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: treat 0 cookies as "no cookies" and render it accordingly in the UI
+        https://bugs.webkit.org/show_bug.cgi?id=94732
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/RequestCookiesView.js:
+        (WebInspector.RequestCookiesView.prototype.get _gotCookies):
+
+2012-08-23  KwangYong Choi  <ky0.choi@samsung.com>
+
+        [EFL] Use vertical slider theme when the slider is vertical
+        https://bugs.webkit.org/show_bug.cgi?id=93838
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Applied vertical slider theme to the vertical sliders. The height
+        of the vertical slider is wrong when it's applied horizontal
+        slider theme.
+
+        And do not resize slider when its size is not specified. It's natural
+        to use the default value of renderer.
+
+        No new tests. It's covered by existing range and datalist tests.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::adjustSliderTrackStyle):
+
+2012-08-23  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove almost all #include "V8Proxy.h"
+        https://bugs.webkit.org/show_bug.cgi?id=94777
+
+        Reviewed by Adam Barth.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/NPV8Object.cpp:
+        * bindings/v8/PageScriptDebugServer.cpp:
+        * bindings/v8/ScheduledAction.cpp:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptInstance.cpp:
+        * bindings/v8/ScriptObject.cpp:
+        * bindings/v8/ScriptRunner.cpp:
+        * bindings/v8/SerializedScriptValue.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8BindingMacros.h:
+        (WebCore):
+        * bindings/v8/V8Collection.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8EventListener.cpp:
+        * bindings/v8/V8GCController.cpp:
+        * bindings/v8/V8LazyEventListener.cpp:
+        * bindings/v8/V8NPObject.cpp:
+        * bindings/v8/V8NPUtils.cpp:
+        * bindings/v8/V8Proxy.h:
+        (WebCore):
+        * bindings/v8/V8Utilities.cpp:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/WorkerScriptController.cpp:
+        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        * bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp:
+        * bindings/v8/custom/V8AudioContextCustom.cpp:
+        * bindings/v8/custom/V8BlobCustom.cpp:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        * bindings/v8/custom/V8CoordinatesCustom.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8DeviceMotionEventCustom.cpp:
+        * bindings/v8/custom/V8DeviceOrientationEventCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        * bindings/v8/custom/V8EntryCustom.cpp:
+        * bindings/v8/custom/V8EntrySyncCustom.cpp:
+        * bindings/v8/custom/V8EventCustom.cpp:
+        * bindings/v8/custom/V8HTMLAllCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLLinkElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLMediaElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLOutputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        * bindings/v8/custom/V8HistoryCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InspectorFrontendHostCustom.cpp:
+        * bindings/v8/custom/V8IntentConstructor.cpp:
+        * bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
+        * bindings/v8/custom/V8MutationObserverCustom.cpp:
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        * bindings/v8/custom/V8NotificationCustom.cpp:
+        * bindings/v8/custom/V8PopStateEventCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
+        * bindings/v8/custom/V8SVGDocumentCustom.cpp:
+        * bindings/v8/custom/V8ScriptProfileCustom.cpp:
+        * bindings/v8/custom/V8ScriptProfileNodeCustom.cpp:
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        * bindings/v8/custom/V8TrackEventCustom.cpp:
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        * bindings/v8/custom/V8WebKitAnimationCustom.cpp:
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r126348.
+        http://trac.webkit.org/changeset/126348
+        https://bugs.webkit.org/show_bug.cgi?id=94588
+
+        We should use v8::String::NewSymbol() for symbols. See
+        https://bugs.webkit.org/show_bug.cgi?id=94574#c10 for more
+        details
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (GenerateNormalAttrSetter):
+        (GenerateNamedConstructorCallback):
+        (GenerateNonStandardFunction):
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::ConfigureV8Float64ArrayTemplate):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::ConfigureV8TestEventTargetTemplate):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::ConfigureV8TestInterfaceTemplate):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructor::GetTemplate):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::ConfigureV8TestObjTemplate):
+        (WebCore::V8TestObj::installPerContextProperties):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrSetter):
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove V8Proxy from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=94773
+
+        Reviewed by Adam Barth.
+
+        To kill V8Proxy, we can remove V8Proxy uses from CodeGeneratorV8.pm.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::wrapSlow):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::V8TestCustomNamedGetter::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::V8TestEventTarget::wrapSlow):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore::V8TestException::wrapSlow):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::wrapSlow):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
+
+2012-08-22  Sukolsak Sakshuwong  <sukolsak@google.com>
+
+        Implement UndoManager's item() method
+        https://bugs.webkit.org/show_bug.cgi?id=94671
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch implements UndoManager's item() method and its V8 custom binding.
+        We need to use custom binding here because we need to return user objects
+        that are stored in a hidden property of DOMTransaction wrappers, not returning
+        the wrappers themselves.
+
+        Test: editing/undomanager/undomanager-item.html
+
+        * bindings/js/JSUndoManagerCustom.cpp:
+        (WebCore::JSUndoManager::item):
+        (WebCore):
+        * bindings/v8/DOMTransaction.cpp:
+        (WebCore::DOMTransaction::data):
+        (WebCore):
+        (WebCore::DOMTransaction::setData):
+        (WebCore::DOMTransaction::getFunction):
+        * bindings/v8/DOMTransaction.h:
+        * bindings/v8/custom/V8UndoManagerCustom.cpp:
+        (WebCore::V8UndoManager::transactCallback):
+        (WebCore::V8UndoManager::itemCallback):
+        (WebCore):
+        * editing/UndoManager.cpp:
+        (WebCore::UndoManager::item):
+        (WebCore):
+        * editing/UndoManager.h:
+        (UndoManager):
+        * editing/UndoManager.idl:
+
+2012-08-22  Dominic Mazzoni  <dmazzoni@google.com>
+
+        AX: Focusable elements without a role should not be ignored
+        https://bugs.webkit.org/show_bug.cgi?id=94302
+
+        Reviewed by Chris Fleizach.
+
+        Changes the accessibility logic so that a generic element that's focusable is
+        not ignored for accessibility, and returns its inner text as its title. That way
+        if you Tab to the element, a reasonable accessibility notification is generated.
+
+        One exception is the body element, because focusing the body is equivalent to
+        blurring the current focused element and does not result in a "focus" accessibility
+        notification.
+
+        Also fixes logic that determined if an element was contentEditable by making
+        sure it catches the case with no attribute value (e.g. <div contentEditable>),
+        which also implies contentEditable=true according to the spec.
+
+        Test: accessibility/focusable-div.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore):
+        (WebCore::nodeHasContentEditableAttributeSet):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r126383.
+        http://trac.webkit.org/changeset/126383
+        https://bugs.webkit.org/show_bug.cgi?id=82888
+
+        Chromium win build crash
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::V8Clipboard::typesAccessorGetter):
+        * dom/Clipboard.h:
+        (Clipboard):
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h:
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::types):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move m_isolatedWorlds and m_isolatedWorldSecurityOrigins from V8Proxy to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=94770
+
+        Reviewed by Adam Barth.
+
+        Now m_isolatedWorlds and m_isolatedWorldSecurityOrigins of V8Proxy
+        are used by ScriptController only. We can move them to ScriptController.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::resetIsolatedWorlds):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        (WebCore::ScriptController::setIsolatedWorldSecurityOrigin):
+        (WebCore::ScriptController::collectIsolatedContexts):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move evaluate() from V8Proxy to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=94768
+
+        Reviewed by Adam Barth.
+
+        To kill V8Proxy, we can move evaluate() from V8Proxy to ScriptController.
+
+        - Renamed evaluate() to compileAndRunScript() to avoid name conflict
+        with existing ScriptController::evaluate().
+
+        - Removed toV8Proxy() from NPV8Object, as it is no longer used.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::compileAndRunScript):
+        (WebCore):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+
+2012-08-22  Vineet Chaudhary  <rgf748@motorola.com>
+
+        Consider replacing return type of Clipboard::types() from HashSet<String> to Vector<String>.
+        https://bugs.webkit.org/show_bug.cgi?id=82888
+
+        Reviewed by Kentaro Hara.
+
+        As part of removing custom bindings of types Array Clipboard::types() needs to return
+        Vector<String> than HashSet<String>
+
+        No new tests. Exixting test should pass with this change as no behavoural changes.
+
+        * bindings/js/JSClipboardCustom.cpp: Replace data type from HashSet<> to Vector<>.
+        (WebCore::JSClipboard::types):
+        * bindings/v8/custom/V8ClipboardCustom.cpp: Ditto.
+        (WebCore::V8Clipboard::typesAccessorGetter):
+        * dom/Clipboard.h: Ditto.
+        (Clipboard):
+        * platform/blackberry/ClipboardBlackBerry.cpp: Ditto.
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h: Ditto.
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp: Ditto.
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h: Ditto.
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp: Ditto.
+        (WebCore::ClipboardChromium::types):
+        * platform/chromium/ClipboardChromium.h: Ditto.
+        (ClipboardChromium):
+        * platform/efl/ClipboardEfl.cpp: Ditto.
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h: Ditto.
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp: Ditto.
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h: Ditto.
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h: Ditto.
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm: Ditto.
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp: Ditto.
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h: Ditto.
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp: Ditto.
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h: Ditto.
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp: Ditto.
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h: Ditto.
+        (ClipboardWx):
+
+2012-08-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Change WebLayer from a concrete type to a pure virtual interface
+        https://bugs.webkit.org/show_bug.cgi?id=94174
+
+        Reviewed by Adrienne Walker.
+
+        This updates WebCore code for the WebLayer interface changes. Classes that have ownership of specific layer
+        types (such as DrawingBufferChromium, Canvas2DLayerBridge and ScrollingCoordinatorChromium) hold ownership
+        of a specific type and a pointer to the WebLayer to GraphicsLayerChromium to be included in the final layer
+        tree. GraphicsLayerChromium holds a WebContentLayer and (optionally) a WebImageLayer and WebLayer (for
+        m_transformLayer) and assembles the final layer tree.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinatorPrivate::ScrollingCoordinatorPrivate):
+        (ScrollingCoordinatorPrivate):
+        (WebCore::ScrollingCoordinatorPrivate::setScrollLayer):
+        (WebCore::ScrollingCoordinatorPrivate::setHorizontalScrollbarLayer):
+        (WebCore::ScrollingCoordinatorPrivate::setVerticalScrollbarLayer):
+        (WebCore::ScrollingCoordinatorPrivate::scrollLayer):
+        (WebCore::scrollableLayerForGraphicsLayer):
+        (WebCore):
+        (WebCore::createScrollbarLayer):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::setScrollLayer):
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setWheelEventHandlerCount):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+        (WebCore::ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers):
+        (WebCore::ScrollingCoordinator::setLayerIsFixedToContainerLayer):
+        * platform/graphics/chromium/Canvas2DLayerBridge.cpp:
+        (WebCore::Canvas2DLayerBridge::Canvas2DLayerBridge):
+        (WebCore::Canvas2DLayerBridge::~Canvas2DLayerBridge):
+        (WebCore::Canvas2DLayerBridge::prepareForDraw):
+        (WebCore::Canvas2DLayerBridge::layer):
+        (WebCore::Canvas2DLayerBridge::contextAcquired):
+        * platform/graphics/chromium/Canvas2DLayerBridge.h:
+        (Canvas2DLayerBridge):
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBufferPrivate::DrawingBufferPrivate):
+        (WebCore::DrawingBufferPrivate::~DrawingBufferPrivate):
+        (WebCore::DrawingBufferPrivate::layer):
+        (DrawingBufferPrivate):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::~GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::willBeDestroyed):
+        (WebCore::GraphicsLayerChromium::updateNames):
+        (WebCore::GraphicsLayerChromium::removeFromParent):
+        (WebCore::GraphicsLayerChromium::setSize):
+        (WebCore::GraphicsLayerChromium::clearBackgroundColor):
+        (WebCore::GraphicsLayerChromium::setContentsOpaque):
+        (WebCore::GraphicsLayerChromium::setFilters):
+        (WebCore::GraphicsLayerChromium::setBackgroundFilters):
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        (WebCore::GraphicsLayerChromium::setBackfaceVisibility):
+        (WebCore::GraphicsLayerChromium::setOpacity):
+        (WebCore::GraphicsLayerChromium::setReplicatedByLayer):
+        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerChromium::setContentsToImage):
+        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
+        (WebCore):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+        (WebCore::GraphicsLayerChromium::setContentsTo):
+        (WebCore::GraphicsLayerChromium::addAnimation):
+        (WebCore::GraphicsLayerChromium::pauseAnimation):
+        (WebCore::GraphicsLayerChromium::removeAnimation):
+        (WebCore::GraphicsLayerChromium::suspendAnimations):
+        (WebCore::GraphicsLayerChromium::resumeAnimations):
+        (WebCore::GraphicsLayerChromium::platformLayer):
+        (WebCore::GraphicsLayerChromium::setDebugBackgroundColor):
+        (WebCore::GraphicsLayerChromium::setDebugBorder):
+        (WebCore::GraphicsLayerChromium::updateChildList):
+        (WebCore::GraphicsLayerChromium::updateLayerPosition):
+        (WebCore::GraphicsLayerChromium::updateLayerSize):
+        (WebCore::GraphicsLayerChromium::updateAnchorPoint):
+        (WebCore::GraphicsLayerChromium::updateTransform):
+        (WebCore::GraphicsLayerChromium::updateChildrenTransform):
+        (WebCore::GraphicsLayerChromium::updateMasksToBounds):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
+        (WebCore::GraphicsLayerChromium::updateLayerBackgroundColor):
+        (WebCore::GraphicsLayerChromium::updateContentsRect):
+        (WebCore::GraphicsLayerChromium::updateContentsScale):
+        (WebCore::GraphicsLayerChromium::setupContentsLayer):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::hasContentsLayer):
+        (WebCore::GraphicsLayerChromium::contentLayer):
+        (WebCore::GraphicsLayerChromium::contentsLayer):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::rootLayer):
+        * platform/graphics/chromium/LayerChromium.h:
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move runScript() from V8Proxy to ScriptRunner
+        https://bugs.webkit.org/show_bug.cgi?id=94706
+
+        Reviewed by Adam Barth.
+
+        To kill V8Proxy, we can move runScript() from V8Proxy to ScriptRunner.
+
+        - ScriptRunner::runScript() should be a static method.
+        It should receive ScriptExecutionContext on which the script is evaluated.
+
+        - After this patch is landed, I'll remove WorkerContextExecutionContext::runScript()
+        and ScriptDebugServer::runScript().
+
+        No tests. No change in behavior.
+
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * bindings/v8/ScriptController.cpp:
+        * bindings/v8/ScriptRunner.cpp: Added.
+        (WebCore):
+        (WebCore::ScriptRunner::runScript):
+        * bindings/v8/ScriptRunner.h: Added.
+        (WebCore):
+        (ScriptRunner):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::handleMaxRecursionDepthExceeded):
+        (WebCore):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-22  Adam Barth  <abarth@webkit.org>
+
+        [V8] OwnHandle doesn't need to support weak handles
+        https://bugs.webkit.org/show_bug.cgi?id=94760
+
+        Reviewed by Kentaro Hara.
+
+        No code uses makeWeak(). We can drop support for it and simplify this
+        class.
+
+        * bindings/v8/OwnHandle.h:
+        (WebCore):
+        (OwnHandle):
+        (WebCore::OwnHandle::OwnHandle):
+        (WebCore::OwnHandle::~OwnHandle):
+        (WebCore::OwnHandle::get):
+        (WebCore::OwnHandle::set):
+        (WebCore::OwnHandle::clear):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove V8Proxy from getXPathNSResolver()
+        https://bugs.webkit.org/show_bug.cgi?id=94715
+
+        Reviewed by Adam Barth.
+
+        - The V8Proxy* argument of getXPathNSResolver(..., V8Proxy* = 0) is not used.
+          We can remove it.
+
+        - We can rename getXPathNSResolver() to toXPathNSResolver().
+
+        - We can move toXPathNSResolver() from V8DOMWrapper to V8Binding,
+          since other toXXX() methods are written in V8Binding.
+
+        - Change the return value of toXPathNSResolver() from RefPtr to PassRefPtr.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (JSValueToNative):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toXPathNSResolver):
+        (WebCore):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        * bindings/v8/V8DOMWrapper.cpp:
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::V8Document::evaluateCallback):
+
+2012-08-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r126325.
+        http://trac.webkit.org/changeset/126325
+        https://bugs.webkit.org/show_bug.cgi?id=94644
+
+        Caused subtle but reproducible failure to call onload handler
+        properly in an SVG layout test in Chromium Mac Debug builds,
+        indicating potentially larger problem
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::beginLoadTimerFired):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::decrementRequestCount):
+
+2012-08-22  Victor Carbune  <victor@rosedu.org>
+
+        Display a TextTrackCue when snap-to-lines flag is set
+        https://bugs.webkit.org/show_bug.cgi?id=79751
+
+        Reviewed by Tony Chang.
+
+        This patch implements rendering functionality for a given text track,
+        following closer the exact WebVTT specification. There are two new classes
+        which have been added in order to succesfully cover rendering when of a text
+        track cue.
+
+        RenderTextTrackCue handles the specific rendering algorithm required,
+        by checking for overlaps with other boxes that are in the same
+        container (these can be any other boxes, not necessarily other cues,
+        the video controls, for example).
+
+        TextTrackCueBox extends HTMLDivElement and is an intermediate layer
+        between the renderer class and the actual cue object. Its purpose is
+        to instantiate the particular renderer and cover all the default CSS
+        styling that needs to be applied to the cue.
+
+        The layout is done in two steps:
+          - Step 1: Layout the TextTrackCue with default CSS properties set (this is
+        the TextTrackCueBox decorated with the respective CSS elements)
+          - Step 2: RenderTextTrackCue adjusts the box position depending on the
+        parameters of the TextTrackCue object and the overlaps that may occur with
+        previously positioned cues.
+
+        Tests: media/track/track-cue-rendering-horizontal.html
+               media/track/track-cue-rendering-vertical.html
+
+        * CMakeLists.txt: Updated to include RenderTextTrackCue.
+        * GNUmakefile.list.am: Updated to include RenderTextTrackCue.
+        * Target.pri: Updated to include RenderTextTrackCue.
+        * WebCore.gypi: Updated to include RenderTextTrackCue.
+        * WebCore.vcproj/WebCore.vcproj: Updated to include RenderTextTrackCue.
+        * WebCore.xcodeproj/project.pbxproj: Updated to include RenderTextTrackCue.
+        * css/mediaControls.css: Removed unreliable CSS.
+        (video::-webkit-media-text-track-display): Removed properties.
+        * html/shadow/MediaControlElements.cpp: Updated to not use the new class.
+        (RenderTextTrackContainerElement):
+        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Simplified
+        the function by moving the check if track is rendered in TextTrack and used
+        the TextTrackCueBox for cues.
+        * html/track/TextTrack.cpp: Added a new method.
+        (WebCore::TextTrack::isRendered): Method that returns whether the track should
+        be rendered or not.
+        (WebCore):
+        * html/track/TextTrack.h: Added the isRendered method.
+        (TextTrack):
+        * html/track/TextTrackCue.cpp: Added several helper methods and
+        the TextTrackCueBox.
+        (WebCore):
+        (WebCore::TextTrackCueBox::TextTrackCueBox): The TextTrackCueBox extends
+        the HTMLDivElement and represents a bridge class between RenderTextTrackCue
+        and TextTrackCue. This is required as the layout is done in two steps, as
+        explained on top of the ChangeLog entry.
+        (WebCore::TextTrackCueBox::getCue): Returns the associated TextTrackCue object.
+        (WebCore::TextTrackCueBox::applyCSSProperties): Applies a part of the default CSS
+        properties, as defined by section 3.5.1 of the WebVTT specification.
+        (WebCore::TextTrackCueBox::shadowPseudoId): Moved the shadow pseudo id.
+        (WebCore::TextTrackCueBox::createRenderer): Creates the particular renderer.
+        (WebCore::TextTrackCue::TextTrackCue): Corrected the internal writing mode map.
+        (WebCore::TextTrackCue::calculateComputedLinePosition): Updated the compute line
+        position algorithm. This requires, however, a method to consider only rendered
+        tracks (and therefore will be addressed completely in subsequent changeset).
+        (WebCore::TextTrackCue::calculateDisplayParameters): Updated and corrected the
+        computed display parameters to match the current specification.
+        (WebCore::TextTrackCue::getDisplayTree): Update to use the TextTrackCueBox class
+        and moved CSS application to the respective class.
+        (WebCore::TextTrackCue::getPositionCoordinates): Added comment to specify in which
+        situation this method is used and change visibility to private.
+        (WebCore::TextTrackCue::getCSSWritingMode): Returns the CSS writing mode corresponding
+        to the cue writing mode.
+        (WebCore::TextTrackCue::getCSSSize): Returns the cue width / height (depending on the
+        writing direction.
+        (WebCore::TextTrackCue::getCSSPosition): Returns the default display position, that is
+        used in the first layout step.
+        * html/track/TextTrackCue.h:
+        (WebCore):
+        (TextTrackCueBox):
+        (WebCore::TextTrackCueBox::create): Initialization method.
+        (TextTrackCue):
+        (WebCore::TextTrackCue::getWritingDirection): Helper method to return the internal
+        values used to represent the writing direction.
+        * rendering/RenderTextTrackCue.cpp: Added.
+        (WebCore):
+        (WebCore::RenderTextTrackCue::RenderTextTrackCue):
+        (WebCore::RenderTextTrackCue::layout): The rendering steps, as mentioned in
+        the WebVTT rendering rules. Currently, this treats only the snap-to-lines set
+        case. It is implemented following closely the spec, and might be subject to
+        change as discussions on various bugs evolve.
+        (WebCore::RenderTextTrackCue::initializeLayoutParameters): Steps 1 - 7.
+        (WebCore::RenderTextTrackCue::placeBoxInDefaultPosition): Steps 8 - 10.
+        (WebCore::RenderTextTrackCue::isOutside): Inline method to check if the cue is outside.
+        (WebCore::RenderTextTrackCue::isOverlapping): Inline method to check if the cue overlaps other boxes.
+        (WebCore::RenderTextTrackCue::shouldSwitchDirection): Step 12.
+        (WebCore::RenderTextTrackCue::moveBoxesByStep): Step 13.
+        (WebCore::RenderTextTrackCue::switchDirection): Steps 15 - 18.
+        (WebCore::RenderTextTrackCue::repositionCueSnapToLinesSet): Cue repositioning
+        for text track cue when the snap to lines flag is set.
+        (WebCore::RenderTextTrackCue::repositionCueSnapToLinesNotSet): Cue repositioning
+        for text track cue when the snap to lines flag is not set. Not implemented yet.
+        * rendering/RenderTextTrackCue.h: Added.
+        (WebCore):
+        (RenderTextTrackCue): Rendering class, handling the display of cues.
+
+2012-08-21  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move matchesCurrentContext() from V8Proxy to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=94596
+
+        Reviewed by Adam Barth.
+
+        To kill V8Proxy:
+
+        - We can move matchesCurrentContext() from V8Proxy to ScriptController.
+        - We can remove V8Proxy::isolatedWorldContext() since it is not used by anybody.
+        - We can remove V8Proxy::finishedWithEvent() since it is empty.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::finishedWithEvent):
+        (WebCore::ScriptController::matchesCurrentContext):
+        (WebCore):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-22  Alejandro Piñeiro  <apinheiro@igalia.com>
+
+        [Gtk] Dojo toggle buttons should expose ROLE_TOGGLE_BUTTON not ROLE_PUSH_BUTTON
+        https://bugs.webkit.org/show_bug.cgi?id=73819
+
+        Reviewed by Chris Fleizach.
+
+        Added a new role, Toggle Button, based on whether aria-pressed is present.
+        http://www.w3.org/TR/wai-aria/states_and_properties#aria-pressed
+
+        Test: platform/gtk/accessibility/aria-toggle-button-role.html
+
+        * accessibility/AccessibilityNodeObject.cpp:
+        (WebCore::AccessibilityNodeObject::determineAccessibilityRole): using buttonRoleType
+        to classify a button-related role.
+        (WebCore::AccessibilityNodeObject::determineAriaRoleAttribute): using buttonRoleType
+        to classify a button-related role.
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::ariaPressedIsPresent): checks if aria-pressed
+        attribute is present.
+        (WebCore::AccessibilityObject::buttonRoleType): returns a specific button-related
+        role if the object is a button-related role.
+        * accessibility/AccessibilityObject.h:
+        (AccessibilityObject): added new role ToggleButtonRole.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): using buttonRoleType
+        to classify a button-related role.
+        * accessibility/gtk/WebKitAccessibleWrapperAtk.cpp:
+        (atkRole): added a mapping between ToggleButtonRole and
+        ATK_ROLE_TOGGLE_BUTTON.
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (createAccessibilityRoleMap): added a mapping between
+        ToggleButtonRole and NSAccessibilityButtonRole
+
+2012-08-22  David Grogan  <dgrogan@chromium.org>
+
+        IndexedDB: revert int version when version change transaction aborts
+        https://bugs.webkit.org/show_bug.cgi?id=94662
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/intversion-revert-on-abort.html
+
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::runIntVersionChangeTransaction):
+        (WebCore::IDBDatabaseBackendImpl::resetIntVersion):
+        One-liner modeled after resetVersion.
+
+        (WebCore):
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h:
+        (IDBDatabaseBackendImpl):
+
+2012-08-17  Jeffrey Pfau  <jpfau@apple.com>
+
+        Allow blocking of Web SQL databases in third-party web workers
+        https://bugs.webkit.org/show_bug.cgi?id=94170
+
+        Reviewed by Adam Barth.
+
+        Web workers did not previously know anything about the document that
+        spawned them. This is undefined for shared workers, but for dedicated
+        workers, we now pipe the information through.
+
+        Tests: http/tests/security/cross-origin-worker-websql-allowed.html
+               http/tests/security/cross-origin-worker-websql.html
+
+        * Modules/webdatabase/WorkerContextWebDatabase.cpp: Pass information about the top origin to canAccessDatabase
+        (WebCore::WorkerContextWebDatabase::openDatabase):
+        (WebCore::WorkerContextWebDatabase::openDatabaseSync):
+        * WebCore.exp.in: Make SecurityOrigin::isolatedCopy const
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::isolatedCopy):
+        (WebCore::SecurityOrigin::canAccessStorage):
+        * page/SecurityOrigin.h:
+        * workers/DedicatedWorkerContext.cpp: Pass topOrigin
+        (WebCore::DedicatedWorkerContext::create):
+        (WebCore::DedicatedWorkerContext::DedicatedWorkerContext):
+        * workers/DedicatedWorkerContext.h:
+        (DedicatedWorkerContext):
+        * workers/DedicatedWorkerThread.cpp: Pass topOrigin
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        (WebCore::DedicatedWorkerThread::createWorkerContext):
+        * workers/DedicatedWorkerThread.h:
+        (DedicatedWorkerThread):
+        * workers/SharedWorkerContext.cpp: Pass topOrigin
+        (WebCore::SharedWorkerContext::SharedWorkerContext):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        (WebCore::SharedWorkerThread::createWorkerContext):
+        * workers/SharedWorkerThread.h:
+        (SharedWorkerThread): Pass topOrigin
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::topOrigin):
+        (WorkerContext):
+        * workers/WorkerMessagingProxy.cpp: Pass topOrigin
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WorkerThreadStartupData):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move context() from V8Proxy to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=94593
+
+        Reviewed by Adam Barth.
+
+        - This patch removes V8Proxy::context(Frame*).
+        - This patch moves V8Proxy::context() to ScriptController::context().
+        - This patch renames ScriptController::context() to ScriptController::currentWorldContext(),
+        for naming consistency with ScriptController::maintWorldContext().
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::context):
+        (WebCore):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::setNamedHiddenWindowReference):
+        * bindings/v8/V8Proxy.cpp:
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        (WebCore::V8DOMWindow::eventAccessorGetter):
+        (WebCore::V8DOMWindow::eventAccessorSetter):
+        (WebCore::DialogHandler::dialogCreated):
+        (WebCore::toV8):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::openCallback):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Remove V8Proxy from V8DOMWrapper::instantiateV8Object()
+        https://bugs.webkit.org/show_bug.cgi?id=94713
+
+        Reviewed by Adam Barth.
+
+        To kill V8Proxy, V8DOMWrapper::instantiateV8Object() should receive Frame*
+        instead of V8Proxy*.
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::wrapSlow):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::V8TestCustomNamedGetter::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::V8TestEventTarget::wrapSlow):
+        * bindings/scripts/test/V8/V8TestException.cpp:
+        (WebCore::V8TestException::wrapSlow):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNode.cpp:
+        (WebCore::V8TestNode::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::wrapSlow):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore):
+        (WebCore::V8DOMWrapper::instantiateV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        (V8DOMWrapper):
+
+2012-08-22  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBRequest can be destructed during abort
+        https://bugs.webkit.org/show_bug.cgi?id=94618
+
+        Reviewed by Tony Chang.
+
+        If there are no script references, an IDBRequest could be kept alive
+        only by enqueued events. On document destruction, the parent transaction
+        is aborted, which aborts the request. During the abort, the enqueued events
+        are deleted, releasing the last reference to the IDBRequest which then
+        destructs in mid-method call and an "unfinished" state, hitting an assert.
+
+        This patch keeps the IDBRequest alive through the completion of the abort()
+        method, which will enqueue another event. In the document destruction case,
+        this will end up with the IDBRequest having stop() called on it which will
+        send the IDBRequest into EarlyDeath state, satisfying the destructor assert.
+
+        Addresses existing layout tests that behave flakily in Chromium port.
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::abort):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move precompileScript() from V8Proxy to ScriptSourceCode
+        https://bugs.webkit.org/show_bug.cgi?id=94701
+
+        Reviewed by Adam Barth.
+
+        To kill V8Proxy, we can move precompileScript() from V8Proxy
+        to ScriptSourceCode.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/ScriptSourceCode.cpp:
+        (WebCore::ScriptSourceCode::precompileScript):
+        (WebCore):
+        * bindings/v8/ScriptSourceCode.h:
+        (ScriptSourceCode):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        * bindings/v8/V8Proxy.h:
+        (V8Proxy):
+
+2012-08-22  Nikhil Bhargava  <nbhargava@google.com>
+
+        Reduce Font.h includes across project -- improves RenderObject.h compile time
+        https://bugs.webkit.org/show_bug.cgi?id=93629
+
+        Reviewed by Eric Seidel.
+
+        RenderStyle.h no longer depends on Font.h. The files that transitively
+        need to be updated with proper includes are fixed.
+
+        No new tests. Functionality should remain the same.
+
+        * accessibility/gtk/WebKitAccessibleInterfaceText.cpp:
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        * bindings/objc/DOM.mm:
+        * css/CSSComputedStyleDeclaration.cpp:
+        * css/CSSPrimitiveValue.cpp:
+        * css/StyleResolver.h:
+        * dom/CharacterData.cpp:
+        * dom/ElementRareData.h:
+        * dom/NodeRenderingContext.cpp:
+        * dom/Text.cpp:
+        * editing/TextIterator.cpp:
+        * editing/mac/EditorMac.mm:
+        * html/HTMLTitleElement.cpp:
+        * html/shadow/TextControlInnerElements.cpp:
+        * inspector/InspectorOverlay.cpp:
+        * page/ContextMenuController.cpp:
+        * page/PrintContext.cpp:
+        * platform/efl/RenderThemeEfl.cpp:
+        * platform/graphics/FontMetrics.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        * platform/gtk/RenderThemeGtk2.cpp:
+        * platform/mac/HTMLConverter.mm:
+        * rendering/EllipsisBox.cpp:
+        * rendering/FlowThreadController.cpp:
+        * rendering/InlineBox.cpp:
+        * rendering/InlineFlowBox.cpp:
+        * rendering/InlineFlowBox.h:
+        (WebCore):
+        * rendering/RenderButton.cpp:
+        * rendering/RenderCombineText.cpp:
+        * rendering/RenderCombineText.h:
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        * rendering/RenderEmbeddedObject.h:
+        (WebCore):
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderFullScreen.h:
+        * rendering/RenderImage.cpp:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderListItem.cpp:
+        * rendering/RenderListMarker.cpp:
+        * rendering/RenderMultiColumnBlock.cpp:
+        * rendering/RenderRegion.h:
+        * rendering/RenderRuby.cpp:
+        * rendering/RenderRubyRun.cpp:
+        * rendering/RenderScrollbar.cpp:
+        * rendering/RenderTable.cpp:
+        * rendering/RenderTableCell.cpp:
+        * rendering/RenderTableRow.cpp:
+        * rendering/RenderTableSection.cpp:
+        * rendering/RenderTextControl.cpp:
+        * rendering/RenderTextControlMultiLine.cpp:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderView.cpp:
+        * rendering/TextAutosizer.cpp:
+        * rendering/mathml/RenderMathMLBlock.h:
+        * rendering/style/KeyframeList.h:
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+        (WebCore):
+        * rendering/style/StyleInheritedData.cpp:
+        * rendering/svg/RenderSVGBlock.cpp:
+        * rendering/svg/RenderSVGInlineText.h:
+        * svg/SVGLengthContext.cpp:
+        * svg/SVGTRefElement.cpp:
+
+2012-08-22  Alex Christensen  <alex.christensen@flexsim.com>
+        win64 compile error fix for BinaryPropertyList.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=94122
+
+        Reviewed by Eric Seidel.
+
+        Fixed compile errors for MSVC x64 without changing performance
+
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::BinaryPropertyListSerializer::appendStringObject):
+
+2012-08-22  Kwang Yul Seo  <skyul@company100.net>
+
+        HTMLTreeBuilder::furthestBlockForFormattingElement should belong to HTMLElementStack
+        https://bugs.webkit.org/show_bug.cgi?id=93857
+
+        Reviewed by Eric Seidel.
+
+        HTMLTreeBuilder::furthestBlockForFormattingElement should belong to
+        HTMLElementStack because it traverses the element stack and finds the
+        furthest block for the given formatting element.
+
+        Currently, it belongs to HTMLTreeBuilder just because
+        isSpecialNode(const HTMLStackItem*) function used by
+        furthestBlockForFormattingElement is internal to HTMLTreeBuilder.
+
+        Moved isSpecialNode to HTMLStackItem and changed
+        furthestBlockForFormattingElement to be a method of HTMLElementStack.
+
+        No behavior change. Just a refactoring.
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore):
+        (WebCore::HTMLElementStack::popUntilNumberedHeaderElementPopped):
+        (WebCore::HTMLElementStack::hasNumberedHeaderElementInScope):
+        (WebCore::HTMLElementStack::furthestBlockForFormattingElement):
+        * html/parser/HTMLElementStack.h:
+        (HTMLElementStack):
+        * html/parser/HTMLStackItem.h:
+        (WebCore::HTMLStackItem::isInHTMLNamespace):
+        (HTMLStackItem):
+        (WebCore::HTMLStackItem::isNumberedHeaderElement):
+        (WebCore::HTMLStackItem::isTableBodyContextElement):
+        (WebCore::HTMLStackItem::isSpecialNode):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
+        (WebCore::HTMLTreeBuilder::processCloseWhenNestedTag):
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+        (WebCore::HTMLTreeBuilder::processAnyOtherEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+        (WebCore::HTMLTreeBuilder::shouldProcessTokenInForeignContent):
+        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
+        * html/parser/HTMLTreeBuilder.h:
+
+2012-08-22  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Add software bitmap resources to CCResourceProvider
+        https://bugs.webkit.org/show_bug.cgi?id=93677
+
+        Reviewed by Adrienne Walker.
+
+        Second commit after revert.
+
+        This adds the ability to CCResourceProvider to use software bitmaps.
+        They are allocated as plain-old-memory, and exposed as Skia objects.
+
+        We want the ResourceProvider to be able to handle different resource
+        types at the same time.  In practice, a default resource type is
+        desired for most uses within a single compositor instance, which is
+        specified by the default resource type.  Default resource types are
+        expected to be mostly 1-to-1 with CCRenderer types.
+
+        New tests added by parametrizing existing CCResourceProvider tests.
+
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::applyFilters):
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        (WebCore::LayerRendererChromium::drawYUVVideoQuad):
+        (WebCore::LayerRendererChromium::drawTextureQuad):
+        (WebCore::LayerRendererChromium::getFramebufferTexture):
+        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (DrawingFrame):
+        * platform/graphics/chromium/cc/CCResourceProvider.cpp:
+        (WebCore::CCResourceProvider::createResource):
+        (WebCore):
+        (WebCore::CCResourceProvider::createGLTexture):
+        (WebCore::CCResourceProvider::createBitmap):
+        (WebCore::CCResourceProvider::createResourceFromExternalTexture):
+        (WebCore::CCResourceProvider::deleteResource):
+        (WebCore::CCResourceProvider::upload):
+        (WebCore::CCResourceProvider::flush):
+        (WebCore::CCResourceProvider::shallowFlushIfSupported):
+        (WebCore::CCResourceProvider::lockForRead):
+        (WebCore::CCResourceProvider::unlockForRead):
+        (WebCore::CCResourceProvider::lockForWrite):
+        (WebCore::CCResourceProvider::unlockForWrite):
+        (WebCore::CCResourceProvider::ScopedReadLockGL::ScopedReadLockGL):
+        (WebCore::CCResourceProvider::ScopedReadLockGL::~ScopedReadLockGL):
+        (WebCore::CCResourceProvider::ScopedWriteLockGL::ScopedWriteLockGL):
+        (WebCore::CCResourceProvider::ScopedWriteLockGL::~ScopedWriteLockGL):
+        (WebCore::CCResourceProvider::populateSkBitmapWithResource):
+        (WebCore::CCResourceProvider::ScopedReadLockSoftware::ScopedReadLockSoftware):
+        (WebCore::CCResourceProvider::ScopedReadLockSoftware::~ScopedReadLockSoftware):
+        (WebCore::CCResourceProvider::ScopedWriteLockSoftware::ScopedWriteLockSoftware):
+        (WebCore::CCResourceProvider::ScopedWriteLockSoftware::~ScopedWriteLockSoftware):
+        (WebCore::CCResourceProvider::CCResourceProvider):
+        * platform/graphics/chromium/cc/CCResourceProvider.h:
+        (WebCore):
+        (WebCore::CCResourceProvider::setCreationPolicy):
+        (WebCore::CCResourceProvider::creationPolicy):
+        (CCResourceProvider):
+        (ScopedReadLockGL):
+        (WebCore::CCResourceProvider::ScopedReadLockGL::textureId):
+        (ScopedWriteLockGL):
+        (WebCore::CCResourceProvider::ScopedWriteLockGL::textureId):
+        (ScopedReadLockSoftware):
+        (WebCore::CCResourceProvider::ScopedReadLockSoftware::skBitmap):
+        (ScopedWriteLockSoftware):
+        (WebCore::CCResourceProvider::ScopedWriteLockSoftware::skCanvas):
+        (Resource):
+
+2012-08-22  Anna Cavender  <annacc@chromium.org>
+
+        Update the TextTrackCue Constructor
+        https://bugs.webkit.org/show_bug.cgi?id=88583
+
+        Reviewed by Eric Carlson.
+
+        The TextTrackCue constructor has been changed to:
+        [Constructor(double startTime, double endTime, DOMString text)]
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#texttrackcue
+
+        No new tests.  Update to media/track/track-add-remove-cue.html
+
+        * html/track/TextTrackCue.cpp:
+        (WebCore::TextTrackCue::TextTrackCue):
+        * html/track/TextTrackCue.h:
+        (WebCore::TextTrackCue::create):
+        (TextTrackCue):
+        * html/track/TextTrackCue.idl:
+        * html/track/WebVTTParser.cpp:
+        (WebCore::WebVTTParser::createNewCue):
+
+2012-08-22  Erik Arvidsson  <arv@chromium.org>
+
+        Changing class attribute is not reflected in the classList property
+        https://bugs.webkit.org/show_bug.cgi?id=93665
+
+        Reviewed by Ojan Vafai.
+
+        Before this change classAttributeChanged was only called for StyledElement. With this refactoring
+        it gets called for all Elements when the class attribute changes.
+
+        Test: fast/dom/Element/class-list-update.html
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRules): To match the old behavior we only include StyledElements.
+        * dom/ClassNodeList.cpp:
+        (WebCore::ClassNodeList::nodeMatches): Ditto.
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged): Moved the call to parseAttribute here, from StyledElement::attributeChanged.
+        (WebCore::Element::parseAttribute): Moved from StyledElement.
+        (WebCore):
+        (WebCore::Element::classAttributeChanged): Ditto.
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::classNames): Ditto.
+        (WebCore):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged): Let Element::attributeChanged call parseAttribtue instead.
+        (WebCore::StyledElement::parseAttribute): Move the class attribute handling to Element::parseAttribute.
+        * dom/StyledElement.h:
+        (StyledElement):
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace v8::String::NewSymbol() in CodeGeneratorV8.pm with v8String()
+        https://bugs.webkit.org/show_bug.cgi?id=94588
+
+        Reviewed by Eric Seidel.
+
+        v8String() is faster than String::NewSymbol().
+        This patch implements v8String(char*, Isolate*) and
+        replaces String::NewSymbol(char*) in CodeGeneratorV8.pm
+        with v8String(char*, Isolate*).
+
+        Performance result:
+
+        // 272 nano sec
+        static v8::Handle<v8::Value> attr3AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+        {
+            v8::Handle<v8::Value> v1 = v8String(String("foo"));
+            v8::Handle<v8::Value> v2 = v8String(String("bar"));
+            if (!v1.IsEmpty() && !v2.IsEmpty())
+                return v8Undefined();
+            return v8::Null(); // Never reach.
+        }
+
+        // 377 nano sec
+        static v8::Handle<v8::Value> attr4AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+        {
+            v8::Handle<v8::Value> v1 = v8::String::NewSymbol("foo");
+            v8::Handle<v8::Value> v2 = v8::String::NewSymbol("bar");
+            if (!v1.IsEmpty() && !v2.IsEmpty())
+                return v8Undefined();
+            return v8::Null(); // Never reach.
+        }
+
+        No tests. No change in behavior.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateNormalAttrGetter):
+        (GenerateNormalAttrSetter):
+        (GenerateNamedConstructorCallback):
+        (GenerateNonStandardFunction):
+        (GenerateImplementation):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::ConfigureV8Float64ArrayTemplate):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::ConfigureV8TestActiveDOMObjectTemplate):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::ConfigureV8TestEventTargetTemplate):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::ConfigureV8TestInterfaceTemplate):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructorConstructor::GetTemplate):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::ConfigureV8TestObjTemplate):
+        (WebCore::V8TestObj::installPerContextProperties):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrSetter):
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        (WebCore::v8String):
+        * html/HTMLDivElement.idl:
+
+2012-08-22  Pratik Solanki  <psolanki@apple.com>
+
+        Setting WebKitEnableHTTPPipelining doesn't work if default is true
+        https://bugs.webkit.org/show_bug.cgi?id=94537
+
+        Reviewed by David Kilzer.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost): Read in the HTTP pipelining pref and
+        allow it to override the default pipelining behavior if it was actually set.
+
+2012-08-22  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add touch link highlight animation layers.
+        https://bugs.webkit.org/show_bug.cgi?id=84487
+
+        Reviewed by James Robinson.
+
+        Adds support for creating composited touch link highlights in renderer thread. Clipping not yet
+        implemented for non-composited frames/overflow divs, but scrolling and layout changes are supported.
+        Transform support currently limited to translation.
+
+        Unit tests for LinkHighlight revised.
+
+        Tests: platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-late-noncomposite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-scrolled-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited-scroll-clip.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-layout-change-2.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-layout-change.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scroll-clip.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled-late-noncomposite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-composited-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-composited-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner-scroll-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner-scroll-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer-scroll-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer-scroll-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-scrolled-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-scrolled-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-rotated.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-scaledX.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-scaledY.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-window-scroll.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple.html
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::willBeDestroyed): Adds notification to LinkHighlight when layer goes away.
+        (WebCore::GraphicsLayerChromium::updateNames): Now sets debug name for LinkHighlight layer.
+        (WebCore::GraphicsLayerChromium::setSize): Invalidates LinkHighlight if present.
+        (WebCore::GraphicsLayerChromium::setNeedsDisplay): Invalidates LinkHighlight if present.
+        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect): Invalidates LinkHighlight if present.
+        (WebCore::GraphicsLayerChromium::setLinkHighlight): Registers LinkHighlightClient* with GraphicsLayerChromium.
+        (WebCore::GraphicsLayerChromium::updateChildList): Now adds LinkHighlight WebLayer if highlight active.
+        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable): Invalidates LinkHighlight if present.
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (WebCore):
+        (LinkHighlightClient): Abstract interface seen by GraphicsLayerChromium.
+        (WebCore::LinkHighlightClient::~LinkHighlightClient):
+        (GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::linkHighlight):
+        * platform/graphics/chromium/LinkHighlight.cpp: Removed.
+
+2012-08-22  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=94401
+        Add support for making a web site become paginated using overflow: 
+        paged-x | paged-y
+        -and corresponding-
+        <rdar://problem/11831783> 
+
+        Reviewed by Dave Hyatt.
+
+        This patch adds two new possible values for overflow-y. They are -
+        webkit-paged-x and -webkit-paged-y. When you set these as overflow-y 
+        values on the html or body element, they make the RenderView 
+        paginated, much like the API on Page.
+
+        -webkit-paged-x and -webkit-paged-y are only valid values for 
+        overflow-y, NOT overflow-x. overflow-x defaults to a value of auto 
+        (for now) unless it has been set to something else.
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        (WebCore::CSSParser::parseValue):
+
+        Two new CSS value keywords.
+        * css/CSSValueKeywords.in:
+
+        EOverflow has two new values for pagination. 
+        * rendering/style/RenderStyleConstants.h:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EOverflow):
+
+        A bunch of existing code from StyleResolver::styleForDocument() is 
+        moved into a helper function so that it can be called from two 
+        places. 
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+        Even though this pagination is very similar to Page::pagination(), it 
+        is different in one critical way. Page::pagination() will apply to 
+        all FrameViews, even those in the page cache. For this reason, 
+        FrameView needs to keep its own Pagination value that just applies to 
+        this FrameView.
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        (WebCore):
+        (FrameView):
+
+        Map RenderStyle values to a Pagination::Mode.
+        (WebCore::paginationModeForRenderStyle):
+        (WebCore):
+
+        Account for paged-x and paged-y here.
+        (WebCore::FrameView::applyOverflowToViewport):
+
+        As is explained in the header, FrameView::pagination() will return 
+        m_pagination if it has been set. Otherwise, it will return 
+        Page::pagination() since currently there are no callers that need to 
+        distinguish between the two.
+        (WebCore::FrameView::pagination):
+        (WebCore::FrameView::setPagination):
+
+        Generally this means that everywhere in WebCore should ask FrameView 
+        for the pagination(), not Page. These call sites all look to 
+        FrameView now.
+        (WebCore::FrameView::paintContents):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::requiresColumns):
+        (WebCore::RenderView::calcColumnWidth):
+        (WebCore::RenderView::paginationUnit):
+        (WebCore::RenderView::viewLogicalHeight):
+
+        Since we need to define Pagination in Page.h AND FrameView.h, it is 
+        now in its own header, Pagination.h. And therefore it is no longer 
+        WebCore::Page::Pagination, but rather it is just WebCore::Pagination.
+        * page/Page.h:
+        (Page):
+        * rendering/Pagination.h: Added.
+        (WebCore):
+        (WebCore::Pagination::Pagination):
+        (Pagination):
+        (WebCore::Pagination::operator==):
+        (WebCore::Pagination::operator!=):
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+
+        Certain ColumnInfo values are set based on the RenderStyle. So if 
+        those RenderStyle values change, the ColumnInfo needs to be updated.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateColumnInfoFromStyle):
+        (WebCore):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+
+        Factor in paged-x and paged-y when determining if a RenderBlock 
+        requires columns.
+        (WebCore::RenderBlock::requiresColumns):
+
+        RenderStyle::specifiesColumns() is an odd and probably broken 
+        function. At the very least, it should be re-named, if not removed 
+        entirely. It does not accurately assess if columns have been 
+        specified. I had to add this code here because specifiesColumns() 
+        returns false for paged-x and true for paged-y. We were hitting a 
+        number of crashes with paged-y because of this, so I chose for the 
+        time being to limit this check to non-root layers.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+
+        It's just Pagination now, not Page::Pagination.
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::reset):
+        (WebCore::InternalSettings::setPagination):
+
+2012-08-22  Dean Jackson  <dino@apple.com>
+
+        [WebGL] Mac/ATI/AMD systems need to translate built-in GLSL functions
+        https://bugs.webkit.org/show_bug.cgi?id=94030
+
+        Reviewed by Tim Horton.
+
+        ATI/AMD GPUs on Apple platforms do not give correct values for some of
+        the built-in GLSL functions. Add a compile flag that is passed to ANGLE
+        so that, with this configuration, it will rewrite the shader to emulate
+        the function in code.
+
+        This is exposing some design weaknesses in the way we call ANGLE. We'll
+        soon need to add more compiler flags; Future bugs will likely clean
+        this code up. But this approach is satisfactory for the moment.
+
+        This change is tested by the Khronos WebGL conformance test suite, in particular:
+        conformance/glsl/functions/glsl-function-distance.html
+        conformance/glsl/functions/glsl-function-dot.html
+        conformance/glsl/functions/glsl-function-length.html
+
+        * platform/graphics/ANGLEWebKitBridge.cpp:
+        (WebCore::ANGLEWebKitBridge::validateShaderSource): Test for ATI cards
+        on the Mac platform, and pass in an extra flag to the translation step.
+        * platform/graphics/ANGLEWebKitBridge.h:
+        (ANGLEWebKitBridge): Add a new parameter to getTranslatedShaderSourceANGLE
+        that accepts some extra options to pass to ANGLE.
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
+        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE): Pass
+        the extra options into ANGLE's compile function.
+
+2012-08-22  Tommy Widenflycht  <tommyw@google.com>
+
+        [chromium] MediaStream API: Add MockWebRTCPeerConnectionHandler
+        https://bugs.webkit.org/show_bug.cgi?id=93091
+
+        Reviewed by Adam Barth.
+
+        Fixing a FIXME that the patch obsoletes.
+
+        Covered by existing tests.
+
+        * platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp:
+        (WebCore::RTCPeerConnectionHandlerChromium::initialize):
+
+2012-08-22  Eric Penner  <epenner@google.com>
+
+        [chromium] Simplify updateContentRect, removing rect parameter, refactor unit tests.
+        https://bugs.webkit.org/show_bug.cgi?id=94165
+
+        Reviewed by Adrienne Walker.
+
+        Remove visible rect parameter from TiledLayerChromium functions. Passing a
+        rect that is not the visible rect wouldn't make sense, and soon we might
+        need further visibility information.
+
+        In refactoring the unit tests, I removed texture manager from all tests
+        and put it in the test class. I also made some utility functions to 
+        simulate the commit flow and remove tons of boilerplate code. I refactored
+        about half the unit tests to use the utility functions.
+
+        Refactored tests.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::update):
+        (WebCore::ContentLayerChromium::needMoreUpdates):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::update):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore):
+        (WebCore::TiledLayerChromium::setTexturePriorities):
+        (WebCore::TiledLayerChromium::resetUpdateState):
+        (WebCore::TiledLayerChromium::update):
+        (WebCore::TiledLayerChromium::needsIdlePaint):
+        (WebCore::TiledLayerChromium::idlePaintRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+
+2012-08-22  Otto Derek Cheung  <otcheung@rim.com>
+
+        [BlackBerry] Add a check to filter out cookies that tries to set the 
+        domain to a top level domain
+        https://bugs.webkit.org/show_bug.cgi?id=94722
+
+        Reviewed by Rob Buis.
+
+        Adding conditions to check whether a cookie domain is a top level domain.
+        If it is, throw it out when parsing.
+
+        Manual Testing by trying to insert a cookie with an invalid domain
+        using web-inspector. (ex: when on news.yahoo.com.hk, try to document.
+        cookie="test1=seeifthiscookieexist; domain=.com.hk")
+
+        PR121622
+
+        * platform/blackberry/CookieParser.cpp:
+        WebCore::CookieParser::parseOneCookie):
+
+2012-08-22  Rob Buis  <rwlbuis@webkit.org>
+
+        Remove RenderBlock::paintEllipsisBoxes
+        https://bugs.webkit.org/show_bug.cgi?id=94709
+
+        Reviewed by Eric Seidel.
+
+        Remove unused method.
+
+        No change in functionality, no new tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintFloats):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+
+2012-08-22  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Introduce RTCSessionDescription
+        https://bugs.webkit.org/show_bug.cgi?id=93119
+
+        Reviewed by Adam Barth.
+
+        This patch introduces RTCSessionDescription together with its
+        corresponding WebCore/platform representation.
+
+        Test: fast/mediastream/RTCSessionDescription.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/DOMWindowMediaStream.idl:
+        * Modules/mediastream/RTCSessionDescription.cpp: Added.
+        (WebCore):
+        (WebCore::RTCSessionDescription::create):
+        (WebCore::RTCSessionDescription::RTCSessionDescription):
+        (WebCore::RTCSessionDescription::~RTCSessionDescription):
+        (WebCore::RTCSessionDescription::type):
+        (WebCore::RTCSessionDescription::setType):
+        (WebCore::RTCSessionDescription::sdp):
+        (WebCore::RTCSessionDescription::setSdp):
+        (WebCore::RTCSessionDescription::descriptor):
+        * Modules/mediastream/RTCSessionDescription.h: Added.
+        (WebCore):
+        (RTCSessionDescription):
+        * Modules/mediastream/RTCSessionDescription.idl: Added.
+        * WebCore.gypi:
+        * platform/mediastream/RTCSessionDescriptionDescriptor.cpp: Added.
+        (WebCore):
+        (WebCore::RTCSessionDescriptionDescriptor::create):
+        (WebCore::RTCSessionDescriptionDescriptor::RTCSessionDescriptionDescriptor):
+        (WebCore::RTCSessionDescriptionDescriptor::~RTCSessionDescriptionDescriptor):
+        * platform/mediastream/RTCSessionDescriptionDescriptor.h: Added.
+        (WebCore):
+        (RTCSessionDescriptionDescriptor):
+        (WebCore::RTCSessionDescriptionDescriptor::type):
+        (WebCore::RTCSessionDescriptionDescriptor::setType):
+        (WebCore::RTCSessionDescriptionDescriptor::sdp):
+        (WebCore::RTCSessionDescriptionDescriptor::setSdp):
+
+2012-08-22  Victor Carbune  <victor@rosedu.org>
+
+        DOM manipulation crashes the browser
+
+        Creating a DOM track element by script and changing the mode crashes
+        results in a browser crash.
+        https://bugs.webkit.org/show_bug.cgi?id=94628
+
+        Reviewed by Eric Carlson.
+
+        Simple fix that creates the text track cue list in case of mode change.
+
+        Test: media/track/track-element-dom-change-crash.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::textTrackModeChanged):
+
+2012-08-22  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Microdata build fix.
+
+        * html/HTMLPropertiesCollection.h:
+        (WebCore::HTMLPropertiesCollection::updatePropertyCache):
+
+2012-08-22  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Introduce RTCIceCandidate
+        https://bugs.webkit.org/show_bug.cgi?id=93117
+
+        Reviewed by Adam Barth.
+
+        This patch introduces RTCIceCandidate together with its corresponding
+        WebCore/platform representation.
+
+        Test: fast/mediastream/RTCIceCandidate.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/DOMWindowMediaStream.idl:
+        * Modules/mediastream/RTCIceCandidate.cpp: Added.
+        (WebCore):
+        (WebCore::RTCIceCandidate::create):
+        (WebCore::RTCIceCandidate::RTCIceCandidate):
+        (WebCore::RTCIceCandidate::~RTCIceCandidate):
+        (WebCore::RTCIceCandidate::candidate):
+        (WebCore::RTCIceCandidate::sdpMid):
+        (WebCore::RTCIceCandidate::sdpMLineIndex):
+        (WebCore::RTCIceCandidate::descriptor):
+        * Modules/mediastream/RTCIceCandidate.h: Added.
+        (WebCore):
+        (RTCIceCandidate):
+        * Modules/mediastream/RTCIceCandidate.idl: Added.
+        * WebCore.gypi:
+        * platform/mediastream/RTCIceCandidateDescriptor.cpp: Added.
+        (WebCore):
+        (WebCore::RTCIceCandidateDescriptor::create):
+        (WebCore::RTCIceCandidateDescriptor::RTCIceCandidateDescriptor):
+        (WebCore::RTCIceCandidateDescriptor::~RTCIceCandidateDescriptor):
+        * platform/mediastream/RTCIceCandidateDescriptor.h: Added.
+        (WebCore):
+        (RTCIceCandidateDescriptor):
+        (WebCore::RTCIceCandidateDescriptor::candidate):
+        (WebCore::RTCIceCandidateDescriptor::sdpMid):
+        (WebCore::RTCIceCandidateDescriptor::sdpMLineIndex):
+
+2012-08-22  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/94679> WebCore scrolling thread leaks objects due to them being autoreleased without any autorelease pool in place
+
+        Reviewed by Dan Bernstein.
+
+        * page/scrolling/mac/ScrollingThreadMac.mm:
+        (WebCore::ScrollingThread::threadRunLoopSourceCallback): Ensure that an autorelease pool is in place when
+        dispatching functions on the scrolling thread.
+
+2012-08-22  Pratik Solanki  <psolanki@apple.com>
+
+        Failure to dispatch delegate callbacks if resource load fails synchronously
+        https://bugs.webkit.org/show_bug.cgi?id=94644
+
+        Reviewed by Antti Koivisto.
+
+        Resource loads can be triggered by layout after document load is
+        complete but before we have dispatched didFinishLoadForFrame callback.
+        In such cases, if the load fails synchronously due to the client
+        returning 0 from willSendRequest callback, we would fail to call
+        didFinishLoading. this was fixed for Font resources in r122446 for bug
+        91018. This fixes it in the general case by having CachedResourceLoader
+        call FrameLoader::checkLoadComplete() when it is done loading all
+        resources.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::beginLoadTimerFired):
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::decrementRequestCount):
+
+2012-08-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r126319.
+        http://trac.webkit.org/changeset/126319
+        https://bugs.webkit.org/show_bug.cgi?id=84487
+
+        Broke Chromium Mac build
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::willBeDestroyed):
+        (WebCore::GraphicsLayerChromium::updateNames):
+        (WebCore::GraphicsLayerChromium::setSize):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplay):
+        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerChromium::addLinkHighlight):
+        (WebCore::GraphicsLayerChromium::didFinishLinkHighlight):
+        (WebCore):
+        (WebCore::GraphicsLayerChromium::updateChildList):
+        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (WebCore):
+        (GraphicsLayerChromium):
+        * platform/graphics/chromium/LinkHighlight.cpp: Added.
+        (WebCore):
+        (WebCore::LinkHighlight::create):
+        (WebCore::LinkHighlight::LinkHighlight):
+        (WebCore::LinkHighlight::~LinkHighlight):
+        (WebCore::LinkHighlight::contentLayer):
+        (WebCore::LinkHighlight::paintContents):
+        (WebCore::LinkHighlight::notifyAnimationStarted):
+        (WebCore::LinkHighlight::notifyAnimationFinished):
+        * platform/graphics/chromium/LinkHighlight.h: Renamed from Source/WebKit/chromium/src/LinkHighlight.h.
+        (WebCore):
+        (LinkHighlight):
+
+2012-08-22  Alexei Svitkine  <asvitkine@chromium.org>
+
+        Respect system setting for rubber-banding in ScrollAnimatorMac.
+        https://bugs.webkit.org/show_bug.cgi?id=94356
+
+        Reviewed by James Robinson.
+
+        Respects user defaults setting of NSScrollViewRubberbanding,
+        which controls rubber-banding in other Mac OS X applications.
+
+        If NSScrollViewRubberbanding is not set, defaults to enabling
+        rubber banding. Otherwise, rubber banding is disabled if the
+        value is 0 and enabled otherwise.
+
+        No new tests since the behavior depends on system settings.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore):
+        (WebCore::rubberBandingEnabledForSystem):
+        (WebCore::ScrollAnimatorMac::handleWheelEvent):
+
+2012-08-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium/mac] Remove unnecessary checks for OS version <= 10.5. We don't support those
+        https://bugs.webkit.org/show_bug.cgi?id=94658
+
+        Reviewed by Tony Chang.
+
+        The chromium mac port hasn't supported Leopard for a while now, so remove chromium-specific code that checks
+        for OS X version <= Leopard.
+
+        * platform/graphics/chromium/CrossProcessFontLoading.mm:
+        (WebCore::FontPlatformData::loadFont):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::canSetCascadeListForCustomFont):
+
+2012-08-22  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add touch link highlight animation layers.
+        https://bugs.webkit.org/show_bug.cgi?id=84487
+
+        Reviewed by James Robinson.
+
+        Adds support for creating composited touch link highlights in renderer thread. Clipping not yet
+        implemented for non-composited frames/overflow divs, but scrolling and layout changes are supported.
+        Transform support currently limited to translation.
+
+        Unit tests for LinkHighlight revised.
+
+        Tests: platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled-late-noncomposite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-composited.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-scrolled-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-iframe.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited-scroll-clip.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-composited.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-layout-change-2.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-layout-change.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scroll-clip.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled-late-noncomposite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div-scrolled.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-1-overflow-div.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-composited-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-composited-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer-clipped.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer-late-composite.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe-scrolled-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-iframe.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner-scroll-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner-scroll-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer-scroll-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer-scroll-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-composited-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-scrolled-inner.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div-scrolled-outer.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-2-overflow-div.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-rotated.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-scaledX.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-scaledY.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple-window-scroll.html
+               platform/chromium-linux/compositing/gestures/gesture-tapHighlight-simple.html
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::willBeDestroyed): Adds notification to LinkHighlight when layer goes away.
+        (WebCore::GraphicsLayerChromium::updateNames): Now sets debug name for LinkHighlight layer.
+        (WebCore::GraphicsLayerChromium::setSize): Invalidates LinkHighlight if present.
+        (WebCore::GraphicsLayerChromium::setNeedsDisplay): Invalidates LinkHighlight if present.
+        (WebCore::GraphicsLayerChromium::setNeedsDisplayInRect): Invalidates LinkHighlight if present.
+        (WebCore::GraphicsLayerChromium::setLinkHighlight): Registers LinkHighlightClient* with GraphicsLayerChromium.
+        (WebCore::GraphicsLayerChromium::updateChildList): Now adds LinkHighlight WebLayer if highlight active.
+        (WebCore::GraphicsLayerChromium::updateLayerIsDrawable): Invalidates LinkHighlight if present.
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (WebCore):
+        (LinkHighlightClient): Abstract interface seen by GraphicsLayerChromium.
+        (WebCore::LinkHighlightClient::~LinkHighlightClient):
+        (GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::linkHighlight):
+        * platform/graphics/chromium/LinkHighlight.cpp: Removed.
+
+2012-08-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix. Missing PANGO_CFLAGS.
+
+        * GNUmakefile.am:
+
+2012-08-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: make "sdk" component compile independently from the rest of the front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=94705
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change refactors the way we compile. Running "compile-front-end.py sdk" will compile sdk only.
+        It also introduces DOMStorageModel and DatabaseModel that are used to split model / UI layers.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InjectedScriptExterns.js:
+        (InjectedScriptHost.prototype.evaluate):
+        * inspector/Inspector.json:
+        * inspector/compile-front-end.py:
+        (dump_module):
+        * inspector/front-end/CompilerScriptMapping.js:
+        * inspector/front-end/ConsoleModel.js:
+        (WebInspector.ConsoleMessage):
+        (WebInspector.ConsoleMessage.prototype.clone):
+        (WebInspector.ConsoleMessage.prototype.location):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorageModel):
+        (WebInspector.DOMStorageModel.prototype._addDOMStorage):
+        (WebInspector.DOMStorageModel.prototype._domStorageUpdated):
+        (WebInspector.DOMStorageModel.prototype.storageForId):
+        (WebInspector.DOMStorageModel.prototype.storages):
+        (WebInspector.DOMStorageDispatcher):
+        (WebInspector.DOMStorageDispatcher.prototype.addDOMStorage):
+        (WebInspector.DOMStorageDispatcher.prototype.domStorageUpdated):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.executeSql):
+        (WebInspector.DatabaseModel):
+        (WebInspector.DatabaseModel.prototype.databases):
+        (WebInspector.DatabaseModel.prototype.databaseForId):
+        (WebInspector.DatabaseModel.prototype._addDatabase):
+        (WebInspector.DatabaseModel.prototype._sqlTransactionSucceeded):
+        (WebInspector.DatabaseModel.prototype._sqlTransactionFailed):
+        (WebInspector.DatabaseDispatcher):
+        (WebInspector.DatabaseDispatcher.prototype.addDatabase):
+        (WebInspector.DatabaseDispatcher.prototype.sqlTransactionSucceeded):
+        (WebInspector.DatabaseDispatcher.prototype.sqlTransactionFailed):
+        * inspector/front-end/DebuggerModel.js:
+        * inspector/front-end/FileUtils.js:
+        (WebInspector.OutputStreamDelegate.prototype.onTransferStarted):
+        (WebInspector.OutputStreamDelegate.prototype.onChunkTransferred):
+        (WebInspector.OutputStreamDelegate.prototype.onTransferFinished):
+        (WebInspector.OutputStreamDelegate.prototype.onError):
+        (WebInspector.OutputStream):
+        (WebInspector.OutputStream.prototype.startTransfer):
+        (WebInspector.OutputStream.prototype.transferChunk):
+        (WebInspector.OutputStream.prototype.finishTransfer):
+        (WebInspector.OutputStream.prototype.dispose):
+        * inspector/front-end/HandlerRegistry.js:
+        * inspector/front-end/HeapSnapshotView.js:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        * inspector/front-end/PresentationConsoleMessageHelper.js:
+        (WebInspector.PresentationConsoleMessageHelper.prototype._parsedScriptSource):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype._reset):
+        (WebInspector.ResourcesPanel.prototype._databaseAdded):
+        (WebInspector.ResourcesPanel.prototype._addDatabase):
+        (WebInspector.ResourcesPanel.prototype._domStorageAdded):
+        (WebInspector.ResourcesPanel.prototype._addDOMStorage):
+        (WebInspector.ResourcesPanel.prototype._showDatabase.get if):
+        (WebInspector.ResourcesPanel.prototype._showDatabase.else.get if):
+        (WebInspector.ResourcesPanel.prototype._showDatabase):
+        (WebInspector.ResourcesPanel.prototype._showDOMStorage.get if):
+        (WebInspector.ResourcesPanel.prototype._showDOMStorage):
+        (WebInspector.ResourcesPanel.prototype._updateDatabaseTables.get if):
+        (WebInspector.ResourcesPanel.prototype._updateDatabaseTables.tableNamesCallback):
+        (WebInspector.DatabaseTreeElement.prototype.onselect):
+        (WebInspector.DatabaseTableTreeElement.prototype.onselect):
+        (WebInspector.DOMStorageTreeElement.prototype.onselect):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.showFunctionDefinition):
+        * inspector/front-end/SearchController.js:
+        (WebInspector.SearchController.prototype.disableSearchUntilExplicitAction):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/Spectrum.js:
+        * inspector/front-end/TextEditorModel.js:
+        * inspector/front-end/UIString.js: Added.
+        (WebInspector.UIString):
+        * inspector/front-end/UIUtils.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/externs.js:
+        (InspectorFrontendHostAPI.prototype.platform):
+        (InspectorFrontendHostAPI.prototype.port):
+        (InspectorFrontendHostAPI.prototype.bringToFront):
+        (InspectorFrontendHostAPI.prototype.closeWindow):
+        (InspectorFrontendHostAPI.prototype.requestAttachWindow):
+        (InspectorFrontendHostAPI.prototype.requestDetachWindow):
+        (InspectorFrontendHostAPI.prototype.requestSetDockSide):
+        (InspectorFrontendHostAPI.prototype.setAttachedWindowHeight):
+        (InspectorFrontendHostAPI.prototype.moveWindowBy):
+        (InspectorFrontendHostAPI.prototype.setInjectedScriptForOrigin):
+        (InspectorFrontendHostAPI.prototype.loaded):
+        (InspectorFrontendHostAPI.prototype.localizedStringsURL):
+        (InspectorFrontendHostAPI.prototype.hiddenPanels):
+        (InspectorFrontendHostAPI.prototype.inspectedURLChanged):
+        (InspectorFrontendHostAPI.prototype.documentCopy):
+        (InspectorFrontendHostAPI.prototype.copyText):
+        (InspectorFrontendHostAPI.prototype.openInNewTab):
+        (InspectorFrontendHostAPI.prototype.canSave):
+        (InspectorFrontendHostAPI.prototype.save):
+        (InspectorFrontendHostAPI.prototype.canAppend):
+        (InspectorFrontendHostAPI.prototype.append):
+        (InspectorFrontendHostAPI.prototype.sendMessageToBackend):
+        (InspectorFrontendHostAPI.prototype.recordActionTaken):
+        (InspectorFrontendHostAPI.prototype.recordPanelShown):
+        (InspectorFrontendHostAPI.prototype.recordSettingChanged):
+        (InspectorFrontendHostAPI.prototype.loadResourceSynchronously):
+        (InspectorFrontendHostAPI.prototype.setZoomFactor):
+        (InspectorFrontendHostAPI.prototype.canInspectWorkers):
+        (SourceMapV3):
+        (SourceMapV3.Section):
+        (SourceMapV3.Offset):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.inspect):
+
+2012-08-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix. libWebCore needs include paths
+        for some bits of WebCoreGtk.
+
+        * GNUmakefile.am:
+
+2012-08-22  Koji Ishii  <kojiishi@gmail.com>
+
+        FontMetrics.unitsPerEm(), FontPlatformData.orientation(), SimpleFontData::platformBoundsForGlyph are not implemented on Chromium Windows
+        https://bugs.webkit.org/show_bug.cgi?id=83512
+
+        Reviewed by Tony Chang.
+
+        Chromium Windows does not implement following 3 functions that are required for bug 51450.
+        1. FontMetrics.unitsPerEm() always returns the default value (gDefaultUnitsPerEm = 1000).
+        2. FontPlatformData.orientation() always returns Horizontal.
+        3. SimpleFontData::platformBoundsForGlyph() always returns FloatRect().
+        Tony suggested in bug 51450 review to split code that is not behind
+        #if ENABLE(OPENTYPE_VERTICAL) to a separate patch.
+
+        Test: Following 3 existing but skipped tests are now enabled and pass.
+              fast/text/emphasis-overlap.html
+              fast/text/emphasis-avoid-ruby.html
+              fast/repaint/text-emphasis-v.html
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::FontCache::createFontPlatformData): Add orientation.
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Add orientation.
+        (WebCore::FontPlatformData::operator=): Add orientation.
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        (FontPlatformData):
+        (WebCore::FontPlatformData::orientation): Add orientation.
+        (WebCore::FontPlatformData::setOrientation): Add orientation.
+        (WebCore::FontPlatformData::operator==): Add orientation.
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformInit): Set FontMetrics.unitsPerEm.
+        (WebCore::SimpleFontData::createScaledFontData): Add orientation.
+        (WebCore::SimpleFontData::platformBoundsForGlyph): Implemented.
+        * platform/graphics/skia/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData): Add orientation.
+
+2012-08-22  Robert Hogan  <robert@webkit.org>
+
+        REGRESSION(r125578): fast/regex/unicodeCaseInsensitive.html crash on Linux Debug Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=94010
+
+        Reviewed by Tony Chang.
+
+        r125578 inspected the raw text run for word-end but the index it used to do so was for a normalized
+        version of the run that could be longer than the raw text run. So to allow proper detection of word-end
+        in complex text (i) do not normalize tabs to plain white-space and (ii) go back to using the normalized version
+        of the run for detecting word-end. There is a risk that some fonts may create glyphs for the '\t' character 
+        but this does not turn up in any of our regression tests and the more common risk appears to be the new-line.
+
+        Test: fast/regex/unicodeCaseInsensitive.html
+
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
+        (WebCore::normalizeSpacesAndMirrorChars):
+
+2012-08-22  Andrey Adaikin  <aandrey@chromium.org>
+
+        Web Inspector: [WebGL] Support the communication protocol from the injected script
+        https://bugs.webkit.org/show_bug.cgi?id=94689
+
+        Reviewed by Pavel Feldman.
+
+        Support the WebGL communication protocol from the injected script module.
+
+        * inspector/InjectedScriptWebGLModuleSource.js:
+        (.):
+
+2012-08-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Split WebCore/platform into a separate library
+        https://bugs.webkit.org/show_bug.cgi?id=94435
+
+        Reviewed by Martin Robinson.
+
+        More people have been reporting problems when linking WebCore because
+        the command line limit is being exceeded. Splitting WebCore a bit more
+        is in order.
+
+        * GNUmakefile.am: add new libWebCorePlatform convenience library.
+        * GNUmakefile.list.am: move list of platform/* files to its own variable.
+
+2012-08-22  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [EFL] Build failures with harfbuzz outside standard locations
+        https://bugs.webkit.org/show_bug.cgi?id=93030
+
+        Reviewed by Rob Buis.
+
+        Add ${HARFBUZZ_INCLUDE_DIRS} to the list of included paths: so far
+        it was being implicitly pulled from evas's pkg-config file, and
+        used to work when WebKit-EFL's dependencies were built with
+        jhbuild -- in this case, harfbuzz is built before evas, which is
+        then built with harfbuzz support and adds the required paths to
+        its .pc file.
+
+        We need to include things directly to account for the case of
+        people not using jhbuild and thus not necessarily having harfbuzz
+        as an evas dependency.
+
+        * PlatformEfl.cmake:
+
+2012-08-22  Raul Hudea  <rhudea@adobe.com>
+
+        Crash in WebCore::RenderBlock::removeChild
+        https://bugs.webkit.org/show_bug.cgi?id=93879
+
+        Reviewed by Abhishek Arya.
+
+        By adding the lifetime state to the RenderNamedFlowThread (r122556), it become possible for the a RenderRegion object to delete its sibling,
+        the RenderNamedFlowThread. This is unexpected in the rendering world and cause problems in RenderBlock::removeChild where we retain previous
+        and next sibling pointers.
+        So, all the RenderNamedFlowThread are created under a RenderFlowThreadContainer object insted of the RenderView. The new object is created only
+        when the first named flow is created.
+
+        Test: fast/regions/remove-flow-thread-crash.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/FlowThreadController.cpp:
+        (WebCore::FlowThreadController::FlowThreadController): Added initialization for the new RenderFlowThreadContainer member
+        (WebCore::FlowThreadController::ensureRenderFlowThreadWithName): Added the creation of the RenderFlowThreadContainer object and use it as a parent for all RenderNamedFlowThreads
+        (WebCore::FlowThreadController::styleDidChange): Inform all the RenderNamedFlowThreads that the style changed in regions (initially this code was in RenderView, but now all RenderNamedFlowThreads are children of RenderFlowThreadContainer)
+        (WebCore):
+        * rendering/FlowThreadController.h:
+        (WebCore):
+        (FlowThreadController):
+        * rendering/RenderFlowThreadContainer.cpp: Added.
+        (WebCore):
+        (WebCore::RenderFlowThreadContainer::RenderFlowThreadContainer):
+        (WebCore::RenderFlowThreadContainer::layout):
+        * rendering/RenderFlowThreadContainer.h: Added.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::markContainingBlocksForLayout): Skip to RenderView if the current object is an RenderFlowThreadContainer.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRenderFlowThreadContainer):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::styleDidChange): Moved the code associated to RenderNamedFlowThreads to FlowThreadController:styleDidChange and call it instead.
+
+2012-08-22  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Add RSS content handling support
+        https://bugs.webkit.org/show_bug.cgi?id=93496
+
+        Reviewed by Yong Li.
+
+        Cleanup some more.
+
+        * platform/network/blackberry/rss/RSSFilterStream.cpp:
+        (WebCore):
+        (WebCore::createParser):
+        (WebCore::defaultEncodingForLanguage):
+        (WebCore::isTranscodingNeeded):
+
+2012-08-21  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Remove unused TextDrawingMode flags from GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=21898
+
+        Reviewed by Benjamin Poulain.
+
+        Remove TextModeClip and TextModeInvisible. These are not used by any port, and
+        according to https://bugs.webkit.org/show_bug.cgi?id=42110#c2 these were added
+        just to map CG existing flags, but are not used.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        * platform/graphics/openvg/PainterOpenVG.cpp:
+        (WebCore::PainterOpenVG::drawText):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::setTextDrawingMode):
+
+2012-08-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r126287.
+        http://trac.webkit.org/changeset/126287
+        https://bugs.webkit.org/show_bug.cgi?id=94708
+
+        It made WK1 layout testing 3.7x slower (>1hours) (Requested by
+        ossy on #webkit).
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::unusedWeakObjectMapCallback):
+        (Bindings):
+        (JSC::Bindings::WeakMapImpl::WeakMapImpl):
+        (JSC::Bindings::WeakMapImpl::~WeakMapImpl):
+        (JSC::Bindings::WeakMap::~WeakMap):
+        (JSC::Bindings::WeakMap::set):
+        (JSC::Bindings::WeakMap::get):
+        (JSC::Bindings::WeakMap::remove):
+        * bridge/qt/qt_instance.h:
+        (QtInstance):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::prototypeForSignalsAndSlots):
+        (JSC::Bindings::QtRuntimeMethod::~QtRuntimeMethod):
+        (JSC::Bindings::QtRuntimeMethod::call):
+        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
+        (JSC::Bindings::QtRuntimeMethod::connectOrDisconnect):
+        * bridge/qt/qt_runtime.h:
+        (QtRuntimeMethod):
+
+2012-08-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: follow up to r126297, fixing WebCore.gypi.
+
+        * WebCore.gypi:
+
+2012-08-22  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Preferred languages and spellchecker APIs are not consistent in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=94683
+
+        Reviewed by Alejandro G. Castro.
+
+        Use a Vector<String> instead of a comma-separated string to
+        get/set languages.
+
+        * platform/text/gtk/TextCheckerEnchant.cpp:
+        (TextCheckerEnchant::updateSpellCheckingLanguages):
+        (TextCheckerEnchant::getSpellCheckingLanguages):
+        * platform/text/gtk/TextCheckerEnchant.h:
+        (TextCheckerEnchant):
+
+2012-08-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move NavigatorView and NavigatorOverlayController to ScriptsPanel module
+        https://bugs.webkit.org/show_bug.cgi?id=94693
+
+        Reviewed by Vsevolod Vlasov.
+
+        Loading them via importScript now.
+
+        * inspector/compile-front-end.py:
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/inspector.html:
+
+2012-08-22  KwangYong Choi  <ky0.choi@samsung.com>
+
+        [EFL] Support slider tick mark snapping
+        https://bugs.webkit.org/show_bug.cgi?id=94560
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Increased the threshold for the EFL port. The value is snapped
+        when it clicked near tick mark.
+
+        No new tests. Covered by fast/forms/datalist/range-snap-to-datalist.html.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore):
+        (WebCore::RenderThemeEfl::sliderTickSnappingThreshold):
+        * platform/efl/RenderThemeEfl.h:
+        (RenderThemeEfl):
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Optionally support smooth-scrolling on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=74926
+
+        Reviewed by Simon Hausmann.
+
+        Make GestureAnimations depend on the GESTURE_ANIMATION feature flag,
+        since GestureAnimations are unused on some platforms.
+
+        * Target.pri:
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::fireUpAnAnimation):
+        (WebCore::ScrollAnimatorNone::cancelAnimations):
+        (WebCore::ScrollAnimatorNone::animationTimerFired):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+
+2012-08-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Port convertQVariantToValue to use the JSC C API
+        https://bugs.webkit.org/show_bug.cgi?id=93889
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Based on patch by Noam Rosenthal.
+
+        This patch is another step towards reducing the use of internal JSC API
+        in the Qt bridge. Most of the conversion from QVariant to JS values is
+        straight-forward. The biggest behavioural change is that QVariant lists
+        are converted on-the-spot instead of lazily. Bug #94691 tracks fixing
+        that.
+
+        * bridge/qt/qt_instance.cpp:
+        (Bindings):
+        (JSC::Bindings::QtField::valueFromInstance):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMethod::call):
+        (JSC::Bindings::QtConnectionObject::execute):
+        (JSC::Bindings::::valueAt):
+        * bridge/qt/qt_runtime.h:
+        (Bindings):
+
+2012-08-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] REGRESSION(r125428): fast/profiler/nested-start-and-stop-profiler.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=93897
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Before r125428 run-time methods (wrapped signals, slots or invokable
+        functions) were subclasses of JSInternalFunction and therefore real
+        function objects in the JavaScript sense. r125428 changed them to be
+        just callable objects, but they did not have Function.prototype as
+        prototype anymore for example nor was their name correct (resulting in
+        a layout test failure).
+
+        This patch changes run-time methods back to being real function objects
+        that have a correct name and have Function.prototype in their prototype
+        change
+
+        The objects returned by JSObjectMakeFunctionWithCallbackInjected are
+        light-weight internal function objects that do not support
+        JSObject{Set/Get}Private. Therefore we inject our own prototype right
+        before the Function.prototype prototype, which uses private data to
+        store a pointer to our C++ QtRuntimeMethod object.  This complicates
+        the retrieval of the pointer to that instance slightly, which is why
+        this patch introduces the toRuntimeMethod convenience function that
+        looks up our prototype first and does a check for type-safety.
+
+        At the same time the patch removes the length properties from the
+        run-time method itself as well as connect/disconnect.  The length
+        property on a function signifies the number of arguments, but in all
+        three cases that number is actually variable, because of overloading.
+        That is why we choose not to expose it in the first place.
+
+        In QtInstance we cache the JS wrapper objects for QtRuntimeMethod in a
+        JSWeakObjectMap. JSWeakObjectMap requires the stored objects to be
+        either the result of JSObjectMake or the global object of a context ref
+        (AFAICS), which is ensured using an ASSERT. Objects created via
+        JSObjectMakeFunctionWithCalllback do not fall into the required
+        category, cause a failing assertion and can therefore not be stored in
+        the weak object map.
+
+        Consequently this patch removes the use of JSWeakObjectMap again and
+        goes back to the old way of using the internal Weak<> API, for the time
+        being. In a future patch the storage will be simplified to not require
+        the use of a weak object map cache for the run-time methods anymore.
+
+        * bridge/qt/qt_instance.cpp: Remove unused WeakMap code.
+        * bridge/qt/qt_instance.h: Remove method cache.
+        (QtInstance):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::prototypeForSignalsAndSlots):
+        (JSC::Bindings::QtRuntimeMethod::call):
+        (JSC::Bindings::QtRuntimeMethod::jsObjectRef):
+        (JSC::Bindings::QtRuntimeMethod::toRuntimeMethod):
+        (Bindings):
+        (JSC::Bindings::QtRuntimeMethod::connectOrDisconnect):
+        * bridge/qt/qt_runtime.h:
+        (QtRuntimeMethod): Remove unused member variables.
+
+2012-08-22  Christophe Dumez  <christophe.dumez@intel.com>
+
+        window.postMessage() / MessagePort.postMessage() throw wrong exception for invalid ports argument
+        https://bugs.webkit.org/show_bug.cgi?id=94581
+
+        Reviewed by Kentaro Hara.
+
+        Update JSC and V8 implementations of window.postMessage() and
+        MessagePort.postMessage() in order to throw an
+        INVALID_STATE_ERR instead of a DATA_CLONE_ERR when values
+        in the "ports" argument are invalid. Additionally, we now
+        check for duplicate ports and throw an exception for this
+        case as well.
+
+        This change was made to comply with the latest HTML5
+        specification at:
+        http://www.w3.org/TR/html5/comms.html
+
+        No new tests, already tested by:
+        fast/events/constructors/message-event-constructor.html
+        fast/events/message-port-clone.html
+        fast/events/message-port-multi.html
+        fast/workers/worker-context-multi-port.html
+        fast/workers/worker-multi-port.html
+
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::fillMessagePortArray):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::extractTransferables):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+
 2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
 
         [TouchAdjustment] Adjust to word or selection
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 394098616..761b21495 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -949,6 +949,7 @@ DerivedSources/WebCore/JS%.h: %.idl $(SCRIPTS_FOR_GENERATE_BINDINGS) $(WebCore)/
 $(webkitgtk_sources) $(webkit2_sources) $(webkit2_plugin_process_sources) $(webcore_sources) $(webcoregtk_sources) : | $(supplemental_dependency_file) $(webcore_built_sources)
 
 noinst_LTLIBRARIES += \
+	libWebCorePlatform.la \
 	libWebCoreModules.la \
 	libWebCore.la
 
@@ -960,24 +961,10 @@ $(webcore_lib_for_dep): $(srcdir)/Source/WebCore/GNUmakefile.am $(srcdir)/Source
 webcoremodules_lib_for_dep = libWebcoreModules.la
 $(webcoremodules_lib_for_dep): $(srcdir)/Source/WebCore/GNUmakefile.am $(srcdir)/Source/WebCore/GNUmakefile.list.am
 
-nodist_EXTRA_libWebCore_la_SOURCES = \
-	$(webcore_built_nosources)
-
-nodist_libWebCore_la_SOURCES = \
-	$(webcore_built_sources)
+webcoreplatform_lib_for_dep = libWebcorePlatform.la
+$(webcoreplatform_lib_for_dep): $(srcdir)/Source/WebCore/GNUmakefile.am $(srcdir)/Source/WebCore/GNUmakefile.list.am
 
-libWebCore_la_SOURCES = \
-	$(webcore_sources)
-
-libWebCore_la_CXXFLAGS = \
-	$(SYMBOL_VISIBILITY_INLINES) \
-	$(global_cxxflags)
-
-libWebCore_la_CFLAGS = \
-	$(SYMBOL_VISIBILITY) \
-	$(global_cflags)
-
-libWebCore_la_CPPFLAGS = \
+common_webcore_shards_cppflags += \
 	-DBUILDING_WEBKIT \
 	$(global_cppflags) \
 	$(webcore_cppflags) \
@@ -995,12 +982,31 @@ libWebCore_la_CPPFLAGS = \
 	$(LIBSOUP_CFLAGS) \
 	$(LIBXML_CFLAGS) \
 	$(LIBXSLT_CFLAGS) \
-	$(PANGO_CFLAGS) \
 	$(SQLITE3_CFLAGS) \
 	$(UNICODE_CFLAGS) \
 	$(XRENDER_CFLAGS) \
 	$(XT_CFLAGS)
 
+nodist_EXTRA_libWebCore_la_SOURCES = \
+	$(webcore_built_nosources)
+
+nodist_libWebCore_la_SOURCES = \
+	$(webcore_built_sources)
+
+libWebCore_la_SOURCES = \
+	$(webcore_sources)
+
+libWebCore_la_CXXFLAGS = \
+	$(SYMBOL_VISIBILITY_INLINES) \
+	$(global_cxxflags)
+
+libWebCore_la_CFLAGS = \
+	$(SYMBOL_VISIBILITY) \
+	$(global_cflags)
+
+libWebCore_la_CPPFLAGS = \
+	$(common_webcore_shards_cppflags)
+
 if TARGET_WIN32
 # PluginPackageWin.cpp needs the symbols from version dll
 libWebCore_la_LIBADD = -lversion
@@ -1015,6 +1021,21 @@ libWebCoreModules_la_CFLAGS = $(libWebCore_la_CFLAGS)
 
 libWebCoreModules_la_CPPFLAGS = $(libWebCore_la_CPPFLAGS)
 
+libWebCorePlatform_la_SOURCES = \
+	$(webcore_platform_sources)
+
+libWebCorePlatform_la_CXXFLAGS = \
+	$(SYMBOL_VISIBILITY_INLINES) \
+	$(global_cxxflags)
+
+libWebCorePlatform_la_CFLAGS = \
+	$(SYMBOL_VISIBILITY) \
+	$(global_cflags)
+
+libWebCorePlatform_la_CPPFLAGS = \
+	$(common_webcore_shards_cppflags) \
+	$(PANGO_CFLAGS)
+
 # We have a different library with only the files that require GTK+. It allows us
 # to build a common WebCore lib and two different gtk WebCore libs depending on
 # the gtk version. In WeKit2 gtk2 is not supported, but the plugin process needs to
@@ -1035,30 +1056,12 @@ libWebCoreGtk_la_CFLAGS = \
 	$(global_cflags)
 
 libWebCoreGtk_la_CPPFLAGS = \
-	-DBUILDING_WEBKIT \
-	$(global_cppflags) \
-	$(webcore_cppflags) \
-	$(webcoregtk_cppflags) \
-	$(javascriptcore_cppflags) \
-	-fno-strict-aliasing \
+	$(common_webcore_shards_cppflags) \
 	$(HILDON_CPPFLAGS) \
-	$(COVERAGE_CFLAGS) \
-	$(ENCHANT_CFLAGS) \
-	$(FARSTREAM_CFLAGS) \
-	$(GAIL_CFLAGS) \
-	$(GEOCLUE_CFLAGS) \
-	$(GLIB_CFLAGS) \
-	$(GSTREAMER_CFLAGS) \
-	$(GTK_CFLAGS) \
 	$(HILDON_CFLAGS) \
-	$(LIBSOUP_CFLAGS) \
-	$(LIBXML_CFLAGS) \
-	$(LIBXSLT_CFLAGS) \
-	$(SQLITE3_CFLAGS) \
-	$(UNICODE_CFLAGS) \
-	$(XCOMPOSITE_CFLAGS) \
-	$(XRENDER_CFLAGS) \
-	$(XT_CFLAGS)
+	$(GAIL_CFLAGS) \
+	$(FARSTREAM_CFLAGS)
+
 
 EXTRA_DIST += \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/filesystem/*.idl) \
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index b7336ccff..f57642056 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -624,8 +624,12 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSRequestAnimationFrameCallback.h \
 	DerivedSources/WebCore/JSRGBColor.cpp \
 	DerivedSources/WebCore/JSRGBColor.h \
+	DerivedSources/WebCore/JSRTCIceCandidate.cpp \
+	DerivedSources/WebCore/JSRTCIceCandidate.h \
 	DerivedSources/WebCore/JSRTCPeerConnection.cpp \
 	DerivedSources/WebCore/JSRTCPeerConnection.h \
+	DerivedSources/WebCore/JSRTCSessionDescription.cpp \
+	DerivedSources/WebCore/JSRTCSessionDescription.h \
 	DerivedSources/WebCore/JSScreen.cpp \
 	DerivedSources/WebCore/JSScreen.h \
 	DerivedSources/WebCore/JSScriptProfile.cpp \
@@ -1214,7 +1218,9 @@ dom_binding_idls += \
 	$(WebCore)/Modules/mediastream/NavigatorUserMediaErrorCallback.idl \
 	$(WebCore)/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl \
 	$(WebCore)/Modules/mediastream/PeerConnection00.idl \
+	$(WebCore)/Modules/mediastream/RTCIceCandidate.idl \
 	$(WebCore)/Modules/mediastream/RTCPeerConnection.idl \
+	$(WebCore)/Modules/mediastream/RTCSessionDescription.idl \
 	$(WebCore)/Modules/mediastream/SessionDescription.idl \
 	$(WebCore)/Modules/notifications/Notification.idl \
 	$(WebCore)/Modules/notifications/NotificationCenter.idl \
@@ -1899,8 +1905,12 @@ webcore_modules_sources += \
 	Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h \
 	Source/WebCore/Modules/mediastream/PeerConnection00.cpp \
 	Source/WebCore/Modules/mediastream/PeerConnection00.h \
+	Source/WebCore/Modules/mediastream/RTCIceCandidate.cpp \
+	Source/WebCore/Modules/mediastream/RTCIceCandidate.h \
 	Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp \
 	Source/WebCore/Modules/mediastream/RTCPeerConnection.h \
+	Source/WebCore/Modules/mediastream/RTCSessionDescription.cpp \
+	Source/WebCore/Modules/mediastream/RTCSessionDescription.h \
 	Source/WebCore/Modules/mediastream/SessionDescription.cpp \
 	Source/WebCore/Modules/mediastream/SessionDescription.h \
 	Source/WebCore/Modules/mediastream/UserMediaClient.h \
@@ -4032,739 +4042,6 @@ webcore_sources += \
 	Source/WebCore/page/WindowFocusAllowedIndicator.h \
 	Source/WebCore/page/WorkerNavigator.cpp \
 	Source/WebCore/page/WorkerNavigator.h \
-	Source/WebCore/platform/animation/Animation.cpp \
-	Source/WebCore/platform/animation/Animation.h \
-	Source/WebCore/platform/animation/AnimationList.cpp \
-	Source/WebCore/platform/animation/AnimationList.h \
-	Source/WebCore/platform/animation/AnimationUtilities.h \
-	Source/WebCore/platform/animation/TimingFunction.h \
-	Source/WebCore/platform/audio/AudioArray.h \
-	Source/WebCore/platform/audio/AudioBus.cpp \
-	Source/WebCore/platform/audio/AudioBus.h \
-	Source/WebCore/platform/audio/AudioChannel.cpp \
-	Source/WebCore/platform/audio/AudioChannel.h \
-	Source/WebCore/platform/audio/AudioDestination.h \
-	Source/WebCore/platform/audio/AudioDSPKernel.h \
-	Source/WebCore/platform/audio/AudioDSPKernelProcessor.cpp \
-	Source/WebCore/platform/audio/AudioDSPKernelProcessor.h \
-	Source/WebCore/platform/audio/AudioFileReader.h \
-	Source/WebCore/platform/audio/AudioIOCallback.h \
-	Source/WebCore/platform/audio/AudioProcessor.h \
-	Source/WebCore/platform/audio/AudioResampler.cpp \
-	Source/WebCore/platform/audio/AudioResampler.h \
-	Source/WebCore/platform/audio/AudioResamplerKernel.cpp \
-	Source/WebCore/platform/audio/AudioResamplerKernel.h \
-	Source/WebCore/platform/audio/AudioSourceProvider.h \
-	Source/WebCore/platform/audio/AudioSourceProviderClient.h \
-	Source/WebCore/platform/audio/AudioUtilities.cpp \
-	Source/WebCore/platform/audio/AudioUtilities.h \
-	Source/WebCore/platform/audio/Biquad.cpp \
-	Source/WebCore/platform/audio/Biquad.h \
-	Source/WebCore/platform/audio/Cone.cpp \
-	Source/WebCore/platform/audio/Cone.h \
-	Source/WebCore/platform/audio/DenormalDisabler.h \
-	Source/WebCore/platform/audio/DirectConvolver.cpp \
-	Source/WebCore/platform/audio/DirectConvolver.h \
-	Source/WebCore/platform/audio/Distance.cpp \
-	Source/WebCore/platform/audio/Distance.h \
-	Source/WebCore/platform/audio/DynamicsCompressor.h \
-	Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp \
-	Source/WebCore/platform/audio/DynamicsCompressorKernel.h \
-	Source/WebCore/platform/audio/DynamicsCompressor.cpp \
-	Source/WebCore/platform/audio/EqualPowerPanner.cpp \
-	Source/WebCore/platform/audio/EqualPowerPanner.h \
-	Source/WebCore/platform/audio/FFTConvolver.cpp \
-	Source/WebCore/platform/audio/FFTConvolver.h \
-	Source/WebCore/platform/audio/FFTFrame.cpp \
-	Source/WebCore/platform/audio/FFTFrame.h \
-	Source/WebCore/platform/audio/FFTFrameStub.cpp \
-	Source/WebCore/platform/audio/HRTFDatabase.cpp \
-	Source/WebCore/platform/audio/HRTFDatabase.h \
-	Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp \
-	Source/WebCore/platform/audio/HRTFDatabaseLoader.h \
-	Source/WebCore/platform/audio/HRTFElevation.cpp \
-	Source/WebCore/platform/audio/HRTFElevation.h \
-	Source/WebCore/platform/audio/HRTFKernel.cpp \
-	Source/WebCore/platform/audio/HRTFKernel.h \
-	Source/WebCore/platform/audio/HRTFPanner.cpp \
-	Source/WebCore/platform/audio/HRTFPanner.h \
-	Source/WebCore/platform/audio/MultiChannelResampler.cpp \
-	Source/WebCore/platform/audio/MultiChannelResampler.h \
-	Source/WebCore/platform/audio/Panner.cpp \
-	Source/WebCore/platform/audio/Panner.h \
-	Source/WebCore/platform/audio/ReverbAccumulationBuffer.cpp \
-	Source/WebCore/platform/audio/ReverbAccumulationBuffer.h \
-	Source/WebCore/platform/audio/ReverbConvolver.cpp \
-	Source/WebCore/platform/audio/ReverbConvolver.h \
-	Source/WebCore/platform/audio/ReverbConvolverStage.cpp \
-	Source/WebCore/platform/audio/ReverbConvolverStage.h \
-	Source/WebCore/platform/audio/Reverb.cpp \
-	Source/WebCore/platform/audio/Reverb.h \
-	Source/WebCore/platform/audio/ReverbInputBuffer.cpp \
-	Source/WebCore/platform/audio/ReverbInputBuffer.h \
-	Source/WebCore/platform/audio/SincResampler.cpp \
-	Source/WebCore/platform/audio/SincResampler.h \
-	Source/WebCore/platform/audio/VectorMath.cpp \
-	Source/WebCore/platform/audio/VectorMath.h \
-	Source/WebCore/platform/audio/ZeroPole.cpp \
-	Source/WebCore/platform/audio/ZeroPole.h \
-	Source/WebCore/platform/ActivePlatformGestureAnimation.cpp \
-	Source/WebCore/platform/ActivePlatformGestureAnimation.h \
-	Source/WebCore/platform/PlatformGestureCurve.h \
-	Source/WebCore/platform/PlatformGestureCurveTarget.h \
-	Source/WebCore/platform/Arena.cpp \
-	Source/WebCore/platform/Arena.h \
-	Source/WebCore/platform/AsyncFileSystem.cpp \
-	Source/WebCore/platform/AsyncFileSystem.h \
-	Source/WebCore/platform/AutodrainedPool.h \
-	Source/WebCore/platform/CalculationValue.cpp \
-	Source/WebCore/platform/CalculationValue.h \
-	Source/WebCore/platform/Clock.cpp \
-	Source/WebCore/platform/Clock.h \
-	Source/WebCore/platform/ClockGeneric.cpp \
-	Source/WebCore/platform/ClockGeneric.h \
-	Source/WebCore/platform/ColorChooser.h \
-	Source/WebCore/platform/ColorChooserClient.h \
-	Source/WebCore/platform/ContentType.cpp \
-	Source/WebCore/platform/ContentType.h \
-	Source/WebCore/platform/ContextMenu.h \
-	Source/WebCore/platform/ContextMenuItem.h \
-	Source/WebCore/platform/Cookie.h \
-	Source/WebCore/platform/CookiesStrategy.h \
-	Source/WebCore/platform/CookieJar.h \
-	Source/WebCore/platform/CrossThreadCopier.cpp \
-	Source/WebCore/platform/CrossThreadCopier.h \
-	Source/WebCore/platform/Cursor.cpp \
-	Source/WebCore/platform/Cursor.h \
-	Source/WebCore/platform/DateComponents.cpp \
-	Source/WebCore/platform/DateComponents.h \
-	Source/WebCore/platform/Decimal.cpp \
-	Source/WebCore/platform/Decimal.h \
-	Source/WebCore/platform/DragData.cpp \
-	Source/WebCore/platform/DragData.h \
-	Source/WebCore/platform/DragImage.cpp \
-	Source/WebCore/platform/DragImage.h \
-	Source/WebCore/platform/EventLoop.h \
-	Source/WebCore/platform/EventTracer.cpp \
-	Source/WebCore/platform/EventTracer.h \
-	Source/WebCore/platform/PlatformInstrumentation.cpp \
-	Source/WebCore/platform/PlatformInstrumentation.h \
-	Source/WebCore/platform/FileChooser.cpp \
-	Source/WebCore/platform/FileChooser.h \
-	Source/WebCore/platform/FileIconLoader.cpp \
-	Source/WebCore/platform/FileIconLoader.h \
-	Source/WebCore/platform/FileMetadata.h \
-	Source/WebCore/platform/FileStreamClient.h \
-	Source/WebCore/platform/FileStream.cpp \
-	Source/WebCore/platform/FileStream.h \
-	Source/WebCore/platform/FileSystem.cpp \
-	Source/WebCore/platform/FileSystem.h \
-	Source/WebCore/platform/FloatConversion.h \
-	Source/WebCore/platform/FractionalLayoutUnit.h \
-	Source/WebCore/platform/Gamepads.h \
-	Source/WebCore/platform/HashTools.h \
-	Source/WebCore/platform/HistogramSupport.cpp \
-	Source/WebCore/platform/HistogramSupport.h \
-	Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp \
-	Source/WebCore/platform/graphics/ANGLEWebKitBridge.h \
-	Source/WebCore/platform/graphics/BitmapImage.cpp \
-	Source/WebCore/platform/graphics/BitmapImage.h \
-	Source/WebCore/platform/graphics/Color.cpp \
-	Source/WebCore/platform/graphics/Color.h \
-	Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp \
-	Source/WebCore/platform/graphics/CrossfadeGeneratedImage.h \
-	Source/WebCore/platform/graphics/ColorSpace.h \
-	Source/WebCore/platform/graphics/DashArray.h \
-	Source/WebCore/platform/graphics/Extensions3D.h \
-	Source/WebCore/platform/graphics/NativeImagePtr.h \
-	Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp \
-	Source/WebCore/platform/graphics/cairo/CairoUtilities.h \
-	Source/WebCore/platform/graphics/cairo/FloatRectCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/FontCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h \
-	Source/WebCore/platform/graphics/cairo/GradientCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/ImageBufferDataCairo.h \
-	Source/WebCore/platform/graphics/cairo/ImageCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/IntRectCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/NativeImageCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/NativeImageCairo.h \
-	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h \
-	Source/WebCore/platform/graphics/cairo/PathCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/PatternCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h \
-	Source/WebCore/platform/graphics/cairo/PlatformPathCairo.h \
-	Source/WebCore/platform/graphics/cairo/PlatformPathCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp \
-	Source/WebCore/platform/graphics/cairo/RefPtrCairo.h \
-	Source/WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterMesh.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterOperation.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterParameter.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterProgram.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h \
-	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp \
-	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h \
-	Source/WebCore/platform/graphics/filters/DistantLightSource.cpp \
-	Source/WebCore/platform/graphics/filters/DistantLightSource.h \
-	Source/WebCore/platform/graphics/filters/FEBlend.cpp \
-	Source/WebCore/platform/graphics/filters/FEBlend.h \
-	Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp \
-	Source/WebCore/platform/graphics/filters/FEColorMatrix.h \
-	Source/WebCore/platform/graphics/filters/FEComponentTransfer.cpp \
-	Source/WebCore/platform/graphics/filters/FEComponentTransfer.h \
-	Source/WebCore/platform/graphics/filters/FEComposite.cpp \
-	Source/WebCore/platform/graphics/filters/FEComposite.h \
-	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp \
-	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h \
-	Source/WebCore/platform/graphics/filters/FECustomFilter.cpp \
-	Source/WebCore/platform/graphics/filters/FECustomFilter.h \
-	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp \
-	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h \
-	Source/WebCore/platform/graphics/filters/FEDisplacementMap.cpp \
-	Source/WebCore/platform/graphics/filters/FEDisplacementMap.h \
-	Source/WebCore/platform/graphics/filters/FEDropShadow.cpp \
-	Source/WebCore/platform/graphics/filters/FEDropShadow.h \
-	Source/WebCore/platform/graphics/filters/FEFlood.cpp \
-	Source/WebCore/platform/graphics/filters/FEFlood.h \
-	Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp \
-	Source/WebCore/platform/graphics/filters/FEGaussianBlur.h \
-	Source/WebCore/platform/graphics/filters/FELighting.cpp \
-	Source/WebCore/platform/graphics/filters/FELighting.h \
-	Source/WebCore/platform/graphics/filters/FEMerge.cpp \
-	Source/WebCore/platform/graphics/filters/FEMerge.h \
-	Source/WebCore/platform/graphics/filters/FEMorphology.cpp \
-	Source/WebCore/platform/graphics/filters/FEMorphology.h \
-	Source/WebCore/platform/graphics/filters/FEOffset.cpp \
-	Source/WebCore/platform/graphics/filters/FEOffset.h \
-	Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp \
-	Source/WebCore/platform/graphics/filters/FESpecularLighting.h \
-	Source/WebCore/platform/graphics/filters/FETile.cpp \
-	Source/WebCore/platform/graphics/filters/FETile.h \
-	Source/WebCore/platform/graphics/filters/FETurbulence.cpp \
-	Source/WebCore/platform/graphics/filters/FETurbulence.h \
-	Source/WebCore/platform/graphics/filters/Filter.h \
-	Source/WebCore/platform/graphics/filters/FilterEffect.cpp \
-	Source/WebCore/platform/graphics/filters/FilterEffect.h \
-	Source/WebCore/platform/graphics/filters/FilterOperation.h \
-	Source/WebCore/platform/graphics/filters/FilterOperation.cpp \
-	Source/WebCore/platform/graphics/filters/FilterOperations.cpp \
-	Source/WebCore/platform/graphics/filters/FilterOperations.h \
-	Source/WebCore/platform/graphics/filters/LightSource.cpp \
-	Source/WebCore/platform/graphics/filters/LightSource.h \
-	Source/WebCore/platform/graphics/filters/PointLightSource.cpp \
-	Source/WebCore/platform/graphics/filters/PointLightSource.h \
-	Source/WebCore/platform/graphics/filters/SourceAlpha.cpp \
-	Source/WebCore/platform/graphics/filters/SourceAlpha.h \
-	Source/WebCore/platform/graphics/filters/SourceGraphic.cpp \
-	Source/WebCore/platform/graphics/filters/SourceGraphic.h \
-	Source/WebCore/platform/graphics/filters/SpotLightSource.cpp \
-	Source/WebCore/platform/graphics/filters/SpotLightSource.h \
-	Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h \
-	Source/WebCore/platform/graphics/filters/arm/FEBlendNEON.h \
-	Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h \
-	Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h \
-	Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp \
-	Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h \
-	Source/WebCore/platform/graphics/FloatPoint3D.cpp \
-	Source/WebCore/platform/graphics/FloatPoint3D.h \
-	Source/WebCore/platform/graphics/FloatPoint.cpp \
-	Source/WebCore/platform/graphics/FloatPoint.h \
-	Source/WebCore/platform/graphics/FloatQuad.cpp \
-	Source/WebCore/platform/graphics/FloatQuad.h \
-	Source/WebCore/platform/graphics/FloatRect.cpp \
-	Source/WebCore/platform/graphics/FloatRect.h \
-	Source/WebCore/platform/graphics/FloatSize.cpp \
-	Source/WebCore/platform/graphics/FloatSize.h \
-	Source/WebCore/platform/graphics/FontBaseline.h \
-	Source/WebCore/platform/graphics/FontCache.cpp \
-	Source/WebCore/platform/graphics/FontCache.h \
-	Source/WebCore/platform/graphics/Font.cpp \
-	Source/WebCore/platform/graphics/FontData.cpp \
-	Source/WebCore/platform/graphics/FontData.h \
-	Source/WebCore/platform/graphics/FontDescription.cpp \
-	Source/WebCore/platform/graphics/FontDescription.h \
-	Source/WebCore/platform/graphics/FontFallbackList.cpp \
-	Source/WebCore/platform/graphics/FontFallbackList.h \
-	Source/WebCore/platform/graphics/FontFamily.cpp \
-	Source/WebCore/platform/graphics/FontFamily.h \
-	Source/WebCore/platform/graphics/FontFastPath.cpp \
-	Source/WebCore/platform/graphics/FontFeatureSettings.cpp \
-	Source/WebCore/platform/graphics/FontFeatureSettings.h \
-	Source/WebCore/platform/graphics/Font.h \
-	Source/WebCore/platform/graphics/FontMetrics.h \
-	Source/WebCore/platform/graphics/FontOrientation.h \
-	Source/WebCore/platform/graphics/FontPlatformData.h \
-	Source/WebCore/platform/graphics/FontRenderingMode.h \
-	Source/WebCore/platform/graphics/FontSelector.h \
-	Source/WebCore/platform/graphics/FontSmoothingMode.h \
-	Source/WebCore/platform/graphics/FontTraitsMask.h \
-	Source/WebCore/platform/graphics/FontWidthVariant.h \
-	Source/WebCore/platform/graphics/FractionalLayoutBoxExtent.cpp \
-	Source/WebCore/platform/graphics/FractionalLayoutBoxExtent.h \
-	Source/WebCore/platform/graphics/FractionalLayoutPoint.h \
-	Source/WebCore/platform/graphics/FractionalLayoutRect.cpp \
-	Source/WebCore/platform/graphics/FractionalLayoutRect.h \
-	Source/WebCore/platform/graphics/FractionalLayoutSize.h \
-	Source/WebCore/platform/graphics/GeneratorGeneratedImage.cpp \
-	Source/WebCore/platform/graphics/GeneratorGeneratedImage.h \
-	Source/WebCore/platform/graphics/GeneratedImage.h \
-	Source/WebCore/platform/graphics/Generator.h \
-	Source/WebCore/platform/graphics/Glyph.h \
-	Source/WebCore/platform/graphics/GlyphBuffer.h \
-	Source/WebCore/platform/graphics/GlyphMetricsMap.h \
-	Source/WebCore/platform/graphics/GlyphPage.h \
-	Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp \
-	Source/WebCore/platform/graphics/GlyphPageTreeNode.h \
-	Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp \
-	Source/WebCore/platform/graphics/gpu/DrawingBuffer.h \
-	Source/WebCore/platform/graphics/Gradient.cpp \
-	Source/WebCore/platform/graphics/Gradient.h \
-	Source/WebCore/platform/graphics/GraphicsContext.cpp \
-	Source/WebCore/platform/graphics/GraphicsContext.h \
-	Source/WebCore/platform/graphics/GraphicsContext3D.cpp \
-	Source/WebCore/platform/graphics/GraphicsContext3D.h \
-	Source/WebCore/platform/graphics/GraphicsLayer.h \
-	Source/WebCore/platform/graphics/GraphicsLayer.cpp \
-	Source/WebCore/platform/graphics/GraphicsLayerClient.h \
-	Source/WebCore/platform/graphics/GraphicsTypes.cpp \
-	Source/WebCore/platform/graphics/GraphicsTypes.h \
-	Source/WebCore/platform/graphics/GraphicsTypes3D.h \
-	Source/WebCore/platform/graphics/Icon.h \
-	Source/WebCore/platform/graphics/ImageBuffer.cpp \
-	Source/WebCore/platform/graphics/ImageBuffer.h \
-	Source/WebCore/platform/graphics/ImageBufferData.h \
-	Source/WebCore/platform/graphics/Image.cpp \
-	Source/WebCore/platform/graphics/Image.h \
-	Source/WebCore/platform/graphics/ImageObserver.h \
-	Source/WebCore/platform/graphics/ImageOrientation.cpp \
-	Source/WebCore/platform/graphics/ImageOrientation.h \
-	Source/WebCore/platform/graphics/ImageSource.cpp \
-	Source/WebCore/platform/graphics/ImageSource.h \
-	Source/WebCore/platform/graphics/IntPoint.h \
-	Source/WebCore/platform/graphics/IntPointHash.h \
-	Source/WebCore/platform/graphics/IntRect.cpp \
-	Source/WebCore/platform/graphics/IntRect.h \
-	Source/WebCore/platform/graphics/IntSize.h \
-	Source/WebCore/platform/graphics/IntSizeHash.h \
-	Source/WebCore/platform/graphics/MediaPlayer.cpp \
-	Source/WebCore/platform/graphics/MediaPlayer.h \
-	Source/WebCore/platform/graphics/MediaPlayerPrivate.h \
-	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp \
-	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h \
-	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp \
-	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h \
-	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp \
-	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp \
-	Source/WebCore/platform/graphics/OpenGLShims.cpp \
-	Source/WebCore/platform/graphics/OpenGLShims.h \
-	Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.h \
-	Source/WebCore/platform/graphics/Path.cpp \
-	Source/WebCore/platform/graphics/Path.h \
-	Source/WebCore/platform/graphics/PathTraversalState.cpp \
-	Source/WebCore/platform/graphics/PathTraversalState.h \
-	Source/WebCore/platform/graphics/Pattern.cpp \
-	Source/WebCore/platform/graphics/Pattern.h \
-	Source/WebCore/platform/graphics/PlatformLayer.h \
-	Source/WebCore/platform/graphics/Region.cpp \
-	Source/WebCore/platform/graphics/Region.h \
-	Source/WebCore/platform/graphics/RoundedRect.cpp \
-	Source/WebCore/platform/graphics/RoundedRect.h \
-	Source/WebCore/platform/graphics/SegmentedFontData.cpp \
-	Source/WebCore/platform/graphics/SegmentedFontData.h \
-	Source/WebCore/platform/graphics/ShadowBlur.cpp \
-	Source/WebCore/platform/graphics/ShadowBlur.h \
-	Source/WebCore/platform/graphics/SimpleFontData.cpp \
-	Source/WebCore/platform/graphics/SimpleFontData.h \
-	Source/WebCore/platform/graphics/StringTruncator.cpp \
-	Source/WebCore/platform/graphics/StringTruncator.h \
-	Source/WebCore/platform/graphics/StrokeStyleApplier.h \
-	Source/WebCore/platform/graphics/SurrogatePairAwareTextIterator.cpp \
-	Source/WebCore/platform/graphics/SurrogatePairAwareTextIterator.h \
-	Source/WebCore/platform/graphics/SVGGlyph.cpp \
-	Source/WebCore/platform/graphics/SVGGlyph.h \
-	Source/WebCore/platform/graphics/TextRenderingMode.h \
-	Source/WebCore/platform/graphics/TextRun.cpp \
-	Source/WebCore/platform/graphics/TextRun.h \
-	Source/WebCore/platform/graphics/TiledBacking.h \
-	Source/WebCore/platform/graphics/transforms/AffineTransform.cpp \
-	Source/WebCore/platform/graphics/transforms/AffineTransform.h \
-	Source/WebCore/platform/graphics/transforms/IdentityTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp \
-	Source/WebCore/platform/graphics/transforms/TransformationMatrix.h \
-	Source/WebCore/platform/graphics/transforms/TransformOperation.h \
-	Source/WebCore/platform/graphics/transforms/TransformOperations.cpp \
-	Source/WebCore/platform/graphics/transforms/TransformOperations.h \
-	Source/WebCore/platform/graphics/transforms/TransformState.cpp \
-	Source/WebCore/platform/graphics/transforms/TransformState.h \
-	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp \
-	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.h \
-	Source/WebCore/platform/graphics/TypesettingFeatures.h \
-	Source/WebCore/platform/graphics/UnitBezier.h \
-	Source/WebCore/platform/graphics/WidthIterator.cpp \
-	Source/WebCore/platform/graphics/WidthIterator.h \
-	Source/WebCore/platform/graphics/WindRule.h \
-	Source/WebCore/platform/graphics/WOFFFileFormat.cpp \
-	Source/WebCore/platform/graphics/WOFFFileFormat.h \
-	Source/WebCore/platform/gtk/ErrorsGtk.cpp \
-	Source/WebCore/platform/gtk/ErrorsGtk.h \
-	Source/WebCore/platform/gtk/GamepadsGtk.cpp \
-	Source/WebCore/platform/gtk/KURLGtk.cpp \
-	Source/WebCore/platform/gtk/LanguageGtk.cpp \
-	Source/WebCore/platform/gtk/LoggingGtk.cpp \
-	Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp \
-	Source/WebCore/platform/gtk/SharedBufferGtk.cpp \
-	Source/WebCore/platform/gtk/TemporaryLinkStubs.cpp \
-	Source/WebCore/platform/HostWindow.h \
-	Source/WebCore/platform/KillRing.h \
-	Source/WebCore/platform/KillRingNone.cpp \
-	Source/WebCore/platform/KURL.cpp \
-	Source/WebCore/platform/KURL.h \
-	Source/WebCore/platform/KURLHash.h \
-	Source/WebCore/platform/KURLWTFURL.cpp \
-	Source/WebCore/platform/KURLWTFURLImpl.h \
-	Source/WebCore/platform/Language.cpp \
-	Source/WebCore/platform/Language.h \
-	Source/WebCore/platform/LengthBox.cpp \
-	Source/WebCore/platform/LengthBox.h \
-	Source/WebCore/platform/Length.cpp \
-	Source/WebCore/platform/Length.h \
-	Source/WebCore/platform/LengthSize.h \
-	Source/WebCore/platform/leveldb/LevelDBComparator.h \
-	Source/WebCore/platform/leveldb/LevelDBDatabase.cpp \
-	Source/WebCore/platform/leveldb/LevelDBDatabase.h \
-	Source/WebCore/platform/leveldb/LevelDBIterator.h \
-	Source/WebCore/platform/leveldb/LevelDBSlice.h \
-	Source/WebCore/platform/leveldb/LevelDBTransaction.h \
-	Source/WebCore/platform/leveldb/LevelDBTransaction.cpp \
-	Source/WebCore/platform/leveldb/LevelDBWriteBatch.h \
-	Source/WebCore/platform/leveldb/LevelDBWriteBatch.cpp \
-	Source/WebCore/platform/LinkHash.cpp \
-	Source/WebCore/platform/LinkHash.h \
-	Source/WebCore/platform/LocalizedStrings.h \
-	Source/WebCore/platform/Logging.cpp \
-	Source/WebCore/platform/Logging.h \
-	Source/WebCore/platform/MIMETypeRegistry.cpp \
-	Source/WebCore/platform/MIMETypeRegistry.h \
-	Source/WebCore/platform/MemoryPressureHandler.cpp \
-	Source/WebCore/platform/MemoryPressureHandler.h \
-	Source/WebCore/platform/MemoryUsageSupport.cpp \
-	Source/WebCore/platform/MemoryUsageSupport.h \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp \
-	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.h \
-	Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp \
-	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.h \
-	Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp \
-	Source/WebCore/platform/image-decoders/gif/GIFImageReader.h \
-	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.h \
-	Source/WebCore/platform/image-decoders/ImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/ImageDecoder.h \
-	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h \
-	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h \
-	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
-	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h \
-	Source/WebCore/platform/LayoutTestSupport.cpp \
-	Source/WebCore/platform/LayoutTestSupport.h \
-	Source/WebCore/platform/linux/GamepadDeviceLinux.cpp \
-	Source/WebCore/platform/linux/GamepadDeviceLinux.h \
-	Source/WebCore/platform/mediastream/IceCandidateDescriptor.cpp \
-	Source/WebCore/platform/mediastream/IceCandidateDescriptor.h \
-	Source/WebCore/platform/mediastream/IceOptions.cpp \
-	Source/WebCore/platform/mediastream/IceOptions.h \
-	Source/WebCore/platform/mediastream/MediaHints.cpp \
-	Source/WebCore/platform/mediastream/MediaHints.h \
-	Source/WebCore/platform/mediastream/MediaStreamCenter.cpp \
-	Source/WebCore/platform/mediastream/MediaStreamCenter.h \
-	Source/WebCore/platform/mediastream/MediaStreamComponent.h \
-	Source/WebCore/platform/mediastream/MediaStreamDescriptor.h \
-	Source/WebCore/platform/mediastream/MediaStreamSource.cpp \
-	Source/WebCore/platform/mediastream/MediaStreamSource.h \
-	Source/WebCore/platform/mediastream/MediaStreamSourcesQueryClient.h \
-	Source/WebCore/platform/mediastream/PeerConnection00Handler.cpp \
-	Source/WebCore/platform/mediastream/PeerConnection00Handler.h \
-	Source/WebCore/platform/mediastream/PeerConnection00HandlerClient.h \
-	Source/WebCore/platform/mediastream/RTCConfiguration.h \
-	Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.cpp \
-	Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.h \
-	Source/WebCore/platform/mediastream/RTCPeerConnectionHandlerClient.h \
-	Source/WebCore/platform/mediastream/SessionDescriptionDescriptor.cpp \
-	Source/WebCore/platform/mediastream/SessionDescriptionDescriptor.h \
-	Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp \
-	Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h \
-	Source/WebCore/platform/mock/DeviceMotionClientMock.cpp \
-	Source/WebCore/platform/mock/DeviceMotionClientMock.h \
-	Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp \
-	Source/WebCore/platform/mock/DeviceOrientationClientMock.h \
-	Source/WebCore/platform/mock/GeolocationClientMock.cpp \
-	Source/WebCore/platform/mock/GeolocationClientMock.h \
-	Source/WebCore/platform/mock/ScrollbarThemeMock.cpp \
-	Source/WebCore/platform/mock/ScrollbarThemeMock.h \
-	Source/WebCore/platform/network/AuthenticationChallengeBase.cpp \
-	Source/WebCore/platform/network/AuthenticationChallengeBase.h \
-	Source/WebCore/platform/network/AuthenticationClient.h \
-	Source/WebCore/platform/network/BlobData.cpp \
-	Source/WebCore/platform/network/BlobData.h \
-	Source/WebCore/platform/network/BlobRegistry.h \
-	Source/WebCore/platform/network/BlobRegistryImpl.cpp \
-	Source/WebCore/platform/network/BlobRegistryImpl.h \
-	Source/WebCore/platform/network/BlobResourceHandle.cpp \
-	Source/WebCore/platform/network/BlobResourceHandle.h \
-	Source/WebCore/platform/network/BlobStorageData.h \
-	Source/WebCore/platform/network/ContentTypeParser.cpp \
-	Source/WebCore/platform/network/ContentTypeParser.h \
-	Source/WebCore/platform/network/CookieStorage.h \
-	Source/WebCore/platform/network/Credential.cpp \
-	Source/WebCore/platform/network/Credential.h \
-	Source/WebCore/platform/network/CredentialStorage.cpp \
-	Source/WebCore/platform/network/CredentialStorage.h \
-	Source/WebCore/platform/network/DNS.h \
-	Source/WebCore/platform/network/DNSResolveQueue.cpp \
-	Source/WebCore/platform/network/DNSResolveQueue.h \
-	Source/WebCore/platform/network/FormDataBuilder.cpp \
-	Source/WebCore/platform/network/FormDataBuilder.h \
-	Source/WebCore/platform/network/FormData.cpp \
-	Source/WebCore/platform/network/FormData.h \
-	Source/WebCore/platform/network/HTTPHeaderMap.cpp \
-	Source/WebCore/platform/network/HTTPHeaderMap.h \
-	Source/WebCore/platform/network/HTTPParsers.cpp \
-	Source/WebCore/platform/network/HTTPParsers.h \
-	Source/WebCore/platform/network/HTTPRequest.cpp \
-	Source/WebCore/platform/network/HTTPRequest.h \
-	Source/WebCore/platform/network/HTTPValidation.cpp \
-	Source/WebCore/platform/network/HTTPValidation.h \
-	Source/WebCore/platform/network/MIMEHeader.cpp \
-	Source/WebCore/platform/network/MIMEHeader.h \
-	Source/WebCore/platform/network/NetworkingContext.h \
-	Source/WebCore/platform/network/ProxyServer.cpp \
-	Source/WebCore/platform/network/ProxyServer.h \
-	Source/WebCore/platform/network/NetworkStateNotifier.cpp \
-	Source/WebCore/platform/network/NetworkStateNotifier.h \
-	Source/WebCore/platform/network/ProtectionSpaceHash.h \
-	Source/WebCore/platform/network/ProtectionSpace.cpp \
-	Source/WebCore/platform/network/ProtectionSpace.h \
-	Source/WebCore/platform/network/ResourceErrorBase.cpp \
-	Source/WebCore/platform/network/ResourceErrorBase.h \
-	Source/WebCore/platform/network/ResourceHandleClient.h \
-	Source/WebCore/platform/network/ResourceHandle.cpp \
-	Source/WebCore/platform/network/ResourceHandle.h \
-	Source/WebCore/platform/network/ResourceHandleInternal.h \
-	Source/WebCore/platform/network/ResourceLoadInfo.h \
-	Source/WebCore/platform/network/ResourceLoadPriority.h \
-	Source/WebCore/platform/network/ResourceLoadTiming.cpp \
-	Source/WebCore/platform/network/ResourceLoadTiming.h \
-	Source/WebCore/platform/network/ResourceRequestBase.cpp \
-	Source/WebCore/platform/network/ResourceRequestBase.h \
-	Source/WebCore/platform/network/ResourceResponseBase.cpp \
-	Source/WebCore/platform/network/ResourceResponseBase.h \
-	Source/WebCore/platform/network/SocketStreamErrorBase.cpp \
-	Source/WebCore/platform/network/SocketStreamErrorBase.h \
-	Source/WebCore/platform/network/SocketStreamHandleBase.cpp \
-	Source/WebCore/platform/network/SocketStreamHandleBase.h \
-	Source/WebCore/platform/network/SocketStreamHandleClient.h \
-	Source/WebCore/platform/network/soup/AuthenticationChallenge.h \
-	Source/WebCore/platform/network/soup/CookieJarSoup.cpp \
-	Source/WebCore/platform/network/soup/CookieJarSoup.h \
-	Source/WebCore/platform/network/soup/CookieStorageSoup.cpp \
-	Source/WebCore/platform/network/soup/CredentialStorageSoup.cpp \
-	Source/WebCore/platform/network/soup/DNSSoup.cpp \
-	Source/WebCore/platform/network/soup/GOwnPtrSoup.cpp \
-	Source/WebCore/platform/network/soup/GOwnPtrSoup.h \
-	Source/WebCore/platform/network/soup/ProxyServerSoup.cpp \
-	Source/WebCore/platform/network/soup/ResourceError.h \
-	Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp \
-	Source/WebCore/platform/network/soup/ResourceRequest.h \
-	Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp \
-	Source/WebCore/platform/network/soup/ResourceResponse.h \
-	Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp \
-	Source/WebCore/platform/network/soup/SocketStreamError.h \
-	Source/WebCore/platform/network/soup/SocketStreamHandle.h \
-	Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp \
-	Source/WebCore/platform/network/soup/SoupURIUtils.cpp \
-	Source/WebCore/platform/network/soup/SoupURIUtils.h \
-	Source/WebCore/platform/NotImplemented.h \
-	Source/WebCore/platform/Pasteboard.h \
-	Source/WebCore/platform/PasteboardStrategy.h \
-	Source/WebCore/platform/PlatformEvent.cpp \
-	Source/WebCore/platform/PlatformEvent.h \
-	Source/WebCore/platform/PlatformExportMacros.h \
-	Source/WebCore/platform/PlatformGestureCurve.h \
-	Source/WebCore/platform/PlatformGestureEvent.h \
-	Source/WebCore/platform/PlatformKeyboardEvent.h \
-	Source/WebCore/platform/PlatformMenuDescription.h \
-	Source/WebCore/platform/PlatformMouseEvent.h \
-	Source/WebCore/platform/PlatformPasteboard.h \
-	Source/WebCore/platform/PlatformScreen.h \
-	Source/WebCore/platform/PlatformStrategies.cpp \
-	Source/WebCore/platform/PlatformStrategies.h \
-	Source/WebCore/platform/PlatformWheelEvent.h \
-	Source/WebCore/platform/PODArena.h \
-	Source/WebCore/platform/PODFreeListArena.h \
-	Source/WebCore/platform/PODInterval.h \
-	Source/WebCore/platform/PODIntervalTree.h \
-	Source/WebCore/platform/PODRedBlackTree.h \
-	Source/WebCore/platform/PopupMenuClient.h \
-	Source/WebCore/platform/PopupMenu.h \
-	Source/WebCore/platform/PopupMenuStyle.h \
-	Source/WebCore/platform/PrerenderHandle.h \
-	Source/WebCore/platform/PurgeableBuffer.h \
-	Source/WebCore/platform/PurgePriority.h \
-	Source/WebCore/platform/RefCountedSupplement.h \
-	Source/WebCore/platform/ReferrerPolicy.h \
-	Source/WebCore/platform/RunLoop.cpp \
-	Source/WebCore/platform/RunLoop.h \
-	Source/WebCore/platform/RuntimeApplicationChecks.cpp \
-	Source/WebCore/platform/RuntimeApplicationChecks.h \
-	Source/WebCore/platform/SchemeRegistry.cpp \
-	Source/WebCore/platform/SchemeRegistry.h \
-	Source/WebCore/platform/ScrollAnimator.cpp \
-	Source/WebCore/platform/ScrollAnimator.h \
-	Source/WebCore/platform/ScrollAnimatorNone.cpp \
-	Source/WebCore/platform/ScrollAnimatorNone.h \
-	Source/WebCore/platform/ScrollableArea.cpp \
-	Source/WebCore/platform/ScrollableArea.h \
-	Source/WebCore/platform/Scrollbar.cpp \
-	Source/WebCore/platform/Scrollbar.h \
-	Source/WebCore/platform/ScrollbarThemeClient.h \
-	Source/WebCore/platform/ScrollbarThemeComposite.cpp \
-	Source/WebCore/platform/ScrollbarThemeComposite.h \
-	Source/WebCore/platform/ScrollbarTheme.cpp \
-	Source/WebCore/platform/ScrollbarTheme.h \
-	Source/WebCore/platform/ScrollTypes.h \
-	Source/WebCore/platform/ScrollView.cpp \
-	Source/WebCore/platform/ScrollView.h \
-	Source/WebCore/platform/SearchPopupMenu.h \
-	Source/WebCore/platform/SecureTextInput.h \
-	Source/WebCore/platform/SharedBuffer.cpp \
-	Source/WebCore/platform/SharedBuffer.h \
-	Source/WebCore/platform/SharedBufferChunkReader.cpp \
-	Source/WebCore/platform/SharedBufferChunkReader.h \
-	Source/WebCore/platform/SharedTimer.h \
-	Source/WebCore/platform/Sound.h \
-	Source/WebCore/platform/sql/SQLiteAuthorizer.cpp \
-	Source/WebCore/platform/sql/SQLiteDatabase.cpp \
-	Source/WebCore/platform/sql/SQLiteDatabase.h \
-	Source/WebCore/platform/sql/SQLiteFileSystem.cpp \
-	Source/WebCore/platform/sql/SQLiteFileSystem.h \
-	Source/WebCore/platform/sql/SQLiteStatement.cpp \
-	Source/WebCore/platform/sql/SQLiteStatement.h \
-	Source/WebCore/platform/sql/SQLiteTransaction.cpp \
-	Source/WebCore/platform/sql/SQLiteTransaction.h \
-	Source/WebCore/platform/sql/SQLValue.cpp \
-	Source/WebCore/platform/sql/SQLValue.h \
-	Source/WebCore/platform/SSLKeyGenerator.h \
-	Source/WebCore/platform/StatsCounter.h \
-	Source/WebCore/platform/SuddenTermination.h \
-	Source/WebCore/platform/Supplementable.h \
-	Source/WebCore/platform/SystemTime.h \
-	Source/WebCore/platform/text/gtk/TextCheckerEnchant.h \
-	Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp \
-	Source/WebCore/platform/text/BidiContext.cpp \
-	Source/WebCore/platform/text/BidiContext.h \
-	Source/WebCore/platform/text/BidiResolver.h \
-	Source/WebCore/platform/text/BidiRunList.h \
-	Source/WebCore/platform/text/DateTimeFormat.cpp \
-	Source/WebCore/platform/text/DateTimeFormat.h \
-	Source/WebCore/platform/text/DecodeEscapeSequences.h \
-	Source/WebCore/platform/text/Hyphenation.cpp \
-	Source/WebCore/platform/text/Hyphenation.h \
-	Source/WebCore/platform/text/LineBreakIteratorPoolICU.h \
-	Source/WebCore/platform/text/LineEnding.cpp \
-	Source/WebCore/platform/text/LineEnding.h \
-	Source/WebCore/platform/text/LocaleToScriptMapping.h \
-	Source/WebCore/platform/text/LocaleToScriptMappingDefault.cpp \
-	Source/WebCore/platform/text/LocalizedDate.h \
-	Source/WebCore/platform/text/LocalizedDateNone.cpp \
-	Source/WebCore/platform/text/LocalizedNumber.h \
-	Source/WebCore/platform/text/LocalizedNumberNone.cpp \
-	Source/WebCore/platform/text/ParserUtilities.h \
-	Source/WebCore/platform/text/PlatformString.h \
-	Source/WebCore/platform/text/QuotedPrintable.cpp \
-	Source/WebCore/platform/text/QuotedPrintable.h \
-	Source/WebCore/platform/text/RegularExpression.cpp \
-	Source/WebCore/platform/text/RegularExpression.h \
-	Source/WebCore/platform/text/SegmentedString.cpp \
-	Source/WebCore/platform/text/SegmentedString.h \
-	Source/WebCore/platform/text/String.cpp \
-	Source/WebCore/platform/text/StringWithDirection.h \
-	Source/WebCore/platform/text/SuffixTree.h \
-	Source/WebCore/platform/text/TextBoundaries.cpp \
-	Source/WebCore/platform/text/TextBoundaries.h \
-	Source/WebCore/platform/text/TextBreakIterator.h \
-	Source/WebCore/platform/text/TextCheckerClient.h \
-	Source/WebCore/platform/text/TextChecking.h \
-	Source/WebCore/platform/text/TextCodec.cpp \
-	Source/WebCore/platform/text/TextCodec.h \
-	Source/WebCore/platform/text/TextCodecASCIIFastPath.h \
-	Source/WebCore/platform/text/TextCodecLatin1.cpp \
-	Source/WebCore/platform/text/TextCodecLatin1.h \
-	Source/WebCore/platform/text/TextCodecUserDefined.cpp \
-	Source/WebCore/platform/text/TextCodecUserDefined.h \
-	Source/WebCore/platform/text/TextCodecUTF16.cpp \
-	Source/WebCore/platform/text/TextCodecUTF16.h \
-	Source/WebCore/platform/text/TextCodecUTF8.cpp \
-	Source/WebCore/platform/text/TextCodecUTF8.h \
-	Source/WebCore/platform/text/TextDirection.h \
-	Source/WebCore/platform/text/TextEncoding.cpp \
-	Source/WebCore/platform/text/TextEncodingDetector.h \
-	Source/WebCore/platform/text/TextEncodingDetectorNone.cpp \
-	Source/WebCore/platform/text/TextEncoding.h \
-	Source/WebCore/platform/text/TextEncodingRegistry.cpp \
-	Source/WebCore/platform/text/TextEncodingRegistry.h \
-	Source/WebCore/platform/text/TextOrientation.h \
-	Source/WebCore/platform/text/TextStream.cpp \
-	Source/WebCore/platform/text/TextStream.h \
-	Source/WebCore/platform/text/transcoder/FontTranscoder.cpp \
-	Source/WebCore/platform/text/transcoder/FontTranscoder.h \
-	Source/WebCore/platform/text/UnicodeBidi.h \
-	Source/WebCore/platform/text/UnicodeRange.cpp \
-	Source/WebCore/platform/text/UnicodeRange.h \
-	Source/WebCore/platform/TouchpadFlingPlatformGestureCurve.cpp \
-	Source/WebCore/platform/TouchpadFlingPlatformGestureCurve.h \
-	Source/WebCore/platform/ThemeTypes.h \
-	Source/WebCore/platform/ThreadCheck.h \
-	Source/WebCore/platform/ThreadGlobalData.cpp \
-	Source/WebCore/platform/ThreadGlobalData.h \
-	Source/WebCore/platform/ThreadTimers.cpp \
-	Source/WebCore/platform/ThreadTimers.h \
-	Source/WebCore/platform/Timer.cpp \
-	Source/WebCore/platform/Timer.h \
-	Source/WebCore/platform/TreeShared.h \
-	Source/WebCore/platform/UUID.cpp \
-	Source/WebCore/platform/UUID.h \
-	Source/WebCore/platform/VisitedLinkStrategy.h \
-	Source/WebCore/platform/VisitedLinks.cpp \
-	Source/WebCore/platform/VisitedLinks.h \
-	Source/WebCore/platform/Widget.cpp \
-	Source/WebCore/platform/Widget.h \
-	Source/WebCore/platform/WindowsKeyboardCodes.h \
 	Source/WebCore/plugins/npapi.h \
 	Source/WebCore/plugins/npruntime.h \
 	Source/WebCore/plugins/nptypes.h \
@@ -4831,6 +4108,7 @@ webcore_sources += \
 	Source/WebCore/rendering/LayoutRepainter.h \
 	Source/WebCore/rendering/LayoutRepainter.cpp \
 	Source/WebCore/rendering/OverlapTestRequestClient.h \
+	Source/WebCore/rendering/Pagination.h \
 	Source/WebCore/rendering/PaintInfo.h \
 	Source/WebCore/rendering/PaintPhase.h \
 	Source/WebCore/rendering/PointerEventsHitRules.cpp \
@@ -4869,6 +4147,8 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderFlexibleBox.h \
 	Source/WebCore/rendering/RenderFlowThread.cpp \
 	Source/WebCore/rendering/RenderFlowThread.h \
+	Source/WebCore/rendering/RenderFlowThreadContainer.cpp \
+	Source/WebCore/rendering/RenderFlowThreadContainer.h \
 	Source/WebCore/rendering/RenderFrameBase.cpp \
 	Source/WebCore/rendering/RenderFrameBase.h \
 	Source/WebCore/rendering/RenderFrame.cpp \
@@ -4983,6 +4263,8 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderTextControlSingleLine.cpp \
 	Source/WebCore/rendering/RenderTextControlSingleLine.h \
 	Source/WebCore/rendering/RenderText.cpp \
+	Source/WebCore/rendering/RenderTextTrackCue.cpp \
+	Source/WebCore/rendering/RenderTextTrackCue.h \
 	Source/WebCore/rendering/RenderTextFragment.cpp \
 	Source/WebCore/rendering/RenderTextFragment.h \
 	Source/WebCore/rendering/RenderText.h \
@@ -5731,6 +5013,746 @@ webcore_sources += \
 	Source/WebCore/xml/XSLTUnicodeSort.cpp \
 	Source/WebCore/xml/XSLTUnicodeSort.h
 
+webcore_platform_sources += \
+	Source/WebCore/platform/animation/Animation.cpp \
+	Source/WebCore/platform/animation/Animation.h \
+	Source/WebCore/platform/animation/AnimationList.cpp \
+	Source/WebCore/platform/animation/AnimationList.h \
+	Source/WebCore/platform/animation/AnimationUtilities.h \
+	Source/WebCore/platform/animation/TimingFunction.h \
+	Source/WebCore/platform/audio/AudioArray.h \
+	Source/WebCore/platform/audio/AudioBus.cpp \
+	Source/WebCore/platform/audio/AudioBus.h \
+	Source/WebCore/platform/audio/AudioChannel.cpp \
+	Source/WebCore/platform/audio/AudioChannel.h \
+	Source/WebCore/platform/audio/AudioDestination.h \
+	Source/WebCore/platform/audio/AudioDSPKernel.h \
+	Source/WebCore/platform/audio/AudioDSPKernelProcessor.cpp \
+	Source/WebCore/platform/audio/AudioDSPKernelProcessor.h \
+	Source/WebCore/platform/audio/AudioFileReader.h \
+	Source/WebCore/platform/audio/AudioIOCallback.h \
+	Source/WebCore/platform/audio/AudioProcessor.h \
+	Source/WebCore/platform/audio/AudioResampler.cpp \
+	Source/WebCore/platform/audio/AudioResampler.h \
+	Source/WebCore/platform/audio/AudioResamplerKernel.cpp \
+	Source/WebCore/platform/audio/AudioResamplerKernel.h \
+	Source/WebCore/platform/audio/AudioSourceProvider.h \
+	Source/WebCore/platform/audio/AudioSourceProviderClient.h \
+	Source/WebCore/platform/audio/AudioUtilities.cpp \
+	Source/WebCore/platform/audio/AudioUtilities.h \
+	Source/WebCore/platform/audio/Biquad.cpp \
+	Source/WebCore/platform/audio/Biquad.h \
+	Source/WebCore/platform/audio/Cone.cpp \
+	Source/WebCore/platform/audio/Cone.h \
+	Source/WebCore/platform/audio/DenormalDisabler.h \
+	Source/WebCore/platform/audio/DirectConvolver.cpp \
+	Source/WebCore/platform/audio/DirectConvolver.h \
+	Source/WebCore/platform/audio/Distance.cpp \
+	Source/WebCore/platform/audio/Distance.h \
+	Source/WebCore/platform/audio/DynamicsCompressor.h \
+	Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp \
+	Source/WebCore/platform/audio/DynamicsCompressorKernel.h \
+	Source/WebCore/platform/audio/DynamicsCompressor.cpp \
+	Source/WebCore/platform/audio/EqualPowerPanner.cpp \
+	Source/WebCore/platform/audio/EqualPowerPanner.h \
+	Source/WebCore/platform/audio/FFTConvolver.cpp \
+	Source/WebCore/platform/audio/FFTConvolver.h \
+	Source/WebCore/platform/audio/FFTFrame.cpp \
+	Source/WebCore/platform/audio/FFTFrame.h \
+	Source/WebCore/platform/audio/FFTFrameStub.cpp \
+	Source/WebCore/platform/audio/HRTFDatabase.cpp \
+	Source/WebCore/platform/audio/HRTFDatabase.h \
+	Source/WebCore/platform/audio/HRTFDatabaseLoader.cpp \
+	Source/WebCore/platform/audio/HRTFDatabaseLoader.h \
+	Source/WebCore/platform/audio/HRTFElevation.cpp \
+	Source/WebCore/platform/audio/HRTFElevation.h \
+	Source/WebCore/platform/audio/HRTFKernel.cpp \
+	Source/WebCore/platform/audio/HRTFKernel.h \
+	Source/WebCore/platform/audio/HRTFPanner.cpp \
+	Source/WebCore/platform/audio/HRTFPanner.h \
+	Source/WebCore/platform/audio/MultiChannelResampler.cpp \
+	Source/WebCore/platform/audio/MultiChannelResampler.h \
+	Source/WebCore/platform/audio/Panner.cpp \
+	Source/WebCore/platform/audio/Panner.h \
+	Source/WebCore/platform/audio/ReverbAccumulationBuffer.cpp \
+	Source/WebCore/platform/audio/ReverbAccumulationBuffer.h \
+	Source/WebCore/platform/audio/ReverbConvolver.cpp \
+	Source/WebCore/platform/audio/ReverbConvolver.h \
+	Source/WebCore/platform/audio/ReverbConvolverStage.cpp \
+	Source/WebCore/platform/audio/ReverbConvolverStage.h \
+	Source/WebCore/platform/audio/Reverb.cpp \
+	Source/WebCore/platform/audio/Reverb.h \
+	Source/WebCore/platform/audio/ReverbInputBuffer.cpp \
+	Source/WebCore/platform/audio/ReverbInputBuffer.h \
+	Source/WebCore/platform/audio/SincResampler.cpp \
+	Source/WebCore/platform/audio/SincResampler.h \
+	Source/WebCore/platform/audio/VectorMath.cpp \
+	Source/WebCore/platform/audio/VectorMath.h \
+	Source/WebCore/platform/audio/ZeroPole.cpp \
+	Source/WebCore/platform/audio/ZeroPole.h \
+	Source/WebCore/platform/ActivePlatformGestureAnimation.cpp \
+	Source/WebCore/platform/ActivePlatformGestureAnimation.h \
+	Source/WebCore/platform/PlatformGestureCurve.h \
+	Source/WebCore/platform/PlatformGestureCurveTarget.h \
+	Source/WebCore/platform/Arena.cpp \
+	Source/WebCore/platform/Arena.h \
+	Source/WebCore/platform/AsyncFileSystem.cpp \
+	Source/WebCore/platform/AsyncFileSystem.h \
+	Source/WebCore/platform/AutodrainedPool.h \
+	Source/WebCore/platform/CalculationValue.cpp \
+	Source/WebCore/platform/CalculationValue.h \
+	Source/WebCore/platform/Clock.cpp \
+	Source/WebCore/platform/Clock.h \
+	Source/WebCore/platform/ClockGeneric.cpp \
+	Source/WebCore/platform/ClockGeneric.h \
+	Source/WebCore/platform/ColorChooser.h \
+	Source/WebCore/platform/ColorChooserClient.h \
+	Source/WebCore/platform/ContentType.cpp \
+	Source/WebCore/platform/ContentType.h \
+	Source/WebCore/platform/ContextMenu.h \
+	Source/WebCore/platform/ContextMenuItem.h \
+	Source/WebCore/platform/Cookie.h \
+	Source/WebCore/platform/CookiesStrategy.h \
+	Source/WebCore/platform/CookieJar.h \
+	Source/WebCore/platform/CrossThreadCopier.cpp \
+	Source/WebCore/platform/CrossThreadCopier.h \
+	Source/WebCore/platform/Cursor.cpp \
+	Source/WebCore/platform/Cursor.h \
+	Source/WebCore/platform/DateComponents.cpp \
+	Source/WebCore/platform/DateComponents.h \
+	Source/WebCore/platform/Decimal.cpp \
+	Source/WebCore/platform/Decimal.h \
+	Source/WebCore/platform/DragData.cpp \
+	Source/WebCore/platform/DragData.h \
+	Source/WebCore/platform/DragImage.cpp \
+	Source/WebCore/platform/DragImage.h \
+	Source/WebCore/platform/EventLoop.h \
+	Source/WebCore/platform/EventTracer.cpp \
+	Source/WebCore/platform/EventTracer.h \
+	Source/WebCore/platform/PlatformInstrumentation.cpp \
+	Source/WebCore/platform/PlatformInstrumentation.h \
+	Source/WebCore/platform/FileChooser.cpp \
+	Source/WebCore/platform/FileChooser.h \
+	Source/WebCore/platform/FileIconLoader.cpp \
+	Source/WebCore/platform/FileIconLoader.h \
+	Source/WebCore/platform/FileMetadata.h \
+	Source/WebCore/platform/FileStreamClient.h \
+	Source/WebCore/platform/FileStream.cpp \
+	Source/WebCore/platform/FileStream.h \
+	Source/WebCore/platform/FileSystem.cpp \
+	Source/WebCore/platform/FileSystem.h \
+	Source/WebCore/platform/FloatConversion.h \
+	Source/WebCore/platform/FractionalLayoutUnit.h \
+	Source/WebCore/platform/Gamepads.h \
+	Source/WebCore/platform/HashTools.h \
+	Source/WebCore/platform/HistogramSupport.cpp \
+	Source/WebCore/platform/HistogramSupport.h \
+	Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp \
+	Source/WebCore/platform/graphics/ANGLEWebKitBridge.h \
+	Source/WebCore/platform/graphics/BitmapImage.cpp \
+	Source/WebCore/platform/graphics/BitmapImage.h \
+	Source/WebCore/platform/graphics/Color.cpp \
+	Source/WebCore/platform/graphics/Color.h \
+	Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp \
+	Source/WebCore/platform/graphics/CrossfadeGeneratedImage.h \
+	Source/WebCore/platform/graphics/ColorSpace.h \
+	Source/WebCore/platform/graphics/DashArray.h \
+	Source/WebCore/platform/graphics/Extensions3D.h \
+	Source/WebCore/platform/graphics/NativeImagePtr.h \
+	Source/WebCore/platform/graphics/cairo/BitmapImageCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp \
+	Source/WebCore/platform/graphics/cairo/CairoUtilities.h \
+	Source/WebCore/platform/graphics/cairo/FloatRectCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/FontCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h \
+	Source/WebCore/platform/graphics/cairo/GradientCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/ImageBufferDataCairo.h \
+	Source/WebCore/platform/graphics/cairo/ImageCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/IntRectCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/NativeImageCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/NativeImageCairo.h \
+	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h \
+	Source/WebCore/platform/graphics/cairo/PathCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PatternCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h \
+	Source/WebCore/platform/graphics/cairo/PlatformPathCairo.h \
+	Source/WebCore/platform/graphics/cairo/PlatformPathCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/RefPtrCairo.h \
+	Source/WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterMesh.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterOperation.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterParameter.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterProgram.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterProgramInfo.h \
+	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp \
+	Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h \
+	Source/WebCore/platform/graphics/filters/DistantLightSource.cpp \
+	Source/WebCore/platform/graphics/filters/DistantLightSource.h \
+	Source/WebCore/platform/graphics/filters/FEBlend.cpp \
+	Source/WebCore/platform/graphics/filters/FEBlend.h \
+	Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp \
+	Source/WebCore/platform/graphics/filters/FEColorMatrix.h \
+	Source/WebCore/platform/graphics/filters/FEComponentTransfer.cpp \
+	Source/WebCore/platform/graphics/filters/FEComponentTransfer.h \
+	Source/WebCore/platform/graphics/filters/FEComposite.cpp \
+	Source/WebCore/platform/graphics/filters/FEComposite.h \
+	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp \
+	Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h \
+	Source/WebCore/platform/graphics/filters/FECustomFilter.cpp \
+	Source/WebCore/platform/graphics/filters/FECustomFilter.h \
+	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp \
+	Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h \
+	Source/WebCore/platform/graphics/filters/FEDisplacementMap.cpp \
+	Source/WebCore/platform/graphics/filters/FEDisplacementMap.h \
+	Source/WebCore/platform/graphics/filters/FEDropShadow.cpp \
+	Source/WebCore/platform/graphics/filters/FEDropShadow.h \
+	Source/WebCore/platform/graphics/filters/FEFlood.cpp \
+	Source/WebCore/platform/graphics/filters/FEFlood.h \
+	Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp \
+	Source/WebCore/platform/graphics/filters/FEGaussianBlur.h \
+	Source/WebCore/platform/graphics/filters/FELighting.cpp \
+	Source/WebCore/platform/graphics/filters/FELighting.h \
+	Source/WebCore/platform/graphics/filters/FEMerge.cpp \
+	Source/WebCore/platform/graphics/filters/FEMerge.h \
+	Source/WebCore/platform/graphics/filters/FEMorphology.cpp \
+	Source/WebCore/platform/graphics/filters/FEMorphology.h \
+	Source/WebCore/platform/graphics/filters/FEOffset.cpp \
+	Source/WebCore/platform/graphics/filters/FEOffset.h \
+	Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp \
+	Source/WebCore/platform/graphics/filters/FESpecularLighting.h \
+	Source/WebCore/platform/graphics/filters/FETile.cpp \
+	Source/WebCore/platform/graphics/filters/FETile.h \
+	Source/WebCore/platform/graphics/filters/FETurbulence.cpp \
+	Source/WebCore/platform/graphics/filters/FETurbulence.h \
+	Source/WebCore/platform/graphics/filters/Filter.h \
+	Source/WebCore/platform/graphics/filters/FilterEffect.cpp \
+	Source/WebCore/platform/graphics/filters/FilterEffect.h \
+	Source/WebCore/platform/graphics/filters/FilterOperation.h \
+	Source/WebCore/platform/graphics/filters/FilterOperation.cpp \
+	Source/WebCore/platform/graphics/filters/FilterOperations.cpp \
+	Source/WebCore/platform/graphics/filters/FilterOperations.h \
+	Source/WebCore/platform/graphics/filters/LightSource.cpp \
+	Source/WebCore/platform/graphics/filters/LightSource.h \
+	Source/WebCore/platform/graphics/filters/PointLightSource.cpp \
+	Source/WebCore/platform/graphics/filters/PointLightSource.h \
+	Source/WebCore/platform/graphics/filters/SourceAlpha.cpp \
+	Source/WebCore/platform/graphics/filters/SourceAlpha.h \
+	Source/WebCore/platform/graphics/filters/SourceGraphic.cpp \
+	Source/WebCore/platform/graphics/filters/SourceGraphic.h \
+	Source/WebCore/platform/graphics/filters/SpotLightSource.cpp \
+	Source/WebCore/platform/graphics/filters/SpotLightSource.h \
+	Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h \
+	Source/WebCore/platform/graphics/filters/arm/FEBlendNEON.h \
+	Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h \
+	Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h \
+	Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp \
+	Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h \
+	Source/WebCore/platform/graphics/FloatPoint3D.cpp \
+	Source/WebCore/platform/graphics/FloatPoint3D.h \
+	Source/WebCore/platform/graphics/FloatPoint.cpp \
+	Source/WebCore/platform/graphics/FloatPoint.h \
+	Source/WebCore/platform/graphics/FloatQuad.cpp \
+	Source/WebCore/platform/graphics/FloatQuad.h \
+	Source/WebCore/platform/graphics/FloatRect.cpp \
+	Source/WebCore/platform/graphics/FloatRect.h \
+	Source/WebCore/platform/graphics/FloatSize.cpp \
+	Source/WebCore/platform/graphics/FloatSize.h \
+	Source/WebCore/platform/graphics/FontBaseline.h \
+	Source/WebCore/platform/graphics/FontCache.cpp \
+	Source/WebCore/platform/graphics/FontCache.h \
+	Source/WebCore/platform/graphics/Font.cpp \
+	Source/WebCore/platform/graphics/FontData.cpp \
+	Source/WebCore/platform/graphics/FontData.h \
+	Source/WebCore/platform/graphics/FontDescription.cpp \
+	Source/WebCore/platform/graphics/FontDescription.h \
+	Source/WebCore/platform/graphics/FontFallbackList.cpp \
+	Source/WebCore/platform/graphics/FontFallbackList.h \
+	Source/WebCore/platform/graphics/FontFamily.cpp \
+	Source/WebCore/platform/graphics/FontFamily.h \
+	Source/WebCore/platform/graphics/FontFastPath.cpp \
+	Source/WebCore/platform/graphics/FontFeatureSettings.cpp \
+	Source/WebCore/platform/graphics/FontFeatureSettings.h \
+	Source/WebCore/platform/graphics/Font.h \
+	Source/WebCore/platform/graphics/FontMetrics.h \
+	Source/WebCore/platform/graphics/FontOrientation.h \
+	Source/WebCore/platform/graphics/FontPlatformData.h \
+	Source/WebCore/platform/graphics/FontRenderingMode.h \
+	Source/WebCore/platform/graphics/FontSelector.h \
+	Source/WebCore/platform/graphics/FontSmoothingMode.h \
+	Source/WebCore/platform/graphics/FontTraitsMask.h \
+	Source/WebCore/platform/graphics/FontWidthVariant.h \
+	Source/WebCore/platform/graphics/FractionalLayoutBoxExtent.cpp \
+	Source/WebCore/platform/graphics/FractionalLayoutBoxExtent.h \
+	Source/WebCore/platform/graphics/FractionalLayoutPoint.h \
+	Source/WebCore/platform/graphics/FractionalLayoutRect.cpp \
+	Source/WebCore/platform/graphics/FractionalLayoutRect.h \
+	Source/WebCore/platform/graphics/FractionalLayoutSize.h \
+	Source/WebCore/platform/graphics/GeneratorGeneratedImage.cpp \
+	Source/WebCore/platform/graphics/GeneratorGeneratedImage.h \
+	Source/WebCore/platform/graphics/GeneratedImage.h \
+	Source/WebCore/platform/graphics/Generator.h \
+	Source/WebCore/platform/graphics/Glyph.h \
+	Source/WebCore/platform/graphics/GlyphBuffer.h \
+	Source/WebCore/platform/graphics/GlyphMetricsMap.h \
+	Source/WebCore/platform/graphics/GlyphPage.h \
+	Source/WebCore/platform/graphics/GlyphPageTreeNode.cpp \
+	Source/WebCore/platform/graphics/GlyphPageTreeNode.h \
+	Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp \
+	Source/WebCore/platform/graphics/gpu/DrawingBuffer.h \
+	Source/WebCore/platform/graphics/Gradient.cpp \
+	Source/WebCore/platform/graphics/Gradient.h \
+	Source/WebCore/platform/graphics/GraphicsContext.cpp \
+	Source/WebCore/platform/graphics/GraphicsContext.h \
+	Source/WebCore/platform/graphics/GraphicsContext3D.cpp \
+	Source/WebCore/platform/graphics/GraphicsContext3D.h \
+	Source/WebCore/platform/graphics/GraphicsLayer.h \
+	Source/WebCore/platform/graphics/GraphicsLayer.cpp \
+	Source/WebCore/platform/graphics/GraphicsLayerClient.h \
+	Source/WebCore/platform/graphics/GraphicsTypes.cpp \
+	Source/WebCore/platform/graphics/GraphicsTypes.h \
+	Source/WebCore/platform/graphics/GraphicsTypes3D.h \
+	Source/WebCore/platform/graphics/Icon.h \
+	Source/WebCore/platform/graphics/ImageBuffer.cpp \
+	Source/WebCore/platform/graphics/ImageBuffer.h \
+	Source/WebCore/platform/graphics/ImageBufferData.h \
+	Source/WebCore/platform/graphics/Image.cpp \
+	Source/WebCore/platform/graphics/Image.h \
+	Source/WebCore/platform/graphics/ImageObserver.h \
+	Source/WebCore/platform/graphics/ImageOrientation.cpp \
+	Source/WebCore/platform/graphics/ImageOrientation.h \
+	Source/WebCore/platform/graphics/ImageSource.cpp \
+	Source/WebCore/platform/graphics/ImageSource.h \
+	Source/WebCore/platform/graphics/IntPoint.h \
+	Source/WebCore/platform/graphics/IntPointHash.h \
+	Source/WebCore/platform/graphics/IntRect.cpp \
+	Source/WebCore/platform/graphics/IntRect.h \
+	Source/WebCore/platform/graphics/IntSize.h \
+	Source/WebCore/platform/graphics/IntSizeHash.h \
+	Source/WebCore/platform/graphics/MediaPlayer.cpp \
+	Source/WebCore/platform/graphics/MediaPlayer.h \
+	Source/WebCore/platform/graphics/MediaPlayerPrivate.h \
+	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp \
+	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h \
+	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp \
+	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h \
+	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp \
+	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp \
+	Source/WebCore/platform/graphics/OpenGLShims.cpp \
+	Source/WebCore/platform/graphics/OpenGLShims.h \
+	Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.h \
+	Source/WebCore/platform/graphics/Path.cpp \
+	Source/WebCore/platform/graphics/Path.h \
+	Source/WebCore/platform/graphics/PathTraversalState.cpp \
+	Source/WebCore/platform/graphics/PathTraversalState.h \
+	Source/WebCore/platform/graphics/Pattern.cpp \
+	Source/WebCore/platform/graphics/Pattern.h \
+	Source/WebCore/platform/graphics/PlatformLayer.h \
+	Source/WebCore/platform/graphics/Region.cpp \
+	Source/WebCore/platform/graphics/Region.h \
+	Source/WebCore/platform/graphics/RoundedRect.cpp \
+	Source/WebCore/platform/graphics/RoundedRect.h \
+	Source/WebCore/platform/graphics/SegmentedFontData.cpp \
+	Source/WebCore/platform/graphics/SegmentedFontData.h \
+	Source/WebCore/platform/graphics/ShadowBlur.cpp \
+	Source/WebCore/platform/graphics/ShadowBlur.h \
+	Source/WebCore/platform/graphics/SimpleFontData.cpp \
+	Source/WebCore/platform/graphics/SimpleFontData.h \
+	Source/WebCore/platform/graphics/StringTruncator.cpp \
+	Source/WebCore/platform/graphics/StringTruncator.h \
+	Source/WebCore/platform/graphics/StrokeStyleApplier.h \
+	Source/WebCore/platform/graphics/SurrogatePairAwareTextIterator.cpp \
+	Source/WebCore/platform/graphics/SurrogatePairAwareTextIterator.h \
+	Source/WebCore/platform/graphics/SVGGlyph.cpp \
+	Source/WebCore/platform/graphics/SVGGlyph.h \
+	Source/WebCore/platform/graphics/TextRenderingMode.h \
+	Source/WebCore/platform/graphics/TextRun.cpp \
+	Source/WebCore/platform/graphics/TextRun.h \
+	Source/WebCore/platform/graphics/TiledBacking.h \
+	Source/WebCore/platform/graphics/transforms/AffineTransform.cpp \
+	Source/WebCore/platform/graphics/transforms/AffineTransform.h \
+	Source/WebCore/platform/graphics/transforms/IdentityTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/MatrixTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/RotateTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/ScaleTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/SkewTransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp \
+	Source/WebCore/platform/graphics/transforms/TransformationMatrix.h \
+	Source/WebCore/platform/graphics/transforms/TransformOperation.h \
+	Source/WebCore/platform/graphics/transforms/TransformOperations.cpp \
+	Source/WebCore/platform/graphics/transforms/TransformOperations.h \
+	Source/WebCore/platform/graphics/transforms/TransformState.cpp \
+	Source/WebCore/platform/graphics/transforms/TransformState.h \
+	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp \
+	Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.h \
+	Source/WebCore/platform/graphics/TypesettingFeatures.h \
+	Source/WebCore/platform/graphics/UnitBezier.h \
+	Source/WebCore/platform/graphics/WidthIterator.cpp \
+	Source/WebCore/platform/graphics/WidthIterator.h \
+	Source/WebCore/platform/graphics/WindRule.h \
+	Source/WebCore/platform/graphics/WOFFFileFormat.cpp \
+	Source/WebCore/platform/graphics/WOFFFileFormat.h \
+	Source/WebCore/platform/gtk/ErrorsGtk.cpp \
+	Source/WebCore/platform/gtk/ErrorsGtk.h \
+	Source/WebCore/platform/gtk/GamepadsGtk.cpp \
+	Source/WebCore/platform/gtk/KURLGtk.cpp \
+	Source/WebCore/platform/gtk/LanguageGtk.cpp \
+	Source/WebCore/platform/gtk/LoggingGtk.cpp \
+	Source/WebCore/platform/gtk/MIMETypeRegistryGtk.cpp \
+	Source/WebCore/platform/gtk/SharedBufferGtk.cpp \
+	Source/WebCore/platform/gtk/TemporaryLinkStubs.cpp \
+	Source/WebCore/platform/HostWindow.h \
+	Source/WebCore/platform/KillRing.h \
+	Source/WebCore/platform/KillRingNone.cpp \
+	Source/WebCore/platform/KURL.cpp \
+	Source/WebCore/platform/KURL.h \
+	Source/WebCore/platform/KURLHash.h \
+	Source/WebCore/platform/KURLWTFURL.cpp \
+	Source/WebCore/platform/KURLWTFURLImpl.h \
+	Source/WebCore/platform/Language.cpp \
+	Source/WebCore/platform/Language.h \
+	Source/WebCore/platform/LengthBox.cpp \
+	Source/WebCore/platform/LengthBox.h \
+	Source/WebCore/platform/Length.cpp \
+	Source/WebCore/platform/Length.h \
+	Source/WebCore/platform/LengthSize.h \
+	Source/WebCore/platform/leveldb/LevelDBComparator.h \
+	Source/WebCore/platform/leveldb/LevelDBDatabase.cpp \
+	Source/WebCore/platform/leveldb/LevelDBDatabase.h \
+	Source/WebCore/platform/leveldb/LevelDBIterator.h \
+	Source/WebCore/platform/leveldb/LevelDBSlice.h \
+	Source/WebCore/platform/leveldb/LevelDBTransaction.h \
+	Source/WebCore/platform/leveldb/LevelDBTransaction.cpp \
+	Source/WebCore/platform/leveldb/LevelDBWriteBatch.h \
+	Source/WebCore/platform/leveldb/LevelDBWriteBatch.cpp \
+	Source/WebCore/platform/LinkHash.cpp \
+	Source/WebCore/platform/LinkHash.h \
+	Source/WebCore/platform/LocalizedStrings.h \
+	Source/WebCore/platform/Logging.cpp \
+	Source/WebCore/platform/Logging.h \
+	Source/WebCore/platform/MIMETypeRegistry.cpp \
+	Source/WebCore/platform/MIMETypeRegistry.h \
+	Source/WebCore/platform/MemoryPressureHandler.cpp \
+	Source/WebCore/platform/MemoryPressureHandler.h \
+	Source/WebCore/platform/MemoryUsageSupport.cpp \
+	Source/WebCore/platform/MemoryUsageSupport.h \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.cpp \
+	Source/WebCore/platform/image-decoders/bmp/BMPImageReader.h \
+	Source/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp \
+	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.h \
+	Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp \
+	Source/WebCore/platform/image-decoders/gif/GIFImageReader.h \
+	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.h \
+	Source/WebCore/platform/image-decoders/ImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/ImageDecoder.h \
+	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h \
+	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h \
+	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
+	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h \
+	Source/WebCore/platform/LayoutTestSupport.cpp \
+	Source/WebCore/platform/LayoutTestSupport.h \
+	Source/WebCore/platform/linux/GamepadDeviceLinux.cpp \
+	Source/WebCore/platform/linux/GamepadDeviceLinux.h \
+	Source/WebCore/platform/mediastream/IceCandidateDescriptor.cpp \
+	Source/WebCore/platform/mediastream/IceCandidateDescriptor.h \
+	Source/WebCore/platform/mediastream/IceOptions.cpp \
+	Source/WebCore/platform/mediastream/IceOptions.h \
+	Source/WebCore/platform/mediastream/MediaHints.cpp \
+	Source/WebCore/platform/mediastream/MediaHints.h \
+	Source/WebCore/platform/mediastream/MediaStreamCenter.cpp \
+	Source/WebCore/platform/mediastream/MediaStreamCenter.h \
+	Source/WebCore/platform/mediastream/MediaStreamComponent.h \
+	Source/WebCore/platform/mediastream/MediaStreamDescriptor.h \
+	Source/WebCore/platform/mediastream/MediaStreamSource.cpp \
+	Source/WebCore/platform/mediastream/MediaStreamSource.h \
+	Source/WebCore/platform/mediastream/MediaStreamSourcesQueryClient.h \
+	Source/WebCore/platform/mediastream/PeerConnection00Handler.cpp \
+	Source/WebCore/platform/mediastream/PeerConnection00Handler.h \
+	Source/WebCore/platform/mediastream/PeerConnection00HandlerClient.h \
+	Source/WebCore/platform/mediastream/RTCConfiguration.h \
+	Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.cpp \
+	Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.h \
+	Source/WebCore/platform/mediastream/SessionDescriptionDescriptor.h \
+	Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.cpp \
+	Source/WebCore/platform/mediastream/RTCPeerConnectionHandler.h \
+	Source/WebCore/platform/mediastream/RTCPeerConnectionHandlerClient.h \
+	Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.cpp \
+	Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.h \
+	Source/WebCore/platform/mediastream/SessionDescriptionDescriptor.cpp \
+	Source/WebCore/platform/mediastream/SessionDescriptionDescriptor.h \
+	Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp \
+	Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h \
+	Source/WebCore/platform/mock/DeviceMotionClientMock.cpp \
+	Source/WebCore/platform/mock/DeviceMotionClientMock.h \
+	Source/WebCore/platform/mock/DeviceOrientationClientMock.cpp \
+	Source/WebCore/platform/mock/DeviceOrientationClientMock.h \
+	Source/WebCore/platform/mock/GeolocationClientMock.cpp \
+	Source/WebCore/platform/mock/GeolocationClientMock.h \
+	Source/WebCore/platform/mock/ScrollbarThemeMock.cpp \
+	Source/WebCore/platform/mock/ScrollbarThemeMock.h \
+	Source/WebCore/platform/network/AuthenticationChallengeBase.cpp \
+	Source/WebCore/platform/network/AuthenticationChallengeBase.h \
+	Source/WebCore/platform/network/AuthenticationClient.h \
+	Source/WebCore/platform/network/BlobData.cpp \
+	Source/WebCore/platform/network/BlobData.h \
+	Source/WebCore/platform/network/BlobRegistry.h \
+	Source/WebCore/platform/network/BlobRegistryImpl.cpp \
+	Source/WebCore/platform/network/BlobRegistryImpl.h \
+	Source/WebCore/platform/network/BlobResourceHandle.cpp \
+	Source/WebCore/platform/network/BlobResourceHandle.h \
+	Source/WebCore/platform/network/BlobStorageData.h \
+	Source/WebCore/platform/network/ContentTypeParser.cpp \
+	Source/WebCore/platform/network/ContentTypeParser.h \
+	Source/WebCore/platform/network/CookieStorage.h \
+	Source/WebCore/platform/network/Credential.cpp \
+	Source/WebCore/platform/network/Credential.h \
+	Source/WebCore/platform/network/CredentialStorage.cpp \
+	Source/WebCore/platform/network/CredentialStorage.h \
+	Source/WebCore/platform/network/DNS.h \
+	Source/WebCore/platform/network/DNSResolveQueue.cpp \
+	Source/WebCore/platform/network/DNSResolveQueue.h \
+	Source/WebCore/platform/network/FormDataBuilder.cpp \
+	Source/WebCore/platform/network/FormDataBuilder.h \
+	Source/WebCore/platform/network/FormData.cpp \
+	Source/WebCore/platform/network/FormData.h \
+	Source/WebCore/platform/network/HTTPHeaderMap.cpp \
+	Source/WebCore/platform/network/HTTPHeaderMap.h \
+	Source/WebCore/platform/network/HTTPParsers.cpp \
+	Source/WebCore/platform/network/HTTPParsers.h \
+	Source/WebCore/platform/network/HTTPRequest.cpp \
+	Source/WebCore/platform/network/HTTPRequest.h \
+	Source/WebCore/platform/network/HTTPValidation.cpp \
+	Source/WebCore/platform/network/HTTPValidation.h \
+	Source/WebCore/platform/network/MIMEHeader.cpp \
+	Source/WebCore/platform/network/MIMEHeader.h \
+	Source/WebCore/platform/network/NetworkingContext.h \
+	Source/WebCore/platform/network/ProxyServer.cpp \
+	Source/WebCore/platform/network/ProxyServer.h \
+	Source/WebCore/platform/network/NetworkStateNotifier.cpp \
+	Source/WebCore/platform/network/NetworkStateNotifier.h \
+	Source/WebCore/platform/network/ProtectionSpaceHash.h \
+	Source/WebCore/platform/network/ProtectionSpace.cpp \
+	Source/WebCore/platform/network/ProtectionSpace.h \
+	Source/WebCore/platform/network/ResourceErrorBase.cpp \
+	Source/WebCore/platform/network/ResourceErrorBase.h \
+	Source/WebCore/platform/network/ResourceHandleClient.h \
+	Source/WebCore/platform/network/ResourceHandle.cpp \
+	Source/WebCore/platform/network/ResourceHandle.h \
+	Source/WebCore/platform/network/ResourceHandleInternal.h \
+	Source/WebCore/platform/network/ResourceLoadInfo.h \
+	Source/WebCore/platform/network/ResourceLoadPriority.h \
+	Source/WebCore/platform/network/ResourceLoadTiming.cpp \
+	Source/WebCore/platform/network/ResourceLoadTiming.h \
+	Source/WebCore/platform/network/ResourceRequestBase.cpp \
+	Source/WebCore/platform/network/ResourceRequestBase.h \
+	Source/WebCore/platform/network/ResourceResponseBase.cpp \
+	Source/WebCore/platform/network/ResourceResponseBase.h \
+	Source/WebCore/platform/network/SocketStreamErrorBase.cpp \
+	Source/WebCore/platform/network/SocketStreamErrorBase.h \
+	Source/WebCore/platform/network/SocketStreamHandleBase.cpp \
+	Source/WebCore/platform/network/SocketStreamHandleBase.h \
+	Source/WebCore/platform/network/SocketStreamHandleClient.h \
+	Source/WebCore/platform/network/soup/AuthenticationChallenge.h \
+	Source/WebCore/platform/network/soup/CookieJarSoup.cpp \
+	Source/WebCore/platform/network/soup/CookieJarSoup.h \
+	Source/WebCore/platform/network/soup/CookieStorageSoup.cpp \
+	Source/WebCore/platform/network/soup/CredentialStorageSoup.cpp \
+	Source/WebCore/platform/network/soup/DNSSoup.cpp \
+	Source/WebCore/platform/network/soup/GOwnPtrSoup.cpp \
+	Source/WebCore/platform/network/soup/GOwnPtrSoup.h \
+	Source/WebCore/platform/network/soup/ProxyServerSoup.cpp \
+	Source/WebCore/platform/network/soup/ResourceError.h \
+	Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp \
+	Source/WebCore/platform/network/soup/ResourceRequest.h \
+	Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp \
+	Source/WebCore/platform/network/soup/ResourceResponse.h \
+	Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp \
+	Source/WebCore/platform/network/soup/SocketStreamError.h \
+	Source/WebCore/platform/network/soup/SocketStreamHandle.h \
+	Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp \
+	Source/WebCore/platform/network/soup/SoupURIUtils.cpp \
+	Source/WebCore/platform/network/soup/SoupURIUtils.h \
+	Source/WebCore/platform/NotImplemented.h \
+	Source/WebCore/platform/Pasteboard.h \
+	Source/WebCore/platform/PasteboardStrategy.h \
+	Source/WebCore/platform/PlatformEvent.cpp \
+	Source/WebCore/platform/PlatformEvent.h \
+	Source/WebCore/platform/PlatformExportMacros.h \
+	Source/WebCore/platform/PlatformGestureCurve.h \
+	Source/WebCore/platform/PlatformGestureEvent.h \
+	Source/WebCore/platform/PlatformKeyboardEvent.h \
+	Source/WebCore/platform/PlatformMenuDescription.h \
+	Source/WebCore/platform/PlatformMouseEvent.h \
+	Source/WebCore/platform/PlatformPasteboard.h \
+	Source/WebCore/platform/PlatformScreen.h \
+	Source/WebCore/platform/PlatformStrategies.cpp \
+	Source/WebCore/platform/PlatformStrategies.h \
+	Source/WebCore/platform/PlatformWheelEvent.h \
+	Source/WebCore/platform/PODArena.h \
+	Source/WebCore/platform/PODFreeListArena.h \
+	Source/WebCore/platform/PODInterval.h \
+	Source/WebCore/platform/PODIntervalTree.h \
+	Source/WebCore/platform/PODRedBlackTree.h \
+	Source/WebCore/platform/PopupMenuClient.h \
+	Source/WebCore/platform/PopupMenu.h \
+	Source/WebCore/platform/PopupMenuStyle.h \
+	Source/WebCore/platform/PrerenderHandle.h \
+	Source/WebCore/platform/PurgeableBuffer.h \
+	Source/WebCore/platform/PurgePriority.h \
+	Source/WebCore/platform/RefCountedSupplement.h \
+	Source/WebCore/platform/ReferrerPolicy.h \
+	Source/WebCore/platform/RunLoop.cpp \
+	Source/WebCore/platform/RunLoop.h \
+	Source/WebCore/platform/RuntimeApplicationChecks.cpp \
+	Source/WebCore/platform/RuntimeApplicationChecks.h \
+	Source/WebCore/platform/SchemeRegistry.cpp \
+	Source/WebCore/platform/SchemeRegistry.h \
+	Source/WebCore/platform/ScrollAnimator.cpp \
+	Source/WebCore/platform/ScrollAnimator.h \
+	Source/WebCore/platform/ScrollAnimatorNone.cpp \
+	Source/WebCore/platform/ScrollAnimatorNone.h \
+	Source/WebCore/platform/ScrollableArea.cpp \
+	Source/WebCore/platform/ScrollableArea.h \
+	Source/WebCore/platform/Scrollbar.cpp \
+	Source/WebCore/platform/Scrollbar.h \
+	Source/WebCore/platform/ScrollbarThemeClient.h \
+	Source/WebCore/platform/ScrollbarThemeComposite.cpp \
+	Source/WebCore/platform/ScrollbarThemeComposite.h \
+	Source/WebCore/platform/ScrollbarTheme.cpp \
+	Source/WebCore/platform/ScrollbarTheme.h \
+	Source/WebCore/platform/ScrollTypes.h \
+	Source/WebCore/platform/ScrollView.cpp \
+	Source/WebCore/platform/ScrollView.h \
+	Source/WebCore/platform/SearchPopupMenu.h \
+	Source/WebCore/platform/SecureTextInput.h \
+	Source/WebCore/platform/SharedBuffer.cpp \
+	Source/WebCore/platform/SharedBuffer.h \
+	Source/WebCore/platform/SharedBufferChunkReader.cpp \
+	Source/WebCore/platform/SharedBufferChunkReader.h \
+	Source/WebCore/platform/SharedTimer.h \
+	Source/WebCore/platform/Sound.h \
+	Source/WebCore/platform/sql/SQLiteAuthorizer.cpp \
+	Source/WebCore/platform/sql/SQLiteDatabase.cpp \
+	Source/WebCore/platform/sql/SQLiteDatabase.h \
+	Source/WebCore/platform/sql/SQLiteFileSystem.cpp \
+	Source/WebCore/platform/sql/SQLiteFileSystem.h \
+	Source/WebCore/platform/sql/SQLiteStatement.cpp \
+	Source/WebCore/platform/sql/SQLiteStatement.h \
+	Source/WebCore/platform/sql/SQLiteTransaction.cpp \
+	Source/WebCore/platform/sql/SQLiteTransaction.h \
+	Source/WebCore/platform/sql/SQLValue.cpp \
+	Source/WebCore/platform/sql/SQLValue.h \
+	Source/WebCore/platform/SSLKeyGenerator.h \
+	Source/WebCore/platform/StatsCounter.h \
+	Source/WebCore/platform/SuddenTermination.h \
+	Source/WebCore/platform/Supplementable.h \
+	Source/WebCore/platform/SystemTime.h \
+	Source/WebCore/platform/text/gtk/TextCheckerEnchant.h \
+	Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp \
+	Source/WebCore/platform/text/BidiContext.cpp \
+	Source/WebCore/platform/text/BidiContext.h \
+	Source/WebCore/platform/text/BidiResolver.h \
+	Source/WebCore/platform/text/BidiRunList.h \
+	Source/WebCore/platform/text/DateTimeFormat.cpp \
+	Source/WebCore/platform/text/DateTimeFormat.h \
+	Source/WebCore/platform/text/DecodeEscapeSequences.h \
+	Source/WebCore/platform/text/Hyphenation.cpp \
+	Source/WebCore/platform/text/Hyphenation.h \
+	Source/WebCore/platform/text/LineBreakIteratorPoolICU.h \
+	Source/WebCore/platform/text/LineEnding.cpp \
+	Source/WebCore/platform/text/LineEnding.h \
+	Source/WebCore/platform/text/LocaleToScriptMapping.h \
+	Source/WebCore/platform/text/LocaleToScriptMappingDefault.cpp \
+	Source/WebCore/platform/text/LocalizedDate.h \
+	Source/WebCore/platform/text/LocalizedDateNone.cpp \
+	Source/WebCore/platform/text/LocalizedNumber.h \
+	Source/WebCore/platform/text/LocalizedNumberNone.cpp \
+	Source/WebCore/platform/text/ParserUtilities.h \
+	Source/WebCore/platform/text/PlatformString.h \
+	Source/WebCore/platform/text/QuotedPrintable.cpp \
+	Source/WebCore/platform/text/QuotedPrintable.h \
+	Source/WebCore/platform/text/RegularExpression.cpp \
+	Source/WebCore/platform/text/RegularExpression.h \
+	Source/WebCore/platform/text/SegmentedString.cpp \
+	Source/WebCore/platform/text/SegmentedString.h \
+	Source/WebCore/platform/text/String.cpp \
+	Source/WebCore/platform/text/StringWithDirection.h \
+	Source/WebCore/platform/text/SuffixTree.h \
+	Source/WebCore/platform/text/TextBoundaries.cpp \
+	Source/WebCore/platform/text/TextBoundaries.h \
+	Source/WebCore/platform/text/TextBreakIterator.h \
+	Source/WebCore/platform/text/TextCheckerClient.h \
+	Source/WebCore/platform/text/TextChecking.h \
+	Source/WebCore/platform/text/TextCodec.cpp \
+	Source/WebCore/platform/text/TextCodec.h \
+	Source/WebCore/platform/text/TextCodecASCIIFastPath.h \
+	Source/WebCore/platform/text/TextCodecLatin1.cpp \
+	Source/WebCore/platform/text/TextCodecLatin1.h \
+	Source/WebCore/platform/text/TextCodecUserDefined.cpp \
+	Source/WebCore/platform/text/TextCodecUserDefined.h \
+	Source/WebCore/platform/text/TextCodecUTF16.cpp \
+	Source/WebCore/platform/text/TextCodecUTF16.h \
+	Source/WebCore/platform/text/TextCodecUTF8.cpp \
+	Source/WebCore/platform/text/TextCodecUTF8.h \
+	Source/WebCore/platform/text/TextDirection.h \
+	Source/WebCore/platform/text/TextEncoding.cpp \
+	Source/WebCore/platform/text/TextEncodingDetector.h \
+	Source/WebCore/platform/text/TextEncodingDetectorNone.cpp \
+	Source/WebCore/platform/text/TextEncoding.h \
+	Source/WebCore/platform/text/TextEncodingRegistry.cpp \
+	Source/WebCore/platform/text/TextEncodingRegistry.h \
+	Source/WebCore/platform/text/TextOrientation.h \
+	Source/WebCore/platform/text/TextStream.cpp \
+	Source/WebCore/platform/text/TextStream.h \
+	Source/WebCore/platform/text/transcoder/FontTranscoder.cpp \
+	Source/WebCore/platform/text/transcoder/FontTranscoder.h \
+	Source/WebCore/platform/text/UnicodeBidi.h \
+	Source/WebCore/platform/text/UnicodeRange.cpp \
+	Source/WebCore/platform/text/UnicodeRange.h \
+	Source/WebCore/platform/TouchpadFlingPlatformGestureCurve.cpp \
+	Source/WebCore/platform/TouchpadFlingPlatformGestureCurve.h \
+	Source/WebCore/platform/ThemeTypes.h \
+	Source/WebCore/platform/ThreadCheck.h \
+	Source/WebCore/platform/ThreadGlobalData.cpp \
+	Source/WebCore/platform/ThreadGlobalData.h \
+	Source/WebCore/platform/ThreadTimers.cpp \
+	Source/WebCore/platform/ThreadTimers.h \
+	Source/WebCore/platform/Timer.cpp \
+	Source/WebCore/platform/Timer.h \
+	Source/WebCore/platform/TreeShared.h \
+	Source/WebCore/platform/UUID.cpp \
+	Source/WebCore/platform/UUID.h \
+	Source/WebCore/platform/VisitedLinkStrategy.h \
+	Source/WebCore/platform/VisitedLinks.cpp \
+	Source/WebCore/platform/VisitedLinks.h \
+	Source/WebCore/platform/Widget.cpp \
+	Source/WebCore/platform/Widget.h \
+	Source/WebCore/platform/WindowsKeyboardCodes.h
+
 # WebCore files that use GTK/GDK or any other dependency that requires GTK+.
 webcoregtk_sources += \
 	Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp \
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
index c9d9f01fa..8110c24c1 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
@@ -490,8 +490,7 @@ void IDBDatabaseBackendImpl::runIntVersionChangeTransaction(int64_t requestedVer
 
     RefPtr<IDBDatabaseBackendImpl> database = this;
     OwnPtr<ScriptExecutionContext::Task> intVersionTask = createCallbackTask(&IDBDatabaseBackendImpl::setIntVersionInternal, database, requestedVersion, callbacks, transaction);
-    // FIXME: Make this reset the integer version as well.
-    OwnPtr<ScriptExecutionContext::Task> resetVersionOnAbortTask = createCallbackTask(&IDBDatabaseBackendImpl::resetVersion, database, m_version);
+    OwnPtr<ScriptExecutionContext::Task> resetVersionOnAbortTask = createCallbackTask(&IDBDatabaseBackendImpl::resetIntVersion, database, m_intVersion);
     if (!transaction->scheduleTask(intVersionTask.release(), resetVersionOnAbortTask.release())) {
         // FIXME: Remove one of the following lines.
         ASSERT_NOT_REACHED();
@@ -624,6 +623,11 @@ void IDBDatabaseBackendImpl::resetVersion(ScriptExecutionContext*, PassRefPtr<ID
     database->m_version = version;
 }
 
+void IDBDatabaseBackendImpl::resetIntVersion(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, int64_t oldVersion)
+{
+    database->m_intVersion = oldVersion;
+}
+
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
index 1a6feba4f..7f31cb04e 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
@@ -93,6 +93,7 @@ private:
     static void removeObjectStoreFromMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>);
     static void addObjectStoreToMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>);
     static void resetVersion(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, const String& version);
+    static void resetIntVersion(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, int64_t intVersion);
 
     RefPtr<IDBBackingStore> m_backingStore;
     int64_t m_id;
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
index 5771235f7..c96b32565 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
@@ -160,6 +160,9 @@ void IDBRequest::abort()
     if (m_readyState == DONE)
         return;
 
+    // Enqueued events may be the only reference to this object.
+    RefPtr<IDBRequest> self(this);
+
     EventQueue* eventQueue = scriptExecutionContext()->eventQueue();
     for (size_t i = 0; i < m_enqueuedEvents.size(); ++i) {
         bool removed = eventQueue->cancelEvent(m_enqueuedEvents[i].get());
diff --git a/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
index ea946a496..cf7ee1f83 100644
--- a/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
@@ -34,7 +34,9 @@ module window {
         attribute [V8EnabledAtRuntime] PeerConnection00Constructor webkitPeerConnection00;
         attribute [V8EnabledAtRuntime] RTCPeerConnectionConstructor webkitRTCPeerConnection;
         attribute SessionDescriptionConstructor SessionDescription;
+        attribute RTCSessionDescriptionConstructor RTCSessionDescription;
         attribute IceCandidateConstructor IceCandidate;
+        attribute RTCIceCandidateConstructor RTCIceCandidate;
         attribute MediaStreamEventConstructor MediaStreamEvent;
     };
 
diff --git a/Source/WebCore/Modules/mediastream/RTCIceCandidate.cpp b/Source/WebCore/Modules/mediastream/RTCIceCandidate.cpp
new file mode 100644
index 000000000..0f9d41ca2
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCIceCandidate.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "RTCIceCandidate.h"
+
+#include "Dictionary.h"
+#include "ExceptionCode.h"
+#include "InspectorValues.h"
+#include "RTCIceCandidateDescriptor.h"
+
+namespace WebCore {
+
+PassRefPtr<RTCIceCandidate> RTCIceCandidate::create(const Dictionary& dictionary, ExceptionCode& ec)
+{
+    String candidate;
+    bool ok = dictionary.get("candidate", candidate);
+    if (!ok || !candidate.length()) {
+        ec = TYPE_MISMATCH_ERR;
+        return 0;
+    }
+
+    String sdpMid;
+    dictionary.get("sdpMid", sdpMid);
+
+    unsigned short sdpMLineIndex = 0;
+    dictionary.get("sdpMLineIndex", sdpMLineIndex);
+
+    return adoptRef(new RTCIceCandidate(RTCIceCandidateDescriptor::create(candidate, sdpMid, sdpMLineIndex)));
+}
+
+PassRefPtr<RTCIceCandidate> RTCIceCandidate::create(PassRefPtr<RTCIceCandidateDescriptor> descriptor)
+{
+    return adoptRef(new RTCIceCandidate(descriptor));
+}
+
+RTCIceCandidate::RTCIceCandidate(PassRefPtr<RTCIceCandidateDescriptor> descriptor)
+    : m_descriptor(descriptor)
+{
+}
+
+RTCIceCandidate::~RTCIceCandidate()
+{
+}
+
+const String& RTCIceCandidate::candidate()
+{
+    return m_descriptor->candidate();
+}
+
+const String& RTCIceCandidate::sdpMid()
+{
+    return m_descriptor->sdpMid();
+}
+
+unsigned short RTCIceCandidate::sdpMLineIndex()
+{
+    return m_descriptor->sdpMLineIndex();
+}
+
+RTCIceCandidateDescriptor* RTCIceCandidate::descriptor()
+{
+    return m_descriptor.get();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/mediastream/RTCIceCandidate.h b/Source/WebCore/Modules/mediastream/RTCIceCandidate.h
new file mode 100644
index 000000000..4a204145a
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCIceCandidate.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCIceCandidate_h
+#define RTCIceCandidate_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "ExceptionBase.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Dictionary;
+class RTCIceCandidateDescriptor;
+
+class RTCIceCandidate : public RefCounted<RTCIceCandidate> {
+public:
+    static PassRefPtr<RTCIceCandidate> create(const Dictionary&, ExceptionCode&);
+    static PassRefPtr<RTCIceCandidate> create(PassRefPtr<RTCIceCandidateDescriptor>);
+    virtual ~RTCIceCandidate();
+
+    const String& candidate();
+    const String& sdpMid();
+    unsigned short sdpMLineIndex();
+
+    RTCIceCandidateDescriptor* descriptor();
+
+private:
+    explicit RTCIceCandidate(PassRefPtr<RTCIceCandidateDescriptor>);
+
+    RefPtr<RTCIceCandidateDescriptor> m_descriptor;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCIceCandidate_h
diff --git a/Source/WebCore/Modules/mediastream/RTCIceCandidate.idl b/Source/WebCore/Modules/mediastream/RTCIceCandidate.idl
new file mode 100644
index 000000000..460db03f4
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCIceCandidate.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module mediastream {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Constructor(in Dictionary dictionary),
+        ConstructorRaisesException
+    ] RTCIceCandidate {
+        readonly attribute DOMString candidate;
+        readonly attribute DOMString sdpMid;
+        readonly attribute unsigned short sdpMLineIndex;
+    };
+
+}
diff --git a/Source/WebCore/Modules/mediastream/RTCSessionDescription.cpp b/Source/WebCore/Modules/mediastream/RTCSessionDescription.cpp
new file mode 100644
index 000000000..677949124
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCSessionDescription.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "RTCSessionDescription.h"
+
+#include "Dictionary.h"
+#include "ExceptionCode.h"
+#include "RTCSessionDescriptionDescriptor.h"
+
+namespace WebCore {
+
+static bool verifyType(const String& type)
+{
+    return type == "offer" || type == "pranswer" || type == "answer";
+}
+
+PassRefPtr<RTCSessionDescription> RTCSessionDescription::create(const Dictionary& dictionary, ExceptionCode& ec)
+{
+    String type;
+    bool ok = dictionary.get("type", type);
+    if (!ok || !verifyType(type)) {
+        ec = TYPE_MISMATCH_ERR;
+        return 0;
+    }
+
+    String sdp;
+    ok = dictionary.get("sdp", sdp);
+    if (!ok || !sdp.length()) {
+        ec = TYPE_MISMATCH_ERR;
+        return 0;
+    }
+
+    return adoptRef(new RTCSessionDescription(RTCSessionDescriptionDescriptor::create(type, sdp)));
+}
+
+PassRefPtr<RTCSessionDescription> RTCSessionDescription::create(PassRefPtr<RTCSessionDescriptionDescriptor> descriptor)
+{
+    ASSERT(descriptor);
+    return adoptRef(new RTCSessionDescription(descriptor));
+}
+
+RTCSessionDescription::RTCSessionDescription(PassRefPtr<RTCSessionDescriptionDescriptor> descriptor)
+    : m_descriptor(descriptor)
+{
+}
+
+RTCSessionDescription::~RTCSessionDescription()
+{
+}
+
+const String& RTCSessionDescription::type()
+{
+    return m_descriptor->type();
+}
+
+void RTCSessionDescription::setType(const String& type, ExceptionCode& ec)
+{
+    if (verifyType(type))
+        m_descriptor->setType(type);
+    else
+        ec = TYPE_MISMATCH_ERR;
+}
+
+const String& RTCSessionDescription::sdp()
+{
+    return m_descriptor->sdp();
+}
+
+void RTCSessionDescription::setSdp(const String& sdp, ExceptionCode& ec)
+{
+    m_descriptor->setSdp(sdp);
+}
+
+RTCSessionDescriptionDescriptor* RTCSessionDescription::descriptor()
+{
+    return m_descriptor.get();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/mediastream/RTCSessionDescription.h b/Source/WebCore/Modules/mediastream/RTCSessionDescription.h
new file mode 100644
index 000000000..4597069ce
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCSessionDescription.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCSessionDescription_h
+#define RTCSessionDescription_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "ExceptionBase.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Dictionary;
+class RTCSessionDescriptionDescriptor;
+
+class RTCSessionDescription : public RefCounted<RTCSessionDescription> {
+public:
+    static PassRefPtr<RTCSessionDescription> create(const Dictionary&, ExceptionCode&);
+    static PassRefPtr<RTCSessionDescription> create(PassRefPtr<RTCSessionDescriptionDescriptor>);
+    virtual ~RTCSessionDescription();
+
+    const String& type();
+    void setType(const String&, ExceptionCode&);
+
+    const String& sdp();
+    void setSdp(const String&, ExceptionCode&);
+
+    RTCSessionDescriptionDescriptor* descriptor();
+
+private:
+    explicit RTCSessionDescription(PassRefPtr<RTCSessionDescriptionDescriptor>);
+
+    RefPtr<RTCSessionDescriptionDescriptor> m_descriptor;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCSessionDescription_h
diff --git a/Source/WebCore/Modules/mediastream/RTCSessionDescription.idl b/Source/WebCore/Modules/mediastream/RTCSessionDescription.idl
new file mode 100644
index 000000000..e84dea2eb
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/RTCSessionDescription.idl
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module mediastream {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Constructor(in Dictionary dictionary),
+        ConstructorRaisesException
+    ] RTCSessionDescription {
+        attribute DOMString type
+            setter raises(DOMException);
+        attribute DOMString sdp
+            setter raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/Modules/webdatabase/WorkerContextWebDatabase.cpp b/Source/WebCore/Modules/webdatabase/WorkerContextWebDatabase.cpp
index 95efa5a9a..899b7053e 100644
--- a/Source/WebCore/Modules/webdatabase/WorkerContextWebDatabase.cpp
+++ b/Source/WebCore/Modules/webdatabase/WorkerContextWebDatabase.cpp
@@ -43,7 +43,7 @@ namespace WebCore {
 
 PassRefPtr<Database> WorkerContextWebDatabase::openDatabase(WorkerContext* context, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
 {
-    if (!context->securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
+    if (!context->securityOrigin()->canAccessDatabase(context->topOrigin()) || !AbstractDatabase::isAvailable()) {
         ec = SECURITY_ERR;
         return 0;
     }
@@ -53,7 +53,7 @@ PassRefPtr<Database> WorkerContextWebDatabase::openDatabase(WorkerContext* conte
 
 PassRefPtr<DatabaseSync> WorkerContextWebDatabase::openDatabaseSync(WorkerContext* context, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
 {
-    if (!context->securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
+    if (!context->securityOrigin()->canAccessDatabase(context->topOrigin()) || !AbstractDatabase::isAvailable()) {
         ec = SECURITY_ERR;
         return 0;
     }
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index 8de7bb49a..25c35d57c 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -155,6 +155,7 @@ IF (WTF_USE_CAIRO)
       "${WEBCORE_DIR}/platform/graphics/freetype"
       "${WEBCORE_DIR}/platform/graphics/harfbuzz/"
       "${WEBCORE_DIR}/platform/graphics/harfbuzz/ng"
+      ${HARFBUZZ_INCLUDE_DIRS}
     )
     LIST(APPEND WebCore_SOURCES
       platform/graphics/WOFFFileFormat.cpp
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index bf94372bc..8b0db217d 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -1118,6 +1118,7 @@ SOURCES += \
     rendering/RenderFileUploadControl.cpp \
     rendering/RenderFlexibleBox.cpp \
     rendering/RenderFlowThread.cpp \
+    rendering/RenderFlowThreadContainer.cpp \
     rendering/RenderFrame.cpp \
     rendering/RenderFrameBase.cpp \
     rendering/RenderFrameSet.cpp \
@@ -1173,6 +1174,7 @@ SOURCES += \
     rendering/RenderTextControlMultiLine.cpp \
     rendering/RenderTextControlSingleLine.cpp \
     rendering/RenderTextFragment.cpp \
+    rendering/RenderTextTrackCue.cpp \
     rendering/RenderTheme.cpp \
     rendering/RenderTreeAsText.cpp \
     rendering/RenderView.cpp \
@@ -2284,6 +2286,7 @@ HEADERS += \
     rendering/mathml/RenderMathMLSquareRoot.h \
     rendering/mathml/RenderMathMLSubSup.h \
     rendering/mathml/RenderMathMLUnderOver.h \
+    rendering/Pagination.h \
     rendering/PaintInfo.h \
     rendering/PaintPhase.h \
     rendering/PointerEventsHitRules.h \
@@ -2794,10 +2797,8 @@ contains(DEFINES, WTF_USE_LIBXML2=1) {
 }
 
 contains(DEFINES, ENABLE_SMOOTH_SCROLLING=1) {
-    win32-*|wince* {
-        HEADERS += platform/ScrollAnimatorNone.h
-        SOURCES += platform/ScrollAnimatorNone.cpp
-    }
+    HEADERS += platform/ScrollAnimatorNone.h
+    SOURCES += platform/ScrollAnimatorNone.cpp
 }
 
 win32-*|wince* {
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index 3def256e9..91ce8352e 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -39,6 +39,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/ScriptGCEvent.cpp
     bindings/v8/ScriptInstance.cpp
     bindings/v8/ScriptObject.cpp
+    bindings/v8/ScriptRunner.cpp
     bindings/v8/ScriptScope.cpp
     bindings/v8/ScriptSourceCode.cpp
     bindings/v8/ScriptState.cpp
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index 16d04a380..770dd858c 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -293,7 +293,6 @@ __ZN7WebCore14ScrollableArea6scrollENS_15ScrollDirectionENS_17ScrollGranularityE
 __ZN7WebCore14ScrollableAreaC2Ev
 __ZN7WebCore14ScrollableAreaD2Ev
 __ZN7WebCore14ScrollbarTheme5themeEv
-__ZN7WebCore14SecurityOrigin12isolatedCopyEv
 __ZN7WebCore14SecurityOrigin16createFromStringERKN3WTF6StringE
 __ZN7WebCore14SecurityOrigin28createFromDatabaseIdentifierERKN3WTF6StringE
 __ZN7WebCore14SecurityOrigin6createERKN3WTF6StringES4_i
@@ -662,7 +661,7 @@ __ZN7WebCore4Page11PageClientsC1Ev
 __ZN7WebCore4Page11PageClientsD1Ev
 __ZN7WebCore4Page12setGroupNameERKN3WTF6StringE
 __ZN7WebCore4Page13rangeOfStringERKN3WTF6StringEPNS_5RangeEj
-__ZN7WebCore4Page13setPaginationERKNS0_10PaginationE
+__ZN7WebCore4Page13setPaginationERKNS_10PaginationE
 __ZN7WebCore4Page14setMediaVolumeEf
 __ZN7WebCore4Page15addSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
 __ZN7WebCore4Page15didMoveOnscreenEv
@@ -1174,6 +1173,7 @@ __ZNK7WebCore14ScrollableArea23mouseEnteredContentAreaEv
 __ZNK7WebCore14ScrollableArea23mouseMovedInContentAreaEv
 __ZNK7WebCore14SecurityOrigin10canDisplayERKNS_4KURLE
 __ZNK7WebCore14SecurityOrigin11toRawStringEv
+__ZNK7WebCore14SecurityOrigin12isolatedCopyEv
 __ZNK7WebCore14SecurityOrigin18databaseIdentifierEv
 __ZNK7WebCore14SecurityOrigin5equalEPKS0_
 __ZNK7WebCore14SecurityOrigin8toStringEv
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index b6022e340..8fc578686 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -455,8 +455,12 @@
             'platform/mediastream/PeerConnection00Handler.h',
             'platform/mediastream/PeerConnection00HandlerClient.h',
             'platform/mediastream/RTCConfiguration.h',
+            'platform/mediastream/RTCIceCandidateDescriptor.cpp',
+            'platform/mediastream/RTCIceCandidateDescriptor.h',
             'platform/mediastream/RTCPeerConnectionHandler.h',
             'platform/mediastream/RTCPeerConnectionHandlerClient.h',
+            'platform/mediastream/RTCSessionDescriptionDescriptor.cpp',
+            'platform/mediastream/RTCSessionDescriptionDescriptor.h',
             'platform/mediastream/SessionDescriptionDescriptor.cpp',
             'platform/mediastream/SessionDescriptionDescriptor.h',
             'platform/mediastream/chromium/MediaStreamCenterChromium.cpp',
@@ -548,6 +552,7 @@
             'rendering/LayoutTypes.h',
             'rendering/LayoutRepainter.h',
             'rendering/OverlapTestRequestClient.h',
+            'rendering/Pagination.h',
             'rendering/PaintInfo.h',
             'rendering/PaintPhase.h',
             'rendering/RenderBR.h',
@@ -556,6 +561,7 @@
             'rendering/RenderBoxModelObject.h',
             'rendering/RenderEmbeddedObject.h',
             'rendering/RenderFlowThread.h',
+            'rendering/RenderFlowThreadContainer.h',
             'rendering/RenderImage.h',
             'rendering/RenderImageResource.h',
             'rendering/RenderImageResourceStyleImage.h',
@@ -853,7 +859,9 @@
             'Modules/mediastream/NavigatorUserMediaErrorCallback.idl',
             'Modules/mediastream/NavigatorUserMediaSuccessCallback.idl',
             'Modules/mediastream/PeerConnection00.idl',
+            'Modules/mediastream/RTCIceCandidate.idl',
             'Modules/mediastream/RTCPeerConnection.idl',
+            'Modules/mediastream/RTCSessionDescription.idl',
             'Modules/mediastream/SessionDescription.idl',
             'Modules/notifications/DOMWindowNotifications.idl',
             'Modules/notifications/Notification.idl',
@@ -1589,8 +1597,12 @@
             'Modules/mediastream/NavigatorUserMediaSuccessCallback.h',
             'Modules/mediastream/PeerConnection00.cpp',
             'Modules/mediastream/PeerConnection00.h',
+            'Modules/mediastream/RTCIceCandidate.cpp',
+            'Modules/mediastream/RTCIceCandidate.h',
             'Modules/mediastream/RTCPeerConnection.cpp',
             'Modules/mediastream/RTCPeerConnection.h',
+            'Modules/mediastream/RTCSessionDescription.cpp',
+            'Modules/mediastream/RTCSessionDescription.h',
             'Modules/mediastream/SessionDescription.cpp',
             'Modules/mediastream/SessionDescription.h',
             'Modules/mediastream/UserMediaClient.h',
@@ -2228,6 +2240,8 @@
             'bindings/v8/ScriptProfileNode.h',
             'bindings/v8/ScriptProfiler.cpp',
             'bindings/v8/ScriptProfiler.h',
+            'bindings/v8/ScriptRunner.cpp',
+            'bindings/v8/ScriptRunner.h',
             'bindings/v8/ScriptScope.cpp',
             'bindings/v8/ScriptScope.h',
             'bindings/v8/ScriptSourceCode.cpp',
@@ -3664,8 +3678,6 @@
             'platform/graphics/chromium/IconChromiumAndroid.cpp',
             'platform/graphics/chromium/ImageBufferDataSkia.h',
             'platform/graphics/chromium/ImageChromium.cpp',
-            'platform/graphics/chromium/LinkHighlight.cpp',
-            'platform/graphics/chromium/LinkHighlight.h',
             'platform/graphics/chromium/MediaPlayerPrivateChromium.h',
             'platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp',
             'platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h',
@@ -4712,6 +4724,8 @@
             'rendering/RenderFlexibleBox.h',
             'rendering/RenderFlowThread.cpp',
             'rendering/RenderFlowThread.h',
+            'rendering/RenderFlowThreadContainer.cpp',
+            'rendering/RenderFlowThreadContainer.h',
             'rendering/RenderFrame.cpp',
             'rendering/RenderFrame.h',
             'rendering/RenderFrameBase.cpp',
@@ -4821,6 +4835,8 @@
             'rendering/RenderTextControlSingleLine.h',
             'rendering/RenderTextFragment.cpp',
             'rendering/RenderTextFragment.h',
+            'rendering/RenderTextTrackCue.cpp',
+            'rendering/RenderTextTrackCue.h',
             'rendering/RenderTheme.cpp',
             'rendering/RenderTheme.h',
             'rendering/RenderThemeChromiumAndroid.cpp',
@@ -6322,8 +6338,6 @@
             'inspector/front-end/KeyboardShortcut.js',
             'inspector/front-end/Linkifier.js',
             'inspector/front-end/NativeBreakpointsSidebarPane.js',
-            'inspector/front-end/NavigatorOverlayController.js',
-            'inspector/front-end/NavigatorView.js',
             'inspector/front-end/NetworkManager.js',
             'inspector/front-end/NetworkLog.js',
             'inspector/front-end/NetworkRequest.js',
@@ -6381,6 +6395,7 @@
             'inspector/front-end/Toolbar.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/UISourceCode.js',
+            'inspector/front-end/UIString.js',
             'inspector/front-end/UIUtils.js',
             'inspector/front-end/UserAgentSupport.js',
             'inspector/front-end/UserMetrics.js',
@@ -6462,6 +6477,8 @@
             'inspector/front-end/CallStackSidebarPane.js',
             'inspector/front-end/FilteredItemSelectionDialog.js',
             'inspector/front-end/JavaScriptSourceFrame.js',
+            'inspector/front-end/NavigatorOverlayController.js',
+            'inspector/front-end/NavigatorView.js',
             'inspector/front-end/RevisionHistoryView.js',
             'inspector/front-end/ScopeChainSidebarPane.js',
             'inspector/front-end/ScriptsNavigator.js',
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 46a2cbd7a..90561a7aa 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -39695,6 +39695,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\rendering\RenderFlowThreadContainer.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\rendering\RenderFlowThreadContainer.h"
+				>
+			</File>
+			<File
 				RelativePath="..\rendering\svg\RenderForeignObject.cpp"
 				>
 				<FileConfiguration
@@ -43763,6 +43771,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\rendering\RenderTextTrackCue.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\rendering\RenderTextTrackCue.h"
+				>
+			</File>
+			<File
 				RelativePath="..\rendering\RenderTheme.cpp"
 				>
 				<FileConfiguration
@@ -76498,6 +76562,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\UIString.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\UIUtils.js"
 					>
 				</File>
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 309c21f65..d95f65847 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -1700,6 +1700,8 @@
 		5DFE8F560D16477B0076E937 /* ScheduledAction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA378BA0D15F64200B793D6 /* ScheduledAction.cpp */; };
 		5DFE8F570D16477C0076E937 /* ScheduledAction.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA378BB0D15F64200B793D6 /* ScheduledAction.h */; };
 		5FC7DC26CFE2563200B85AE4 /* JSEventTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = 5FC7DC26CFE2563200B85AE5 /* JSEventTarget.h */; };
+		603EA36015DD1D7000E150E6 /* RenderFlowThreadContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 603EA35E15DD1D7000E150E6 /* RenderFlowThreadContainer.cpp */; };
+		603EA36115DD1D7000E150E6 /* RenderFlowThreadContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 603EA35F15DD1D7000E150E6 /* RenderFlowThreadContainer.h */; };
 		626CDE0E1140424C001E5A68 /* SpatialNavigation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 626CDE0C1140424C001E5A68 /* SpatialNavigation.cpp */; };
 		626CDE0F1140424C001E5A68 /* SpatialNavigation.h in Headers */ = {isa = PBXBuildFile; fileRef = 626CDE0D1140424C001E5A68 /* SpatialNavigation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		628D214C12131ED10055DCFC /* NetworkingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 628D214B12131ED10055DCFC /* NetworkingContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2944,6 +2946,8 @@
 		86BE340315058CB200CE0FD8 /* PerformanceEntryList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86BE33FD15058CB200CE0FD8 /* PerformanceEntryList.cpp */; };
 		86BE340415058CB200CE0FD8 /* PerformanceEntryList.h in Headers */ = {isa = PBXBuildFile; fileRef = 86BE33FE15058CB200CE0FD8 /* PerformanceEntryList.h */; };
 		86D982F7125C154000AD9E3D /* DocumentTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 86D982F6125C154000AD9E3D /* DocumentTiming.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86FF886115DE3D0700BD6B28 /* RenderTextTrackCue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86FF885E15DE3B8200BD6B28 /* RenderTextTrackCue.cpp */; };
+		86FF886215DE3D0700BD6B28 /* RenderTextTrackCue.h in Headers */ = {isa = PBXBuildFile; fileRef = 86FF885F15DE3B8200BD6B28 /* RenderTextTrackCue.h */; };
 		890AE0E11256A07900F5968C /* DirectoryReaderBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 890AE0E01256A07900F5968C /* DirectoryReaderBase.h */; };
 		8931DE5B14C44C44000DC9D2 /* JSBlobCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8931DE5A14C44C44000DC9D2 /* JSBlobCustom.cpp */; };
 		893C47A71238908B002B3D86 /* FileCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47A51238908B002B3D86 /* FileCallback.h */; };
@@ -3243,6 +3247,7 @@
 		9363B62C0F8E8FE000803810 /* HistoryPropertyList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9363B62A0F8E8FE000803810 /* HistoryPropertyList.cpp */; };
 		9363B62D0F8E8FE000803810 /* HistoryPropertyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 9363B62B0F8E8FE000803810 /* HistoryPropertyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9370918D1416D86B00477333 /* textAreaResizeCorner@2x.png in Resources */ = {isa = PBXBuildFile; fileRef = 9370918C1416D86B00477333 /* textAreaResizeCorner@2x.png */; };
+		9377ABA015DEFEEF0031FD04 /* Pagination.h in Headers */ = {isa = PBXBuildFile; fileRef = 9377AB9F15DEFEEF0031FD04 /* Pagination.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93799EF80BF2743600D0F230 /* RenderWordBreak.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93799EF60BF2743600D0F230 /* RenderWordBreak.cpp */; };
 		93799EF90BF2743600D0F230 /* RenderWordBreak.h in Headers */ = {isa = PBXBuildFile; fileRef = 93799EF70BF2743600D0F230 /* RenderWordBreak.h */; };
 		9380F47309A11AB4001FDB34 /* Widget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9380F47109A11AB4001FDB34 /* Widget.cpp */; };
@@ -8844,6 +8849,8 @@
 		5DB1BC6910715A6400EFAA49 /* TransformSourceLibxslt.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TransformSourceLibxslt.cpp; sourceTree = "<group>"; };
 		5DC87EEF11716DF2001C0E6D /* EmptyProtocolDefinitions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EmptyProtocolDefinitions.h; sourceTree = "<group>"; };
 		5FC7DC26CFE2563200B85AE5 /* JSEventTarget.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSEventTarget.h; sourceTree = "<group>"; };
+		603EA35E15DD1D7000E150E6 /* RenderFlowThreadContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderFlowThreadContainer.cpp; sourceTree = "<group>"; };
+		603EA35F15DD1D7000E150E6 /* RenderFlowThreadContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFlowThreadContainer.h; sourceTree = "<group>"; };
 		626CDE0C1140424C001E5A68 /* SpatialNavigation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpatialNavigation.cpp; sourceTree = "<group>"; };
 		626CDE0D1140424C001E5A68 /* SpatialNavigation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpatialNavigation.h; sourceTree = "<group>"; };
 		628D214B12131ED10055DCFC /* NetworkingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetworkingContext.h; sourceTree = "<group>"; };
@@ -10080,6 +10087,8 @@
 		86BE33FE15058CB200CE0FD8 /* PerformanceEntryList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PerformanceEntryList.h; sourceTree = "<group>"; };
 		86BE33FF15058CB200CE0FD8 /* PerformanceEntryList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PerformanceEntryList.idl; sourceTree = "<group>"; };
 		86D982F6125C154000AD9E3D /* DocumentTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentTiming.h; sourceTree = "<group>"; };
+		86FF885E15DE3B8200BD6B28 /* RenderTextTrackCue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderTextTrackCue.cpp; sourceTree = "<group>"; };
+		86FF885F15DE3B8200BD6B28 /* RenderTextTrackCue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderTextTrackCue.h; sourceTree = "<group>"; };
 		890AE0E01256A07900F5968C /* DirectoryReaderBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DirectoryReaderBase.h; path = Modules/filesystem/DirectoryReaderBase.h; sourceTree = "<group>"; };
 		8931DE5A14C44C44000DC9D2 /* JSBlobCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBlobCustom.cpp; sourceTree = "<group>"; };
 		893C47A51238908B002B3D86 /* FileCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileCallback.h; path = Modules/filesystem/FileCallback.h; sourceTree = "<group>"; };
@@ -10390,6 +10399,7 @@
 		9363B62B0F8E8FE000803810 /* HistoryPropertyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HistoryPropertyList.h; sourceTree = "<group>"; };
 		936DD03A09CEAC270056AE8C /* Range.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Range.idl; sourceTree = "<group>"; };
 		9370918C1416D86B00477333 /* textAreaResizeCorner@2x.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = "textAreaResizeCorner@2x.png"; sourceTree = "<group>"; };
+		9377AB9F15DEFEEF0031FD04 /* Pagination.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pagination.h; sourceTree = "<group>"; };
 		93799EF60BF2743600D0F230 /* RenderWordBreak.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderWordBreak.cpp; sourceTree = "<group>"; };
 		93799EF70BF2743600D0F230 /* RenderWordBreak.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderWordBreak.h; sourceTree = "<group>"; };
 		9380F47109A11AB4001FDB34 /* Widget.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Widget.cpp; sourceTree = "<group>"; };
@@ -21264,6 +21274,7 @@
 				2D9066050BE141D400956998 /* LayoutState.h */,
 				BACF290013B2A0D500781F90 /* LayoutTypes.h */,
 				3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */,
+				9377AB9F15DEFEEF0031FD04 /* Pagination.h */,
 				0885067D11DA045B00182B98 /* PaintInfo.h */,
 				0885067E11DA045B00182B98 /* PaintPhase.h */,
 				B2B1F7140D00CAA8004AEA64 /* PointerEventsHitRules.cpp */,
@@ -21302,6 +21313,8 @@
 				53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */,
 				508CCA4E13CF106B003151F3 /* RenderFlowThread.cpp */,
 				508CCA4D13CF106B003151F3 /* RenderFlowThread.h */,
+				603EA35E15DD1D7000E150E6 /* RenderFlowThreadContainer.cpp */,
+				603EA35F15DD1D7000E150E6 /* RenderFlowThreadContainer.h */,
 				A871DECC0A1530C700B12A68 /* RenderFrame.cpp */,
 				A871DECB0A1530C700B12A68 /* RenderFrame.h */,
 				0FD3080C117CF7E700A791F7 /* RenderFrameBase.cpp */,
@@ -21422,6 +21435,8 @@
 				083DAEA50F01A7FB00342754 /* RenderTextControlSingleLine.h */,
 				BCEA484E097D93020094C9E4 /* RenderTextFragment.cpp */,
 				BCEA484F097D93020094C9E4 /* RenderTextFragment.h */,
+				86FF885E15DE3B8200BD6B28 /* RenderTextTrackCue.cpp */,
+				86FF885F15DE3B8200BD6B28 /* RenderTextTrackCue.h */,
 				BCEA484A097D93020094C9E4 /* RenderTheme.cpp */,
 				BCEA484B097D93020094C9E4 /* RenderTheme.h */,
 				BCEA4848097D93020094C9E4 /* RenderThemeMac.h */,
@@ -24561,6 +24576,7 @@
 				066C77310AB603FD00238CC4 /* RenderFileUploadControl.h in Headers */,
 				53C8298E13D8D92700DE2DEB /* RenderFlexibleBox.h in Headers */,
 				508CCA4F13CF106B003151F3 /* RenderFlowThread.h in Headers */,
+				603EA36115DD1D7000E150E6 /* RenderFlowThreadContainer.h in Headers */,
 				A871DED30A1530C700B12A68 /* RenderFrame.h in Headers */,
 				0FD3080F117CF7E700A791F7 /* RenderFrameBase.h in Headers */,
 				A871DED10A1530C700B12A68 /* RenderFrameSet.h in Headers */,
@@ -24665,6 +24681,7 @@
 				083DAEA70F01A7FB00342754 /* RenderTextControlMultiLine.h in Headers */,
 				083DAEA90F01A7FB00342754 /* RenderTextControlSingleLine.h in Headers */,
 				BCEA488E097D93020094C9E4 /* RenderTextFragment.h in Headers */,
+				86FF886215DE3D0700BD6B28 /* RenderTextTrackCue.h in Headers */,
 				BCEA488A097D93020094C9E4 /* RenderTheme.h in Headers */,
 				BCEA4887097D93020094C9E4 /* RenderThemeMac.h in Headers */,
 				93F1998C08245E59001E9ABC /* RenderTreeAsText.h in Headers */,
@@ -25427,6 +25444,7 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
+				9377ABA015DEFEEF0031FD04 /* Pagination.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -27797,6 +27815,7 @@
 				066C77300AB603FD00238CC4 /* RenderFileUploadControl.cpp in Sources */,
 				53C8298D13D8D92700DE2DEB /* RenderFlexibleBox.cpp in Sources */,
 				508CCA5013CF106B003151F3 /* RenderFlowThread.cpp in Sources */,
+				603EA36015DD1D7000E150E6 /* RenderFlowThreadContainer.cpp in Sources */,
 				A871DED40A1530C700B12A68 /* RenderFrame.cpp in Sources */,
 				0FD3080E117CF7E700A791F7 /* RenderFrameBase.cpp in Sources */,
 				A871DED20A1530C700B12A68 /* RenderFrameSet.cpp in Sources */,
@@ -27868,6 +27887,7 @@
 				083DAEA60F01A7FB00342754 /* RenderTextControlMultiLine.cpp in Sources */,
 				083DAEA80F01A7FB00342754 /* RenderTextControlSingleLine.cpp in Sources */,
 				BCEA488D097D93020094C9E4 /* RenderTextFragment.cpp in Sources */,
+				86FF886115DE3D0700BD6B28 /* RenderTextTrackCue.cpp in Sources */,
 				BCEA4889097D93020094C9E4 /* RenderTheme.cpp in Sources */,
 				BCEA4888097D93020094C9E4 /* RenderThemeMac.mm in Sources */,
 				93F19AD508245E59001E9ABC /* RenderTreeAsText.cpp in Sources */,
diff --git a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
index d38af5045..fa7410700 100644
--- a/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityNodeObject.cpp
@@ -250,7 +250,7 @@ AccessibilityRole AccessibilityNodeObject::determineAccessibilityRole()
     if (node()->isTextNode())
         return StaticTextRole;
     if (node()->hasTagName(buttonTag))
-        return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
+        return buttonRoleType();
     if (node()->hasTagName(inputTag)) {
         HTMLInputElement* input = static_cast<HTMLInputElement*>(node());
         if (input->isCheckbox())
@@ -258,7 +258,7 @@ AccessibilityRole AccessibilityNodeObject::determineAccessibilityRole()
         if (input->isRadioButton())
             return RadioButtonRole;
         if (input->isTextButton())
-            return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
+            return buttonRoleType();
         return TextFieldRole;
     }
     if (node()->hasTagName(selectTag)) {
@@ -336,9 +336,9 @@ AccessibilityRole AccessibilityNodeObject::determineAriaRoleAttribute() const
     // ARIA states if an item can get focus, it should not be presentational.
     if (role == PresentationalRole && canSetFocusAttribute())
         return UnknownRole;
-    
-    if (role == ButtonRole && ariaHasPopup())
-        role = PopUpButtonRole;
+
+    if (role == ButtonRole)
+        role = buttonRoleType();
 
     if (role == TextAreaRole && !ariaIsMultiline())
         role = TextFieldRole;
diff --git a/Source/WebCore/accessibility/AccessibilityObject.cpp b/Source/WebCore/accessibility/AccessibilityObject.cpp
index 737cc6bd1..f867ec3ee 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityObject.cpp
@@ -1734,5 +1734,24 @@ void AccessibilityObject::scrollToGlobalPoint(const IntPoint& globalPoint) const
         }
     }
 }
-    
+
+bool AccessibilityObject::ariaPressedIsPresent() const
+{
+    return !getAttribute(aria_pressedAttr).isEmpty();
+}
+
+AccessibilityRole AccessibilityObject::buttonRoleType() const
+{
+    // If aria-pressed is present, then it should be exposed as a toggle button.
+    // http://www.w3.org/TR/wai-aria/states_and_properties#aria-pressed
+    if (ariaPressedIsPresent())
+        return ToggleButtonRole;
+    if (ariaHasPopup())
+        return PopUpButtonRole;
+    // We don't contemplate RadioButtonRole, as it depends on the input
+    // type.
+
+    return ButtonRole;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 1e36a2ca7..ea77ae48b 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -187,6 +187,7 @@ enum AccessibilityRole {
     TreeGridRole,
     TreeItemRole,
     TextFieldRole,
+    ToggleButtonRole,
     ToolbarRole,
     UnknownRole,
     UserInterfaceTooltipRole,
@@ -451,6 +452,7 @@ public:
     virtual bool supportsARIAFlowTo() const { return false; }
     virtual void ariaFlowToElements(AccessibilityChildrenVector&) const { }
     virtual bool ariaHasPopup() const { return false; }
+    virtual bool ariaPressedIsPresent() const;
     bool ariaIsMultiline() const;
     virtual const AtomicString& invalidStatus() const;
     bool supportsARIAExpanded() const;
@@ -715,6 +717,7 @@ protected:
     static bool isAccessibilityObjectSearchMatch(AccessibilityObject*, AccessibilitySearchCriteria*);
     static bool isAccessibilityTextSearchMatch(AccessibilityObject*, AccessibilitySearchCriteria*);
     static bool objectMatchesSearchCriteriaWithResultLimit(AccessibilityObject*, AccessibilitySearchCriteria*, AccessibilityChildrenVector&);
+    virtual AccessibilityRole buttonRoleType() const;
     
 #if PLATFORM(GTK)
     bool allowsTextRanges() const;
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index 5b63998e2..7fa5d3bb6 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1688,7 +1688,7 @@ bool AccessibilityRenderObject::ariaHasPopup() const
 {
     return elementAttributeValue(aria_haspopupAttr);
 }
-    
+
 bool AccessibilityRenderObject::supportsARIAFlowTo() const
 {
     return !getAttribute(aria_flowtoAttr).isEmpty();
@@ -3143,7 +3143,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (m_renderer->isListMarker())
         return ListMarkerRole;
     if (node && node->hasTagName(buttonTag))
-        return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
+        return buttonRoleType();
     if (m_renderer->isText())
         return StaticTextRole;
     if (cssBox && cssBox->isImage()) {
@@ -3170,7 +3170,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
         if (input->isRadioButton())
             return RadioButtonRole;
         if (input->isTextButton())
-            return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
+            return buttonRoleType();
     }
 
     if (isFileUploadButton())
diff --git a/Source/WebCore/accessibility/gtk/WebKitAccessibleInterfaceText.cpp b/Source/WebCore/accessibility/gtk/WebKitAccessibleInterfaceText.cpp
index c8df36474..691d32e34 100644
--- a/Source/WebCore/accessibility/gtk/WebKitAccessibleInterfaceText.cpp
+++ b/Source/WebCore/accessibility/gtk/WebKitAccessibleInterfaceText.cpp
@@ -33,6 +33,7 @@
 
 #include "AccessibilityObject.h"
 #include "Document.h"
+#include "Font.h"
 #include "FrameView.h"
 #include <wtf/gobject/GOwnPtr.h>
 #include "HostWindow.h"
diff --git a/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp b/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
index 4876aaf2a..f7f9f6ee8 100644
--- a/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp
@@ -430,6 +430,8 @@ static AtkRole atkRole(AccessibilityRole role)
         return ATK_ROLE_UNKNOWN;
     case ButtonRole:
         return ATK_ROLE_PUSH_BUTTON;
+    case ToggleButtonRole:
+        return ATK_ROLE_TOGGLE_BUTTON;
     case RadioButtonRole:
         return ATK_ROLE_RADIO_BUTTON;
     case CheckBoxRole:
diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
index 7a9d4bb7c..6f5e75161 100644
--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
@@ -45,6 +45,7 @@
 #import "Chrome.h"
 #import "ColorMac.h"
 #import "ContextMenuController.h"
+#import "Font.h"
 #import "Frame.h"
 #import "FrameLoaderClient.h"
 #import "FrameSelection.h"
@@ -1576,7 +1577,8 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { DivRole, NSAccessibilityGroupRole },
         { FormRole, NSAccessibilityGroupRole },
         { SpinButtonRole, NSAccessibilityIncrementorRole },
-        { FooterRole, NSAccessibilityGroupRole }
+        { FooterRole, NSAccessibilityGroupRole },
+        { ToggleButtonRole, NSAccessibilityButtonRole }
     };
     AccessibilityRoleMap& roleMap = *new AccessibilityRoleMap;
     
diff --git a/Source/WebCore/bindings/js/JSMessagePortCustom.cpp b/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
index f44bbb7b4..7a439d360 100644
--- a/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -90,15 +90,20 @@ void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortA
             return;
         // Validation of non-null objects, per HTML5 spec 10.3.3.
         if (value.isUndefinedOrNull()) {
-            setDOMException(exec, DATA_CLONE_ERR);
+            setDOMException(exec, INVALID_STATE_ERR);
             return;
         }
 
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
         RefPtr<MessagePort> port = toMessagePort(value);
-        if (port)
+        if (port) {
+            // Check for duplicate ports.
+            if (portArray.contains(port)) {
+                setDOMException(exec, INVALID_STATE_ERR);
+                return;
+            }
             portArray.append(port.release());
-        else {
+        } else {
             RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(value);
             if (arrayBuffer)
                 arrayBuffers.append(arrayBuffer);
diff --git a/Source/WebCore/bindings/js/JSUndoManagerCustom.cpp b/Source/WebCore/bindings/js/JSUndoManagerCustom.cpp
index 94cc0b60f..8fc09c511 100644
--- a/Source/WebCore/bindings/js/JSUndoManagerCustom.cpp
+++ b/Source/WebCore/bindings/js/JSUndoManagerCustom.cpp
@@ -38,6 +38,12 @@ JSValue JSUndoManager::transact(ExecState*)
     return jsUndefined();
 }
 
+JSValue JSUndoManager::item(ExecState*)
+{
+    // FIXME: implement JSC bindings
+    return jsUndefined();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/bindings/objc/DOM.mm b/Source/WebCore/bindings/objc/DOM.mm
index abc529892..5c77da5c2 100644
--- a/Source/WebCore/bindings/objc/DOM.mm
+++ b/Source/WebCore/bindings/objc/DOM.mm
@@ -34,6 +34,7 @@
 #import "DOMNodeInternal.h"
 #import "DOMPrivate.h"
 #import "DOMRangeInternal.h"
+#import "Font.h"
 #import "Frame.h"
 #import "HTMLElement.h"
 #import "HTMLNames.h"
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 300a365be..5969d2d47 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -3352,24 +3352,23 @@ END
 END
     }
 
-    my $proxyInit;
+    AddToImplIncludes("Frame.h");
+    my $frame = "0";
     if (IsNodeSubType($dataNode)) {
-        AddToImplIncludes("Frame.h");
-        $proxyInit = "impl->document()->frame() ? impl->document()->frame()->script()->proxy() : 0";
         # DocumentType nodes are the only nodes that may have a NULL document.
         if ($interfaceName eq "DocumentType") {
-            $proxyInit = "impl->document() ? ($proxyInit) : 0";
+            $frame = "impl->document() ? impl->document()->frame() : 0";
+        } else {
+            $frame = "impl->document()->frame()";
         }
-    } else {
-        $proxyInit = "0";
     }
     push(@implContent, <<END);
-    V8Proxy* proxy = $proxyInit;
+    Frame* frame = $frame;
 END
 
     if (IsSubType($dataNode, "Document")) {
         push(@implContent, <<END);
-    if (proxy && proxy->windowShell()->context().IsEmpty() && proxy->windowShell()->initContextIfNeeded()) {
+    if (frame && frame->script()->windowShell()->context().IsEmpty() && frame->script()->windowShell()->initContextIfNeeded()) {
         // initContextIfNeeded may have created a wrapper for the object, retry from the start.
         return ${className}::wrap(impl.get(), isolate);
     }
@@ -3383,8 +3382,8 @@ END
         AddToImplIncludes("Frame.h");
         push(@implContent, <<END);
     if (impl->frame()) {
-        proxy = impl->frame()->script()->proxy();
-        proxy->windowShell()->initContextIfNeeded();
+        frame = impl->frame();
+        frame->script()->windowShell()->initContextIfNeeded();
     }
 END
     }
@@ -3394,10 +3393,10 @@ END
 
     // Enter the node's context and create the wrapper in that context.
     v8::Handle<v8::Context> context;
-    if (proxy && !proxy->matchesCurrentContext()) {
+    if (frame && !frame->script()->matchesCurrentContext()) {
         // For performance, we enter the context only if the currently running context
         // is different from the context that we are about to enter.
-        context = proxy->context();
+        context = frame->script()->currentWorldContext();
         if (!context.IsEmpty())
             context->Enter();
     }
@@ -3405,7 +3404,7 @@ END
     }
 
     push(@implContent, <<END);
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
 END
     if (IsNodeSubType($dataNode) || IsVisibleAcrossOrigins($dataNode)) {
         push(@implContent, <<END);
@@ -3815,7 +3814,7 @@ sub JSValueToNative
     }
 
     if ($type eq "XPathNSResolver") {
-        return "V8DOMWrapper::getXPathNSResolver($value)";
+        return "toXPathNSResolver($value)";
     }
 
     my $arrayType = $codeGenerator->GetArrayType($type);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
index d033908e8..c93730d3a 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
@@ -24,6 +24,7 @@
 #include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8ArrayBufferView.h"
 #include "V8ArrayBufferViewCustom.h"
@@ -151,8 +152,8 @@ v8::Handle<v8::Object> V8Float64Array::wrapSlow(PassRefPtr<Float64Array> impl, v
 {
     v8::Handle<v8::Object> wrapper;
     ASSERT(static_cast<void*>(static_cast<ArrayBufferView*>(impl.get())) == static_cast<void*>(impl.get()));
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index 653eb1e42..23872e961 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -180,22 +180,22 @@ bool V8TestActiveDOMObject::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8TestActiveDOMObject::wrapSlow(PassRefPtr<TestActiveDOMObject> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
+    Frame* frame = 0;
     if (impl->frame()) {
-        proxy = impl->frame()->script()->proxy();
-        proxy->windowShell()->initContextIfNeeded();
+        frame = impl->frame();
+        frame->script()->windowShell()->initContextIfNeeded();
     }
 
     // Enter the node's context and create the wrapper in that context.
     v8::Handle<v8::Context> context;
-    if (proxy && !proxy->matchesCurrentContext()) {
+    if (frame && !frame->script()->matchesCurrentContext()) {
         // For performance, we enter the context only if the currently running context
         // is different from the context that we are about to enter.
-        context = proxy->context();
+        context = frame->script()->currentWorldContext();
         if (!context.IsEmpty())
             context->Enter();
     }
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     // Exit the node's context if it was entered.
     if (!context.IsEmpty())
         context->Exit();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
index 0f9e64ac7..e568d57ae 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
@@ -24,6 +24,7 @@
 #include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
 #include "V8DOMWrapper.h"
@@ -113,8 +114,8 @@ bool V8TestCustomNamedGetter::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8TestCustomNamedGetter::wrapSlow(PassRefPtr<TestCustomNamedGetter> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
index 32e13aa03..dacbd1d8d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
@@ -24,6 +24,7 @@
 #include "BindingState.h"
 #include "ContextFeatures.h"
 #include "Dictionary.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
 #include "V8DOMWrapper.h"
@@ -150,8 +151,8 @@ bool V8TestEventConstructor::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8TestEventConstructor::wrapSlow(PassRefPtr<TestEventConstructor> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
index 427f1d533..b10b607a9 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
@@ -24,6 +24,7 @@
 #include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
 #include "V8Collection.h"
@@ -174,8 +175,8 @@ bool V8TestEventTarget::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8TestEventTarget::wrapSlow(PassRefPtr<TestEventTarget> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
index 99eb522fa..ffb49fd4b 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestException.cpp
@@ -23,6 +23,7 @@
 
 #include "BindingState.h"
 #include "ContextFeatures.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
 #include "V8DOMWrapper.h"
@@ -104,8 +105,8 @@ bool V8TestException::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8TestException::wrapSlow(PassRefPtr<TestException> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 96cfd7a79..d4b8161af 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -26,6 +26,7 @@
 #include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "RuntimeEnabledFeatures.h"
 #include "TestSupplemental.h"
 #include "V8Binding.h"
@@ -347,8 +348,8 @@ ActiveDOMObject* V8TestInterface::toActiveDOMObject(v8::Handle<v8::Object> objec
 v8::Handle<v8::Object> V8TestInterface::wrapSlow(PassRefPtr<TestInterface> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index 2ede10bda..ab66706d6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -24,6 +24,7 @@
 #include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "MediaQueryListListener.h"
 #include "RuntimeEnabledFeatures.h"
 #include "V8Binding.h"
@@ -113,8 +114,8 @@ bool V8TestMediaQueryListListener::HasInstance(v8::Handle<v8::Value> value)
 v8::Handle<v8::Object> V8TestMediaQueryListListener::wrapSlow(PassRefPtr<TestMediaQueryListListener> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 29892806b..d37f46dc0 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -158,8 +158,8 @@ ActiveDOMObject* V8TestNamedConstructor::toActiveDOMObject(v8::Handle<v8::Object
 v8::Handle<v8::Object> V8TestNamedConstructor::wrapSlow(PassRefPtr<TestNamedConstructor> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForActiveDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
index c2a109f05..9a3cef794 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNode.cpp
@@ -114,18 +114,18 @@ v8::Handle<v8::Object> V8TestNode::wrapSlow(PassRefPtr<TestNode> impl, v8::Isola
 {
     v8::Handle<v8::Object> wrapper;
     ASSERT(static_cast<void*>(static_cast<Node*>(impl.get())) == static_cast<void*>(impl.get()));
-    V8Proxy* proxy = impl->document()->frame() ? impl->document()->frame()->script()->proxy() : 0;
+    Frame* frame = impl->document()->frame();
 
     // Enter the node's context and create the wrapper in that context.
     v8::Handle<v8::Context> context;
-    if (proxy && !proxy->matchesCurrentContext()) {
+    if (frame && !frame->script()->matchesCurrentContext()) {
         // For performance, we enter the context only if the currently running context
         // is different from the context that we are about to enter.
-        context = proxy->context();
+        context = frame->script()->currentWorldContext();
         if (!context.IsEmpty())
             context->Enter();
     }
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     // Exit the node's context if it was entered.
     if (!context.IsEmpty())
         context->Exit();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index a8b18c832..3f0b324f0 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -26,6 +26,7 @@
 #include "DOMStringList.h"
 #include "Dictionary.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "HTMLNames.h"
 #include "IDBBindingUtilities.h"
 #include "IDBKey.h"
@@ -2320,8 +2321,8 @@ void V8TestObj::installPerContextProperties(v8::Handle<v8::Object> instance, Tes
 v8::Handle<v8::Object> V8TestObj::wrapSlow(PassRefPtr<TestObj> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     installPerContextProperties(wrapper, impl.get());
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index 0f7b87b12..45ace2076 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -26,6 +26,7 @@
 #include "BindingState.h"
 #include "ContextFeatures.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
 #include "MessagePort.h"
 #include "RuntimeEnabledFeatures.h"
 #include "SerializedScriptValue.h"
@@ -296,8 +297,8 @@ bool V8TestSerializedScriptValueInterface::HasInstance(v8::Handle<v8::Value> val
 v8::Handle<v8::Object> V8TestSerializedScriptValueInterface::wrapSlow(PassRefPtr<TestSerializedScriptValueInterface> impl, v8::Isolate* isolate)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
-    wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl.get());
+    Frame* frame = 0;
+    wrapper = V8DOMWrapper::instantiateV8Object(frame, &info, impl.get());
     if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
     v8::Persistent<v8::Object> wrapperHandle = V8DOMWrapper::setJSWrapperForDOMObject(impl, wrapper, isolate);
diff --git a/Source/WebCore/bindings/v8/DOMTransaction.cpp b/Source/WebCore/bindings/v8/DOMTransaction.cpp
index d6e36ad1b..225e5abb6 100644
--- a/Source/WebCore/bindings/v8/DOMTransaction.cpp
+++ b/Source/WebCore/bindings/v8/DOMTransaction.cpp
@@ -96,17 +96,29 @@ void DOMTransaction::reapply()
         m_undoManager->registerUndoStep(this);
 }
 
-v8::Handle<v8::Function> DOMTransaction::getFunction(const char* propertyName)
+v8::Handle<v8::Value> DOMTransaction::data()
 {
     v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(toV8(this));
     if (wrapper.IsEmpty())
-        return v8::Handle<v8::Function>();
+        return v8::Handle<v8::Value>();
+    return wrapper->GetHiddenValue(V8HiddenPropertyName::domTransactionData());
+}
 
-    v8::Local<v8::Value> data = wrapper->GetHiddenValue(V8HiddenPropertyName::domTransactionData());
-    if (data.IsEmpty() || !data->IsObject())
-        return v8::Handle<v8::Function>();
+void DOMTransaction::setData(v8::Handle<v8::Value> newData)
+{
+    v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(toV8(this));
+    if (wrapper.IsEmpty())
+        return;
+    wrapper->SetHiddenValue(V8HiddenPropertyName::domTransactionData(), newData);
+}
 
-    v8::Local<v8::Value> function = v8::Local<v8::Object>::Cast(data)->Get(v8::String::NewSymbol(propertyName));
+v8::Handle<v8::Function> DOMTransaction::getFunction(const char* propertyName)
+{
+    v8::Handle<v8::Value> dictionary = data();
+    if (dictionary.IsEmpty() || !dictionary->IsObject())
+        return v8::Handle<v8::Function>();
+    
+    v8::Local<v8::Value> function = v8::Handle<v8::Object>::Cast(dictionary)->Get(v8::String::NewSymbol(propertyName));
     if (function.IsEmpty() || !function->IsFunction())
         return v8::Handle<v8::Function>();
 
diff --git a/Source/WebCore/bindings/v8/DOMTransaction.h b/Source/WebCore/bindings/v8/DOMTransaction.h
index 88fb30db8..96a1f1d2e 100644
--- a/Source/WebCore/bindings/v8/DOMTransaction.h
+++ b/Source/WebCore/bindings/v8/DOMTransaction.h
@@ -47,6 +47,9 @@ public:
     virtual EditAction editingAction() const OVERRIDE { return EditActionUnspecified; }
     virtual bool isDOMTransaction() const OVERRIDE { return true; }
 
+    v8::Handle<v8::Value> data();
+    void setData(v8::Handle<v8::Value>);
+
     UndoManager* undoManager() const { return m_undoManager; }
     void setUndoManager(UndoManager* undoManager) { m_undoManager = undoManager; }
 
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index af7d99e7e..a32b44ea5 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -39,7 +39,6 @@
 #include "V8Binding.h"
 #include "V8GCController.h"
 #include "V8NPUtils.h"
-#include "V8Proxy.h"
 #include "WrapperTypeInfo.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
@@ -69,15 +68,6 @@ static v8::Local<v8::Context> toV8Context(NPP npp, NPObject* npObject)
     return ScriptController::mainWorldContext(object->rootObject->frame());
 }
 
-static V8Proxy* toV8Proxy(NPObject* npObject)
-{
-    V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
-    Frame* frame = object->rootObject->frame();
-    if (!frame)
-        return 0;
-    return frame->script()->proxy();
-}
-
 static V8NPObjectMap* staticV8NPObjectMap()
 {
     DEFINE_STATIC_LOCAL(V8NPObjectMap, v8npObjectMap, ());
@@ -335,9 +325,6 @@ bool _NPN_EvaluateHelper(NPP npp, bool popupsAllowed, NPObject* npObject, NPStri
     if (context.IsEmpty())
         return false;
 
-    V8Proxy* proxy = toV8Proxy(npObject);
-    ASSERT(proxy);
-
     v8::Context::Scope scope(context);
     ExceptionCatcher exceptionCatcher;
 
@@ -346,10 +333,14 @@ bool _NPN_EvaluateHelper(NPP npp, bool popupsAllowed, NPObject* npObject, NPStri
     if (!popupsAllowed)
         filename = "npscript";
 
+    V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
+    Frame* frame = v8NpObject->rootObject->frame();
+    ASSERT(frame);
+
     String script = String::fromUTF8(npScript->UTF8Characters, npScript->UTF8Length);
 
     UserGestureIndicator gestureIndicator(popupsAllowed ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
-    v8::Local<v8::Value> v8result = proxy->evaluate(ScriptSourceCode(script, KURL(ParsedURLString, filename)), 0);
+    v8::Local<v8::Value> v8result = frame->script()->compileAndRunScript(ScriptSourceCode(script, KURL(ParsedURLString, filename)));
 
     if (v8result.IsEmpty())
         return false;
diff --git a/Source/WebCore/bindings/v8/OwnHandle.h b/Source/WebCore/bindings/v8/OwnHandle.h
index 17c551cd6..668f5d414 100644
--- a/Source/WebCore/bindings/v8/OwnHandle.h
+++ b/Source/WebCore/bindings/v8/OwnHandle.h
@@ -35,45 +35,41 @@
 
 namespace WebCore {
 
-    template<typename T>
-    class OwnHandle {
-    public:
-        OwnHandle() { }
-        explicit OwnHandle(v8::Handle<T> handle) : m_handle(v8::Persistent<T>::New(handle)) { }
-        ~OwnHandle() { clear(); }
+template<typename T>
+class OwnHandle {
+public:
+    OwnHandle() { }
 
-        v8::Handle<T> get() const { return m_handle; }
-        void set(v8::Handle<T> handle) { clear(); m_handle = v8::Persistent<T>::New(handle); }
+    explicit OwnHandle(v8::Handle<T> handle)
+        : m_handle(v8::Persistent<T>::New(handle))
+    {
+    }
 
-        // Note: This is clear in the OwnPtr sense, not the v8::Handle sense.
-        void clear()
-        {
-            if (m_handle.IsEmpty())
-                return;
-            if (m_handle.IsWeak())
-                m_handle.ClearWeak();
-            m_handle.Dispose();
-            m_handle.Clear();
-        }
+    ~OwnHandle()
+    {
+        clear();
+    }
 
-        // Make the underlying handle weak.  The client doesn't get a callback,
-        // we just make the handle empty.
-        void makeWeak()
-        {
-            if (m_handle.IsEmpty())
-                return;
-            m_handle.MakeWeak(this, &OwnHandle<T>::weakCallback);
-        }
+    v8::Handle<T> get() const { return m_handle; }
 
-    private:
-        static void weakCallback(v8::Persistent<v8::Value> object, void* ownHandle)
-        {
-            OwnHandle<T>* handle = static_cast<OwnHandle<T>*>(ownHandle);
-            handle->clear();
-        }
+    void set(v8::Handle<T> handle)
+    {
+        clear();
+        m_handle = v8::Persistent<T>::New(handle);
+    }
 
-        v8::Persistent<T> m_handle;
-    };
+    // Note: This is clear in the OwnPtr sense, not the v8::Handle sense.
+    void clear()
+    {
+        if (m_handle.IsEmpty())
+            return;
+        m_handle.Dispose();
+        m_handle.Clear();
+    }
+
+private:
+    v8::Persistent<T> m_handle;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
index 04169fc3d..b4857b453 100755
--- a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
@@ -39,7 +39,6 @@
 #include "ScriptDebugListener.h"
 #include "V8Binding.h"
 #include "V8DOMWindow.h"
-#include "V8Proxy.h"
 #include "V8RecursionScope.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
diff --git a/Source/WebCore/bindings/v8/ScheduledAction.cpp b/Source/WebCore/bindings/v8/ScheduledAction.cpp
index d56f677a0..2a5f89d2d 100644
--- a/Source/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/v8/ScheduledAction.cpp
@@ -42,7 +42,6 @@
 
 #include "ScriptController.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include "V8RecursionScope.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
@@ -132,7 +131,7 @@ void ScheduledAction::execute(ScriptController* script)
     if (!m_function.IsEmpty() && m_function->IsFunction())
         script->callFunction(v8::Persistent<v8::Function>::Cast(m_function), v8Context->Global(), m_argc, m_argv);
     else
-        script->proxy()->evaluate(m_code, 0);
+        script->compileAndRunScript(m_code);
 
     // The 'proxy' may be invalid at this point since JS could have released the owning Frame.
 }
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index 9955ca907..1fb36b374 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -50,6 +50,7 @@
 #include "PlatformSupport.h"
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
+#include "ScriptRunner.h"
 #include "ScriptSourceCode.h"
 #include "ScriptableDocumentParser.h"
 #include "SecurityOrigin.h"
@@ -62,7 +63,6 @@
 #include "V8HTMLEmbedElement.h"
 #include "V8IsolatedContext.h"
 #include "V8NPObject.h"
-#include "V8Proxy.h"
 #include "V8RecursionScope.h"
 #include "Widget.h"
 #include <wtf/StdLibExtras.h>
@@ -154,12 +154,12 @@ void ScriptController::clearScriptObjects()
 
 void ScriptController::resetIsolatedWorlds()
 {
-    for (IsolatedWorldMap::iterator iter = m_proxy->isolatedWorlds().begin();
-         iter != m_proxy->isolatedWorlds().end(); ++iter) {
+    for (IsolatedWorldMap::iterator iter = m_isolatedWorlds.begin();
+         iter != m_isolatedWorlds.end(); ++iter) {
         iter->second->destroy();
     }
-    m_proxy->isolatedWorlds().clear();
-    m_proxy->isolatedWorldSecurityOrigins().clear();
+    m_isolatedWorlds.clear();
+    m_isolatedWorldSecurityOrigins.clear();
 }
 
 void ScriptController::clearForClose()
@@ -198,12 +198,6 @@ v8::Local<v8::Value> ScriptController::callFunction(v8::Handle<v8::Function> fun
     return ScriptController::callFunctionWithInstrumentation(m_frame ? m_frame->document() : 0, function, receiver, argc, args);
 }
 
-static v8::Local<v8::Value> handleMaxRecursionDepthExceeded()
-{
-    throwError(RangeError, "Maximum call stack size exceeded.");
-    return v8::Local<v8::Value>();
-}
-
 static inline void resourceInfo(const v8::Handle<v8::Function> function, String& resourceName, int& lineNumber)
 {
     v8::ScriptOrigin origin = function->GetScriptOrigin();
@@ -262,6 +256,73 @@ ScriptValue ScriptController::callFunctionEvenIfScriptDisabled(v8::Handle<v8::Fu
     return ScriptValue(callFunction(function, receiver, argc, argv));
 }
 
+v8::Local<v8::Value> ScriptController::compileAndRunScript(const ScriptSourceCode& source)
+{
+    ASSERT(v8::Context::InContext());
+
+    V8GCController::checkMemoryUsage();
+
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willEvaluateScript(m_frame, source.url().isNull() ? String() : source.url().string(), source.startLine());
+
+    v8::Local<v8::Value> result;
+    {
+        // Isolate exceptions that occur when compiling and executing
+        // the code. These exceptions should not interfere with
+        // javascript code we might evaluate from C++ when returning
+        // from here.
+        v8::TryCatch tryCatch;
+        tryCatch.SetVerbose(true);
+
+        // Compile the script.
+        v8::Local<v8::String> code = v8ExternalString(source.source());
+#if PLATFORM(CHROMIUM)
+        TRACE_EVENT_BEGIN0("v8", "v8.compile");
+#endif
+        OwnPtr<v8::ScriptData> scriptData = ScriptSourceCode::precompileScript(code, source.cachedScript());
+
+        // NOTE: For compatibility with WebCore, ScriptSourceCode's line starts at
+        // 1, whereas v8 starts at 0.
+        v8::Handle<v8::Script> script = ScriptSourceCode::compileScript(code, source.url(), source.startPosition(), scriptData.get());
+#if PLATFORM(CHROMIUM)
+        TRACE_EVENT_END0("v8", "v8.compile");
+        TRACE_EVENT0("v8", "v8.run");
+#endif
+
+        // Keep Frame (and therefore ScriptController) alive.
+        RefPtr<Frame> protect(m_frame);
+        result = ScriptRunner::runCompiledScript(script, m_frame->document());
+    }
+
+    InspectorInstrumentation::didEvaluateScript(cookie);
+
+    return result;
+}
+
+ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
+{
+    String sourceURL = sourceCode.url();
+    const String* savedSourceURL = m_sourceURL;
+    m_sourceURL = &sourceURL;
+
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> v8Context = ScriptController::mainWorldContext(m_frame);
+    if (v8Context.IsEmpty())
+        return ScriptValue();
+
+    v8::Context::Scope scope(v8Context);
+
+    RefPtr<Frame> protect(m_frame);
+
+    v8::Local<v8::Value> object = compileAndRunScript(sourceCode);
+
+    m_sourceURL = savedSourceURL;
+
+    if (object.IsEmpty())
+        return ScriptValue();
+
+    return ScriptValue(object);
+}
+
 void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sources, Vector<ScriptValue>* results)
 {
     evaluateInIsolatedWorld(worldID, sources, 0, results);
@@ -280,8 +341,8 @@ void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<Sc
         v8::HandleScope evaluateHandleScope;
         V8IsolatedContext* isolatedContext = 0;
         if (worldID > 0) {
-            IsolatedWorldMap::iterator iter = m_proxy->isolatedWorlds().find(worldID);
-            if (iter != m_proxy->isolatedWorlds().end())
+            IsolatedWorldMap::iterator iter = m_isolatedWorlds.find(worldID);
+            if (iter != m_isolatedWorlds.end())
                 isolatedContext = iter->second;
             else {
                 isolatedContext = new V8IsolatedContext(m_frame, extensionGroup, worldID);
@@ -291,11 +352,11 @@ void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<Sc
                 }
 
                 // FIXME: We should change this to using window shells to match JSC.
-                m_proxy->isolatedWorlds().set(worldID, isolatedContext);
+                m_isolatedWorlds.set(worldID, isolatedContext);
             }
 
-            IsolatedWorldSecurityOriginMap::iterator securityOriginIter = m_proxy->isolatedWorldSecurityOrigins().find(worldID);
-            if (securityOriginIter != m_proxy->isolatedWorldSecurityOrigins().end())
+            IsolatedWorldSecurityOriginMap::iterator securityOriginIter = m_isolatedWorldSecurityOrigins.find(worldID);
+            if (securityOriginIter != m_isolatedWorldSecurityOrigins.end())
                 isolatedContext->setSecurityOrigin(securityOriginIter->second);
         } else {
             isolatedContext = new V8IsolatedContext(m_frame, extensionGroup, worldID);
@@ -310,7 +371,7 @@ void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<Sc
         v8::Local<v8::Array> resultArray = v8::Array::New(sources.size());
 
         for (size_t i = 0; i < sources.size(); ++i) {
-            v8::Local<v8::Value> evaluationResult = m_proxy->evaluate(sources[i], 0);
+            v8::Local<v8::Value> evaluationResult = compileAndRunScript(sources[i]);
             if (evaluationResult.IsEmpty())
                 evaluationResult = v8::Local<v8::Value>::New(v8::Undefined());
             resultArray->Set(i, evaluationResult);
@@ -331,38 +392,12 @@ void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<Sc
 void ScriptController::setIsolatedWorldSecurityOrigin(int worldID, PassRefPtr<SecurityOrigin> securityOrigin)
 {
     ASSERT(worldID);
-    m_proxy->isolatedWorldSecurityOrigins().set(worldID, securityOrigin);
-    IsolatedWorldMap::iterator iter = m_proxy->isolatedWorlds().find(worldID);
-    if (iter != m_proxy->isolatedWorlds().end())
+    m_isolatedWorldSecurityOrigins.set(worldID, securityOrigin);
+    IsolatedWorldMap::iterator iter = m_isolatedWorlds.find(worldID);
+    if (iter != m_isolatedWorlds.end())
         iter->second->setSecurityOrigin(securityOrigin);
 }
 
-// Evaluate a script file in the environment of this proxy.
-ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
-{
-    String sourceURL = sourceCode.url();
-    const String* savedSourceURL = m_sourceURL;
-    m_sourceURL = &sourceURL;
-
-    v8::HandleScope handleScope;
-    v8::Handle<v8::Context> v8Context = ScriptController::mainWorldContext(m_proxy->frame());
-    if (v8Context.IsEmpty())
-        return ScriptValue();
-
-    v8::Context::Scope scope(v8Context);
-
-    RefPtr<Frame> protect(m_frame);
-
-    v8::Local<v8::Value> object = m_proxy->evaluate(sourceCode, 0);
-
-    m_sourceURL = savedSourceURL;
-
-    if (object.IsEmpty())
-        return ScriptValue();
-
-    return ScriptValue(object);
-}
-
 TextPosition ScriptController::eventHandlerPosition() const
 {
     ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();
@@ -373,7 +408,17 @@ TextPosition ScriptController::eventHandlerPosition() const
 
 void ScriptController::finishedWithEvent(Event* event)
 {
-    m_proxy->finishedWithEvent(event);
+}
+
+v8::Local<v8::Context> ScriptController::currentWorldContext()
+{
+    if (V8IsolatedContext* isolatedContext = V8IsolatedContext::getEntered()) {
+        RefPtr<SharedPersistent<v8::Context> > context = isolatedContext->sharedContext();
+        if (m_frame != toFrameIfNotDetached(context->get()))
+            return v8::Local<v8::Context>();
+        return v8::Local<v8::Context>::New(context->get());
+    }
+    return mainWorldContext();
 }
 
 v8::Local<v8::Context> ScriptController::mainWorldContext()
@@ -390,6 +435,24 @@ v8::Local<v8::Context> ScriptController::mainWorldContext(Frame* frame)
     return frame->script()->mainWorldContext();
 }
 
+bool ScriptController::matchesCurrentContext()
+{
+    // This method is equivalent to 'return v8::Context::GetCurrent() == contextForCurrentWorld()',
+    // but is written without using contextForCurrentWorld().
+    // Given that this method is used by a hot call path of DOM object constructor,
+    // we want to avoid the overhead of contextForCurrentWorld() creating Local<Context> every time.
+    v8::Handle<v8::Context> context;
+    if (V8IsolatedContext* isolatedContext = V8IsolatedContext::getEntered()) {
+        context = isolatedContext->sharedContext()->get();
+        if (m_frame != toFrameIfNotDetached(context))
+            return false;
+    } else {
+        windowShell()->initContextIfNeeded();
+        context = windowShell()->context();
+    }
+    return context == v8::Context::GetCurrent();
+}
+
 // Create a V8 object with an interceptor of NPObjectPropertyGetter.
 void ScriptController::bindToWindowObject(Frame* frame, const String& key, NPObject* object)
 {
@@ -598,7 +661,7 @@ void ScriptController::setCaptureCallStackForUncaughtExceptions(bool value)
 void ScriptController::collectIsolatedContexts(Vector<std::pair<ScriptState*, SecurityOrigin*> >& result)
 {
     v8::HandleScope handleScope;
-    for (IsolatedWorldMap::iterator it = m_proxy->isolatedWorlds().begin(); it != m_proxy->isolatedWorlds().end(); ++it) {
+    for (IsolatedWorldMap::iterator it = m_isolatedWorlds.begin(); it != m_isolatedWorlds.end(); ++it) {
         V8IsolatedContext* isolatedContext = it->second;
         if (!isolatedContext->securityOrigin())
             continue;
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index d67836030..ca59838ac 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -88,7 +88,10 @@ public:
     // This function must be called from the main thread. It is safe to call it repeatedly.
     static void initializeThreading();
 
-    // Evaluate a script file in the environment of this proxy.
+    v8::Local<v8::Value> compileAndRunScript(const ScriptSourceCode&);
+
+    // Evaluate JavaScript in the main world.
+    // The caller must hold an execution context.
     ScriptValue evaluate(const ScriptSourceCode&);
 
     // Evaluate JavaScript in a new isolated world. The script gets its own
@@ -154,10 +157,13 @@ public:
     // V8Proxy::retrieveFrameForEnteredContext() for more information.
     static Frame* retrieveFrameForCurrentContext();
 
-    // Returns V8 Context of a frame. If none exists, creates
-    // a new context. It is potentially slow and consumes memory.
+    // Returns V8 Context. If none exists, creates a new context.
+    // It is potentially slow and consumes memory.
     static v8::Local<v8::Context> mainWorldContext(Frame*);
     v8::Local<v8::Context> mainWorldContext();
+    v8::Local<v8::Context> currentWorldContext();
+
+    bool matchesCurrentContext();
 
     // Pass command-line flags to the JS engine.
     static void setFlags(const char* string, int length);
@@ -212,6 +218,13 @@ private:
     // For the moment, we have one of these. Soon we will have one per DOMWrapperWorld.
     RefPtr<V8DOMWindowShell> m_windowShell;
 
+    // The isolated worlds we are tracking for this frame. We hold them alive
+    // here so that they can be used again by future calls to
+    // evaluateInIsolatedWorld().
+    IsolatedWorldMap m_isolatedWorlds;
+
+    IsolatedWorldSecurityOriginMap m_isolatedWorldSecurityOrigins;
+
     bool m_paused;
 
     OwnPtr<V8Proxy> m_proxy;
diff --git a/Source/WebCore/bindings/v8/ScriptInstance.cpp b/Source/WebCore/bindings/v8/ScriptInstance.cpp
index 645b1daf2..1f407d0f5 100644
--- a/Source/WebCore/bindings/v8/ScriptInstance.cpp
+++ b/Source/WebCore/bindings/v8/ScriptInstance.cpp
@@ -31,9 +31,7 @@
 #include "config.h"
 #include "ScriptInstance.h"
 
-#ifndef NDEBUG
-#include "V8Proxy.h"
-#endif
+#include "V8GCController.h"
 #include <wtf/Assertions.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/ScriptObject.cpp b/Source/WebCore/bindings/v8/ScriptObject.cpp
index 0266df48e..8154d9705 100644
--- a/Source/WebCore/bindings/v8/ScriptObject.cpp
+++ b/Source/WebCore/bindings/v8/ScriptObject.cpp
@@ -39,7 +39,6 @@
 #include "V8Binding.h"
 #include "V8InjectedScriptHost.h"
 #include "V8InspectorFrontendHost.h"
-#include "V8Proxy.h"
 
 #include <v8.h>
 
diff --git a/Source/WebCore/bindings/v8/ScriptRunner.cpp b/Source/WebCore/bindings/v8/ScriptRunner.cpp
new file mode 100644
index 000000000..04f8ea304
--- /dev/null
+++ b/Source/WebCore/bindings/v8/ScriptRunner.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptRunner.h"
+
+#include "ScriptExecutionContext.h"
+#include "V8Binding.h"
+#include "V8GCController.h"
+#include "V8RecursionScope.h"
+
+namespace WebCore {
+
+v8::Local<v8::Value> ScriptRunner::runCompiledScript(v8::Handle<v8::Script> script, ScriptExecutionContext* context)
+{
+    if (script.IsEmpty())
+        return v8::Local<v8::Value>();
+
+    V8GCController::checkMemoryUsage();
+    if (V8RecursionScope::recursionLevel() >= kMaxRecursionDepth)
+        return handleMaxRecursionDepthExceeded();
+
+    if (handleOutOfMemory())
+        ASSERT(script.IsEmpty());
+
+    // Run the script and keep track of the current recursion depth.
+    v8::Local<v8::Value> result;
+    v8::TryCatch tryCatch;
+    tryCatch.SetVerbose(true);
+    {
+        V8RecursionScope recursionScope(context);
+        result = script->Run();
+    }
+
+    if (handleOutOfMemory())
+        ASSERT(result.IsEmpty());
+
+    // Handle V8 internal error situation.
+    if (tryCatch.HasCaught()) {
+        ASSERT(result.IsEmpty());
+        return v8::Local<v8::Value>();
+    }
+
+    if (result.IsEmpty())
+        return v8::Local<v8::Value>();
+
+    crashIfV8IsDead();
+    return result;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptRunner.h b/Source/WebCore/bindings/v8/ScriptRunner.h
new file mode 100644
index 000000000..381576cdd
--- /dev/null
+++ b/Source/WebCore/bindings/v8/ScriptRunner.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptRunner_h
+#define ScriptRunner_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class ScriptRunner {
+public:
+    static v8::Local<v8::Value> runCompiledScript(v8::Handle<v8::Script>, ScriptExecutionContext*);
+};
+
+} // namespace WebCore
+
+#endif // ScriptRunner_h
diff --git a/Source/WebCore/bindings/v8/ScriptSourceCode.cpp b/Source/WebCore/bindings/v8/ScriptSourceCode.cpp
index a478e6817..efff63e17 100644
--- a/Source/WebCore/bindings/v8/ScriptSourceCode.cpp
+++ b/Source/WebCore/bindings/v8/ScriptSourceCode.cpp
@@ -26,10 +26,34 @@
 #include "config.h"
 #include "ScriptSourceCode.h"
 
+#include "CachedMetadata.h"
+#include "CachedScript.h"
 #include "V8Binding.h"
 
 namespace WebCore {
 
+PassOwnPtr<v8::ScriptData> ScriptSourceCode::precompileScript(v8::Handle<v8::String> code, CachedScript* cachedScript)
+{
+    // A pseudo-randomly chosen ID used to store and retrieve V8 ScriptData from
+    // the CachedScript. If the format changes, this ID should be changed too.
+    static const unsigned dataTypeID = 0xECC13BD7;
+
+    // Very small scripts are not worth the effort to preparse.
+    static const int minPreparseLength = 1024;
+
+    if (!cachedScript || code->Length() < minPreparseLength)
+        return nullptr;
+
+    CachedMetadata* cachedMetadata = cachedScript->cachedMetadata(dataTypeID);
+    if (cachedMetadata)
+        return adoptPtr(v8::ScriptData::New(cachedMetadata->data(), cachedMetadata->size()));
+
+    OwnPtr<v8::ScriptData> scriptData = adoptPtr(v8::ScriptData::PreCompile(code));
+    cachedScript->setCachedMetadata(dataTypeID, scriptData->Data(), scriptData->Length());
+
+    return scriptData.release();
+}
+
 v8::Handle<v8::Script> ScriptSourceCode::compileScript(v8::Handle<v8::String> code, const String& fileName, const TextPosition& scriptStartPosition, v8::ScriptData* scriptData)
 {
     v8::Handle<v8::String> name = v8String(fileName);
diff --git a/Source/WebCore/bindings/v8/ScriptSourceCode.h b/Source/WebCore/bindings/v8/ScriptSourceCode.h
index a6543ca81..32f855da7 100644
--- a/Source/WebCore/bindings/v8/ScriptSourceCode.h
+++ b/Source/WebCore/bindings/v8/ScriptSourceCode.h
@@ -36,6 +36,7 @@
 #include "KURL.h"
 #include "PlatformString.h"
 #include <v8.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/text/TextPosition.h>
 
 namespace WebCore {
@@ -73,6 +74,7 @@ public:
     int startLine() const { return m_startPosition.m_line.oneBasedInt(); }
     const TextPosition& startPosition() const { return m_startPosition; }
 
+    static PassOwnPtr<v8::ScriptData> precompileScript(v8::Handle<v8::String>, CachedScript*);
     static v8::Handle<v8::Script> compileScript(v8::Handle<v8::String>, const String&, const TextPosition&, v8::ScriptData* = 0);
 
 private:
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index 83bb8f0b3..a9b39ce11 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -54,7 +54,6 @@
 #include "V8Int32Array.h"
 #include "V8Int8Array.h"
 #include "V8MessagePort.h"
-#include "V8Proxy.h"
 #include "V8Uint16Array.h"
 #include "V8Uint32Array.h"
 #include "V8Uint8Array.h"
diff --git a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
index bc47766f9..04f399163 100644
--- a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -41,7 +41,6 @@
 #include "V8Event.h"
 #include "V8EventListenerList.h"
 #include "V8HiddenPropertyName.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 83f126cb9..bf57f8286 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -43,8 +43,10 @@
 #include "V8DOMWindow.h"
 #include "V8Element.h"
 #include "V8ObjectConstructor.h"
+#include "V8XPathNSResolver.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
+#include "XPathNSResolver.h"
 
 #include <wtf/MathExtras.h>
 #include <wtf/MainThread.h>
@@ -240,6 +242,16 @@ PassRefPtr<DOMStringList> toDOMStringList(v8::Handle<v8::Value> value)
     return ret.release();
 }
 
+PassRefPtr<XPathNSResolver> toXPathNSResolver(v8::Handle<v8::Value> value)
+{
+    RefPtr<XPathNSResolver> resolver;
+    if (V8XPathNSResolver::HasInstance(value))
+        resolver = V8XPathNSResolver::toNative(v8::Handle<v8::Object>::Cast(value));
+    else if (value->IsObject())
+        resolver = V8CustomXPathNSResolver::create(value->ToObject());
+    return resolver;
+}
+
 DOMWindow* toDOMWindow(v8::Handle<v8::Context> context)
 {
     v8::Handle<v8::Object> global = context->Global();
@@ -307,6 +319,12 @@ bool handleOutOfMemory()
     return true;
 }
 
+v8::Local<v8::Value> handleMaxRecursionDepthExceeded()
+{
+    throwError(RangeError, "Maximum call stack size exceeded.");
+    return v8::Local<v8::Value>();
+}
+
 void crashIfV8IsDead()
 {
     if (v8::V8::IsDead()) {
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 5bb4c0154..2333cede0 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -40,7 +40,6 @@
 #include "V8HiddenPropertyName.h"
 #include "V8ObjectConstructor.h"
 #include "V8PerIsolateData.h"
-#include "V8Proxy.h"
 #include "V8StringResource.h"
 #include "V8ThrowException.h"
 #include "V8ValueCache.h"
@@ -51,6 +50,10 @@
 namespace WebCore {
 
     class DOMStringList;
+    class ScriptExecutionContext;
+    class WorldContextHandle;
+
+    const int kMaxRecursionDepth = 22;
 
     // Schedule a DOM exception to be thrown, if the exception code is different
     // from zero.
@@ -348,6 +351,7 @@ namespace WebCore {
     v8::Persistent<v8::FunctionTemplate> createRawTemplate();
 
     PassRefPtr<DOMStringList> toDOMStringList(v8::Handle<v8::Value>);
+    PassRefPtr<XPathNSResolver> toXPathNSResolver(v8::Handle<v8::Value>);
 
     // Returns the window object associated with a context.
     DOMWindow* toDOMWindow(v8::Handle<v8::Context>);
@@ -365,6 +369,7 @@ namespace WebCore {
     // If the current context causes out of memory, JavaScript setting
     // is disabled and it returns true.
     bool handleOutOfMemory();
+    v8::Local<v8::Value> handleMaxRecursionDepthExceeded();
 
     void crashIfV8IsDead();
 
diff --git a/Source/WebCore/bindings/v8/V8BindingMacros.h b/Source/WebCore/bindings/v8/V8BindingMacros.h
index 0e3802244..f4cab8b85 100644
--- a/Source/WebCore/bindings/v8/V8BindingMacros.h
+++ b/Source/WebCore/bindings/v8/V8BindingMacros.h
@@ -33,6 +33,12 @@
 
 namespace WebCore {
 
+#if defined(ENABLE_DOM_STATS_COUNTERS) && PLATFORM(CHROMIUM)
+#define INC_STATS(name) StatsCounter::incrementStatsCounter(name)
+#else
+#define INC_STATS(name)
+#endif
+
 enum ParameterDefaultPolicy {
     DefaultIsUndefined,
     DefaultIsNullString
diff --git a/Source/WebCore/bindings/v8/V8Collection.h b/Source/WebCore/bindings/v8/V8Collection.h
index 281f8ec62..5dff6e7f0 100644
--- a/Source/WebCore/bindings/v8/V8Collection.h
+++ b/Source/WebCore/bindings/v8/V8Collection.h
@@ -35,7 +35,6 @@
 #include "HTMLSelectElement.h"
 #include "V8Binding.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include <v8.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index 80204668f..3e6a78e24 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -61,7 +61,6 @@
 #include "V8Location.h"
 #include "V8ObjectConstructor.h"
 #include "V8PerContextData.h"
-#include "V8Proxy.h"
 #include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
index 31ff31da3..f51b67bbe 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -52,15 +52,12 @@
 #include "V8NodeList.h"
 #include "V8ObjectConstructor.h"
 #include "V8PerContextData.h"
-#include "V8Proxy.h"
 #include "V8StyleSheet.h"
 #include "V8WorkerContextEventListener.h"
-#include "V8XPathNSResolver.h"
 #include "WebGLContextAttributes.h"
 #include "WebGLUniformLocation.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WrapperTypeInfo.h"
-#include "XPathNSResolver.h"
 #include <algorithm>
 #include <utility>
 #include <v8-debug.h>
@@ -110,12 +107,6 @@ v8::Local<v8::Function> V8DOMWrapper::constructorForType(WrapperTypeInfo* type,
 }
 #endif
 
-V8PerContextData* V8DOMWrapper::perContextData(V8Proxy* proxy)
-{
-    V8DOMWindowShell* shell = proxy->windowShell();
-    return shell ? shell->perContextData() : 0;
-}
-
 #if ENABLE(WORKERS)
 V8PerContextData* V8DOMWrapper::perContextData(WorkerContext*)
 {
@@ -135,7 +126,7 @@ void V8DOMWrapper::setNamedHiddenWindowReference(Frame* frame, const char* name,
     // Get DOMWindow
     if (!frame)
         return; // Object might be detached from window
-    v8::Handle<v8::Context> context = V8Proxy::context(frame);
+    v8::Handle<v8::Context> context = frame->script()->currentWorldContext();
     if (context.IsEmpty())
         return;
 
@@ -166,23 +157,19 @@ PassRefPtr<NodeFilter> V8DOMWrapper::wrapNativeNodeFilter(v8::Handle<v8::Value>
     return NodeFilter::create(V8NodeFilterCondition::create(filter));
 }
 
-v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(V8Proxy* proxy, WrapperTypeInfo* type, void* impl)
+v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(Frame* frame, WrapperTypeInfo* type, void* impl)
 {
 #if ENABLE(WORKERS)
     WorkerContext* workerContext = 0;
 #endif
-    V8PerContextData* contextData = 0;
-    V8IsolatedContext* isolatedContext;
-    if (UNLIKELY(!!(isolatedContext = V8IsolatedContext::getEntered()))) {
-        contextData = isolatedContext->perContextData();
-    } else if (!proxy) {
+    if (!frame) {
         v8::Handle<v8::Context> context = v8::Context::GetCurrent();
         if (!context.IsEmpty()) {
             v8::Handle<v8::Object> globalPrototype = v8::Handle<v8::Object>::Cast(context->Global()->GetPrototype());
             if (isWrapperOfType(globalPrototype, &V8DOMWindow::info)) {
-                Frame* frame = V8DOMWindow::toNative(globalPrototype)->frame();
-                if (frame && frame->script()->canExecuteScripts(NotAboutToExecuteScript))
-                    proxy = frame->script()->proxy();
+                Frame* globalFrame = V8DOMWindow::toNative(globalPrototype)->frame();
+                if (globalFrame && globalFrame->script()->canExecuteScripts(NotAboutToExecuteScript))
+                    frame = globalFrame;
             }
 #if ENABLE(WORKERS)
             else if (isWrapperOfType(globalPrototype, &V8WorkerContext::info))
@@ -191,23 +178,21 @@ v8::Local<v8::Object> V8DOMWrapper::instantiateV8Object(V8Proxy* proxy, WrapperT
         }
     }
 
-    v8::Local<v8::Object> instance;
-    if (!contextData) {
-        if (proxy)
-            contextData = perContextData(proxy);
+    V8PerContextData* contextData = 0;
+    if (frame)
+        contextData = perContextDataForCurrentWorld(frame);
 #if ENABLE(WORKERS)
-        else if (workerContext)
-            contextData = perContextData(workerContext);
+    else if (workerContext)
+        contextData = perContextData(workerContext);
 #endif
-    }
 
+    v8::Local<v8::Object> instance;
     if (contextData)
         instance = contextData->createWrapperFromCache(type);
     else {
         v8::Local<v8::Function> function = type->getTemplate()->GetFunction();
         instance = V8ObjectConstructor::newInstance(function);
     }
-
     if (!instance.IsEmpty()) {
         // Avoid setting the DOM wrapper for failed allocations.
         setDOMWrapper(instance, type, impl);
@@ -293,16 +278,4 @@ PassRefPtr<EventListener> V8DOMWrapper::getEventListener(v8::Local<v8::Value> va
 #endif
 }
 
-// XPath-related utilities
-RefPtr<XPathNSResolver> V8DOMWrapper::getXPathNSResolver(v8::Handle<v8::Value> value, V8Proxy* proxy)
-{
-    RefPtr<XPathNSResolver> resolver;
-    if (V8XPathNSResolver::HasInstance(value))
-        resolver = V8XPathNSResolver::toNative(v8::Handle<v8::Object>::Cast(value));
-    else if (value->IsObject())
-        resolver = V8CustomXPathNSResolver::create(value->ToObject());
-    return resolver;
-}
-
-
 }  // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8DOMWrapper.h b/Source/WebCore/bindings/v8/V8DOMWrapper.h
index d9e8059e4..f66e89e49 100644
--- a/Source/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/Source/WebCore/bindings/v8/V8DOMWrapper.h
@@ -93,9 +93,6 @@ namespace WebCore {
 
         static PassRefPtr<EventListener> getEventListener(v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
 
-        // XPath-related utilities
-        static RefPtr<XPathNSResolver> getXPathNSResolver(v8::Handle<v8::Value> value, V8Proxy* proxy = 0);
-
         // Wrap JS node filter in C++.
         static PassRefPtr<NodeFilter> wrapNativeNodeFilter(v8::Handle<v8::Value>);
 
@@ -125,7 +122,7 @@ namespace WebCore {
         static void setNamedHiddenReference(v8::Handle<v8::Object> parent, const char* name, v8::Handle<v8::Value> child);
         static void setNamedHiddenWindowReference(Frame*, const char*, v8::Handle<v8::Value>);
 
-        static v8::Local<v8::Object> instantiateV8Object(V8Proxy* proxy, WrapperTypeInfo*, void* impl);
+        static v8::Local<v8::Object> instantiateV8Object(Frame*, WrapperTypeInfo*, void*);
 
         static v8::Handle<v8::Object> getCachedWrapper(Node* node)
         {
@@ -148,7 +145,6 @@ namespace WebCore {
             return domNodeMap.get(node);
         }
     private:
-        static V8PerContextData* perContextData(V8Proxy*);
 #if ENABLE(WORKERS)
         static V8PerContextData* perContextData(WorkerContext*);
 #endif
diff --git a/Source/WebCore/bindings/v8/V8EventListener.cpp b/Source/WebCore/bindings/v8/V8EventListener.cpp
index a5eb85e83..e872b17e8 100644
--- a/Source/WebCore/bindings/v8/V8EventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8EventListener.cpp
@@ -37,7 +37,6 @@
 
 #include "Document.h"
 #include "Frame.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index 42380ca2a..2a882dc76 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -42,6 +42,7 @@
 #include "PlatformSupport.h"
 #include "RetainedDOMInfo.h"
 #include "RetainedObjectInfo.h"
+#include "V8AbstractEventListener.h"
 #include "V8Binding.h"
 #include "V8CSSRule.h"
 #include "V8CSSRuleList.h"
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index 91f782888..d548b1607 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -43,7 +43,6 @@
 #include "V8HTMLFormElement.h"
 #include "V8HiddenPropertyName.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include "V8RecursionScope.h"
 #include "WorldContextHandle.h"
 
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index 7bc073b83..a5b3d1deb 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -41,7 +41,6 @@
 #include "V8HTMLObjectElement.h"
 #include "V8NPUtils.h"
 #include "V8ObjectConstructor.h"
-#include "V8Proxy.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include <wtf/OwnArrayPtr.h>
diff --git a/Source/WebCore/bindings/v8/V8NPUtils.cpp b/Source/WebCore/bindings/v8/V8NPUtils.cpp
index 13cd55ef6..dfd751e32 100644
--- a/Source/WebCore/bindings/v8/V8NPUtils.cpp
+++ b/Source/WebCore/bindings/v8/V8NPUtils.cpp
@@ -39,7 +39,6 @@
 #include "NPV8Object.h"
 #include "V8Binding.h"
 #include "V8NPObject.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index 0c025c176..ed36d8675 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -45,6 +45,7 @@
 #include "PlatformSupport.h"
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
+#include "ScriptRunner.h"
 #include "ScriptSourceCode.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -77,13 +78,6 @@
 
 namespace WebCore {
 
-// FIXME: This will be soon removed when we move runScript() to ScriptController.
-static v8::Local<v8::Value> handleMaxRecursionDepthExceeded()
-{
-    throwError(RangeError, "Maximum call stack size exceeded.");
-    return v8::Local<v8::Value>();
-}
-
 V8Proxy::V8Proxy(Frame* frame)
     : m_frame(frame)
 {
@@ -94,158 +88,9 @@ V8Proxy::~V8Proxy()
     windowShell()->destroyGlobal();
 }
 
-PassOwnPtr<v8::ScriptData> V8Proxy::precompileScript(v8::Handle<v8::String> code, CachedScript* cachedScript)
-{
-    // A pseudo-randomly chosen ID used to store and retrieve V8 ScriptData from
-    // the CachedScript. If the format changes, this ID should be changed too.
-    static const unsigned dataTypeID = 0xECC13BD7;
-
-    // Very small scripts are not worth the effort to preparse.
-    static const int minPreparseLength = 1024;
-
-    if (!cachedScript || code->Length() < minPreparseLength)
-        return nullptr;
-
-    CachedMetadata* cachedMetadata = cachedScript->cachedMetadata(dataTypeID);
-    if (cachedMetadata)
-        return adoptPtr(v8::ScriptData::New(cachedMetadata->data(), cachedMetadata->size()));
-
-    OwnPtr<v8::ScriptData> scriptData = adoptPtr(v8::ScriptData::PreCompile(code));
-    cachedScript->setCachedMetadata(dataTypeID, scriptData->Data(), scriptData->Length());
-
-    return scriptData.release();
-}
-
-v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* node)
-{
-    ASSERT(v8::Context::InContext());
-
-    V8GCController::checkMemoryUsage();
-
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willEvaluateScript(m_frame, source.url().isNull() ? String() : source.url().string(), source.startLine());
-
-    v8::Local<v8::Value> result;
-    {
-        // Isolate exceptions that occur when compiling and executing
-        // the code. These exceptions should not interfere with
-        // javascript code we might evaluate from C++ when returning
-        // from here.
-        v8::TryCatch tryCatch;
-        tryCatch.SetVerbose(true);
-
-        // Compile the script.
-        v8::Local<v8::String> code = v8ExternalString(source.source());
-#if PLATFORM(CHROMIUM)
-        TRACE_EVENT_BEGIN0("v8", "v8.compile");
-#endif
-        OwnPtr<v8::ScriptData> scriptData = precompileScript(code, source.cachedScript());
-
-        // NOTE: For compatibility with WebCore, ScriptSourceCode's line starts at
-        // 1, whereas v8 starts at 0.
-        v8::Handle<v8::Script> script = ScriptSourceCode::compileScript(code, source.url(), source.startPosition(), scriptData.get());
-#if PLATFORM(CHROMIUM)
-        TRACE_EVENT_END0("v8", "v8.compile");
-        TRACE_EVENT0("v8", "v8.run");
-#endif
-        result = runScript(script);
-    }
-
-    InspectorInstrumentation::didEvaluateScript(cookie);
-
-    return result;
-}
-
-v8::Local<v8::Value> V8Proxy::runScript(v8::Handle<v8::Script> script)
-{
-    if (script.IsEmpty())
-        return v8::Local<v8::Value>();
-
-    V8GCController::checkMemoryUsage();
-    if (V8RecursionScope::recursionLevel() >= kMaxRecursionDepth)
-        return handleMaxRecursionDepthExceeded();
-
-    if (handleOutOfMemory())
-        ASSERT(script.IsEmpty());
-
-    // Keep Frame (and therefore ScriptController and V8Proxy) alive.
-    RefPtr<Frame> protect(frame());
-
-    // Run the script and keep track of the current recursion depth.
-    v8::Local<v8::Value> result;
-    v8::TryCatch tryCatch;
-    tryCatch.SetVerbose(true);
-    {
-        V8RecursionScope recursionScope(frame()->document());
-        result = script->Run();
-    }
-
-    if (handleOutOfMemory())
-        ASSERT(result.IsEmpty());
-
-    // Handle V8 internal error situation (Out-of-memory).
-    if (tryCatch.HasCaught()) {
-        ASSERT(result.IsEmpty());
-        return v8::Local<v8::Value>();
-    }
-
-    if (result.IsEmpty())
-        return v8::Local<v8::Value>();
-
-    crashIfV8IsDead();
-    return result;
-}
-
 V8DOMWindowShell* V8Proxy::windowShell() const
 {
     return frame()->script()->windowShell();
 }
 
-v8::Local<v8::Context> V8Proxy::context(Frame* frame)
-{
-    v8::Local<v8::Context> context = ScriptController::mainWorldContext(frame);
-    if (context.IsEmpty())
-        return v8::Local<v8::Context>();
-
-    if (V8IsolatedContext* isolatedContext = V8IsolatedContext::getEntered()) {
-        context = v8::Local<v8::Context>::New(isolatedContext->context());
-        if (frame != toFrameIfNotDetached(context))
-            return v8::Local<v8::Context>();
-    }
-
-    return context;
-}
-
-v8::Local<v8::Context> V8Proxy::context()
-{
-    if (V8IsolatedContext* isolatedContext = V8IsolatedContext::getEntered()) {
-        RefPtr<SharedPersistent<v8::Context> > context = isolatedContext->sharedContext();
-        if (m_frame != toFrameIfNotDetached(context->get()))
-            return v8::Local<v8::Context>();
-        return v8::Local<v8::Context>::New(context->get());
-    }
-    return frame()->script()->mainWorldContext();
-}
-
-v8::Local<v8::Context> V8Proxy::isolatedWorldContext(int worldId)
-{
-    IsolatedWorldMap::iterator iter = m_isolatedWorlds.find(worldId);
-    if (iter == m_isolatedWorlds.end())
-        return v8::Local<v8::Context>();
-    return v8::Local<v8::Context>::New(iter->second->context());
-}
-
-bool V8Proxy::matchesCurrentContext()
-{
-    v8::Handle<v8::Context> context;
-    if (V8IsolatedContext* isolatedContext = V8IsolatedContext::getEntered()) {
-        context = isolatedContext->sharedContext()->get();
-        if (m_frame != toFrameIfNotDetached(context))
-            return false;
-    } else {
-        windowShell()->initContextIfNeeded();
-        context = windowShell()->context();
-    }
-    return context == context->GetCurrent();
-}
-
 }  // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8Proxy.h b/Source/WebCore/bindings/v8/V8Proxy.h
index a62a60862..07a7781e2 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.h
+++ b/Source/WebCore/bindings/v8/V8Proxy.h
@@ -46,12 +46,6 @@
 #include <wtf/Vector.h>
 #include <wtf/text/TextPosition.h>
 
-#if defined(ENABLE_DOM_STATS_COUNTERS) && PLATFORM(CHROMIUM)
-#define INC_STATS(name) StatsCounter::incrementStatsCounter(name)
-#else
-#define INC_STATS(name)
-#endif
-
 namespace WebCore {
 
     class CachedScript;
@@ -67,8 +61,6 @@ namespace WebCore {
     class V8PerContextData;
     class WorldContextHandle;
 
-    const int kMaxRecursionDepth = 22;
-
     // Note: although the pointer is raw, the instance is kept alive by a strong
     // reference to the v8 context it contains, which is not made weak until we
     // call world->destroy().
@@ -87,46 +79,12 @@ namespace WebCore {
 
         Frame* frame() const { return m_frame; }
 
-        void finishedWithEvent(Event*) { }
-
-        // Evaluate a script file in the current execution environment.
-        // The caller must hold an execution context.
-        // If cannot evalute the script, it returns an error.
-        v8::Local<v8::Value> evaluate(const ScriptSourceCode&, Node*);
-
-        // Run an already compiled script.
-        v8::Local<v8::Value> runScript(v8::Handle<v8::Script>);
-
-        // Returns V8 Context of a frame. If none exists, creates
-        // a new context. It is potentially slow and consumes memory.
-        static v8::Local<v8::Context> context(Frame*);
-
-        v8::Local<v8::Context> context();
-        v8::Local<v8::Context> isolatedWorldContext(int worldId);
-        bool matchesCurrentContext();
-
         // FIXME: This should eventually take DOMWrapperWorld argument!
         // FIXME: This method will be soon removed, as all methods that access windowShell()
         // will be moved to ScriptController.
         V8DOMWindowShell* windowShell() const;
-
-        // FIXME: Move m_isolatedWorlds to ScriptController and remove this getter.
-        IsolatedWorldMap& isolatedWorlds() { return m_isolatedWorlds; }
-
-        // FIXME: Move m_isolatedWorldSecurityOrigins to ScriptController and remove this getter.
-        IsolatedWorldSecurityOriginMap& isolatedWorldSecurityOrigins() { return m_isolatedWorldSecurityOrigins; }
-
     private:
-        PassOwnPtr<v8::ScriptData> precompileScript(v8::Handle<v8::String>, CachedScript*);
-
         Frame* m_frame;
-
-        // The isolated worlds we are tracking for this frame. We hold them alive
-        // here so that they can be used again by future calls to
-        // evaluateInIsolatedWorld().
-        IsolatedWorldMap m_isolatedWorlds;
-        
-        IsolatedWorldSecurityOriginMap m_isolatedWorldSecurityOrigins;
     };
 }
 
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index 4cfe531ea..0a45dddf0 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -41,7 +41,6 @@
 #include "V8ArrayBuffer.h"
 #include "V8Binding.h"
 #include "V8MessagePort.h"
-#include "V8Proxy.h"
 #include "WorkerContext.h"
 #include <v8.h>
 #include <wtf/ArrayBuffer.h>
@@ -104,13 +103,19 @@ bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, A
         v8::Local<v8::Value> transferrable = transferrables->Get(i);
         // Validation of non-null objects, per HTML5 spec 10.3.3.
         if (isUndefinedOrNull(transferrable)) {
-            setDOMException(DATA_CLONE_ERR, isolate);
+            setDOMException(INVALID_STATE_ERR, isolate);
             return false;
         }
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
-        if (V8MessagePort::HasInstance(transferrable))
-            ports.append(V8MessagePort::toNative(v8::Handle<v8::Object>::Cast(transferrable)));
-        else if (V8ArrayBuffer::HasInstance(transferrable))
+        if (V8MessagePort::HasInstance(transferrable)) {
+            RefPtr<MessagePort> port = V8MessagePort::toNative(v8::Handle<v8::Object>::Cast(transferrable));
+            // Check for duplicate MessagePorts.
+            if (ports.contains(port)) {
+                setDOMException(INVALID_STATE_ERR, isolate);
+                return false;
+            }
+            ports.append(port.release());
+        } else if (V8ArrayBuffer::HasInstance(transferrable))
             arrayBuffers.append(V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(transferrable)));
         else {
             throwTypeError();
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index b0f051e8f..e7059fe69 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -45,6 +45,7 @@
 #include "V8DOMMap.h"
 #include "V8DOMWindowShell.h"
 #include "V8DedicatedWorkerContext.h"
+#include "V8GCController.h"
 #include "V8ObjectConstructor.h"
 #include "V8PerContextData.h"
 #include "V8RecursionScope.h"
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index d67895129..917849666 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -39,7 +39,6 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "V8DOMMap.h"
-#include "V8Proxy.h"
 #include "V8WorkerContext.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
index 672c2ab9d..fb00a1ad7 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
@@ -37,7 +37,6 @@
 #include "ExceptionCode.h"
 #include "V8ArrayBuffer.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
index 12be5b309..1ce2bebd1 100644
--- a/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/Source/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -37,7 +37,6 @@
 #include "V8ArrayBuffer.h"
 #include "V8ArrayBufferCustom.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp
index 0fd9506d7..0b024612e 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioBufferSourceNodeCustom.cpp
@@ -33,7 +33,6 @@
 #include "ExceptionCode.h"
 #include "V8AudioBuffer.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
index 13d0d2699..56b12dcdf 100644
--- a/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8AudioContextCustom.cpp
@@ -35,7 +35,6 @@
 #include "V8ArrayBuffer.h"
 #include "V8AudioBuffer.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include <wtf/ArrayBuffer.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp b/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
index 6ebcc2d64..1112e5406 100644
--- a/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8BlobCustom.cpp
@@ -37,7 +37,6 @@
 #include "V8Binding.h"
 #include "V8Blob.h"
 #include "V8File.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WebKitBlobBuilder.h"
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
index 007bd9ab7..dd0800fbb 100644
--- a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
@@ -39,7 +39,6 @@
 #include "EventTarget.h"
 
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringConcatenate.h>
diff --git a/Source/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp b/Source/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
index a27fd01e7..4060096cb 100644
--- a/Source/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp
@@ -45,7 +45,6 @@
 #include "V8HTMLImageElement.h"
 #include "V8HTMLVideoElement.h"
 #include "V8ImageData.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index 875f64e68..06635228b 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -40,7 +40,6 @@
 
 #include "V8Binding.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index d8a9b1ff2..99d127d6b 100644
--- a/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -38,7 +38,6 @@
 #include "ScriptCallStackFactory.h"
 #include "V8Binding.h"
 #include "V8MemoryInfo.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8CoordinatesCustom.cpp b/Source/WebCore/bindings/v8/custom/V8CoordinatesCustom.cpp
index 8289eb2b2..8238ad6b7 100644
--- a/Source/WebCore/bindings/v8/custom/V8CoordinatesCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CoordinatesCustom.cpp
@@ -28,7 +28,6 @@
 
 #include "Coordinates.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp b/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
index fb790b10a..b97f7d76b 100644
--- a/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
@@ -36,7 +36,6 @@
 
 #include "ScriptExecutionContext.h"
 #include "V8Callback.h"
-#include "V8Proxy.h"
 #include "V8SQLError.h"
 #include "V8SQLTransaction.h"
 #include <wtf/Assertions.h>
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
index ae7e9072f..33be7e99d 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
@@ -35,7 +35,6 @@
 #include "V8Binding.h"
 #include "V8Blob.h"
 #include "V8HTMLFormElement.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index b8aa4face..7280d91c5 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -61,7 +61,6 @@
 #include "V8HiddenPropertyName.h"
 #include "V8HTMLCollection.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WindowFeatures.h"
 #include <wtf/ArrayBuffer.h>
@@ -121,7 +120,8 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
         }
 
         // params is passed to action, and released in action's destructor
-        OwnPtr<ScheduledAction> action = adoptPtr(new ScheduledAction(V8Proxy::context(imp->frame()), v8::Handle<v8::Function>::Cast(function), paramCount, params));
+        ASSERT(imp->frame());
+        OwnPtr<ScheduledAction> action = adoptPtr(new ScheduledAction(imp->frame()->script()->currentWorldContext(), v8::Handle<v8::Function>::Cast(function), paramCount, params));
 
         // FIXME: We should use OwnArrayPtr for params.
         delete[] params;
@@ -131,7 +131,8 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
         RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
         if (imp->document() && !imp->document()->contentSecurityPolicy()->allowEval(callStack.release()))
             return v8Integer(0, args.GetIsolate());
-        id = DOMTimer::install(scriptContext, adoptPtr(new ScheduledAction(V8Proxy::context(imp->frame()), functionString)), timeout, singleShot);
+        ASSERT(imp->frame());
+        id = DOMTimer::install(scriptContext, adoptPtr(new ScheduledAction(imp->frame()->script()->currentWorldContext(), functionString)), timeout, singleShot);
     }
 
     // Try to do the idle notification before the timeout expires to get better
@@ -154,7 +155,8 @@ v8::Handle<v8::Value> V8DOMWindow::eventAccessorGetter(v8::Local<v8::String> nam
     if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), frame))
         return v8::Undefined();
 
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
+    ASSERT(frame);
+    v8::Local<v8::Context> context = frame->script()->currentWorldContext();
     if (context.IsEmpty())
         return v8::Undefined();
 
@@ -175,7 +177,8 @@ void V8DOMWindow::eventAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::
     if (!BindingSecurity::shouldAllowAccessToFrame(BindingState::instance(), frame))
         return;
 
-    v8::Local<v8::Context> context = V8Proxy::context(frame);
+    ASSERT(frame);
+    v8::Local<v8::Context> context = frame->script()->currentWorldContext();
     if (context.IsEmpty())
         return;
 
@@ -402,7 +405,7 @@ private:
 
 inline void DialogHandler::dialogCreated(DOMWindow* dialogFrame)
 {
-    m_dialogContext = V8Proxy::context(dialogFrame->frame());
+    m_dialogContext = dialogFrame->frame() ? dialogFrame->frame()->script()->currentWorldContext() : v8::Local<v8::Context>();
     if (m_dialogContext.IsEmpty())
         return;
     if (m_dialogArguments.IsEmpty())
@@ -621,7 +624,7 @@ v8::Handle<v8::Value> toV8(DOMWindow* window, v8::Isolate* isolate)
     }
 
     // Otherwise, return the global object associated with this frame.
-    v8::Handle<v8::Context> context = V8Proxy::context(frame);
+    v8::Handle<v8::Context> context = frame->script()->currentWorldContext();
     if (context.IsEmpty())
         return v8Undefined();
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index afb207c76..2f12a56b2 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -29,7 +29,6 @@
 #include "V8ArrayBufferViewCustom.h"
 #include "V8Binding.h"
 #include "V8DataView.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
index 0cb6eca44..d2a24186b 100644
--- a/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
@@ -37,7 +37,6 @@
 #include "DedicatedWorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "V8WorkerContextEventListener.h"
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp
index 610a34bdc..83ff773b7 100644
--- a/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DeviceMotionEventCustom.cpp
@@ -30,7 +30,6 @@
 
 #include "DeviceMotionData.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 #include <v8.h>
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
index 128302439..c6861bae9 100644
--- a/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DeviceOrientationEventCustom.cpp
@@ -30,7 +30,6 @@
 
 #include "DeviceOrientationData.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 #include <v8.h>
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index ce72b602a..3ef19f255 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -48,7 +48,6 @@
 #include "V8HTMLDocument.h"
 #include "V8IsolatedContext.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include "V8Touch.h"
 #include "V8TouchList.h"
 #if ENABLE(WEBGL)
@@ -76,7 +75,7 @@ v8::Handle<v8::Value> V8Document::evaluateCallback(const v8::Arguments& args)
     if (V8Node::HasInstance(args[1]))
         contextNode = V8Node::toNative(v8::Handle<v8::Object>::Cast(args[1]));
 
-    RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2]);
+    RefPtr<XPathNSResolver> resolver = toXPathNSResolver(args[2]);
     if (!resolver && !args[2]->IsNull() && !args[2]->IsUndefined())
         return setDOMException(TYPE_MISMATCH_ERR, args.GetIsolate());
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
index 7613a14b1..304aadd52 100644
--- a/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DocumentLocationCustom.cpp
@@ -30,7 +30,6 @@
 #include "Location.h"
 #include "V8Binding.h"
 #include "V8Location.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp
index a6179c2e5..ced418558 100644
--- a/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8EntryCustom.cpp
@@ -39,7 +39,6 @@
 #include "V8DirectoryEntry.h"
 #include "V8Entry.h"
 #include "V8FileEntry.h"
-#include "V8Proxy.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
index c89e48979..c8cc3809a 100644
--- a/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
@@ -39,7 +39,6 @@
 #include "V8DirectoryEntrySync.h"
 #include "V8EntrySync.h"
 #include "V8FileEntrySync.h"
-#include "V8Proxy.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
index 9da52c74f..67f1a73e9 100644
--- a/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8EventCustom.cpp
@@ -39,7 +39,6 @@
 #include "EventNames.h"
 #include "V8Binding.h"
 #include "V8Clipboard.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
index 6bcdc71c9..4fdf3adef 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
@@ -37,7 +37,6 @@
 #include "V8NamedNodesCollection.h"
 #include "V8Node.h"
 #include "V8NodeList.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index f9e36cb6b..5d268201e 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -40,7 +40,6 @@
 #include "V8Binding.h"
 #include "V8CanvasRenderingContext2D.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #if ENABLE(WEBGL)
 #include "InspectorWebGLInstrumentation.h"
 #include "V8WebGLRenderingContext.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
index eb0fd25d2..45f230e37 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCollectionCustom.cpp
@@ -38,7 +38,6 @@
 #include "V8NamedNodesCollection.h"
 #include "V8Node.h"
 #include "V8NodeList.h"
-#include "V8Proxy.h"
 #include "V8RadioNodeList.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index fb801a761..3f1cbc1ee 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -44,7 +44,6 @@
 #include "V8HTMLCollection.h"
 #include "V8IsolatedContext.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include "V8RecursionScope.h"
 #include <wtf/text/StringBuilder.h>
 #include <wtf/OwnArrayPtr.h>
@@ -142,7 +141,7 @@ v8::Handle<v8::Value> V8HTMLDocument::openCallback(const v8::Arguments& args)
     if (args.Length() > 2) {
         if (RefPtr<Frame> frame = htmlDocument->frame()) {
             // Fetch the global object for the frame.
-            v8::Local<v8::Context> context = V8Proxy::context(frame.get());
+            v8::Local<v8::Context> context = frame->script()->currentWorldContext();
             // Bail out if we cannot get the context.
             if (context.IsEmpty())
                 return v8::Undefined();
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
index c650649df..4033629ff 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLFormElementCustom.cpp
@@ -37,7 +37,6 @@
 #include "V8NamedNodesCollection.h"
 #include "V8Node.h"
 #include "V8NodeList.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
index 649cb35a6..3cec8a7ff 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
@@ -35,7 +35,6 @@
 #include "HTMLFrameElement.h"
 #include "HTMLNames.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
index 0a9693aba..0d993775a 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp
@@ -41,7 +41,6 @@
 
 #include "V8Binding.h"
 #include "V8DOMWindow.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
index 81110b785..05cadeb67 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -39,7 +39,6 @@
 #include "V8Binding.h"
 #include "V8Document.h"
 #include "V8HTMLImageElement.h"
-#include "V8Proxy.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
index 63825a9b2..72148f026 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
@@ -34,7 +34,6 @@
 #include "HTMLInputElement.h"
 
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLLinkElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLLinkElementCustom.cpp
index 5a3c06fc6..97d4e7324 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLLinkElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLLinkElementCustom.cpp
@@ -34,7 +34,6 @@
 #include "HTMLLinkElement.h"
 #include "V8Binding.h"
 #include "V8DOMSettableTokenList.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
index ddb517202..bf195b3a1 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLMediaElementCustom.cpp
@@ -30,7 +30,6 @@
 #include "V8HTMLMediaElement.h"
 
 #include "V8MediaController.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
index 8ee991d67..215f71fcd 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
@@ -40,7 +40,6 @@
 #include "V8HTMLOptionElement.h"
 #include "V8HTMLSelectElementCustom.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLOutputElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLOutputElementCustom.cpp
index 4eeaef639..433da425b 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLOutputElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLOutputElementCustom.cpp
@@ -34,7 +34,6 @@
 #include "HTMLOutputElement.h"
 #include "V8Binding.h"
 #include "V8DOMSettableTokenList.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
index 406632574..a40ca22ca 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLPlugInElementCustom.cpp
@@ -37,7 +37,6 @@
 #include "V8HTMLEmbedElement.h"
 #include "V8HTMLObjectElement.h"
 #include "V8NPObject.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp
index 71473c56c..ca804a747 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLSelectElementCustom.cpp
@@ -42,7 +42,6 @@
 #include "V8NamedNodesCollection.h"
 #include "V8Node.h"
 #include "V8NodeList.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
index acdb74972..2198f0cac 100644
--- a/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HistoryCustom.cpp
@@ -38,7 +38,6 @@
 #include "V8Binding.h"
 #include "V8DOMWindow.h"
 #include "V8HiddenPropertyName.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 0fe290b3a..df9d14657 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -40,6 +40,7 @@
 #include "InspectorValues.h"
 #include "ScriptDebugServer.h"
 #include "ScriptValue.h"
+#include "V8AbstractEventListener.h"
 #include "V8Binding.h"
 #include "V8Database.h"
 #include "V8Float32Array.h"
@@ -52,7 +53,6 @@
 #include "V8Int8Array.h"
 #include "V8NodeList.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include "V8Storage.h"
 #include "V8Uint16Array.h"
 #include "V8Uint32Array.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
index 659fd8b28..95f82261d 100644
--- a/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InspectorFrontendHostCustom.cpp
@@ -40,7 +40,6 @@
 
 #include "V8Binding.h"
 #include "V8MouseEvent.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
index 848a91656..bd002f7c5 100644
--- a/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IntentConstructor.cpp
@@ -37,7 +37,6 @@
 #include "V8DOMWrapper.h"
 #include "V8Intent.h"
 #include "V8MessagePort.h"
-#include "V8Proxy.h"
 #include <wtf/ArrayBuffer.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp b/Source/WebCore/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp
index 76b5eee31..c17770d4c 100644
--- a/Source/WebCore/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8JavaScriptCallFrameCustom.cpp
@@ -34,7 +34,6 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp
index df9f38527..361b4a5a5 100644
--- a/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8LocationCustom.cpp
@@ -42,7 +42,6 @@
 #include "V8DOMWindow.h"
 #include "V8EventListener.h"
 #include "V8Utilities.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
index ae355694d..2189aa906 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
@@ -36,7 +36,6 @@
 #include "MessageChannel.h"
 #include "V8Binding.h"
 #include "V8MessagePort.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
index 922abb153..9200d8ffa 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
@@ -39,7 +39,6 @@
 #include "V8Blob.h"
 #include "V8DOMWindow.h"
 #include "V8MessagePort.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
index 7fe8faae2..544c7bb2a 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
@@ -36,7 +36,6 @@
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8MessagePort.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContextExecutionProxy.h"
 
diff --git a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
index 7f3095d63..ee3e68022 100644
--- a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
@@ -39,7 +39,6 @@
 #include "V8Callback.h"
 #include "V8MutationObserver.h"
 #include "V8MutationRecord.h"
-#include "V8Proxy.h"
 #include <wtf/Assertions.h>
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
diff --git a/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
index 7c9e5250a..d1ce128d9 100644
--- a/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
@@ -39,7 +39,6 @@
 #include "V8Binding.h"
 #include "V8DOMWrapper.h"
 #include "V8MutationCallback.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
index 6bd2a05b1..667d16810 100644
--- a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
@@ -37,7 +37,6 @@
 #include "V8Binding.h"
 #include "V8Element.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 
 #include <wtf/RefPtr.h>
 
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 3aba2f967..1cab8f12e 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -51,7 +51,6 @@
 #include "V8Node.h"
 #include "V8Notation.h"
 #include "V8ProcessingInstruction.h"
-#include "V8Proxy.h"
 #include "V8Text.h"
 #include <wtf/RefPtr.h>
 
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
index 595b484ed..e25c128d1 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
@@ -35,7 +35,6 @@
 #include "NodeList.h"
 #include "V8Binding.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 
 #include <wtf/RefPtr.h>
 #include <wtf/StdLibExtras.h>
diff --git a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
index 7626a0b46..3a029d720 100644
--- a/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -40,7 +40,6 @@
 #include "V8Binding.h"
 #include "V8EventListener.h"
 #include "V8Notification.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "V8VoidCallback.h"
 #include "WorkerContext.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8NotificationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NotificationCustom.cpp
index ffc38aa72..7565ffe48 100644
--- a/Source/WebCore/bindings/v8/custom/V8NotificationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NotificationCustom.cpp
@@ -30,7 +30,6 @@
 
 #include "ExceptionCode.h"
 #include "V8NotificationPermissionCallback.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
index 0abf0c043..842a5381f 100644
--- a/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8PopStateEventCustom.cpp
@@ -36,7 +36,6 @@
 #include "SerializedScriptValue.h"
 #include "V8HiddenPropertyName.h"
 #include "V8History.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLResultSetRowListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLResultSetRowListCustom.cpp
index a7c40419b..70911da12 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLResultSetRowListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLResultSetRowListCustom.cpp
@@ -35,7 +35,6 @@
 
 #include "SQLResultSetRowList.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
index c6622eb43..1ce14c10d 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
@@ -40,7 +40,6 @@
 #include "V8Binding.h"
 #include "V8SQLStatementCallback.h"
 #include "V8SQLStatementErrorCallback.h"
-#include "V8Proxy.h"
 #include <wtf/Vector.h>
 
 using namespace WTF;
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
index f6e99d206..83cbf3936 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
@@ -39,7 +39,6 @@
 #include "SQLResultSet.h"
 #include "SQLValue.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include "V8SQLResultSet.h"
 #include <wtf/Vector.h>
 
diff --git a/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp
index fa9925bda..797eaabf0 100644
--- a/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SVGDocumentCustom.cpp
@@ -35,7 +35,6 @@
 
 #include "Frame.h"
 #include "V8IsolatedContext.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp
index 2963980b8..0cf56d842 100644
--- a/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ScriptProfileCustom.cpp
@@ -34,7 +34,6 @@
 
 #include "ScriptProfile.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 #include <v8-profiler.h>
 
diff --git a/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp
index 845c92471..4f3cb8237 100644
--- a/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ScriptProfileNodeCustom.cpp
@@ -34,7 +34,6 @@
 
 #include "ScriptProfileNode.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 #include <v8-profiler.h>
 
diff --git a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
index 5c4dc02d4..cd9fb1632 100644
--- a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
@@ -33,7 +33,6 @@
 
 #include "Storage.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
index c4e82bb08..904abd4ea 100644
--- a/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StyleSheetListCustom.cpp
@@ -34,7 +34,6 @@
 #include "HTMLStyleElement.h"
 #include "StyleSheetList.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include "V8StyleSheet.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8TrackEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8TrackEventCustom.cpp
index c7c517528..86aaf95ef 100644
--- a/Source/WebCore/bindings/v8/custom/V8TrackEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8TrackEventCustom.cpp
@@ -36,7 +36,6 @@
 
 #include "TrackBase.h"
 #include "TrackEvent.h"
-#include "V8Proxy.h"
 #include "V8TextTrack.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/bindings/v8/custom/V8UndoManagerCustom.cpp b/Source/WebCore/bindings/v8/custom/V8UndoManagerCustom.cpp
index c7088bb02..71be095a7 100644
--- a/Source/WebCore/bindings/v8/custom/V8UndoManagerCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8UndoManagerCustom.cpp
@@ -31,7 +31,6 @@
 #include "DOMTransaction.h"
 #include "ExceptionCode.h"
 #include "V8DOMTransaction.h"
-#include "V8HiddenPropertyName.h"
 
 namespace WebCore {
 
@@ -49,9 +48,7 @@ v8::Handle<v8::Value> V8UndoManager::transactCallback(const v8::Arguments& args)
     EXCEPTION_BLOCK(bool, merge, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined)->BooleanValue());
 
     RefPtr<DOMTransaction> transaction = DOMTransaction::create(WorldContextHandle(UseCurrentWorld));
-    v8::Handle<v8::Object> transactionWrapper = v8::Handle<v8::Object>::Cast(toV8(transaction.get()));
-
-    transactionWrapper->SetHiddenValue(V8HiddenPropertyName::domTransactionData(), dictionary);
+    transaction->setData(dictionary);
 
     ExceptionCode ec = 0;
     imp->transact(transaction, merge, ec);
@@ -60,6 +57,37 @@ v8::Handle<v8::Value> V8UndoManager::transactCallback(const v8::Arguments& args)
     return v8Undefined();
 }
 
+v8::Handle<v8::Value> V8UndoManager::itemCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.UndoManager.item");
+    if (args.Length() < 1)
+        return throwNotEnoughArgumentsError(args.GetIsolate());
+    UndoManager* imp = V8UndoManager::toNative(args.Holder());
+
+    EXCEPTION_BLOCK(unsigned, index, toUInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+
+    if (index >= imp->length())
+        return v8::Null(args.GetIsolate());
+
+    const UndoManagerEntry& entry = imp->item(index);
+
+    v8::Handle<v8::Array> result = v8::Array::New(entry.size());
+    v8::Isolate* isolate = args.GetIsolate();
+    for (size_t index = 0; index < entry.size(); ++index) {
+        UndoStep* step = entry[index].get();
+        if (step->isDOMTransaction())
+            result->Set(v8Integer(index, isolate), static_cast<DOMTransaction*>(step)->data());
+        else {
+            // FIXME: We shouldn't be creating new object each time we return.
+            // Object for the same native editing command should always be the same.
+            v8::Handle<v8::Object> object = v8::Object::New();
+            object->Set(v8::String::NewSymbol("label"), v8::String::New("[Editing command]"));
+            result->Set(v8Integer(index, isolate), object);
+        }
+    }
+    return result;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(UNDO_MANAGER)
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 70d780d39..3657cfb1b 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -50,7 +50,6 @@
 #include "V8OESStandardDerivatives.h"
 #include "V8OESTextureFloat.h"
 #include "V8OESVertexArrayObject.h"
-#include "V8Proxy.h"
 #include "V8Uint16Array.h"
 #include "V8Uint32Array.h"
 #include "V8Uint8Array.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
index fcbf49d5a..3ec7d9917 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
@@ -27,7 +27,6 @@
 #include "V8WebKitAnimation.h"
 
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include "WebKitAnimation.h"
 
 #include <v8.h>
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
index de4022a8b..52b04a773 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
@@ -33,7 +33,6 @@
 
 #include "V8Binding.h"
 #include "V8DOMWrapper.h"
-#include "V8Proxy.h"
 #include "WrapperTypeInfo.h"
 
 #include <wtf/MathExtras.h>
diff --git a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
index 3d44b5292..7411dac0d 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
@@ -41,7 +41,6 @@
 #include "V8ArrayBufferView.h"
 #include "V8Binding.h"
 #include "V8Blob.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WebSocket.h"
 #include "WebSocketChannel.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index 57232578c..3a1da47b7 100644
--- a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -37,7 +37,6 @@
 #include "ExceptionCode.h"
 #include "ScheduledAction.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "V8WorkerContextEventListener.h"
 #include "WebSocket.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
index 945c29ec0..1b4f29c3c 100644
--- a/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
@@ -40,7 +40,6 @@
 #include "Frame.h"
 #include "SerializedScriptValue.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
index 7bd673082..c0e9c5b92 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
@@ -36,7 +36,6 @@
 #include "SecurityOrigin.h"
 #include "V8Binding.h"
 #include "V8IsolatedContext.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index f89e3c97d..dbeb64432 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -42,7 +42,6 @@
 #include "V8DOMFormData.h"
 #include "V8Document.h"
 #include "V8HTMLDocument.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
diff --git a/Source/WebCore/bindings/v8/custom/V8XSLTProcessorCustom.cpp b/Source/WebCore/bindings/v8/custom/V8XSLTProcessorCustom.cpp
index 3dc9ef570..87228c9a2 100644
--- a/Source/WebCore/bindings/v8/custom/V8XSLTProcessorCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XSLTProcessorCustom.cpp
@@ -42,7 +42,6 @@
 #include "V8Document.h"
 #include "V8DocumentFragment.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include "XSLTProcessor.h"
 
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index d36cf1cdb..b9a34ac30 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "qt_instance.h"
 
+#include "APICast.h"
 #include "Error.h"
 #include "JSDOMBinding.h"
 #include "JSDOMWindowBase.h"
@@ -360,7 +361,6 @@ JSValue QtInstance::valueOf(ExecState* exec) const
 }
 
 // In qt_runtime.cpp
-JSValue convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
 QVariant convertValueToQVariant(ExecState*, JSValue, QMetaType::Type hint, int *distance);
 
 QByteArray QtField::name() const
@@ -394,7 +394,11 @@ JSValue QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
         else if (m_type == DynamicProperty)
             val = obj->property(m_dynamicProperty);
 #endif
-        return convertQVariantToValue(exec, inst->rootObject(), val);
+        JSValueRef exception = 0;
+        JSValueRef jsValue = convertQVariantToValue(toRef(exec), inst->rootObject(), val, &exception);
+        if (exception)
+            return throwError(exec, toJS(exec, exception));
+        return toJS(exec, jsValue);
     }
     QString msg = QString(QLatin1String("cannot access member `%1' of deleted QObject")).arg(QLatin1String(name()));
     return throwError(exec, createError(exec, msg.toLatin1().constData()));
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 50f6db645..842f95d65 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -104,7 +104,7 @@ typedef enum {
     Object,
     Null,
     RTArray,
-    JSUint8ClampedArray
+    RTUint8ClampedArray
 } JSRealType;
 
 #if defined(QTWK_RUNTIME_CONVERSION_DEBUG) || defined(QTWK_RUNTIME_MATCH_DEBUG)
@@ -162,7 +162,7 @@ static JSRealType valueRealType(ExecState* exec, JSValue val)
     else if (val.isNull())
         return Null;
     else if (isJSUint8ClampedArray(val))
-        return JSUint8ClampedArray;
+        return RTUint8ClampedArray;
     else if (val.isObject()) {
         JSObject *object = val.toObject(exec);
         if (object->inherits(&RuntimeArray::s_info))  // RuntimeArray 'inherits' from Array, but not in C++
@@ -264,7 +264,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
             case QObj:
                 hint = QMetaType::QObjectStar;
                 break;
-            case JSUint8ClampedArray:
+            case RTUint8ClampedArray:
                 hint = QMetaType::QByteArray;
                 break;
             case Array:
@@ -484,7 +484,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
         }
 
         case QMetaType::QByteArray: {
-            if (type == JSUint8ClampedArray) {
+            if (type == RTUint8ClampedArray) {
                 WTF::Uint8ClampedArray* arr = toUint8ClampedArray(value);
                 ret = QVariant(QByteArray(reinterpret_cast<const char*>(arr->data()), arr->length()));
                 dist = 0;
@@ -775,7 +775,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
     return convertValueToQVariant(exec, value, hint, distance, &visitedObjects, recursionLimit);
 }
 
-JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
+JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> root, const QVariant& variant, JSValueRef *exception)
 {
     // Variants with QObject * can be isNull but not a null pointer
     // An empty QString variant is also null
@@ -786,13 +786,11 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         !QMetaType::typeFlags(type).testFlag(QMetaType::PointerToQObject) &&
         type != QMetaType::VoidStar &&
         type != QMetaType::QString) {
-        return jsNull();
+        return JSValueMakeNull(context);
     }
 
-    JSLockHolder lock(exec);
-
     if (type == QMetaType::Bool)
-        return jsBoolean(variant.toBool());
+        return JSValueMakeBoolean(context, variant.toBool());
 
     if (type == QMetaType::Int ||
         type == QMetaType::UInt ||
@@ -804,7 +802,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         type == QMetaType::UShort ||
         type == QMetaType::Float ||
         type == QMetaType::Double)
-        return jsNumber(variant.toDouble());
+        return JSValueMakeNumber(context, variant.toDouble());
 
     if (type == QMetaType::QDateTime ||
         type == QMetaType::QDate ||
@@ -824,59 +822,62 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         }
 
         // Dates specified this way are in local time (we convert DateTimes above)
-        GregorianDateTime dt;
-        dt.setYear(date.year());
-        dt.setMonth(date.month() - 1);
-        dt.setMonthDay(date.day());
-        dt.setHour(time.hour());
-        dt.setMinute(time.minute());
-        dt.setSecond(time.second());
-        dt.setIsDST(-1);
-        double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
-
-        return DateInstance::create(exec, exec->lexicalGlobalObject()->dateStructure(), trunc(ms));
+        const JSValueRef arguments[] = {
+            JSValueMakeNumber(context, date.year()),
+            JSValueMakeNumber(context, date.month() - 1),
+            JSValueMakeNumber(context, date.day()),
+            JSValueMakeNumber(context, time.hour()),
+            JSValueMakeNumber(context, time.minute()),
+            JSValueMakeNumber(context, time.second()),
+            JSValueMakeNumber(context, time.msec())
+        };
+        return JSObjectMakeDate(context, 7, arguments, exception);
     }
 
     if (type == QMetaType::QByteArray) {
         QByteArray qtByteArray = variant.value<QByteArray>();
         WTF::RefPtr<WTF::Uint8ClampedArray> wtfByteArray = WTF::Uint8ClampedArray::createUninitialized(qtByteArray.length());
         memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
-        return toJS(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), wtfByteArray.get());
+        ExecState* exec = toJS(context);
+        return toRef(exec, toJS(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), wtfByteArray.get()));
     }
 
     if (QMetaType::typeFlags(type).testFlag(QMetaType::PointerToQObject)) {
         QObject* obj = variant.value<QObject*>();
         if (!obj)
-            return jsNull();
-        return QtInstance::getQtInstance(obj, root, QtInstance::QtOwnership)->createRuntimeObject(exec);
+            return JSValueMakeNull(context);
+        ExecState* exec = toJS(context);
+        return toRef(exec, QtInstance::getQtInstance(obj, root, QtInstance::QtOwnership)->createRuntimeObject(exec));
     }
 
-    if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(variant.type())))
-        return QtPixmapInstance::createPixmapRuntimeObject(exec, root, variant);
+    if (QtPixmapInstance::canHandle(static_cast<QMetaType::Type>(variant.type()))) {
+        ExecState* exec = toJS(context);
+        return toRef(exec, QtPixmapInstance::createPixmapRuntimeObject(exec, root, variant));
+    }
 
     if (customRuntimeConversions()->contains(type)) {
         if (!root->globalObject()->inherits(&JSDOMWindow::s_info))
-            return jsUndefined();
+            return JSValueMakeUndefined(context);
 
         Document* document = (static_cast<JSDOMWindow*>(root->globalObject()))->impl()->document();
         if (!document)
-            return jsUndefined();
-        return customRuntimeConversions()->value(type).toJSValueFunc(exec, toJSDOMGlobalObject(document, exec), variant);
+            return JSValueMakeUndefined(context);
+        ExecState* exec = toJS(context);
+        return toRef(exec, customRuntimeConversions()->value(type).toJSValueFunc(exec, toJSDOMGlobalObject(document, exec), variant));
     }
 
     if (type == QMetaType::QVariantMap) {
         // create a new object, and stuff properties into it
-        JSObject* ret = constructEmptyObject(exec);
+        JSObjectRef ret = JSObjectMake(context, 0, 0);
         QVariantMap map = variant.value<QVariantMap>();
         QVariantMap::const_iterator i = map.constBegin();
         while (i != map.constEnd()) {
             QString s = i.key();
-            JSValue val = convertQVariantToValue(exec, root.get(), i.value());
-            if (val) {
-                PutPropertySlot slot;
-                ret->methodTable()->put(ret, exec, Identifier(&exec->globalData(), reinterpret_cast_ptr<const UChar *>(s.constData()), s.length()), val, slot);
-                // ### error case?
-            }
+            JSStringRef propertyName = JSStringCreateWithCharacters(reinterpret_cast<const JSChar*>(s.constData()), s.length());
+            JSValueRef propertyValue = convertQVariantToValue(context, root.get(), i.value(), /*ignored exception*/0);
+            if (propertyValue)
+                JSObjectSetProperty(context, ret, propertyName, propertyValue, kJSPropertyAttributeNone, /*ignored exception*/0);
+            JSStringRelease(propertyName);
             ++i;
         }
 
@@ -885,31 +886,58 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
 
     // List types
     if (type == QMetaType::QVariantList) {
+        // ### TODO: Could use special array class that lazily converts.
+        // See https://bugs.webkit.org/show_bug.cgi?id=94691
         QVariantList vl = variant.toList();
-        qConvDebug() << "got a " << vl.count() << " length list:" << vl;
-        return RuntimeArray::create(exec, new QtArray<QVariant>(vl, QMetaType::Void, root));
+        JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);
+        if (exception && *exception)
+            return array;
+        for (int i = 0; i < vl.count(); ++i) {
+            JSValueRef property = convertQVariantToValue(context, root.get(), vl.at(i), /*ignored exception*/0);
+            if (property)
+                JSObjectSetPropertyAtIndex(context, array, i, property, /*ignored exception*/0);
+        }
+        return array;
     } else if (type == QMetaType::QStringList) {
         QStringList sl = variant.value<QStringList>();
-        return RuntimeArray::create(exec, new QtArray<QString>(sl, QMetaType::QString, root));
-    } else if (type == (QMetaType::Type) qMetaTypeId<QObjectList>()) {
-        QObjectList ol= variant.value<QObjectList>();
-        return RuntimeArray::create(exec, new QtArray<QObject*>(ol, QMetaType::QObjectStar, root));
-    } else if (type == (QMetaType::Type)qMetaTypeId<QList<int> >()) {
-        QList<int> il= variant.value<QList<int> >();
-        return RuntimeArray::create(exec, new QtArray<int>(il, QMetaType::Int, root));
+        JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);
+        for (int i = 0; i < sl.count(); ++i) {
+            const QString& s = sl.at(i);
+            JSStringRef jsString = JSStringCreateWithCharacters(reinterpret_cast<const JSChar*>(s.constData()), s.length());
+            JSObjectSetPropertyAtIndex(context, array, i, JSValueMakeString(context, jsString), /*ignored exception*/0);
+            JSStringRelease(jsString);
+        }
+        return array;
+    } else if (type == static_cast<QMetaType::Type>(qMetaTypeId<QObjectList>())) {
+        QObjectList ol = variant.value<QObjectList>();
+        JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);
+        ExecState* exec = toJS(context);
+        for (int i = 0; i < ol.count(); ++i) {
+            JSValueRef jsObject = toRef(exec, QtInstance::getQtInstance(ol.at(i), root, QtInstance::QtOwnership)->createRuntimeObject(exec));
+            JSObjectSetPropertyAtIndex(context, array, i, jsObject, /*ignored exception*/0);
+        }
+        return array;
+    } else if (type == static_cast<QMetaType::Type>(qMetaTypeId<QList<int> >())) {
+        QList<int> il = variant.value<QList<int> >();
+        JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);
+        for (int i = 0; i < il.count(); ++i)
+            JSObjectSetPropertyAtIndex(context, array, i, JSValueMakeNumber(context, il.at(i)), /*ignored exception*/0);
+        return array;
     }
 
     if (type == (QMetaType::Type)qMetaTypeId<QVariant>()) {
         QVariant real = variant.value<QVariant>();
         qConvDebug() << "real variant is:" << real;
-        return convertQVariantToValue(exec, root, real);
+        return convertQVariantToValue(context, root.get(), real, exception);
     }
 
     qConvDebug() << "fallback path for" << variant << variant.userType();
 
     QString string = variant.toString();
-    UString ustring((UChar*)string.utf16(), string.length());
-    return jsString(exec, ustring);
+    JSStringRef jsstring = JSStringCreateWithCharacters(reinterpret_cast<const JSChar*>(string.constData()), string.length());
+    JSValueRef value = JSValueMakeString(context, jsstring);
+    JSStringRelease(jsstring);
+    return value;
 }
 
 // Type conversion metadata (from QtScript originally)
@@ -1333,7 +1361,7 @@ JSValueRef QtRuntimeMethod::call(JSContextRef context, JSObjectRef function, JSO
         return JSValueMakeUndefined(context);
 
     if (vargs.size() > 0 && vargs[0].isValid())
-        return toRef(toJS(context), convertQVariantToValue(toJS(context), d->m_instance->rootObject(), vargs[0]));
+        return convertQVariantToValue(context, d->m_instance->rootObject(), vargs[0], exception);
 
     return JSValueMakeUndefined(context);
 }
@@ -1649,7 +1677,7 @@ void QtConnectionObject::execute(void** argv)
 
     for (int i = 0; i < argc; i++) {
         int argType = method.parameterType(i);
-        args[i] = ::toRef(exec, convertQVariantToValue(exec, m_rootObject, QVariant(argType, argv[i+1])));
+        args[i] = convertQVariantToValue(toRef(exec), m_rootObject, QVariant(argType, argv[i+1]), ignoredException);
     }
 
     JSObjectCallAsFunction(m_context, m_receiverFunction, m_receiver, argc, args.data(), 0);
@@ -1701,7 +1729,7 @@ template <typename T> JSValue QtArray<T>::valueAt(ExecState *exec, unsigned int
 {
     if (index < m_length) {
         T val = m_list.at(index);
-        return convertQVariantToValue(exec, rootObject(), QVariant::fromValue(val));
+        return convertQVariantToValue(toRef(exec), rootObject(), QVariant::fromValue(val));
     }
 
     return jsUndefined();
diff --git a/Source/WebCore/bridge/qt/qt_runtime.h b/Source/WebCore/bridge/qt/qt_runtime.h
index a91e4f513..ed0f4cfe2 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.h
+++ b/Source/WebCore/bridge/qt/qt_runtime.h
@@ -157,7 +157,7 @@ typedef JSValue (*ConvertToJSValueFunction)(ExecState* exec, WebCore::JSDOMGloba
 void registerCustomType(int qtMetaTypeId, ConvertToVariantFunction, ConvertToJSValueFunction);
 
 QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance);
-JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant);
+JSValueRef convertQVariantToValue(JSContextRef, PassRefPtr<RootObject>, const QVariant&, JSValueRef* exception);
 
 void setException(JSContextRef, JSValueRef* exception, const QString& text);
 
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 902536762..fe10eb0f6 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -53,6 +53,7 @@
 #include "RenderStyle.h"
 #include "RenderView.h"
 #include "ShadowValue.h"
+#include "StyleInheritedData.h"
 #include "StylePropertySet.h"
 #include "StylePropertyShorthand.h"
 #include "WebKitCSSTransformValue.h"
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index ec0f1c204..18c4c0352 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -596,11 +596,14 @@ static inline bool isValidKeywordPropertyAndValue(CSSPropertyID propertyId, int
         if (valueID == CSSValueAuto || valueID == CSSValueNone || (valueID >= CSSValueInset && valueID <= CSSValueDouble))
             return true;
         break;
-    case CSSPropertyOverflowX:
-    case CSSPropertyOverflowY: // visible | hidden | scroll | auto | marquee | overlay | inherit
+    case CSSPropertyOverflowX: // visible | hidden | scroll | auto | marquee | overlay | inherit
         if (valueID == CSSValueVisible || valueID == CSSValueHidden || valueID == CSSValueScroll || valueID == CSSValueAuto || valueID == CSSValueOverlay || valueID == CSSValueWebkitMarquee)
             return true;
         break;
+    case CSSPropertyOverflowY: // visible | hidden | scroll | auto | marquee | overlay | inherit | -webkit-paged-x | -webkit-paged-y
+        if (valueID == CSSValueVisible || valueID == CSSValueHidden || valueID == CSSValueScroll || valueID == CSSValueAuto || valueID == CSSValueOverlay || valueID == CSSValueWebkitMarquee || valueID == CSSValueWebkitPagedX || valueID == CSSValueWebkitPagedY)
+            return true;
+        break;
     case CSSPropertyPageBreakAfter: // auto | always | avoid | left | right | inherit
     case CSSPropertyPageBreakBefore:
     case CSSPropertyWebkitColumnBreakAfter:
@@ -1758,10 +1761,20 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
      */
     case CSSPropertyOverflow: {
         ShorthandScope scope(this, propId);
-        if (num != 1 || !parseValue(CSSPropertyOverflowX, important))
+        if (num != 1 || !parseValue(CSSPropertyOverflowY, important))
             return false;
-        CSSValue* value = m_parsedProperties->last().value();
-        addProperty(CSSPropertyOverflowY, value, important);
+
+        RefPtr<CSSValue> overflowXValue;
+
+        // FIXME: -webkit-paged-x or -webkit-paged-y only apply to overflow-y. If this value has been
+        // set using the shorthand, then for now overflow-x will default to auto, but once we implement
+        // pagination controls, it should default to hidden. If the overflow-y value is anything but
+        // paged-x or paged-y, then overflow-x and overflow-y should have the same value.
+        if (id == CSSValueWebkitPagedX || id == CSSValueWebkitPagedY)
+            overflowXValue = cssValuePool().createIdentifierValue(CSSValueAuto);
+        else
+            overflowXValue = m_parsedProperties->last().value();
+        addProperty(CSSPropertyOverflowX, overflowXValue.release(), important);
         return true;
     }
 
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index 7d1ca2974..c433f2094 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -31,6 +31,7 @@
 #include "Color.h"
 #include "Counter.h"
 #include "ExceptionCode.h"
+#include "Font.h"
 #include "MemoryInstrumentation.h"
 #include "Node.h"
 #include "Pair.h"
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index 14cef2595..c39a9c021 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1960,6 +1960,12 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EOverflow e)
         case OOVERLAY:
             m_value.ident = CSSValueOverlay;
             break;
+        case OPAGEDX:
+            m_value.ident = CSSValueWebkitPagedX;
+            break;
+        case OPAGEDY:
+            m_value.ident = CSSValueWebkitPagedY;
+            break;
     }
 }
 
@@ -1978,6 +1984,10 @@ template<> inline CSSPrimitiveValue::operator EOverflow() const
             return OMARQUEE;
         case CSSValueOverlay:
             return OOVERLAY;
+        case CSSValueWebkitPagedX:
+            return OPAGEDX;
+        case CSSValueWebkitPagedY:
+            return OPAGEDY;
     }
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index 853c77fc9..8205cff46 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -964,3 +964,7 @@ from-image
 snap
 #endif
 
+// overflow
+-webkit-paged-x
+-webkit-paged-y
+
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index ea5950e54..a7397aed3 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -96,6 +96,7 @@
 #include "RenderScrollbarTheme.h"
 #include "RenderStyleConstants.h"
 #include "RenderTheme.h"
+#include "RenderView.h"
 #include "RotateTransformOperation.h"
 #include "SVGDocumentExtensions.h"
 #include "SVGFontFaceElement.h"
@@ -885,8 +886,7 @@ void StyleResolver::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, in
     // then sort the buffer.
     if (m_element->hasID())
         collectMatchingRulesForList(rules->idRules(m_element->idForStyleResolution().impl()), firstRuleIndex, lastRuleIndex, options);
-    if (m_element->hasClass()) {
-        ASSERT(m_styledElement);
+    if (m_styledElement && m_styledElement->hasClass()) {
         for (size_t i = 0; i < m_styledElement->classNames().size(); ++i)
             collectMatchingRulesForList(rules->classRules(m_styledElement->classNames()[i].impl()), firstRuleIndex, lastRuleIndex, options);
     }
@@ -1600,6 +1600,46 @@ void StyleResolver::matchUARules(MatchResult& result)
     }
 }
 
+static void setStylesForPaginationMode(Pagination::Mode paginationMode, RenderStyle* style)
+{
+    if (paginationMode == Pagination::Unpaginated)
+        return;
+        
+    switch (paginationMode) {
+    case Pagination::LeftToRightPaginated:
+        style->setColumnAxis(HorizontalColumnAxis);
+        if (style->isHorizontalWritingMode())
+            style->setColumnProgression(style->isLeftToRightDirection() ? NormalColumnProgression : ReverseColumnProgression);
+        else
+            style->setColumnProgression(style->isFlippedBlocksWritingMode() ? ReverseColumnProgression : NormalColumnProgression);
+        break;
+    case Pagination::RightToLeftPaginated:
+        style->setColumnAxis(HorizontalColumnAxis);
+        if (style->isHorizontalWritingMode())
+            style->setColumnProgression(style->isLeftToRightDirection() ? ReverseColumnProgression : NormalColumnProgression);
+        else
+            style->setColumnProgression(style->isFlippedBlocksWritingMode() ? NormalColumnProgression : ReverseColumnProgression);
+        break;
+    case Pagination::TopToBottomPaginated:
+        style->setColumnAxis(VerticalColumnAxis);
+        if (style->isHorizontalWritingMode())
+            style->setColumnProgression(style->isFlippedBlocksWritingMode() ? ReverseColumnProgression : NormalColumnProgression);
+        else
+            style->setColumnProgression(style->isLeftToRightDirection() ? NormalColumnProgression : ReverseColumnProgression);
+        break;
+    case Pagination::BottomToTopPaginated:
+        style->setColumnAxis(VerticalColumnAxis);
+        if (style->isHorizontalWritingMode())
+            style->setColumnProgression(style->isFlippedBlocksWritingMode() ? NormalColumnProgression : ReverseColumnProgression);
+        else
+            style->setColumnProgression(style->isLeftToRightDirection() ? ReverseColumnProgression : NormalColumnProgression);
+        break;
+    case Pagination::Unpaginated:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
 PassRefPtr<RenderStyle> StyleResolver::styleForDocument(Document* document, CSSFontSelector* fontSelector)
 {
     Frame* frame = document->frame();
@@ -1645,44 +1685,15 @@ PassRefPtr<RenderStyle> StyleResolver::styleForDocument(Document* document, CSSF
     }
 
     if (frame) {
-        if (Page* page = frame->page()) {
-            const Page::Pagination& pagination = page->pagination();
-            if (pagination.mode != Page::Pagination::Unpaginated) {
-                switch (pagination.mode) {
-                case Page::Pagination::LeftToRightPaginated:
-                    documentStyle->setColumnAxis(HorizontalColumnAxis);
-                    if (documentStyle->isHorizontalWritingMode())
-                        documentStyle->setColumnProgression(documentStyle->isLeftToRightDirection() ? NormalColumnProgression : ReverseColumnProgression);
-                    else
-                        documentStyle->setColumnProgression(documentStyle->isFlippedBlocksWritingMode() ? ReverseColumnProgression : NormalColumnProgression);
-                    break;
-                case Page::Pagination::RightToLeftPaginated:
-                    documentStyle->setColumnAxis(HorizontalColumnAxis);
-                    if (documentStyle->isHorizontalWritingMode())
-                        documentStyle->setColumnProgression(documentStyle->isLeftToRightDirection() ? ReverseColumnProgression : NormalColumnProgression);
-                    else
-                        documentStyle->setColumnProgression(documentStyle->isFlippedBlocksWritingMode() ? NormalColumnProgression : ReverseColumnProgression);
-                    break;
-                case Page::Pagination::TopToBottomPaginated:
-                    documentStyle->setColumnAxis(VerticalColumnAxis);
-                    if (documentStyle->isHorizontalWritingMode())
-                        documentStyle->setColumnProgression(documentStyle->isFlippedBlocksWritingMode() ? ReverseColumnProgression : NormalColumnProgression);
-                    else
-                        documentStyle->setColumnProgression(documentStyle->isLeftToRightDirection() ? NormalColumnProgression : ReverseColumnProgression);
-                    break;
-                case Page::Pagination::BottomToTopPaginated:
-                    documentStyle->setColumnAxis(VerticalColumnAxis);
-                    if (documentStyle->isHorizontalWritingMode())
-                        documentStyle->setColumnProgression(documentStyle->isFlippedBlocksWritingMode() ? NormalColumnProgression : ReverseColumnProgression);
-                    else
-                        documentStyle->setColumnProgression(documentStyle->isLeftToRightDirection() ? ReverseColumnProgression : NormalColumnProgression);
-                    break;
-                case Page::Pagination::Unpaginated:
-                    ASSERT_NOT_REACHED();
-                    break;
-                }
-
+        if (FrameView* frameView = frame->view()) {
+            const Pagination& pagination = frameView->pagination();
+            if (pagination.mode != Pagination::Unpaginated) {
+                setStylesForPaginationMode(pagination.mode, documentStyle.get());
                 documentStyle->setColumnGap(pagination.gap);
+                if (RenderView* view = document->renderView()) {
+                    if (view->hasColumns())
+                        view->updateColumnInfoFromStyle(documentStyle.get());
+                }
             }
         }
     }
@@ -2206,11 +2217,20 @@ void StyleResolver::adjustRenderStyle(RenderStyle* style, RenderStyle* parentSty
         style->setOverflowY(OMARQUEE);
     else if (style->overflowY() == OMARQUEE && style->overflowX() != OMARQUEE)
         style->setOverflowX(OMARQUEE);
-    else if (style->overflowX() == OVISIBLE && style->overflowY() != OVISIBLE)
+    else if (style->overflowX() == OVISIBLE && style->overflowY() != OVISIBLE) {
+        // FIXME: Once we implement pagination controls, overflow-x should default to hidden
+        // if overflow-y is set to -webkit-paged-x or -webkit-page-y. For now, we'll let it
+        // default to auto so we can at least scroll through the pages.
         style->setOverflowX(OAUTO);
-    else if (style->overflowY() == OVISIBLE && style->overflowX() != OVISIBLE)
+    } else if (style->overflowY() == OVISIBLE && style->overflowX() != OVISIBLE)
         style->setOverflowY(OAUTO);
 
+    // Call setStylesForPaginationMode() if a pagination mode is set for any non-root elements. If these
+    // styles are specified on a root element, then they will be incorporated in
+    // StyleResolver::styleForDocument().
+    if ((style->overflowY() == OPAGEDX || style->overflowY() == OPAGEDY) && !(e->hasTagName(htmlTag) || e->hasTagName(bodyTag)))
+        setStylesForPaginationMode(WebCore::paginationModeForRenderStyle(style), style);
+
     // Table rows, sections and the table itself will support overflow:hidden and will ignore scroll/auto.
     // FIXME: Eventually table sections will support auto and scroll.
     if (style->display() == TABLE || style->display() == INLINE_TABLE
diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
index 4e9fe9148..712085ba2 100644
--- a/Source/WebCore/css/StyleResolver.h
+++ b/Source/WebCore/css/StyleResolver.h
@@ -29,6 +29,7 @@
 #include "MediaQueryExp.h"
 #include "RenderStyle.h"
 #include "SelectorChecker.h"
+#include "StyleInheritedData.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 9d8221e47..81b0e16b9 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -253,7 +253,4 @@ video::-webkit-media-text-track-future-nodes {
 video::-webkit-media-text-track-display {
     position: absolute;
     color: rgba(255, 255, 255, 1);
-
-    top: 100%;
-    -webkit-transform: translate(0%, -100%);
 }
diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
index b613ab97c..8c930d8f2 100644
--- a/Source/WebCore/dom/CharacterData.cpp
+++ b/Source/WebCore/dom/CharacterData.cpp
@@ -32,6 +32,7 @@
 #include "MutationRecord.h"
 #include "NodeRenderingContext.h"
 #include "RenderText.h"
+#include "StyleInheritedData.h"
 #include "TextBreakIterator.h"
 #include "UndoManager.h"
 
diff --git a/Source/WebCore/dom/ClassNodeList.cpp b/Source/WebCore/dom/ClassNodeList.cpp
index c0ce6d2e0..a4d88ab35 100644
--- a/Source/WebCore/dom/ClassNodeList.cpp
+++ b/Source/WebCore/dom/ClassNodeList.cpp
@@ -54,8 +54,11 @@ bool ClassNodeList::nodeMatches(Element* testNode) const
         return false;
     if (!m_classNames.size())
         return false;
-    ASSERT(testNode->isStyledElement());
-    return static_cast<StyledElement*>(testNode)->classNames().containsAll(m_classNames);
+    // FIXME: DOM4 allows getElementsByClassName to return non StyledElement.
+    // https://bugs.webkit.org/show_bug.cgi?id=94718
+    if (!testNode->isStyledElement())
+        return false;
+    return testNode->classNames().containsAll(m_classNames);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 743e12278..04bc20b0b 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -696,6 +696,8 @@ inline void Element::setAttributeInternal(size_t index, const QualifiedName& nam
 
 void Element::attributeChanged(const Attribute& attribute)
 {
+    parseAttribute(attribute);
+
     document()->incDOMTreeVersion();
 
     if (isIdAttributeName(attribute.name())) {
@@ -747,6 +749,34 @@ void Element::attributeChanged(const Attribute& attribute)
         document()->axObjectCache()->postNotification(this, AXObjectCache::AXInvalidStatusChanged, true);
 }
 
+void Element::parseAttribute(const Attribute& attribute)
+{
+    if (attribute.name() == classAttr)
+        classAttributeChanged(attribute.value());
+}
+
+void Element::classAttributeChanged(const AtomicString& newClassString)
+{
+    const UChar* characters = newClassString.characters();
+    unsigned length = newClassString.length();
+    unsigned i;
+    for (i = 0; i < length; ++i) {
+        if (isNotHTMLSpace(characters[i]))
+            break;
+    }
+    bool hasClass = i < length;
+    if (hasClass) {
+        const bool shouldFoldCase = document()->inQuirksMode();
+        ensureAttributeData()->setClass(newClassString, shouldFoldCase);
+    } else if (attributeData())
+        mutableAttributeData()->clearClass();
+
+    if (DOMTokenList* classList = optionalClassList())
+        static_cast<ClassList*>(classList)->reset(newClassString);
+
+    setNeedsStyleRecalc();
+}
+
 // Returns true is the given attribute is an event handler.
 // We consider an event handler any attribute that begins with "on".
 // It is a simple solution that has the advantage of not requiring any
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 97a16f636..f79227e9e 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -246,6 +246,7 @@ public:
 
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(const Attribute&);
+    virtual void parseAttribute(const Attribute&);
 
     // Only called by the parser immediately after element construction.
     void parserSetAttributes(const Vector<Attribute>&, FragmentScriptingPermission);
@@ -428,6 +429,7 @@ public:
 
     bool hasID() const;
     bool hasClass() const;
+    const SpaceSplitString& classNames() const;
 
     IntSize savedLayerScrollOffset() const;
     void setSavedLayerScrollOffset(const IntSize&);
@@ -461,6 +463,11 @@ protected:
     PassRefPtr<HTMLCollection> ensureCachedHTMLCollection(CollectionType);
     HTMLCollection* cachedHTMLCollection(CollectionType);
 
+    // classAttributeChanged() exists to share code between
+    // parseAttribute (called via setAttribute()) and
+    // svgAttributeChanged (called when element.className.baseValue is set)
+    void classAttributeChanged(const AtomicString& newClassString);
+
 private:
     void updateInvalidAttributes() const;
 
@@ -687,6 +694,13 @@ inline void Element::setIdAttribute(const AtomicString& value)
     setAttribute(document()->idAttributeName(), value);
 }
 
+inline const SpaceSplitString& Element::classNames() const
+{
+    ASSERT(hasClass());
+    ASSERT(attributeData());
+    return attributeData()->classNames();
+}
+
 inline size_t Element::attributeCount() const
 {
     ASSERT(attributeData());
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index 07394ebd1..b75a0bda9 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -29,6 +29,7 @@
 #include "HTMLCollection.h"
 #include "NamedNodeMap.h"
 #include "NodeRareData.h"
+#include "StyleInheritedData.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/dom/MessagePort.cpp b/Source/WebCore/dom/MessagePort.cpp
index ab4dcdc0d..50d4b16e3 100644
--- a/Source/WebCore/dom/MessagePort.cpp
+++ b/Source/WebCore/dom/MessagePort.cpp
@@ -83,7 +83,7 @@ void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, const M
         for (unsigned int i = 0; i < ports->size(); ++i) {
             MessagePort* dataPort = (*ports)[i].get();
             if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
-                ec = DATA_CLONE_ERR;
+                ec = INVALID_STATE_ERR;
                 return;
             }
         }
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index c8e23502d..21f1c3f89 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -40,6 +40,7 @@
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "ShadowRoot.h"
+#include "StyleInheritedData.h"
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index c5616b082..e75cd531d 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -147,8 +147,6 @@ CSSStyleDeclaration* StyledElement::style()
 
 void StyledElement::attributeChanged(const Attribute& attribute)
 {
-    parseAttribute(attribute);
-
     if (isPresentationAttribute(attribute.name())) {
         setAttributeStyleDirty();
         setNeedsStyleRecalc(InlineStyleChange);
@@ -157,28 +155,6 @@ void StyledElement::attributeChanged(const Attribute& attribute)
     Element::attributeChanged(attribute);
 }
 
-void StyledElement::classAttributeChanged(const AtomicString& newClassString)
-{
-    const UChar* characters = newClassString.characters();
-    unsigned length = newClassString.length();
-    unsigned i;
-    for (i = 0; i < length; ++i) {
-        if (isNotHTMLSpace(characters[i]))
-            break;
-    }
-    bool hasClass = i < length;
-    if (hasClass) {
-        const bool shouldFoldCase = document()->inQuirksMode();
-        ensureAttributeData()->setClass(newClassString, shouldFoldCase);
-    } else if (attributeData())
-        mutableAttributeData()->clearClass();
-
-    if (DOMTokenList* classList = optionalClassList())
-        static_cast<ClassList*>(classList)->reset(newClassString);
-
-    setNeedsStyleRecalc();
-}
-
 void StyledElement::styleAttributeChanged(const AtomicString& newStyleString, ShouldReparseStyleAttribute shouldReparse)
 {
     if (shouldReparse) {
@@ -197,10 +173,10 @@ void StyledElement::styleAttributeChanged(const AtomicString& newStyleString, Sh
 
 void StyledElement::parseAttribute(const Attribute& attribute)
 {
-    if (attribute.name() == classAttr)
-        classAttributeChanged(attribute.value());
-    else if (attribute.name() == styleAttr)
+    if (attribute.name() == styleAttr)
         styleAttributeChanged(attribute.value());
+    else
+        Element::parseAttribute(attribute);
 }
 
 void StyledElement::inlineStyleChanged()
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index a080dc136..66418ddfd 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -53,8 +53,6 @@ public:
 
     const StylePropertySet* attributeStyle();
 
-    const SpaceSplitString& classNames() const;
-
     virtual void collectStyleForAttribute(const Attribute&, StylePropertySet*) { }
 
     // May be called by ElementAttributeData::cloneDataFrom().
@@ -65,7 +63,7 @@ protected:
     StyledElement(const QualifiedName&, Document*, ConstructionType);
 
     virtual void attributeChanged(const Attribute&) OVERRIDE;
-    virtual void parseAttribute(const Attribute&);
+    virtual void parseAttribute(const Attribute&) OVERRIDE;
 
     virtual bool isPresentationAttribute(const QualifiedName&) const { return false; }
 
@@ -75,11 +73,6 @@ protected:
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-    // classAttributeChanged() exists to share code between
-    // parseAttribute (called via setAttribute()) and
-    // svgAttributeChanged (called when element.className.baseValue is set)
-    void classAttributeChanged(const AtomicString& newClassString);
-
 private:
     virtual void updateStyleAttribute() const;
     void inlineStyleChanged();
@@ -94,13 +87,6 @@ private:
     }
 };
 
-inline const SpaceSplitString& StyledElement::classNames() const
-{
-    ASSERT(hasClass());
-    ASSERT(attributeData());
-    return attributeData()->classNames();
-}
-
 inline void StyledElement::invalidateStyleAttribute()
 {
     clearIsStyleAttributeValid();
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 9945f94aa..87e366362 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -32,6 +32,7 @@
 #include "SVGNames.h"
 #endif
 
+#include "StyleInheritedData.h"
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
 
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index 87c10b31b..5ca7282bc 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -28,6 +28,7 @@
 #include "TextIterator.h"
 
 #include "Document.h"
+#include "Font.h"
 #include "Frame.h"
 #include "HTMLElement.h"
 #include "HTMLTextFormControlElement.h"
diff --git a/Source/WebCore/editing/UndoManager.cpp b/Source/WebCore/editing/UndoManager.cpp
index e506424f3..419de311d 100644
--- a/Source/WebCore/editing/UndoManager.cpp
+++ b/Source/WebCore/editing/UndoManager.cpp
@@ -160,6 +160,17 @@ void UndoManager::redo(ExceptionCode& ec)
     m_redoStack.removeLast();
 }
 
+UndoManagerEntry UndoManager::item(unsigned index) const
+{
+    ASSERT(index < length());
+    if (index < m_redoStack.size()) {
+        UndoManagerEntry entry = *m_redoStack[index];
+        entry.reverse();
+        return entry;
+    }
+    return *m_undoStack[length() - index - 1];
+}
+
 void UndoManager::registerUndoStep(PassRefPtr<UndoStep> step)
 {
     if (!m_isInProgress) {
diff --git a/Source/WebCore/editing/UndoManager.h b/Source/WebCore/editing/UndoManager.h
index dc5d67c7d..f43039e07 100644
--- a/Source/WebCore/editing/UndoManager.h
+++ b/Source/WebCore/editing/UndoManager.h
@@ -62,6 +62,8 @@ public:
     void undo(ExceptionCode& = ASSERT_NO_EXCEPTION);
     void redo(ExceptionCode& = ASSERT_NO_EXCEPTION);
 
+    UndoManagerEntry item(unsigned index) const;
+
     unsigned length() const { return m_undoStack.size() + m_redoStack.size(); }
     unsigned position() const { return m_redoStack.size(); }
 
diff --git a/Source/WebCore/editing/UndoManager.idl b/Source/WebCore/editing/UndoManager.idl
index e65677b6f..c228b9ea6 100644
--- a/Source/WebCore/editing/UndoManager.idl
+++ b/Source/WebCore/editing/UndoManager.idl
@@ -41,6 +41,8 @@ module core {
         void redo()
             raises(DOMException);
 
+        [Custom] sequence<DOMTransaction> item(in unsigned long index);
+
         readonly attribute unsigned long length;
         readonly attribute unsigned long position;
 
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 4b8cd442b..303a70b72 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -34,6 +34,7 @@
 #import "EditingText.h"
 #import "Editor.h"
 #import "EditorClient.h"
+#import "Font.h"
 #import "Frame.h"
 #import "FrameView.h"
 #import "HTMLConverter.h"
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index fadcfe7c6..ffb30894b 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -1300,6 +1300,10 @@ void HTMLMediaElement::textTrackModeChanged(TextTrack* track)
                     textTrackAddCues(track, track->cues());
                 else if (trackElement->readyState() == HTMLTrackElement::NONE)
                     trackElement->scheduleLoad();
+
+                // If this is the first added track, create the list of text tracks.
+                if (!m_textTracks)
+                  m_textTracks = TextTrackList::create(this, ActiveDOMObject::scriptExecutionContext());
             }
             break;
         }
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.h b/Source/WebCore/html/HTMLPropertiesCollection.h
index ac3d3e238..42bf3e30a 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.h
+++ b/Source/WebCore/html/HTMLPropertiesCollection.h
@@ -68,7 +68,7 @@ private:
 
     void updateNameCache() const;
 
-    void updatePropertyCache(Element* element, const AtomicString& propertyName) const
+    void updatePropertyCache(Element*, const AtomicString& propertyName) const
     {
         if (!m_propertyNames)
             m_propertyNames = DOMStringList::create();
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index f8a97001d..241816ff3 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -27,6 +27,7 @@
 #include "HTMLNames.h"
 #include "NodeRenderingContext.h"
 #include "RenderStyle.h"
+#include "StyleInheritedData.h"
 #include "Text.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index 62ed6f4e3..6c220c973 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -38,16 +38,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static inline bool isNumberedHeaderElement(HTMLStackItem* item)
-{
-    return item->hasTagName(h1Tag)
-        || item->hasTagName(h2Tag)
-        || item->hasTagName(h3Tag)
-        || item->hasTagName(h4Tag)
-        || item->hasTagName(h5Tag)
-        || item->hasTagName(h6Tag);
-}
-    
 static inline bool isRootNode(HTMLStackItem* item)
 {
     return item->isDocumentFragmentNode()
@@ -108,7 +98,7 @@ inline bool isForeignContentScopeMarker(HTMLStackItem* item)
 {
     return HTMLElementStack::isMathMLTextIntegrationPoint(item)
         || HTMLElementStack::isHTMLIntegrationPoint(item)
-        || isInHTMLNamespace(item);
+        || item->isInHTMLNamespace();
 }
 
 inline bool isButtonScopeMarker(HTMLStackItem* item)
@@ -231,7 +221,7 @@ void HTMLElementStack::popUntilPopped(const AtomicString& tagName)
 
 void HTMLElementStack::popUntilNumberedHeaderElementPopped()
 {
-    while (!isNumberedHeaderElement(topStackItem()))
+    while (!topStackItem()->isNumberedHeaderElement())
         pop();
     pop();
 }
@@ -460,7 +450,7 @@ bool HTMLElementStack::hasNumberedHeaderElementInScope() const
 {
     for (ElementRecord* record = m_top.get(); record; record = record->next()) {
         HTMLStackItem* item = record->stackItem().get();
-        if (isNumberedHeaderElement(item))
+        if (item->isNumberedHeaderElement())
             return true;
         if (isScopeMarker(item))
             return false;
@@ -598,6 +588,19 @@ void HTMLElementStack::removeNonTopCommon(Element* element)
     ASSERT_NOT_REACHED();
 }
 
+HTMLElementStack::ElementRecord* HTMLElementStack::furthestBlockForFormattingElement(Element* formattingElement) const
+{
+    ElementRecord* furthestBlock = 0;
+    for (ElementRecord* pos = m_top.get(); pos; pos = pos->next()) {
+        if (pos->element() == formattingElement)
+            return furthestBlock;
+        if (pos->stackItem()->isSpecialNode())
+            furthestBlock = pos;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 #ifndef NDEBUG
 
 void HTMLElementStack::show()
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index 620c5a194..1aaa20448 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -101,6 +101,7 @@ public:
     HTMLStackItem* oneBelowTop() const;
     ElementRecord* topRecord() const;
     ElementRecord* find(Element*) const;
+    ElementRecord* furthestBlockForFormattingElement(Element*) const;
     ElementRecord* topmost(const AtomicString& tagName) const;
 
     void insertAbove(PassRefPtr<HTMLStackItem>, ElementRecord*);
@@ -180,15 +181,6 @@ private:
     unsigned m_stackDepth;
 };
     
-inline bool isInHTMLNamespace(const HTMLStackItem* item)
-{
-    // A DocumentFragment takes the place of the document element when parsing
-    // fragments and should be considered in the HTML namespace.
-    return item->namespaceURI() == HTMLNames::xhtmlNamespaceURI
-        || item->isDocumentFragmentNode(); // FIXME: Does this also apply to ShadowRoot?
-}
-
-
 } // namespace WebCore
 
 #endif // HTMLElementStack_h
diff --git a/Source/WebCore/html/parser/HTMLStackItem.h b/Source/WebCore/html/parser/HTMLStackItem.h
index 371ac43f4..0a183bc26 100644
--- a/Source/WebCore/html/parser/HTMLStackItem.h
+++ b/Source/WebCore/html/parser/HTMLStackItem.h
@@ -29,6 +29,8 @@
 #include "Element.h"
 #include "HTMLNames.h"
 #include "HTMLToken.h"
+#include "MathMLNames.h"
+#include "SVGNames.h"
 
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -79,6 +81,123 @@ public:
             || hasTagName(HTMLNames::trTag);
     }
 
+    bool isInHTMLNamespace() const
+    {
+        // A DocumentFragment takes the place of the document element when parsing
+        // fragments and should be considered in the HTML namespace.
+        return namespaceURI() == HTMLNames::xhtmlNamespaceURI
+            || isDocumentFragmentNode(); // FIXME: Does this also apply to ShadowRoot?
+    }
+
+    bool isNumberedHeaderElement() const
+    {
+        return hasTagName(HTMLNames::h1Tag)
+            || hasTagName(HTMLNames::h2Tag)
+            || hasTagName(HTMLNames::h3Tag)
+            || hasTagName(HTMLNames::h4Tag)
+            || hasTagName(HTMLNames::h5Tag)
+            || hasTagName(HTMLNames::h6Tag);
+    }
+
+    bool isTableBodyContextElement() const
+    {
+        return hasTagName(HTMLNames::tbodyTag)
+            || hasTagName(HTMLNames::tfootTag)
+            || hasTagName(HTMLNames::theadTag);
+    }
+
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#special
+    bool isSpecialNode() const
+    {
+        if (hasTagName(MathMLNames::miTag)
+            || hasTagName(MathMLNames::moTag)
+            || hasTagName(MathMLNames::mnTag)
+            || hasTagName(MathMLNames::msTag)
+            || hasTagName(MathMLNames::mtextTag)
+            || hasTagName(MathMLNames::annotation_xmlTag)
+            || hasTagName(SVGNames::foreignObjectTag)
+            || hasTagName(SVGNames::descTag)
+            || hasTagName(SVGNames::titleTag))
+            return true;
+        if (isDocumentFragmentNode())
+            return true;
+        if (!isInHTMLNamespace())
+            return false;
+        const AtomicString& tagName = localName();
+        return tagName == HTMLNames::addressTag
+            || tagName == HTMLNames::appletTag
+            || tagName == HTMLNames::areaTag
+            || tagName == HTMLNames::articleTag
+            || tagName == HTMLNames::asideTag
+            || tagName == HTMLNames::baseTag
+            || tagName == HTMLNames::basefontTag
+            || tagName == HTMLNames::bgsoundTag
+            || tagName == HTMLNames::blockquoteTag
+            || tagName == HTMLNames::bodyTag
+            || tagName == HTMLNames::brTag
+            || tagName == HTMLNames::buttonTag
+            || tagName == HTMLNames::captionTag
+            || tagName == HTMLNames::centerTag
+            || tagName == HTMLNames::colTag
+            || tagName == HTMLNames::colgroupTag
+            || tagName == HTMLNames::commandTag
+            || tagName == HTMLNames::ddTag
+            || tagName == HTMLNames::detailsTag
+            || tagName == HTMLNames::dirTag
+            || tagName == HTMLNames::divTag
+            || tagName == HTMLNames::dlTag
+            || tagName == HTMLNames::dtTag
+            || tagName == HTMLNames::embedTag
+            || tagName == HTMLNames::fieldsetTag
+            || tagName == HTMLNames::figcaptionTag
+            || tagName == HTMLNames::figureTag
+            || tagName == HTMLNames::footerTag
+            || tagName == HTMLNames::formTag
+            || tagName == HTMLNames::frameTag
+            || tagName == HTMLNames::framesetTag
+            || isNumberedHeaderElement()
+            || tagName == HTMLNames::headTag
+            || tagName == HTMLNames::headerTag
+            || tagName == HTMLNames::hgroupTag
+            || tagName == HTMLNames::hrTag
+            || tagName == HTMLNames::htmlTag
+            || tagName == HTMLNames::iframeTag
+            || tagName == HTMLNames::imgTag
+            || tagName == HTMLNames::inputTag
+            || tagName == HTMLNames::isindexTag
+            || tagName == HTMLNames::liTag
+            || tagName == HTMLNames::linkTag
+            || tagName == HTMLNames::listingTag
+            || tagName == HTMLNames::marqueeTag
+            || tagName == HTMLNames::menuTag
+            || tagName == HTMLNames::metaTag
+            || tagName == HTMLNames::navTag
+            || tagName == HTMLNames::noembedTag
+            || tagName == HTMLNames::noframesTag
+            || tagName == HTMLNames::noscriptTag
+            || tagName == HTMLNames::objectTag
+            || tagName == HTMLNames::olTag
+            || tagName == HTMLNames::pTag
+            || tagName == HTMLNames::paramTag
+            || tagName == HTMLNames::plaintextTag
+            || tagName == HTMLNames::preTag
+            || tagName == HTMLNames::scriptTag
+            || tagName == HTMLNames::sectionTag
+            || tagName == HTMLNames::selectTag
+            || tagName == HTMLNames::styleTag
+            || tagName == HTMLNames::summaryTag
+            || tagName == HTMLNames::tableTag
+            || isTableBodyContextElement()
+            || tagName == HTMLNames::tdTag
+            || tagName == HTMLNames::textareaTag
+            || tagName == HTMLNames::thTag
+            || tagName == HTMLNames::titleTag
+            || tagName == HTMLNames::trTag
+            || tagName == HTMLNames::ulTag
+            || tagName == HTMLNames::wbrTag
+            || tagName == HTMLNames::xmpTag;
+    }
+
 private:
     HTMLStackItem(PassRefPtr<ContainerNode> node, ItemType type)
         : m_node(node)
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 9e91b5381..522a4409b 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -110,98 +110,6 @@ static bool isTableBodyContextTag(const AtomicString& tagName)
         || tagName == theadTag;
 }
 
-// http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#special
-static bool isSpecialNode(const HTMLStackItem* item)
-{
-    if (item->hasTagName(MathMLNames::miTag)
-        || item->hasTagName(MathMLNames::moTag)
-        || item->hasTagName(MathMLNames::mnTag)
-        || item->hasTagName(MathMLNames::msTag)
-        || item->hasTagName(MathMLNames::mtextTag)
-        || item->hasTagName(MathMLNames::annotation_xmlTag)
-        || item->hasTagName(SVGNames::foreignObjectTag)
-        || item->hasTagName(SVGNames::descTag)
-        || item->hasTagName(SVGNames::titleTag))
-        return true;
-    if (item->isDocumentFragmentNode())
-        return true;
-    if (!isInHTMLNamespace(item))
-        return false;
-    const AtomicString& tagName = item->localName();
-    return tagName == addressTag
-        || tagName == appletTag
-        || tagName == areaTag
-        || tagName == articleTag
-        || tagName == asideTag
-        || tagName == baseTag
-        || tagName == basefontTag
-        || tagName == bgsoundTag
-        || tagName == blockquoteTag
-        || tagName == bodyTag
-        || tagName == brTag
-        || tagName == buttonTag
-        || tagName == captionTag
-        || tagName == centerTag
-        || tagName == colTag
-        || tagName == colgroupTag
-        || tagName == commandTag
-        || tagName == ddTag
-        || tagName == detailsTag
-        || tagName == dirTag
-        || tagName == divTag
-        || tagName == dlTag
-        || tagName == dtTag
-        || tagName == embedTag
-        || tagName == fieldsetTag
-        || tagName == figcaptionTag
-        || tagName == figureTag
-        || tagName == footerTag
-        || tagName == formTag
-        || tagName == frameTag
-        || tagName == framesetTag
-        || isNumberedHeaderTag(tagName)
-        || tagName == headTag
-        || tagName == headerTag
-        || tagName == hgroupTag
-        || tagName == hrTag
-        || tagName == htmlTag
-        || tagName == iframeTag
-        || tagName == imgTag
-        || tagName == inputTag
-        || tagName == isindexTag
-        || tagName == liTag
-        || tagName == linkTag
-        || tagName == listingTag
-        || tagName == marqueeTag
-        || tagName == menuTag
-        || tagName == metaTag
-        || tagName == navTag
-        || tagName == noembedTag
-        || tagName == noframesTag
-        || tagName == noscriptTag
-        || tagName == objectTag
-        || tagName == olTag
-        || tagName == pTag
-        || tagName == paramTag
-        || tagName == plaintextTag
-        || tagName == preTag
-        || tagName == scriptTag
-        || tagName == sectionTag
-        || tagName == selectTag
-        || tagName == styleTag
-        || tagName == summaryTag
-        || tagName == tableTag
-        || isTableBodyContextTag(tagName)
-        || tagName == tdTag
-        || tagName == textareaTag
-        || tagName == thTag
-        || tagName == titleTag
-        || tagName == trTag
-        || tagName == ulTag
-        || tagName == wbrTag
-        || tagName == xmpTag;
-}
-
 static bool isNonAnchorNonNobrFormattingTag(const AtomicString& tagName)
 {
     return tagName == bTag
@@ -481,7 +389,7 @@ void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken* token)
         processToken(token);
 
     bool inForeignContent = !m_tree.isEmpty()
-        && !isInHTMLNamespace(m_tree.currentStackItem())
+        && !m_tree.currentStackItem()->isInHTMLNamespace()
         && !HTMLElementStack::isHTMLIntegrationPoint(m_tree.currentStackItem())
         && !HTMLElementStack::isMathMLTextIntegrationPoint(m_tree.currentStackItem());
 
@@ -640,7 +548,7 @@ void HTMLTreeBuilder::processCloseWhenNestedTag(AtomicHTMLToken* token)
             processFakeEndTag(item->localName());
             break;
         }
-        if (isSpecialNode(item.get()) && !item->hasTagName(addressTag) && !item->hasTagName(divTag) && !item->hasTagName(pTag))
+        if (item->isSpecialNode() && !item->hasTagName(addressTag) && !item->hasTagName(divTag) && !item->hasTagName(pTag))
             break;
         nodeRecord = nodeRecord->next();
     }
@@ -816,7 +724,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken* token)
     }
     if (isNumberedHeaderTag(token->name())) {
         processFakePEndTagIfPInButtonScope();
-        if (isNumberedHeaderTag(m_tree.currentStackItem()->localName())) {
+        if (m_tree.currentStackItem()->isNumberedHeaderElement()) {
             parseError(token);
             m_tree.openElements()->pop();
         }
@@ -1494,7 +1402,7 @@ void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken* token)
             m_tree.openElements()->popUntilPopped(item->element());
             return;
         }
-        if (isSpecialNode(item.get())) {
+        if (item->isSpecialNode()) {
             parseError(token);
             return;
         }
@@ -1502,21 +1410,6 @@ void HTMLTreeBuilder::processAnyOtherEndTagForInBody(AtomicHTMLToken* token)
     }
 }
 
-// FIXME: This probably belongs on HTMLElementStack.
-HTMLElementStack::ElementRecord* HTMLTreeBuilder::furthestBlockForFormattingElement(Element* formattingElement)
-{
-    HTMLElementStack::ElementRecord* furthestBlock = 0;
-    HTMLElementStack::ElementRecord* record = m_tree.openElements()->topRecord();
-    for (; record; record = record->next()) {
-        if (record->element() == formattingElement)
-            return furthestBlock;
-        if (isSpecialNode(record->stackItem().get()))
-            furthestBlock = record;
-    }
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-inbody
 void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
 {
@@ -1544,7 +1437,7 @@ void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken* token)
         if (formattingElement != m_tree.currentElement())
             parseError(token);
         // 2.
-        HTMLElementStack::ElementRecord* furthestBlock = furthestBlockForFormattingElement(formattingElement);
+        HTMLElementStack::ElementRecord* furthestBlock = m_tree.openElements()->furthestBlockForFormattingElement(formattingElement);
         // 3.
         if (!furthestBlock) {
             m_tree.openElements()->popUntilPopped(formattingElement);
@@ -2656,7 +2549,7 @@ bool HTMLTreeBuilder::shouldProcessTokenInForeignContent(AtomicHTMLToken* token)
     if (m_tree.isEmpty())
         return false;
     HTMLStackItem* item = m_tree.currentStackItem();
-    if (isInHTMLNamespace(item))
+    if (item->isInHTMLNamespace())
         return false;
     if (HTMLElementStack::isMathMLTextIntegrationPoint(item)) {
         if (token->type() == HTMLTokenTypes::StartTag
@@ -2756,7 +2649,7 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken* token)
             m_tree.openElements()->pop();
             return;
         }
-        if (!isInHTMLNamespace(m_tree.currentStackItem())) {
+        if (!m_tree.currentStackItem()->isInHTMLNamespace()) {
             // FIXME: This code just wants an Element* iterator, instead of an ElementRecord*
             HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
             if (!nodeRecord->stackItem()->hasLocalName(token->name()))
@@ -2768,7 +2661,7 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken* token)
                 }
                 nodeRecord = nodeRecord->next();
 
-                if (isInHTMLNamespace(nodeRecord->stackItem().get()))
+                if (nodeRecord->stackItem()->isInHTMLNamespace())
                     break;
             }
         }
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 86d229de0..c57362783 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -174,7 +174,6 @@ private:
 
     Vector<Attribute> attributesForIsindexInput(AtomicHTMLToken*);
 
-    HTMLElementStack::ElementRecord* furthestBlockForFormattingElement(Element*);
     void callTheAdoptionAgency(AtomicHTMLToken*);
 
     void closeTheCell();
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index 1b67afec3..881c2deb5 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -32,21 +32,27 @@
 
 #include "MediaControlElements.h"
 
+#include "CSSStyleDeclaration.h"
 #include "CSSValueKeywords.h"
 #include "DOMTokenList.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
+#include "FloatPoint.h"
 #include "Frame.h"
+#include "HTMLDivElement.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
+#include "LayoutRepainter.h"
 #include "LocalizedStrings.h"
 #include "MediaControls.h"
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderDeprecatedFlexibleBox.h"
+#include "RenderInline.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
+#include "RenderText.h"
 #include "RenderTheme.h"
 #include "RenderVideo.h"
 #include "RenderView.h"
@@ -1258,7 +1264,7 @@ const AtomicString& MediaControlCurrentTimeDisplayElement::shadowPseudoId() cons
 class RenderTextTrackContainerElement : public RenderBlock {
 public:
     RenderTextTrackContainerElement(Node*);
-    
+
 private:
     virtual void layout();
 };
@@ -1352,29 +1358,18 @@ void MediaControlTextTrackContainerElement::updateDisplay()
     // 10. For each text track cue cue in cues that has not yet had
     // corresponding CSS boxes added to output, in text track cue order, run the
     // following substeps:
-
-    // Simple renderer for now.
     for (size_t i = 0; i < activeCues.size(); ++i) {
         TextTrackCue* cue = activeCues[i].data();
 
         ASSERT(cue->isActive());
-        if (cue->track()->kind() != TextTrack::captionsKeyword() && cue->track()->kind() != TextTrack::subtitlesKeyword())
-            continue;
-
-        if (!cue->track() || cue->track()->mode() != TextTrack::SHOWING)
+        if (!cue->track() || !cue->track()->isRendered())
             continue;
 
-        RefPtr<HTMLDivElement> displayTree = cue->getDisplayTree();
-
-        // Append only new display trees.
-        if (displayTree->hasChildNodes() && !contains(displayTree.get()))
-            appendChild(displayTree, ASSERT_NO_EXCEPTION, true);
-
-        // Note: the display tree of a cue is removed when the active flag of the cue is unset.
-
-        // FIXME(BUG 79751): Render the TextTrackCue when snap-to-lines is set.
+        RefPtr<TextTrackCueBox> displayBox = cue->getDisplayTree();
 
-        // FIXME(BUG 84296): Implement overlapping detection for cue boxes when snap-to-lines is not set.
+        if (displayBox->hasChildNodes() && !contains(static_cast<Node*>(displayBox.get())))
+            // Note: the display tree of a cue is removed when the active flag of the cue is unset.
+            appendChild(displayBox, ASSERT_NO_EXCEPTION, false);
     }
 
     // 11. Return output.
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index c58f176f7..116b67869 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -42,6 +42,7 @@
 #include "ScriptController.h"
 #include "SpeechInput.h"
 #include "SpeechInputEvent.h"
+#include "StyleInheritedData.h"
 #include "TextEvent.h"
 #include "TextEventInputType.h"
 
diff --git a/Source/WebCore/html/track/TextTrack.cpp b/Source/WebCore/html/track/TextTrack.cpp
index 75d763cdd..addc87527 100644
--- a/Source/WebCore/html/track/TextTrack.cpp
+++ b/Source/WebCore/html/track/TextTrack.cpp
@@ -199,7 +199,7 @@ void TextTrack::addCue(PassRefPtr<TextTrackCue> prpCue, ExceptionCode& ec)
     RefPtr<TextTrackCue> cue = prpCue;
 
     // TODO(93143): Add spec-compliant behavior for negative time values.
-    if (cue->startTime() < 0 || cue->endTime() < 0)
+    if (isnan(cue->startTime()) || isnan(cue->endTime()) || cue->startTime() < 0 || cue->endTime() < 0)
         return;
 
     // 4.8.10.12.4 Text track API
@@ -294,6 +294,17 @@ void TextTrack::invalidateTrackIndex()
     m_trackIndex = invalidTrackIndex;
 }
 
+bool TextTrack::isRendered()
+{
+    if (m_kind != captionsKeyword() && m_kind != subtitlesKeyword())
+        return false;
+
+    if (m_mode != SHOWING && !m_showingByDefault)
+        return false;
+
+    return true;
+}
+
 TextTrackCueList* TextTrack::ensureTextTrackCueList()
 {
     if (!m_cues)
diff --git a/Source/WebCore/html/track/TextTrack.h b/Source/WebCore/html/track/TextTrack.h
index 3cd7a7447..957bcca60 100644
--- a/Source/WebCore/html/track/TextTrack.h
+++ b/Source/WebCore/html/track/TextTrack.h
@@ -110,6 +110,8 @@ public:
     int trackIndex();
     void invalidateTrackIndex();
 
+    bool isRendered();
+
 protected:
     TextTrack(ScriptExecutionContext*, TextTrackClient*, const String& kind, const String& label, const String& language, TextTrackType);
 
diff --git a/Source/WebCore/html/track/TextTrackCue.cpp b/Source/WebCore/html/track/TextTrackCue.cpp
index 7973fc5f5..e67ae8b93 100644
--- a/Source/WebCore/html/track/TextTrackCue.cpp
+++ b/Source/WebCore/html/track/TextTrackCue.cpp
@@ -41,6 +41,7 @@
 #include "Event.h"
 #include "HTMLDivElement.h"
 #include "HTMLMediaElement.h"
+#include "RenderTextTrackCue.h"
 #include "Text.h"
 #include "TextTrack.h"
 #include "TextTrackCueList.h"
@@ -88,9 +89,99 @@ static const String& verticalGrowingRightKeyword()
     return verticallr;
 }
 
-TextTrackCue::TextTrackCue(ScriptExecutionContext* context, const String& id, double start, double end, const String& content, const String& settings, bool pauseOnExit)
-    : m_id(id)
-    , m_startTime(start)
+// ----------------------------
+
+TextTrackCueBox::TextTrackCueBox(Document* document, TextTrackCue* cue)
+    : HTMLElement(divTag, document)
+    , m_cue(cue)
+{
+}
+
+TextTrackCue* TextTrackCueBox::getCue() const
+{
+    return m_cue;
+}
+
+void TextTrackCueBox::applyCSSProperties()
+{
+    // FIXME: Apply all the initial CSS positioning properties. http://wkb.ug/79916
+
+    // 3.5.1 On the (root) List of WebVTT Node Objects:
+
+    // the 'position' property must be set to 'absolute'
+    setInlineStyleProperty(CSSPropertyPosition, CSSValueAbsolute);
+
+    //  the 'unicode-bidi' property must be set to 'plaintext'
+    setInlineStyleProperty(CSSPropertyUnicodeBidi, CSSValueWebkitPlaintext);
+
+    // FIXME: Determine the text direction using the BIDI algorithm. http://wkb.ug/79749
+    // the 'direction' property must be set to direction
+    setInlineStyleProperty(CSSPropertyDirection, CSSValueLtr);
+
+    // the 'writing-mode' property must be set to writing-mode
+    setInlineStyleProperty(CSSPropertyWebkitWritingMode, m_cue->getCSSWritingMode(), false);
+
+    std::pair<float, float> position = m_cue->getCSSPosition();
+
+    // the 'top' property must be set to top,
+    setInlineStyleProperty(CSSPropertyTop, static_cast<double>(position.second), CSSPrimitiveValue::CSS_PERCENTAGE);
+
+    // the 'left' property must be set to left
+    setInlineStyleProperty(CSSPropertyLeft, static_cast<double>(position.first), CSSPrimitiveValue::CSS_PERCENTAGE);
+
+    // the 'width' property must be set to width, and the 'height' property  must be set to height
+    if (m_cue->vertical() == horizontalKeyword()) {
+        setInlineStyleProperty(CSSPropertyWidth, static_cast<double>(m_cue->getCSSSize()), CSSPrimitiveValue::CSS_PERCENTAGE);
+        setInlineStyleProperty(CSSPropertyHeight, CSSValueAuto);
+    } else {
+        setInlineStyleProperty(CSSPropertyWidth, CSSValueAuto);
+        setInlineStyleProperty(CSSPropertyHeight, static_cast<double>(m_cue->getCSSSize()),  CSSPrimitiveValue::CSS_PERCENTAGE);
+    }
+
+    // The 'text-align' property on the (root) List of WebVTT Node Objects must
+    // be set to the value in the second cell of the row of the table below
+    // whose first cell is the value of the corresponding cue's text track cue
+    // alignment:
+    if (m_cue->align() == startKeyword())
+        setInlineStyleProperty(CSSPropertyTextAlign, CSSValueStart);
+    else if (m_cue->align() == endKeyword())
+        setInlineStyleProperty(CSSPropertyTextAlign, CSSValueEnd);
+    else
+        setInlineStyleProperty(CSSPropertyTextAlign, CSSValueCenter);
+
+    if (!m_cue->snapToLines()) {
+        // 10.13.1 Set up x and y:
+        // Note: x and y are set through the CSS left and top above.
+
+        // 10.13.2 Position the boxes in boxes such that the point x% along the
+        // width of the bounding box of the boxes in boxes is x% of the way
+        // across the width of the video's rendering area, and the point y%
+        // along the height of the bounding box of the boxes in boxes is y%
+        // of the way across the height of the video's rendering area, while
+        // maintaining the relative positions of the boxes in boxes to each
+        // other.
+        setInlineStyleProperty(CSSPropertyWebkitTransform,
+                String::format("translate(-%.2f%%, -%.2f%%)", position.first, position.second));
+
+        setInlineStyleProperty(CSSPropertyWhiteSpace, CSSValuePre);
+    }
+}
+
+const AtomicString& TextTrackCueBox::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(const AtomicString, trackDisplayBoxShadowPseudoId, ("-webkit-media-text-track-display"));
+    return trackDisplayBoxShadowPseudoId;
+}
+
+RenderObject* TextTrackCueBox::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderTextTrackCue(this);
+}
+
+// ----------------------------
+
+TextTrackCue::TextTrackCue(ScriptExecutionContext* context, double start, double end, const String& content)
+    : m_startTime(start)
     , m_endTime(end)
     , m_content(content)
     , m_linePosition(undefinedPosition)
@@ -103,25 +194,24 @@ TextTrackCue::TextTrackCue(ScriptExecutionContext* context, const String& id, do
     , m_documentFragment(0)
     , m_scriptExecutionContext(context)
     , m_isActive(false)
-    , m_pauseOnExit(pauseOnExit)
+    , m_pauseOnExit(false)
     , m_snapToLines(true)
     , m_hasInnerTimestamps(false)
     , m_pastDocumentNodes(HTMLDivElement::create(static_cast<Document*>(context)))
     , m_futureDocumentNodes(HTMLDivElement::create(static_cast<Document*>(context)))
     , m_displayTreeShouldChange(true)
-    , m_displayTree(HTMLDivElement::create(static_cast<Document*>(context)))
-    , m_displayXPosition(undefinedPosition)
-    , m_displayYPosition(undefinedPosition)
+    , m_displayTree(TextTrackCueBox::create(static_cast<Document*>(m_scriptExecutionContext), this))
 {
     ASSERT(m_scriptExecutionContext->isDocument());
 
-    // The text track cue writing directions are directly relatd to the
-    // block-flow element, which can be set through the CSS writing modes.
+    // 4. If the text track cue writing direction is horizontal, then let
+    // writing-mode be 'horizontal-tb'. Otherwise, if the text track cue writing
+    // direction is vertical growing left, then let writing-mode be
+    // 'vertical-rl'. Otherwise, the text track cue writing direction is
+    // vertical growing right; let writing-mode be 'vertical-lr'.
     m_displayWritingModeMap[Horizontal] = CSSValueHorizontalTb;
-    m_displayWritingModeMap[VerticalGrowingLeft] = CSSValueVerticalLr;
-    m_displayWritingModeMap[VerticalGrowingRight] = CSSValueVerticalRl;
-
-    parseSettings(settings);
+    m_displayWritingModeMap[VerticalGrowingLeft] = CSSValueVerticalRl;
+    m_displayWritingModeMap[VerticalGrowingRight] = CSSValueVerticalLr;
 
     // A text track cue has a text track cue computed line position whose value
     // is defined in terms of the other aspects of the cue.
@@ -443,10 +533,27 @@ int TextTrackCue::calculateComputedLinePosition()
 
     // Otherwise, it is the value returned by the following algorithm:
 
-    // FIXME(BUG 79751): Complete determination algorithm when it is actually
-    // used - when displaying a TextTrackCue having snap-to-lines flag set.
+    // If cue is not associated with a text track, return -1 and abort these
+    // steps.
+    if (!track())
+        return -1;
+
+    // Let n be the number of text tracks whose text track mode is showing or
+    // showing by default and that are in the media element's list of text
+    // tracks before track.
 
-    return 100;
+    // FIXME: Add a method to cache the track index considering only
+    // rendered tracks (that have showing or showing by default mode set).
+    // http://wkb.ug/93779
+    int n = track()->trackIndex();
+
+    // Increment n by one.
+    n++;
+
+    // Negate n.
+    n = -n;
+
+    return n;
 }
 
 void TextTrackCue::calculateDisplayParameters()
@@ -460,7 +567,6 @@ void TextTrackCue::calculateDisplayParameters()
     // vertical growing left, then let block-flow be 'lr'. Otherwise, the text
     // track cue writing direction is vertical growing right; let block-flow be
     // 'rl'.
-
     m_displayWritingMode = m_displayWritingModeMap[m_writingDirection];
 
     // 10.5 Determine the value of maximum size for cue as per the appropriate
@@ -469,7 +575,7 @@ void TextTrackCue::calculateDisplayParameters()
     if ((m_writingDirection == Horizontal && m_cueAlignment == Start && m_displayDirection == CSSValueLtr)
             || (m_writingDirection == Horizontal && m_cueAlignment == End && m_displayDirection == CSSValueRtl)
             || (m_writingDirection == VerticalGrowingLeft && m_cueAlignment == Start)
-            || (m_writingDirection == VerticalGrowingRight && m_cueAlignment == End)) {
+            || (m_writingDirection == VerticalGrowingRight && m_cueAlignment == Start)) {
         maximumSize = 100 - m_textPosition;
     } else if ((m_writingDirection == Horizontal && m_cueAlignment == End && m_displayDirection == CSSValueLtr)
             || (m_writingDirection == Horizontal && m_cueAlignment == Start && m_displayDirection == CSSValueRtl)
@@ -485,61 +591,56 @@ void TextTrackCue::calculateDisplayParameters()
     // be text track cue size. Otherwise, let size be maximum size.
     m_displaySize = std::min(m_cueSize, maximumSize);
 
-    // 10.7 If the text track cue writing direction is horizontal, then let
-    // width be 'size vw' and height be 'auto'. Otherwise, let width be 'auto'
-    // and height be 'size vh'. (These are CSS values used by the next section
-    // to set CSS properties for the rendering; 'vw' and 'vh' are CSS units.)
-    m_displayWidth = m_writingDirection == Horizontal ? m_displaySize : autoSize;
-    m_displayHeight = m_writingDirection == Horizontal ? autoSize : m_displaySize;
-
     // 10.8 Determine the value of x-position or y-position for cue as per the
     // appropriate rules from the following list:
-    if ((m_writingDirection == Horizontal && m_cueAlignment == Start && m_displayDirection == CSSValueLtr)
-            || (m_writingDirection == Horizontal && m_cueAlignment == End && m_displayDirection == CSSValueRtl)) {
-        m_displayXPosition = m_textPosition;
-    } else if ((m_writingDirection == Horizontal && m_cueAlignment == End && m_displayDirection == CSSValueLtr)
-            || (m_writingDirection == Horizontal && m_cueAlignment == Start && m_displayDirection == CSSValueRtl)) {
-        m_displayXPosition = 100 - m_textPosition;
+    if (m_writingDirection == Horizontal) {
+        if (m_cueAlignment == Start) {
+            if (m_displayDirection == CSSValueLtr)
+                m_displayPosition.first = m_textPosition;
+            else
+                m_displayPosition.first = 100 - m_textPosition - m_displaySize;
+        } else if (m_cueAlignment == End) {
+            if (m_displayDirection == CSSValueRtl)
+                m_displayPosition.first = 100 - m_textPosition;
+            else
+                m_displayPosition.first = m_textPosition - m_displaySize;
+        }
     }
 
     if ((m_writingDirection == VerticalGrowingLeft && m_cueAlignment == Start)
             || (m_writingDirection == VerticalGrowingRight && m_cueAlignment == Start)) {
-        m_displayYPosition = m_textPosition;
+        m_displayPosition.second = m_textPosition;
     } else if ((m_writingDirection == VerticalGrowingLeft && m_cueAlignment == End)
             || (m_writingDirection == VerticalGrowingRight && m_cueAlignment == End)) {
-        m_displayYPosition = 100 - m_textPosition;
+        m_displayPosition.second = 100 - m_textPosition;
     }
 
     if (m_writingDirection == Horizontal && m_cueAlignment == Middle) {
-        m_displayXPosition = m_textPosition - m_displaySize / 2;
-
-        if (m_displayDirection == CSSValueRtl)
-           m_displayXPosition = 100 - m_displayXPosition;
+        if (m_displayDirection == CSSValueLtr)
+            m_displayPosition.first = m_textPosition - m_displaySize / 2;
+        else
+           m_displayPosition.first = 100 - m_textPosition - m_displaySize / 2;
     }
 
     if ((m_writingDirection == VerticalGrowingLeft && m_cueAlignment == Middle)
         || (m_writingDirection == VerticalGrowingRight && m_cueAlignment == Middle))
-        m_displayYPosition = m_textPosition - m_displaySize / 2;
+        m_displayPosition.second = m_textPosition - m_displaySize / 2;
 
     // 10.9 Determine the value of whichever of x-position or y-position is not
     // yet calculated for cue as per the appropriate rules from the following
     // list:
-    if (m_snapToLines && m_displayYPosition == undefinedPosition && m_writingDirection == Horizontal)
-        m_displayYPosition = 0;
+    if (m_snapToLines && m_displayPosition.second == undefinedPosition && m_writingDirection == Horizontal)
+        m_displayPosition.second = 0;
 
-    if (!m_snapToLines && m_writingDirection == Horizontal)
-        m_displayYPosition = m_computedLinePosition;
+    if (!m_snapToLines && m_displayPosition.second == undefinedPosition && m_writingDirection == Horizontal)
+        m_displayPosition.second = m_computedLinePosition;
 
-    if (m_snapToLines && m_displayXPosition == undefinedPosition
+    if (m_snapToLines && m_displayPosition.first == undefinedPosition
             && (m_writingDirection == VerticalGrowingLeft || m_writingDirection == VerticalGrowingRight))
-        m_displayXPosition = 0;
+        m_displayPosition.first = 0;
 
     if (!m_snapToLines && (m_writingDirection == VerticalGrowingLeft || m_writingDirection == VerticalGrowingRight))
-        m_displayXPosition = m_computedLinePosition;
-
-    // 10.10 Let left be 'x-position vw' and top be 'y-position vh'.
-
-    // FIXME(Bug 79916): CSS top and left properties need to be applied.
+        m_displayPosition.first = m_computedLinePosition;
 }
 
 void TextTrackCue::updateDisplayTree(float movieTime)
@@ -587,10 +688,8 @@ void TextTrackCue::updateDisplayTree(float movieTime)
     }
 }
 
-PassRefPtr<HTMLDivElement> TextTrackCue::getDisplayTree()
+PassRefPtr<TextTrackCueBox> TextTrackCue::getDisplayTree()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, trackDisplayBoxShadowPseudoId, ("-webkit-media-text-track-display"));
-
     if (!m_displayTreeShouldChange)
         return m_displayTree;
 
@@ -600,7 +699,6 @@ PassRefPtr<HTMLDivElement> TextTrackCue::getDisplayTree()
     // 10.11. Apply the terms of the CSS specifications to nodes within the
     // following constraints, thus obtaining a set of CSS boxes positioned
     // relative to an initial containing block:
-    m_displayTree->setShadowPseudoId(trackDisplayBoxShadowPseudoId, ASSERT_NO_EXCEPTION);
     m_displayTree->removeChildren();
 
     // The document tree is the tree of WebVTT Node Objects rooted at nodes.
@@ -624,38 +722,7 @@ PassRefPtr<HTMLDivElement> TextTrackCue::getDisplayTree()
     // is no line breaking opportunity. (Thus, normally text wraps as needed,
     // but if there is a particularly long word, it does not overflow as it
     // normally would in CSS, it is instead forcibly wrapped at the box's edge.)
-
-    // FIXME(BUG 79916): CSS width property should be set to 'size vw', when the
-    // maximum cue size computation is corrected in the specification.
-    if (m_snapToLines)
-        m_displayTree->setInlineStyleProperty(CSSPropertyWidth, (double) m_cueSize, CSSPrimitiveValue::CSS_PERCENTAGE);
-
-    // FIXME(BUG 79750, 79751): Steps 10.12 - 10.14
-
-    if (!m_snapToLines) {
-        std::pair<double, double> position = getPositionCoordinates();
-
-        // 10.13.1 Set up x and y:
-        m_displayTree->setInlineStyleProperty(CSSPropertyLeft, position.first, CSSPrimitiveValue::CSS_PERCENTAGE);
-        m_displayTree->setInlineStyleProperty(CSSPropertyTop, position.second, CSSPrimitiveValue::CSS_PERCENTAGE);
-
-        // 10.13.2 Position the boxes in boxes such that the point x% along the
-        // width of the bounding box of the boxes in boxes is x% of the way
-        // across the width of the video's rendering area, and the point y%
-        // along the height of the bounding box of the boxes in boxes is y%
-        // of the way across the height of the video's rendering area, while
-        // maintaining the relative positions of the boxes in boxes to each
-        // other.
-        String translateX = "-" + String::number(position.first) + "%";
-        String translateY = "-" + String::number(position.second) + "%";
-        String webkitTransformTranslateValue = "translate(" + translateX + "," + translateY + ")";
-
-        m_displayTree->setInlineStyleProperty(CSSPropertyWebkitTransform,
-                                              webkitTransformTranslateValue);
-
-        m_displayTree->setInlineStyleProperty(CSSPropertyWhiteSpace,
-                                              CSSValuePre);
-    }
+    m_displayTree->applyCSSProperties();
 
     if (m_hasInnerTimestamps)
         updateDisplayTree(track()->mediaElement()->currentTime());
@@ -673,8 +740,9 @@ void TextTrackCue::removeDisplayTree()
         m_displayTree->remove(ASSERT_NO_EXCEPTION);
 }
 
-std::pair<double, double> TextTrackCue::getPositionCoordinates()
+std::pair<double, double> TextTrackCue::getPositionCoordinates() const
 {
+    // This method is used for setting x and y when snap to lines is not set.
     std::pair<double, double> coordinates;
 
     if (m_writingDirection == Horizontal && m_displayDirection == CSSValueLtr) {
@@ -732,7 +800,7 @@ TextTrackCue::CueSetting TextTrackCue::settingName(const String& name)
     return None;
 }
 
-void TextTrackCue::parseSettings(const String& input)
+void TextTrackCue::setCueSettings(const String& input)
 {
     unsigned position = 0;
 
@@ -929,6 +997,24 @@ NextSetting:
     }
 }
 
+int TextTrackCue::getCSSWritingMode() const
+{
+    return m_displayWritingMode;
+}
+
+int TextTrackCue::getCSSSize() const
+{
+    return m_displaySize;
+}
+
+std::pair<double, double> TextTrackCue::getCSSPosition() const
+{
+    if (!m_snapToLines)
+        return getPositionCoordinates();
+
+    return m_displayPosition;
+}
+
 const AtomicString& TextTrackCue::interfaceName() const
 {
     return eventNames().interfaceForTextTrackCue;
diff --git a/Source/WebCore/html/track/TextTrackCue.h b/Source/WebCore/html/track/TextTrackCue.h
index 9c5ba5b71..115a86809 100644
--- a/Source/WebCore/html/track/TextTrackCue.h
+++ b/Source/WebCore/html/track/TextTrackCue.h
@@ -34,6 +34,7 @@
 #if ENABLE(VIDEO_TRACK)
 
 #include "EventTarget.h"
+#include "HTMLElement.h"
 #include "TextTrack.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
@@ -41,15 +42,40 @@
 namespace WebCore {
 
 class DocumentFragment;
+class HTMLDivElement;
 class ScriptExecutionContext;
 class TextTrack;
-class HTMLDivElement;
+class TextTrackCue;
+
+// ----------------------------
+
+class TextTrackCueBox : public HTMLElement {
+public:
+    static PassRefPtr<TextTrackCueBox> create(Document* document, TextTrackCue* cue)
+    {
+        return adoptRef(new TextTrackCueBox(document, cue));
+    }
+
+    TextTrackCue* getCue() const;
+    void applyCSSProperties();
+
+    virtual const AtomicString& shadowPseudoId() const OVERRIDE;
+
+private:
+    TextTrackCueBox(Document*, TextTrackCue*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) OVERRIDE;
+
+    TextTrackCue* m_cue;
+};
+
+// ----------------------------
 
 class TextTrackCue : public RefCounted<TextTrackCue>, public EventTarget {
 public:
-    static PassRefPtr<TextTrackCue> create(ScriptExecutionContext* context, const String& id, double start, double end, const String& content, const String& settings, bool pauseOnExit)
+    static PassRefPtr<TextTrackCue> create(ScriptExecutionContext* context, double start, double end, const String& content)
     {
-        return adoptRef(new TextTrackCue(context, id, start, end, content, settings, pauseOnExit));
+        return adoptRef(new TextTrackCue(context, start, end, content));
     }
 
     virtual ~TextTrackCue();
@@ -90,6 +116,8 @@ public:
     const String& text() const { return m_content; }
     void setText(const String&);
 
+    void setCueSettings(const String&);
+
     int cueIndex();
     void invalidateCueIndex();
 
@@ -101,13 +129,27 @@ public:
     bool isActive();
     void setIsActive(bool);
 
-    PassRefPtr<HTMLDivElement> getDisplayTree();
+    PassRefPtr<TextTrackCueBox> getDisplayTree();
     void updateDisplayTree(float);
     void removeDisplayTree();
 
+    int calculateComputedLinePosition();
+
     virtual const AtomicString& interfaceName() const;
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
+    std::pair<double, double> getCSSPosition() const;
+    int getCSSSize() const;
+    int getCSSWritingMode() const;
+
+    enum WritingDirection {
+        Horizontal,
+        VerticalGrowingLeft,
+        VerticalGrowingRight,
+        NumberOfWritingDirections
+    };
+    WritingDirection getWritingDirection() const { return m_writingDirection; }
+
     DEFINE_ATTRIBUTE_EVENT_LISTENER(enter);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(exit);
 
@@ -119,15 +161,13 @@ protected:
     virtual EventTargetData* ensureEventTargetData();
 
 private:
-    TextTrackCue(ScriptExecutionContext*, const String& id, double start, double end, const String& content, const String& settings, bool pauseOnExit);
+    TextTrackCue(ScriptExecutionContext*, double start, double end, const String& content);
 
+    std::pair<double, double> getPositionCoordinates() const;
     void parseSettings(const String&);
 
-    int calculateComputedLinePosition();
     void calculateDisplayParameters();
 
-    std::pair<double, double> getPositionCoordinates();
-
     void cueWillChange();
     void cueDidChange();
 
@@ -147,12 +187,6 @@ private:
     int m_cueSize;
     int m_cueIndex;
 
-    enum WritingDirection {
-        Horizontal,
-        VerticalGrowingLeft,
-        VerticalGrowingRight,
-        NumberOfWritingDirections
-    };
     WritingDirection m_writingDirection;
 
     enum Alignment { Start, Middle, End };
@@ -173,7 +207,7 @@ private:
     RefPtr<HTMLDivElement> m_futureDocumentNodes;
 
     bool m_displayTreeShouldChange;
-    RefPtr<HTMLDivElement> m_displayTree;
+    RefPtr<TextTrackCueBox> m_displayTree;
 
     int m_displayDirection;
 
@@ -181,11 +215,8 @@ private:
     int m_displayWritingMode;
 
     int m_displaySize;
-    int m_displayHeight;
-    int m_displayWidth;
 
-    double m_displayXPosition;
-    double m_displayYPosition;
+    std::pair<float, float> m_displayPosition;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/track/TextTrackCue.idl b/Source/WebCore/html/track/TextTrackCue.idl
index d552525a4..040110963 100644
--- a/Source/WebCore/html/track/TextTrackCue.idl
+++ b/Source/WebCore/html/track/TextTrackCue.idl
@@ -29,7 +29,7 @@ module html {
         Conditional=VIDEO_TRACK,
         V8EnabledAtRuntime=webkitVideoTrack,
         JSGenerateToNativeObject,
-        Constructor(in DOMString id, in double startTime, in double endTime, in DOMString text, in [Optional=DefaultIsUndefined] DOMString settings, in [Optional=DefaultIsUndefined] boolean pauseOnExit),
+        Constructor(in double startTime, in double endTime, in DOMString text),
         CallWith=ScriptExecutionContext,
         EventTarget,
         JSCustomMarkFunction,
diff --git a/Source/WebCore/html/track/WebVTTParser.cpp b/Source/WebCore/html/track/WebVTTParser.cpp
index 32b79f10e..fe47d2258 100644
--- a/Source/WebCore/html/track/WebVTTParser.cpp
+++ b/Source/WebCore/html/track/WebVTTParser.cpp
@@ -262,7 +262,9 @@ void WebVTTParser::createNewCue()
     if (!m_currentContent.length())
         return;
 
-    RefPtr<TextTrackCue> cue = TextTrackCue::create(m_scriptExecutionContext, m_currentId, m_currentStartTime, m_currentEndTime, m_currentContent.toString(), m_currentSettings, false);
+    RefPtr<TextTrackCue> cue = TextTrackCue::create(m_scriptExecutionContext, m_currentStartTime, m_currentEndTime, m_currentContent.toString());
+    cue->setId(m_currentId);
+    cue->setCueSettings(m_currentSettings);
 
     m_cuelist.append(cue);
     if (m_client)
diff --git a/Source/WebCore/inspector/InjectedScriptExterns.js b/Source/WebCore/inspector/InjectedScriptExterns.js
index edd7754e4..a24f69773 100644
--- a/Source/WebCore/inspector/InjectedScriptExterns.js
+++ b/Source/WebCore/inspector/InjectedScriptExterns.js
@@ -76,6 +76,10 @@ InjectedScriptHost.prototype.type = function(object) { }
  * @param {*} object
  */
 InjectedScriptHost.prototype.getEventListeners = function(object) { }
+/**
+ * @param {string} expression
+ */
+InjectedScriptHost.prototype.evaluate = function(expression) { }
 
 
 /**
diff --git a/Source/WebCore/inspector/InjectedScriptWebGLModuleSource.js b/Source/WebCore/inspector/InjectedScriptWebGLModuleSource.js
index 977872767..3ace0b245 100644
--- a/Source/WebCore/inspector/InjectedScriptWebGLModuleSource.js
+++ b/Source/WebCore/inspector/InjectedScriptWebGLModuleSource.js
@@ -35,6 +35,105 @@
  */
 (function (InjectedScriptHost, inspectedWindow, injectedScriptId) {
 
+var TypeUtils = {
+    /**
+     * http://www.khronos.org/registry/typedarray/specs/latest/#7
+     * @type {Array.<Function>}
+     */
+    typedArrayClasses: (function(typeNames) {
+        var result = [];
+        for (var i = 0, n = typeNames.length; i < n; ++i) {
+            if (inspectedWindow[typeNames[i]])
+                result.push(inspectedWindow[typeNames[i]]);
+        }
+        return result;
+    })(["Int8Array", "Uint8Array", "Uint8ClampedArray", "Int16Array", "Uint16Array", "Int32Array", "Uint32Array", "Float32Array", "Float64Array"]),
+
+    /**
+     * @param {*} array
+     * @return {Function}
+     */
+    typedArrayClass: function(array)
+    {
+        var classes = TypeUtils.typedArrayClasses;
+        for (var i = 0, n = classes.length; i < n; ++i) {
+            if (array instanceof classes[i])
+                return classes[i];
+        }
+        return null;
+    },
+
+    /**
+     * @param {*} obj
+     * @return {*}
+     * FIXME: suppress checkTypes due to outdated builtin externs for CanvasRenderingContext2D and ImageData
+     * @suppress {checkTypes}
+     */
+    clone: function(obj)
+    {
+        if (!obj)
+            return obj;
+
+        var type = typeof obj;
+        if (type !== "object" && type !== "function")
+            return obj;
+
+        // Handle Array and ArrayBuffer instances.
+        if (typeof obj.slice === "function") {
+            console.assert(obj instanceof Array || obj instanceof ArrayBuffer);
+            return obj.slice(0);
+        }
+
+        var typedArrayClass = TypeUtils.typedArrayClass(obj);
+        if (typedArrayClass)
+            return new typedArrayClass(obj);
+
+        if (obj instanceof HTMLImageElement)
+            return obj.cloneNode(true);
+
+        if (obj instanceof HTMLCanvasElement) {
+            var result = obj.cloneNode(true);
+            var context = result.getContext("2d");
+            context.drawImage(obj, 0, 0);
+            return result;
+        }
+
+        if (obj instanceof HTMLVideoElement) {
+            var result = obj.cloneNode(true);
+            // FIXME: Copy HTMLVideoElement's current image into a 2d canvas.
+            return result;
+        }
+
+        if (obj instanceof ImageData) {
+            var context = TypeUtils._dummyCanvas2dContext();
+            var result = context.createImageData(obj);
+            for (var i = 0, n = obj.data.length; i < n; ++i)
+              result.data[i] = obj.data[i];
+            return result;
+        }
+
+        console.error("ASSERT_NOT_REACHED: failed to clone object: ", obj);
+        return obj;
+    },
+
+    /**
+     * @return {CanvasRenderingContext2D}
+     */
+    _dummyCanvas2dContext: function()
+    {
+        var context = TypeUtils._dummyCanvas2dContext;
+        if (!context) {
+            var canvas = inspectedWindow.document.createElement("canvas");
+            context = canvas.getContext("2d");
+            var contextResource = Resource.forObject(context);
+            if (contextResource)
+                context = contextResource.wrappedObject();
+            TypeUtils._dummyCanvas2dContext = context;
+        }
+        return context;
+    }
+}
+
 /**
  * @constructor
  */
@@ -93,7 +192,7 @@ Cache.prototype = {
  * @param {Resource|Object} thisObject
  * @param {string} functionName
  * @param {Array|Arguments} args
- * @param {Resource|*} result
+ * @param {Resource|*=} result
  */
 function Call(thisObject, functionName, args, result)
 {
@@ -134,6 +233,76 @@ Call.prototype = {
     result: function()
     {
         return this._result;
+    },
+
+    freeze: function()
+    {
+        if (this._freezed)
+            return;
+        this._freezed = true;
+        for (var i = 0, n = this._args.length; i < n; ++i) {
+            // FIXME: freeze the Resources also!
+            if (!Resource.forObject(this._args[i]))
+                this._args[i] = TypeUtils.clone(this._args[i]);
+        }
+    }
+}
+
+/**
+ * @constructor
+ * @param {ReplayableResource} thisObject
+ * @param {string} functionName
+ * @param {Array.<ReplayableResource|*>} args
+ * @param {ReplayableResource|*} result
+ */
+function ReplayableCall(thisObject, functionName, args, result)
+{
+    this._thisObject = thisObject;
+    this._functionName = functionName;
+    this._args = args;
+    this._result = result;
+}
+
+ReplayableCall.prototype = {
+    /**
+     * @return {ReplayableResource}
+     */
+    resource: function()
+    {
+        return this._thisObject;
+    },
+
+    /**
+     * @return {string}
+     */
+    functionName: function()
+    {
+        return this._functionName;
+    },
+
+    /**
+     * @return {Array.<ReplayableResource|*>}
+     */
+    args: function()
+    {
+        return this._args;
+    },
+
+    /**
+     * @return {ReplayableResource|*}
+     */
+    result: function()
+    {
+        return this._result;
+    },
+
+    /**
+     * @param {Cache} cache
+     * @return {Call}
+     */
+    replay: function(cache)
+    {
+        // FIXME: Do the replay.
     }
 }
 
@@ -145,18 +314,24 @@ function Resource(wrappedObject)
 {
     this._id = ++Resource._uniqueId;
     this._resourceManager = null;
+    this._calls = [];
     this.setWrappedObject(wrappedObject);
 }
 
+/**
+ * @type {number}
+ */
 Resource._uniqueId = 0;
 
 /**
- * @param {Object} obj
+ * @param {*} obj
  * @return {Resource}
  */
 Resource.forObject = function(obj)
 {
-    if (!obj || obj instanceof Resource)
+    if (!obj)
+        return null;
+    if (obj instanceof Resource)
         return obj;
     if (typeof obj === "object")
         return obj["__resourceObject"];
@@ -185,7 +360,8 @@ Resource.prototype = {
      */
     setWrappedObject: function(value)
     {
-        console.assert(value && !(value instanceof Resource), "Binding a Resource object to another Resource object?");
+        console.assert(value, "wrappedObject should not be NULL");
+        console.assert(!(value instanceof Resource), "Binding a Resource object to another Resource object?");
         this._wrappedObject = value;
         this._bindObjectToResource(value);
     },
@@ -216,6 +392,23 @@ Resource.prototype = {
     },
 
     /**
+     * @return {Array.<Call>}
+     */
+    calls: function()
+    {
+        return this._calls;
+    },
+
+    /**
+     * @param {Call} call
+     */
+    pushCall: function(call)
+    {
+        call.freeze();
+        this._calls.push(call);
+    },
+
+    /**
      * @param {Object} object
      */
     _bindObjectToResource: function(object)
@@ -226,6 +419,26 @@ Resource.prototype = {
 
 /**
  * @constructor
+ * @param {Resource} originalResource
+ * @param {Object} data
+ */
+function ReplayableResource(originalResource, data)
+{
+}
+
+ReplayableResource.prototype = {
+    /**
+     * @param {Cache} cache
+     * @return {Resource}
+     */
+    replay: function(cache)
+    {
+        // FIXME: Do the replay.
+    }
+}
+
+/**
+ * @constructor
  * @extends {Resource}
  * @param {WebGLRenderingContext} glContext
  */
@@ -313,7 +526,7 @@ WebGLRenderingContextResource.prototype.__proto__ = Resource.prototype;
  * @param {WebGLRenderingContext} originalObject
  * @param {Function} originalFunction
  * @param {string} functionName
- * @param {Array} args
+ * @param {Array|Arguments} args
  */
 WebGLRenderingContextResource.WrapFunction = function(originalObject, originalFunction, functionName, args)
 {
@@ -353,8 +566,8 @@ WebGLRenderingContextResource.WrapFunction.prototype = {
  */
 function TraceLog()
 {
-    this._calls = [];
-    this._resourceCache = new Cache();
+    this._replayableCalls = [];
+    this._replayablesCache = new Cache();
 }
 
 TraceLog.prototype = {
@@ -363,7 +576,15 @@ TraceLog.prototype = {
      */
     size: function()
     {
-        return this._calls.length;
+        return this._replayableCalls.length;
+    },
+
+    /**
+     * @return {Array.<ReplayableCall>}
+     */
+    replayableCalls: function()
+    {
+        return this._replayableCalls;
     },
 
     /**
@@ -379,8 +600,68 @@ TraceLog.prototype = {
      */
     addCall: function(call)
     {
-        // FIXME: Clone call and push the clone.
-        this._calls.push(call);
+        // FIXME: Convert the call to a ReplayableCall and push it.
+    }
+}
+
+/**
+ * @constructor
+ * @param {TraceLog} traceLog
+ */
+function TraceLogPlayer(traceLog)
+{
+    this._traceLog = traceLog;
+    this._nextReplayStep = 0;
+    this._replayWorldCache = new Cache();
+}
+
+TraceLogPlayer.prototype = {
+    /**
+     * @return {TraceLog}
+     */
+    traceLog: function()
+    {
+        return this._traceLog;
+    },
+
+    /**
+     * @return {number}
+     */
+    nextReplayStep: function()
+    {
+        return this._nextReplayStep;
+    },
+
+    reset: function()
+    {
+        // FIXME: Prevent memory leaks: detach and delete all old resources OR reuse them OR create a new replay canvas every time.
+        this._nextReplayStep = 0;
+        this._replayWorldCache.reset();
+    },
+
+    step: function()
+    {
+        this.stepTo(this._nextReplayStep);
+    },
+
+    /**
+     * @param {number} stepNum
+     */
+    stepTo: function(stepNum)
+    {
+        stepNum = Math.min(stepNum, this._traceLog.size() - 1);
+        console.assert(stepNum >= 0);
+        if (this._nextReplayStep > stepNum)
+            this.reset();
+        // FIXME: Replay all the cached resources first to warm-up.
+        var replayableCalls = this._traceLog.replayableCalls();
+        while (this._nextReplayStep <= stepNum)
+            replayableCalls[this._nextReplayStep++].replay(this._replayWorldCache);            
+    },
+
+    replay: function()
+    {
+        this.stepTo(this._traceLog.size() - 1);
     }
 }
 
@@ -445,6 +726,10 @@ ResourceTrackingManager.prototype = {
         this._stopCapturingOnFrameEnd = true;
     },
 
+    /**
+     * @param {Resource} resource
+     * @param {Array|Arguments} args
+     */
     captureArguments: function(resource, args)
     {
         if (!this._capturing)
@@ -491,6 +776,10 @@ ResourceTrackingManager.prototype = {
 var InjectedScript = function()
 {
     this._manager = new ResourceTrackingManager();
+    this._lastTraceLogId = 0;
+    this._traceLogs = {};
+    this._traceLogPlayer = null;
+    this._replayContext = null;
 }
 
 InjectedScript.prototype = {
@@ -508,7 +797,72 @@ InjectedScript.prototype = {
 
     captureFrame: function()
     {
+        var id = this._makeTraceLogId();
         this._manager.captureFrame();
+        this._traceLogs[id] = this._manager.lastTraceLog();
+        return id;
+    },
+
+    /**
+     * @param {string} id
+     */
+    dropTraceLog: function(id)
+    {
+        if (this._traceLogPlayer && this._traceLogPlayer.traceLog() === this._traceLogs[id])
+            this._traceLogPlayer = null;
+        delete this._traceLogs[id];
+    },
+
+    /**
+     * @param {string} id
+     * @return {Object|string}
+     */
+    traceLog: function(id)
+    {
+        var traceLog = this._traceLogs[id];
+        if (!traceLog)
+            return "Error: Trace log with this ID not found.";
+        var result = {
+            id: id,
+            calls: []
+        };
+        var calls = traceLog.replayableCalls();
+        for (var i = 0, n = calls.length; i < n; ++i) {
+            var call = calls[i];
+            result.calls.push({
+                functionName: call.functionName() + "(" + call.args().join(", ") + ") => " + call.result()
+            });
+        }
+        return result;
+    },
+
+    /**
+     * @param {string} id
+     * @param {number} stepNo
+     * @return {string}
+     */
+    replayTraceLog: function(id, stepNo)
+    {
+        var traceLog = this._traceLogs[id];
+        if (!traceLog)
+            return "";
+        if (!this._traceLogPlayer || this._traceLogPlayer.traceLog() !== traceLog)
+            this._traceLogPlayer = new TraceLogPlayer(traceLog);
+        this._traceLogPlayer.stepTo(stepNo);
+        if (!this._replayContext) {
+            console.error("ASSERT_NOT_REACHED: replayTraceLog failed to create a replay canvas?!");
+            return "";
+        }
+        // Return current screenshot.
+        return this._replayContext.canvas.toDataURL();
+    },
+
+    /**
+     * @return {string}
+     */
+    _makeTraceLogId: function()
+    {
+        return "{\"injectedScriptId\":" + injectedScriptId + ",\"traceLogId\":" + (++this._lastTraceLogId) + "}";
     }
 }
 
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 6fed8dc71..4aba46a69 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -2144,7 +2144,11 @@
             },
             {
                 "id": "ShorthandEntry",
-                "type": "object"
+                "type": "object",
+                "properties": [
+                    { "name": "name", "type": "string", "description": "Shorthand name." },
+                    { "name": "value", "type": "string", "description": "Shorthand value." }
+                ]
             },
             {
                 "id": "CSSPropertyInfo",
diff --git a/Source/WebCore/inspector/InspectorOverlay.cpp b/Source/WebCore/inspector/InspectorOverlay.cpp
index 21bd0ed49..981b2552b 100644
--- a/Source/WebCore/inspector/InspectorOverlay.cpp
+++ b/Source/WebCore/inspector/InspectorOverlay.cpp
@@ -33,6 +33,7 @@
 #include "InspectorOverlay.h"
 
 #include "Element.h"
+#include "Font.h"
 #include "FontCache.h"
 #include "FontFamily.h"
 #include "Frame.h"
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index 730e36bb8..83b402d6e 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -493,7 +493,7 @@ PassRefPtr<TypeBuilder::CSS::CSSStyle> InspectorStyle::styleWithProperties() con
     populateAllProperties(&properties);
 
     RefPtr<Array<TypeBuilder::CSS::CSSProperty> > propertiesObject = Array<TypeBuilder::CSS::CSSProperty>::create();
-    RefPtr<Array<InspectorObject> > shorthandEntries = Array<InspectorObject>::create();
+    RefPtr<Array<TypeBuilder::CSS::ShorthandEntry> > shorthandEntries = Array<TypeBuilder::CSS::ShorthandEntry>::create();
     HashMap<String, RefPtr<TypeBuilder::CSS::CSSProperty> > propertyNameToPreviousActiveProperty;
     HashSet<String> foundShorthands;
 
@@ -557,10 +557,10 @@ PassRefPtr<TypeBuilder::CSS::CSSStyle> InspectorStyle::styleWithProperties() con
                 if (!shorthand.isEmpty()) {
                     if (!foundShorthands.contains(shorthand)) {
                         foundShorthands.add(shorthand);
-                        RefPtr<InspectorObject> shorthandEntry = InspectorObject::create();
-                        shorthandEntry->setString("name", shorthand);
-                        shorthandEntry->setString("value", shorthandValue(shorthand));
-                        shorthandEntries->addItem(shorthandEntry.release());
+                        RefPtr<TypeBuilder::CSS::ShorthandEntry> entry = TypeBuilder::CSS::ShorthandEntry::create()
+                            .setName(shorthand)
+                            .setValue(shorthandValue(shorthand));
+                        shorthandEntries->addItem(entry);
                     }
                 }
             }
@@ -949,7 +949,7 @@ PassRefPtr<TypeBuilder::CSS::CSSStyle> InspectorStyleSheet::buildObjectForStyle(
     if (id.isEmpty()) {
         RefPtr<TypeBuilder::CSS::CSSStyle> bogusStyle = TypeBuilder::CSS::CSSStyle::create()
             .setCssProperties(Array<TypeBuilder::CSS::CSSProperty>::create())
-            .setShorthandEntries(Array<InspectorObject>::create());
+            .setShorthandEntries(Array<TypeBuilder::CSS::ShorthandEntry>::create());
         return bogusStyle.release();
     }
     RefPtr<InspectorStyle> inspectorStyle = inspectorStyleForId(id);
diff --git a/Source/WebCore/inspector/compile-front-end.py b/Source/WebCore/inspector/compile-front-end.py
index d956e3dbf..449131936 100755
--- a/Source/WebCore/inspector/compile-front-end.py
+++ b/Source/WebCore/inspector/compile-front-end.py
@@ -30,42 +30,32 @@
 import os
 import os.path
 import generate_protocol_externs
+import sys
 
 inspector_path = "Source/WebCore/inspector"
 inspector_frontend_path = inspector_path + "/front-end"
 
 generate_protocol_externs.generate_protocol_externs(inspector_frontend_path + "/protocol-externs.js", inspector_path + "/Inspector.json")
 
-externs = ["externs.js", "protocol-externs.js"]
 jsmodule_name_prefix = "jsmodule_"
 modules = [
     {
-        "target_name": "util",
+        "name": "common",
         "dependencies": [],
         "sources": [
-            "DOMExtension.js",
-            "utilities.js",
-            "treeoutline.js",
-        ]
-    },
-    {
-        "target_name": "common",
-        "dependencies": ["util"],
-        "sources": [
+            "Color.js",
             "Object.js",
             "Settings.js",
+            "UIString.js",
             "UserMetrics.js",
-            "HandlerRegistry.js",
-            "InspectorFrontendHostStub.js",
+            "utilities.js",
         ]
     },
     {
-        "target_name": "sdk",
+        "name": "sdk",
         "dependencies": ["common"],
         "sources": [
-            "InspectorBackend.js",
             "ApplicationCacheModel.js",
-            "Color.js",
             "CompilerScriptMapping.js",
             "ConsoleModel.js",
             "ContentProvider.js",
@@ -85,9 +75,10 @@ modules = [
             "FileUtils.js",
             "HAREntry.js",
             "IndexedDBModel.js",
+            "InspectorBackend.js",
+            "JavaScriptSource.js",
             "Linkifier.js",
             "NetworkLog.js",
-            "Placard.js",
             "PresentationConsoleMessageHelper.js",
             "SASSSourceMapping.js",
             "Script.js",
@@ -109,27 +100,29 @@ modules = [
             "UISourceCode.js",
             "UserAgentSupport.js",
             "Workspace.js",
+            "protocol-externs.js",
         ]
     },
     {
-        "target_name": "ui",
+        "name": "ui",
         "dependencies": ["common"],
         "sources": [
-            "AdvancedSearchController.js",
             "Checkbox.js",
             "ContextMenu.js",
-            "CookiesTable.js",
+            "DOMExtension.js",
             "DOMSyntaxHighlighter.js",
             "DataGrid.js",
             "DefaultTextEditor.js",
             "Dialog.js",
             "Drawer.js",
             "EmptyView.js",
+            "GoToLineDialog.js",
             "HelpScreen.js",
             "InspectorView.js",
             "KeyboardShortcut.js",
             "Panel.js",
             "PanelEnablerView.js",
+            "Placard.js",
             "Popover.js",
             "ProgressBar.js",
             "PropertiesSection.js",
@@ -150,33 +143,33 @@ modules = [
             "TextEditorHighlighter.js",
             "TextEditorModel.js",
             "TextPrompt.js",
+            "TimelineGrid.js",
             "Toolbar.js",
             "UIUtils.js",
             "View.js",
+            "treeoutline.js",
         ]
     },
     {
-        "target_name": "components",
+        "name": "components",
         "dependencies": ["sdk", "ui"],
         "sources": [
+            "AdvancedSearchController.js",
+            "HandlerRegistry.js",
             "ConsoleMessage.js",
+            "CookiesTable.js",
             "DOMBreakpointsSidebarPane.js",
             "DOMPresentationUtils.js",
             "ElementsTreeOutline.js",
-            "GoToLineDialog.js",
             "NativeBreakpointsSidebarPane.js",
-            "NavigatorOverlayController.js",
-            "NavigatorView.js",
             "JavaScriptContextManager.js",
-            "JavaScriptSource.js",
             "ObjectPopoverHelper.js",
             "ObjectPropertiesSection.js",
             "SourceFrame.js",
-            "TimelineGrid.js",
         ]
     },
     {
-        "target_name": "elements",
+        "name": "elements",
         "dependencies": ["components"],
         "sources": [
             "ElementsPanel.js",
@@ -187,7 +180,7 @@ modules = [
         ]
     },
     {
-        "target_name": "network",
+        "name": "network",
         "dependencies": ["components"],
         "sources": [
             "FontView.js",
@@ -207,7 +200,7 @@ modules = [
         ]
     },
     {
-        "target_name": "resources",
+        "name": "resources",
         "dependencies": ["components"],
         "sources": [
             "ApplicationCacheItemsView.js",
@@ -223,13 +216,15 @@ modules = [
         ]
     },
     {
-        "target_name": "scripts",
+        "name": "scripts",
         "dependencies": ["components"],
         "sources": [
             "BreakpointsSidebarPane.js",
             "CallStackSidebarPane.js",
             "FilteredItemSelectionDialog.js",
             "JavaScriptSourceFrame.js",
+            "NavigatorOverlayController.js",
+            "NavigatorView.js",
             "RevisionHistoryView.js",
             "ScopeChainSidebarPane.js",
             "ScriptsNavigator.js",
@@ -244,7 +239,7 @@ modules = [
         ]
     },
     {
-        "target_name": "console",
+        "name": "console",
         "dependencies": ["components"],
         "sources": [
             "ConsoleView.js",
@@ -252,7 +247,7 @@ modules = [
         ]
     },
     {
-        "target_name": "timeline",
+        "name": "timeline",
         "dependencies": ["components"],
         "sources": [
             "MemoryStatistics.js",
@@ -264,7 +259,7 @@ modules = [
         ]
     },
     {
-        "target_name": "audits",
+        "name": "audits",
         "dependencies": ["components"],
         "sources": [
             "AuditCategories.js",
@@ -276,7 +271,7 @@ modules = [
         ]
     },
     {
-        "target_name": "extensions",
+        "name": "extensions",
         "dependencies": ["components"],
         "sources": [
             "ExtensionAPI.js",
@@ -288,22 +283,28 @@ modules = [
         ]
     },
     {
-        "target_name": "inspector",
+        "name": "settings",
         "dependencies": ["components", "extensions"],
         "sources": [
             "SettingsScreen.js",
+        ]
+    },
+    {
+        "name": "workers",
+        "dependencies": ["components"],
+        "sources": [
             "WorkerManager.js",
         ]
     },
     {
-        "target_name": "tests",
+        "name": "tests",
         "dependencies": ["components"],
         "sources": [
             "TestController.js",
         ]
     },
     {
-        "target_name": "profiler",
+        "name": "profiler",
         "dependencies": ["components"],
         "sources": [
             "BottomUpProfileDataGridTree.js",
@@ -324,33 +325,30 @@ modules = [
             "TopDownProfileDataGridTree.js",
         ]
     },
-#    {
-#        "target_name": "tokenizers",
-#        "dependencies": ["components"],
-#        "sources": [
-#            "SourceCSSTokenizer.js",
-#            "SourceHTMLTokenizer.js",
-#            "SourceJavaScriptTokenizer.js",
-#        ]
-#    },
+    {
+        "name": "host_stub",
+        "dependencies": ["ui"],
+        "sources": [
+            "InspectorFrontendHostStub.js",
+        ]
+    },
 ]
 
-# To be compiled...
-#
-# [Misc]
-# inspector
-# SettingsScreen
-# JavaScriptFormatter
-# ScriptFormatterWorker
+modules_by_name = {}
+for module in modules:
+    modules_by_name[module["name"]] = module
 
-compiler_command = "java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SIMPLE_OPTIMIZATIONS --warning_level VERBOSE --language_in ECMASCRIPT5 --accept_const_keyword \\\n"
 
-command = compiler_command
-for extern in externs:
-    command += "    --externs " + inspector_frontend_path + "/" + extern
-    command += " \\\n"
-for module in modules:
-    command += "    --module " + jsmodule_name_prefix + module["target_name"] + ":"
+def dump_module(name, recursively, processed_modules):
+    if name in processed_modules:
+        return ""
+    processed_modules[name] = True
+    module = modules_by_name[name]
+    command = ""
+    if recursively:
+        for dependency in module["dependencies"]:
+            command += dump_module(dependency, recursively, processed_modules)
+    command += " \\\n    --module " + jsmodule_name_prefix + module["name"] + ":"
     command += str(len(module["sources"]))
     firstDependency = True
     for dependency in module["dependencies"]:
@@ -360,31 +358,49 @@ for module in modules:
             command += ","
         firstDependency = False
         command += jsmodule_name_prefix + dependency
-    command += " \\\n"
     for script in module["sources"]:
-        command += "        --js " + inspector_frontend_path + "/" + script
-        command += " \\\n"
-command += "\n"
-os.system(command)
+        command += " \\\n        --js " + inspector_frontend_path + "/" + script
+    return command
+
+compiler_command = "java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SIMPLE_OPTIMIZATIONS --warning_level VERBOSE --language_in ECMASCRIPT5 --accept_const_keyword \\\n"
+
+process_recursively = len(sys.argv) == 2
+if process_recursively:
+    module_name = sys.argv[1]
+    if module_name != "all":
+        modules = [modules_by_name[sys.argv[1]]]
+    for module in modules:
+        command = compiler_command
+        command += "    --externs " + inspector_frontend_path + "/externs.js"
+        command += dump_module(module["name"], True, {})
+        print "Compiling \"" + module["name"] + "\""
+        os.system(command)
+else:
+    command = compiler_command
+    command += "    --externs " + inspector_frontend_path + "/externs.js"
+    for module in modules:
+        command += dump_module(module["name"], False, {})
+    os.system(command)
 
-print "Compiling InjectedScriptSource.js..."
-os.system("echo \"var injectedScriptValue = \" > " + inspector_path + "/" + "InjectedScriptSourceTmp.js")
-os.system("cat  " + inspector_path + "/" + "InjectedScriptSource.js" + " >> " + inspector_path + "/" + "InjectedScriptSourceTmp.js")
-command = compiler_command
-command += "    --externs " + inspector_path + "/" + "InjectedScriptExterns.js" + " \\\n"
-command += "    --module " + jsmodule_name_prefix + "injected_script" + ":" + "1" + " \\\n"
-command += "        --js " + inspector_path + "/" + "InjectedScriptSourceTmp.js" + " \\\n"
-command += "\n"
-os.system(command)
-os.system("rm " + inspector_path + "/" + "InjectedScriptSourceTmp.js")
+if not process_recursively:
+    print "Compiling InjectedScriptSource.js..."
+    os.system("echo \"var injectedScriptValue = \" > " + inspector_path + "/" + "InjectedScriptSourceTmp.js")
+    os.system("cat  " + inspector_path + "/" + "InjectedScriptSource.js" + " >> " + inspector_path + "/" + "InjectedScriptSourceTmp.js")
+    command = compiler_command
+    command += "    --externs " + inspector_path + "/" + "InjectedScriptExterns.js" + " \\\n"
+    command += "    --module " + jsmodule_name_prefix + "injected_script" + ":" + "1" + " \\\n"
+    command += "        --js " + inspector_path + "/" + "InjectedScriptSourceTmp.js" + " \\\n"
+    command += "\n"
+    os.system(command)
+    os.system("rm " + inspector_path + "/" + "InjectedScriptSourceTmp.js")
 
-print "Compiling InjectedScriptWebGLModuleSource.js..."
-os.system("echo \"var injectedScriptWebGLModuleValue = \" > " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js")
-os.system("cat  " + inspector_path + "/" + "InjectedScriptWebGLModuleSource.js" + " >> " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js")
-command = compiler_command
-command += "    --externs " + inspector_path + "/" + "InjectedScriptExterns.js" + " \\\n"
-command += "    --module " + jsmodule_name_prefix + "injected_script" + ":" + "1" + " \\\n"
-command += "        --js " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js" + " \\\n"
-command += "\n"
-os.system(command)
-os.system("rm " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js")
+    print "Compiling InjectedScriptWebGLModuleSource.js..."
+    os.system("echo \"var injectedScriptWebGLModuleValue = \" > " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js")
+    os.system("cat  " + inspector_path + "/" + "InjectedScriptWebGLModuleSource.js" + " >> " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js")
+    command = compiler_command
+    command += "    --externs " + inspector_path + "/" + "InjectedScriptExterns.js" + " \\\n"
+    command += "    --module " + jsmodule_name_prefix + "injected_script" + ":" + "1" + " \\\n"
+    command += "        --js " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js" + " \\\n"
+    command += "\n"
+    os.system(command)
+    os.system("rm " + inspector_path + "/" + "InjectedScriptWebGLModuleSourceTmp.js")
diff --git a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
index df5ca2cb3..4d362d0e5 100644
--- a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
@@ -260,6 +260,9 @@ WebInspector.SourceMapParser.prototype = {
             this._parseMap(mappingPayload, 0, 0);
     },
 
+    /**
+     * @param {Array.<SourceMapV3.Section>} sections
+     */
     _parseSections: function(sections)
     {
         for (var i = 0; i < sections.length; ++i) {
@@ -268,6 +271,11 @@ WebInspector.SourceMapParser.prototype = {
         }
     },
 
+    /**
+     * @param {SourceMapV3} map
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     */
     _parseMap: function(map, lineNumber, columnNumber)
     {
         var sourceIndex = 0;
diff --git a/Source/WebCore/inspector/front-end/ConsoleModel.js b/Source/WebCore/inspector/front-end/ConsoleModel.js
index 2e2abdd1a..040296ea7 100644
--- a/Source/WebCore/inspector/front-end/ConsoleModel.js
+++ b/Source/WebCore/inspector/front-end/ConsoleModel.js
@@ -162,6 +162,7 @@ WebInspector.ConsoleMessage = function(source, level, url, line, repeatCount)
     this.level = level;
     this.url = url || null;
     this.line = line || 0;
+    this.message = "";
 
     repeatCount = repeatCount || 1;
     this.repeatCount = repeatCount;
@@ -189,6 +190,11 @@ WebInspector.ConsoleMessage.prototype = {
     clone: function()
     {
         // Implemented by concrete instances
+    },
+
+    location: function()
+    {
+        // Implemented by concrete instances
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index eedebe573..45f201c1d 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -1076,7 +1076,7 @@ WebInspector.DOMAgent.prototype = {
     },
 
     /**
-     * @param {DOMAgent.Node} node
+     * @param {WebInspector.DOMNode} node
      */
     _unbind: function(node)
     {
diff --git a/Source/WebCore/inspector/front-end/DOMStorage.js b/Source/WebCore/inspector/front-end/DOMStorage.js
index cdb32f415..df977711a 100644
--- a/Source/WebCore/inspector/front-end/DOMStorage.js
+++ b/Source/WebCore/inspector/front-end/DOMStorage.js
@@ -85,10 +85,69 @@ WebInspector.DOMStorage.prototype = {
 
 /**
  * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.DOMStorageModel = function()
+{
+    this._storages = {};
+    InspectorBackend.registerDOMStorageDispatcher(new WebInspector.DOMStorageDispatcher(this));
+    DOMStorageAgent.enable();
+}
+
+WebInspector.DOMStorageModel.Events = {
+    DOMStorageAdded: "DOMStorageAdded",
+    DOMStorageUpdated: "DOMStorageUpdated"
+}
+
+WebInspector.DOMStorageModel.prototype = {
+    /**
+     * @param {WebInspector.DOMStorage} domStorage
+     */
+    _addDOMStorage: function(domStorage)
+    {
+        this._storages[domStorage.id] = domStorage;
+        this.dispatchEventToListeners(WebInspector.DOMStorageModel.Events.DOMStorageAdded, domStorage);
+    },
+
+    /**
+     * @param {DOMStorageAgent.StorageId} storageId
+     */
+    _domStorageUpdated: function(storageId)
+    {
+        this.dispatchEventToListeners(WebInspector.DOMStorageModel.Events.DOMStorageUpdated, this._storages[storageId]);
+    },
+
+    /**
+     * @param {DOMStorageAgent.StorageId} storageId
+     * @return {WebInspector.DOMStorage}
+     */
+    storageForId: function(storageId)
+    {
+        return this._storages[storageId];
+    },
+
+    /**
+     * @return {Array.<WebInspector.DOMStorage>}
+     */
+    storages: function()
+    {
+        var result = [];
+        for (var storageId in this._storages)
+            result.push(this._storages[storageId]);
+        return result;
+    }
+}
+
+WebInspector.DOMStorageModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
  * @implements {DOMStorageAgent.Dispatcher}
+ * @param {WebInspector.DOMStorageModel} model
  */
-WebInspector.DOMStorageDispatcher = function()
+WebInspector.DOMStorageDispatcher = function(model)
 {
+    this._model = model;
 }
 
 WebInspector.DOMStorageDispatcher.prototype = {
@@ -98,11 +157,10 @@ WebInspector.DOMStorageDispatcher.prototype = {
      */
     addDOMStorage: function(payload)
     {
-        var domStorage = new WebInspector.DOMStorage(
+        this._model._addDOMStorage(new WebInspector.DOMStorage(
             payload.id,
             payload.origin,
-            payload.isLocalStorage);
-        WebInspector.panel("resources").addDOMStorage(domStorage);
+            payload.isLocalStorage));
     },
 
     /**
@@ -110,6 +168,11 @@ WebInspector.DOMStorageDispatcher.prototype = {
      */
     domStorageUpdated: function(storageId)
     {
-        WebInspector.panel("resources").domStorageUpdated(storageId);
+        this._model._domStorageUpdated(storageId);
     }
 }
+
+/**
+ * @type {WebInspector.DOMStorageModel}
+ */
+WebInspector.domStorageModel = null;
diff --git a/Source/WebCore/inspector/front-end/Database.js b/Source/WebCore/inspector/front-end/Database.js
index 6e94adb48..72389c5ab 100644
--- a/Source/WebCore/inspector/front-end/Database.js
+++ b/Source/WebCore/inspector/front-end/Database.js
@@ -28,9 +28,11 @@
 
 /**
  * @constructor
+ * @param {WebInspector.DatabaseModel} model
  */
-WebInspector.Database = function(id, domain, name, version)
+WebInspector.Database = function(model, id, domain, name, version)
 {
+    this._model = model;
     this._id = id;
     this._domain = domain;
     this._name = name;
@@ -113,18 +115,100 @@ WebInspector.Database.prototype = {
                 onError(WebInspector.UIString("Database not found."));
                 return;
             }
-            WebInspector.DatabaseDispatcher._callbacks[transactionId] = {"onSuccess": onSuccess, "onError": onError};
+            this._model._callbacks[transactionId] = {"onSuccess": onSuccess, "onError": onError};
         }
-        DatabaseAgent.executeSQL(this._id, query, callback);
+        DatabaseAgent.executeSQL(this._id, query, callback.bind(this));
     }
 }
 
 /**
  * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.DatabaseModel = function()
+{
+    this._callbacks = {};
+    this._databases = [];
+    InspectorBackend.registerDatabaseDispatcher(new WebInspector.DatabaseDispatcher(this));
+    DatabaseAgent.enable();
+}
+
+WebInspector.DatabaseModel.Events = {
+    DatabaseAdded: "DatabaseAdded"
+}
+
+WebInspector.DatabaseModel.prototype = {
+    /**
+     * @return {Array.<WebInspector.Database>}
+     */
+    databases: function()
+    {
+        var result = [];
+        for (var databaseId in this._databases)
+            result.push(this._databases[databaseId]);
+        return result;
+    },
+
+    /**
+     * @param {DatabaseAgent.DatabaseId} databaseId
+     * @return {WebInspector.Database}
+     */
+    databaseForId: function(databaseId)
+    {
+        return this._databases[databaseId];
+    },
+
+    /**
+     * @param {WebInspector.Database} database
+     */
+    _addDatabase: function(database)
+    {
+        this._databases.push(database);
+        this.dispatchEventToListeners(WebInspector.DatabaseModel.Events.DatabaseAdded, database);
+    },
+
+    /**
+     * @param {number} transactionId
+     * @param {Array.<string>} columnNames
+     * @param {Array.<*>} values
+     */
+    _sqlTransactionSucceeded: function(transactionId, columnNames, values)
+    {
+        if (!this._callbacks[transactionId])
+            return;
+
+        var callback = this._callbacks[transactionId]["onSuccess"];
+        delete this._callbacks[transactionId];
+        if (callback)
+            callback(columnNames, values);
+    },
+
+    /**
+     * @param {number} transactionId
+     * @param {?DatabaseAgent.Error} errorObj
+     */
+    _sqlTransactionFailed: function(transactionId, errorObj)
+    {
+        if (!this._callbacks[transactionId])
+            return;
+
+        var callback = this._callbacks[transactionId]["onError"];
+        delete this._callbacks[transactionId];
+        if (callback)
+            callback(errorObj);
+    }
+}
+
+WebInspector.DatabaseModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
  * @implements {DatabaseAgent.Dispatcher}
+ * @param {WebInspector.DatabaseModel} model
  */
-WebInspector.DatabaseDispatcher = function()
+WebInspector.DatabaseDispatcher = function(model)
 {
+    this._model = model;
 }
 
 WebInspector.DatabaseDispatcher._callbacks = {};
@@ -135,12 +219,12 @@ WebInspector.DatabaseDispatcher.prototype = {
      */
     addDatabase: function(payload)
     {
-        var database = new WebInspector.Database(
+        this._model._addDatabase(new WebInspector.Database(
+            this._model,
             payload.id,
             payload.domain,
             payload.name,
-            payload.version);
-        WebInspector.panel("resources").addDatabase(database);
+            payload.version));
     },
 
     /**
@@ -150,13 +234,7 @@ WebInspector.DatabaseDispatcher.prototype = {
      */
     sqlTransactionSucceeded: function(transactionId, columnNames, values)
     {
-        if (!WebInspector.DatabaseDispatcher._callbacks[transactionId])
-            return;
-
-        var callback = WebInspector.DatabaseDispatcher._callbacks[transactionId]["onSuccess"];
-        delete WebInspector.DatabaseDispatcher._callbacks[transactionId];
-        if (callback)
-            callback(columnNames, values);
+        this._model._sqlTransactionSucceeded(transactionId, columnNames, values);
     },
 
     /**
@@ -165,12 +243,11 @@ WebInspector.DatabaseDispatcher.prototype = {
      */
     sqlTransactionFailed: function(transactionId, errorObj)
     {
-        if (!WebInspector.DatabaseDispatcher._callbacks[transactionId])
-            return;
-
-        var callback = WebInspector.DatabaseDispatcher._callbacks[transactionId]["onError"];
-        delete WebInspector.DatabaseDispatcher._callbacks[transactionId];
-        if (callback)
-             callback(errorObj);
+        this._model._sqlTransactionFailed(transactionId, errorObj);
     }
 }
+
+/**
+ * @type {WebInspector.DatabaseModel}
+ */
+WebInspector.databaseModel = null;
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index 8c6c8e0a8..e8e2d4b4f 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -647,6 +647,7 @@ WebInspector.DebuggerDispatcher.prototype = {
      * @param {number} endLine
      * @param {number} endColumn
      * @param {boolean=} isContentScript
+     * @param {string=} sourceMapURL
      */
     scriptParsed: function(scriptId, sourceURL, startLine, startColumn, endLine, endColumn, isContentScript, sourceMapURL)
     {
diff --git a/Source/WebCore/inspector/front-end/FileUtils.js b/Source/WebCore/inspector/front-end/FileUtils.js
index 07fe25f5c..34ec16e50 100644
--- a/Source/WebCore/inspector/front-end/FileUtils.js
+++ b/Source/WebCore/inspector/front-end/FileUtils.js
@@ -36,21 +36,33 @@ WebInspector.OutputStreamDelegate = function()
 }
 
 WebInspector.OutputStreamDelegate.prototype = {
-    onTransferStarted: function(source)
-    {
-    },
+    onTransferStarted: function(source) { },
 
-    onChunkTransferred: function(source)
-    {
-    },
+    onChunkTransferred: function(source) { },
 
-    onTransferFinished: function(source)
-    {
-    },
+    onTransferFinished: function(source) { },
 
-    onError: function(source, event)
-    {
-    }
+    onError: function(source, event) { }
+}
+
+/**
+ * @interface
+ */
+WebInspector.OutputStream = function()
+{
+}
+
+WebInspector.OutputStream.prototype = {
+    startTransfer: function() { },
+
+    /**
+     * @param {string} chunk
+     */
+    transferChunk: function(chunk) { },
+
+    finishTransfer: function() { },
+
+    dispose: function() { }
 }
 
 /**
diff --git a/Source/WebCore/inspector/front-end/HandlerRegistry.js b/Source/WebCore/inspector/front-end/HandlerRegistry.js
index e13f56d9c..84ae7fda5 100644
--- a/Source/WebCore/inspector/front-end/HandlerRegistry.js
+++ b/Source/WebCore/inspector/front-end/HandlerRegistry.js
@@ -184,3 +184,9 @@ WebInspector.HandlerSelector.prototype =
         this._handlerRegistry.activeHandler = value;
     }
 }
+
+
+/**
+ * @type {WebInspector.HandlerRegistry}
+ */
+WebInspector.openAnchorLocationRegistry = null;
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotView.js b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
index a26a6592a..b7f5019fd 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotView.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotView.js
@@ -784,35 +784,6 @@ WebInspector.HeapSnapshotProfileType.prototype = {
 
 WebInspector.HeapSnapshotProfileType.prototype.__proto__ = WebInspector.ProfileType.prototype;
 
-
-/**
- * @interface
- */
-WebInspector.OutputStream = function()
-{
-}
-
-WebInspector.OutputStream.prototype = {
-    startTransfer: function()
-    {
-    },
-
-    /**
-     * @param {string} chunk
-     */
-    transferChunk: function(chunk)
-    {
-    },
-
-    finishTransfer: function()
-    {
-    },
-
-    dispose: function()
-    {
-    }
-};
-
 /**
  * @constructor
  * @extends {WebInspector.ProfileHeader}
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index 61d8ae87f..dc2701cd0 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -32,6 +32,7 @@ if (!window.InspectorFrontendHost) {
 
 /**
  * @constructor
+ * @implements {InspectorFrontendHostAPI}
  */
 WebInspector.InspectorFrontendHostStub = function()
 {
@@ -192,7 +193,7 @@ WebInspector.InspectorFrontendHostStub.prototype = {
     }
 }
 
-var InspectorFrontendHost = new WebInspector.InspectorFrontendHostStub();
+InspectorFrontendHost = new WebInspector.InspectorFrontendHostStub();
 Preferences.localizeUI = false;
 
 // Default implementation; platforms will override.
diff --git a/Source/WebCore/inspector/front-end/InspectorView.js b/Source/WebCore/inspector/front-end/InspectorView.js
index e5799babe..b521a9d1d 100644
--- a/Source/WebCore/inspector/front-end/InspectorView.js
+++ b/Source/WebCore/inspector/front-end/InspectorView.js
@@ -237,6 +237,15 @@ WebInspector.InspectorView.prototype = {
             this._panelsElement.style.bottom = 0;
         }
         this.doResize();
+    },
+
+    /**
+     * @param {WebInspector.Panel} panel
+     */
+    showPanelForAnchorNavigation: function(panel)
+    {
+        WebInspector.searchController.disableSearchUntilExplicitAction();
+        this.setCurrentPanel(panel);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js b/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
index 0d63f27de..a0cc97848 100644
--- a/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
+++ b/Source/WebCore/inspector/front-end/PresentationConsoleMessageHelper.js
@@ -101,7 +101,7 @@ WebInspector.PresentationConsoleMessageHelper.prototype = {
         var pendingMessages = [];
         for (var i = 0; i < messages.length; i++) {
             var message = messages[i];
-            var rawLocation = message.location();
+            var rawLocation = /** @type {WebInspector.DebuggerModel.Location} */ message.location();
             if (script.scriptId === rawLocation.scriptId)
                 this._addConsoleMessageToScript(message, rawLocation);
             else
diff --git a/Source/WebCore/inspector/front-end/RequestCookiesView.js b/Source/WebCore/inspector/front-end/RequestCookiesView.js
index dbaf9d36a..d8d5da840 100644
--- a/Source/WebCore/inspector/front-end/RequestCookiesView.js
+++ b/Source/WebCore/inspector/front-end/RequestCookiesView.js
@@ -61,7 +61,7 @@ WebInspector.RequestCookiesView.prototype = {
 
     get _gotCookies()
     {
-        return !!(this._request.requestCookies || this._request.responseCookies);
+        return (this._request.requestCookies && this._request.requestCookies.length) || (this._request.responseCookies && this._request.responseCookies.length);
     },
 
     _buildCookiesTable: function()
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 22aebced5..8ddcd2520 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -87,8 +87,11 @@ WebInspector.ResourcesPanel = function(database)
     this.storageViewStatusBarItemsContainer = document.createElement("div");
     this.storageViewStatusBarItemsContainer.className = "status-bar-items";
 
-    this._databases = [];
-    this._domStorage = [];
+    this._databaseTableViews = new Map();
+    this._databaseQueryViews = new Map();
+    this._databaseTreeElements = new Map();
+    this._domStorageViews = new Map();
+    this._domStorageTreeElements = new Map();
     this._cookieViews = {};
     this._origins = {};
     this._domains = {};
@@ -102,11 +105,19 @@ WebInspector.ResourcesPanel = function(database)
     }
     WebInspector.GoToLineDialog.install(this, viewGetter.bind(this));
 
+    if (WebInspector.resourceTreeModel.cachedResourcesLoaded())
+        this._cachedResourcesLoaded();
+
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.OnLoad, this._onLoadEventFired, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded, this._cachedResourcesLoaded, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.WillLoadCachedResources, this._resetWithFrames, this);
-    if (WebInspector.resourceTreeModel.cachedResourcesLoaded())
-        this._cachedResourcesLoaded();
+
+    WebInspector.databaseModel.databases().forEach(this._addDatabase.bind(this));
+    WebInspector.databaseModel.addEventListener(WebInspector.DatabaseModel.Events.DatabaseAdded, this._databaseAdded, this);
+
+    WebInspector.domStorageModel.storages().forEach(this._addDOMStorage.bind(this));
+    WebInspector.domStorageModel.addEventListener(WebInspector.DOMStorageModel.Events.DOMStorageAdded, this._domStorageAdded, this);
+    WebInspector.domStorageModel.addEventListener(WebInspector.DOMStorageModel.Events.DOMStorageUpdated, this._domStorageUpdated, this);
 }
 
 WebInspector.ResourcesPanel.prototype = {
@@ -167,22 +178,14 @@ WebInspector.ResourcesPanel.prototype = {
     {
         this._origins = {};
         this._domains = {};
-        for (var i = 0; i < this._databases.length; ++i) {
-            var database = this._databases[i];
-            delete database._tableViews;
-            if (database._queryView)
-                database._queryView.removeEventListener(WebInspector.DatabaseQueryView.Events.SchemaUpdated, this._updateDatabaseTables, this);
-            delete database._queryView;
-        }
-        this._databases = [];
-
-        var domStorageLength = this._domStorage.length;
-        for (var i = 0; i < this._domStorage.length; ++i) {
-            var domStorage = this._domStorage[i];
-            delete domStorage._domStorageView;
-        }
-        this._domStorage = [];
-
+        var queryViews = this._databaseQueryViews.values();
+        for (var i = 0; i < queryViews.length; ++i)
+            queryViews[i].removeEventListener(WebInspector.DatabaseQueryView.Events.SchemaUpdated, this._updateDatabaseTables, this);
+        this._databaseTableViews.clear();
+        this._databaseQueryViews.clear();
+        this._databaseTreeElements.clear();
+        this._domStorageViews.clear();
+        this._domStorageTreeElements.clear();
         this._cookieViews = {};
 
         this.databasesListTreeElement.removeChildren();
@@ -289,12 +292,22 @@ WebInspector.ResourcesPanel.prototype = {
         this._initialize();
     },
 
-    addDatabase: function(database)
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _databaseAdded: function(event)
     {
-        this._databases.push(database);
+        var database = /** @type {WebInspector.Database} */ event.data;
+        this._addDatabase(database);
+    },
 
+    /**
+     * @param {WebInspector.Database} database
+     */
+    _addDatabase: function(database)
+    {
         var databaseTreeElement = new WebInspector.DatabaseTreeElement(this, database);
-        database._databasesTreeElement = databaseTreeElement;
+        this._databaseTreeElements.put(database, databaseTreeElement);
         this.databasesListTreeElement.appendChild(databaseTreeElement);
     },
 
@@ -313,36 +326,47 @@ WebInspector.ResourcesPanel.prototype = {
         }
     },
 
-    addDOMStorage: function(domStorage)
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _domStorageAdded: function(event)
+    {
+        var domStorage = /** @type {WebInspector.DOMStorage}*/ event.data;
+        this._addDOMStorage(domStorage);
+    },
+
+    /**
+     * @param {WebInspector.DOMStorage} domStorage
+     */
+    _addDOMStorage: function(domStorage)
     {
-        this._domStorage.push(domStorage);
         var domStorageTreeElement = new WebInspector.DOMStorageTreeElement(this, domStorage, (domStorage.isLocalStorage ? "local-storage" : "session-storage"));
-        domStorage._domStorageTreeElement = domStorageTreeElement;
+        this._domStorageTreeElements.put(domStorage, domStorageTreeElement);
         if (domStorage.isLocalStorage)
             this.localStorageListTreeElement.appendChild(domStorageTreeElement);
         else
             this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
-    selectDatabase: function(databaseId)
+    /**
+     * @param {WebInspector.Database} database
+     */
+    selectDatabase: function(database)
     {
-        var database;
-        for (var i = 0, len = this._databases.length; i < len; ++i) {
-            database = this._databases[i];
-            if (database.id === databaseId) {
-                this.showDatabase(database);
-                database._databasesTreeElement.select();
-                return;
-            }
+        if (database) {
+            this._showDatabase(database);
+            this._databaseTreeElements.get(database).select();
         }
     },
 
-    selectDOMStorage: function(storageId)
+    /**
+     * @param {WebInspector.DOMStorage} domStorage
+     */
+    selectDOMStorage: function(domStorage)
     {
-        var domStorage = this._domStorageForId(storageId);
         if (domStorage) {
-            this.showDOMStorage(domStorage);
-            domStorage._domStorageTreeElement.select();
+            this._showDOMStorage(domStorage);
+            this._domStorageTreeElements.get(domStorage).select();
         }
     },
 
@@ -400,25 +424,28 @@ WebInspector.ResourcesPanel.prototype = {
     /**
      * @param {string=} tableName
      */
-    showDatabase: function(database, tableName)
+    _showDatabase: function(database, tableName)
     {
         if (!database)
             return;
 
         var view;
         if (tableName) {
-            if (!("_tableViews" in database))
-                database._tableViews = {};
-            view = database._tableViews[tableName];
+            var tableViews = this._databaseTableViews.get(database);
+            if (!tableViews) {
+                tableViews = {};
+                this._databaseTableViews.put(database, tableViews);
+            }
+            view = tableViews[tableName];
             if (!view) {
                 view = new WebInspector.DatabaseTableView(database, tableName);
-                database._tableViews[tableName] = view;
+                tableViews[tableName] = view;
             }
         } else {
-            view = database._queryView;
+            view = this._databaseQueryViews.get(database);
             if (!view) {
                 view = new WebInspector.DatabaseQueryView(database);
-                database._queryView = view;
+                this._databaseQueryViews.put(database, view);
                 view.addEventListener(WebInspector.DatabaseQueryView.Events.SchemaUpdated, this._updateDatabaseTables, this);
             }
         }
@@ -434,16 +461,16 @@ WebInspector.ResourcesPanel.prototype = {
         this._innerShowView(view);
     },
 
-    showDOMStorage: function(domStorage)
+    _showDOMStorage: function(domStorage)
     {
         if (!domStorage)
             return;
 
         var view;
-        view = domStorage._domStorageView;
+        view = this._domStorageViews.get(domStorage);
         if (!view) {
             view = new WebInspector.DOMStorageItemsView(domStorage);
-            domStorage._domStorageView = view;
+            this._domStorageViews.put(domStorage, view);
         }
 
         this._innerShowView(view);
@@ -513,12 +540,17 @@ WebInspector.ResourcesPanel.prototype = {
     {
         var database = event.data;
 
-        if (!database || !database._databasesTreeElement)
+        if (!database)
+            return;
+
+        var databasesTreeElement = this._databaseTreeElements.get(database);
+        if (!databasesTreeElement)
             return;
 
-        database._databasesTreeElement.shouldRefreshChildren = true;
+        databasesTreeElement.shouldRefreshChildren = true;
+        var tableViews = this._databaseTableViews.get(database);
 
-        if (!("_tableViews" in database))
+        if (!tableViews)
             return;
 
         var tableNamesHash = {};
@@ -529,26 +561,26 @@ WebInspector.ResourcesPanel.prototype = {
             for (var i = 0; i < tableNamesLength; ++i)
                 tableNamesHash[tableNames[i]] = true;
 
-            for (var tableName in database._tableViews) {
+            for (var tableName in tableViews) {
                 if (!(tableName in tableNamesHash)) {
-                    if (self.visibleView === database._tableViews[tableName])
+                    if (self.visibleView === tableViews[tableName])
                         self.closeVisibleView();
-                    delete database._tableViews[tableName];
+                    delete tableViews[tableName];
                 }
             }
         }
         database.getTableNames(tableNamesCallback);
     },
 
-    domStorageUpdated: function(storageId)
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _domStorageUpdated: function(event)
     {
-        var domStorage = this._domStorageForId(storageId);
-        if (!domStorage)
-            return;
-
-        var view = domStorage._domStorageView;
+        var storage = /** @type {WebInspector.DOMStorage}*/ event.data;
+        var view = this._domStorageViews.get(storage);
         if (this.visibleView && view === this.visibleView)
-            domStorage._domStorageView.update();
+            view.update();
     },
 
     _populateApplicationCacheTree: function()
@@ -622,19 +654,6 @@ WebInspector.ResourcesPanel.prototype = {
             this._applicationCacheViews[manifestURL].updateNetworkState(isNowOnline);
     },
 
-    _domStorageForId: function(storageId)
-    {
-        if (!this._domStorage)
-            return null;
-        var domStorageLength = this._domStorage.length;
-        for (var i = 0; i < domStorageLength; ++i) {
-            var domStorage = this._domStorage[i];
-            if (domStorage.id == storageId)
-                return domStorage;
-        }
-        return null;
-    },
-
     sidebarResized: function(event)
     {
         var width = event.data;
@@ -1322,7 +1341,7 @@ WebInspector.DatabaseTreeElement.prototype = {
     onselect: function()
     {
         WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
-        this._storagePanel.showDatabase(this._database);
+        this._storagePanel._showDatabase(this._database);
     },
 
     onexpand: function()
@@ -1366,7 +1385,7 @@ WebInspector.DatabaseTableTreeElement.prototype = {
     onselect: function()
     {
         WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
-        this._storagePanel.showDatabase(this._database, this._tableName);
+        this._storagePanel._showDatabase(this._database, this._tableName);
     }
 }
 WebInspector.DatabaseTableTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
@@ -1852,7 +1871,7 @@ WebInspector.DOMStorageTreeElement.prototype = {
     onselect: function()
     {
         WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
-        this._storagePanel.showDOMStorage(this._domStorage);
+        this._storagePanel._showDOMStorage(this._domStorage);
     }
 }
 WebInspector.DOMStorageTreeElement.prototype.__proto__ = WebInspector.BaseStorageTreeElement.prototype;
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index 1f688d6d8..08bd66af2 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -28,6 +28,8 @@ importScript("BreakpointsSidebarPane.js");
 importScript("CallStackSidebarPane.js");
 importScript("FilteredItemSelectionDialog.js");
 importScript("JavaScriptSourceFrame.js");
+importScript("NavigatorOverlayController.js");
+importScript("NavigatorView.js");
 importScript("RevisionHistoryView.js");
 importScript("ScopeChainSidebarPane.js");
 importScript("ScriptsNavigator.js");
@@ -390,7 +392,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     showFunctionDefinition: function(functionLocation)
     {
-        WebInspector.showPanelForAnchorNavigation(this);
+        WebInspector.inspectorView.showPanelForAnchorNavigation(this);
         var uiLocation = WebInspector.debuggerModel.rawLocationToUILocation(functionLocation);
         this._showSourceLine(uiLocation.uiSourceCode, uiLocation.lineNumber);
     },
diff --git a/Source/WebCore/inspector/front-end/SearchController.js b/Source/WebCore/inspector/front-end/SearchController.js
index 372034d96..8d2e726d3 100644
--- a/Source/WebCore/inspector/front-end/SearchController.js
+++ b/Source/WebCore/inspector/front-end/SearchController.js
@@ -169,7 +169,7 @@ WebInspector.SearchController.prototype = {
         this._matchesElement.textContent = "";
     },
 
-    disableSearchUntilExplicitAction: function(event)
+    disableSearchUntilExplicitAction: function()
     {
         this._performSearch("", false, false);
     },
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index cebc91d32..ee13ebc27 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -102,6 +102,7 @@ WebInspector.Settings = function()
     this.deviceOrientationOverride = this.createSetting("deviceOrientationOverride", "");
     this.showHeapSnapshotObjectsHiddenProperties = this.createSetting("showHeaSnapshotObjectsHiddenProperties", false);
     this.searchInContentScripts = this.createSetting("searchInContentScripts", false);
+    this.textEditorIndent = this.createSetting("textEditorIndent", "    ");
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
index 0c8ce544c..0cd4803e8 100644
--- a/Source/WebCore/inspector/front-end/Spectrum.js
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -261,6 +261,9 @@ WebInspector.Spectrum.draggable = function(element, onmove, onstart, onstop) {
 };
 
 WebInspector.Spectrum.prototype = {
+    /**
+     * @type {WebInspector.Color}
+     */
     set color(color)
     {
         var rgba = (color.rgba || color.rgb).slice(0);
diff --git a/Source/WebCore/inspector/front-end/TextEditorModel.js b/Source/WebCore/inspector/front-end/TextEditorModel.js
index 4ab3c995b..068cf997b 100644
--- a/Source/WebCore/inspector/front-end/TextEditorModel.js
+++ b/Source/WebCore/inspector/front-end/TextEditorModel.js
@@ -532,5 +532,3 @@ WebInspector.TextEditorModel.prototype = {
 }
 
 WebInspector.TextEditorModel.prototype.__proto__ = WebInspector.Object.prototype;
-
-WebInspector.settings.textEditorIndent = WebInspector.settings.createSetting("textEditorIndent", WebInspector.TextEditorModel.Indent.FourSpaces);
diff --git a/Source/Platform/chromium/public/WebScrollableLayer.h b/Source/WebCore/inspector/front-end/UIString.js
index ea02f8c73..ec6a18857 100644
--- a/Source/Platform/chromium/public/WebScrollableLayer.h
+++ b/Source/WebCore/inspector/front-end/UIString.js
@@ -1,5 +1,8 @@
 /*
- * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007 Matt Lilek (pewtermoose@gmail.com).
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,6 +13,9 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -22,43 +28,26 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-
-#ifndef WebScrollableLayer_h
-#define WebScrollableLayer_h
-
-#include "WebCommon.h"
-#include "WebLayer.h"
-#include "WebPoint.h"
-#include "WebRect.h"
-#include "WebVector.h"
-
-namespace WebKit {
-
-class WebScrollableLayer : public WebLayer {
-public:
-    WebScrollableLayer() { }
-    WebScrollableLayer(const WebScrollableLayer& layer) : WebLayer(layer) { }
-    virtual ~WebScrollableLayer() { }
-    WebScrollableLayer& operator=(const WebScrollableLayer& layer)
-    {
-        WebLayer::assign(layer);
-        return *this;
+ /**
+ * @param {string} string
+ * @param {...*} vararg
+ */
+WebInspector.UIString = function(string, vararg)
+{
+    if (Preferences.localizeUI) {
+        if (window.localizedStrings && string in window.localizedStrings)
+            string = window.localizedStrings[string];
+        else {
+            if (!(string in WebInspector._missingLocalizedStrings)) {
+                console.warn("Localized string \"" + string + "\" not found.");
+                WebInspector._missingLocalizedStrings[string] = true;
+            }
+    
+            if (Preferences.showMissingLocalizedStrings)
+                string += " (not localized)";
+        }
     }
+    return String.vsprintf(string, Array.prototype.slice.call(arguments, 1));
+}
 
-    WEBKIT_EXPORT void setScrollPosition(WebPoint);
-    WEBKIT_EXPORT void setScrollable(bool);
-    WEBKIT_EXPORT void setHaveWheelEventHandlers(bool);
-    WEBKIT_EXPORT void setShouldScrollOnMainThread(bool);
-    WEBKIT_EXPORT void setNonFastScrollableRegion(const WebVector<WebRect>&);
-    WEBKIT_EXPORT void setIsContainerForFixedPositionLayers(bool);
-    WEBKIT_EXPORT void setFixedToContainerLayer(bool);
-
-
-#if WEBKIT_IMPLEMENTATION
-    WebScrollableLayer(const WTF::PassRefPtr<WebCore::LayerChromium>& layer) : WebLayer(layer) { }
-#endif
-};
-
-} // namespace WebKit
-
-#endif // WebScrollableLayer_h
+WebInspector._missingLocalizedStrings = {};
diff --git a/Source/WebCore/inspector/front-end/UIUtils.js b/Source/WebCore/inspector/front-end/UIUtils.js
index 9af5070e1..c1e07584e 100644
--- a/Source/WebCore/inspector/front-end/UIUtils.js
+++ b/Source/WebCore/inspector/front-end/UIUtils.js
@@ -680,30 +680,6 @@ Number.withThousandsSeparator = function(num)
     return str;
 }
 
-WebInspector._missingLocalizedStrings = {};
-
-/**
- * @param {string} string
- * @param {...*} vararg
- */
-WebInspector.UIString = function(string, vararg)
-{
-    if (Preferences.localizeUI) {
-        if (window.localizedStrings && string in window.localizedStrings)
-            string = window.localizedStrings[string];
-        else {
-            if (!(string in WebInspector._missingLocalizedStrings)) {
-                console.warn("Localized string \"" + string + "\" not found.");
-                WebInspector._missingLocalizedStrings[string] = true;
-            }
-    
-            if (Preferences.showMissingLocalizedStrings)
-                string += " (not localized)";
-        }
-    }
-    return String.vsprintf(string, Array.prototype.slice.call(arguments, 1));
-}
-
 WebInspector.useLowerCaseMenuTitles = function()
 {
     return WebInspector.platform() === "windows" && Preferences.useLowerCaseMenuTitlesOnWindows;
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index bd9b15512..c9c8497a5 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -196,6 +196,7 @@
     <file>treeoutline.js</file>
     <file>UISourceCode.js</file>
     <file>UISourceCodeFrame.js</file>
+    <file>UIString.js</file>
     <file>UIUtils.js</file>
     <file>UserAgentSupport.js</file>
     <file>UserMetrics.js</file>
diff --git a/Source/WebCore/inspector/front-end/externs.js b/Source/WebCore/inspector/front-end/externs.js
index 92b877ed1..8cf53d26c 100644
--- a/Source/WebCore/inspector/front-end/externs.js
+++ b/Source/WebCore/inspector/front-end/externs.js
@@ -116,20 +116,70 @@ DOMApplicationCache.prototype.OBSOLETE = 5;
 var InspectorBackend = {}
 InspectorBackend.runAfterPendingDispatches = function(message) {}
 
+/** @interface */
+function InspectorFrontendHostAPI() {}
+InspectorFrontendHostAPI.prototype.platform = function() {}
+InspectorFrontendHostAPI.prototype.port = function() {}
+InspectorFrontendHostAPI.prototype.bringToFront = function() {}
+InspectorFrontendHostAPI.prototype.closeWindow = function() {}
+InspectorFrontendHostAPI.prototype.requestAttachWindow = function() {}
+InspectorFrontendHostAPI.prototype.requestDetachWindow = function() {}
+InspectorFrontendHostAPI.prototype.requestSetDockSide = function() {}
+InspectorFrontendHostAPI.prototype.setAttachedWindowHeight = function(height) {}
+InspectorFrontendHostAPI.prototype.moveWindowBy = function(x, y) {}
+InspectorFrontendHostAPI.prototype.setInjectedScriptForOrigin = function(origin, script) {}
+InspectorFrontendHostAPI.prototype.loaded = function() {}
+InspectorFrontendHostAPI.prototype.localizedStringsURL = function() {}
+InspectorFrontendHostAPI.prototype.hiddenPanels = function() {}
+InspectorFrontendHostAPI.prototype.inspectedURLChanged = function(url) {}
+InspectorFrontendHostAPI.prototype.documentCopy = function(event) {}
+InspectorFrontendHostAPI.prototype.copyText = function(text) {}
+InspectorFrontendHostAPI.prototype.openInNewTab = function(url) {}
+InspectorFrontendHostAPI.prototype.canSave = function() {}
+InspectorFrontendHostAPI.prototype.save = function(url, content, forceSaveAs) {}
+InspectorFrontendHostAPI.prototype.canAppend = function() {}
+InspectorFrontendHostAPI.prototype.append = function(url, content) {}
+InspectorFrontendHostAPI.prototype.sendMessageToBackend = function(message) {}
+InspectorFrontendHostAPI.prototype.recordActionTaken = function(actionCode) {}
+InspectorFrontendHostAPI.prototype.recordPanelShown = function(panelCode) {}
+InspectorFrontendHostAPI.prototype.recordSettingChanged = function(settingCode) {}
+InspectorFrontendHostAPI.prototype.loadResourceSynchronously = function(url) {}
+InspectorFrontendHostAPI.prototype.setZoomFactor = function(zoom) {}
+InspectorFrontendHostAPI.prototype.canInspectWorkers = function() {}
+/** @type {InspectorFrontendHostAPI} */
+var InspectorFrontendHost;
+
+/** @constructor */
+function SourceMapV3()
+{
+    /** @type {number} */ this.version;
+    /** @type {string} */ this.file;
+    /** @type {Array.<string>} */ this.sources;
+    /** @type {Array.<SourceMapV3.Section>} */ this.sections;
+    /** @type {string} */ this.mappings
+}
+
+/** @constructor */
+SourceMapV3.Section = function()
+{
+    /** @type {SourceMapV3} */ this.map;
+    /** @type {SourceMapV3.Offset} */ this.offset;
+}
+
+/** @constructor */
+SourceMapV3.Offset = function()
+{
+    /** @type {number} */ this.line;
+    /** @type {number} */ this.column;
+}
 
 // FIXME: remove everything below.
 var WebInspector = {}
-  
-WebInspector.panels = {};
 
-/**
- * @type {WebInspector.InspectorView}
- */
-WebInspector.inspectorView;
+WebInspector.panels = {};
 
 /**
  * @param {Element} element
- * @param {WebInspector.View} view
  * @param {function()=} onclose
  */
 WebInspector.showViewInDrawer = function(element, view, onclose) {}
@@ -203,18 +253,6 @@ function ExtensionReloadOptions() {
     this.userAgent = "";
 }
 
-/**
- * @type {WebInspector.HandlerRegistry}
- */
-WebInspector.openAnchorLocationRegistry = null;
-
-/**
- * @param {WebInspector.Panel} panel
- */
-WebInspector.showPanelForAnchorNavigation = function(panel)
-{
-}
-
 WebInspector.showPanel = function(panel)
 {
 }
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index 7785f7d1f..5fdd2b477 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -39,6 +39,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMExtension.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
+    <script type="text/javascript" src="UIString.js"></script>
     <script type="text/javascript" src="UIUtils.js"></script>
     <script type="text/javascript" src="InspectorBackend.js"></script>
     <script type="text/javascript" src="InspectorBackendCommands.js"></script>
@@ -71,8 +72,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="NetworkRequest.js"></script>
     <script type="text/javascript" src="CSSStyleModel.js"></script>
     <script type="text/javascript" src="NetworkManager.js"></script>
-    <script type="text/javascript" src="NavigatorOverlayController.js"></script>
-    <script type="text/javascript" src="NavigatorView.js"></script>
     <script type="text/javascript" src="NetworkLog.js"></script>
     <script type="text/javascript" src="ResourceTreeModel.js"></script>
     <script type="text/javascript" src="ResourceUtils.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 5160cec8a..e055d112e 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -501,8 +501,6 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     this.cssModel = new WebInspector.CSSStyleModel();
     this.timelineManager = new WebInspector.TimelineManager();
     this.userAgentSupport = new WebInspector.UserAgentSupport();
-    InspectorBackend.registerDatabaseDispatcher(new WebInspector.DatabaseDispatcher());
-    InspectorBackend.registerDOMStorageDispatcher(new WebInspector.DOMStorageDispatcher());
 
     this.searchController = new WebInspector.SearchController();
     this.advancedSearchController = new WebInspector.AdvancedSearchController();
@@ -553,8 +551,8 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     }
 
     InspectorAgent.enable(showInitialPanel);
-    DatabaseAgent.enable();
-    DOMStorageAgent.enable();
+    this.databaseModel = new WebInspector.DatabaseModel();
+    this.domStorageModel = new WebInspector.DOMStorageModel();
 
     if (!Capabilities.profilerCausesRecompilation || WebInspector.settings.profilerEnabled.get())
         ProfilerAgent.enable();
@@ -1017,9 +1015,9 @@ WebInspector.inspect = function(payload, hints)
     }
 
     if (hints.databaseId)
-        WebInspector.showPanel("resources").selectDatabase(hints.databaseId);
+        WebInspector.showPanel("resources").selectDatabase(WebInspector.databaseModel.databaseForId(hints.databaseId));
     else if (hints.domStorageId)
-        WebInspector.showPanel("resources").selectDOMStorage(hints.domStorageId);
+        WebInspector.showPanel("resources").selectDOMStorage(WebInspector.domStorageModel.storageForId(hints.domStorageId));
 
     object.release();
 }
@@ -1060,17 +1058,11 @@ WebInspector._showAnchorLocationInPanel = function(anchor, panel)
         anchor.addStyleClass("webkit-html-resource-link");
     }
 
-    this.showPanelForAnchorNavigation(panel);
+    WebInspector.inspectorView.showPanelForAnchorNavigation(panel);
     panel.showAnchorLocation(anchor);
     return true;
 }
 
-WebInspector.showPanelForAnchorNavigation = function(panel)
-{
-    WebInspector.searchController.disableSearchUntilExplicitAction();
-    WebInspector.inspectorView.setCurrentPanel(panel);
-}
-
 WebInspector.showProfileForURL = function(url)
 {
     WebInspector.showPanel("profiles").showProfileForURL(url);
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 3a8a8dd8a..d9019fc30 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -68,6 +68,7 @@
 #include "UserTypingGestureIndicator.h"
 #include "WindowFeatures.h"
 #include "markup.h"
+#include <wtf/unicode/CharacterNames.h>
 #include <wtf/unicode/Unicode.h>
 
 #if PLATFORM(GTK)
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 4482fe245..4c495fd5a 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -136,6 +136,33 @@ static RenderLayer::UpdateLayerPositionsFlags updateLayerPositionFlags(RenderLay
     return flags;
 }
 
+Pagination::Mode paginationModeForRenderStyle(RenderStyle* style)
+{
+    EOverflow overflow = style->overflowY();
+    if (overflow != OPAGEDX && overflow != OPAGEDY)
+        return Pagination::Unpaginated;
+
+    bool isHorizontalWritingMode = style->isHorizontalWritingMode();
+    TextDirection textDirection = style->direction();
+    WritingMode writingMode = style->writingMode();
+
+    // paged-x always corresponds to LeftToRightPaginated or RightToLeftPaginated. If the WritingMode
+    // is horizontal, then we use TextDirection to choose between those options. If the WritingMode
+    // is vertical, then the direction of the verticality dictates the choice.
+    if (overflow == OPAGEDX) {
+        if ((isHorizontalWritingMode && textDirection == LTR) || writingMode == LeftToRightWritingMode)
+            return Pagination::LeftToRightPaginated;
+        return Pagination::RightToLeftPaginated;
+    }
+
+    // paged-y always corresponds to TopToBottomPaginated or BottomToTopPaginated. If the WritingMode
+    // is horizontal, then the direction of the horizontality dictates the choice. If the WritingMode
+    // is vertical, then we use TextDirection to choose between those options. 
+    if (writingMode == TopToBottomWritingMode || (!isHorizontalWritingMode && textDirection == RTL))
+        return Pagination::TopToBottomPaginated;
+    return Pagination::BottomToTopPaginated;
+}
+
 FrameView::FrameView(Frame* frame)
     : m_frame(frame)
     , m_canHaveScrollbars(true)
@@ -582,6 +609,8 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
             // Don't set it at all.
             ;
     }
+
+    Pagination pagination;
     
      switch (overflowY) {
         case OHIDDEN:
@@ -596,11 +625,19 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
         case OAUTO:
             vMode = ScrollbarAuto;
             break;
+        case OPAGEDX:
+            pagination.mode = WebCore::paginationModeForRenderStyle(o->style());
+            break;
+        case OPAGEDY:
+            pagination.mode = WebCore::paginationModeForRenderStyle(o->style());
+            break;
         default:
             // Don't set it at all.
             ;
     }
 
+    setPagination(pagination);
+
     m_viewportRenderer = o;
 }
 
@@ -2555,6 +2592,30 @@ void FrameView::updateOverflowStatus(bool horizontalOverflow, bool verticalOverf
     
 }
 
+const Pagination& FrameView::pagination() const
+{
+    if (m_pagination != Pagination())
+        return m_pagination;
+
+    if (Page* page = m_frame->page()) {
+        if (page->mainFrame() == m_frame)
+            return page->pagination();
+    }
+
+    return m_pagination;
+}
+
+void FrameView::setPagination(const Pagination& pagination)
+{
+    if (m_pagination == pagination)
+        return;
+
+    m_pagination = pagination;
+
+    if (m_frame)
+        m_frame->document()->styleResolverChanged(DeferRecalcStyle);
+}
+
 IntRect FrameView::windowClipRect(bool clipToContents) const
 {
     ASSERT(m_frame->view() == this);
@@ -3051,8 +3112,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         p->fillRect(rect, Color(0xFF, 0, 0), ColorSpaceDeviceRGB);
 #endif
 
-    Page* page = m_frame->page();
-    if (page->mainFrame() == m_frame && page->pagination().mode != Page::Pagination::Unpaginated)
+    if (pagination().mode != Pagination::Unpaginated)
         p->fillRect(rect, baseBackgroundColor(), ColorSpaceDeviceRGB);
 
     bool isTopLevelPainter = !sCurrentPaintTimeStamp;
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 87c108b48..6ab968e85 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -29,6 +29,7 @@
 #include "Color.h"
 #include "Frame.h"
 #include "LayoutTypes.h"
+#include "Pagination.h"
 #include "PaintPhase.h"
 #include "ScrollView.h"
 #include <wtf/Forward.h>
@@ -52,6 +53,8 @@ class RenderLayer;
 class RenderObject;
 class RenderScrollbarPart;
 
+Pagination::Mode paginationModeForRenderStyle(RenderStyle*);
+
 typedef unsigned long long DOMTimeStamp;
 
 class FrameView : public ScrollView {
@@ -347,6 +350,15 @@ public:
 
     void setScrollingPerformanceLoggingEnabled(bool);
 
+    // Page and FrameView both store a Pagination value. Page::pagination() is set only by API,
+    // and FrameView::pagination() is set only by CSS. Page::pagination() will affect all
+    // FrameViews in the page cache, but FrameView::pagination() only affects the current
+    // FrameView. FrameView::pagination() will return m_pagination if it has been set. Otherwise,
+    // it will return Page::pagination() since currently there are no callers that need to
+    // distinguish between the two.
+    const Pagination& pagination() const;
+    void setPagination(const Pagination&);
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
@@ -484,6 +496,8 @@ private:
     bool m_verticalOverflow;    
     RenderObject* m_viewportRenderer;
 
+    Pagination m_pagination;
+
     bool m_wasScrolledByUser;
     bool m_inProgrammaticScroll;
     bool m_safeToPropagateScrollToParent;
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index f8b026f73..2ba722acc 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -25,6 +25,7 @@
 #include "FindOptions.h"
 #include "LayoutTypes.h"
 #include "PageVisibilityState.h"
+#include "Pagination.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
 #include "Region.h"
@@ -246,28 +247,10 @@ namespace WebCore {
         float deviceScaleFactor() const { return m_deviceScaleFactor; }
         void setDeviceScaleFactor(float);
 
-        struct Pagination {
-            enum Mode { Unpaginated, LeftToRightPaginated, RightToLeftPaginated, TopToBottomPaginated, BottomToTopPaginated };
-
-            Pagination()
-                : mode(Unpaginated)
-                , behavesLikeColumns(false)
-                , pageLength(0)
-                , gap(0)
-            {
-            };
-
-            bool operator==(const Pagination& other) const
-            {
-                return mode == other.mode && behavesLikeColumns == other.behavesLikeColumns && pageLength == other.pageLength && gap == other.gap;
-            }
-
-            Mode mode;
-            bool behavesLikeColumns;
-            unsigned pageLength;
-            unsigned gap;
-        };
-
+        // Page and FrameView both store a Pagination value. Page::pagination() is set only by API,
+        // and FrameView::pagination() is set only by CSS. Page::pagination() will affect all
+        // FrameViews in the page cache, but FrameView::pagination() only affects the current
+        // FrameView. 
         const Pagination& pagination() const { return m_pagination; }
         void setPagination(const Pagination&);
 
diff --git a/Source/WebCore/page/PrintContext.cpp b/Source/WebCore/page/PrintContext.cpp
index a2ea78c76..a1d138f3e 100644
--- a/Source/WebCore/page/PrintContext.cpp
+++ b/Source/WebCore/page/PrintContext.cpp
@@ -25,6 +25,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index bb79e55e8..f5cd1c52e 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -215,7 +215,7 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createUnique()
     return origin.release();
 }
 
-PassRefPtr<SecurityOrigin> SecurityOrigin::isolatedCopy()
+PassRefPtr<SecurityOrigin> SecurityOrigin::isolatedCopy() const
 {
     return adoptRef(new SecurityOrigin(this));
 }
@@ -400,7 +400,7 @@ bool SecurityOrigin::canAccessStorage(const SecurityOrigin* topOrigin) const
     if (!topOrigin)
         return true;
 
-    if (m_blockThirdPartyStorage && topOrigin->isThirdParty(this))
+    if ((m_blockThirdPartyStorage || topOrigin->m_blockThirdPartyStorage) && topOrigin->isThirdParty(this))
         return false;
 
     return true;
diff --git a/Source/WebCore/page/SecurityOrigin.h b/Source/WebCore/page/SecurityOrigin.h
index fb8e036db..2e32cfb69 100644
--- a/Source/WebCore/page/SecurityOrigin.h
+++ b/Source/WebCore/page/SecurityOrigin.h
@@ -54,7 +54,7 @@ public:
 
     // Create a deep copy of this SecurityOrigin. This method is useful
     // when marshalling a SecurityOrigin to another thread.
-    PassRefPtr<SecurityOrigin> isolatedCopy();
+    PassRefPtr<SecurityOrigin> isolatedCopy() const;
 
     // Set the domain property of this security origin to newDomain. This
     // function does not check whether newDomain is a suffix of the current
diff --git a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
index 1db759404..e256bde1a 100644
--- a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
+++ b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
@@ -29,12 +29,12 @@
 
 #include "Frame.h"
 #include "FrameView.h"
+#include "Page.h"
 #include "Region.h"
 #include "RenderLayerCompositor.h"
 #include "RenderView.h"
 #include "ScrollbarThemeComposite.h"
 #include "WebScrollbarThemeGeometryNative.h"
-#include <public/WebScrollableLayer.h>
 #include <public/WebScrollbar.h>
 #include <public/WebScrollbarLayer.h>
 #include <public/WebScrollbarThemeGeometry.h>
@@ -42,7 +42,6 @@
 
 using WebKit::WebLayer;
 using WebKit::WebRect;
-using WebKit::WebScrollableLayer;
 using WebKit::WebScrollbarLayer;
 using WebKit::WebVector;
 
@@ -51,36 +50,39 @@ namespace WebCore {
 class ScrollingCoordinatorPrivate {
 WTF_MAKE_NONCOPYABLE(ScrollingCoordinatorPrivate);
 public:
-    ScrollingCoordinatorPrivate() { }
+    ScrollingCoordinatorPrivate()
+        : m_scrollLayer(0)
+    {
+    }
+
     ~ScrollingCoordinatorPrivate() { }
 
-    void setScrollLayer(WebScrollableLayer layer)
+    void setScrollLayer(WebLayer* layer)
     {
         m_scrollLayer = layer;
 
-        if (!m_horizontalScrollbarLayer.isNull())
-            m_horizontalScrollbarLayer.setScrollLayer(layer);
-        if (!m_verticalScrollbarLayer.isNull())
-            m_verticalScrollbarLayer.setScrollLayer(layer);
+        if (m_horizontalScrollbarLayer)
+            m_horizontalScrollbarLayer->setScrollLayer(layer);
+        if (m_verticalScrollbarLayer)
+            m_verticalScrollbarLayer->setScrollLayer(layer);
     }
 
-    void setHorizontalScrollbarLayer(WebScrollbarLayer layer)
+    void setHorizontalScrollbarLayer(PassOwnPtr<WebScrollbarLayer> layer)
     {
         m_horizontalScrollbarLayer = layer;
     }
 
-    void setVerticalScrollbarLayer(WebScrollbarLayer layer)
+    void setVerticalScrollbarLayer(PassOwnPtr<WebScrollbarLayer> layer)
     {
         m_verticalScrollbarLayer = layer;
     }
 
-    bool hasScrollLayer() const { return !m_scrollLayer.isNull(); }
-    WebScrollableLayer scrollLayer() const { return m_scrollLayer; }
+    WebLayer* scrollLayer() const { return m_scrollLayer; }
 
 private:
-    WebScrollableLayer m_scrollLayer;
-    WebScrollbarLayer m_horizontalScrollbarLayer;
-    WebScrollbarLayer m_verticalScrollbarLayer;
+    WebLayer* m_scrollLayer;
+    OwnPtr<WebScrollbarLayer> m_horizontalScrollbarLayer;
+    OwnPtr<WebScrollbarLayer> m_verticalScrollbarLayer;
 };
 
 PassRefPtr<ScrollingCoordinator> ScrollingCoordinator::create(Page* page)
@@ -112,15 +114,20 @@ static GraphicsLayer* scrollLayerForFrameView(FrameView* frameView)
 #endif
 }
 
-static WebScrollbarLayer createScrollbarLayer(Scrollbar* scrollbar, WebScrollableLayer scrollLayer, GraphicsLayer* scrollbarGraphicsLayer, FrameView* frameView)
+static WebLayer* scrollableLayerForGraphicsLayer(GraphicsLayer* layer)
+{
+    return layer->platformLayer();
+}
+
+static PassOwnPtr<WebScrollbarLayer> createScrollbarLayer(Scrollbar* scrollbar, WebLayer* scrollLayer, GraphicsLayer* scrollbarGraphicsLayer, FrameView* frameView)
 {
     ASSERT(scrollbar);
     ASSERT(scrollbarGraphicsLayer);
 
-    if (scrollLayer.isNull()) {
+    if (!scrollLayer) {
         // FIXME: sometimes we get called before setScrollLayer, workaround by finding the scroll layout ourselves.
-        scrollLayer = scrollLayerForFrameView(frameView)->platformLayer()->to<WebScrollableLayer>();
-        ASSERT(!scrollLayer.isNull());
+        scrollLayer = scrollableLayerForGraphicsLayer(scrollLayerForFrameView(frameView));
+        ASSERT(scrollLayer);
     }
 
     // Root layer non-overlay scrollbars should be marked opaque to disable
@@ -138,7 +145,7 @@ static WebScrollbarLayer createScrollbarLayer(Scrollbar* scrollbar, WebScrollabl
     if (!platformSupported || scrollbar->isCustomScrollbar()) {
         scrollbarGraphicsLayer->setContentsToMedia(0);
         scrollbarGraphicsLayer->setDrawsContent(true);
-        return WebScrollbarLayer();
+        return nullptr;
     }
 
     // All Chromium scrollbar themes derive from ScrollbarThemeComposite.
@@ -146,14 +153,14 @@ static WebScrollbarLayer createScrollbarLayer(Scrollbar* scrollbar, WebScrollabl
     WebKit::WebScrollbarThemePainter painter(themeComposite, scrollbar);
     OwnPtr<WebKit::WebScrollbarThemeGeometry> geometry(WebKit::WebScrollbarThemeGeometryNative::create(themeComposite));
 
-    WebScrollbarLayer scrollbarLayer = WebScrollbarLayer::create(scrollbar, painter, geometry.release());
-    scrollbarLayer.setScrollLayer(scrollLayer);
+    OwnPtr<WebScrollbarLayer> scrollbarLayer = adoptPtr(WebScrollbarLayer::create(scrollbar, painter, geometry.release()));
+    scrollbarLayer->setScrollLayer(scrollLayer);
 
-    scrollbarGraphicsLayer->setContentsToMedia(&scrollbarLayer);
+    scrollbarGraphicsLayer->setContentsToMedia(scrollbarLayer->layer());
     scrollbarGraphicsLayer->setDrawsContent(false);
-    scrollbarLayer.setOpaque(scrollbarGraphicsLayer->contentsOpaque());
+    scrollbarLayer->layer()->setOpaque(scrollbarGraphicsLayer->contentsOpaque());
 
-    return scrollbarLayer;
+    return scrollbarLayer.release();
 }
 
 void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer* horizontalScrollbarLayer)
@@ -161,6 +168,7 @@ void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView*
     if (!horizontalScrollbarLayer || !coordinatesScrollingForFrameView(frameView))
         return;
 
+    setScrollLayer(scrollLayerForFrameView(m_page->mainFrame()->view()));
     m_private->setHorizontalScrollbarLayer(createScrollbarLayer(frameView->horizontalScrollbar(), m_private->scrollLayer(), horizontalScrollbarLayer, frameView));
 }
 
@@ -169,25 +177,25 @@ void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView* f
     if (!verticalScrollbarLayer || !coordinatesScrollingForFrameView(frameView))
         return;
 
+    setScrollLayer(scrollLayerForFrameView(m_page->mainFrame()->view()));
     m_private->setVerticalScrollbarLayer(createScrollbarLayer(frameView->verticalScrollbar(), m_private->scrollLayer(), verticalScrollbarLayer, frameView));
 }
 
 void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
 {
-    WebScrollableLayer layer;
-    if (scrollLayer)
-        layer = scrollLayer->platformLayer()->to<WebScrollableLayer>();
-    m_private->setScrollLayer(layer);
+    m_private->setScrollLayer(scrollLayer ? scrollableLayerForGraphicsLayer(scrollLayer) : 0);
 }
 
 void ScrollingCoordinator::setNonFastScrollableRegion(const Region& region)
 {
-    if (m_private->hasScrollLayer()) {
+    // We won't necessarily get a setScrollLayer() call before this one, so grab the root ourselves.
+    setScrollLayer(scrollLayerForFrameView(m_page->mainFrame()->view()));
+    if (m_private->scrollLayer()) {
         Vector<IntRect> rects = region.rects();
         WebVector<WebRect> webRects(rects.size());
         for (size_t i = 0; i < rects.size(); ++i)
             webRects[i] = rects[i];
-        m_private->scrollLayer().setNonFastScrollableRegion(webRects);
+        m_private->scrollLayer()->setNonFastScrollableRegion(webRects);
     }
 }
 
@@ -198,14 +206,18 @@ void ScrollingCoordinator::setScrollParameters(const ScrollParameters&)
 
 void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerCount)
 {
-    if (m_private->hasScrollLayer())
-        m_private->scrollLayer().setHaveWheelEventHandlers(wheelEventHandlerCount > 0);
+    // We won't necessarily get a setScrollLayer() call before this one, so grab the root ourselves.
+    setScrollLayer(scrollLayerForFrameView(m_page->mainFrame()->view()));
+    if (m_private->scrollLayer())
+        m_private->scrollLayer()->setHaveWheelEventHandlers(wheelEventHandlerCount > 0);
 }
 
 void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool should)
 {
-    if (m_private->hasScrollLayer())
-        m_private->scrollLayer().setShouldScrollOnMainThread(should);
+    // We won't necessarily get a setScrollLayer() call before this one, so grab the root ourselves.
+    setScrollLayer(scrollLayerForFrameView(m_page->mainFrame()->view()));
+    if (m_private->scrollLayer())
+        m_private->scrollLayer()->setShouldScrollOnMainThread(should);
 }
 
 bool ScrollingCoordinator::supportsFixedPositionLayers() const
@@ -215,14 +227,14 @@ bool ScrollingCoordinator::supportsFixedPositionLayers() const
 
 void ScrollingCoordinator::setLayerIsContainerForFixedPositionLayers(GraphicsLayer* layer, bool enable)
 {
-    if (WebLayer* platformLayer = layer->platformLayer())
-        platformLayer->to<WebScrollableLayer>().setIsContainerForFixedPositionLayers(enable);
+    if (WebLayer* scrollableLayer = scrollableLayerForGraphicsLayer(layer))
+        scrollableLayer->setIsContainerForFixedPositionLayers(enable);
 }
 
 void ScrollingCoordinator::setLayerIsFixedToContainerLayer(GraphicsLayer* layer, bool enable)
 {
-    if (WebLayer* platformLayer = layer->platformLayer())
-        platformLayer->to<WebScrollableLayer>().setFixedToContainerLayer(enable);
+    if (WebLayer* scrollableLayer = scrollableLayerForGraphicsLayer(layer))
+        scrollableLayer->setFixedToContainerLayer(enable);
 }
 
 }
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
index 064696e42..789759102 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
@@ -63,7 +63,9 @@ void ScrollingThread::threadRunLoopSourceCallback(void* scrollingThread)
 
 void ScrollingThread::threadRunLoopSourceCallback()
 {
+    NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
     dispatchFunctionsFromScrollingThread();
+    [pool drain];
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.cpp b/Source/WebCore/platform/ScrollAnimatorNone.cpp
index 45cc1e587..34a6f7709 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.cpp
+++ b/Source/WebCore/platform/ScrollAnimatorNone.cpp
@@ -34,18 +34,22 @@
 
 #include "ScrollAnimatorNone.h"
 
-#include "ActivePlatformGestureAnimation.h"
 #include "FloatPoint.h"
 #include "NotImplemented.h"
 #include <wtf/OwnArrayPtr.h>
 #include "PlatformGestureEvent.h"
 #include "ScrollableArea.h"
 #include "ScrollbarTheme.h"
-#include "TouchpadFlingPlatformGestureCurve.h"
 #include <algorithm>
 #include <wtf/CurrentTime.h>
 #include <wtf/PassOwnPtr.h>
 
+#if ENABLE(GESTURE_ANIMATION)
+#include "ActivePlatformGestureAnimation.h"
+#include "TouchpadFlingPlatformGestureCurve.h"
+#endif
+
+
 #if PLATFORM(CHROMIUM)
 #include "TraceEvent.h"
 #endif
@@ -401,9 +405,11 @@ ScrollAnimatorNone::~ScrollAnimatorNone()
 
 void ScrollAnimatorNone::fireUpAnAnimation(FloatPoint fp)
 {
+#if ENABLE(GESTURE_ANIMATION)
     if (m_gestureAnimation)
         m_gestureAnimation.clear();
     m_gestureAnimation = ActivePlatformGestureAnimation::create(TouchpadFlingPlatformGestureCurve::create(fp), this);
+#endif
 #if USE(REQUEST_ANIMATION_FRAME_TIMER)
     startNextTimer(0);
 #else
@@ -491,7 +497,9 @@ void ScrollAnimatorNone::scrollToOffsetWithoutAnimation(const FloatPoint& offset
 void ScrollAnimatorNone::cancelAnimations()
 {
     m_animationActive = false;
+#if ENABLE(GESTURE_ANIMATION)
     m_gestureAnimation.clear();
+#endif
 }
 
 void ScrollAnimatorNone::serviceScrollAnimations()
@@ -545,12 +553,14 @@ void ScrollAnimatorNone::animationTimerFired()
     if (m_verticalData.m_startTime && m_verticalData.animateScroll(currentTime))
         continueAnimation = true;
 
+#if ENABLE(GESTURE_ANIMATION)
     if (m_gestureAnimation) {
         if (m_gestureAnimation->animate(currentTime))
             continueAnimation = true;
         else
             m_gestureAnimation.clear();
     }
+#endif
 
     if (continueAnimation)
 #if USE(REQUEST_ANIMATION_FRAME_TIMER)
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.h b/Source/WebCore/platform/ScrollAnimatorNone.h
index ae18c02a0..2a4d86611 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.h
+++ b/Source/WebCore/platform/ScrollAnimatorNone.h
@@ -173,7 +173,9 @@ protected:
     bool m_firstVelocitySet;
     bool m_firstVelocityIsVertical;
 
+#if ENABLE(GESTURE_ANIMATION)
     OwnPtr<ActivePlatformGestureAnimation> m_gestureAnimation;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/CookieParser.cpp b/Source/WebCore/platform/blackberry/CookieParser.cpp
index 91babc2a1..e29ea28bd 100644
--- a/Source/WebCore/platform/blackberry/CookieParser.cpp
+++ b/Source/WebCore/platform/blackberry/CookieParser.cpp
@@ -29,6 +29,7 @@
 
 #include "Logging.h"
 #include "ParsedCookie.h"
+#include <network/TopLevelDomain.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/text/CString.h>
 
@@ -271,6 +272,11 @@ ParsedCookie* CookieParser::parseOneCookie(const String& cookie, unsigned start,
                 // We should check for an embedded dot in the portion of string in the host not in the domain
                 // but to match firefox behaviour we do not.
 
+                // Check whether the domain is a top level domain, if it is throw it out
+                // http://publicsuffix.org/list/
+                if (!BlackBerry::Platform::TopLevelDomain::isCookieWritableDomain(realDomain.utf8().data()))
+                    LOG_AND_DELETE("Invalid cookie %s (domain): it did not pass the top level domain check", cookie.ascii().data());
+
                 res->setDomain(realDomain);
             } else
                 LOG_AND_DELETE("Invalid cookie %s (domain)", cookie.ascii().data());
diff --git a/Source/WebCore/platform/cf/BinaryPropertyList.cpp b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
index 9ba9617dd..bec2ec950 100644
--- a/Source/WebCore/platform/cf/BinaryPropertyList.cpp
+++ b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
@@ -697,7 +697,7 @@ void BinaryPropertyListSerializer::appendStringObject(const String& string)
     unsigned length = string.length();
     if (charactersAreAllASCII(characters, length)) {
         if (length <= maxLengthInMarkerByte)
-            appendByte(asciiStringMarkerByte | length);
+            appendByte(static_cast<unsigned char>(asciiStringMarkerByte | length));
         else {
             appendByte(asciiStringWithSeparateLengthMarkerByte);
             appendInteger(length);
@@ -706,7 +706,7 @@ void BinaryPropertyListSerializer::appendStringObject(const String& string)
             appendByte(characters[i]);
     } else {
         if (length <= maxLengthInMarkerByte)
-            appendByte(unicodeStringMarkerByte | length);
+            appendByte(static_cast<unsigned char>(unicodeStringMarkerByte | length));
         else {
             appendByte(unicodeStringWithSeparateLengthMarkerByte);
             appendInteger(length);
@@ -723,7 +723,7 @@ void BinaryPropertyListSerializer::appendStringObject(const char* string)
     startObject();
     unsigned length = strlen(string);
     if (length <= maxLengthInMarkerByte)
-        appendByte(asciiStringMarkerByte | length);
+        appendByte(static_cast<unsigned char>(asciiStringMarkerByte | length));
     else {
         appendByte(asciiStringWithSeparateLengthMarkerByte);
         appendInteger(length);
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index e07dd8409..4075430d4 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -27,6 +27,7 @@
 #include "RenderThemeEfl.h"
 
 #include "CSSValueKeywords.h"
+#include "FontDescription.h"
 #include "GraphicsContext.h"
 #include "HTMLInputElement.h"
 #include "InputType.h"
@@ -766,13 +767,18 @@ void RenderThemeEfl::adjustSliderTrackStyle(StyleResolver* styleResolver, Render
         return;
     }
 
-    adjustSizeConstraints(style, SliderHorizontal);
+    const ThemePartDesc* desc;
+    if (style->appearance() == SliderHorizontalPart) {
+        adjustSizeConstraints(style, SliderHorizontal);
+        desc = m_partDescs + static_cast<size_t>(SliderHorizontal);
+    } else {
+        adjustSizeConstraints(style, SliderVertical);
+        desc = m_partDescs + static_cast<size_t>(SliderVertical);
+    }
     style->resetBorder();
-
-    const struct ThemePartDesc *desc = m_partDescs + (size_t)SliderHorizontal;
-    if (style->width().value() < desc->min.width().value())
+    if (style->width().value() > 0 && style->width().value() < desc->min.width().value())
         style->setWidth(desc->min.width());
-    if (style->height().value() < desc->min.height().value())
+    if (style->height().value() > 0 && style->height().value() < desc->min.height().value())
         style->setHeight(desc->min.height());
 }
 
@@ -809,6 +815,12 @@ int RenderThemeEfl::sliderTickOffsetFromTrackCenter() const
 
     return sliderTickOffset;
 }
+
+LayoutUnit RenderThemeEfl::sliderTickSnappingThreshold() const
+{
+    // The same threshold value as the Chromium port.
+    return 5;
+}
 #endif
 
 bool RenderThemeEfl::supportsDataListUI(const AtomicString& type) const
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.h b/Source/WebCore/platform/efl/RenderThemeEfl.h
index 641e52619..b97fdd3ad 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.h
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.h
@@ -164,6 +164,7 @@ public:
 #if ENABLE(DATALIST_ELEMENT)
     virtual IntSize sliderTickSize() const OVERRIDE;
     virtual int sliderTickOffsetFromTrackCenter() const OVERRIDE;
+    virtual LayoutUnit sliderTickSnappingThreshold() const OVERRIDE;
 #endif
 
     virtual bool supportsDataListUI(const AtomicString&) const OVERRIDE;
diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
index 595d16a4f..78a0de410 100644
--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
@@ -66,7 +66,7 @@ void ANGLEWebKitBridge::setResources(ShBuiltInResources resources)
     m_resources = resources;
 }
 
-bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShaderType shaderType, String& translatedShaderSource, String& shaderValidationLog)
+bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShaderType shaderType, String& translatedShaderSource, String& shaderValidationLog, int extraCompileOptions)
 {
     if (!builtCompilers) {
         m_fragmentCompiler = ShConstructCompiler(SH_FRAGMENT_SHADER, SH_WEBGL_SPEC, m_shaderOutput, &m_resources);
@@ -88,7 +88,7 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
 
     const char* const shaderSourceStrings[] = { shaderSource };
 
-    bool validateSuccess = ShCompile(compiler, shaderSourceStrings, 1, SH_OBJECT_CODE);
+    bool validateSuccess = ShCompile(compiler, shaderSourceStrings, 1, SH_OBJECT_CODE | extraCompileOptions);
     if (!validateSuccess) {
         int logSize = 0;
         ShGetInfo(compiler, SH_INFO_LOG_LENGTH, &logSize);
diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
index d75b5f298..834dcc9aa 100644
--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.h
@@ -53,7 +53,7 @@ public:
     ShBuiltInResources getResources() { return m_resources; }
     void setResources(ShBuiltInResources);
     
-    bool validateShaderSource(const char* shaderSource, ANGLEShaderType shaderType, String& translatedShaderSource, String& shaderValidationLog);
+    bool validateShaderSource(const char* shaderSource, ANGLEShaderType shaderType, String& translatedShaderSource, String& shaderValidationLog, int extraCompileOptions);
 
 private:
 
diff --git a/Source/WebCore/platform/graphics/FontMetrics.h b/Source/WebCore/platform/graphics/FontMetrics.h
index 5fe408bb6..11b062918 100644
--- a/Source/WebCore/platform/graphics/FontMetrics.h
+++ b/Source/WebCore/platform/graphics/FontMetrics.h
@@ -20,6 +20,7 @@
 #ifndef FontMetrics_h
 #define FontMetrics_h
 
+#include "FontBaseline.h"
 #include <wtf/MathExtras.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.h b/Source/WebCore/platform/graphics/GraphicsContext.h
index a2f4d6867..0369b20a7 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext.h
@@ -128,10 +128,8 @@ namespace WebCore {
     class TransformationMatrix;
 
     enum TextDrawingMode {
-        TextModeInvisible = 0,
         TextModeFill      = 1 << 0,
         TextModeStroke    = 1 << 1,
-        TextModeClip      = 1 << 2
     };
     typedef unsigned TextDrawingModeFlags;
 
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
index 425681805..6fad26e53 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
@@ -358,6 +358,11 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
     return;
 #endif
 
+    paintCurrentFrameInContext(context, rect);
+}
+
+void MediaPlayerPrivate::paintCurrentFrameInContext(GraphicsContext* context, const IntRect& rect)
+{
     if (!hasVideo() || context->paintingDisabled() || !m_webCorePlayer->visible())
         return;
 
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
index c378bf68a..40156fbb7 100644
--- a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
@@ -89,6 +89,8 @@ public:
 
     virtual void paint(GraphicsContext*, const IntRect&);
 
+    virtual void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
+
     virtual bool hasAvailableVideoFrame() const;
 
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index befadb940..2eed9cd6b 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -1646,12 +1646,8 @@ void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
     if (paintingDisabled())
         return;
 
-    // Wow, wish CG had used bits here.
     CGContextRef context = platformContext();
     switch (mode) {
-    case TextModeInvisible:
-        CGContextSetTextDrawingMode(context, kCGTextInvisible);
-        break;
     case TextModeFill:
         CGContextSetTextDrawingMode(context, kCGTextFill);
         break;
@@ -1661,18 +1657,6 @@ void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
     case TextModeFill | TextModeStroke:
         CGContextSetTextDrawingMode(context, kCGTextFillStroke);
         break;
-    case TextModeClip:
-        CGContextSetTextDrawingMode(context, kCGTextClip);
-        break;
-    case TextModeFill | TextModeClip:
-        CGContextSetTextDrawingMode(context, kCGTextFillClip);
-        break;
-    case TextModeStroke | TextModeClip:
-        CGContextSetTextDrawingMode(context, kCGTextStrokeClip);
-        break;
-    case TextModeFill | TextModeStroke | TextModeClip:
-        CGContextSetTextDrawingMode(context, kCGTextFillStrokeClip);
-        break;
     default:
         break;
     }
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
index db517cad2..10654312c 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.cpp
@@ -69,22 +69,21 @@ Canvas2DLayerBridge::Canvas2DLayerBridge(PassRefPtr<GraphicsContext3D> context,
             grContext->resetContext();
     }
 
-    m_layer = WebExternalTextureLayer::create(this);
-    m_layer.setTextureId(textureId);
-    m_layer.setRateLimitContext(!WebKit::WebCompositor::threadingEnabled() || m_useDoubleBuffering);
+    m_layer = adoptPtr(WebExternalTextureLayer::create(this));
+    m_layer->setTextureId(textureId);
+    m_layer->setRateLimitContext(!WebKit::WebCompositor::threadingEnabled() || m_useDoubleBuffering);
 }
 
 Canvas2DLayerBridge::~Canvas2DLayerBridge()
 {
     if (SkDeferredCanvas* deferred = deferredCanvas())
         deferred->setNotificationClient(0);
-    m_layer.setTextureId(0);
+    m_layer->setTextureId(0);
     if (m_useDoubleBuffering) {
         m_context->makeContextCurrent();
         GLC(m_context.get(), m_context->deleteTexture(m_frontBufferTexture));
         m_context->flush();
     }
-    m_layer.clearClient();
 }
 
 SkDeferredCanvas* Canvas2DLayerBridge::deferredCanvas()
@@ -98,7 +97,7 @@ void Canvas2DLayerBridge::prepareForDraw()
 {
     ASSERT(deferredCanvas());
     if (!m_useDoubleBuffering)
-        m_layer.willModifyTexture();
+        m_layer->willModifyTexture();
     m_context->makeContextCurrent();
 }
 
@@ -148,13 +147,13 @@ WebGraphicsContext3D* Canvas2DLayerBridge::context()
 
 WebKit::WebLayer* Canvas2DLayerBridge::layer()
 {
-    return &m_layer;
+    return m_layer->layer();
 }
 
 void Canvas2DLayerBridge::contextAcquired()
 {
     if (m_deferralMode == NonDeferred && !m_useDoubleBuffering)
-        m_layer.willModifyTexture();
+        m_layer->willModifyTexture();
 }
 
 unsigned Canvas2DLayerBridge::backBufferTexture()
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
index 409d207c5..27b1ea659 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerBridge.h
@@ -76,7 +76,7 @@ private:
     unsigned m_backBufferTexture;
     IntSize m_size;
     SkCanvas* m_canvas;
-    WebKit::WebExternalTextureLayer m_layer;
+    OwnPtr<WebKit::WebExternalTextureLayer> m_layer;
     RefPtr<GraphicsContext3D> m_context;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 0dc960b6d..a8f57e296 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -96,23 +96,13 @@ void ContentLayerChromium::setTexturePriorities(const CCPriorityCalculator& prio
 void ContentLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
 {
     createTextureUpdaterIfNeeded();
-
-    IntRect contentRect;
-
-    // Always call updateContentRect() but with an empty layer rectangle when
-    // layer doesn't draw contents.
-    if (drawsContent())
-        contentRect = visibleContentRect();
-
-    updateContentRect(queue, contentRect, occlusion, stats);
+    TiledLayerChromium::update(queue, occlusion, stats);
     m_needsDisplay = false;
 }
 
 bool ContentLayerChromium::needMoreUpdates()
 {
-    if (!drawsContent())
-        return false;
-    return needsIdlePaint(visibleContentRect());
+    return needsIdlePaint();
 }
 
 void ContentLayerChromium::createTextureUpdaterIfNeeded()
diff --git a/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm b/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
index a27af4cbe..c0f10dc6b 100644
--- a/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
+++ b/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
@@ -41,20 +41,6 @@ namespace {
 typedef HashMap<uint32, MemoryActivatedFont*> FontContainerRefMemoryFontHash;
 typedef HashMap<WTF::String, MemoryActivatedFont*> FontNameMemoryFontHash;
 
-// On 10.5, font loading is not blocked by the sandbox and thus there is no
-// need for the cross-process font loading mechanim.
-// On system versions >=10.6 cross-process font loading is required.
-bool OutOfProcessFontLoadingEnabled()
-{
-    static SInt32 systemVersion = 0;
-    if (!systemVersion) {
-        if (Gestalt(gestaltSystemVersion, &systemVersion) != noErr)
-            return false;
-    }
-
-    return systemVersion >= 0x1060;
-}
-
 // Caching:
 //
 // Requesting a font from the browser process is expensive and so is
@@ -199,7 +185,7 @@ void FontPlatformData::loadFont(NSFont* nsFont, float fontSize, NSFont*& outNSFo
 {
     outNSFont = nsFont;
     cgFont = CTFontCopyGraphicsFont(toCTFontRef(outNSFont), 0);
-    if (OutOfProcessFontLoadingEnabled() && outNSFont && cgFont && isLastResortFont(cgFont)) {
+    if (outNSFont && cgFont && isLastResortFont(cgFont)) {
         // Release old CGFontRef since it points at the LastResort font which we don't want.
         CFRelease(cgFont);
         cgFont = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index 1d167a556..6102a3e6f 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -156,16 +156,15 @@ class DrawingBufferPrivate : public WebKit::WebExternalTextureLayerClient {
 public:
     explicit DrawingBufferPrivate(DrawingBuffer* drawingBuffer)
         : m_drawingBuffer(drawingBuffer)
-        , m_layer(WebKit::WebExternalTextureLayer::create(this))
+        , m_layer(adoptPtr(WebKit::WebExternalTextureLayer::create(this)))
     {
         GraphicsContext3D::Attributes attributes = m_drawingBuffer->graphicsContext3D()->getContextAttributes();
-        m_layer.setOpaque(!attributes.alpha);
-        m_layer.setPremultipliedAlpha(attributes.premultipliedAlpha);
+        m_layer->setOpaque(!attributes.alpha);
+        m_layer->setPremultipliedAlpha(attributes.premultipliedAlpha);
     }
 
     virtual ~DrawingBufferPrivate()
     {
-        m_layer.clearClient();
     }
 
     virtual unsigned prepareTexture(WebKit::WebTextureUpdater& updater) OVERRIDE
@@ -187,11 +186,11 @@ public:
         return GraphicsContext3DPrivate::extractWebGraphicsContext3D(m_drawingBuffer->graphicsContext3D());
     }
 
-    WebKit::WebLayer* layer() { return &m_layer; }
+    WebKit::WebLayer* layer() { return m_layer->layer(); }
 
 private:
     DrawingBuffer* m_drawingBuffer;
-    WebKit::WebExternalTextureLayer m_layer;
+    OwnPtr<WebKit::WebExternalTextureLayer> m_layer;
 };
 
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
index 156dcd3d1..9f8998cda 100644
--- a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
@@ -629,7 +629,8 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     }
 
     return new FontPlatformData(hfont,
-                                fontDescription.computedPixelSize());
+                                fontDescription.computedPixelSize(),
+                                fontDescription.orientation());
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.cpp
index a6541ee1c..6f27f8a54 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.cpp
@@ -32,14 +32,16 @@
 #include "config.h"
 #include "FontPlatformData.h"
 
-#include <windows.h>
-#include <objidl.h>
-#include <mlang.h>
-
+#include "FontCache.h"
 #include "HWndDC.h"
 #include "PlatformSupport.h"
+#include "SharedBuffer.h"
 #include "SkTypeface_win.h"
 #include "SkiaFontWin.h"
+
+#include <mlang.h>
+#include <objidl.h>
+#include <windows.h>
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -62,6 +64,7 @@ SkTypeface* CreateTypefaceFromHFont(HFONT hfont, int* size, int* lfQuality)
 FontPlatformData::FontPlatformData(WTF::HashTableDeletedValueType)
     : m_font(hashTableDeletedFontValue())
     , m_size(-1)
+    , m_orientation(Horizontal)
     , m_scriptCache(0)
     , m_scriptFontProperties(0)
     , m_typeface(0)
@@ -72,6 +75,7 @@ FontPlatformData::FontPlatformData(WTF::HashTableDeletedValueType)
 FontPlatformData::FontPlatformData()
     : m_font(0)
     , m_size(0)
+    , m_orientation(Horizontal)
     , m_scriptCache(0)
     , m_scriptFontProperties(0)
     , m_typeface(0)
@@ -79,9 +83,10 @@ FontPlatformData::FontPlatformData()
 {
 }
 
-FontPlatformData::FontPlatformData(HFONT font, float size)
+FontPlatformData::FontPlatformData(HFONT font, float size, FontOrientation orientation)
     : m_font(RefCountedHFONT::create(font))
     , m_size(size)
+    , m_orientation(orientation)
     , m_scriptCache(0)
     , m_scriptFontProperties(0)
     , m_typeface(CreateTypefaceFromHFont(font, 0, &m_lfQuality))
@@ -92,6 +97,7 @@ FontPlatformData::FontPlatformData(HFONT font, float size)
 FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
     : m_font(0)
     , m_size(size)
+    , m_orientation(Horizontal)
     , m_scriptCache(0)
     , m_scriptFontProperties(0)
     , m_typeface(0)
@@ -102,6 +108,7 @@ FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
 FontPlatformData::FontPlatformData(const FontPlatformData& data)
     : m_font(data.m_font)
     , m_size(data.m_size)
+    , m_orientation(data.m_orientation)
     , m_scriptCache(0)
     , m_scriptFontProperties(0)
     , m_typeface(data.m_typeface)
@@ -115,6 +122,7 @@ FontPlatformData& FontPlatformData::operator=(const FontPlatformData& data)
     if (this != &data) {
         m_font = data.m_font;
         m_size = data.m_size;
+        m_orientation = data.m_orientation;
         SkRefCnt_SafeAssign(m_typeface, data.m_typeface);
         m_lfQuality = data.m_lfQuality;
 
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
index d264b17da..55a5c2b07 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
@@ -64,7 +64,7 @@ public:
     FontPlatformData(WTF::HashTableDeletedValueType);
     FontPlatformData();
     // This constructor takes ownership of the HFONT
-    FontPlatformData(HFONT, float size);
+    FontPlatformData(HFONT, float size, FontOrientation);
     FontPlatformData(float size, bool bold, bool oblique);
     FontPlatformData(const FontPlatformData&);
 
@@ -79,8 +79,8 @@ public:
     SkTypeface* typeface() const { return m_typeface; }
     int lfQuality() const { return m_lfQuality; }
 
-    FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
-    void setOrientation(FontOrientation) { } // FIXME: Implement.
+    FontOrientation orientation() const { return m_orientation; }
+    void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
 
     unsigned hash() const
     {
@@ -89,7 +89,7 @@ public:
 
     bool operator==(const FontPlatformData& other) const
     { 
-        return m_font == other.m_font && m_size == other.m_size;
+        return m_font == other.m_font && m_size == other.m_size && m_orientation == other.m_orientation;
     }
 
 #ifndef NDEBUG
@@ -137,6 +137,7 @@ private:
 
     RefPtr<RefCountedHFONT> m_font;
     float m_size;  // Point size of the font in pixels.
+    FontOrientation m_orientation;
 
     SkTypeface* m_typeface; // cached from m_font
     int m_lfQuality; // cached from m_font
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
index da2ecc610..101ad4bb1 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
@@ -107,7 +107,7 @@ void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(WebGraphic
     context->makeContextCurrent();
 
     texture->acquireBackingTexture(resourceProvider);
-    CCScopedLockResourceForWrite lock(resourceProvider, texture->resourceId());
+    CCResourceProvider::ScopedWriteLockGL lock(resourceProvider, texture->resourceId());
     // Create an accelerated canvas to draw on.
     OwnPtr<SkCanvas> canvas = createAcceleratedCanvas(grContext, texture->size(), lock.textureId());
 
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index fb0900bbc..7d5591be3 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -52,7 +52,6 @@
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "Image.h"
-#include "LinkHighlight.h"
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
 #include "PlatformString.h"
@@ -83,14 +82,17 @@ PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
 
 GraphicsLayerChromium::GraphicsLayerChromium(GraphicsLayerClient* client)
     : GraphicsLayer(client)
+    , m_contentsLayer(0)
+    , m_contentsLayerId(0)
+    , m_linkHighlight(0)
     , m_contentsLayerPurpose(NoContentsLayer)
     , m_contentsLayerHasBackgroundColor(false)
     , m_inSetChildren(false)
     , m_pageScaleChanged(false)
 {
     m_opaqueRectTrackingContentLayerDelegate = adoptPtr(new OpaqueRectTrackingContentLayerDelegate(this));
-    m_layer = WebContentLayer::create(m_opaqueRectTrackingContentLayerDelegate.get());
-    m_layer.setDrawsContent(m_drawsContent && m_contentsVisible);
+    m_layer = adoptPtr(WebContentLayer::create(m_opaqueRectTrackingContentLayerDelegate.get()));
+    m_layer->layer()->setDrawsContent(m_drawsContent && m_contentsVisible);
     if (client)
         deviceOrPageScaleFactorChanged();
     updateDebugIndicators();
@@ -98,31 +100,16 @@ GraphicsLayerChromium::GraphicsLayerChromium(GraphicsLayerClient* client)
 
 GraphicsLayerChromium::~GraphicsLayerChromium()
 {
-    // Do cleanup while we can still safely call methods on the derived class.
     willBeDestroyed();
 }
 
 void GraphicsLayerChromium::willBeDestroyed()
 {
-    if (!m_layer.isNull()) {
-        m_layer.clearClient();
-        m_layer.clearRenderSurface();
-        m_layer.setAnimationDelegate(0);
-    }
-
-    if (!m_contentsLayer.isNull()) {
-        m_contentsLayer.clearRenderSurface();
-        m_contentsLayer.setAnimationDelegate(0);
-    }
-
-    if (!m_transformLayer.isNull()) {
-        m_transformLayer.clearRenderSurface();
-        m_transformLayer.setAnimationDelegate(0);
+    if (m_linkHighlight) {
+        m_linkHighlight->clearCurrentGraphicsLayer();
+        m_linkHighlight = 0;
     }
 
-    if (m_linkHighlight)
-        m_linkHighlight.clear();
-
     GraphicsLayer::willBeDestroyed();
 }
 
@@ -136,21 +123,20 @@ void GraphicsLayerChromium::setName(const String& inName)
 
 void GraphicsLayerChromium::updateNames()
 {
-    if (!m_layer.isNull()) {
-        String debugName = "Layer for " + m_nameBase;
-        m_layer.setDebugName(debugName);
-    }
-    if (!m_transformLayer.isNull()) {
+    String debugName = "Layer for " + m_nameBase;
+    m_layer->layer()->setDebugName(debugName);
+
+    if (m_transformLayer) {
         String debugName = "TransformLayer for " + m_nameBase;
-        m_transformLayer.setDebugName(debugName);
+        m_transformLayer->setDebugName(debugName);
     }
-    if (!m_contentsLayer.isNull()) {
+    if (m_contentsLayer) {
         String debugName = "ContentsLayer for " + m_nameBase;
-        m_contentsLayer.setDebugName(debugName);
+        m_contentsLayer->setDebugName(debugName);
     }
     if (m_linkHighlight) {
         String debugName = "LinkHighlight for " + m_nameBase;
-        m_linkHighlight->contentLayer()->setDebugName(debugName);
+        m_linkHighlight->layer()->setDebugName(debugName);
     }
 }
 
@@ -203,7 +189,7 @@ bool GraphicsLayerChromium::replaceChild(GraphicsLayer* oldChild, GraphicsLayer*
 void GraphicsLayerChromium::removeFromParent()
 {
     GraphicsLayer::removeFromParent();
-    primaryLayer().removeFromParent();
+    platformLayer()->removeFromParent();
 }
 
 void GraphicsLayerChromium::setPosition(const FloatPoint& point)
@@ -233,8 +219,11 @@ void GraphicsLayerChromium::setSize(const FloatSize& size)
     GraphicsLayer::setSize(clampedSize);
     updateLayerSize();
 
-    if (m_pageScaleChanged && !m_layer.isNull())
-        m_layer.invalidate();
+    if (m_pageScaleChanged) {
+        m_layer->layer()->invalidate();
+        if (m_linkHighlight)
+            m_linkHighlight->invalidate();
+    }
     m_pageScaleChanged = false;
 }
 
@@ -301,13 +290,13 @@ void GraphicsLayerChromium::setBackgroundColor(const Color& color)
 void GraphicsLayerChromium::clearBackgroundColor()
 {
     GraphicsLayer::clearBackgroundColor();
-    m_contentsLayer.setBackgroundColor(static_cast<RGBA32>(0));
+    m_contentsLayer->setBackgroundColor(static_cast<RGBA32>(0));
 }
 
 void GraphicsLayerChromium::setContentsOpaque(bool opaque)
 {
     GraphicsLayer::setContentsOpaque(opaque);
-    m_layer.setOpaque(m_contentsOpaque);
+    m_layer->layer()->setOpaque(m_contentsOpaque);
 }
 
 static bool copyWebCoreFilterOperationsToWebFilterOperations(const FilterOperations& filters, WebFilterOperations& webFilters)
@@ -391,11 +380,11 @@ bool GraphicsLayerChromium::setFilters(const FilterOperations& filters)
     if (!copyWebCoreFilterOperationsToWebFilterOperations(filters, webFilters)) {
         // Make sure the filters are removed from the platform layer, as they are
         // going to fallback to software mode.
-        m_layer.setFilters(WebFilterOperations());
+        m_layer->layer()->setFilters(WebFilterOperations());
         GraphicsLayer::setFilters(FilterOperations());
         return false;
     }
-    m_layer.setFilters(webFilters);
+    m_layer->layer()->setFilters(webFilters);
     return GraphicsLayer::setFilters(filters);
 }
 
@@ -404,7 +393,7 @@ void GraphicsLayerChromium::setBackgroundFilters(const FilterOperations& filters
     WebFilterOperations webFilters;
     if (!copyWebCoreFilterOperationsToWebFilterOperations(filters, webFilters))
         return;
-    m_layer.setBackgroundFilters(webFilters);
+    m_layer->layer()->setBackgroundFilters(webFilters);
 }
 
 void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
@@ -414,23 +403,21 @@ void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
 
     GraphicsLayer::setMaskLayer(maskLayer);
 
-    WebLayer maskWebLayer;
-    if (m_maskLayer)
-        maskWebLayer = *m_maskLayer->platformLayer();
-    m_layer.setMaskLayer(maskWebLayer);
+    WebLayer* maskWebLayer = m_maskLayer ? m_maskLayer->platformLayer() : 0;
+    m_layer->layer()->setMaskLayer(maskWebLayer);
 }
 
 void GraphicsLayerChromium::setBackfaceVisibility(bool visible)
 {
     GraphicsLayer::setBackfaceVisibility(visible);
-    m_layer.setDoubleSided(m_backfaceVisibility);
+    m_layer->setDoubleSided(m_backfaceVisibility);
 }
 
 void GraphicsLayerChromium::setOpacity(float opacity)
 {
     float clampedOpacity = max(min(opacity, 1.0f), 0.0f);
     GraphicsLayer::setOpacity(clampedOpacity);
-    primaryLayer().setOpacity(opacity);
+    platformLayer()->setOpacity(opacity);
 }
 
 void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
@@ -438,29 +425,33 @@ void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
     GraphicsLayerChromium* layerChromium = static_cast<GraphicsLayerChromium*>(layer);
     GraphicsLayer::setReplicatedByLayer(layer);
 
-    WebLayer webReplicaLayer;
-    if (layerChromium)
-        webReplicaLayer = layerChromium->primaryLayer();
-    primaryLayer().setReplicaLayer(webReplicaLayer);
+    WebLayer* webReplicaLayer = layerChromium ? layerChromium->platformLayer() : 0;
+    platformLayer()->setReplicaLayer(webReplicaLayer);
 }
 
 
 void GraphicsLayerChromium::setContentsNeedsDisplay()
 {
-    if (!m_contentsLayer.isNull())
-        m_contentsLayer.invalidate();
+    if (m_contentsLayer)
+        m_contentsLayer->invalidate();
 }
 
 void GraphicsLayerChromium::setNeedsDisplay()
 {
-    if (drawsContent())
-        m_layer.invalidate();
+    if (drawsContent()) {
+        m_layer->layer()->invalidate();
+        if (m_linkHighlight)
+            m_linkHighlight->invalidate();
+    }
 }
 
 void GraphicsLayerChromium::setNeedsDisplayInRect(const FloatRect& rect)
 {
-    if (drawsContent())
-        m_layer.invalidateRect(rect);
+    if (drawsContent()) {
+        m_layer->layer()->invalidateRect(rect);
+        if (m_linkHighlight)
+            m_linkHighlight->invalidate();
+    }
 }
 
 void GraphicsLayerChromium::setContentsRect(const IntRect& rect)
@@ -476,46 +467,56 @@ void GraphicsLayerChromium::setContentsToImage(Image* image)
 {
     bool childrenChanged = false;
     if (image) {
-        if (m_contentsLayer.isNull() || m_contentsLayerPurpose != ContentsLayerForImage) {
-            WebKit::WebImageLayer imageLayer = WebKit::WebImageLayer::create();
-            setupContentsLayer(imageLayer);
+        if (m_contentsLayerPurpose != ContentsLayerForImage) {
+            m_imageLayer = adoptPtr(WebImageLayer::create());
+            setupContentsLayer(m_imageLayer->layer());
             m_contentsLayerPurpose = ContentsLayerForImage;
             childrenChanged = true;
         }
-        WebKit::WebImageLayer imageLayer = m_contentsLayer.to<WebKit::WebImageLayer>();
         NativeImageSkia* nativeImage = image->nativeImageForCurrentFrame();
-        imageLayer.setBitmap(nativeImage->bitmap());
-        imageLayer.setOpaque(image->isBitmapImage() && !image->currentFrameHasAlpha());
+        m_imageLayer->setBitmap(nativeImage->bitmap());
+        m_imageLayer->layer()->setOpaque(image->isBitmapImage() && !image->currentFrameHasAlpha());
         updateContentsRect();
     } else {
-        if (!m_contentsLayer.isNull()) {
+        if (m_imageLayer) {
             childrenChanged = true;
 
-            // The old contents layer will be removed via updateChildList.
-            m_contentsLayer.reset();
+            m_imageLayer.clear();
         }
+        // The old contents layer will be removed via updateChildList.
+        m_contentsLayer = 0;
     }
 
     if (childrenChanged)
         updateChildList();
 }
 
-void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
+void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* layer)
+{
+    setContentsTo(ContentsLayerForCanvas, layer);
+}
+
+void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
+{
+    setContentsTo(ContentsLayerForVideo, layer);
+}
+
+void GraphicsLayerChromium::setContentsTo(ContentsLayerPurpose purpose, WebKit::WebLayer* layer)
 {
     bool childrenChanged = false;
-    if (platformLayer) {
-        if (m_contentsLayer != *platformLayer) {
-            setupContentsLayer(*platformLayer);
-            m_contentsLayerPurpose = ContentsLayerForCanvas;
+    if (layer) {
+        if (m_contentsLayerId != layer->id()) {
+            setupContentsLayer(layer);
+            m_contentsLayerPurpose = purpose;
             childrenChanged = true;
         }
         updateContentsRect();
     } else {
-        if (!m_contentsLayer.isNull()) {
+        if (m_contentsLayer) {
             childrenChanged = true;
 
             // The old contents layer will be removed via updateChildList.
-            m_contentsLayer.reset();
+            m_contentsLayer = 0;
         }
     }
 
@@ -525,7 +526,7 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 
 bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
 {
-    primaryLayer().setAnimationDelegate(this);
+    platformLayer()->setAnimationDelegate(this);
 
     int animationId = mapAnimationNameToId(animationName);
     int groupId = AnimationIdVendor::getNextGroupId();
@@ -534,8 +535,8 @@ bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const
 
     if (toAdd) {
         // Remove any existing animations with the same animation id and target property.
-        primaryLayer().removeAnimation(animationId, toAdd->targetProperty());
-        return primaryLayer().addAnimation(toAdd.get());
+        platformLayer()->removeAnimation(animationId, toAdd->targetProperty());
+        return platformLayer()->addAnimation(toAdd.get());
     }
 
     return false;
@@ -543,12 +544,12 @@ bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const
 
 void GraphicsLayerChromium::pauseAnimation(const String& animationName, double timeOffset)
 {
-    primaryLayer().pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
+    platformLayer()->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
 }
 
 void GraphicsLayerChromium::removeAnimation(const String& animationName)
 {
-    primaryLayer().removeAnimation(mapAnimationNameToId(animationName));
+    platformLayer()->removeAnimation(mapAnimationNameToId(animationName));
 }
 
 void GraphicsLayerChromium::suspendAnimations(double wallClockTime)
@@ -556,88 +557,52 @@ void GraphicsLayerChromium::suspendAnimations(double wallClockTime)
     // |wallClockTime| is in the wrong time base. Need to convert here.
     // FIXME: find a more reliable way to do this.
     double monotonicTime = wallClockTime + monotonicallyIncreasingTime() - currentTime();
-    primaryLayer().suspendAnimations(monotonicTime);
+    platformLayer()->suspendAnimations(monotonicTime);
 }
 
 void GraphicsLayerChromium::resumeAnimations()
 {
-    primaryLayer().resumeAnimations(monotonicallyIncreasingTime());
+    platformLayer()->resumeAnimations(monotonicallyIncreasingTime());
 }
 
-void GraphicsLayerChromium::addLinkHighlight(const Path& path)
+void GraphicsLayerChromium::setLinkHighlight(LinkHighlightClient* linkHighlight)
 {
-    m_linkHighlight = LinkHighlight::create(this, path, AnimationIdVendor::LinkHighlightAnimationId, AnimationIdVendor::getNextGroupId());
+    m_linkHighlight = linkHighlight;
     updateChildList();
 }
 
-void GraphicsLayerChromium::didFinishLinkHighlight()
-{
-    if (m_linkHighlight)
-        m_linkHighlight->contentLayer()->removeFromParent();
-
-    m_linkHighlight.clear();
-}
-
-void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
-{
-    bool childrenChanged = false;
-    if (layer) {
-        if (m_contentsLayer.isNull() || m_contentsLayerPurpose != ContentsLayerForVideo) {
-            setupContentsLayer(*layer);
-            m_contentsLayerPurpose = ContentsLayerForVideo;
-            childrenChanged = true;
-        }
-        updateContentsRect();
-    } else {
-        if (!m_contentsLayer.isNull()) {
-            childrenChanged = true;
-
-            // The old contents layer will be removed via updateChildList.
-            m_contentsLayer.reset();
-        }
-    }
-
-    if (childrenChanged)
-        updateChildList();
-}
-
-WebKit::WebLayer GraphicsLayerChromium::primaryLayer() const
-{
-    return m_transformLayer.isNull() ? m_layer : m_transformLayer;
-}
-
 PlatformLayer* GraphicsLayerChromium::platformLayer() const
 {
-    return const_cast<PlatformLayer*>(m_transformLayer.isNull() ? &m_layer : &m_transformLayer);
+    return m_transformLayer ? m_transformLayer.get() : m_layer->layer();
 }
 
 void GraphicsLayerChromium::setDebugBackgroundColor(const Color& color)
 {
     if (color.isValid())
-        m_layer.setBackgroundColor(color.rgb());
+        m_layer->layer()->setBackgroundColor(color.rgb());
     else
-        m_layer.setBackgroundColor(static_cast<RGBA32>(0));
+        m_layer->layer()->setBackgroundColor(static_cast<RGBA32>(0));
 }
 
 void GraphicsLayerChromium::setDebugBorder(const Color& color, float borderWidth)
 {
     if (color.isValid()) {
-        m_layer.setDebugBorderColor(color.rgb());
-        m_layer.setDebugBorderWidth(borderWidth);
+        m_layer->layer()->setDebugBorderColor(color.rgb());
+        m_layer->layer()->setDebugBorderWidth(borderWidth);
     } else {
-        m_layer.setDebugBorderColor(static_cast<RGBA32>(0));
-        m_layer.setDebugBorderWidth(0);
+        m_layer->layer()->setDebugBorderColor(static_cast<RGBA32>(0));
+        m_layer->layer()->setDebugBorderWidth(0);
     }
 }
 
 void GraphicsLayerChromium::updateChildList()
 {
-    Vector<WebLayer> newChildren;
+    Vector<WebLayer*> newChildren;
 
-    if (!m_transformLayer.isNull()) {
+    if (m_transformLayer) {
         // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
-        newChildren.append(m_layer);
-    } else if (!m_contentsLayer.isNull()) {
+        newChildren.append(m_layer->layer());
+    } else if (m_contentsLayer) {
         // FIXME: add the contents layer in the correct order with negative z-order children.
         // This does not cause visible rendering issues because currently contents layers are only used
         // for replaced elements that don't have children.
@@ -649,79 +614,79 @@ void GraphicsLayerChromium::updateChildList()
     for (size_t i = 0; i < numChildren; ++i) {
         GraphicsLayerChromium* curChild = static_cast<GraphicsLayerChromium*>(childLayers[i]);
 
-        newChildren.append(curChild->primaryLayer());
+        newChildren.append(curChild->platformLayer());
     }
 
     if (m_linkHighlight)
-        newChildren.append(m_linkHighlight->contentLayer());
+        newChildren.append(m_linkHighlight->layer());
 
     for (size_t i = 0; i < newChildren.size(); ++i)
-        newChildren[i].removeFromParent();
+        newChildren[i]->removeFromParent();
 
-    WebVector<WebLayer> newWebChildren;
+    WebVector<WebLayer*> newWebChildren;
     newWebChildren.assign(newChildren.data(), newChildren.size());
 
-    if (!m_transformLayer.isNull()) {
-        m_transformLayer.setChildren(newWebChildren);
+    if (m_transformLayer) {
+        m_transformLayer->setChildren(newWebChildren);
 
-        if (!m_contentsLayer.isNull()) {
+        if (m_contentsLayer) {
             // If we have a transform layer, then the contents layer is parented in the
             // primary layer (which is itself a child of the transform layer).
-            m_layer.removeAllChildren();
-            m_layer.addChild(m_contentsLayer);
+            m_layer->layer()->removeAllChildren();
+            m_layer->layer()->addChild(m_contentsLayer);
         }
     } else
-        m_layer.setChildren(newWebChildren);
+        m_layer->layer()->setChildren(newWebChildren);
 }
 
 void GraphicsLayerChromium::updateLayerPosition()
 {
-    primaryLayer().setPosition(m_position);
+    platformLayer()->setPosition(m_position);
 }
 
 void GraphicsLayerChromium::updateLayerSize()
 {
     IntSize layerSize(m_size.width(), m_size.height());
-    if (!m_transformLayer.isNull()) {
-        m_transformLayer.setBounds(layerSize);
-        m_layer.setPosition(FloatPoint());
+    if (m_transformLayer) {
+        m_transformLayer->setBounds(layerSize);
+        m_layer->layer()->setPosition(FloatPoint());
     }
 
-    m_layer.setBounds(layerSize);
+    m_layer->layer()->setBounds(layerSize);
 
-    // Note that we don't resize m_contentsLayer. It's up the caller to do that.
+    // Note that we don't resize m_contentsLayer-> It's up the caller to do that.
 }
 
 void GraphicsLayerChromium::updateAnchorPoint()
 {
-    primaryLayer().setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
-    primaryLayer().setAnchorPointZ(m_anchorPoint.z());
+    platformLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
+    platformLayer()->setAnchorPointZ(m_anchorPoint.z());
 }
 
 void GraphicsLayerChromium::updateTransform()
 {
-    primaryLayer().setTransform(WebTransformationMatrix(m_transform));
+    platformLayer()->setTransform(WebTransformationMatrix(m_transform));
 }
 
 void GraphicsLayerChromium::updateChildrenTransform()
 {
-    primaryLayer().setSublayerTransform(WebTransformationMatrix(m_childrenTransform));
+    platformLayer()->setSublayerTransform(WebTransformationMatrix(m_childrenTransform));
 }
 
 void GraphicsLayerChromium::updateMasksToBounds()
 {
-    m_layer.setMasksToBounds(m_masksToBounds);
+    m_layer->layer()->setMasksToBounds(m_masksToBounds);
     updateDebugIndicators();
 }
 
 void GraphicsLayerChromium::updateLayerPreserves3D()
 {
-    if (m_preserves3D && m_transformLayer.isNull()) {
+    if (m_preserves3D && !m_transformLayer) {
         // Create the transform layer.
-        m_transformLayer = WebLayer::create();
-        m_transformLayer.setPreserves3D(true);
-        m_transformLayer.setAnimationDelegate(this);
-        m_layer.transferAnimationsTo(&m_transformLayer);
+        m_transformLayer = adoptPtr(WebLayer::create());
+        m_transformLayer->setPreserves3D(true);
+        m_transformLayer->setAnimationDelegate(this);
+        m_layer->layer()->transferAnimationsTo(m_transformLayer.get());
 
         // Copy the position from this layer.
         updateLayerPosition();
@@ -730,34 +695,34 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         updateTransform();
         updateChildrenTransform();
 
-        m_layer.setPosition(FloatPoint::zero());
+        m_layer->layer()->setPosition(FloatPoint::zero());
 
-        m_layer.setAnchorPoint(FloatPoint(0.5f, 0.5f));
-        m_layer.setTransform(SkMatrix44());
+        m_layer->layer()->setAnchorPoint(FloatPoint(0.5f, 0.5f));
+        m_layer->layer()->setTransform(SkMatrix44());
 
         // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
-        m_layer.setOpacity(1);
+        m_layer->layer()->setOpacity(1);
 
-        m_layer.setContentsScale(contentsScale());
+        m_layer->setContentsScale(contentsScale());
 
         // Move this layer to be a child of the transform layer.
         if (parent())
-            parent()->platformLayer()->replaceChild(m_layer, m_transformLayer);
-        m_transformLayer.addChild(m_layer);
+            parent()->platformLayer()->replaceChild(m_layer->layer(), m_transformLayer.get());
+        m_transformLayer->addChild(m_layer->layer());
 
         updateChildList();
-    } else if (!m_preserves3D && !m_transformLayer.isNull()) {
+    } else if (m_preserves3D && !m_transformLayer) {
         // Relace the transformLayer in the parent with this layer.
-        m_layer.removeFromParent();
+        m_layer->layer()->removeFromParent();
         if (parent())
-            parent()->platformLayer()->replaceChild(m_transformLayer, m_layer);
+            parent()->platformLayer()->replaceChild(m_transformLayer.get(), m_layer->layer());
 
-        m_layer.setAnimationDelegate(this);
-        m_transformLayer.transferAnimationsTo(&m_layer);
+        m_layer->layer()->setAnimationDelegate(this);
+        m_transformLayer->transferAnimationsTo(m_layer->layer());
 
         // Release the transform layer.
-        m_transformLayer.setAnimationDelegate(0);
-        m_transformLayer.reset();
+        m_transformLayer->setAnimationDelegate(0);
+        m_transformLayer.clear();
 
         updateLayerPosition();
         updateLayerSize();
@@ -768,39 +733,42 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         updateChildList();
     }
 
-    m_layer.setPreserves3D(m_preserves3D);
-    primaryLayer().setOpacity(m_opacity);
+    m_layer->layer()->setPreserves3D(m_preserves3D);
+    platformLayer()->setOpacity(m_opacity);
     updateNames();
 }
 
 void GraphicsLayerChromium::updateLayerIsDrawable()
 {
     // For the rest of the accelerated compositor code, there is no reason to make a
-    // distinction between drawsContent and contentsVisible. So, for m_layer, these two
+    // distinction between drawsContent and contentsVisible. So, for m_layer->layer(), these two
     // flags are combined here. m_contentsLayer shouldn't receive the drawsContent flag
     // so it is only given contentsVisible.
 
-    m_layer.setDrawsContent(m_drawsContent && m_contentsVisible);
+    m_layer->layer()->setDrawsContent(m_drawsContent && m_contentsVisible);
 
-    if (!m_contentsLayer.isNull())
-        m_contentsLayer.setDrawsContent(m_contentsVisible);
+    if (m_contentsLayer)
+        m_contentsLayer->setDrawsContent(m_contentsVisible);
 
-    if (m_drawsContent)
-        m_layer.invalidate();
+    if (m_drawsContent) {
+        m_layer->layer()->invalidate();
+        if (m_linkHighlight)
+            m_linkHighlight->invalidate();
+    }
 
     updateDebugIndicators();
 }
 
 void GraphicsLayerChromium::updateLayerBackgroundColor()
 {
-    if (m_contentsLayer.isNull())
+    if (!m_contentsLayer)
         return;
 
     // We never create the contents layer just for background color yet.
     if (m_backgroundColorSet)
-        m_contentsLayer.setBackgroundColor(m_backgroundColor.rgb());
+        m_contentsLayer->setBackgroundColor(m_backgroundColor.rgb());
     else
-        m_contentsLayer.setBackgroundColor(static_cast<RGBA32>(0));
+        m_contentsLayer->setBackgroundColor(static_cast<RGBA32>(0));
 }
 
 void GraphicsLayerChromium::updateContentsVideo()
@@ -810,50 +778,42 @@ void GraphicsLayerChromium::updateContentsVideo()
 
 void GraphicsLayerChromium::updateContentsRect()
 {
-    if (m_contentsLayer.isNull())
+    if (!m_contentsLayer)
         return;
 
-    m_contentsLayer.setPosition(FloatPoint(m_contentsRect.x(), m_contentsRect.y()));
-    m_contentsLayer.setBounds(IntSize(m_contentsRect.width(), m_contentsRect.height()));
+    m_contentsLayer->setPosition(FloatPoint(m_contentsRect.x(), m_contentsRect.y()));
+    m_contentsLayer->setBounds(IntSize(m_contentsRect.width(), m_contentsRect.height()));
 }
 
 void GraphicsLayerChromium::updateContentsScale()
 {
     // If page scale is already applied then there's no need to apply it again.
-    if (appliesPageScale() || m_layer.isNull())
+    if (appliesPageScale())
         return;
 
-    m_layer.setContentsScale(contentsScale());
+    m_layer->setContentsScale(contentsScale());
 }
 
-void GraphicsLayerChromium::setupContentsLayer(WebLayer contentsLayer)
+void GraphicsLayerChromium::setupContentsLayer(WebLayer* contentsLayer)
 {
-    if (contentsLayer == m_contentsLayer)
-        return;
-
-    if (!m_contentsLayer.isNull()) {
-        m_contentsLayer.setUseParentBackfaceVisibility(false);
-        m_contentsLayer.removeFromParent();
-        m_contentsLayer.reset();
-    }
-
     m_contentsLayer = contentsLayer;
+    m_contentsLayerId = m_contentsLayer->id();
 
-    if (!m_contentsLayer.isNull()) {
-        m_contentsLayer.setAnchorPoint(FloatPoint(0, 0));
-        m_contentsLayer.setUseParentBackfaceVisibility(true);
+    if (m_contentsLayer) {
+        m_contentsLayer->setAnchorPoint(FloatPoint(0, 0));
+        m_contentsLayer->setUseParentBackfaceVisibility(true);
 
         // It is necessary to call setDrawsContent as soon as we receive the new contentsLayer, for
         // the correctness of early exit conditions in setDrawsContent() and setContentsVisible().
-        m_contentsLayer.setDrawsContent(m_contentsVisible);
+        m_contentsLayer->setDrawsContent(m_contentsVisible);
 
         // Insert the content layer first. Video elements require this, because they have
         // shadow content that must display in front of the video.
-        m_layer.insertChild(m_contentsLayer, 0);
+        m_layer->layer()->insertChild(m_contentsLayer, 0);
 
         if (showDebugBorders()) {
-            m_contentsLayer.setDebugBorderColor(Color(0, 0, 128, 180).rgb());
-            m_contentsLayer.setDebugBorderWidth(1);
+            m_contentsLayer->setDebugBorderColor(Color(0, 0, 128, 180).rgb());
+            m_contentsLayer->setDebugBorderWidth(1);
         }
     }
     updateDebugIndicators();
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index aa64ead6d..4fc8d1cfd 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -39,20 +39,32 @@
 
 #include <public/WebAnimationDelegate.h>
 #include <public/WebContentLayer.h>
+#include <public/WebImageLayer.h>
 #include <public/WebLayer.h>
 #include <wtf/HashMap.h>
 
 namespace WebCore {
 
 class LayerChromium;
-class LinkHighlight;
 class Path;
 
+class LinkHighlightClient {
+public:
+    virtual void invalidate() = 0;
+    virtual void clearCurrentGraphicsLayer() = 0;
+    virtual WebKit::WebLayer* layer() = 0;
+
+protected:
+    virtual ~LinkHighlightClient() { }
+};
+
 class GraphicsLayerChromium : public GraphicsLayer, public GraphicsContextPainter, public WebKit::WebAnimationDelegate {
 public:
     GraphicsLayerChromium(GraphicsLayerClient*);
     virtual ~GraphicsLayerChromium();
 
+    virtual void willBeDestroyed() OVERRIDE;
+
     virtual void setName(const String&);
 
     virtual bool setChildren(const Vector<GraphicsLayer*>&);
@@ -101,7 +113,7 @@ public:
     virtual void setContentsToImage(Image*);
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsToCanvas(PlatformLayer*);
-    virtual bool hasContentsLayer() const { return !m_contentsLayer.isNull(); }
+    virtual bool hasContentsLayer() const { return m_contentsLayer; }
 
     virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String&, double timeOffset);
     virtual void pauseAnimation(const String& animationName, double timeOffset);
@@ -109,8 +121,9 @@ public:
     virtual void suspendAnimations(double wallClockTime);
     virtual void resumeAnimations();
 
-    virtual void addLinkHighlight(const Path&);
-    virtual void didFinishLinkHighlight();
+    void setLinkHighlight(LinkHighlightClient*);
+    // Next function for testing purposes.
+    LinkHighlightClient* linkHighlight() { return m_linkHighlight; }
 
     virtual PlatformLayer* platformLayer() const;
 
@@ -125,15 +138,13 @@ public:
     virtual void notifyAnimationStarted(double startTime) OVERRIDE;
     virtual void notifyAnimationFinished(double finishTime) OVERRIDE;
 
+    WebKit::WebContentLayer* contentLayer() const { return m_layer.get(); }
+
     // Exposed for tests.
-    WebKit::WebLayer contentsLayer() const { return m_contentsLayer; }
+    WebKit::WebLayer* contentsLayer() const { return m_contentsLayer; }
     float contentsScale() const;
 
 private:
-    virtual void willBeDestroyed();
-
-    WebKit::WebLayer primaryLayer() const;
-
     void updateNames();
     void updateChildList();
     void updateLayerPosition();
@@ -151,32 +162,39 @@ private:
     void updateContentsRect();
     void updateContentsScale();
 
-    void setupContentsLayer(WebKit::WebLayer);
+    enum ContentsLayerPurpose {
+        NoContentsLayer = 0,
+        ContentsLayerForImage,
+        ContentsLayerForVideo,
+        ContentsLayerForCanvas,
+    };
+
+    void setContentsTo(ContentsLayerPurpose, WebKit::WebLayer*);
+    void setupContentsLayer(WebKit::WebLayer*);
 
     int mapAnimationNameToId(const String& animationName);
 
     String m_nameBase;
 
-    WebKit::WebContentLayer m_layer;
-    WebKit::WebLayer m_transformLayer;
-    WebKit::WebLayer m_contentsLayer;
+    OwnPtr<WebKit::WebContentLayer> m_layer;
+    OwnPtr<WebKit::WebLayer> m_transformLayer;
+    OwnPtr<WebKit::WebImageLayer> m_imageLayer;
+    WebKit::WebLayer* m_contentsLayer;
+    // We don't have ownership of m_contentsLayer, but we do want to know if a given layer is the
+    // same as our current layer in setContentsTo(). Since m_contentsLayer may be deleted at this point,
+    // we stash an ID away when we know m_contentsLayer is alive and use that for comparisons from that point
+    // on.
+    int m_contentsLayerId;
 
-    OwnPtr<OpaqueRectTrackingContentLayerDelegate> m_opaqueRectTrackingContentLayerDelegate;
+    LinkHighlightClient* m_linkHighlight;
 
-    enum ContentsLayerPurpose {
-        NoContentsLayer = 0,
-        ContentsLayerForImage,
-        ContentsLayerForVideo,
-        ContentsLayerForCanvas,
-    };
+    OwnPtr<OpaqueRectTrackingContentLayerDelegate> m_opaqueRectTrackingContentLayerDelegate;
 
     ContentsLayerPurpose m_contentsLayerPurpose;
     bool m_contentsLayerHasBackgroundColor : 1;
     bool m_inSetChildren;
     bool m_pageScaleChanged;
 
-    RefPtr<LinkHighlight> m_linkHighlight;
-
     typedef HashMap<String, int> AnimationIdMap;
     AnimationIdMap m_animationIdMap;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index f7e603ed8..f8d869fad 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -148,8 +148,7 @@ void ImageLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTr
         invalidateContentRect(IntRect(IntPoint(), contentBounds()));
         m_needsDisplay = false;
     }
-
-    updateContentRect(queue, visibleContentRect(), occlusion, stats);
+    TiledLayerChromium::update(queue, occlusion, stats);
 }
 
 void ImageLayerChromium::createTextureUpdaterIfNeeded()
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 30c81b65c..4e7fa74f5 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -234,10 +234,11 @@ void LayerChromium::setBounds(const IntSize& size)
         setNeedsCommit();
 }
 
-const LayerChromium* LayerChromium::rootLayer() const
+LayerChromium* LayerChromium::rootLayer()
 {
-    const LayerChromium* layer = this;
-    for (LayerChromium* parent = layer->parent(); parent; layer = parent, parent = parent->parent()) { }
+    LayerChromium* layer = this;
+    while (layer->parent())
+        layer = layer->parent();
     return layer;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index ec14a51a7..2e541ee7b 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -95,7 +95,7 @@ public:
     // The root layer is a special case -- it operates in physical pixels.
     virtual const WebKit::WebTransformationMatrix& transform() const OVERRIDE { return m_transform; }
 
-    const LayerChromium* rootLayer() const;
+    LayerChromium* rootLayer();
     LayerChromium* parent() const;
     void addChild(PassRefPtr<LayerChromium>);
     void insertChild(PassRefPtr<LayerChromium>, size_t index);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 36e47d177..84f00a1c7 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -363,7 +363,7 @@ static inline SkBitmap applyFilters(LayerRendererChromium* layerRenderer, const
 
     layerRenderer->context()->flush();
 
-    CCScopedLockResourceForWrite lock(layerRenderer->resourceProvider(), sourceTexture->id());
+    CCResourceProvider::ScopedWriteLockGL lock(layerRenderer->resourceProvider(), sourceTexture->id());
     SkBitmap source = CCRenderSurfaceFilters::apply(filters, lock.textureId(), sourceTexture->size(), filterContext, filterGrContext);
     return source;
 }
@@ -465,20 +465,20 @@ void LayerRendererChromium::drawRenderPassQuad(DrawingFrame& frame, const CCRend
     // FIXME: Cache this value so that we don't have to do it for both the surface and its replica.
     // Apply filters to the contents texture.
     SkBitmap filterBitmap = applyFilters(this, renderPass->filters(), contentsTexture);
-    OwnPtr<CCScopedLockResourceForRead> contentsResourceLock;
+    OwnPtr<CCResourceProvider::ScopedReadLockGL> contentsResourceLock;
     unsigned contentsTextureId = 0;
     if (filterBitmap.getTexture()) {
         GrTexture* texture = reinterpret_cast<GrTexture*>(filterBitmap.getTexture());
         contentsTextureId = texture->getTextureHandle();
     } else {
-        contentsResourceLock = adoptPtr(new CCScopedLockResourceForRead(m_resourceProvider, contentsTexture->id()));
+        contentsResourceLock = adoptPtr(new CCResourceProvider::ScopedReadLockGL(m_resourceProvider, contentsTexture->id()));
         contentsTextureId = contentsResourceLock->textureId();
     }
 
     // Draw the background texture if there is one.
     if (backgroundTexture) {
         ASSERT(backgroundTexture->size() == quad->quadRect().size());
-        CCScopedLockResourceForRead lock(m_resourceProvider, backgroundTexture->id());
+        CCResourceProvider::ScopedReadLockGL lock(m_resourceProvider, backgroundTexture->id());
         copyTextureToFramebuffer(frame, lock.textureId(), quad->quadRect(), quad->quadTransform());
     }
 
@@ -495,10 +495,10 @@ void LayerRendererChromium::drawRenderPassQuad(DrawingFrame& frame, const CCRend
         deviceLayerEdges.inflateAntiAliasingDistance();
     }
 
-    OwnPtr<CCScopedLockResourceForRead> maskResourceLock;
+    OwnPtr<CCResourceProvider::ScopedReadLockGL> maskResourceLock;
     unsigned maskTextureId = 0;
     if (quad->maskResourceId()) {
-        maskResourceLock = adoptPtr(new CCScopedLockResourceForRead(m_resourceProvider, quad->maskResourceId()));
+        maskResourceLock = adoptPtr(new CCResourceProvider::ScopedReadLockGL(m_resourceProvider, quad->maskResourceId()));
         maskTextureId = maskResourceLock->textureId();
     }
 
@@ -689,7 +689,7 @@ void LayerRendererChromium::drawTileQuad(const DrawingFrame& frame, const CCTile
     GLC(context(), context()->useProgram(uniforms.program));
     GLC(context(), context()->uniform1i(uniforms.samplerLocation, 0));
     GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE0));
-    CCScopedLockResourceForRead quadResourceLock(m_resourceProvider, quad->resourceId());
+    CCResourceProvider::ScopedReadLockGL quadResourceLock(m_resourceProvider, quad->resourceId());
     GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, quadResourceLock.textureId()));
     GLC(context(), context()->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, quad->textureFilter()));
     GLC(context(), context()->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, quad->textureFilter()));
@@ -796,9 +796,9 @@ void LayerRendererChromium::drawYUVVideoQuad(const DrawingFrame& frame, const CC
     const CCVideoLayerImpl::FramePlane& uPlane = quad->uPlane();
     const CCVideoLayerImpl::FramePlane& vPlane = quad->vPlane();
 
-    CCScopedLockResourceForRead yPlaneLock(m_resourceProvider, yPlane.resourceId);
-    CCScopedLockResourceForRead uPlaneLock(m_resourceProvider, uPlane.resourceId);
-    CCScopedLockResourceForRead vPlaneLock(m_resourceProvider, vPlane.resourceId);
+    CCResourceProvider::ScopedReadLockGL yPlaneLock(m_resourceProvider, yPlane.resourceId);
+    CCResourceProvider::ScopedReadLockGL uPlaneLock(m_resourceProvider, uPlane.resourceId);
+    CCResourceProvider::ScopedReadLockGL vPlaneLock(m_resourceProvider, vPlane.resourceId);
     GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE1));
     GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, yPlaneLock.textureId()));
     GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE2));
@@ -907,7 +907,7 @@ void LayerRendererChromium::drawTextureQuad(const DrawingFrame& frame, const CCT
     GLC(context(), context()->uniform4f(binding.texTransformLocation, uvRect.x(), uvRect.y(), uvRect.width(), uvRect.height()));
 
     GLC(context(), context()->activeTexture(GraphicsContext3D::TEXTURE0));
-    CCScopedLockResourceForRead quadResourceLock(m_resourceProvider, quad->resourceId());
+    CCResourceProvider::ScopedReadLockGL quadResourceLock(m_resourceProvider, quad->resourceId());
     GLC(context(), context()->bindTexture(GraphicsContext3D::TEXTURE_2D, quadResourceLock.textureId()));
 
     // FIXME: setting the texture parameters every time is redundant. Move this code somewhere
@@ -1199,7 +1199,7 @@ bool LayerRendererChromium::getFramebufferTexture(CCScopedTexture* texture, cons
     if (!texture->id() && !texture->allocate(CCRenderer::ImplPool, deviceRect.size(), GraphicsContext3D::RGB, CCResourceProvider::TextureUsageAny))
         return false;
 
-    CCScopedLockResourceForWrite lock(m_resourceProvider, texture->id());
+    CCResourceProvider::ScopedWriteLockGL lock(m_resourceProvider, texture->id());
     GLC(m_context, m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, lock.textureId()));
     GLC(m_context, m_context->copyTexImage2D(GraphicsContext3D::TEXTURE_2D, 0, texture->format(),
                                              deviceRect.x(), deviceRect.y(), deviceRect.width(), deviceRect.height(), 0));
@@ -1226,7 +1226,7 @@ bool LayerRendererChromium::bindFramebufferToTexture(DrawingFrame& frame, const
     ASSERT(texture->id());
 
     GLC(m_context, m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_offscreenFramebufferId));
-    m_currentFramebufferLock = adoptPtr(new CCScopedLockResourceForWrite(m_resourceProvider, texture->id()));
+    m_currentFramebufferLock = adoptPtr(new CCResourceProvider::ScopedWriteLockGL(m_resourceProvider, texture->id()));
     unsigned textureId = m_currentFramebufferLock->textureId();
     GLC(m_context, m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, textureId, 0));
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 09cd0e291..3575c193d 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -248,7 +248,7 @@ private:
     bool m_visible;
     TextureUploaderOption m_textureUploaderSetting;
 
-    OwnPtr<CCScopedLockResourceForWrite> m_currentFramebufferLock;
+    OwnPtr<CCResourceProvider::ScopedWriteLockGL> m_currentFramebufferLock;
 };
 
 
diff --git a/Source/WebCore/platform/graphics/chromium/LinkHighlight.cpp b/Source/WebCore/platform/graphics/chromium/LinkHighlight.cpp
deleted file mode 100644
index 1d447304f..000000000
--- a/Source/WebCore/platform/graphics/chromium/LinkHighlight.cpp
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include "LinkHighlight.h"
-
-#include "CCKeyframedAnimationCurve.h"
-#include "GraphicsLayerChromium.h"
-#include "PlatformContextSkia.h"
-#include <wtf/CurrentTime.h>
-#include <wtf/OwnPtr.h>
-
-#if USE(ACCELERATED_COMPOSITING)
-
-using WebKit::WebTransformationMatrix;
-
-namespace WebCore {
-
-PassRefPtr<LinkHighlight> LinkHighlight::create(GraphicsLayerChromium* parent, const Path& path, int animationId, int groupId)
-{
-    return adoptRef(new LinkHighlight(parent, path, animationId, groupId));
-}
-
-LinkHighlight::LinkHighlight(GraphicsLayerChromium* parent, const Path& path, int animationId, int groupId)
-    : m_contentLayer(ContentLayerChromium::create(this))
-    , m_parent(parent)
-    , m_path(path)
-{
-    m_contentLayer->setIsDrawable(true);
-
-    IntRect rect = enclosingIntRect(path.boundingRect());
-
-    m_contentLayer->setBounds(rect.size());
-
-    WebTransformationMatrix transform;
-    transform.translate(rect.x() + rect.width() / 2, rect.y() + rect.height() / 2);
-    m_contentLayer->setTransform(transform);
-
-    m_path.translate(FloatSize(-rect.x(), -rect.y()));
-
-    m_contentLayer->setLayerAnimationDelegate(this);
-
-    // FIXME: Should these be configurable?
-    const float startOpacity = 0.25;
-    const float duration = 2;
-
-    m_contentLayer->setOpacity(startOpacity);
-
-    OwnPtr<CCKeyframedFloatAnimationCurve> curve(CCKeyframedFloatAnimationCurve::create());
-    curve->addKeyframe(CCFloatKeyframe::create(0, startOpacity, nullptr));
-    curve->addKeyframe(CCFloatKeyframe::create(duration / 2, startOpacity, nullptr));
-    curve->addKeyframe(CCFloatKeyframe::create(duration, 0, nullptr));
-
-    // animationId = 1 is reserved for us.
-    OwnPtr<CCActiveAnimation> animation(CCActiveAnimation::create(curve.release(), animationId, groupId, CCActiveAnimation::Opacity));
-    animation->setNeedsSynchronizedStartTime(true);
-    m_contentLayer->layerAnimationController()->addAnimation(animation.release());
-}
-
-LinkHighlight::~LinkHighlight()
-{
-    m_contentLayer->removeFromParent();
-    m_contentLayer->clearDelegate();
-    m_contentLayer->setLayerAnimationDelegate(0);
-}
-
-ContentLayerChromium* LinkHighlight::contentLayer()
-{
-    return m_contentLayer.get();
-}
-
-void LinkHighlight::paintContents(SkCanvas* canvas, const IntRect&, FloatRect&)
-{
-    PlatformContextSkia platformContext(canvas);
-    GraphicsContext gc(&platformContext);
-    // FIXME: make colour configurable?
-    gc.setStrokeColor(Color(0, 0, 255, 255), ColorSpaceDeviceRGB);
-    gc.setStrokeThickness(2);
-    gc.strokePath(m_path);
-    gc.setFillColor(Color(255, 0, 255, 255), ColorSpaceDeviceRGB);
-    gc.fillPath(m_path);
-}
-
-void LinkHighlight::notifyAnimationStarted(double)
-{
-}
-
-void LinkHighlight::notifyAnimationFinished(double)
-{
-    // Allow null parent pointer to facilitate testing.
-    if (m_parent)
-        m_parent->didFinishLinkHighlight();
-}
-
-} // namespace WebCore
-
-#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/LinkHighlight.h b/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
deleted file mode 100644
index 2f97cab79..000000000
--- a/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef LinkHighlight_h
-#define LinkHighlight_h
-
-#include "ContentLayerChromium.h"
-#include "Path.h"
-#include <public/WebAnimationDelegate.h>
-#include <wtf/RefPtr.h>
-
-#if USE(ACCELERATED_COMPOSITING)
-
-namespace WebCore {
-
-class GraphicsLayerChromium;
-
-class LinkHighlight : public RefCounted<LinkHighlight>, public ContentLayerDelegate, public WebKit::WebAnimationDelegate {
-public:
-    static PassRefPtr<LinkHighlight> create(GraphicsLayerChromium* parent, const Path&, int animationId, int groupId);
-    virtual ~LinkHighlight();
-
-    ContentLayerChromium* contentLayer();
-
-    // ContentLayerDelegate implementation.
-    virtual void paintContents(SkCanvas*, const IntRect& clipRect, FloatRect& opaque) OVERRIDE;
-
-    // WebAnimationDelegate implementation.
-    virtual void notifyAnimationStarted(double time) OVERRIDE;
-    virtual void notifyAnimationFinished(double time) OVERRIDE;
-
-private:
-    LinkHighlight(GraphicsLayerChromium* parent, const Path&, int animationId, int groupId);
-
-    RefPtr<ContentLayerChromium> m_contentLayer;
-    GraphicsLayerChromium* m_parent;
-    Path m_path;
-};
-
-} // namespace WebCore
-
-#endif // USE(ACCELERATED_COMPOSITING)
-
-#endif
diff --git a/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
index a3dbd770a..579fa2860 100644
--- a/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SimpleFontDataChromiumWin.cpp
@@ -81,6 +81,8 @@ void SimpleFontData::platformInit()
 
     OUTLINETEXTMETRIC outlineTextMetric;
     if (GetOutlineTextMetrics(dc, sizeof(outlineTextMetric), &outlineTextMetric) > 0) {
+        m_fontMetrics.setUnitsPerEm(outlineTextMetric.otmEMSquare);
+
         // This is a TrueType font.  We might be able to get an accurate xHeight.
         GLYPHMETRICS glyphMetrics = {0};
         MAT2 identityMatrix = {{0, 1}, {0, 0}, {0, 0}, {0, 1}};
@@ -114,7 +116,7 @@ PassOwnPtr<SimpleFontData> SimpleFontData::createScaledFontData(const FontDescri
     float scaledSize = scaleFactor * fontDescription.computedSize();
     winFont.lfHeight = -lroundf(scaledSize);
     HFONT hfont = CreateFontIndirect(&winFont);
-    return adoptPtr(new SimpleFontData(FontPlatformData(hfont, scaledSize), isCustomFont(), false));
+    return adoptPtr(new SimpleFontData(FontPlatformData(hfont, scaledSize, m_platformData.orientation()), isCustomFont(), false));
 }
 
 SimpleFontData* SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
@@ -168,9 +170,28 @@ void SimpleFontData::determinePitch()
     SelectObject(dc, oldFont);
 }
 
-FloatRect SimpleFontData::platformBoundsForGlyph(Glyph) const
+FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
 {
-    return FloatRect();
+    HWndDC hdc(0);
+    SetGraphicsMode(hdc, GM_ADVANCED);
+    HGDIOBJ oldFont = SelectObject(hdc, m_platformData.hfont());
+
+    GLYPHMETRICS gdiMetrics;
+    static const MAT2 identity = { 0, 1,  0, 0,  0, 0,  0, 1 };
+    if (GetGlyphOutline(hdc, glyph, GGO_METRICS | GGO_GLYPH_INDEX, &gdiMetrics, 0, 0, &identity) == -1) {
+        if (PlatformSupport::ensureFontLoaded(m_platformData.hfont())) {
+            // Retry GetTextMetrics.
+            // FIXME: Handle gracefully the error if this call also fails.
+            // See http://crbug.com/6401.
+            if (GetGlyphOutline(hdc, glyph, GGO_METRICS | GGO_GLYPH_INDEX, &gdiMetrics, 0, 0, &identity) == -1)
+                LOG_ERROR("Unable to get the glyph metrics after second attempt");
+        }
+    }
+
+    SelectObject(hdc, oldFont);
+
+    return FloatRect(gdiMetrics.gmptGlyphOrigin.x, -gdiMetrics.gmptGlyphOrigin.y,
+        gdiMetrics.gmBlackBoxX, gdiMetrics.gmBlackBoxY);
 }
 
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index cce163522..68bfa45b0 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -553,11 +553,6 @@ void TiledLayerChromium::updateTileTextures(const IntRect& paintRect, int left,
     }
 }
 
-void TiledLayerChromium::setTexturePriorities(const CCPriorityCalculator& priorityCalc)
-{
-    setTexturePrioritiesInRect(priorityCalc, visibleContentRect());
-}
-
 namespace {
 // This picks a small animated layer to be anything less than one viewport. This
 // is specifically for page transitions which are viewport-sized layers. The extra
@@ -592,7 +587,7 @@ void setPriorityForTexture(const CCPriorityCalculator& priorityCalc,
 }
 }
 
-void TiledLayerChromium::setTexturePrioritiesInRect(const CCPriorityCalculator& priorityCalc, const IntRect& visibleContentRect)
+void TiledLayerChromium::setTexturePriorities(const CCPriorityCalculator& priorityCalc)
 {
     updateBounds();
     resetUpdateState();
@@ -604,7 +599,7 @@ void TiledLayerChromium::setTexturePrioritiesInRect(const CCPriorityCalculator&
     bool smallAnimatedLayer = isSmallAnimatedLayer(this);
 
     // Minimally create the tiles in the desired pre-paint rect.
-    IntRect createTilesRect = idlePaintRect(visibleContentRect);
+    IntRect createTilesRect = idlePaintRect();
     if (!createTilesRect.isEmpty()) {
         int left, top, right, bottom;
         m_tiler->contentRectToTileIndices(createTilesRect, left, top, right, bottom);
@@ -618,7 +613,7 @@ void TiledLayerChromium::setTexturePrioritiesInRect(const CCPriorityCalculator&
 
     // Also, minimally create all tiles for small animated layers and also
     // double-buffer them since we have limited their size to be reasonable.
-    IntRect doubleBufferedRect = visibleContentRect;
+    IntRect doubleBufferedRect = visibleContentRect();
     if (smallAnimatedLayer)
         doubleBufferedRect = IntRect(IntPoint::zero(), contentBounds());
 
@@ -647,7 +642,7 @@ void TiledLayerChromium::setTexturePrioritiesInRect(const CCPriorityCalculator&
                 IntRect tileRect = m_tiler->tileRect(tile);
                 tile->dirtyRect = tileRect;
                 LayerTextureUpdater::Texture* backBuffer = tile->texture();
-                setPriorityForTexture(priorityCalc, visibleContentRect, tile->dirtyRect, drawsToRoot, smallAnimatedLayer, backBuffer->texture());
+                setPriorityForTexture(priorityCalc, visibleContentRect(), tile->dirtyRect, drawsToRoot, smallAnimatedLayer, backBuffer->texture());
                 OwnPtr<CCPrioritizedTexture> frontBuffer = CCPrioritizedTexture::create(backBuffer->texture()->textureManager(),
                                                                                         backBuffer->texture()->size(),
                                                                                         backBuffer->texture()->format());
@@ -665,7 +660,7 @@ void TiledLayerChromium::setTexturePrioritiesInRect(const CCPriorityCalculator&
         if (!tile)
             continue;
         IntRect tileRect = m_tiler->tileRect(tile);
-        setPriorityForTexture(priorityCalc, visibleContentRect, tileRect, drawsToRoot, smallAnimatedLayer, tile->managedTexture());
+        setPriorityForTexture(priorityCalc, visibleContentRect(), tileRect, drawsToRoot, smallAnimatedLayer, tile->managedTexture());
     }
 }
 
@@ -680,6 +675,9 @@ Region TiledLayerChromium::visibleContentOpaqueRegion() const
 
 void TiledLayerChromium::resetUpdateState()
 {
+    m_skipsDraw = false;
+    m_failedUpdate = false;
+
     CCLayerTilingData::TileMap::const_iterator end = m_tiler->tiles().end();
     for (CCLayerTilingData::TileMap::const_iterator iter = m_tiler->tiles().begin(); iter != end; ++iter) {
         UpdatableTile* tile = static_cast<UpdatableTile*>(iter->second.get());
@@ -690,13 +688,11 @@ void TiledLayerChromium::resetUpdateState()
     }
 }
 
-void TiledLayerChromium::updateContentRect(CCTextureUpdateQueue& queue, const IntRect& contentRect, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
+void TiledLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
 {
-    m_skipsDraw = false;
-    m_failedUpdate = false;
+    ASSERT(!m_skipsDraw && !m_failedUpdate); // Did resetUpdateState get skipped?
     updateBounds();
-
-    if (m_tiler->hasEmptyBounds())
+    if (m_tiler->hasEmptyBounds() || !drawsContent())
         return;
 
     bool didPaint = false;
@@ -715,12 +711,12 @@ void TiledLayerChromium::updateContentRect(CCTextureUpdateQueue& queue, const In
         m_failedUpdate = false;
     }
 
-    if (contentRect.isEmpty())
+    if (visibleContentRect().isEmpty())
         return;
 
     // Visible painting. First occlude visible tiles and paint the non-occluded tiles.
     int left, top, right, bottom;
-    m_tiler->contentRectToTileIndices(contentRect, left, top, right, bottom);
+    m_tiler->contentRectToTileIndices(visibleContentRect(), left, top, right, bottom);
     markOcclusionsAndRequestTextures(left, top, right, bottom, occlusion);
     m_skipsDraw = !updateTiles(left, top, right, bottom, queue, occlusion, stats, didPaint);
     if (m_skipsDraw)
@@ -729,7 +725,7 @@ void TiledLayerChromium::updateContentRect(CCTextureUpdateQueue& queue, const In
         return;
 
     // If we have already painting everything visible. Do some pre-painting while idle.
-    IntRect idlePaintContentRect = idlePaintRect(contentRect);
+    IntRect idlePaintContentRect = idlePaintRect();
     if (idlePaintContentRect.isEmpty())
         return;
 
@@ -765,13 +761,13 @@ void TiledLayerChromium::updateContentRect(CCTextureUpdateQueue& queue, const In
     }
 }
 
-bool TiledLayerChromium::needsIdlePaint(const IntRect& visibleContentRect)
+bool TiledLayerChromium::needsIdlePaint()
 {
     // Don't trigger more paints if we failed (as we'll just fail again).
-    if (m_failedUpdate || visibleContentRect.isEmpty() || m_tiler->hasEmptyBounds())
+    if (m_failedUpdate || visibleContentRect().isEmpty() || m_tiler->hasEmptyBounds() || !drawsContent())
         return false;
 
-    IntRect idlePaintContentRect = idlePaintRect(visibleContentRect);
+    IntRect idlePaintContentRect = idlePaintRect();
     if (idlePaintContentRect.isEmpty())
         return false;
 
@@ -795,15 +791,15 @@ bool TiledLayerChromium::needsIdlePaint(const IntRect& visibleContentRect)
     return false;
 }
 
-IntRect TiledLayerChromium::idlePaintRect(const IntRect& visibleContentRect)
+IntRect TiledLayerChromium::idlePaintRect()
 {
     // Don't inflate an empty rect.
-    if (visibleContentRect.isEmpty())
-        return visibleContentRect;
+    if (visibleContentRect().isEmpty())
+        return IntRect();
 
     // FIXME: This can be made a lot larger now! We should increase
     //        this slowly while insuring it doesn't cause any perf issues.
-    IntRect prepaintRect = visibleContentRect;
+    IntRect prepaintRect = visibleContentRect();
     prepaintRect.inflateX(m_tiler->tileSize().width());
     prepaintRect.inflateY(m_tiler->tileSize().height() * 2);
     IntRect contentRect(IntPoint::zero(), contentBounds());
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
index 33263e543..2abc11298 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
@@ -60,6 +60,8 @@ public:
 
     virtual Region visibleContentOpaqueRegion() const OVERRIDE;
 
+    virtual void update(CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&) OVERRIDE;
+
 protected:
     TiledLayerChromium();
 
@@ -82,13 +84,9 @@ protected:
     // Reset state on tiles that will be used for updating the layer.
     void resetUpdateState();
 
-    // Prepare data needed to update textures that intersect with contentRect.
-    void updateContentRect(CCTextureUpdateQueue&, const IntRect& contentRect, const CCOcclusionTracker*, CCRenderingStats&);
-
     // After preparing an update, returns true if more painting is needed.
-    bool needsIdlePaint(const IntRect& visibleContentRect);
-
-    IntRect idlePaintRect(const IntRect& visibleContentRect);
+    bool needsIdlePaint();
+    IntRect idlePaintRect();
 
     bool skipsDraw() const { return m_skipsDraw; }
 
@@ -104,8 +102,6 @@ private:
     bool tileOnlyNeedsPartialUpdate(UpdatableTile*);
     bool tileNeedsBufferedUpdate(UpdatableTile*);
 
-    void setTexturePrioritiesInRect(const CCPriorityCalculator&, const IntRect& visibleContentRect);
-
     void markOcclusionsAndRequestTextures(int left, int top, int right, int bottom, const CCOcclusionTracker*);
 
     bool updateTiles(int left, int top, int right, int bottom, CCTextureUpdateQueue&, const CCOcclusionTracker*, CCRenderingStats&, bool& didPaint);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
index 8a5d6af9d..fb36b4cae 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
@@ -31,6 +31,7 @@
 #include "IntRect.h"
 #include "LayerRendererChromium.h" // For the GLC() macro
 #include "LayerTextureSubImage.h"
+#include <limits.h>
 #include <public/WebGraphicsContext3D.h>
 #include <wtf/HashSet.h>
 
@@ -88,13 +89,24 @@ bool CCResourceProvider::inUseByConsumer(ResourceId id)
 
 CCResourceProvider::ResourceId CCResourceProvider::createResource(int pool, const IntSize& size, GC3Denum format, TextureUsageHint hint)
 {
+    switch (m_defaultResourceType) {
+    case GLTexture:
+        return createGLTexture(pool, size, format, hint);
+    case Bitmap:
+        ASSERT(format == GraphicsContext3D::RGBA);
+        return createBitmap(pool, size);
+    }
+
+    CRASH();
+    return 0;
+}
+
+CCResourceProvider::ResourceId CCResourceProvider::createGLTexture(int pool, const IntSize& size, GC3Denum format, TextureUsageHint hint)
+{
     ASSERT(CCProxy::isImplThread());
     unsigned textureId = 0;
     WebGraphicsContext3D* context3d = m_context->context3D();
-    if (!context3d) {
-        // FIXME: Implement this path for software compositing.
-        return 0;
-    }
+    ASSERT(context3d);
     GLC(context3d, textureId = context3d->createTexture());
     GLC(context3d, context3d->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
     GLC(context3d, context3d->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR));
@@ -115,12 +127,24 @@ CCResourceProvider::ResourceId CCResourceProvider::createResource(int pool, cons
     return id;
 }
 
+CCResourceProvider::ResourceId CCResourceProvider::createBitmap(int pool, const IntSize& size)
+{
+    ASSERT(CCProxy::isImplThread());
+
+    uint8_t* pixels = new uint8_t[size.width() * size.height() * 4];
+
+    ResourceId id = m_nextId++;
+    Resource resource(pixels, pool, size, GraphicsContext3D::RGBA);
+    m_resources.add(id, resource);
+    return id;
+}
+
 CCResourceProvider::ResourceId CCResourceProvider::createResourceFromExternalTexture(unsigned textureId)
 {
     ASSERT(CCProxy::isImplThread());
+    ASSERT(m_context->context3D());
     ResourceId id = m_nextId++;
-    Resource resource;
-    resource.glId = textureId;
+    Resource resource(textureId, 0, IntSize(), 0);
     resource.external = true;
     m_resources.add(id, resource);
     return id;
@@ -129,15 +153,17 @@ CCResourceProvider::ResourceId CCResourceProvider::createResourceFromExternalTex
 void CCResourceProvider::deleteResource(ResourceId id)
 {
     ASSERT(CCProxy::isImplThread());
-    WebGraphicsContext3D* context3d = m_context->context3D();
-    if (!context3d) {
-        // FIXME: Implement this path for software compositing.
-        return;
-    }
     ResourceMap::iterator it = m_resources.find(id);
     ASSERT(it != m_resources.end() && !it->second.lockedForWrite && !it->second.lockForReadCount);
-    if (!it->second.external)
+
+    if (it->second.glId && !it->second.external) {
+        WebGraphicsContext3D* context3d = m_context->context3D();
+        ASSERT(context3d);
         GLC(context3d, context3d->deleteTexture(it->second.glId));
+    }
+    if (it->second.pixels)
+        delete it->second.pixels;
+
     m_resources.remove(it);
 }
 
@@ -153,71 +179,68 @@ void CCResourceProvider::deleteOwnedResources(int pool)
         deleteResource(*it);
 }
 
-void CCResourceProvider::upload(ResourceId id, const uint8_t* image, const IntRect& imageRect, const IntRect& sourceRect, const IntSize& destOffset)
+CCResourceProvider::ResourceType CCResourceProvider::resourceType(ResourceId id)
 {
-    ASSERT(CCProxy::isImplThread());
-    ASSERT(m_texSubImage.get());
-    WebGraphicsContext3D* context3d = m_context->context3D();
-    if (!context3d) {
-        // FIXME: Implement this path for software compositing.
-        return;
-    }
     ResourceMap::iterator it = m_resources.find(id);
-    ASSERT(it != m_resources.end() && !it->second.lockedForWrite && !it->second.lockForReadCount && !it->second.external);
-
-    context3d->bindTexture(GraphicsContext3D::TEXTURE_2D, it->second.glId);
-    m_texSubImage->upload(image, imageRect, sourceRect, destOffset, it->second.format, context3d);
+    ASSERT(it != m_resources.end());
+    return it->second.type;
 }
 
-unsigned CCResourceProvider::lockForWrite(ResourceId id)
+void CCResourceProvider::upload(ResourceId id, const uint8_t* image, const IntRect& imageRect, const IntRect& sourceRect, const IntSize& destOffset)
 {
     ASSERT(CCProxy::isImplThread());
     ResourceMap::iterator it = m_resources.find(id);
     ASSERT(it != m_resources.end() && !it->second.lockedForWrite && !it->second.lockForReadCount && !it->second.external);
-    it->second.lockedForWrite = true;
-    return it->second.glId;
-}
 
-void CCResourceProvider::unlockForWrite(ResourceId id)
-{
-    ASSERT(CCProxy::isImplThread());
-    ResourceMap::iterator it = m_resources.find(id);
-    ASSERT(it != m_resources.end() && it->second.lockedForWrite && !it->second.external);
-    it->second.lockedForWrite = false;
+    if (it->second.glId) {
+        WebGraphicsContext3D* context3d = m_context->context3D();
+        ASSERT(context3d);
+        ASSERT(m_texSubImage.get());
+        context3d->bindTexture(GraphicsContext3D::TEXTURE_2D, it->second.glId);
+        m_texSubImage->upload(image, imageRect, sourceRect, destOffset, it->second.format, context3d);
+    }
+
+    if (it->second.pixels) {
+        SkBitmap srcFull;
+        srcFull.setConfig(SkBitmap::kARGB_8888_Config, imageRect.width(), imageRect.height());
+        srcFull.setPixels(const_cast<uint8_t*>(image));
+        SkBitmap srcSubset;
+        SkIRect skSourceRect = SkIRect::MakeXYWH(sourceRect.x(), sourceRect.y(), sourceRect.width(), sourceRect.height());
+        skSourceRect.offset(-imageRect.x(), -imageRect.y());
+        srcFull.extractSubset(&srcSubset, skSourceRect);
+
+        ScopedWriteLockSoftware lock(this, id);
+        SkCanvas* dest = lock.skCanvas();
+        dest->writePixels(srcSubset, destOffset.width(), destOffset.height());
+    }
 }
 
 void CCResourceProvider::flush()
 {
     ASSERT(CCProxy::isImplThread());
     WebGraphicsContext3D* context3d = m_context->context3D();
-    if (!context3d) {
-        // FIXME: Implement this path for software compositing.
-        return;
-    }
-    context3d->flush();
+    if (context3d)
+        context3d->flush();
 }
 
 bool CCResourceProvider::shallowFlushIfSupported()
 {
     ASSERT(CCProxy::isImplThread());
     WebGraphicsContext3D* context3d = m_context->context3D();
-    if (!context3d) {
-        // FIXME: Implement this path for software compositing.
+    if (!context3d || !m_useShallowFlush)
         return false;
-    }
 
-    if (m_useShallowFlush)
-        context3d->shallowFlushCHROMIUM();
-    return m_useShallowFlush;
+    context3d->shallowFlushCHROMIUM();
+    return true;
 }
 
-unsigned CCResourceProvider::lockForRead(ResourceId id)
+const CCResourceProvider::Resource* CCResourceProvider::lockForRead(ResourceId id)
 {
     ASSERT(CCProxy::isImplThread());
     ResourceMap::iterator it = m_resources.find(id);
     ASSERT(it != m_resources.end() && !it->second.lockedForWrite);
-    ++(it->second.lockForReadCount);
-    return it->second.glId;
+    it->second.lockForReadCount++;
+    return &it->second;
 }
 
 void CCResourceProvider::unlockForRead(ResourceId id)
@@ -225,13 +248,90 @@ void CCResourceProvider::unlockForRead(ResourceId id)
     ASSERT(CCProxy::isImplThread());
     ResourceMap::iterator it = m_resources.find(id);
     ASSERT(it != m_resources.end() && it->second.lockForReadCount > 0);
-    --(it->second.lockForReadCount);
+    it->second.lockForReadCount--;
+}
+
+const CCResourceProvider::Resource* CCResourceProvider::lockForWrite(ResourceId id)
+{
+    ASSERT(CCProxy::isImplThread());
+    ResourceMap::iterator it = m_resources.find(id);
+    ASSERT(it != m_resources.end() && !it->second.lockedForWrite && !it->second.lockForReadCount && !it->second.external);
+    it->second.lockedForWrite = true;
+    return &it->second;
+}
+
+void CCResourceProvider::unlockForWrite(ResourceId id)
+{
+    ASSERT(CCProxy::isImplThread());
+    ResourceMap::iterator it = m_resources.find(id);
+    ASSERT(it != m_resources.end() && it->second.lockedForWrite && !it->second.external);
+    it->second.lockedForWrite = false;
+}
+
+CCResourceProvider::ScopedReadLockGL::ScopedReadLockGL(CCResourceProvider* resourceProvider, CCResourceProvider::ResourceId resourceId)
+    : m_resourceProvider(resourceProvider)
+    , m_resourceId(resourceId)
+    , m_textureId(resourceProvider->lockForRead(resourceId)->glId)
+{
+    ASSERT(m_textureId);
+}
+
+CCResourceProvider::ScopedReadLockGL::~ScopedReadLockGL()
+{
+    m_resourceProvider->unlockForRead(m_resourceId);
+}
+
+CCResourceProvider::ScopedWriteLockGL::ScopedWriteLockGL(CCResourceProvider* resourceProvider, CCResourceProvider::ResourceId resourceId)
+    : m_resourceProvider(resourceProvider)
+    , m_resourceId(resourceId)
+    , m_textureId(resourceProvider->lockForWrite(resourceId)->glId)
+{
+    ASSERT(m_textureId);
+}
+
+CCResourceProvider::ScopedWriteLockGL::~ScopedWriteLockGL()
+{
+    m_resourceProvider->unlockForWrite(m_resourceId);
+}
+
+void CCResourceProvider::populateSkBitmapWithResource(SkBitmap* skBitmap, const Resource* resource)
+{
+    ASSERT(resource->pixels);
+    ASSERT(resource->format == GraphicsContext3D::RGBA);
+    skBitmap->setConfig(SkBitmap::kARGB_8888_Config, resource->size.width(), resource->size.height());
+    skBitmap->setPixels(resource->pixels);
+}
+
+CCResourceProvider::ScopedReadLockSoftware::ScopedReadLockSoftware(CCResourceProvider* resourceProvider, CCResourceProvider::ResourceId resourceId)
+    : m_resourceProvider(resourceProvider)
+    , m_resourceId(resourceId)
+{
+    CCResourceProvider::populateSkBitmapWithResource(&m_skBitmap, resourceProvider->lockForRead(resourceId));
+}
+
+CCResourceProvider::ScopedReadLockSoftware::~ScopedReadLockSoftware()
+{
+    m_resourceProvider->unlockForRead(m_resourceId);
+}
+
+CCResourceProvider::ScopedWriteLockSoftware::ScopedWriteLockSoftware(CCResourceProvider* resourceProvider, CCResourceProvider::ResourceId resourceId)
+    : m_resourceProvider(resourceProvider)
+    , m_resourceId(resourceId)
+{
+    CCResourceProvider::populateSkBitmapWithResource(&m_skBitmap, resourceProvider->lockForWrite(resourceId));
+    m_skCanvas.setBitmapDevice(m_skBitmap);
+}
+
+CCResourceProvider::ScopedWriteLockSoftware::~ScopedWriteLockSoftware()
+{
+    m_resourceProvider->unlockForWrite(m_resourceId);
 }
 
 CCResourceProvider::CCResourceProvider(CCGraphicsContext* context)
     : m_context(context)
     , m_nextId(1)
     , m_nextChild(1)
+    , m_defaultResourceType(GLTexture)
     , m_useTextureStorageExt(false)
     , m_useTextureUsageHint(false)
     , m_useShallowFlush(false)
@@ -243,10 +343,15 @@ bool CCResourceProvider::initialize()
 {
     ASSERT(CCProxy::isImplThread());
     WebGraphicsContext3D* context3d = m_context->context3D();
-    if (!context3d || !context3d->makeContextCurrent()) {
+    if (!context3d) {
+        m_maxTextureSize = INT_MAX;
+
         // FIXME: Implement this path for software compositing.
         return false;
     }
+    if (!context3d->makeContextCurrent())
+        return false;
+
     WebKit::WebString extensionsWebString = context3d->getString(GraphicsContext3D::EXTENSIONS);
     String extensionsString(extensionsWebString.data(), extensionsWebString.length());
     Vector<String> extensions;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
index e927d292f..ebad4b986 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
@@ -30,6 +30,8 @@
 #include "CCGraphicsContext.h"
 #include "GraphicsContext3D.h"
 #include "IntSize.h"
+#include "SkBitmap.h"
+#include "SkCanvas.h"
 #include <wtf/Deque.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
@@ -44,8 +46,6 @@ class WebGraphicsContext3D;
 
 namespace WebCore {
 
-class CCScopedLockResourceForRead;
-class CCScopedLockResourceForWrite;
 class IntRect;
 class LayerTextureSubImage;
 
@@ -58,6 +58,10 @@ public:
     typedef Vector<ResourceId> ResourceIdArray;
     typedef HashMap<ResourceId, ResourceId> ResourceIdMap;
     enum TextureUsageHint { TextureUsageAny, TextureUsageFramebuffer };
+    enum ResourceType {
+        GLTexture = 1,
+        Bitmap,
+    };
     struct Mailbox {
         GC3Dbyte name[64];
     };
@@ -87,11 +91,19 @@ public:
 
     // Producer interface.
 
-    // Creates a resource of the given size/format, into the given pool.
+    void setDefaultResourceType(ResourceType type) { m_defaultResourceType = type; }
+    ResourceType defaultResourceType() const { return m_defaultResourceType; }
+    ResourceType resourceType(ResourceId);
+
+    // Creates a resource of the default resource type.
     ResourceId createResource(int pool, const IntSize&, GC3Denum format, TextureUsageHint);
 
-    // Wraps an external texture into a resource.
+    // You can also explicitly create a specific resource type.
+    ResourceId createGLTexture(int pool, const IntSize&, GC3Denum format, TextureUsageHint);
+    ResourceId createBitmap(int pool, const IntSize&);
+    // Wraps an external texture into a GL resource.
     ResourceId createResourceFromExternalTexture(unsigned textureId);
+
     void deleteResource(ResourceId);
 
     // Deletes all resources owned by a given pool.
@@ -147,13 +159,72 @@ public:
     // Only for testing
     size_t mailboxCount() const { return m_mailboxes.size(); }
 
-private:
-    friend class CCScopedLockResourceForRead;
-    friend class CCScopedLockResourceForWrite;
+    // The following lock classes are part of the CCResourceProvider API and are
+    // needed to read and write the resource contents. The user must ensure
+    // that they only use GL locks on GL resources, etc, and this is enforced
+    // by assertions.
+    class ScopedReadLockGL {
+        WTF_MAKE_NONCOPYABLE(ScopedReadLockGL);
+    public:
+        ScopedReadLockGL(CCResourceProvider*, CCResourceProvider::ResourceId);
+        ~ScopedReadLockGL();
+
+        unsigned textureId() const { return m_textureId; }
+
+    private:
+        CCResourceProvider* m_resourceProvider;
+        CCResourceProvider::ResourceId m_resourceId;
+        unsigned m_textureId;
+    };
+
+    class ScopedWriteLockGL {
+        WTF_MAKE_NONCOPYABLE(ScopedWriteLockGL);
+    public:
+        ScopedWriteLockGL(CCResourceProvider*, CCResourceProvider::ResourceId);
+        ~ScopedWriteLockGL();
+
+        unsigned textureId() const { return m_textureId; }
+
+    private:
+        CCResourceProvider* m_resourceProvider;
+        CCResourceProvider::ResourceId m_resourceId;
+        unsigned m_textureId;
+    };
+
+    class ScopedReadLockSoftware {
+        WTF_MAKE_NONCOPYABLE(ScopedReadLockSoftware);
+    public:
+        ScopedReadLockSoftware(CCResourceProvider*, CCResourceProvider::ResourceId);
+        ~ScopedReadLockSoftware();
+
+        const SkBitmap* skBitmap() const { return &m_skBitmap; }
 
+    private:
+        CCResourceProvider* m_resourceProvider;
+        CCResourceProvider::ResourceId m_resourceId;
+        SkBitmap m_skBitmap;
+    };
+
+    class ScopedWriteLockSoftware {
+        WTF_MAKE_NONCOPYABLE(ScopedWriteLockSoftware);
+    public:
+        ScopedWriteLockSoftware(CCResourceProvider*, CCResourceProvider::ResourceId);
+        ~ScopedWriteLockSoftware();
+
+        SkCanvas* skCanvas() { return &m_skCanvas; }
+
+    private:
+        CCResourceProvider* m_resourceProvider;
+        CCResourceProvider::ResourceId m_resourceId;
+        SkBitmap m_skBitmap;
+        SkCanvas m_skCanvas;
+    };
+
+private:
     struct Resource {
         Resource()
             : glId(0)
+            , pixels(0)
             , pool(0)
             , lockForReadCount(0)
             , lockedForWrite(false)
@@ -161,9 +232,23 @@ private:
             , exported(false)
             , size()
             , format(0)
+            , type(static_cast<ResourceType>(0))
         { }
         Resource(unsigned textureId, int pool, const IntSize& size, GC3Denum format)
             : glId(textureId)
+            , pixels(0)
+            , pool(pool)
+            , lockForReadCount(0)
+            , lockedForWrite(false)
+            , external(false)
+            , exported(false)
+            , size(size)
+            , format(format)
+            , type(GLTexture)
+        { }
+        Resource(uint8_t* pixels, int pool, const IntSize& size, GC3Denum format)
+            : glId(0)
+            , pixels(pixels)
             , pool(pool)
             , lockForReadCount(0)
             , lockedForWrite(false)
@@ -171,8 +256,10 @@ private:
             , exported(false)
             , size(size)
             , format(format)
+            , type(Bitmap)
         { }
         unsigned glId;
+        uint8_t* pixels;
         int pool;
         int lockForReadCount;
         bool lockedForWrite;
@@ -180,6 +267,7 @@ private:
         bool exported;
         IntSize size;
         GC3Denum format;
+        ResourceType type;
     };
     typedef HashMap<ResourceId, Resource> ResourceMap;
     struct Child {
@@ -192,13 +280,11 @@ private:
     explicit CCResourceProvider(CCGraphicsContext*);
     bool initialize();
 
-    // Gets a GL texture id representing the resource, that can be rendered into.
-    unsigned lockForWrite(ResourceId);
-    void unlockForWrite(ResourceId);
-
-    // Gets a GL texture id representing the resource, that can be rendered with.
-    unsigned lockForRead(ResourceId);
+    const Resource* lockForRead(ResourceId);
     void unlockForRead(ResourceId);
+    const Resource* lockForWrite(ResourceId);
+    void unlockForWrite(ResourceId);
+    static void populateSkBitmapWithResource(SkBitmap*, const Resource*);
 
     bool transferResource(WebKit::WebGraphicsContext3D*, ResourceId, TransferableResource*);
     void trimMailboxDeque();
@@ -211,6 +297,7 @@ private:
 
     Deque<Mailbox> m_mailboxes;
 
+    ResourceType m_defaultResourceType;
     bool m_useTextureStorageExt;
     bool m_useTextureUsageHint;
     bool m_useShallowFlush;
@@ -218,51 +305,6 @@ private:
     int m_maxTextureSize;
 };
 
-class CCScopedLockResourceForRead {
-    WTF_MAKE_NONCOPYABLE(CCScopedLockResourceForRead);
-public:
-    CCScopedLockResourceForRead(CCResourceProvider* resourceProvider, CCResourceProvider::ResourceId resourceId)
-        : m_resourceProvider(resourceProvider)
-        , m_resourceId(resourceId)
-        , m_textureId(resourceProvider->lockForRead(resourceId))
-    {
-        ASSERT(m_textureId);
-    }
-
-    ~CCScopedLockResourceForRead()
-    {
-        m_resourceProvider->unlockForRead(m_resourceId);
-    }
-
-    unsigned textureId() const { return m_textureId; }
-
-private:
-    CCResourceProvider* m_resourceProvider;
-    CCResourceProvider::ResourceId m_resourceId;
-    unsigned m_textureId;
-};
-
-class CCScopedLockResourceForWrite {
-    WTF_MAKE_NONCOPYABLE(CCScopedLockResourceForWrite);
-public:
-    CCScopedLockResourceForWrite(CCResourceProvider* resourceProvider, CCResourceProvider::ResourceId resourceId)
-        : m_resourceProvider(resourceProvider)
-        , m_resourceId(resourceId)
-        , m_textureId(resourceProvider->lockForWrite(resourceId)) { }
-
-    ~CCScopedLockResourceForWrite()
-    {
-        m_resourceProvider->unlockForWrite(m_resourceId);
-    }
-
-    unsigned textureId() const { return m_textureId; }
-
-private:
-    CCResourceProvider* m_resourceProvider;
-    CCResourceProvider::ResourceId m_resourceId;
-    unsigned m_textureId;
-};
-
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
index 8a0c32c4f..961284876 100644
--- a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
+++ b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
@@ -247,15 +247,7 @@ static CTFontDescriptorRef cascadeToLastResortAndDisableSwashesFontDescriptor()
 // Adding a cascade list breaks the font on Leopard
 static bool canSetCascadeListForCustomFont()
 {
-#if PLATFORM(CHROMIUM)
-    static SInt32 systemVersion;
-    if (!systemVersion) {
-        if (Gestalt(gestaltSystemVersion, &systemVersion) != noErr)
-            return false;
-    }
-
-    return systemVersion >= 0x1060;
-#elif PLATFORM(IOS) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 1060
+#if PLATFORM(IOS) || __MAC_OS_X_VERSION_MIN_REQUIRED >= 1060
     return true;
 #else
     return false;
diff --git a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
index 17d4ddcef..6836b7db4 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
@@ -61,7 +61,8 @@ static void normalizeSpacesAndMirrorChars(const UChar* source, UChar* destinatio
         UChar32 character;
         int nextPosition = position;
         U16_NEXT(source, nextPosition, length, character);
-        if (Font::treatAsSpace(character))
+        // Don't normalize tabs as they are not treated as spaces for word-end
+        if (Font::treatAsSpace(character) && character != '\t')
             character = ' ';
         else if (Font::treatAsZeroWidthSpace(character))
             character = zeroWidthSpace;
@@ -121,7 +122,7 @@ void HarfBuzzShaperBase::setNormalizedBuffer(NormalizeMode normalizeMode)
 bool HarfBuzzShaperBase::isWordEnd(unsigned index)
 {
     // This could refer a high-surrogate, but should work.
-    return index && isCodepointSpace(m_run[index]);
+    return index && isCodepointSpace(m_normalizedBuffer[index]);
 }
 
 int HarfBuzzShaperBase::determineWordBreakSpacing()
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
index 3bbb6c737..a3c056591 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
@@ -121,8 +121,15 @@ String Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE(Platform3DObject
 
     String translatedShaderSource;
     String shaderInfoLog;
+    int extraCompileOptions = 0;
 
-    bool isValid = compiler.validateShaderSource(entry.source.utf8().data(), shaderType, translatedShaderSource, shaderInfoLog);
+#if PLATFORM(MAC)
+    const char* vendor = reinterpret_cast<const char*>(::glGetString(GL_VENDOR));
+    if (vendor && (std::strstr(vendor, "ATI") || std::strstr(vendor, "AMD")))
+        extraCompileOptions |= SH_EMULATE_BUILT_IN_FUNCTIONS;
+#endif
+
+    bool isValid = compiler.validateShaderSource(entry.source.utf8().data(), shaderType, translatedShaderSource, shaderInfoLog, extraCompileOptions);
 
     entry.log = shaderInfoLog;
     entry.isValid = isValid;
diff --git a/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp b/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
index 802978343..123a2fcbf 100644
--- a/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
+++ b/Source/WebCore/platform/graphics/openvg/PainterOpenVG.cpp
@@ -1114,8 +1114,6 @@ void PainterOpenVG::drawText(VGFont vgFont, Vector<VGuint>& characters, VGfloat*
 
     VGbitfield paintModes = 0;
 
-    if (m_state->textDrawingMode & TextModeClip)
-        return; // unsupported for every port except CG at the time of writing
     if (m_state->textDrawingMode & TextModeFill && !m_state->fillDisabled())
         paintModes |= VG_FILL_PATH;
     if (m_state->textDrawingMode & TextModeStroke && !m_state->strokeDisabled())
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
index 9ae500775..3e1b99221 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
@@ -100,7 +100,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
     logFont.lfWeight = bold ? FW_BOLD : FW_DONTCARE;
 
     HFONT hfont = CreateFontIndirect(&logFont);
-    return FontPlatformData(hfont, size);
+    return FontPlatformData(hfont, size, orientation);
 #elif OS(UNIX)
     ASSERT(m_fontReference);
     return FontPlatformData(m_fontReference, "", size, bold && !m_fontReference->isBold(), italic && !m_fontReference->isItalic(), orientation, textOrientation);
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index 394688f4a..3cfbd35eb 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -529,9 +529,6 @@ SkXfermode::Mode PlatformContextSkia::getXfermodeMode() const
 
 void PlatformContextSkia::setTextDrawingMode(TextDrawingModeFlags mode)
 {
-    // TextModeClip is never used, so we assert that it isn't set:
-    // https://bugs.webkit.org/show_bug.cgi?id=21898
-    ASSERT(!(mode & TextModeClip));
     m_state->m_textDrawingMode = mode;
 }
 
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index 22b54f651..8c4eab13b 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -28,6 +28,7 @@
 #include "CSSValueKeywords.h"
 #include "FileList.h"
 #include "FileSystem.h"
+#include "FontDescription.h"
 #include <wtf/gobject/GOwnPtr.h>
 #include "Gradient.h"
 #include "GraphicsContext.h"
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
index 7012d3d26..1c33e8cb4 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
@@ -32,6 +32,7 @@
 #undef GTK_DISABLE_DEPRECATED
 
 #include "CSSValueKeywords.h"
+#include "Font.h"
 #include "GraphicsContext.h"
 #include "GtkVersioning.h"
 #include "HTMLNames.h"
diff --git a/Source/WebCore/platform/mac/HTMLConverter.mm b/Source/WebCore/platform/mac/HTMLConverter.mm
index 67be0059c..bb6e743b6 100644
--- a/Source/WebCore/platform/mac/HTMLConverter.mm
+++ b/Source/WebCore/platform/mac/HTMLConverter.mm
@@ -36,6 +36,7 @@
 #import "DOMPrivate.h"
 #import "DOMRangeInternal.h"
 #import "Element.h"
+#import "Font.h"
 #import "Frame.h"
 #import "HTMLNames.h"
 #import "HTMLParserIdioms.h"
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 600dee583..a5b512e84 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -642,6 +642,24 @@ static bool scrollAnimationEnabledForSystem()
 #endif
 }
 
+#if ENABLE(RUBBER_BANDING)
+static bool rubberBandingEnabledForSystem()
+{
+    static bool initialized = false;
+    static bool enabled = true;
+    // Caches the result, which is consistent with other apps like the Finder, which all
+    // require a restart after changing this default.
+    if (!initialized) {
+        // Uses -objectForKey: and not -boolForKey: in order to default to true if the value wasn't set.
+        id value = [[NSUserDefaults standardUserDefaults] objectForKey:@"NSScrollViewRubberbanding"];
+        if ([value isKindOfClass:[NSNumber class]])
+            enabled = [value boolValue];
+        initialized = true;
+    }
+    return enabled;
+}
+#endif
+
 bool ScrollAnimatorMac::scroll(ScrollbarOrientation orientation, ScrollGranularity granularity, float step, float multiplier)
 {
     m_haveScrolledSincePageLoad = true;
@@ -981,7 +999,7 @@ bool ScrollAnimatorMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
     m_haveScrolledSincePageLoad = true;
 
-    if (!wheelEvent.hasPreciseScrollingDeltas())
+    if (!wheelEvent.hasPreciseScrollingDeltas() || !rubberBandingEnabledForSystem())
         return ScrollAnimator::handleWheelEvent(wheelEvent);
 
     // FIXME: This is somewhat roundabout hack to allow forwarding wheel events
diff --git a/Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.cpp b/Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.cpp
new file mode 100644
index 000000000..34bb4bece
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "RTCIceCandidateDescriptor.h"
+
+namespace WebCore {
+
+PassRefPtr<RTCIceCandidateDescriptor> RTCIceCandidateDescriptor::create(const String& candidate, const String& sdpMid, unsigned short sdpMLineIndex)
+{
+    return adoptRef(new RTCIceCandidateDescriptor(candidate, sdpMid, sdpMLineIndex));
+}
+
+RTCIceCandidateDescriptor::RTCIceCandidateDescriptor(const String& candidate, const String& sdpMid, unsigned short sdpMLineIndex)
+    : m_candidate(candidate)
+    , m_sdpMid(sdpMid)
+    , m_sdpMLineIndex(sdpMLineIndex)
+{
+}
+
+RTCIceCandidateDescriptor::~RTCIceCandidateDescriptor()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.h b/Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.h
new file mode 100644
index 000000000..b5af1e432
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/RTCIceCandidateDescriptor.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCIceCandidateDescriptor_h
+#define RTCIceCandidateDescriptor_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class RTCIceCandidateDescriptor : public RefCounted<RTCIceCandidateDescriptor> {
+public:
+    static PassRefPtr<RTCIceCandidateDescriptor> create(const String& candidate, const String& sdpMid, unsigned short sdpMLineIndex);
+    virtual ~RTCIceCandidateDescriptor();
+
+    const String& candidate() { return m_candidate; }
+    const String& sdpMid() { return m_sdpMid; }
+    unsigned short sdpMLineIndex() { return m_sdpMLineIndex; }
+
+private:
+    RTCIceCandidateDescriptor(const String& candidate, const String& sdpMid, unsigned short sdpMLineIndex);
+
+    String m_candidate;
+    String m_sdpMid;
+    unsigned short m_sdpMLineIndex;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCIceCandidateDescriptor_h
diff --git a/Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.cpp b/Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.cpp
new file mode 100644
index 000000000..9178676b1
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "RTCSessionDescriptionDescriptor.h"
+
+namespace WebCore {
+
+PassRefPtr<RTCSessionDescriptionDescriptor> RTCSessionDescriptionDescriptor::create(const String& type, const String& sdp)
+{
+    return adoptRef(new RTCSessionDescriptionDescriptor(type, sdp));
+}
+
+RTCSessionDescriptionDescriptor::RTCSessionDescriptionDescriptor(const String& type, const String& sdp)
+    : m_type(type)
+    , m_sdp(sdp)
+{
+}
+
+RTCSessionDescriptionDescriptor::~RTCSessionDescriptionDescriptor()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.h b/Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.h
new file mode 100644
index 000000000..04e34b78d
--- /dev/null
+++ b/Source/WebCore/platform/mediastream/RTCSessionDescriptionDescriptor.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Google Inc. nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RTCSessionDescriptionDescriptor_h
+#define RTCSessionDescriptionDescriptor_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class RTCSessionDescriptionDescriptor : public RefCounted<RTCSessionDescriptionDescriptor> {
+public:
+    static PassRefPtr<RTCSessionDescriptionDescriptor> create(const String& type, const String& sdp);
+    virtual ~RTCSessionDescriptionDescriptor();
+
+    const String& type() { return m_type; }
+    void setType(const String& type) { m_type = type; }
+
+    const String& sdp() { return m_sdp; }
+    void setSdp(const String& sdp) { m_sdp = sdp; }
+
+private:
+    RTCSessionDescriptionDescriptor(const String& type, const String& sdp);
+
+    String m_type;
+    String m_sdp;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // RTCSessionDescriptionDescriptor_h
diff --git a/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp b/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp
index b89be72eb..851391035 100644
--- a/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp
+++ b/Source/WebCore/platform/mediastream/chromium/RTCPeerConnectionHandlerChromium.cpp
@@ -56,8 +56,7 @@ RTCPeerConnectionHandlerChromium::~RTCPeerConnectionHandlerChromium()
 bool RTCPeerConnectionHandlerChromium::initialize()
 {
     m_webHandler = adoptPtr(WebKit::Platform::current()->createRTCPeerConnectionHandler(this));
-    // FIXME: Change the default value to false once the mock WebRTCPeerConnectionHandler has landed.
-    return m_webHandler ? m_webHandler->initialize() : true;
+    return m_webHandler ? m_webHandler->initialize() : false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/blackberry/rss/RSSFilterStream.cpp b/Source/WebCore/platform/network/blackberry/rss/RSSFilterStream.cpp
index 58915bd13..a7e50446e 100644
--- a/Source/WebCore/platform/network/blackberry/rss/RSSFilterStream.cpp
+++ b/Source/WebCore/platform/network/blackberry/rss/RSSFilterStream.cpp
@@ -50,15 +50,6 @@ static const char* const s_contentEncodingHeaderKey = "Content-Encoding";
 static const char* const s_contentLengthHeaderKey = "Content-Length";
 static const char* const s_contentTypeHeaderKey = "Content-Type";
 
-static const char* const s_atom10VersionKey = "xmlns";
-static const char* const s_atom10VersionValue = "http://www.w3.org/2005/Atom";
-static const char* const s_rss10VersionKey = "xmlns";
-static const char* const s_rss10VersionValue = "http://purl.org/rss/1.0/";
-static const char* const s_rss20VersionKey = "version";
-static const char* const s_rss20VersionValue = "2.0";
-static const char* const s_rssXmlVersionKey = "version";
-static const char* const s_rssXmlVersionValue = "1.0";
-
 static int isASCIISpaceLowerByte(int ch)
 {
     return isASCIISpace<int>(ch & 0xff);
@@ -239,7 +230,7 @@ static PassOwnPtr<RSSParserBase> createParser(RSSFilterStream::ResourceType type
     case RSSFilterStream::TypeRSS20:
         return adoptPtr(new RSS20Parser());
     default:
-        // The following code is just for compiler, it should never reach here.
+        ASSERT_NOT_REACHED();
         return adoptPtr(new RSS20Parser());
     }
 }
@@ -317,8 +308,7 @@ static bool findXMLLanguagePosition(const char* str, const char*& langStart, con
 
 static const char* defaultEncodingForLanguage(const char* language)
 {
-    if (!strcasecmp(language, "en")
-        || !strcasecmp(language, "en-US"))
+    if (!strcasecmp(language, "en") || !strcasecmp(language, "en-US"))
         return s_latin1EncodingName;
     if (!strcasecmp(language, "zh-cn"))
         return s_gbkEncodingName;
@@ -330,7 +320,6 @@ static bool isTranscodingNeeded(const std::string& encoding)
 {
     // When there's no encoding information, or the encoding can not be found in all encodings
     // supported in our phone, we will try to transcode the content anyway, supposed to ASCII.
-
     if (encoding.empty())
         return true;
 
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index 520d68578..57a6fb2c8 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -265,15 +265,6 @@ void ResourceRequest::setHTTPPipeliningEnabled(bool flag)
     s_httpPipeliningEnabled = flag;
 }
 
-#if USE(CFNETWORK) || PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
-static inline bool readBooleanPreference(CFStringRef key)
-{
-    Boolean keyExistsAndHasValidFormat;
-    Boolean result = CFPreferencesGetAppBooleanValue(key, kCFPreferencesCurrentApplication, &keyExistsAndHasValidFormat);
-    return keyExistsAndHasValidFormat ? result : false;
-}
-#endif
-
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     static const unsigned preferredConnectionCount = 6;
@@ -284,8 +275,10 @@ unsigned initializeMaximumHTTPConnectionCountPerHost()
 #if USE(CFNETWORK) || PLATFORM(MAC) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 1070
     static const unsigned unlimitedConnectionCount = 10000;
 
-    if (!ResourceRequest::httpPipeliningEnabled() && readBooleanPreference(CFSTR("WebKitEnableHTTPPipelining")))
-        ResourceRequest::setHTTPPipeliningEnabled(true);
+    Boolean keyExistsAndHasValidFormat = false;
+    Boolean prefValue = CFPreferencesGetAppBooleanValue(CFSTR("WebKitEnableHTTPPipelining"), kCFPreferencesCurrentApplication, &keyExistsAndHasValidFormat);
+    if (keyExistsAndHasValidFormat)
+        ResourceRequest::setHTTPPipeliningEnabled(prefValue);
 
     if (ResourceRequest::httpPipeliningEnabled()) {
         wkSetHTTPPipeliningMaximumPriority(toHTTPPipeliningPriority(ResourceLoadPriorityHighest));
diff --git a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp
index f3f60e687..11a3ef2d3 100644
--- a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp
+++ b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.cpp
@@ -155,14 +155,12 @@ Vector<String> TextCheckerEnchant::getGuessesForWord(const String& word)
     return guesses;
 }
 
-void TextCheckerEnchant::updateSpellCheckingLanguages(const String& languages)
+void TextCheckerEnchant::updateSpellCheckingLanguages(const Vector<String>& languages)
 {
     Vector<EnchantDict*> spellDictionaries;
 
     if (!languages.isEmpty()) {
-        Vector<String> languagesVector;
-        languages.split(static_cast<UChar>(','), languagesVector);
-        for (Vector<String>::const_iterator iter = languagesVector.begin(); iter != languagesVector.end(); ++iter) {
+        for (Vector<String>::const_iterator iter = languages.begin(); iter != languages.end(); ++iter) {
             CString currentLanguage = iter->utf8();
             if (enchant_broker_dict_exists(m_broker, currentLanguage.data())) {
                 EnchantDict* dict = enchant_broker_request_dict(m_broker, currentLanguage.data());
@@ -188,24 +186,21 @@ void TextCheckerEnchant::updateSpellCheckingLanguages(const String& languages)
     m_enchantDictionaries = spellDictionaries;
 }
 
-String TextCheckerEnchant::getSpellCheckingLanguages()
+Vector<String> TextCheckerEnchant::getSpellCheckingLanguages()
 {
+    Vector<String> languages;
     if (m_enchantDictionaries.isEmpty())
-        return String();
+        return languages;
 
     // Get a Vector<CString> with the list of languages in use.
     Vector<CString> currentDictionaries;
     for (Vector<EnchantDict*>::const_iterator iter = m_enchantDictionaries.begin(); iter != m_enchantDictionaries.end(); ++iter)
         enchant_dict_describe(*iter, enchantDictDescribeCallback, &currentDictionaries);
 
-    // Build the result String;
-    StringBuilder builder;
-    for (Vector<CString>::const_iterator iter = currentDictionaries.begin(); iter != currentDictionaries.end(); ++iter) {
-        if (iter != currentDictionaries.begin())
-            builder.append(",");
-        builder.append(String::fromUTF8(iter->data()));
-    }
-    return builder.toString();
+    for (Vector<CString>::const_iterator iter = currentDictionaries.begin(); iter != currentDictionaries.end(); ++iter)
+        languages.append(String::fromUTF8(iter->data()));
+
+    return languages;
 }
 
 void TextCheckerEnchant::freeEnchantBrokerDictionaries()
diff --git a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h
index e7a980978..1780b454d 100644
--- a/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h
+++ b/Source/WebCore/platform/text/gtk/TextCheckerEnchant.h
@@ -41,8 +41,8 @@ public:
     void learnWord(const String&);
     void checkSpellingOfString(const String&, int& misspellingLocation, int& misspellingLength);
     Vector<String> getGuessesForWord(const String&);
-    void updateSpellCheckingLanguages(const String& languages);
-    String getSpellCheckingLanguages();
+    void updateSpellCheckingLanguages(const Vector<String>& languages);
+    Vector<String> getSpellCheckingLanguages();
 
 private:
     TextCheckerEnchant();
diff --git a/Source/WebCore/rendering/EllipsisBox.cpp b/Source/WebCore/rendering/EllipsisBox.cpp
index 7290cb25f..c25673d93 100644
--- a/Source/WebCore/rendering/EllipsisBox.cpp
+++ b/Source/WebCore/rendering/EllipsisBox.cpp
@@ -21,6 +21,7 @@
 #include "EllipsisBox.h"
 
 #include "Document.h"
+#include "Font.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
diff --git a/Source/WebCore/rendering/FlowThreadController.cpp b/Source/WebCore/rendering/FlowThreadController.cpp
index dc9432c76..476c924b8 100644
--- a/Source/WebCore/rendering/FlowThreadController.cpp
+++ b/Source/WebCore/rendering/FlowThreadController.cpp
@@ -32,7 +32,9 @@
 #include "FlowThreadController.h"
 
 #include "RenderFlowThread.h"
+#include "RenderFlowThreadContainer.h"
 #include "RenderNamedFlowThread.h"
+#include "StyleInheritedData.h"
 #include "WebKitNamedFlow.h"
 #include "WebKitNamedFlowCollection.h"
 #include <wtf/text/AtomicString.h>
@@ -47,6 +49,7 @@ PassOwnPtr<FlowThreadController> FlowThreadController::create(RenderView* view)
 FlowThreadController::FlowThreadController(RenderView* view)
     : m_view(view)
     , m_currentRenderFlowThread(0)
+    , m_flowThreadContainer(0)
     , m_isRenderNamedFlowThreadOrderDirty(false)
 {
 }
@@ -57,6 +60,11 @@ FlowThreadController::~FlowThreadController()
 
 RenderNamedFlowThread* FlowThreadController::ensureRenderFlowThreadWithName(const AtomicString& name)
 {
+    if (!m_flowThreadContainer) {
+        m_flowThreadContainer = new (m_view->renderArena()) RenderFlowThreadContainer(m_view->document());
+        m_flowThreadContainer->setStyle(RenderFlowThread::createFlowThreadStyle(m_view->style()));
+        m_view->addChild(m_flowThreadContainer);
+    }
     if (!m_renderNamedFlowThreadList)
         m_renderNamedFlowThreadList = adoptPtr(new RenderNamedFlowThreadList());
     else {
@@ -76,14 +84,23 @@ RenderNamedFlowThread* FlowThreadController::ensureRenderFlowThreadWithName(cons
     flowRenderer->setStyle(RenderFlowThread::createFlowThreadStyle(m_view->style()));
     m_renderNamedFlowThreadList->add(flowRenderer);
 
-    // Keep the flow renderer as a child of RenderView.
-    m_view->addChild(flowRenderer);
+    // Keep the flow renderer as a child of RenderFlowThreadContainer.
+    m_flowThreadContainer->addChild(flowRenderer);
 
     setIsRenderNamedFlowThreadOrderDirty(true);
 
     return flowRenderer;
 }
 
+void FlowThreadController::styleDidChange()
+{
+    RenderStyle* viewStyle = m_view->style();
+    for (RenderNamedFlowThreadList::iterator iter = m_renderNamedFlowThreadList->begin(); iter != m_renderNamedFlowThreadList->end(); ++iter) {
+        RenderNamedFlowThread* flowRenderer = *iter;
+        flowRenderer->setStyle(RenderFlowThread::createFlowThreadStyle(viewStyle));
+    }
+}
+
 void FlowThreadController::layoutRenderNamedFlowThreads()
 {
     ASSERT(m_renderNamedFlowThreadList);
diff --git a/Source/WebCore/rendering/FlowThreadController.h b/Source/WebCore/rendering/FlowThreadController.h
index d48c87972..58edb2cf1 100644
--- a/Source/WebCore/rendering/FlowThreadController.h
+++ b/Source/WebCore/rendering/FlowThreadController.h
@@ -37,6 +37,7 @@
 namespace WebCore {
 
 class RenderFlowThread;
+class RenderFlowThreadContainer;
 class RenderNamedFlowThread;
 
 typedef ListHashSet<RenderNamedFlowThread*> RenderNamedFlowThreadList;
@@ -61,10 +62,10 @@ public:
     const RenderNamedFlowThreadList* renderNamedFlowThreadList() const { return m_renderNamedFlowThreadList.get(); }
     bool hasRenderNamedFlowThreads() const { return m_renderNamedFlowThreadList && !m_renderNamedFlowThreadList->isEmpty(); }
     void layoutRenderNamedFlowThreads();
+    void styleDidChange();
 
     void registerNamedFlowContentNode(Node*, RenderNamedFlowThread*);
     void unregisterNamedFlowContentNode(Node*);
-    
     void removeFlowThread(RenderNamedFlowThread*);
 
 protected:
@@ -73,6 +74,7 @@ protected:
 private:
     RenderView* m_view;
     RenderFlowThread* m_currentRenderFlowThread;
+    RenderFlowThreadContainer* m_flowThreadContainer;
     bool m_isRenderNamedFlowThreadOrderDirty;
     OwnPtr<RenderNamedFlowThreadList> m_renderNamedFlowThreadList;
     // maps a content node to its render flow thread.
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index 08bfd6970..be3c9c7cf 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "InlineBox.h"
 
+#include "FontMetrics.h"
 #include "Frame.h"
 #include "HitTestResult.h"
 #include "InlineFlowBox.h"
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index a96f61225..c3da10025 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -24,6 +24,7 @@
 #include "CSSPropertyNames.h"
 #include "Document.h"
 #include "EllipsisBox.h"
+#include "Font.h"
 #include "GraphicsContext.h"
 #include "InlineTextBox.h"
 #include "HitTestResult.h"
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 20f59d723..32839f15f 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -31,8 +31,11 @@ class HitTestRequest;
 class HitTestResult;
 class InlineTextBox;
 class RenderLineBoxList;
+class SimpleFontData;
 class VerticalPositionCache;
 
+struct GlyphOverflow;
+
 typedef HashMap<const InlineTextBox*, pair<Vector<const SimpleFontData*>, GlyphOverflow> > GlyphOverflowAndFallbackFontsMap;
 
 class InlineFlowBox : public InlineBox {
diff --git a/Source/WebCore/rendering/Pagination.h b/Source/WebCore/rendering/Pagination.h
new file mode 100644
index 000000000..1afad696c
--- /dev/null
+++ b/Source/WebCore/rendering/Pagination.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Pagination_h
+#define Pagination_h
+
+namespace WebCore {
+
+struct Pagination {
+    enum Mode { Unpaginated, LeftToRightPaginated, RightToLeftPaginated, TopToBottomPaginated, BottomToTopPaginated };
+
+    Pagination()
+        : mode(Unpaginated)
+        , behavesLikeColumns(false)
+        , pageLength(0)
+        , gap(0)
+    {
+    };
+
+    bool operator==(const Pagination& other) const
+    {
+        return mode == other.mode && behavesLikeColumns == other.behavesLikeColumns && pageLength == other.pageLength && gap == other.gap;
+    }
+
+    bool operator!=(const Pagination& other) const
+    {
+        return mode != other.mode || behavesLikeColumns != other.behavesLikeColumns || pageLength != other.pageLength || gap != other.gap;
+    }
+
+    Mode mode;
+    bool behavesLikeColumns;
+    unsigned pageLength;
+    unsigned gap;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index aa71af50c..a4158f4e1 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -3080,31 +3080,6 @@ void RenderBlock::paintFloats(PaintInfo& paintInfo, const LayoutPoint& paintOffs
     }
 }
 
-void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
-{
-    if (!paintInfo.shouldPaintWithinRoot(this) || !firstLineBox())
-        return;
-
-    if (style()->visibility() == VISIBLE && paintInfo.phase == PaintPhaseForeground) {
-        // We can check the first box and last box and avoid painting if we don't
-        // intersect.
-        LayoutUnit yPos = paintOffset.y() + firstLineBox()->y();
-        LayoutUnit h = lastLineBox()->y() + lastLineBox()->logicalHeight() - firstLineBox()->y();
-        if (yPos >= paintInfo.rect.maxY() || yPos + h <= paintInfo.rect.y())
-            return;
-
-        // See if our boxes intersect with the dirty rect.  If so, then we paint
-        // them.  Note that boxes can easily overlap, so we can't make any assumptions
-        // based off positions of our first line box or our last line box.
-        for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-            yPos = paintOffset.y() + curr->y();
-            h = curr->logicalHeight();
-            if (curr->ellipsisBox() && yPos < paintInfo.rect.maxY() && yPos + h > paintInfo.rect.y())
-                curr->paintEllipsisBox(paintInfo, paintOffset, curr->lineTop(), curr->lineBottom());
-        }
-    }
-}
-
 RenderInline* RenderBlock::inlineElementContinuation() const
 { 
     RenderBoxModelObject* continuation = this->continuation();
@@ -5139,8 +5114,12 @@ void RenderBlock::calcColumnWidth()
 
 bool RenderBlock::requiresColumns(int desiredColumnCount) const
 {
+    // If overflow-y is set to paged-x or paged-y on the body or html element, we'll handle the paginating
+    // in the RenderView instead.
+    bool isPaginated = (style()->overflowY() == OPAGEDX || style()->overflowY() == OPAGEDY) && !(isRoot() || isBody());
+
     return firstChild()
-        && (desiredColumnCount != 1 || !style()->hasAutoColumnWidth() || !style()->hasInlineColumnAxis())
+        && (desiredColumnCount != 1 || !style()->hasAutoColumnWidth() || !style()->hasInlineColumnAxis() || isPaginated)
         && !firstChild()->isAnonymousColumnsBlock()
         && !firstChild()->isAnonymousColumnSpanBlock();
 }
@@ -5171,6 +5150,32 @@ void RenderBlock::setDesiredColumnCountAndWidth(int count, LayoutUnit width)
     }
 }
 
+void RenderBlock::updateColumnInfoFromStyle(RenderStyle* style)
+{
+    if (!hasColumns())
+        return;
+
+    ColumnInfo* info = gColumnInfoMap->get(this);
+
+    bool needsLayout = false;
+    ColumnInfo::Axis oldAxis = info->progressionAxis();
+    ColumnInfo::Axis newAxis = style->hasInlineColumnAxis() ? ColumnInfo::InlineAxis : ColumnInfo::BlockAxis;
+    if (oldAxis != newAxis) {
+        info->setProgressionAxis(newAxis);
+        needsLayout = true;
+    }
+
+    bool oldProgressionIsReversed = info->progressionIsReversed();
+    bool newProgressionIsReversed = style->columnProgression() == ReverseColumnProgression;
+    if (oldProgressionIsReversed != newProgressionIsReversed) {
+        info->setProgressionIsReversed(newProgressionIsReversed);
+        needsLayout = true;
+    }
+
+    if (needsLayout)
+        setNeedsLayoutAndPrefWidthsRecalc();
+}
+
 LayoutUnit RenderBlock::desiredColumnWidth() const
 {
     if (!hasColumns())
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 11b698b45..a31b26ed6 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -266,6 +266,8 @@ public:
 
     ColumnInfo* columnInfo() const;
     int columnGap() const;
+
+    void updateColumnInfoFromStyle(RenderStyle*);
     
     // These two functions take the ColumnInfo* to avoid repeated lookups of the info in the global HashMap.
     unsigned columnCount(ColumnInfo*) const;
@@ -743,7 +745,6 @@ private:
     void paintContents(PaintInfo&, const LayoutPoint&);
     void paintColumnContents(PaintInfo&, const LayoutPoint&, bool paintFloats = false);
     void paintColumnRules(PaintInfo&, const LayoutPoint&);
-    void paintEllipsisBoxes(PaintInfo&, const LayoutPoint&);
     void paintSelection(PaintInfo&, const LayoutPoint&);
     void paintCaret(PaintInfo&, const LayoutPoint&, CaretType);
 
diff --git a/Source/WebCore/rendering/RenderButton.cpp b/Source/WebCore/rendering/RenderButton.cpp
index 5477f9e50..7103e6e50 100644
--- a/Source/WebCore/rendering/RenderButton.cpp
+++ b/Source/WebCore/rendering/RenderButton.cpp
@@ -27,6 +27,7 @@
 #include "HTMLNames.h"
 #include "RenderTextFragment.h"
 #include "RenderTheme.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/RenderCombineText.cpp b/Source/WebCore/rendering/RenderCombineText.cpp
index c79886a9d..123661e4d 100644
--- a/Source/WebCore/rendering/RenderCombineText.cpp
+++ b/Source/WebCore/rendering/RenderCombineText.cpp
@@ -22,6 +22,7 @@
 #include "RenderCombineText.h"
 
 #include "RenderBlock.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/RenderCombineText.h b/Source/WebCore/rendering/RenderCombineText.h
index 406c3f6a3..1433aa005 100644
--- a/Source/WebCore/rendering/RenderCombineText.h
+++ b/Source/WebCore/rendering/RenderCombineText.h
@@ -21,6 +21,7 @@
 #ifndef RenderCombineText_h
 #define RenderCombineText_h
 
+#include "Font.h"
 #include "RenderText.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index 9c5587979..8fa73ae4f 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "RenderDeprecatedFlexibleBox.h"
 
+#include "Font.h"
 #include "LayoutRepainter.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.h b/Source/WebCore/rendering/RenderEmbeddedObject.h
index be854c1ed..6edc9bfb7 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.h
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.h
@@ -28,6 +28,7 @@
 namespace WebCore {
 
 class MouseEvent;
+class TextRun;
 
 // Renderer for embeds and objects, often, but not always, rendered via plug-ins.
 // For example, <embed src="foo.html"> does not invoke a plug-in.
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index bac5b59c7..de9564456 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -23,6 +23,7 @@
 
 #include "ElementShadow.h"
 #include "FileList.h"
+#include "Font.h"
 #include "GraphicsContext.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
diff --git a/Source/WebCore/rendering/RenderFlowThreadContainer.cpp b/Source/WebCore/rendering/RenderFlowThreadContainer.cpp
new file mode 100644
index 000000000..680ac4ec0
--- /dev/null
+++ b/Source/WebCore/rendering/RenderFlowThreadContainer.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "RenderFlowThreadContainer.h"
+
+namespace WebCore {
+
+RenderFlowThreadContainer::RenderFlowThreadContainer(Node* node)
+: RenderFlowThread(node)
+{
+}
+
+void RenderFlowThreadContainer::layout()
+{
+    ASSERT(needsLayout());
+    setNeedsLayout(false);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderFlowThreadContainer.h b/Source/WebCore/rendering/RenderFlowThreadContainer.h
new file mode 100644
index 000000000..5a958ce3a
--- /dev/null
+++ b/Source/WebCore/rendering/RenderFlowThreadContainer.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef RenderFlowThreadContainer_h
+#define RenderFlowThreadContainer_h
+
+
+#include "RenderFlowThread.h"
+
+namespace WebCore {
+
+class RenderFlowThreadContainer: public RenderFlowThread {
+public:
+    RenderFlowThreadContainer(Node*);
+    virtual ~RenderFlowThreadContainer() { };
+
+    virtual void layout() OVERRIDE;
+    virtual bool isRenderFlowThreadContainer() const OVERRIDE  { return true; }
+
+private:
+    virtual const char* renderName() const { return "RenderFlowThreadContainer"; }
+};
+
+} // namespace WebCore
+
+#endif // RenderFlowThread_h
diff --git a/Source/WebCore/rendering/RenderFullScreen.h b/Source/WebCore/rendering/RenderFullScreen.h
index a675c5f09..a54ac1561 100644
--- a/Source/WebCore/rendering/RenderFullScreen.h
+++ b/Source/WebCore/rendering/RenderFullScreen.h
@@ -28,6 +28,7 @@
 #if ENABLE(FULLSCREEN_API)
 
 #include "RenderDeprecatedFlexibleBox.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 48ea05470..f399abc4d 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -29,6 +29,7 @@
 #include "RenderImage.h"
 
 #include "BitmapImage.h"
+#include "Font.h"
 #include "FontCache.h"
 #include "Frame.h"
 #include "FrameSelection.h"
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 35ba973bd..d58bfc1ab 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -36,6 +36,7 @@
 #include "RenderLayer.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 #include "TransformState.h"
 #include "VisiblePosition.h"
 
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index fe75262c8..661d0eb08 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -4777,7 +4777,7 @@ bool RenderLayer::shouldBeNormalFlowOnly() const
                 || renderer()->isVideo()
                 || renderer()->isEmbeddedObject()
                 || renderer()->isRenderIFrame()
-                || renderer()->style()->specifiesColumns())
+                || (renderer()->style()->specifiesColumns() && !isRootLayer()))
             && !renderer()->isOutOfFlowPositioned()
             && !renderer()->isRelPositioned()
             && !renderer()->hasTransform()
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index ef6147f26..89d99b3e2 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -29,6 +29,7 @@
 #include "HTMLOListElement.h"
 #include "RenderListMarker.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringBuilder.h>
 
diff --git a/Source/WebCore/rendering/RenderListMarker.cpp b/Source/WebCore/rendering/RenderListMarker.cpp
index 0d2f48dd5..04d8632a8 100644
--- a/Source/WebCore/rendering/RenderListMarker.cpp
+++ b/Source/WebCore/rendering/RenderListMarker.cpp
@@ -27,6 +27,7 @@
 
 #include "CachedImage.h"
 #include "Document.h"
+#include "Font.h"
 #include "GraphicsContext.h"
 #include "RenderLayer.h"
 #include "RenderListItem.h"
diff --git a/Source/WebCore/rendering/RenderMultiColumnBlock.cpp b/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
index 177a1676a..9f6bdefb4 100644
--- a/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
+++ b/Source/WebCore/rendering/RenderMultiColumnBlock.cpp
@@ -27,6 +27,7 @@
 #include "RenderMultiColumnBlock.h"
 #include "RenderMultiColumnFlowThread.h"
 #include "RenderMultiColumnSet.h"
+#include "StyleInheritedData.h"
 
 using namespace std;
 
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index 23d6cb8ac..391c11988 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -640,9 +640,9 @@ void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderOb
         if (!container && !object->isRenderView())
             return;
         if (!last->isText() && last->style()->isOutOfFlowPositioned()) {
-            bool willSkipRelativelyPositionedInlines = !object->isRenderBlock() || object->isAnonymousBlock();
-            // Skip relatively positioned inlines and anonymous blocks to get to the enclosing RenderBlock.
-            while (object && (!object->isRenderBlock() || object->isAnonymousBlock()))
+            bool willSkipRelativelyPositionedInlines = !object->isRenderBlock() || object->isAnonymousBlock() || object->isRenderFlowThreadContainer();
+            // Skip relatively positioned inlines and anonymous blocks (and the flow threads container) to get to the enclosing RenderBlock.
+            while (object && (!object->isRenderBlock() || object->isAnonymousBlock() || object->isRenderFlowThreadContainer()))
                 object = object->container();
             if (!object || object->posChildNeedsLayout())
                 return;
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 266c83891..3ca2a2255 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -369,6 +369,7 @@ public:
 #endif
 
     virtual bool isRenderFlowThread() const { return false; }
+    virtual bool isRenderFlowThreadContainer() const { return false; }
     virtual bool isRenderNamedFlowThread() const { return false; }
     
     virtual bool isRenderMultiColumnBlock() const { return false; }
diff --git a/Source/WebCore/rendering/RenderRegion.h b/Source/WebCore/rendering/RenderRegion.h
index 93c0fc08b..5f22a75a7 100644
--- a/Source/WebCore/rendering/RenderRegion.h
+++ b/Source/WebCore/rendering/RenderRegion.h
@@ -31,6 +31,7 @@
 #define RenderRegion_h
 
 #include "RenderReplaced.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/RenderRuby.cpp b/Source/WebCore/rendering/RenderRuby.cpp
index 390db2f56..e7b859f70 100644
--- a/Source/WebCore/rendering/RenderRuby.cpp
+++ b/Source/WebCore/rendering/RenderRuby.cpp
@@ -34,6 +34,7 @@
 
 #include "RenderRubyRun.h"
 #include "RenderStyle.h"
+#include "StyleInheritedData.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
diff --git a/Source/WebCore/rendering/RenderRubyRun.cpp b/Source/WebCore/rendering/RenderRubyRun.cpp
index 9c27375df..65d764a9b 100644
--- a/Source/WebCore/rendering/RenderRubyRun.cpp
+++ b/Source/WebCore/rendering/RenderRubyRun.cpp
@@ -36,6 +36,7 @@
 #include "RenderRubyText.h"
 #include "RenderText.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 
 using namespace std;
 
diff --git a/Source/WebCore/rendering/RenderScrollbar.cpp b/Source/WebCore/rendering/RenderScrollbar.cpp
index f8e33c650..216c5f8d8 100644
--- a/Source/WebCore/rendering/RenderScrollbar.cpp
+++ b/Source/WebCore/rendering/RenderScrollbar.cpp
@@ -31,6 +31,7 @@
 #include "RenderPart.h"
 #include "RenderScrollbarPart.h"
 #include "RenderScrollbarTheme.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 2cda8dcc7..77428c499 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -41,6 +41,7 @@
 #include "RenderTableCol.h"
 #include "RenderTableSection.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 
 using namespace std;
 
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 3f304e284..0cefc75a8 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -33,6 +33,7 @@
 #include "PaintInfo.h"
 #include "RenderTableCol.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 #include "TransformState.h"
 
 using namespace std;
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index 7ca33ad61..7dc05fa56 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -32,6 +32,7 @@
 #include "PaintInfo.h"
 #include "RenderTableCell.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 2644a8438..a906a2ef8 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -34,6 +34,7 @@
 #include "RenderTableCol.h"
 #include "RenderTableRow.h"
 #include "RenderView.h"
+#include "StyleInheritedData.h"
 #include <limits>
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
diff --git a/Source/WebCore/rendering/RenderTextControl.cpp b/Source/WebCore/rendering/RenderTextControl.cpp
index 1964d9171..3bc25b897 100644
--- a/Source/WebCore/rendering/RenderTextControl.cpp
+++ b/Source/WebCore/rendering/RenderTextControl.cpp
@@ -27,6 +27,7 @@
 #include "RenderText.h"
 #include "RenderTheme.h"
 #include "ScrollbarTheme.h"
+#include "StyleInheritedData.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
 #include <wtf/unicode/CharacterNames.h>
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
index a46327e65..96997d0ed 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -27,6 +27,7 @@
 #include "HTMLTextAreaElement.h"
 #include "HitTestResult.h"
 #include "ShadowRoot.h"
+#include "StyleInheritedData.h"
 #include "TextControlInnerElements.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/rendering/RenderTextTrackCue.cpp b/Source/WebCore/rendering/RenderTextTrackCue.cpp
new file mode 100644
index 000000000..ef8edda64
--- /dev/null
+++ b/Source/WebCore/rendering/RenderTextTrackCue.cpp
@@ -0,0 +1,230 @@
+/*
+ * Copyright (C) 2012 Victor Carbune (victor@rosedu.org)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO_TRACK)
+
+#include "RenderTextTrackCue.h"
+
+#include "TextTrackCue.h"
+
+namespace WebCore {
+
+RenderTextTrackCue::RenderTextTrackCue(TextTrackCueBox* node)
+    : RenderBlock(static_cast<Node*>(node))
+    , m_cue(node->getCue())
+{
+}
+
+void RenderTextTrackCue::layout()
+{
+    RenderBlock::layout();
+
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    if (m_cue->snapToLines())
+        repositionCueSnapToLinesSet();
+    else
+        repositionCueSnapToLinesNotSet();
+    statePusher.pop();
+}
+
+bool RenderTextTrackCue::initializeLayoutParameters(InlineFlowBox*& firstLineBox, LayoutUnit& step, LayoutUnit& position)
+{
+    ASSERT(firstChild());
+
+    RenderBlock* parentBlock = containingBlock();
+    firstLineBox = toRenderInline(firstChild())->firstLineBox();
+
+    // 1. Horizontal: Let step be the height of the first line box in boxes.
+    //    Vertical: Let step be the width of the first line box in boxes.
+    step = m_cue->getWritingDirection() == TextTrackCue::Horizontal ? firstLineBox->height() : firstLineBox->width();
+
+    // 2. If step is zero, then jump to the step labeled done positioning below.
+    if (!step)
+        return false;
+
+    // 3. Let line position be the text track cue computed line position.
+    int linePosition = m_cue->calculateComputedLinePosition();
+
+    // 4. Vertical Growing Left: Add one to line position then negate it.
+    if (m_cue->getWritingDirection() == TextTrackCue::VerticalGrowingLeft)
+        linePosition = -(linePosition + 1);
+
+    // 5. Let position be the result of multiplying step and line position.
+    position = step * linePosition;
+
+    // 6. Vertical Growing Left: Decrease position by the width of the
+    // bounding box of the boxes in boxes, then increase position by step.
+    if (m_cue->getWritingDirection() == TextTrackCue::VerticalGrowingLeft) {
+        position -= width();
+        position += step;
+    }
+
+    // 7. If line position is less than zero...
+    if (linePosition < 0) {
+        // Horizontal / Vertical: ... then increase position by the
+        // height / width of the video's rendering area ...
+        position += m_cue->getWritingDirection() == TextTrackCue::Horizontal ? parentBlock->height() : parentBlock->width();
+
+        // ... and negate step.
+        step = -step;
+    }
+
+    return true;
+}
+
+void RenderTextTrackCue::placeBoxInDefaultPosition(LayoutUnit position, bool& switched)
+{
+    // 8. Move all boxes in boxes ...
+    if (m_cue->getWritingDirection() == TextTrackCue::Horizontal)
+        // Horizontal: ... down by the distance given by position
+        setY(y() + position);
+    else
+        // Vertical: ... right by the distance given by position
+        setX(x() + position);
+
+    // 9. Default: Remember the position of all the boxes in boxes as their
+    // default position.
+    m_fallbackPosition = FloatPoint(x(), y());
+
+    // 10. Let switched be false.
+    switched = false;
+}
+
+bool RenderTextTrackCue::isOutside() const
+{
+    return !containingBlock()->absoluteBoundingBoxRect().contains(absoluteBoundingBoxRect());
+}
+
+bool RenderTextTrackCue::isOverlapping() const
+{
+    for (RenderObject* box = previousSibling(); box; box = box->previousSibling()) {
+        IntRect boxRect = box->absoluteBoundingBoxRect();
+
+        if (absoluteBoundingBoxRect().intersects(boxRect))
+            return true;
+    }
+
+    return false;
+}
+
+bool RenderTextTrackCue::shouldSwitchDirection(InlineFlowBox* firstLineBox, LayoutUnit step) const
+{
+    LayoutUnit top = y();
+    LayoutUnit left = x();
+    LayoutUnit bottom = top + firstLineBox->height();
+    LayoutUnit right = left + firstLineBox->width();
+
+    // 12. Horizontal: If step is negative and the top of the first line
+    // box in boxes is now above the top of the video's rendering area,
+    // or if step is positive and the bottom of the first line box in
+    // boxes is now below the bottom of the video's rendering area, jump
+    // to the step labeled switch direction.
+    LayoutUnit parentHeight = containingBlock()->height();
+    if (m_cue->getWritingDirection() == TextTrackCue::Horizontal && ((step < 0 && top < 0) || (step > 0 && bottom > parentHeight)))
+        return true;
+
+    // 12. Vertical: If step is negative and the left edge of the first line
+    // box in boxes is now to the left of the left edge of the video's
+    // rendering area, or if step is positive and the right edge of the
+    // first line box in boxes is now to the right of the right edge of
+    // the video's rendering area, jump to the step labeled switch direction.
+    LayoutUnit parentWidth = containingBlock()->width();
+    if (m_cue->getWritingDirection() != TextTrackCue::Horizontal && ((step < 0 && left < 0) || (step > 0 && right > parentWidth)))
+        return true;
+
+    return false;
+}
+
+void RenderTextTrackCue::moveBoxesByStep(LayoutUnit step)
+{
+    // 13. Horizontal: Move all the boxes in boxes down by the distance
+    // given by step. (If step is negative, then this will actually
+    // result in an upwards movement of the boxes in absolute terms.)
+    if (m_cue->getWritingDirection() == TextTrackCue::Horizontal)
+        setY(y() + step);
+
+    // 13. Vertical: Move all the boxes in boxes right by the distance
+    // given by step. (If step is negative, then this will actually
+    // result in a leftwards movement of the boxes in absolute terms.)
+    else
+        setX(x() + step);
+}
+
+bool RenderTextTrackCue::switchDirection(bool& switched, LayoutUnit& step)
+{
+    // 15. Switch direction: Move all the boxes in boxes back to their
+    // default position as determined in the step above labeled default.
+    setX(m_fallbackPosition.x());
+    setY(m_fallbackPosition.y());
+
+    // 16. If switched is true, jump to the step labeled done
+    // positioning below.
+    if (switched)
+        return false;
+
+    // 17. Negate step.
+    step = -step;
+
+    // 18. Set switched to true.
+    switched = true;
+    return true;
+}
+
+void RenderTextTrackCue::repositionCueSnapToLinesSet()
+{
+    InlineFlowBox* firstLineBox;
+    LayoutUnit step;
+    LayoutUnit position;
+    if (!initializeLayoutParameters(firstLineBox, step, position))
+        return;
+
+    bool switched;
+    placeBoxInDefaultPosition(position, switched);
+
+    // 11. Step loop: If none of the boxes in boxes would overlap any of the boxes
+    // in output and all the boxes in output are within the video's rendering area
+    // then jump to the step labeled done positioning.
+    while (isOutside() || isOverlapping()) {
+        if (!shouldSwitchDirection(firstLineBox, step))
+            // 13. Move all the boxes in boxes ...
+            // 14. Jump back to the step labeled step loop.
+            moveBoxesByStep(step);
+        else if (!switchDirection(switched, step))
+            break;
+
+        // 19. Jump back to the step labeled step loop.
+    }
+}
+
+void RenderTextTrackCue::repositionCueSnapToLinesNotSet()
+{
+    // FIXME: Implement overlapping detection when snap-to-lines is not set. http://wkb.ug/84296
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/rendering/RenderTextTrackCue.h b/Source/WebCore/rendering/RenderTextTrackCue.h
new file mode 100644
index 000000000..8973ad8a7
--- /dev/null
+++ b/Source/WebCore/rendering/RenderTextTrackCue.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Victor Carbune (victor@rosedu.org)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RenderTextTrackCue_h
+#define RenderTextTrackCue_h
+
+#if ENABLE(VIDEO_TRACK)
+
+#include "FloatPoint.h"
+#include "RenderBlock.h"
+#include "RenderInline.h"
+#include "RenderView.h"
+
+namespace WebCore {
+
+class TextTrackCueBox;
+
+class RenderTextTrackCue : public RenderBlock {
+public:
+    explicit RenderTextTrackCue(TextTrackCueBox*);
+
+private:
+    virtual void layout() OVERRIDE;
+
+    bool isOutside() const;
+    bool isOverlapping() const;
+    bool shouldSwitchDirection(InlineFlowBox*, LayoutUnit) const;
+
+    void moveBoxesByStep(LayoutUnit);
+    bool switchDirection(bool&, LayoutUnit&);
+
+    bool initializeLayoutParameters(InlineFlowBox*&, LayoutUnit&, LayoutUnit&);
+    void placeBoxInDefaultPosition(LayoutUnit, bool&);
+    void repositionCueSnapToLinesSet();
+
+    void repositionCueSnapToLinesNotSet();
+
+    TextTrackCue* m_cue;
+    FloatPoint m_fallbackPosition;
+};
+
+} // namespace WebCore
+
+#endif
+#endif // RenderTextTrackCue_h
diff --git a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 3eaae4111..0a58af605 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -25,6 +25,7 @@
 #include "RenderThemeChromiumSkia.h"
 
 #include "CSSValueKeywords.h"
+#include "Font.h"
 #include "GraphicsContext.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
diff --git a/Source/WebCore/rendering/RenderThemeWinCE.cpp b/Source/WebCore/rendering/RenderThemeWinCE.cpp
index 188cd90b9..c5750f4bc 100644
--- a/Source/WebCore/rendering/RenderThemeWinCE.cpp
+++ b/Source/WebCore/rendering/RenderThemeWinCE.cpp
@@ -27,6 +27,7 @@
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
+#include "FontMetrics.h"
 #include "GraphicsContext.h"
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index 048f6e1ce..02b54c660 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -38,6 +38,7 @@
 #include "RenderSelectionInfo.h"
 #include "RenderWidget.h"
 #include "RenderWidgetProtector.h"
+#include "StyleInheritedData.h"
 #include "TransformState.h"
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -217,12 +218,9 @@ void RenderView::mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, Transfo
 
 bool RenderView::requiresColumns(int desiredColumnCount) const
 {
-    if (m_frameView) {
-        if (Frame* frame = m_frameView->frame()) {
-            if (Page* page = frame->page())
-                return frame == page->mainFrame() && page->pagination().mode != Page::Pagination::Unpaginated;
-        }
-    }
+    if (m_frameView)
+        return m_frameView->pagination().mode != Pagination::Unpaginated;
+
     return RenderBlock::requiresColumns(desiredColumnCount);
 }
 
@@ -230,24 +228,17 @@ void RenderView::calcColumnWidth()
 {
     int columnWidth = contentLogicalWidth();
     if (m_frameView && style()->hasInlineColumnAxis()) {
-        if (Frame* frame = m_frameView->frame()) {
-            if (Page* page = frame->page()) {
-                if (int pageLength = page->pagination().pageLength)
-                    columnWidth = pageLength;
-            }
-        }
+        if (int pageLength = m_frameView->pagination().pageLength)
+            columnWidth = pageLength;
     }
     setDesiredColumnCountAndWidth(1, columnWidth);
 }
 
 ColumnInfo::PaginationUnit RenderView::paginationUnit() const
 {
-    if (m_frameView) {
-        if (Frame* frame = m_frameView->frame()) {
-            if (Page* page = frame->page())
-                return (frame == page->mainFrame() && page->pagination().behavesLikeColumns) ? ColumnInfo::Column : ColumnInfo::Page;
-        }
-    }
+    if (m_frameView)
+        return m_frameView->pagination().behavesLikeColumns ? ColumnInfo::Column : ColumnInfo::Page;
+
     return ColumnInfo::Page;
 }
 
@@ -799,14 +790,8 @@ int RenderView::viewLogicalHeight() const
     int height = style()->isHorizontalWritingMode() ? viewHeight() : viewWidth();
 
     if (hasColumns() && !style()->hasInlineColumnAxis()) {
-        if (Frame* frame = m_frameView->frame()) {
-            if (Page* page = frame->page()) {
-                if (frame == page->mainFrame()) {
-                    if (int pageLength = page->pagination().pageLength)
-                        height = pageLength;
-                }
-            }
-        }
+        if (int pageLength = m_frameView->pagination().pageLength)
+            height = pageLength;
     }
 
     return height;
@@ -928,13 +913,8 @@ CustomFilterGlobalContext* RenderView::customFilterGlobalContext()
 void RenderView::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
-    
-    for (RenderObject* renderer = firstChild(); renderer; renderer = renderer->nextSibling()) {
-        if (renderer->isRenderNamedFlowThread()) {
-            RenderNamedFlowThread* flowRenderer = toRenderNamedFlowThread(renderer);
-            flowRenderer->setStyle(RenderFlowThread::createFlowThreadStyle(style()));
-        }
-    }
+    if (hasRenderNamedFlowThreads())
+        flowThreadController()->styleDidChange();
 }
 
 bool RenderView::hasRenderNamedFlowThreads() const
diff --git a/Source/WebCore/rendering/TextAutosizer.cpp b/Source/WebCore/rendering/TextAutosizer.cpp
index 9e0f2a47d..6122962b2 100644
--- a/Source/WebCore/rendering/TextAutosizer.cpp
+++ b/Source/WebCore/rendering/TextAutosizer.cpp
@@ -31,6 +31,7 @@
 #include "RenderText.h"
 #include "RenderView.h"
 #include "Settings.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
index 25ec75039..cd1e26cb2 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLBlock.h
@@ -30,6 +30,7 @@
 #if ENABLE(MATHML)
 
 #include "RenderBlock.h"
+#include "StyleInheritedData.h"
 
 #define ENABLE_DEBUG_MATH_LAYOUT 0
 
diff --git a/Source/WebCore/rendering/style/KeyframeList.h b/Source/WebCore/rendering/style/KeyframeList.h
index 5101b0689..6193fa67d 100644
--- a/Source/WebCore/rendering/style/KeyframeList.h
+++ b/Source/WebCore/rendering/style/KeyframeList.h
@@ -26,6 +26,7 @@
 #define KeyframeList_h
 
 #include "CSSPropertyNames.h"
+#include "StyleInheritedData.h"
 #include <wtf/Vector.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 72a438961..37d98904e 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -26,6 +26,7 @@
 #include "ContentData.h"
 #include "CursorList.h"
 #include "CSSPropertyNames.h"
+#include "Font.h"
 #include "FontSelector.h"
 #include "MemoryInstrumentation.h"
 #include "QuotesData.h"
@@ -34,6 +35,7 @@
 #include "ScaleTransformOperation.h"
 #include "ShadowData.h"
 #include "StyleImage.h"
+#include "StyleInheritedData.h"
 #include "StyleResolver.h"
 #if ENABLE(TOUCH_EVENTS)
 #include "RenderTheme.h"
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 0925f80b7..011950c8e 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -35,7 +35,8 @@
 #include "CounterDirectives.h"
 #include "DataRef.h"
 #include "FillLayer.h"
-#include "Font.h"
+#include "FontBaseline.h"
+#include "FontDescription.h"
 #include "GraphicsTypes.h"
 #include "Length.h"
 #include "LengthBox.h"
@@ -53,7 +54,6 @@
 #include "StyleFlexibleBoxData.h"
 #include "StyleGridData.h"
 #include "StyleGridItemData.h"
-#include "StyleInheritedData.h"
 #include "StyleMarqueeData.h"
 #include "StyleMultiColData.h"
 #include "StyleRareInheritedData.h"
@@ -104,11 +104,14 @@ using std::max;
 class BorderData;
 class CounterContent;
 class CursorList;
+class Font;
+class FontMetrics;
 class IntRect;
 class MemoryObjectInfo;
 class Pair;
 class ShadowData;
 class StyleImage;
+class StyleInheritedData;
 class StyleResolver;
 class TransformationMatrix;
 
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index b0c330d13..880b62243 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -114,7 +114,7 @@ enum EBoxSizing { CONTENT_BOX, BORDER_BOX };
 // Random visual rendering model attributes. Not inherited.
 
 enum EOverflow {
-    OVISIBLE, OHIDDEN, OSCROLL, OAUTO, OOVERLAY, OMARQUEE
+    OVISIBLE, OHIDDEN, OSCROLL, OAUTO, OOVERLAY, OMARQUEE, OPAGEDX, OPAGEDY
 };
 
 enum EVerticalAlign {
diff --git a/Source/WebCore/rendering/style/StyleInheritedData.cpp b/Source/WebCore/rendering/style/StyleInheritedData.cpp
index ad14cbbfa..021740f15 100644
--- a/Source/WebCore/rendering/style/StyleInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleInheritedData.cpp
@@ -20,7 +20,7 @@
  */
 
 #include "config.h"
-#include "StyleRareInheritedData.h"
+#include "StyleInheritedData.h"
 
 #include "RenderStyle.h"
 #include "StyleImage.h"
diff --git a/Source/WebCore/rendering/svg/RenderSVGBlock.cpp b/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
index c4f9a284d..361279415 100644
--- a/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
@@ -27,6 +27,7 @@
 #include "RenderSVGResource.h"
 #include "SVGElement.h"
 #include "SVGResourcesCache.h"
+#include "StyleInheritedData.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGInlineText.h b/Source/WebCore/rendering/svg/RenderSVGInlineText.h
index ab81ca99f..7643cf1ab 100644
--- a/Source/WebCore/rendering/svg/RenderSVGInlineText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGInlineText.h
@@ -23,6 +23,7 @@
 #define RenderSVGInlineText_h
 
 #if ENABLE(SVG)
+#include "Font.h"
 #include "RenderText.h"
 #include "SVGTextLayoutAttributes.h"
 
diff --git a/Source/WebCore/svg/SVGLengthContext.cpp b/Source/WebCore/svg/SVGLengthContext.cpp
index d33de3456..51b4900fc 100644
--- a/Source/WebCore/svg/SVGLengthContext.cpp
+++ b/Source/WebCore/svg/SVGLengthContext.cpp
@@ -27,6 +27,7 @@
 
 #include "CSSHelper.h"
 #include "ExceptionCode.h"
+#include "FontMetrics.h"
 #include "Frame.h"
 #include "RenderPart.h"
 #include "RenderSVGRoot.h"
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index cc3b55488..f74e01151 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -36,6 +36,7 @@
 #include "SVGDocument.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
+#include "StyleInheritedData.h"
 #include "Text.h"
 #include "XLinkNames.h"
 
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index 063027870..cd673982c 100755
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -160,7 +160,7 @@ void InternalSettings::reset()
 {
     TextRun::setAllowsRoundingHacks(false);
     setUserPreferredLanguages(Vector<String>());
-    page()->setPagination(Page::Pagination());
+    page()->setPagination(Pagination());
     page()->setPageScaleFactor(1, IntPoint(0, 0));
 #if ENABLE(PAGE_POPUP)
     m_pagePopupDriver.clear();
@@ -565,17 +565,17 @@ void InternalSettings::setPagination(const String& mode, int gap, int pageLength
         return;
     }
 
-    Page::Pagination pagination;
+    Pagination pagination;
     if (mode == "Unpaginated")
-        pagination.mode = Page::Pagination::Unpaginated;
+        pagination.mode = Pagination::Unpaginated;
     else if (mode == "LeftToRightPaginated")
-        pagination.mode = Page::Pagination::LeftToRightPaginated;
+        pagination.mode = Pagination::LeftToRightPaginated;
     else if (mode == "RightToLeftPaginated")
-        pagination.mode = Page::Pagination::RightToLeftPaginated;
+        pagination.mode = Pagination::RightToLeftPaginated;
     else if (mode == "TopToBottomPaginated")
-        pagination.mode = Page::Pagination::TopToBottomPaginated;
+        pagination.mode = Pagination::TopToBottomPaginated;
     else if (mode == "BottomToTopPaginated")
-        pagination.mode = Page::Pagination::BottomToTopPaginated;
+        pagination.mode = Pagination::BottomToTopPaginated;
     else {
         ec = SYNTAX_ERR;
         return;
diff --git a/Source/WebCore/workers/DedicatedWorkerContext.cpp b/Source/WebCore/workers/DedicatedWorkerContext.cpp
index d31da76cb..769de8cda 100644
--- a/Source/WebCore/workers/DedicatedWorkerContext.cpp
+++ b/Source/WebCore/workers/DedicatedWorkerContext.cpp
@@ -42,15 +42,15 @@
 namespace WebCore {
 
 // static
-PassRefPtr<DedicatedWorkerContext> DedicatedWorkerContext::create(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+PassRefPtr<DedicatedWorkerContext> DedicatedWorkerContext::create(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, PassRefPtr<SecurityOrigin> topOrigin)
 {
-    RefPtr<DedicatedWorkerContext> context = adoptRef(new DedicatedWorkerContext(url, userAgent, settings, thread));
+    RefPtr<DedicatedWorkerContext> context = adoptRef(new DedicatedWorkerContext(url, userAgent, settings, thread, topOrigin));
     context->applyContentSecurityPolicyFromString(contentSecurityPolicy, contentSecurityPolicyType);
     return context.release();
 }
 
-DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread)
-    : WorkerContext(url, userAgent, settings, thread)
+DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, DedicatedWorkerThread* thread, PassRefPtr<SecurityOrigin> topOrigin)
+    : WorkerContext(url, userAgent, settings, thread, topOrigin)
 {
 }
 
diff --git a/Source/WebCore/workers/DedicatedWorkerContext.h b/Source/WebCore/workers/DedicatedWorkerContext.h
index fdd1189c5..12f7ca209 100644
--- a/Source/WebCore/workers/DedicatedWorkerContext.h
+++ b/Source/WebCore/workers/DedicatedWorkerContext.h
@@ -44,7 +44,7 @@ namespace WebCore {
     class DedicatedWorkerContext : public WorkerContext {
     public:
         typedef WorkerContext Base;
-        static PassRefPtr<DedicatedWorkerContext> create(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, DedicatedWorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType);
+        static PassRefPtr<DedicatedWorkerContext> create(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, DedicatedWorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, PassRefPtr<SecurityOrigin> topOrigin);
 
         virtual bool isDedicatedWorkerContext() const { return true; }
 
@@ -63,7 +63,7 @@ namespace WebCore {
 
         DedicatedWorkerThread* thread();
     private:
-        DedicatedWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, DedicatedWorkerThread*);
+        DedicatedWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, DedicatedWorkerThread*, PassRefPtr<SecurityOrigin> topOrigin);
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/workers/DedicatedWorkerThread.cpp b/Source/WebCore/workers/DedicatedWorkerThread.cpp
index 81a4edf2b..738d2c054 100644
--- a/Source/WebCore/workers/DedicatedWorkerThread.cpp
+++ b/Source/WebCore/workers/DedicatedWorkerThread.cpp
@@ -39,13 +39,13 @@
 
 namespace WebCore {
 
-PassRefPtr<DedicatedWorkerThread> DedicatedWorkerThread::create(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+PassRefPtr<DedicatedWorkerThread> DedicatedWorkerThread::create(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, const SecurityOrigin* topOrigin)
 {
-    return adoptRef(new DedicatedWorkerThread(scriptURL, userAgent, settings, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType));
+    return adoptRef(new DedicatedWorkerThread(scriptURL, userAgent, settings, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType, topOrigin));
 }
 
-DedicatedWorkerThread::DedicatedWorkerThread(const KURL& url, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-    : WorkerThread(url, userAgent, settings, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType)
+DedicatedWorkerThread::DedicatedWorkerThread(const KURL& url, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, const SecurityOrigin* topOrigin)
+    : WorkerThread(url, userAgent, settings, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType, topOrigin)
     , m_workerObjectProxy(workerObjectProxy)
 {
 }
@@ -54,9 +54,9 @@ DedicatedWorkerThread::~DedicatedWorkerThread()
 {
 }
 
-PassRefPtr<WorkerContext> DedicatedWorkerThread::createWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+PassRefPtr<WorkerContext> DedicatedWorkerThread::createWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, PassRefPtr<SecurityOrigin> topOrigin)
 {
-    return DedicatedWorkerContext::create(url, userAgent, settings, this, contentSecurityPolicy, contentSecurityPolicyType);
+    return DedicatedWorkerContext::create(url, userAgent, settings, this, contentSecurityPolicy, contentSecurityPolicyType, topOrigin);
 }
 
 void DedicatedWorkerThread::runEventLoop()
diff --git a/Source/WebCore/workers/DedicatedWorkerThread.h b/Source/WebCore/workers/DedicatedWorkerThread.h
index 5aa13d0d1..5d94072be 100644
--- a/Source/WebCore/workers/DedicatedWorkerThread.h
+++ b/Source/WebCore/workers/DedicatedWorkerThread.h
@@ -41,16 +41,16 @@ namespace WebCore {
 
     class DedicatedWorkerThread : public WorkerThread {
     public:
-        static PassRefPtr<DedicatedWorkerThread> create(const KURL& scriptURL, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        static PassRefPtr<DedicatedWorkerThread> create(const KURL& scriptURL, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType, const SecurityOrigin* topOrigin);
         WorkerObjectProxy& workerObjectProxy() const { return m_workerObjectProxy; }
         ~DedicatedWorkerThread();
 
     protected:
-        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType, PassRefPtr<SecurityOrigin> topOrigin);
         virtual void runEventLoop();
 
     private:
-        DedicatedWorkerThread(const KURL&, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        DedicatedWorkerThread(const KURL&, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType, const SecurityOrigin* topOrigin);
 
         WorkerObjectProxy& m_workerObjectProxy;
     };
diff --git a/Source/WebCore/workers/SharedWorkerContext.cpp b/Source/WebCore/workers/SharedWorkerContext.cpp
index cbd2a340a..7997002ac 100644
--- a/Source/WebCore/workers/SharedWorkerContext.cpp
+++ b/Source/WebCore/workers/SharedWorkerContext.cpp
@@ -59,7 +59,7 @@ PassRefPtr<SharedWorkerContext> SharedWorkerContext::create(const String& name,
 }
 
 SharedWorkerContext::SharedWorkerContext(const String& name, const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, SharedWorkerThread* thread)
-    : WorkerContext(url, userAgent, settings, thread)
+    : WorkerContext(url, userAgent, settings, thread, 0)
     , m_name(name)
 {
 }
diff --git a/Source/WebCore/workers/SharedWorkerThread.cpp b/Source/WebCore/workers/SharedWorkerThread.cpp
index d39b3351d..5631587ad 100644
--- a/Source/WebCore/workers/SharedWorkerThread.cpp
+++ b/Source/WebCore/workers/SharedWorkerThread.cpp
@@ -44,7 +44,7 @@ PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, co
 }
 
 SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-    : WorkerThread(url, userAgent, settings, sourceCode, workerLoaderProxy, workerReportingProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType)
+    : WorkerThread(url, userAgent, settings, sourceCode, workerLoaderProxy, workerReportingProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType, 0)
     , m_name(name.isolatedCopy())
 {
 }
@@ -53,7 +53,7 @@ SharedWorkerThread::~SharedWorkerThread()
 {
 }
 
-PassRefPtr<WorkerContext> SharedWorkerThread::createWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+PassRefPtr<WorkerContext> SharedWorkerThread::createWorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, PassRefPtr<SecurityOrigin>)
 {
     return SharedWorkerContext::create(m_name, url, userAgent, settings, this, contentSecurityPolicy, contentSecurityPolicyType);
 }
diff --git a/Source/WebCore/workers/SharedWorkerThread.h b/Source/WebCore/workers/SharedWorkerThread.h
index c343824eb..c383313f7 100644
--- a/Source/WebCore/workers/SharedWorkerThread.h
+++ b/Source/WebCore/workers/SharedWorkerThread.h
@@ -43,7 +43,7 @@ namespace WebCore {
         ~SharedWorkerThread();
 
     protected:
-        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType, PassRefPtr<SecurityOrigin> topOrigin);
 
     private:
         SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index e5bd15ea6..d7eaf5db4 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -85,7 +85,7 @@ public:
     virtual bool isCleanupTask() const { return true; }
 };
 
-WorkerContext::WorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, WorkerThread* thread)
+WorkerContext::WorkerContext(const KURL& url, const String& userAgent, PassOwnPtr<GroupSettings> settings, WorkerThread* thread, PassRefPtr<SecurityOrigin> topOrigin)
     : m_url(url)
     , m_userAgent(userAgent)
     , m_groupSettings(settings)
@@ -96,6 +96,7 @@ WorkerContext::WorkerContext(const KURL& url, const String& userAgent, PassOwnPt
 #endif
     , m_closing(false)
     , m_eventQueue(WorkerEventQueue::create(this))
+    , m_topOrigin(topOrigin)
 {
     setSecurityOrigin(SecurityOrigin::create(url));
 }
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index 34819d07c..a6d60c814 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -138,8 +138,10 @@ namespace WebCore {
         void unregisterObserver(Observer*);
         void notifyObserversOfStop();
 
+        const SecurityOrigin* topOrigin() const { return m_topOrigin.get(); }
+
     protected:
-        WorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, WorkerThread*);
+        WorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, WorkerThread*, PassRefPtr<SecurityOrigin> topOrigin);
         void applyContentSecurityPolicyFromString(const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
 
         virtual void logExceptionToConsole(const String& errorMessage, const String& sourceURL, int lineNumber, PassRefPtr<ScriptCallStack>);
@@ -183,6 +185,8 @@ namespace WebCore {
         HashSet<Observer*> m_workerObservers;
 
         OwnPtr<WorkerEventQueue> m_eventQueue;
+
+        RefPtr<SecurityOrigin> m_topOrigin;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/workers/WorkerMessagingProxy.cpp b/Source/WebCore/workers/WorkerMessagingProxy.cpp
index 6f839f0a6..c35d8e8aa 100644
--- a/Source/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/Source/WebCore/workers/WorkerMessagingProxy.cpp
@@ -280,8 +280,9 @@ void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const Strin
     if (document->page())
         settings = document->page()->group().groupSettings();
     RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, settings, sourceCode, *this, *this, startMode,
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeader(),
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeaderType());
+                                                                         document->contentSecurityPolicy()->deprecatedHeader(),
+                                                                         document->contentSecurityPolicy()->deprecatedHeaderType(),
+                                                                         document->topDocument()->securityOrigin());
     workerThreadCreated(thread);
     thread->start();
     InspectorInstrumentation::didStartWorkerContext(m_scriptExecutionContext.get(), this, scriptURL);
diff --git a/Source/WebCore/workers/WorkerThread.cpp b/Source/WebCore/workers/WorkerThread.cpp
index bd0355c41..d18c90dca 100644
--- a/Source/WebCore/workers/WorkerThread.cpp
+++ b/Source/WebCore/workers/WorkerThread.cpp
@@ -71,9 +71,9 @@ unsigned WorkerThread::workerThreadCount()
 struct WorkerThreadStartupData {
     WTF_MAKE_NONCOPYABLE(WorkerThreadStartupData); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+    static PassOwnPtr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, const SecurityOrigin* topOrigin)
     {
-        return adoptPtr(new WorkerThreadStartupData(scriptURL, userAgent, settings, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType));
+        return adoptPtr(new WorkerThreadStartupData(scriptURL, userAgent, settings, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType, topOrigin));
     }
 
     KURL m_scriptURL;
@@ -83,17 +83,19 @@ public:
     WorkerThreadStartMode m_startMode;
     String m_contentSecurityPolicy;
     ContentSecurityPolicy::HeaderType m_contentSecurityPolicyType;
+    RefPtr<SecurityOrigin> m_topOrigin;
 private:
-    WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType);
+    WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, const SecurityOrigin* topOrigin);
 };
 
-WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, const SecurityOrigin* topOrigin)
     : m_scriptURL(scriptURL.copy())
     , m_userAgent(userAgent.isolatedCopy())
     , m_sourceCode(sourceCode.isolatedCopy())
     , m_startMode(startMode)
     , m_contentSecurityPolicy(contentSecurityPolicy.isolatedCopy())
     , m_contentSecurityPolicyType(contentSecurityPolicyType)
+    , m_topOrigin(topOrigin ? topOrigin->isolatedCopy() : 0)
 {
     if (!settings)
         return;
@@ -104,11 +106,11 @@ WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const St
     m_groupSettings->setIndexedDBDatabasePath(settings->indexedDBDatabasePath().isolatedCopy());
 }
 
-WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType, const SecurityOrigin* topOrigin)
     : m_threadID(0)
     , m_workerLoaderProxy(workerLoaderProxy)
     , m_workerReportingProxy(workerReportingProxy)
-    , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, settings, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType))
+    , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, settings, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType, topOrigin))
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     , m_notificationClient(0)
 #endif
@@ -146,7 +148,7 @@ void WorkerThread::workerThread()
 {
     {
         MutexLocker lock(m_threadCreationMutex);
-        m_workerContext = createWorkerContext(m_startupData->m_scriptURL, m_startupData->m_userAgent, m_startupData->m_groupSettings.release(), m_startupData->m_contentSecurityPolicy, m_startupData->m_contentSecurityPolicyType);
+        m_workerContext = createWorkerContext(m_startupData->m_scriptURL, m_startupData->m_userAgent, m_startupData->m_groupSettings.release(), m_startupData->m_contentSecurityPolicy, m_startupData->m_contentSecurityPolicyType, m_startupData->m_topOrigin.release());
 
         if (m_runLoop.terminated()) {
             // The worker was terminated before the thread had a chance to run. Since the context didn't exist yet,
diff --git a/Source/WebCore/workers/WorkerThread.h b/Source/WebCore/workers/WorkerThread.h
index 670e3cd1c..dc3072fcb 100644
--- a/Source/WebCore/workers/WorkerThread.h
+++ b/Source/WebCore/workers/WorkerThread.h
@@ -31,6 +31,7 @@
 
 #include "ContentSecurityPolicy.h"
 #include "GroupSettings.h"
+#include "SecurityOrigin.h"
 #include "WorkerRunLoop.h"
 #include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
@@ -69,10 +70,10 @@ namespace WebCore {
 #endif
 
     protected:
-        WorkerThread(const KURL&, const String& userAgent, const GroupSettings*,  const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        WorkerThread(const KURL&, const String& userAgent, const GroupSettings*,  const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType, const SecurityOrigin* topOrigin);
 
         // Factory method for creating a new worker context for the thread.
-        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType) = 0;
+        virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String& userAgent, PassOwnPtr<GroupSettings>, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType, PassRefPtr<SecurityOrigin> topOrigin) = 0;
 
         // Executes the event loop for the worker thread. Derived classes can override to perform actions before/after entering the event loop.
         virtual void runEventLoop();
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index c50c39829..7eb7e5904 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -6445,5 +6445,10 @@ void WebPagePrivate::restoreHistoryViewState(Platform::IntSize contentsSize, Pla
     }
 }
 
+IntSize WebPagePrivate::screenSize() const
+{
+    return Platform::Graphics::Screen::primaryScreen()->size();
+}
+
 }
 }
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index 2ee4d6a04..a005d81b6 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -462,6 +462,8 @@ public:
     void applySizeOverride(int overrideWidth, int overrideHeight);
     void setTextZoomFactor(float);
 
+    WebCore::IntSize screenSize() const;
+
     WebPage* m_webPage;
     WebPageClient* m_client;
     WebCore::InspectorClientBlackBerry* m_inspectorClient;
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 0db79e222..1059181c0 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,30 @@
+2012-08-22  Crystal Zhang  <haizhang@rim.com>
+
+        [BlackBerry] Make all pickers non-zoomable
+        https://bugs.webkit.org/show_bug.cgi?id=94729
+
+        Reviewed by Antonio Gomes.
+
+        Move HTML header initialization to PagePopupBlackBerry as that part are all the same, and make all pickers non-zoomable.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::screenSize):
+        (WebKit):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/DatePickerClient.cpp:
+        (WebCore::DatePickerClient::generateHTML):
+        (WebCore::DatePickerClient::writeDocument):
+        * WebCoreSupport/PagePopupBlackBerry.cpp:
+        (WebCore::PagePopupBlackBerry::init):
+        (WebCore::PagePopupBlackBerry::generateHTML):
+        (WebCore):
+        * WebCoreSupport/PagePopupBlackBerry.h:
+        (PagePopupBlackBerry):
+        * WebCoreSupport/SelectPopupClient.cpp:
+        (WebCore::SelectPopupClient::generateHTML):
+        (WebCore::SelectPopupClient::writeDocument):
+
 2012-08-21  Benjamin C Meyer  <bmeyer@rim.com>
 
         [BlackBerry] Add option to only add JavaScript object 'qnx' to private webviews
diff --git a/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.cpp b/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.cpp
index d70dc4fbe..93f7fda26 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/DatePickerClient.cpp
@@ -50,7 +50,7 @@ DatePickerClient::~DatePickerClient()
 void DatePickerClient::generateHTML(BlackBerry::Platform::BlackBerryInputType type, const BlackBerry::WebKit::WebString& value, const BlackBerry::WebKit::WebString& min, const BlackBerry::WebKit::WebString& max, double step)
 {
     StringBuilder source;
-    source.append("<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\"/><style>\n");
+    source.append("<style>\n");
     // Include CSS file.
     source.append(popupControlBlackBerryCss,
             sizeof(popupControlBlackBerryCss));
@@ -134,9 +134,6 @@ void DatePickerClient::didClosePopup()
 
 void DatePickerClient::writeDocument(DocumentWriter& writer)
 {
-    writer.setMIMEType("text/html");
-    writer.begin(KURL());
     writer.addData(m_source.utf8().data(), m_source.utf8().length());
-    writer.end();
 }
 }
diff --git a/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp
index 5141a890b..402b52333 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp
@@ -40,6 +40,7 @@
 
 // Fixme: should get the height from runtime.
 #define URL_BAR_HEIGHT 70
+#define PADDING 80
 
 using namespace BlackBerry::Platform::Graphics;
 using namespace BlackBerry::WebKit;
@@ -63,14 +64,32 @@ bool PagePopupBlackBerry::sendCreatePopupWebViewRequest()
 
 bool PagePopupBlackBerry::init(WebPage* webpage)
 {
-    DocumentWriter* writer = webpage->d->mainFrame()->loader()->activeDocumentLoader()->writer();
-    m_client->writeDocument(*writer);
+    generateHTML(webpage);
 
     installDomFunction(webpage->d->mainFrame());
 
     return true;
 }
 
+void PagePopupBlackBerry::generateHTML(WebPage* webpage)
+{
+    DocumentWriter* writer = webpage->d->mainFrame()->loader()->activeDocumentLoader()->writer();
+    writer->setMIMEType("text/html");
+    writer->begin(KURL());
+
+    // All the popups have the same html head and the page content should be non-zoomable.
+    StringBuilder source;
+    // FIXME: the hardcoding padding will be removed soon.
+    int screenWidth = webpage->d->screenSize().width() - PADDING;
+    source.append("<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\"/>\n");
+    source.append("<meta name=\"viewport\" content=\"width=" + String::number(screenWidth));
+    source.append("; user-scalable=no\" />\n");
+    writer->addData(source.toString().utf8().data(), source.toString().utf8().length());
+
+    m_client->writeDocument(*writer);
+    writer->end();
+}
+
 static JSValueRef setValueAndClosePopupCallback(JSContextRef context,
         JSObjectRef, JSObjectRef, size_t argumentCount,
         const JSValueRef arguments[], JSValueRef*)
diff --git a/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.h
index c82e8c6b6..5d71e4c90 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.h
@@ -46,6 +46,7 @@ public:
     void closePopup();
     void installDomFunction(Frame*);
     void setRect();
+    void generateHTML(BlackBerry::WebKit::WebPage*);
 
 private:
     BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
diff --git a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
index 4b69bd6d3..138a6718f 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
@@ -66,7 +66,7 @@ void SelectPopupClient::generateHTML(bool multiple, int size, const ScopeArray<B
     const int* itemType, bool* selecteds)
 {
     StringBuilder source;
-    source.append("<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\"/><style>\n");
+    source.append("<style>\n");
     // Include CSS file.
     source.append(popupControlBlackBerryCss,
             sizeof(popupControlBlackBerryCss));
@@ -188,10 +188,7 @@ void SelectPopupClient::didClosePopup()
 
 void SelectPopupClient::writeDocument(DocumentWriter& writer)
 {
-    writer.setMIMEType("text/html");
-    writer.begin(KURL());
     writer.addData(m_source.utf8().data(), m_source.utf8().length());
-    writer.end();
 }
 
 void SelectPopupClient::notifySelectionChange(WebCore::Timer<SelectPopupClient>*)
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index 7804ecd97..41b2bb936 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,525 @@
+2012-08-22  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: tests for injection/extraction of idb keys
+        https://bugs.webkit.org/show_bug.cgi?id=94653
+
+        Reviewed by Tony Chang.
+
+        Added unit tests for key injection/extraction using
+        SerializedScriptValue. These were moved from chromium, now
+        that all uses of the API are through WebKit.
+
+        * tests/IDBKeyPathTest.cpp:
+        (WebCore):
+        (WebCore::TEST):
+
+2012-08-22  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Change WebLayer from a concrete type to a pure virtual interface
+        https://bugs.webkit.org/show_bug.cgi?id=94174
+
+        Reviewed by Adrienne Walker.
+
+        This updates the implementation of the Web*Layer family to the new design and updates callers in WebViewImpl /
+        NonCompositedContentHost / LinkHighlight.
+
+        * WebKit.gypi:
+        * src/LinkHighlight.cpp:
+        (WebKit::LinkHighlight::LinkHighlight):
+        (WebKit::LinkHighlight::contentLayer):
+        (WebKit::LinkHighlight::clipLayer):
+        (WebKit::LinkHighlight::releaseResources):
+        (WebKit::LinkHighlight::computeHighlightLayerPathAndPosition):
+        (WebKit::LinkHighlight::startHighlightAnimation):
+        (WebKit::LinkHighlight::updateGeometry):
+        * src/LinkHighlight.h:
+        (LinkHighlight):
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::NonCompositedContentHost):
+        (WebKit::NonCompositedContentHost::setScrollLayer):
+        (WebKit::NonCompositedContentHost::setViewport):
+        (WebKit::NonCompositedContentHost::scrollLayer):
+        * src/NonCompositedContentHost.h:
+        * src/WebContentLayer.cpp: Removed.
+        * src/WebContentLayerImpl.cpp:
+        (WebKit::WebContentLayer::create):
+        (WebKit::WebContentLayerImpl::WebContentLayerImpl):
+        (WebKit::WebContentLayerImpl::~WebContentLayerImpl):
+        (WebKit::WebContentLayerImpl::layer):
+        (WebKit):
+        (WebKit::WebContentLayerImpl::setDoubleSided):
+        (WebKit::WebContentLayerImpl::setContentsScale):
+        (WebKit::WebContentLayerImpl::setUseLCDText):
+        (WebKit::WebContentLayerImpl::setDrawCheckerboardForMissingTiles):
+        (WebKit::WebContentLayerImpl::paintContents):
+        * src/WebContentLayerImpl.h:
+        (WebContentLayerImpl):
+        * src/WebExternalTextureLayerImpl.cpp: Renamed from Source/WebKit/chromium/src/WebExternalTextureLayer.cpp.
+        (WebKit):
+        (WebKit::WebExternalTextureLayer::create):
+        (WebKit::WebExternalTextureLayerImpl::WebExternalTextureLayerImpl):
+        (WebKit::WebExternalTextureLayerImpl::~WebExternalTextureLayerImpl):
+        (WebKit::WebExternalTextureLayerImpl::layer):
+        (WebKit::WebExternalTextureLayerImpl::setTextureId):
+        (WebKit::WebExternalTextureLayerImpl::setFlipped):
+        (WebKit::WebExternalTextureLayerImpl::setUVRect):
+        (WebKit::WebExternalTextureLayerImpl::setOpaque):
+        (WebKit::WebExternalTextureLayerImpl::setPremultipliedAlpha):
+        (WebKit::WebExternalTextureLayerImpl::willModifyTexture):
+        (WebKit::WebExternalTextureLayerImpl::setRateLimitContext):
+        (WebTextureUpdaterImpl):
+        (WebKit::WebTextureUpdaterImpl::WebTextureUpdaterImpl):
+        (WebKit::WebExternalTextureLayerImpl::prepareTexture):
+        (WebKit::WebExternalTextureLayerImpl::context):
+        * src/WebExternalTextureLayerImpl.h: Copied from Source/Platform/chromium/public/WebVideoLayer.h.
+        (WebKit):
+        (WebExternalTextureLayerImpl):
+        * src/WebIOSurfaceLayerImpl.cpp: Renamed from Source/WebKit/chromium/src/WebIOSurfaceLayer.cpp.
+        (WebKit):
+        (WebKit::WebIOSurfaceLayer::create):
+        (WebKit::WebIOSurfaceLayerImpl::WebIOSurfaceLayerImpl):
+        (WebKit::WebIOSurfaceLayerImpl::~WebIOSurfaceLayerImpl):
+        (WebKit::WebIOSurfaceLayerImpl::setIOSurfaceProperties):
+        (WebKit::WebIOSurfaceLayerImpl::layer):
+        * src/WebIOSurfaceLayerImpl.h: Copied from Source/Platform/chromium/public/WebImageLayer.h.
+        (WebCore):
+        (WebKit):
+        (WebIOSurfaceLayerImpl):
+        * src/WebImageLayerImpl.cpp: Renamed from Source/WebKit/chromium/src/WebSolidColorLayer.cpp.
+        (WebKit):
+        (WebKit::WebImageLayer::create):
+        (WebKit::WebImageLayerImpl::WebImageLayerImpl):
+        (WebKit::WebImageLayerImpl::~WebImageLayerImpl):
+        (WebKit::WebImageLayerImpl::layer):
+        (WebKit::WebImageLayerImpl::setBitmap):
+        * src/WebImageLayerImpl.h: Renamed from Source/WebKit/chromium/src/WebImageLayer.cpp.
+        (WebCore):
+        (WebKit):
+        (WebImageLayerImpl):
+        * src/WebLayer.cpp: Removed.
+        * src/WebLayerImpl.cpp:
+        (WebKit::WebLayer::create):
+        (WebKit::WebLayerImpl::WebLayerImpl):
+        (WebKit::WebLayerImpl::~WebLayerImpl):
+        (WebKit):
+        (WebKit::WebLayerImpl::id):
+        (WebKit::WebLayerImpl::invalidateRect):
+        (WebKit::WebLayerImpl::invalidate):
+        (WebKit::WebLayerImpl::addChild):
+        (WebKit::WebLayerImpl::insertChild):
+        (WebKit::WebLayerImpl::replaceChild):
+        (WebKit::WebLayerImpl::setChildren):
+        (WebKit::WebLayerImpl::removeFromParent):
+        (WebKit::WebLayerImpl::removeAllChildren):
+        (WebKit::WebLayerImpl::setAnchorPoint):
+        (WebKit::WebLayerImpl::anchorPoint):
+        (WebKit::WebLayerImpl::setAnchorPointZ):
+        (WebKit::WebLayerImpl::anchorPointZ):
+        (WebKit::WebLayerImpl::setBounds):
+        (WebKit::WebLayerImpl::bounds):
+        (WebKit::WebLayerImpl::setMasksToBounds):
+        (WebKit::WebLayerImpl::masksToBounds):
+        (WebKit::WebLayerImpl::setMaskLayer):
+        (WebKit::WebLayerImpl::setReplicaLayer):
+        (WebKit::WebLayerImpl::setOpacity):
+        (WebKit::WebLayerImpl::opacity):
+        (WebKit::WebLayerImpl::setOpaque):
+        (WebKit::WebLayerImpl::opaque):
+        (WebKit::WebLayerImpl::setPosition):
+        (WebKit::WebLayerImpl::position):
+        (WebKit::WebLayerImpl::setSublayerTransform):
+        (WebKit::WebLayerImpl::sublayerTransform):
+        (WebKit::WebLayerImpl::setTransform):
+        (WebKit::WebLayerImpl::transform):
+        (WebKit::WebLayerImpl::setDrawsContent):
+        (WebKit::WebLayerImpl::drawsContent):
+        (WebKit::WebLayerImpl::setPreserves3D):
+        (WebKit::WebLayerImpl::setUseParentBackfaceVisibility):
+        (WebKit::WebLayerImpl::setBackgroundColor):
+        (WebKit::WebLayerImpl::setFilters):
+        (WebKit::WebLayerImpl::setBackgroundFilters):
+        (WebKit::WebLayerImpl::setDebugBorderColor):
+        (WebKit::WebLayerImpl::setDebugBorderWidth):
+        (WebKit::WebLayerImpl::setDebugName):
+        (WebKit::WebLayerImpl::setAnimationDelegate):
+        (WebKit::WebLayerImpl::addAnimation):
+        (WebKit::WebLayerImpl::removeAnimation):
+        (WebKit::WebLayerImpl::pauseAnimation):
+        (WebKit::WebLayerImpl::suspendAnimations):
+        (WebKit::WebLayerImpl::resumeAnimations):
+        (WebKit::WebLayerImpl::hasActiveAnimation):
+        (WebKit::WebLayerImpl::transferAnimationsTo):
+        (WebKit::WebLayerImpl::setForceRenderSurface):
+        (WebKit::WebLayerImpl::setScrollPosition):
+        (WebKit::WebLayerImpl::setScrollable):
+        (WebKit::WebLayerImpl::setHaveWheelEventHandlers):
+        (WebKit::WebLayerImpl::setShouldScrollOnMainThread):
+        (WebKit::WebLayerImpl::setNonFastScrollableRegion):
+        (WebKit::WebLayerImpl::setIsContainerForFixedPositionLayers):
+        (WebKit::WebLayerImpl::setFixedToContainerLayer):
+        (WebKit::WebLayerImpl::layer):
+        * src/WebLayerImpl.h:
+        (WebCore):
+        (WebLayerImpl):
+        * src/WebLayerTreeView.cpp:
+        (WebKit::WebLayerTreeView::setRootLayer):
+        * src/WebLayerTreeViewImpl.cpp:
+        (WebKit::WebLayerTreeViewImpl::create):
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::readyStateChanged):
+        (WebKit::WebMediaPlayerClientImpl::repaint):
+        (WebKit::WebMediaPlayerClientImpl::setOpaque):
+        (WebKit::WebMediaPlayerClientImpl::platformLayer):
+        (WebKit::WebMediaPlayerClientImpl::acceleratedRenderingInUse):
+        * src/WebMediaPlayerClientImpl.h:
+        (WebMediaPlayerClientImpl):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::setBackingTextureId):
+        (WebKit::WebPluginContainerImpl::setBackingIOSurfaceId):
+        (WebKit::WebPluginContainerImpl::commitBackingTexture):
+        (WebKit::WebPluginContainerImpl::setOpaque):
+        (WebKit::WebPluginContainerImpl::platformLayer):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+        * src/WebScrollableLayer.cpp: Removed.
+        * src/WebScrollbarLayerImpl.cpp: Renamed from Source/WebKit/chromium/src/WebScrollbarLayer.cpp.
+        (WebKit):
+        (WebKit::WebScrollbarLayer::create):
+        (WebKit::WebScrollbarLayerImpl::WebScrollbarLayerImpl):
+        (WebKit::WebScrollbarLayerImpl::~WebScrollbarLayerImpl):
+        (WebKit::WebScrollbarLayerImpl::layer):
+        (WebKit::WebScrollbarLayerImpl::setScrollLayer):
+        * src/WebScrollbarLayerImpl.h: Copied from Source/WebKit/chromium/src/WebSolidColorLayerImpl.h.
+        (WebCore):
+        (WebKit):
+        (WebScrollbarLayerImpl):
+        * src/WebSolidColorLayerImpl.cpp:
+        (WebKit::WebSolidColorLayer::create):
+        (WebKit::WebSolidColorLayerImpl::WebSolidColorLayerImpl):
+        (WebKit::WebSolidColorLayerImpl::layer):
+        (WebKit):
+        (WebKit::WebSolidColorLayerImpl::setBackgroundColor):
+        * src/WebSolidColorLayerImpl.h:
+        (WebCore):
+        (WebKit):
+        (WebSolidColorLayerImpl):
+        * src/WebVideoLayerImpl.cpp: Copied from Source/WebKit/chromium/src/WebVideoLayer.cpp.
+        (WebKit):
+        (WebKit::WebVideoLayer::create):
+        (WebKit::WebVideoLayerImpl::WebVideoLayerImpl):
+        (WebKit::WebVideoLayerImpl::~WebVideoLayerImpl):
+        (WebKit::WebVideoLayerImpl::layer):
+        (WebKit::WebVideoLayerImpl::active):
+        * src/WebVideoLayerImpl.h: Renamed from Source/WebKit/chromium/src/WebVideoLayer.cpp.
+        (WebCore):
+        (WebKit):
+        (WebVideoLayerImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::setRootGraphicsLayer):
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        (WebKit):
+        * src/WebViewImpl.h:
+        * tests/ImageLayerChromiumTest.cpp:
+        (WebCore::TEST):
+        * tests/WebLayerTest.cpp:
+        * tests/WebLayerTreeViewTest.cpp:
+
+2012-08-22  Alejandro Piñeiro  <apinheiro@igalia.com>
+
+        Dojo toggle buttons should expose ROLE_TOGGLE_BUTTON not ROLE_PUSH_BUTTON
+        https://bugs.webkit.org/show_bug.cgi?id=73819
+
+        Reviewed by Chris Fleizach.
+
+        Added a new role, Toggle Button, based on whether aria-pressed is present.
+        http://www.w3.org/TR/wai-aria/states_and_properties#aria-pressed
+
+        * public/WebAccessibilityRole.h: added WebAccessibilityRoleToggleButton that
+        matchs with WebCore ToggleButtonRole
+        * src/AssertMatchingEnums.cpp: added the assert matching rule for
+        WebAccessibilityRoleToggleButton and ToggleButtonRole
+
+2012-08-17  Jeffrey Pfau  <jpfau@apple.com>
+
+        Allow blocking of Web SQL databases in third-party web workers
+        https://bugs.webkit.org/show_bug.cgi?id=94170
+
+        Reviewed by Adam Barth.
+
+        Web workers did not previously know anything about the document that
+        spawned them. This is undefined for shared workers, but for dedicated
+        workers, we now pipe the information through.
+
+
+        * src/WebWorkerClientImpl.cpp:
+        (WebKit::WebWorkerClientImpl::startWorkerContext): Pass top document's origin
+
+2012-08-22  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Move context() from V8Proxy to ScriptController
+        https://bugs.webkit.org/show_bug.cgi?id=94593
+
+        Reviewed by Adam Barth.
+
+        To kill V8Proxy, we can move context() from V8Proxy to ScriptController.
+
+        No tests. No change in behavior.
+
+        * src/InspectorFrontendClientImpl.cpp:
+        (WebKit::InspectorFrontendClientImpl::windowObjectCleared):
+        * src/WebDevToolsFrontendImpl.cpp:
+        (WebKit::WebDevToolsFrontendImpl::dispatchOnInspectorFrontend):
+
+2012-08-22  Nikhil Bhargava  <nbhargava@google.com>
+
+        Reduce Font.h includes across project -- improves RenderObject.h compile time
+        https://bugs.webkit.org/show_bug.cgi?id=93629
+
+        Reviewed by Eric Seidel.
+
+        Adds includes due to change in RenderStyle.h
+
+        * src/WebFrameImpl.cpp:
+        * src/mac/WebSubstringUtil.mm:
+
+2012-08-22  Nikhil Bhargava  <nbhargava@google.com>
+
+        Speed up compilation of tests involving WebTransformationMatrix
+        https://bugs.webkit.org/show_bug.cgi?id=94639
+
+        Reviewed by James Robinson.
+
+        EXPECT_TRANSFORMATION_MATRIX_EQ was changed to become mainly a function.
+        As a macro that expanded into 16 other macros, it caused an unneeded
+        slow down of close to 45s in the compile time of CCLayerTreeHostCommonTest
+        Bugs have been filed to clang and gcc noting the errant behavior:
+        http://llvm.org/bugs/show_bug.cgi?id=13651 and http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54337
+
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        * tests/CCLayerTreeTestCommon.h:
+        (WebKitTests):
+        (WebKitTests::ExpectTransformationMatrixEq):
+        * tests/WebTransformOperationsTest.cpp:
+        (TEST):
+        (checkProgress):
+        * tests/WebTransformationMatrixTest.cpp:
+        (WebKit::TEST):
+
+2012-08-22  Alexandre Elias  <aelias@google.com>
+
+        [chromium] Add software bitmap resources to CCResourceProvider
+        https://bugs.webkit.org/show_bug.cgi?id=93677
+
+        Reviewed by Adrienne Walker.
+
+        Second commit after revert.
+
+        This adds the ability to CCResourceProvider to use software bitmaps.
+        They are allocated as plain-old-memory, and exposed as Skia objects.
+
+        We want the ResourceProvider to be able to handle different resource
+        types at the same time.  In practice, a default resource type is
+        desired for most uses within a single compositor instance, which is
+        specified by the default resource type.  Default resource types are
+        expected to be mostly 1-to-1 with CCRenderer types.
+
+        New tests added by parametrizing existing CCResourceProvider tests.
+
+        * tests/CCResourceProviderTest.cpp:
+        (WebKit::CCResourceProviderTest::getResourcePixels):
+
+2012-08-22  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add touch link highlight animation layers.
+        https://bugs.webkit.org/show_bug.cgi?id=84487
+
+        Reviewed by James Robinson.
+
+        Adds support for creating composited touch link highlights in renderer thread. Clipping not yet
+        implemented for non-composited frames/overflow divs, but scrolling and layout changes are supported.
+        Transform support currently limited to translation.
+
+        Unit tests for LinkHighlight revised.
+
+        * WebKit.gyp:
+        * src/LinkHighlight.cpp: Added.
+        (WebKit):
+        (WebKit::LinkHighlight::create):
+        (WebKit::LinkHighlight::LinkHighlight):
+        (WebKit::LinkHighlight::~LinkHighlight):
+        (WebKit::LinkHighlight::contentLayer): Accessor for layer containing highlight.
+        (WebKit::LinkHighlight::clipLayer): Accessor for layer that provides clipping for highlight.
+        (WebKit::LinkHighlight::releaseResources): Releases Node* for highlight target, clears client/delegate pointers.
+        (WebKit::LinkHighlight::computeEnclosingCompositingLayer): Determines which GraphicsLayerChromium to attach highlight to.
+        (WebKit::LinkHighlight::computeHighlightLayerPathAndPosition): Determines coordinates of highlight in owning GraphicsLayerChromium's coordinates.
+        (WebKit::LinkHighlight::paintContents): If highlight active, paints highlight.
+        (WebKit::LinkHighlight::startHighlightAnimation): Called to start highlight animation.
+        (WebKit::LinkHighlight::clearGraphicsLayerLinkHighlightPointer): Removes this LinkHighlight's pointer from owning GraphicsLayerChromium.
+        (WebKit::LinkHighlight::notifyAnimationStarted): Implements WebAnimationDelegate.
+        (WebKit::LinkHighlight::notifyAnimationFinished): Implements WebAnimationDelegate, releases resources when animation completes.
+        (WebKit::LinkHighlight::updateGeometry): Invokes computation of which GraphicsLayerChromium to attach to, and highlight shape & position.
+            Computations proceed only if preceded by call to invalidate().
+        (WebKit::LinkHighlight::clearCurrentGraphicsLayer): Handles notification that current GraphicsLayerChromium* is no longer valid.
+        (WebKit::LinkHighlight::invalidate): Sets flag to allow geometry update on next call from WebViewImpl::layout().
+        (WebKit::LinkHighlight::layer): Exports WebLayer* for use in GraphicsLayerChromium.
+        * src/LinkHighlight.h: Renamed from Source/WebCore/platform/graphics/chromium/LinkHighlight.h.
+        (WebCore):
+        (WebKit):
+        (LinkHighlight):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleGestureEvent):
+        (WebKit):
+        (WebKit::highlightConditions):
+        (WebKit::WebViewImpl::bestTouchLinkNode): Find highlight target node for touch event location.
+        (WebKit::WebViewImpl::enableTouchHighlight): Invokes highlight for node at current touch event location.
+        (WebKit::WebViewImpl::layout): Adds call to LinkHighlight::updateGeometry().
+        * src/WebViewImpl.h:
+        (WebKit):
+        (WebViewImpl):
+        (WebKit::WebViewImpl::linkHighlight):
+        * tests/LinkHighlightTest.cpp:
+        (WebCore):
+        (WebCore::TEST):
+        * tests/data/test_touch_link_highlight.html: Added.
+
+2012-08-22  Adam Barth  <abarth@webkit.org>
+
+        WebWidget should be able to paint into a zoomed canvas without aliasing
+        https://bugs.webkit.org/show_bug.cgi?id=92043
+
+        Reviewed by James Robinson.
+
+        If accelerated compositing is enabled, WebWidget::paint reads back from
+        the compositor rather than re-painting the widget. That approach works
+        well if the canvas we're rendering into is at a similar resolution to
+        the pixels in the compositor, but if the canvas has been scaled (e.g.,
+        to help the user disambiguate links), then reading back from the
+        compositor will cause aliasing artifacts.
+
+        This patch adds an option to paint to let the embedder request a
+        software re-rendering of the widget to avoid these aliasing artifacts.
+
+        * public/WebWidget.h:
+        (WebKit::WebWidget::paint):
+        * src/WebPagePopupImpl.cpp:
+        (WebKit::WebPagePopupImpl::paint):
+        * src/WebPagePopupImpl.h:
+        (WebPagePopupImpl):
+        * src/WebPopupMenuImpl.cpp:
+        (WebKit::WebPopupMenuImpl::paint):
+        * src/WebPopupMenuImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::canvasBackgroundForTransparencey):
+        (WebKit):
+        (WebKit::WebViewImpl::paint):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-08-22  Eric Penner  <epenner@google.com>
+
+        [chromium] Simplify updateContentRect, removing rect parameter, refactor unit tests.
+        https://bugs.webkit.org/show_bug.cgi?id=94165
+
+        Reviewed by Adrienne Walker.
+
+        Refactored tests to remove lots of boilerplate code.
+
+        * tests/CCTiledLayerTestCommon.cpp:
+        * tests/CCTiledLayerTestCommon.h:
+        (FakeTiledLayerChromium):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-08-22  Iain Merrick  <husky@chromium.org>
+
+        [chromium] Remove WebFrame::setSelectionToRange
+        https://bugs.webkit.org/show_bug.cgi?id=94685
+
+        Reviewed by Adam Barth.
+
+        It has basically the same functionality as WebFrame::selectRange.
+        The calling code was removed in Chromium patch 152608.
+
+        * public/WebFrame.h:
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+
+2012-08-22  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, rolling out r126319.
+        http://trac.webkit.org/changeset/126319
+        https://bugs.webkit.org/show_bug.cgi?id=84487
+
+        Broke Chromium Mac build
+
+        * WebKit.gyp:
+        * src/LinkHighlight.cpp: Removed.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleGestureEvent):
+        (WebKit::WebViewImpl::computeScaleAndScrollForHitRect):
+        (WebKit::WebViewImpl::layout):
+        * src/WebViewImpl.h:
+        (WebKit):
+        (WebViewImpl):
+        * tests/LinkHighlightTest.cpp:
+        * tests/data/test_touch_link_highlight.html: Removed.
+
+2012-08-22  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Add touch link highlight animation layers.
+        https://bugs.webkit.org/show_bug.cgi?id=84487
+
+        Reviewed by James Robinson.
+
+        Adds support for creating composited touch link highlights in renderer thread. Clipping not yet
+        implemented for non-composited frames/overflow divs, but scrolling and layout changes are supported.
+        Transform support currently limited to translation.
+
+        Unit tests for LinkHighlight revised.
+
+        * WebKit.gyp:
+        * src/LinkHighlight.cpp: Added.
+        (WebKit):
+        (WebKit::LinkHighlight::create):
+        (WebKit::LinkHighlight::LinkHighlight):
+        (WebKit::LinkHighlight::~LinkHighlight):
+        (WebKit::LinkHighlight::contentLayer): Accessor for layer containing highlight.
+        (WebKit::LinkHighlight::clipLayer): Accessor for layer that provides clipping for highlight.
+        (WebKit::LinkHighlight::releaseResources): Releases Node* for highlight target, clears client/delegate pointers.
+        (WebKit::LinkHighlight::computeEnclosingCompositingLayer): Determines which GraphicsLayerChromium to attach highlight to.
+        (WebKit::LinkHighlight::computeHighlightLayerPathAndPosition): Determines coordinates of highlight in owning GraphicsLayerChromium's coordinates.
+        (WebKit::LinkHighlight::paintContents): If highlight active, paints highlight.
+        (WebKit::LinkHighlight::startHighlightAnimation): Called to start highlight animation.
+        (WebKit::LinkHighlight::clearGraphicsLayerLinkHighlightPointer): Removes this LinkHighlight's pointer from owning GraphicsLayerChromium.
+        (WebKit::LinkHighlight::notifyAnimationStarted): Implements WebAnimationDelegate.
+        (WebKit::LinkHighlight::notifyAnimationFinished): Implements WebAnimationDelegate, releases resources when animation completes.
+        (WebKit::LinkHighlight::updateGeometry): Invokes computation of which GraphicsLayerChromium to attach to, and highlight shape & position.
+            Computations proceed only if preceded by call to invalidate().
+        (WebKit::LinkHighlight::clearCurrentGraphicsLayer): Handles notification that current GraphicsLayerChromium* is no longer valid.
+        (WebKit::LinkHighlight::invalidate): Sets flag to allow geometry update on next call from WebViewImpl::layout().
+        (WebKit::LinkHighlight::layer): Exports WebLayer* for use in GraphicsLayerChromium.
+        * src/LinkHighlight.h: Renamed from Source/WebCore/platform/graphics/chromium/LinkHighlight.h.
+        (WebCore):
+        (WebKit):
+        (LinkHighlight):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleGestureEvent):
+        (WebKit):
+        (WebKit::highlightConditions):
+        (WebKit::WebViewImpl::bestTouchLinkNode): Find highlight target node for touch event location.
+        (WebKit::WebViewImpl::enableTouchHighlight): Invokes highlight for node at current touch event location.
+        (WebKit::WebViewImpl::layout): Adds call to LinkHighlight::updateGeometry().
+        * src/WebViewImpl.h:
+        (WebKit):
+        (WebViewImpl):
+        (WebKit::WebViewImpl::linkHighlight):
+        * tests/LinkHighlightTest.cpp:
+        (WebCore):
+        (WebCore::TEST):
+        * tests/data/test_touch_link_highlight.html: Added.
+
 2012-08-22  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed.  Rolled DEPS.
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index e226db13a..1a46375fa 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -422,6 +422,8 @@
                 'src/InspectorClientImpl.h',
                 'src/InspectorFrontendClientImpl.cpp',
                 'src/InspectorFrontendClientImpl.h',
+                'src/LinkHighlight.cpp',
+                'src/LinkHighlight.h',
                 'src/NonCompositedContentHost.cpp',
                 'src/NonCompositedContentHost.h',
                 'src/PrerendererClientImpl.h',
@@ -713,6 +715,7 @@
                                 'tests/FrameTestHelpers.cpp',
                                 'tests/LevelDBTest.cpp',
                                 'tests/ListenerLeakTest.cpp',
+                                'tests/LinkHighlightTest.cpp',
                                 'tests/PopupMenuTest.cpp',
                                 'tests/RenderTableCellTest.cpp',
                                 'tests/RenderTableRowTest.cpp',
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index 7fb0c0f70..fc86f83b3 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -183,26 +183,27 @@
             'src/WebAnimationImpl.h',
             'src/WebCompositorInputHandlerImpl.cpp',
             'src/WebCompositorInputHandlerImpl.h',
-            'src/WebContentLayer.cpp',
             'src/WebContentLayerImpl.cpp',
             'src/WebContentLayerImpl.h',
-            'src/WebExternalTextureLayer.cpp',
+            'src/WebExternalTextureLayerImpl.cpp',
+            'src/WebExternalTextureLayerImpl.h',
             'src/WebFloatAnimationCurve.cpp',
-            'src/WebIOSurfaceLayer.cpp',
-            'src/WebImageLayer.cpp',
-            'src/WebLayer.cpp',
+            'src/WebIOSurfaceLayerImpl.cpp',
+            'src/WebIOSurfaceLayerImpl.h',
+            'src/WebImageLayerImpl.cpp',
+            'src/WebImageLayerImpl.h',
             'src/WebLayerImpl.cpp',
             'src/WebLayerImpl.h',
             'src/WebLayerTreeView.cpp',
             'src/WebLayerTreeViewImpl.cpp',
             'src/WebLayerTreeViewImpl.h',
-            'src/WebScrollableLayer.cpp',
-            'src/WebScrollbarLayer.cpp',
-            'src/WebSolidColorLayer.cpp',
+            'src/WebScrollbarLayerImpl.cpp',
+            'src/WebScrollbarLayerImpl.h',
             'src/WebSolidColorLayerImpl.cpp',
             'src/WebSolidColorLayerImpl.h',
             'src/WebTransformAnimationCurve.cpp',
-            'src/WebVideoLayer.cpp',
+            'src/WebVideoLayerImpl.cpp',
+            'src/WebVideoLayerImpl.h',
         ],
 
         'conditions': [
diff --git a/Source/WebKit/chromium/public/WebAccessibilityRole.h b/Source/WebKit/chromium/public/WebAccessibilityRole.h
index 60958f910..f40c1d99b 100644
--- a/Source/WebKit/chromium/public/WebAccessibilityRole.h
+++ b/Source/WebKit/chromium/public/WebAccessibilityRole.h
@@ -133,6 +133,7 @@ enum WebAccessibilityRole {
     WebAccessibilityRoleTreeGrid,
     WebAccessibilityRoleTreeItemRole,
     WebAccessibilityRoleTextField,
+    WebAccessibilityRoleToggleButton,
     WebAccessibilityRoleToolbar,
     WebAccessibilityRoleUnknown,
     WebAccessibilityRoleUserInterfaceTooltip,
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index c0b8e2aa7..06531df8f 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -433,8 +433,6 @@ public:
 
     virtual WebRange markedRange() const = 0;
 
-    virtual void setSelectionToRange(const WebRange&) = 0;
-
     // Returns the frame rectangle in window coordinate space of the given text
     // range.
     virtual bool firstRectForCharacterRange(unsigned location, unsigned length, WebRect&) const = 0;
diff --git a/Source/WebKit/chromium/public/WebWidget.h b/Source/WebKit/chromium/public/WebWidget.h
index 8e4fecac7..ac1658140 100644
--- a/Source/WebKit/chromium/public/WebWidget.h
+++ b/Source/WebKit/chromium/public/WebWidget.h
@@ -41,6 +41,7 @@
 
 #define WEBKIT_HAS_NEW_FULLSCREEN_API 1
 #define WEBWIDGET_HAS_SETCOMPOSITORSURFACEREADY 1
+#define WEBWIDGET_HAS_PAINT_OPTIONS 1
 
 namespace WebKit {
 
@@ -90,6 +91,21 @@ public:
     // and it may result in calls to WebWidgetClient::didInvalidateRect.
     virtual void layout() { }
 
+    enum PaintOptions {
+        // Attempt to fulfill the painting request by reading back from the
+        // compositor, assuming we're using a compositor to render.
+        ReadbackFromCompositorIfAvailable,
+
+        // Force the widget to rerender onto the canvas using software. This
+        // mode ignores 3d transforms and ignores GPU-resident content, such
+        // as video, canvas, and WebGL.
+        //
+        // Note: This option exists on OS(ANDROID) and will hopefully be
+        //       removed once the link disambiguation feature renders using
+        //       the compositor.
+        ForceSoftwareRenderingAndIgnoreGPUResidentContent,
+    };
+
     // Called to paint the rectangular region within the WebWidget
     // onto the specified canvas at (viewPort.x,viewPort.y). You MUST call
     // Layout before calling this method. It is okay to call paint
@@ -97,7 +113,7 @@ public:
     // changes are made to the WebWidget (e.g., once events are
     // processed, it should be assumed that another call to layout is
     // warranted before painting again).
-    virtual void paint(WebCanvas*, const WebRect& viewPort) { }
+    virtual void paint(WebCanvas*, const WebRect& viewPort, PaintOptions = ReadbackFromCompositorIfAvailable) { }
 
     // In non-threaded compositing mode, triggers compositing of the current
     // layers onto the screen. You MUST call Layout before calling this method,
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 8f2dc5e86..27239d769 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -257,6 +257,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocumentMath, DocumentMathRole)
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocumentNote, DocumentNoteRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleDocumentRegion, DocumentRegionRole);
 COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleUserInterfaceTooltip, UserInterfaceTooltipRole);
+COMPILE_ASSERT_MATCHING_ENUM(WebAccessibilityRoleToggleButton, ToggleButtonRole);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Uncached, ApplicationCacheHost::UNCACHED);
 COMPILE_ASSERT_MATCHING_ENUM(WebApplicationCacheHost::Idle, ApplicationCacheHost::IDLE);
diff --git a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
index 0338d3f2d..4f257c77c 100644
--- a/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
+++ b/Source/WebKit/chromium/src/InspectorFrontendClientImpl.cpp
@@ -36,8 +36,8 @@
 #include "InspectorFrontendHost.h"
 #include "Page.h"
 #include "PlatformString.h"
+#include "ScriptController.h"
 #include "V8InspectorFrontendHost.h"
-#include "V8Proxy.h"
 #include "WebDevToolsFrontendClient.h"
 #include "WebDevToolsFrontendImpl.h"
 #include "platform/WebFloatPoint.h"
@@ -63,7 +63,7 @@ InspectorFrontendClientImpl::~InspectorFrontendClientImpl()
 void InspectorFrontendClientImpl::windowObjectCleared()
 {
     v8::HandleScope handleScope;
-    v8::Handle<v8::Context> frameContext = V8Proxy::context(m_frontendPage->mainFrame());
+    v8::Handle<v8::Context> frameContext = m_frontendPage->mainFrame() ? m_frontendPage->mainFrame()->script()->currentWorldContext() : v8::Local<v8::Context>();
     v8::Context::Scope contextScope(frameContext);
 
     ASSERT(!m_frontendHost);
diff --git a/Source/WebKit/chromium/src/LinkHighlight.cpp b/Source/WebKit/chromium/src/LinkHighlight.cpp
new file mode 100644
index 000000000..fa34d1d0d
--- /dev/null
+++ b/Source/WebKit/chromium/src/LinkHighlight.cpp
@@ -0,0 +1,271 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "LinkHighlight.h"
+
+#include "Color.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "LayoutTypes.h"
+#include "Node.h"
+#include "NonCompositedContentHost.h"
+#include "PlatformContextSkia.h"
+#include "RenderLayer.h"
+#include "RenderLayerBacking.h"
+#include "RenderObject.h"
+#include "RenderView.h"
+#include "WebFrameImpl.h"
+#include "WebKit.h"
+#include "WebViewImpl.h"
+#include <public/WebAnimationCurve.h>
+#include <public/WebFloatAnimationCurve.h>
+#include <public/WebFloatPoint.h>
+#include <public/WebRect.h>
+#include <public/WebSize.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+class WebViewImpl;
+
+PassOwnPtr<LinkHighlight> LinkHighlight::create(Node* node, WebViewImpl* owningWebViewImpl)
+{
+    return adoptPtr(new LinkHighlight(node, owningWebViewImpl));
+}
+
+LinkHighlight::LinkHighlight(Node* node, WebViewImpl* owningWebViewImpl)
+    : m_contentLayer(adoptPtr(WebContentLayer::create(this)))
+    , m_clipLayer(adoptPtr(WebLayer::create()))
+    , m_node(node)
+    , m_owningWebViewImpl(owningWebViewImpl)
+    , m_currentGraphicsLayer(0)
+    , m_geometryNeedsUpdate(false)
+{
+    ASSERT(m_node);
+    ASSERT(owningWebViewImpl);
+
+    m_clipLayer->setAnchorPoint(WebFloatPoint());
+    m_clipLayer->addChild(m_contentLayer->layer());
+    m_contentLayer->layer()->setDrawsContent(false);
+
+    // We don't want to show the highlight until startAnimation is called, even though the highlight
+    // layer may be added to the tree immediately.
+    m_contentLayer->layer()->setOpacity(0);
+    m_contentLayer->layer()->setAnimationDelegate(this);
+}
+
+LinkHighlight::~LinkHighlight()
+{
+    clearGraphicsLayerLinkHighlightPointer();
+    releaseResources();
+}
+
+WebContentLayer* LinkHighlight::contentLayer()
+{
+    return m_contentLayer.get();
+}
+
+WebLayer* LinkHighlight::clipLayer()
+{
+    return m_clipLayer.get();
+}
+
+void LinkHighlight::releaseResources()
+{
+    m_node.clear();
+}
+
+RenderLayer* LinkHighlight::computeEnclosingCompositingLayer()
+{
+    if (!m_node || !m_node->renderer())
+        return 0;
+
+    RenderLayer* renderLayer = m_node->renderer()->enclosingLayer();
+
+    // Find the nearest enclosing composited layer and attach to it. We may need to cross frame boundaries
+    // to find a suitable layer.
+    while (renderLayer && !renderLayer->isComposited()) {
+        if (!renderLayer->parent()) {
+            // See if we've reached the root in an enclosed frame.
+            if (renderLayer->renderer()->frame()->ownerRenderer())
+                renderLayer = renderLayer->renderer()->frame()->ownerRenderer()->enclosingLayer();
+            else
+                renderLayer = 0;
+        } else
+            renderLayer = renderLayer->parent();
+    }
+
+    if (!renderLayer || !renderLayer->isComposited())
+        return 0;
+
+    m_graphicsLayerOffset = FloatPoint();
+    GraphicsLayerChromium* newGraphicsLayer = static_cast<GraphicsLayerChromium*>(renderLayer->backing()->graphicsLayer());
+    if (!newGraphicsLayer->drawsContent()) {
+        m_graphicsLayerOffset = newGraphicsLayer->position();
+        newGraphicsLayer = static_cast<GraphicsLayerChromium*>(m_owningWebViewImpl->nonCompositedContentHost()->topLevelRootLayer());
+    }
+
+    if (m_currentGraphicsLayer != newGraphicsLayer) {
+        if (m_currentGraphicsLayer)
+            clearGraphicsLayerLinkHighlightPointer();
+
+        m_currentGraphicsLayer = newGraphicsLayer;
+        m_currentGraphicsLayer->setLinkHighlight(this);
+    }
+
+    return renderLayer;
+}
+
+bool LinkHighlight::computeHighlightLayerPathAndPosition(RenderLayer* compositingLayer)
+{
+    if (!m_node || !m_node->renderer())
+        return false;
+
+    bool pathHasChanged = false;
+    FloatRect boundingRect = m_node->getPixelSnappedRect();
+
+    // FIXME: If we ever use a more sophisticated highlight path, we'll need
+    // to devise a way of detecting when it changes.
+    if (boundingRect.size() != m_path.boundingRect().size()) {
+        FloatSize rectRoundingRadii(3, 3);
+        m_path.clear();
+        m_path.addRoundedRect(boundingRect, rectRoundingRadii);
+        // Always treat the path as being at the origin of this layer.
+        m_path.translate(FloatPoint() - boundingRect.location());
+        pathHasChanged = true;
+    }
+
+    FloatRect nodeBounds = boundingRect;
+
+    // This is a simplified, but basically correct, transformation of the target location, converted
+    // from its containing frame view to window coordinates and then back to the containing frame view
+    // of the composited layer.
+    // FIXME: We also need to transform the target's size in case of scaling. This can be done by also transforming
+    //        the full rects in the xToY calls, and transforming both the upper-left and lower right corners
+    //        to local coordinates at the end..
+    ASSERT(compositingLayer);
+    IntPoint targetWindow = m_node->renderer()->frame()->view()->contentsToWindow(enclosingIntRect(nodeBounds).location());
+    IntPoint targetCompositorAbsolute = compositingLayer->renderer()->frame()->view()->windowToContents(targetWindow);
+    FloatPoint targetCompositorLocal = compositingLayer->renderer()->absoluteToLocal(targetCompositorAbsolute, false, true);
+
+    m_contentLayer->layer()->setBounds(WebSize(enclosingIntRect(nodeBounds).size()));
+    m_contentLayer->layer()->setPosition(WebFloatPoint(targetCompositorLocal));
+
+    return pathHasChanged;
+}
+
+void LinkHighlight::paintContents(WebCanvas* canvas, const WebRect& webClipRect, WebFloatRect&)
+{
+    if (!m_node || !m_node->renderer())
+        return;
+
+    PlatformContextSkia platformContext(canvas);
+    GraphicsContext gc(&platformContext);
+    IntRect clipRect(IntPoint(webClipRect.x, webClipRect.y), IntSize(webClipRect.width, webClipRect.height));
+    gc.clip(clipRect);
+    gc.setFillColor(m_node->renderer()->style()->tapHighlightColor(), ColorSpaceDeviceRGB);
+    gc.fillPath(m_path);
+}
+
+void LinkHighlight::startHighlightAnimation()
+{
+    const float startOpacity = 1;
+    // FIXME: Should duration be configurable?
+    const float duration = 2;
+
+    m_contentLayer->layer()->setOpacity(startOpacity);
+
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, startOpacity));
+    curve.add(WebFloatKeyframe(duration / 2, startOpacity));
+    // For layout tests we don't fade out.
+    curve.add(WebFloatKeyframe(duration, WebKit::layoutTestMode() ? startOpacity : 0));
+
+    m_animation = adoptPtr(WebAnimation::create(curve, WebAnimation::TargetPropertyOpacity));
+    m_contentLayer->layer()->setDrawsContent(true);
+    m_contentLayer->layer()->addAnimation(m_animation.get());
+
+    invalidate();
+    m_owningWebViewImpl->scheduleAnimation();
+}
+
+void LinkHighlight::clearGraphicsLayerLinkHighlightPointer()
+{
+    if (m_currentGraphicsLayer) {
+        m_currentGraphicsLayer->setLinkHighlight(0);
+        m_currentGraphicsLayer = 0;
+    }
+}
+
+void LinkHighlight::notifyAnimationStarted(double)
+{
+}
+
+void LinkHighlight::notifyAnimationFinished(double)
+{
+    // Since WebViewImpl may hang on to us for a while, make sure we
+    // release resources as soon as possible.
+    clearGraphicsLayerLinkHighlightPointer();
+    releaseResources();
+}
+
+void LinkHighlight::updateGeometry()
+{
+    // To avoid unnecessary updates (e.g. other entities have requested animations from our WebViewImpl),
+    // only proceed if we actually requested an update.
+    if (!m_geometryNeedsUpdate)
+        return;
+
+    m_geometryNeedsUpdate = false;
+
+    RenderLayer* compositingLayer = computeEnclosingCompositingLayer();
+    if (compositingLayer && computeHighlightLayerPathAndPosition(compositingLayer)) {
+        // We only need to invalidate the layer if the highlight size has changed, otherwise
+        // we can just re-position the layer without needing to repaint.
+        m_contentLayer->layer()->invalidate();
+    }
+}
+
+void LinkHighlight::clearCurrentGraphicsLayer()
+{
+    m_currentGraphicsLayer = 0;
+    m_geometryNeedsUpdate = true;
+}
+
+void LinkHighlight::invalidate()
+{
+    // Make sure we update geometry on the next callback from WebViewImpl::layout().
+    m_geometryNeedsUpdate = true;
+}
+
+WebLayer* LinkHighlight::layer()
+{
+    return clipLayer();
+}
+
+} // namespace WeKit
diff --git a/Source/WebKit/chromium/src/LinkHighlight.h b/Source/WebKit/chromium/src/LinkHighlight.h
new file mode 100644
index 000000000..4eb6f5967
--- /dev/null
+++ b/Source/WebKit/chromium/src/LinkHighlight.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LinkHighlight_h
+#define LinkHighlight_h
+
+#include "FloatPoint.h"
+#include "GraphicsLayerChromium.h"
+#include "IntPoint.h"
+#include "Path.h"
+#include <public/WebAnimationDelegate.h>
+#include <public/WebContentLayer.h>
+#include <public/WebContentLayerClient.h>
+#include <public/WebLayer.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+class RenderLayer;
+class Node;
+}
+
+namespace WebKit {
+
+struct WebFloatRect;
+struct WebRect;
+class WebViewImpl;
+
+class LinkHighlight : public WebContentLayerClient, public WebAnimationDelegate, WebCore::LinkHighlightClient {
+public:
+    static PassOwnPtr<LinkHighlight> create(WebCore::Node*, WebViewImpl*);
+    virtual ~LinkHighlight();
+
+    WebContentLayer* contentLayer();
+    WebLayer* clipLayer();
+    void startHighlightAnimation();
+    void updateGeometry();
+
+    // WebContentLayerClient implementation.
+    virtual void paintContents(WebCanvas*, const WebRect& clipRect, WebFloatRect& opaque) OVERRIDE;
+
+    // WebAnimationDelegate implementation.
+    virtual void notifyAnimationStarted(double time) OVERRIDE;
+    virtual void notifyAnimationFinished(double time) OVERRIDE;
+
+    // LinkHighlightClient inplementation.
+    virtual void invalidate() OVERRIDE;
+    virtual WebLayer* layer() OVERRIDE;
+    virtual void clearCurrentGraphicsLayer() OVERRIDE;
+
+private:
+    LinkHighlight(WebCore::Node*, WebViewImpl*);
+
+    void releaseResources();
+
+    WebCore::RenderLayer* computeEnclosingCompositingLayer();
+    void clearGraphicsLayerLinkHighlightPointer();
+    // This function computes the highlight path, and returns true if it has changed
+    // size since the last call to this function.
+    bool computeHighlightLayerPathAndPosition(WebCore::RenderLayer*);
+
+    OwnPtr<WebContentLayer> m_contentLayer;
+    OwnPtr<WebLayer> m_clipLayer;
+    WebCore::Path m_path;
+
+    RefPtr<WebCore::Node> m_node;
+    OwnPtr<WebAnimation> m_animation;
+    WebViewImpl* m_owningWebViewImpl;
+    WebCore::GraphicsLayerChromium* m_currentGraphicsLayer;
+
+    bool m_geometryNeedsUpdate;
+    WebCore::FloatPoint m_graphicsLayerOffset;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
index 65dac62ca..4df4204b3 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
@@ -30,6 +30,7 @@
 #include "FloatPoint.h"
 #include "FloatRect.h"
 #include "GraphicsLayer.h"
+#include "GraphicsLayerChromium.h"
 #include "PlatformContextSkia.h"
 #include "WebViewImpl.h"
 #include <public/WebContentLayer.h>
@@ -48,11 +49,11 @@ NonCompositedContentHost::NonCompositedContentHost(WebViewImpl* webView)
     m_graphicsLayer->setName("non-composited content");
 #endif
     m_graphicsLayer->setDrawsContent(true);
-    WebContentLayer layer = m_graphicsLayer->platformLayer()->to<WebContentLayer>();
-    layer.setUseLCDText(true);
-    layer.setOpaque(true);
+    WebContentLayer* layer = static_cast<WebCore::GraphicsLayerChromium*>(m_graphicsLayer.get())->contentLayer();
+    layer->setUseLCDText(true);
+    layer->layer()->setOpaque(true);
 #if !OS(ANDROID)
-    layer.setDrawCheckerboardForMissingTiles(true);
+    layer->setDrawCheckerboardForMissingTiles(true);
 #endif
 }
 
@@ -80,7 +81,7 @@ void NonCompositedContentHost::setScrollLayer(WebCore::GraphicsLayer* layer)
         return;
     }
 
-    if (*layer->platformLayer() == scrollLayer())
+    if (layer->platformLayer() == scrollLayer())
         return;
 
     layer->addChildAtIndex(m_graphicsLayer.get(), 0);
@@ -95,12 +96,12 @@ void NonCompositedContentHost::setViewport(const WebCore::IntSize& viewportSize,
     bool visibleRectChanged = m_viewportSize != viewportSize;
 
     m_viewportSize = viewportSize;
-    WebScrollableLayer layer = scrollLayer();
-    layer.setScrollPosition(scrollPosition + scrollOrigin);
-    layer.setPosition(WebFloatPoint(-scrollPosition));
+    WebLayer* layer = scrollLayer();
+    layer->setScrollPosition(scrollPosition + scrollOrigin);
+    layer->setPosition(WebFloatPoint(-scrollPosition));
     // Due to the possibility of pinch zoom, the noncomposited layer is always
     // assumed to be scrollable.
-    layer.setScrollable(true);
+    layer->setScrollable(true);
     m_deviceScaleFactor = deviceScale;
     m_graphicsLayer->deviceOrPageScaleFactorChanged();
     m_graphicsLayer->setSize(contentsSize);
@@ -127,11 +128,11 @@ bool NonCompositedContentHost::haveScrollLayer()
     return m_graphicsLayer->parent();
 }
 
-WebScrollableLayer NonCompositedContentHost::scrollLayer()
+WebLayer* NonCompositedContentHost::scrollLayer()
 {
     if (!m_graphicsLayer->parent())
-        return WebScrollableLayer();
-    return m_graphicsLayer->parent()->platformLayer()->to<WebScrollableLayer>();
+        return 0;
+    return m_graphicsLayer->parent()->platformLayer();
 }
 
 void NonCompositedContentHost::invalidateRect(const WebCore::IntRect& rect)
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.h b/Source/WebKit/chromium/src/NonCompositedContentHost.h
index e60e9ef48..08b5f6a41 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.h
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.h
@@ -29,7 +29,7 @@
 #include "GraphicsLayerClient.h"
 #include "IntSize.h"
 
-#include <public/WebScrollableLayer.h>
+#include <public/WebLayer.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -80,7 +80,7 @@ private:
     virtual float deviceScaleFactor() const OVERRIDE { return m_deviceScaleFactor; }
 
     bool haveScrollLayer();
-    WebScrollableLayer scrollLayer();
+    WebLayer* scrollLayer();
 
     OwnPtr<WebCore::GraphicsLayer> m_graphicsLayer;
     WebViewImpl* m_webView;
diff --git a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
index 69da1ea3f..fa21e8974 100644
--- a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
@@ -26,37 +26,66 @@
 #include "config.h"
 #include "WebContentLayerImpl.h"
 
+#include "SkMatrix44.h"
 #include <public/WebContentLayerClient.h>
+#include <public/WebFloatPoint.h>
 #include <public/WebFloatRect.h>
 #include <public/WebRect.h>
+#include <public/WebSize.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-PassRefPtr<WebContentLayerImpl> WebContentLayerImpl::create(WebContentLayerClient* contentClient)
+WebContentLayer* WebContentLayer::create(WebContentLayerClient* client)
 {
-    return adoptRef(new WebContentLayerImpl(contentClient));
+    return new WebContentLayerImpl(client);
 }
 
-WebContentLayerImpl::WebContentLayerImpl(WebContentLayerClient* contentClient)
-    : ContentLayerChromium(this)
-    , m_contentClient(contentClient)
+WebContentLayerImpl::WebContentLayerImpl(WebContentLayerClient* client)
+    : m_webLayerImpl(adoptPtr(new WebLayerImpl(ContentLayerChromium::create(this))))
+    , m_client(client)
 {
-    setIsDrawable(true);
+    m_webLayerImpl->layer()->setIsDrawable(true);
 }
 
 WebContentLayerImpl::~WebContentLayerImpl()
 {
-    clearDelegate();
+    static_cast<ContentLayerChromium*>(m_webLayerImpl->layer())->clearDelegate();
 }
 
+WebLayer* WebContentLayerImpl::layer()
+{
+    return m_webLayerImpl.get();
+}
+
+void WebContentLayerImpl::setDoubleSided(bool doubleSided)
+{
+    m_webLayerImpl->layer()->setDoubleSided(doubleSided);
+}
+
+void WebContentLayerImpl::setContentsScale(float scale)
+{
+    m_webLayerImpl->layer()->setContentsScale(scale);
+}
+
+void WebContentLayerImpl::setUseLCDText(bool enable)
+{
+    m_webLayerImpl->layer()->setUseLCDText(enable);
+}
+
+void WebContentLayerImpl::setDrawCheckerboardForMissingTiles(bool enable)
+{
+    m_webLayerImpl->layer()->setDrawCheckerboardForMissingTiles(enable);
+}
+
+
 void WebContentLayerImpl::paintContents(SkCanvas* canvas, const IntRect& clip, FloatRect& opaque)
 {
-    if (!m_contentClient)
+    if (!m_client)
         return;
     WebFloatRect webOpaque;
-    m_contentClient->paintContents(canvas, WebRect(clip), webOpaque);
+    m_client->paintContents(canvas, WebRect(clip), webOpaque);
     opaque = webOpaque;
 }
 
diff --git a/Source/WebKit/chromium/src/WebContentLayerImpl.h b/Source/WebKit/chromium/src/WebContentLayerImpl.h
index 97729ea1e..511f8e0ba 100644
--- a/Source/WebKit/chromium/src/WebContentLayerImpl.h
+++ b/Source/WebKit/chromium/src/WebContentLayerImpl.h
@@ -27,23 +27,33 @@
 #define WebContentLayerImpl_h
 
 #include "ContentLayerChromium.h"
+#include "WebLayerImpl.h"
+#include <public/WebContentLayer.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebKit {
 class WebContentLayerClient;
 
-class WebContentLayerImpl : public WebCore::ContentLayerChromium, public WebCore::ContentLayerDelegate {
+class WebContentLayerImpl : public WebContentLayer,
+                            public WebCore::ContentLayerDelegate {
 public:
-    static PassRefPtr<WebContentLayerImpl> create(WebContentLayerClient* contentClient);
+    explicit WebContentLayerImpl(WebContentLayerClient*);
+
+    // WebContentLayer implementation.
+    virtual WebLayer* layer() OVERRIDE;
+    virtual void setDoubleSided(bool)  OVERRIDE;
+    virtual void setContentsScale(float)  OVERRIDE;
+    virtual void setUseLCDText(bool)  OVERRIDE;
+    virtual void setDrawCheckerboardForMissingTiles(bool)  OVERRIDE;
 
 protected:
-    explicit WebContentLayerImpl(WebContentLayerClient* contentClient);
     virtual ~WebContentLayerImpl();
 
     // ContentLayerDelegate implementation.
     virtual void paintContents(SkCanvas*, const WebCore::IntRect& clip, WebCore::FloatRect& opaque) OVERRIDE;
 
-    WebContentLayerClient* m_contentClient;
+    OwnPtr<WebLayerImpl> m_webLayerImpl;
+    WebContentLayerClient* m_client;
     bool m_drawsContent;
 };
 
diff --git a/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
index 9418c0dc0..800568a61 100644
--- a/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsFrontendImpl.cpp
@@ -44,6 +44,7 @@
 #include "Page.h"
 #include "Pasteboard.h"
 #include "PlatformString.h"
+#include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "V8Binding.h"
@@ -51,7 +52,6 @@
 #include "V8InspectorFrontendHost.h"
 #include "V8MouseEvent.h"
 #include "V8Node.h"
-#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WebDevToolsFrontendClient.h"
 #include "WebFrameImpl.h"
@@ -107,7 +107,7 @@ void WebDevToolsFrontendImpl::dispatchOnInspectorFrontend(const WebString& messa
 {
     WebFrameImpl* frame = m_webViewImpl->mainFrameImpl();
     v8::HandleScope scope;
-    v8::Handle<v8::Context> frameContext = V8Proxy::context(frame->frame());
+    v8::Handle<v8::Context> frameContext = frame->frame() ? frame->frame()->script()->currentWorldContext() : v8::Local<v8::Context>();
     v8::Context::Scope contextScope(frameContext);
     v8::Handle<v8::Value> inspectorBackendValue = frameContext->Global()->Get(v8::String::New("InspectorBackend"));
     if (!inspectorBackendValue->IsObject())
diff --git a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp b/Source/WebKit/chromium/src/WebExternalTextureLayerImpl.cpp
index d4aff5721..d62166f44 100644
--- a/Source/WebKit/chromium/src/WebExternalTextureLayer.cpp
+++ b/Source/WebKit/chromium/src/WebExternalTextureLayerImpl.cpp
@@ -24,10 +24,11 @@
  */
 
 #include "config.h"
-#include <public/WebExternalTextureLayer.h>
+#include "WebExternalTextureLayerImpl.h"
 
 #include "CCTextureUpdateQueue.h"
 #include "TextureLayerChromium.h"
+#include "WebLayerImpl.h"
 #include <public/WebExternalTextureLayerClient.h>
 #include <public/WebFloatRect.h>
 #include <public/WebSize.h>
@@ -36,96 +37,96 @@ using namespace WebCore;
 
 namespace WebKit {
 
-class WebTextureUpdaterImpl : public WebTextureUpdater {
-public:
-    explicit WebTextureUpdaterImpl(CCTextureUpdateQueue& queue)
-        : m_queue(queue)
-    {
-    }
-
-    virtual void appendCopy(unsigned sourceTexture, unsigned destinationTexture, WebSize size) OVERRIDE
-    {
-        TextureCopier::Parameters copy = { sourceTexture, destinationTexture, size };
-        m_queue.appendCopy(copy);
-    }
-
-private:
-    CCTextureUpdateQueue& m_queue;
-};
-
-class WebExternalTextureLayerImpl : public TextureLayerChromiumClient, public TextureLayerChromium {
-public:
-    explicit WebExternalTextureLayerImpl(WebExternalTextureLayerClient* client)
-        : TextureLayerChromium(client ? this : 0)
-        , m_client(client)
-    {
-    }
-
-    virtual unsigned prepareTexture(CCTextureUpdateQueue& queue) OVERRIDE
-    {
-        WebTextureUpdaterImpl updaterImpl(queue);
-        return m_client->prepareTexture(updaterImpl);
-    }
+WebExternalTextureLayer* WebExternalTextureLayer::create(WebExternalTextureLayerClient* client)
+{
+    return new WebExternalTextureLayerImpl(client);
+}
 
-    virtual WebKit::WebGraphicsContext3D* context() OVERRIDE
-    {
-        return m_client->context();
-    }
+WebExternalTextureLayerImpl::WebExternalTextureLayerImpl(WebExternalTextureLayerClient* client)
+    : m_client(client)
+{
+    RefPtr<TextureLayerChromium> layer;
+    if (m_client)
+        layer = TextureLayerChromium::create(this);
+    else
+        layer = TextureLayerChromium::create(0);
+    layer->setIsDrawable(true);
+    m_layer = adoptPtr(new WebLayerImpl(layer.release()));
+}
 
-private:
-    WebExternalTextureLayerClient* m_client;
-};
+WebExternalTextureLayerImpl::~WebExternalTextureLayerImpl()
+{
+    static_cast<TextureLayerChromium*>(m_layer->layer())->clearClient();
+}
 
-WebExternalTextureLayer WebExternalTextureLayer::create(WebExternalTextureLayerClient* client)
+WebLayer* WebExternalTextureLayerImpl::layer()
 {
-    RefPtr<TextureLayerChromium> layer = adoptRef(new WebExternalTextureLayerImpl(client));
-    layer->setIsDrawable(true);
-    return WebExternalTextureLayer(layer.release());
+    return m_layer.get();
 }
 
-void WebExternalTextureLayer::clearClient()
+void WebExternalTextureLayerImpl::setTextureId(unsigned id)
 {
-    unwrap<TextureLayerChromium>()->clearClient();
+    static_cast<TextureLayerChromium*>(m_layer->layer())->setTextureId(id);
 }
 
-void WebExternalTextureLayer::setTextureId(unsigned id)
+void WebExternalTextureLayerImpl::setFlipped(bool flipped)
 {
-    unwrap<TextureLayerChromium>()->setTextureId(id);
+    static_cast<TextureLayerChromium*>(m_layer->layer())->setFlipped(flipped);
 }
 
-void WebExternalTextureLayer::setFlipped(bool flipped)
+void WebExternalTextureLayerImpl::setUVRect(const WebFloatRect& rect)
 {
-    unwrap<TextureLayerChromium>()->setFlipped(flipped);
+    static_cast<TextureLayerChromium*>(m_layer->layer())->setUVRect(rect);
 }
 
-void WebExternalTextureLayer::setUVRect(const WebFloatRect& rect)
+void WebExternalTextureLayerImpl::setOpaque(bool opaque)
 {
-    unwrap<TextureLayerChromium>()->setUVRect(rect);
+    static_cast<TextureLayerChromium*>(m_layer->layer())->setOpaque(opaque);
 }
 
-void WebExternalTextureLayer::setOpaque(bool opaque)
+void WebExternalTextureLayerImpl::setPremultipliedAlpha(bool premultipliedAlpha)
 {
-    unwrap<TextureLayerChromium>()->setOpaque(opaque);
+    static_cast<TextureLayerChromium*>(m_layer->layer())->setPremultipliedAlpha(premultipliedAlpha);
 }
 
-void WebExternalTextureLayer::setPremultipliedAlpha(bool premultipliedAlpha)
+void WebExternalTextureLayerImpl::willModifyTexture()
 {
-    unwrap<TextureLayerChromium>()->setPremultipliedAlpha(premultipliedAlpha);
+    static_cast<TextureLayerChromium*>(m_layer->layer())->willModifyTexture();
 }
 
-void WebExternalTextureLayer::willModifyTexture()
+void WebExternalTextureLayerImpl::setRateLimitContext(bool rateLimit)
 {
-    unwrap<TextureLayerChromium>()->willModifyTexture();
+    static_cast<TextureLayerChromium*>(m_layer->layer())->setRateLimitContext(rateLimit);
 }
 
-void WebExternalTextureLayer::setRateLimitContext(bool rateLimit)
+class WebTextureUpdaterImpl : public WebTextureUpdater {
+public:
+    explicit WebTextureUpdaterImpl(CCTextureUpdateQueue& queue)
+        : m_queue(queue)
+    {
+    }
+
+    virtual void appendCopy(unsigned sourceTexture, unsigned destinationTexture, WebSize size) OVERRIDE
+    {
+        TextureCopier::Parameters copy = { sourceTexture, destinationTexture, size };
+        m_queue.appendCopy(copy);
+    }
+
+private:
+    CCTextureUpdateQueue& m_queue;
+};
+
+unsigned WebExternalTextureLayerImpl::prepareTexture(CCTextureUpdateQueue& queue)
 {
-    unwrap<TextureLayerChromium>()->setRateLimitContext(rateLimit);
+    ASSERT(m_client);
+    WebTextureUpdaterImpl updaterImpl(queue);
+    return m_client->prepareTexture(updaterImpl);
 }
 
-WebExternalTextureLayer::WebExternalTextureLayer(PassRefPtr<TextureLayerChromium> layer)
-    : WebLayer(layer)
+WebGraphicsContext3D* WebExternalTextureLayerImpl::context()
 {
+    ASSERT(m_client);
+    return m_client->context();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebContentLayer.cpp b/Source/WebKit/chromium/src/WebExternalTextureLayerImpl.h
index efa7465b1..5348895bf 100644
--- a/Source/WebKit/chromium/src/WebContentLayer.cpp
+++ b/Source/WebKit/chromium/src/WebExternalTextureLayerImpl.h
@@ -23,60 +23,42 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include <public/WebContentLayer.h>
+#ifndef WebExternalTextureLayerImpl_h
+#define WebExternalTextureLayerImpl_h
 
-#include "ContentLayerChromium.h"
-#include "WebContentLayerImpl.h"
-
-using namespace WebCore;
+#include "TextureLayerChromium.h"
+#include <public/WebExternalTextureLayer.h>
 
 namespace WebKit {
 
-WebContentLayer WebContentLayer::create(WebContentLayerClient* contentClient)
-{
-    return WebContentLayer(WebContentLayerImpl::create(contentClient));
-}
+class WebLayerImpl;
 
-void WebContentLayer::clearClient()
-{
-    unwrap<ContentLayerChromium>()->clearDelegate();
-}
+class WebExternalTextureLayerImpl : public WebExternalTextureLayer,
+                                    public WebCore::TextureLayerChromiumClient {
+public:
+    explicit WebExternalTextureLayerImpl(WebExternalTextureLayerClient*);
+    virtual ~WebExternalTextureLayerImpl();
 
-void WebContentLayer::setDoubleSided(bool doubleSided)
-{
-    m_private->setDoubleSided(doubleSided);
-}
+    // WebExternalTextureLayer implementation.
+    virtual WebLayer* layer() OVERRIDE;
+    virtual void setTextureId(unsigned) OVERRIDE;
+    virtual void setFlipped(bool) OVERRIDE;
+    virtual void setUVRect(const WebFloatRect&) OVERRIDE;
+    virtual void setOpaque(bool) OVERRIDE;
+    virtual void setPremultipliedAlpha(bool) OVERRIDE;
+    virtual void willModifyTexture() OVERRIDE;
+    virtual void setRateLimitContext(bool) OVERRIDE;
 
-void WebContentLayer::setContentsScale(float scale)
-{
-    m_private->setContentsScale(scale);
-}
+    // TextureLayerChromiumClient implementation.
+    virtual unsigned prepareTexture(WebCore::CCTextureUpdateQueue&) OVERRIDE;
+    virtual WebGraphicsContext3D* context() OVERRIDE;
 
-void WebContentLayer::setUseLCDText(bool enable)
-{
-    m_private->setUseLCDText(enable);
-}
+private:
+    WebExternalTextureLayerClient* m_client;
+    OwnPtr<WebLayerImpl> m_layer;
+};
 
-void WebContentLayer::setDrawCheckerboardForMissingTiles(bool enable)
-{
-    m_private->setDrawCheckerboardForMissingTiles(enable);
 }
 
-WebContentLayer::WebContentLayer(const PassRefPtr<ContentLayerChromium>& node)
-    : WebScrollableLayer(node)
-{
-}
-
-WebContentLayer& WebContentLayer::operator=(const PassRefPtr<ContentLayerChromium>& node)
-{
-    m_private = node;
-    return *this;
-}
-
-WebContentLayer::operator PassRefPtr<ContentLayerChromium>() const
-{
-    return static_cast<ContentLayerChromium*>(m_private.get());
-}
+#endif // WebExternalTextureLayerImpl_h
 
-} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index 0a9855f15..4279febe0 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -140,6 +140,7 @@
 #include "ShadowRoot.h"
 #include "SkiaUtils.h"
 #include "SpellChecker.h"
+#include "StyleInheritedData.h"
 #include "SubstituteData.h"
 #include "TextAffinity.h"
 #include "TextIterator.h"
@@ -1235,14 +1236,6 @@ WebRange WebFrameImpl::markedRange() const
     return frame()->editor()->compositionRange();
 }
 
-void WebFrameImpl::setSelectionToRange(const WebRange& range)
-{
-    if (frame()->selection()->isContentEditable()) {
-        RefPtr<Range> replacementRange = PassRefPtr<Range>(range);
-        frame()->selection()->setSelection(VisibleSelection(replacementRange.get(), SEL_DEFAULT_AFFINITY));
-    }
-}
-
 bool WebFrameImpl::firstRectForCharacterRange(unsigned location, unsigned length, WebRect& rect) const
 {
     if ((location + length < location) && (location + length))
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index e83b3b0f7..20c5fe9d3 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -169,7 +169,6 @@ public:
     virtual void unmarkText();
     virtual bool hasMarkedText() const;
     virtual WebRange markedRange() const;
-    virtual void setSelectionToRange(const WebRange&) OVERRIDE;
     virtual bool firstRectForCharacterRange(unsigned location, unsigned length, WebRect&) const;
     virtual size_t characterIndexForPoint(const WebPoint&) const;
     virtual bool executeCommand(const WebString&, const WebNode& = WebNode());
diff --git a/Source/WebKit/chromium/src/WebIOSurfaceLayer.cpp b/Source/WebKit/chromium/src/WebIOSurfaceLayerImpl.cpp
index 77db0c877..bab70c61d 100644
--- a/Source/WebKit/chromium/src/WebIOSurfaceLayer.cpp
+++ b/Source/WebKit/chromium/src/WebIOSurfaceLayerImpl.cpp
@@ -24,30 +24,39 @@
  */
 
 #include "config.h"
-#include <public/WebIOSurfaceLayer.h>
+#include "WebIOSurfaceLayerImpl.h"
 
 #include "IOSurfaceLayerChromium.h"
-#include <public/WebSize.h>
+#include "WebLayerImpl.h"
 
-using namespace WebCore;
+using WebCore::IOSurfaceLayerChromium;
 
 namespace WebKit {
 
-WebIOSurfaceLayer WebIOSurfaceLayer::create()
+WebIOSurfaceLayer* WebIOSurfaceLayer::create()
 {
     RefPtr<IOSurfaceLayerChromium> layer = IOSurfaceLayerChromium::create();
     layer->setIsDrawable(true);
-    return WebIOSurfaceLayer(layer.release());
+    return new WebIOSurfaceLayerImpl(layer.release());
 }
 
-void WebIOSurfaceLayer::setIOSurfaceProperties(unsigned ioSurfaceId, WebSize size)
+WebIOSurfaceLayerImpl::WebIOSurfaceLayerImpl(PassRefPtr<IOSurfaceLayerChromium> layer)
+    : m_layer(adoptPtr(new WebLayerImpl(layer)))
 {
-    unwrap<IOSurfaceLayerChromium>()->setIOSurfaceProperties(ioSurfaceId, size);
 }
 
-WebIOSurfaceLayer::WebIOSurfaceLayer(PassRefPtr<IOSurfaceLayerChromium> layer)
-    : WebLayer(layer)
+WebIOSurfaceLayerImpl::~WebIOSurfaceLayerImpl()
 {
 }
 
+void WebIOSurfaceLayerImpl::setIOSurfaceProperties(unsigned ioSurfaceId, WebSize size)
+{
+    static_cast<IOSurfaceLayerChromium*>(m_layer->layer())->setIOSurfaceProperties(ioSurfaceId, size);
+}
+
+WebLayer* WebIOSurfaceLayerImpl::layer()
+{
+    return m_layer.get();
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebIOSurfaceLayerImpl.h b/Source/WebKit/chromium/src/WebIOSurfaceLayerImpl.h
new file mode 100644
index 000000000..3dbb02759
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebIOSurfaceLayerImpl.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebIOSurfaceLayerImpl_h
+#define WebIOSurfaceLayerImpl_h
+
+#include <public/WebIOSurfaceLayer.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+class IOSurfaceLayerChromium;
+}
+
+namespace WebKit {
+
+class WebIOSurfaceLayerImpl : public WebIOSurfaceLayer {
+public:
+    explicit WebIOSurfaceLayerImpl(PassRefPtr<WebCore::IOSurfaceLayerChromium>);
+    virtual ~WebIOSurfaceLayerImpl();
+
+    // WebIOSurfaceLayer implementation.
+    virtual WebLayer* layer() OVERRIDE;
+    virtual void setIOSurfaceProperties(unsigned ioSurfaceId, WebSize) OVERRIDE;
+
+private:
+    OwnPtr<WebLayerImpl> m_layer;
+};
+
+}
+
+#endif // WebIOSurfaceLayerImpl_h
+
diff --git a/Source/WebKit/chromium/src/WebSolidColorLayer.cpp b/Source/WebKit/chromium/src/WebImageLayerImpl.cpp
index 83914b263..d93af8045 100644
--- a/Source/WebKit/chromium/src/WebSolidColorLayer.cpp
+++ b/Source/WebKit/chromium/src/WebImageLayerImpl.cpp
@@ -24,26 +24,37 @@
  */
 
 #include "config.h"
-#include <public/WebSolidColorLayer.h>
+#include "WebImageLayerImpl.h"
 
-#include "WebSolidColorLayerImpl.h"
-#include <public/WebFloatRect.h>
+#include "ImageLayerChromium.h"
+#include "WebLayerImpl.h"
+
+using WebCore::ImageLayerChromium;
 
 namespace WebKit {
 
-WebSolidColorLayer WebSolidColorLayer::create()
+WebImageLayer* WebImageLayer::create()
+{
+    return new WebImageLayerImpl(WebCore::ImageLayerChromium::create());
+}
+
+WebImageLayerImpl::WebImageLayerImpl(PassRefPtr<WebCore::ImageLayerChromium> layer)
+    : m_layer(adoptPtr(new WebLayerImpl(layer)))
+{
+}
+
+WebImageLayerImpl::~WebImageLayerImpl()
 {
-    return WebSolidColorLayer(WebSolidColorLayerImpl::create());
 }
 
-WebSolidColorLayer::WebSolidColorLayer(const PassRefPtr<WebSolidColorLayerImpl>& node)
-    : WebLayer(node)
+WebLayer* WebImageLayerImpl::layer()
 {
+    return m_layer.get();
 }
 
-void WebSolidColorLayer::setBackgroundColor(const WebColor& color)
+void WebImageLayerImpl::setBitmap(SkBitmap bitmap)
 {
-    m_private->setBackgroundColor(color);
+    static_cast<ImageLayerChromium*>(m_layer->layer())->setBitmap(bitmap);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebImageLayer.cpp b/Source/WebKit/chromium/src/WebImageLayerImpl.h
index f76151530..9a4b8b3eb 100644
--- a/Source/WebKit/chromium/src/WebImageLayer.cpp
+++ b/Source/WebKit/chromium/src/WebImageLayerImpl.h
@@ -23,26 +23,32 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef WebImageLayerImpl_h
+#define WebImageLayerImpl_h
+
 #include <public/WebImageLayer.h>
+#include <wtf/OwnPtr.h>
 
-#include "ImageLayerChromium.h"
+namespace WebCore {
+class ImageLayerChromium;
+}
 
 namespace WebKit {
+class WebLayerImpl;
 
-WebImageLayer WebImageLayer::create()
-{
-    return WebImageLayer(WebCore::ImageLayerChromium::create());
-}
+class WebImageLayerImpl : public WebImageLayer {
+public:
+    explicit WebImageLayerImpl(PassRefPtr<WebCore::ImageLayerChromium>);
+    virtual ~WebImageLayerImpl();
 
-WebImageLayer::WebImageLayer(PassRefPtr<WebCore::ImageLayerChromium> layer)
-    : WebLayer(layer)
-{
-}
+    // WebImageLayer implementation.
+    WebLayer* layer() OVERRIDE;
+    virtual void setBitmap(SkBitmap) OVERRIDE;
+
+private:
+    OwnPtr<WebLayerImpl> m_layer;
+};
 
-void WebImageLayer::setBitmap(SkBitmap bitmap)
-{
-    unwrap<WebCore::ImageLayerChromium>()->setBitmap(bitmap);
 }
 
-} // namespace WebKit
+#endif // WebImageLayerImpl_h
diff --git a/Source/WebKit/chromium/src/WebLayer.cpp b/Source/WebKit/chromium/src/WebLayer.cpp
deleted file mode 100644
index 37897e6f8..000000000
--- a/Source/WebKit/chromium/src/WebLayer.cpp
+++ /dev/null
@@ -1,379 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include <public/WebLayer.h>
-
-#include "LayerChromium.h"
-#include "SkMatrix44.h"
-#include "WebAnimationImpl.h"
-#include "WebLayerImpl.h"
-#include <public/WebFilterOperations.h>
-#include <public/WebFloatPoint.h>
-#include <public/WebFloatRect.h>
-#include <public/WebSize.h>
-#include <public/WebTransformationMatrix.h>
-
-using namespace WebCore;
-using WebKit::WebTransformationMatrix;
-
-namespace {
-
-WebTransformationMatrix transformationMatrixFromSkMatrix44(const SkMatrix44& matrix)
-{
-    double data[16];
-    matrix.asColMajord(data);
-    return WebTransformationMatrix(data[0], data[1], data[2], data[3],
-                                   data[4], data[5], data[6], data[7],
-                                   data[8], data[9], data[10], data[11],
-                                   data[12], data[13], data[14], data[15]);
-}
-
-SkMatrix44 skMatrix44FromTransformationMatrix(const WebTransformationMatrix& matrix)
-{
-    SkMatrix44 skMatrix;
-    skMatrix.set(0, 0, SkDoubleToMScalar(matrix.m11()));
-    skMatrix.set(1, 0, SkDoubleToMScalar(matrix.m12()));
-    skMatrix.set(2, 0, SkDoubleToMScalar(matrix.m13()));
-    skMatrix.set(3, 0, SkDoubleToMScalar(matrix.m14()));
-    skMatrix.set(0, 1, SkDoubleToMScalar(matrix.m21()));
-    skMatrix.set(1, 1, SkDoubleToMScalar(matrix.m22()));
-    skMatrix.set(2, 1, SkDoubleToMScalar(matrix.m23()));
-    skMatrix.set(3, 1, SkDoubleToMScalar(matrix.m24()));
-    skMatrix.set(0, 2, SkDoubleToMScalar(matrix.m31()));
-    skMatrix.set(1, 2, SkDoubleToMScalar(matrix.m32()));
-    skMatrix.set(2, 2, SkDoubleToMScalar(matrix.m33()));
-    skMatrix.set(3, 2, SkDoubleToMScalar(matrix.m34()));
-    skMatrix.set(0, 3, SkDoubleToMScalar(matrix.m41()));
-    skMatrix.set(1, 3, SkDoubleToMScalar(matrix.m42()));
-    skMatrix.set(2, 3, SkDoubleToMScalar(matrix.m43()));
-    skMatrix.set(3, 3, SkDoubleToMScalar(matrix.m44()));
-    return skMatrix;
-}
-
-} // anonymous namespace
-
-namespace WebKit {
-
-WebLayer WebLayer::create()
-{
-    return WebLayer(WebLayerImpl::create());
-}
-
-void WebLayer::reset()
-{
-    m_private.reset();
-}
-
-void WebLayer::assign(const WebLayer& other)
-{
-    m_private = other.m_private;
-}
-
-bool WebLayer::equals(const WebLayer& n) const
-{
-    return (m_private.get() == n.m_private.get());
-}
-
-void WebLayer::invalidateRect(const WebFloatRect& dirtyRect)
-{
-    m_private->setNeedsDisplayRect(dirtyRect);
-}
-
-void WebLayer::invalidate()
-{
-    m_private->setNeedsDisplay();
-}
-
-void WebLayer::addChild(const WebLayer& child)
-{
-    m_private->addChild(child);
-}
-
-void WebLayer::insertChild(const WebLayer& child, size_t index)
-{
-    m_private->insertChild(child, index);
-}
-
-void WebLayer::replaceChild(const WebLayer& reference, const WebLayer& newLayer)
-{
-    WebLayer ref = reference;
-    m_private->replaceChild(ref.unwrap<LayerChromium>(), newLayer);
-}
-
-void WebLayer::setChildren(const WebVector<WebLayer>& webChildren)
-{
-    Vector<RefPtr<LayerChromium> > children(webChildren.size());
-    for (size_t i = 0; i < webChildren.size(); ++i)
-        children[i] = webChildren[i].unwrap<LayerChromium>();
-    m_private->setChildren(children);
-}
-
-void WebLayer::removeFromParent()
-{
-    m_private->removeFromParent();
-}
-
-void WebLayer::removeAllChildren()
-{
-    m_private->removeAllChildren();
-}
-
-void WebLayer::setAnchorPoint(const WebFloatPoint& anchorPoint)
-{
-    m_private->setAnchorPoint(anchorPoint);
-}
-
-WebFloatPoint WebLayer::anchorPoint() const
-{
-    return WebFloatPoint(m_private->anchorPoint());
-}
-
-void WebLayer::setAnchorPointZ(float anchorPointZ)
-{
-    m_private->setAnchorPointZ(anchorPointZ);
-}
-
-float WebLayer::anchorPointZ() const
-{
-    return m_private->anchorPointZ();
-}
-
-void WebLayer::setBounds(const WebSize& size)
-{
-    m_private->setBounds(size);
-}
-
-WebSize WebLayer::bounds() const
-{
-    return WebSize(m_private->bounds());
-}
-
-void WebLayer::setMasksToBounds(bool masksToBounds)
-{
-    m_private->setMasksToBounds(masksToBounds);
-}
-
-bool WebLayer::masksToBounds() const
-{
-    return m_private->masksToBounds();
-}
-
-void WebLayer::setMaskLayer(const WebLayer& maskLayer)
-{
-    WebLayer ref = maskLayer;
-    m_private->setMaskLayer(ref.unwrap<LayerChromium>());
-}
-
-void WebLayer::setReplicaLayer(const WebLayer& replicaLayer)
-{
-    WebLayer ref = replicaLayer;
-    m_private->setReplicaLayer(ref.unwrap<LayerChromium>());
-}
-
-void WebLayer::setOpacity(float opacity)
-{
-    m_private->setOpacity(opacity);
-}
-
-float WebLayer::opacity() const
-{
-    return m_private->opacity();
-}
-
-void WebLayer::setOpaque(bool opaque)
-{
-    m_private->setOpaque(opaque);
-}
-
-bool WebLayer::opaque() const
-{
-    return m_private->opaque();
-}
-
-void WebLayer::setPosition(const WebFloatPoint& position)
-{
-    m_private->setPosition(position);
-}
-
-WebFloatPoint WebLayer::position() const
-{
-    return WebFloatPoint(m_private->position());
-}
-
-void WebLayer::setSublayerTransform(const SkMatrix44& matrix)
-{
-    m_private->setSublayerTransform(transformationMatrixFromSkMatrix44(matrix));
-}
-
-void WebLayer::setSublayerTransform(const WebTransformationMatrix& matrix)
-{
-    m_private->setSublayerTransform(matrix);
-}
-
-SkMatrix44 WebLayer::sublayerTransform() const
-{
-    return skMatrix44FromTransformationMatrix(m_private->sublayerTransform());
-}
-
-void WebLayer::setTransform(const SkMatrix44& matrix)
-{
-    m_private->setTransform(transformationMatrixFromSkMatrix44(matrix));
-}
-
-void WebLayer::setTransform(const WebTransformationMatrix& matrix)
-{
-    m_private->setTransform(matrix);
-}
-
-SkMatrix44 WebLayer::transform() const
-{
-    return skMatrix44FromTransformationMatrix(m_private->transform());
-}
-
-void WebLayer::setDrawsContent(bool drawsContent)
-{
-    m_private->setIsDrawable(drawsContent);
-}
-
-bool WebLayer::drawsContent() const
-{
-    return m_private->drawsContent();
-}
-
-void WebLayer::setPreserves3D(bool preserve3D)
-{
-    m_private->setPreserves3D(preserve3D);
-}
-
-void WebLayer::setUseParentBackfaceVisibility(bool useParentBackfaceVisibility)
-{
-    m_private->setUseParentBackfaceVisibility(useParentBackfaceVisibility);
-}
-
-void WebLayer::setBackgroundColor(WebColor color)
-{
-    m_private->setBackgroundColor(color);
-}
-
-void WebLayer::setFilters(const WebFilterOperations& filters)
-{
-    m_private->setFilters(filters);
-}
-
-void WebLayer::setBackgroundFilters(const WebFilterOperations& filters)
-{
-    m_private->setBackgroundFilters(filters);
-}
-
-void WebLayer::setDebugBorderColor(const WebColor& color)
-{
-    m_private->setDebugBorderColor(color);
-}
-
-void WebLayer::setDebugBorderWidth(float width)
-{
-    m_private->setDebugBorderWidth(width);
-}
-
-void WebLayer::setDebugName(WebString name)
-{
-    m_private->setDebugName(name);
-}
-
-void WebLayer::setAnimationDelegate(WebAnimationDelegate* delegate)
-{
-    m_private->setLayerAnimationDelegate(delegate);
-}
-
-bool WebLayer::addAnimation(WebAnimation* animation)
-{
-    return m_private->addAnimation(static_cast<WebAnimationImpl*>(animation)->cloneToCCAnimation());
-}
-
-void WebLayer::removeAnimation(int animationId)
-{
-    m_private->removeAnimation(animationId);
-}
-
-void WebLayer::removeAnimation(int animationId, WebAnimation::TargetProperty targetProperty)
-{
-    m_private->layerAnimationController()->removeAnimation(animationId, static_cast<CCActiveAnimation::TargetProperty>(targetProperty));
-}
-
-void WebLayer::pauseAnimation(int animationId, double timeOffset)
-{
-    m_private->pauseAnimation(animationId, timeOffset);
-}
-
-void WebLayer::suspendAnimations(double monotonicTime)
-{
-    m_private->suspendAnimations(monotonicTime);
-}
-
-void WebLayer::resumeAnimations(double monotonicTime)
-{
-    m_private->resumeAnimations(monotonicTime);
-}
-
-bool WebLayer::hasActiveAnimation()
-{
-    return m_private->hasActiveAnimation();
-}
-
-void WebLayer::transferAnimationsTo(WebLayer* other)
-{
-    ASSERT(other);
-    if (other)
-        other->m_private->setLayerAnimationController(m_private->releaseLayerAnimationController());
-}
-
-void WebLayer::setForceRenderSurface(bool forceRenderSurface)
-{
-    m_private->setForceRenderSurface(forceRenderSurface);
-}
-
-void WebLayer::clearRenderSurface()
-{
-    m_private->clearRenderSurface();
-}
-
-WebLayer::WebLayer(const PassRefPtr<LayerChromium>& node)
-    : m_private(node)
-{
-}
-
-WebLayer& WebLayer::operator=(const PassRefPtr<LayerChromium>& node)
-{
-    m_private = node;
-    return *this;
-}
-
-WebLayer::operator PassRefPtr<LayerChromium>() const
-{
-    return m_private.get();
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebLayerImpl.cpp b/Source/WebKit/chromium/src/WebLayerImpl.cpp
index 16e1206ca..40ced485d 100644
--- a/Source/WebKit/chromium/src/WebLayerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebLayerImpl.cpp
@@ -26,25 +26,376 @@
 #include "config.h"
 #include "WebLayerImpl.h"
 
-using namespace WebCore;
+#include "CCActiveAnimation.h"
+#include "LayerChromium.h"
+#include "SkMatrix44.h"
+#include "WebAnimationImpl.h"
+#include <public/WebFloatPoint.h>
+#include <public/WebFloatRect.h>
+#include <public/WebSize.h>
+#include <public/WebTransformationMatrix.h>
+
+using WebCore::CCActiveAnimation;
+using WebCore::LayerChromium;
 
 namespace WebKit {
 
-PassRefPtr<WebLayerImpl> WebLayerImpl::create()
+namespace {
+
+WebTransformationMatrix transformationMatrixFromSkMatrix44(const SkMatrix44& matrix)
+{
+    double data[16];
+    matrix.asColMajord(data);
+    return WebTransformationMatrix(data[0], data[1], data[2], data[3],
+                                   data[4], data[5], data[6], data[7],
+                                   data[8], data[9], data[10], data[11],
+                                   data[12], data[13], data[14], data[15]);
+}
+
+SkMatrix44 skMatrix44FromTransformationMatrix(const WebTransformationMatrix& matrix)
+{
+    SkMatrix44 skMatrix;
+    skMatrix.set(0, 0, SkDoubleToMScalar(matrix.m11()));
+    skMatrix.set(1, 0, SkDoubleToMScalar(matrix.m12()));
+    skMatrix.set(2, 0, SkDoubleToMScalar(matrix.m13()));
+    skMatrix.set(3, 0, SkDoubleToMScalar(matrix.m14()));
+    skMatrix.set(0, 1, SkDoubleToMScalar(matrix.m21()));
+    skMatrix.set(1, 1, SkDoubleToMScalar(matrix.m22()));
+    skMatrix.set(2, 1, SkDoubleToMScalar(matrix.m23()));
+    skMatrix.set(3, 1, SkDoubleToMScalar(matrix.m24()));
+    skMatrix.set(0, 2, SkDoubleToMScalar(matrix.m31()));
+    skMatrix.set(1, 2, SkDoubleToMScalar(matrix.m32()));
+    skMatrix.set(2, 2, SkDoubleToMScalar(matrix.m33()));
+    skMatrix.set(3, 2, SkDoubleToMScalar(matrix.m34()));
+    skMatrix.set(0, 3, SkDoubleToMScalar(matrix.m41()));
+    skMatrix.set(1, 3, SkDoubleToMScalar(matrix.m42()));
+    skMatrix.set(2, 3, SkDoubleToMScalar(matrix.m43()));
+    skMatrix.set(3, 3, SkDoubleToMScalar(matrix.m44()));
+    return skMatrix;
+}
+
+} // anonymous namespace
+
+
+WebLayer* WebLayer::create()
 {
-    return adoptRef(new WebLayerImpl());
+    return new WebLayerImpl(LayerChromium::create());
 }
 
-WebLayerImpl::WebLayerImpl()
-    : LayerChromium()
+WebLayerImpl::WebLayerImpl(PassRefPtr<LayerChromium> layer)
+    : m_layer(layer)
 {
-    // Make sure that this layer does not draw content. This way we don't have to override
-    // the base class implementation of drawsContent().
-    ASSERT(!drawsContent());
 }
 
 WebLayerImpl::~WebLayerImpl()
 {
+    m_layer->clearRenderSurface();
+    m_layer->setLayerAnimationDelegate(0);
+}
+
+int WebLayerImpl::id() const
+{
+    return m_layer->id();
+}
+
+void WebLayerImpl::invalidateRect(const WebFloatRect& rect)
+{
+    m_layer->setNeedsDisplayRect(rect);
+}
+
+void WebLayerImpl::invalidate()
+{
+    m_layer->setNeedsDisplay();
+}
+
+void WebLayerImpl::addChild(WebLayer* child)
+{
+    m_layer->addChild(static_cast<WebLayerImpl*>(child)->layer());
+}
+
+void WebLayerImpl::insertChild(WebLayer* child, size_t index)
+{
+    m_layer->insertChild(static_cast<WebLayerImpl*>(child)->layer(), index);
+}
+
+void WebLayerImpl::replaceChild(WebLayer* reference, WebLayer* newLayer)
+{
+    m_layer->replaceChild(static_cast<WebLayerImpl*>(reference)->layer(), static_cast<WebLayerImpl*>(newLayer)->layer());
+}
+
+void WebLayerImpl::setChildren(const WebVector<WebLayer*>& webChildren)
+{
+    Vector<RefPtr<LayerChromium> > children(webChildren.size());
+    for (size_t i = 0; i < webChildren.size(); ++i)
+        children[i] = static_cast<WebLayerImpl*>(webChildren[i])->layer();
+    m_layer->setChildren(children);
+}
+
+void WebLayerImpl::removeFromParent()
+{
+    m_layer->removeFromParent();
+}
+
+void WebLayerImpl::removeAllChildren()
+{
+    m_layer->removeAllChildren();
+}
+
+void WebLayerImpl::setAnchorPoint(const WebFloatPoint& anchorPoint)
+{
+    m_layer->setAnchorPoint(anchorPoint);
+}
+
+WebFloatPoint WebLayerImpl::anchorPoint() const
+{
+    return WebFloatPoint(m_layer->anchorPoint());
+}
+
+void WebLayerImpl::setAnchorPointZ(float anchorPointZ)
+{
+    m_layer->setAnchorPointZ(anchorPointZ);
+}
+
+float WebLayerImpl::anchorPointZ() const
+{
+    return m_layer->anchorPointZ();
+}
+
+void WebLayerImpl::setBounds(const WebSize& size)
+{
+    m_layer->setBounds(size);
+}
+
+WebSize WebLayerImpl::bounds() const
+{
+    return WebSize(m_layer->bounds());
+}
+
+void WebLayerImpl::setMasksToBounds(bool masksToBounds)
+{
+    m_layer->setMasksToBounds(masksToBounds);
+}
+
+bool WebLayerImpl::masksToBounds() const
+{
+    return m_layer->masksToBounds();
+}
+
+void WebLayerImpl::setMaskLayer(WebLayer* maskLayer)
+{
+    m_layer->setMaskLayer(maskLayer ? static_cast<WebLayerImpl*>(maskLayer)->layer() : 0);
+}
+
+void WebLayerImpl::setReplicaLayer(WebLayer* replicaLayer)
+{
+    m_layer->setReplicaLayer(replicaLayer ? static_cast<WebLayerImpl*>(replicaLayer)->layer() : 0);
+}
+
+void WebLayerImpl::setOpacity(float opacity)
+{
+    m_layer->setOpacity(opacity);
+}
+
+float WebLayerImpl::opacity() const
+{
+    return m_layer->opacity();
+}
+
+void WebLayerImpl::setOpaque(bool opaque)
+{
+    m_layer->setOpaque(opaque);
+}
+
+bool WebLayerImpl::opaque() const
+{
+    return m_layer->opaque();
+}
+
+void WebLayerImpl::setPosition(const WebFloatPoint& position)
+{
+    m_layer->setPosition(position);
+}
+
+WebFloatPoint WebLayerImpl::position() const
+{
+    return WebFloatPoint(m_layer->position());
+}
+
+void WebLayerImpl::setSublayerTransform(const SkMatrix44& matrix)
+{
+    m_layer->setSublayerTransform(transformationMatrixFromSkMatrix44(matrix));
+}
+
+void WebLayerImpl::setSublayerTransform(const WebTransformationMatrix& matrix)
+{
+    m_layer->setSublayerTransform(matrix);
+}
+
+SkMatrix44 WebLayerImpl::sublayerTransform() const
+{
+    return skMatrix44FromTransformationMatrix(m_layer->sublayerTransform());
+}
+
+void WebLayerImpl::setTransform(const SkMatrix44& matrix)
+{
+    m_layer->setTransform(transformationMatrixFromSkMatrix44(matrix));
+}
+
+void WebLayerImpl::setTransform(const WebTransformationMatrix& matrix)
+{
+    m_layer->setTransform(matrix);
+}
+
+SkMatrix44 WebLayerImpl::transform() const
+{
+    return skMatrix44FromTransformationMatrix(m_layer->transform());
+}
+
+void WebLayerImpl::setDrawsContent(bool drawsContent)
+{
+    m_layer->setIsDrawable(drawsContent);
+}
+
+bool WebLayerImpl::drawsContent() const
+{
+    return m_layer->drawsContent();
+}
+
+void WebLayerImpl::setPreserves3D(bool preserve3D)
+{
+    m_layer->setPreserves3D(preserve3D);
+}
+
+void WebLayerImpl::setUseParentBackfaceVisibility(bool useParentBackfaceVisibility)
+{
+    m_layer->setUseParentBackfaceVisibility(useParentBackfaceVisibility);
+}
+
+void WebLayerImpl::setBackgroundColor(WebColor color)
+{
+    m_layer->setBackgroundColor(color);
+}
+
+void WebLayerImpl::setFilters(const WebFilterOperations& filters)
+{
+    m_layer->setFilters(filters);
+}
+
+void WebLayerImpl::setBackgroundFilters(const WebFilterOperations& filters)
+{
+    m_layer->setBackgroundFilters(filters);
+}
+
+void WebLayerImpl::setDebugBorderColor(const WebColor& color)
+{
+    m_layer->setDebugBorderColor(color);
+}
+
+void WebLayerImpl::setDebugBorderWidth(float width)
+{
+    m_layer->setDebugBorderWidth(width);
+}
+
+void WebLayerImpl::setDebugName(WebString name)
+{
+    m_layer->setDebugName(name);
+}
+
+void WebLayerImpl::setAnimationDelegate(WebAnimationDelegate* delegate)
+{
+    m_layer->setLayerAnimationDelegate(delegate);
+}
+
+bool WebLayerImpl::addAnimation(WebAnimation* animation)
+{
+    return m_layer->addAnimation(static_cast<WebAnimationImpl*>(animation)->cloneToCCAnimation());
+}
+
+void WebLayerImpl::removeAnimation(int animationId)
+{
+    m_layer->removeAnimation(animationId);
+}
+
+void WebLayerImpl::removeAnimation(int animationId, WebAnimation::TargetProperty targetProperty)
+{
+    m_layer->layerAnimationController()->removeAnimation(animationId, static_cast<CCActiveAnimation::TargetProperty>(targetProperty));
+}
+
+void WebLayerImpl::pauseAnimation(int animationId, double timeOffset)
+{
+    m_layer->pauseAnimation(animationId, timeOffset);
+}
+
+void WebLayerImpl::suspendAnimations(double monotonicTime)
+{
+    m_layer->suspendAnimations(monotonicTime);
+}
+
+void WebLayerImpl::resumeAnimations(double monotonicTime)
+{
+    m_layer->resumeAnimations(monotonicTime);
+}
+
+bool WebLayerImpl::hasActiveAnimation()
+{
+    return m_layer->hasActiveAnimation();
+}
+
+void WebLayerImpl::transferAnimationsTo(WebLayer* other)
+{
+    ASSERT(other);
+    static_cast<WebLayerImpl*>(other)->m_layer->setLayerAnimationController(m_layer->releaseLayerAnimationController());
+}
+
+void WebLayerImpl::setForceRenderSurface(bool forceRenderSurface)
+{
+    m_layer->setForceRenderSurface(forceRenderSurface);
+}
+
+void WebLayerImpl::setScrollPosition(WebPoint position)
+{
+    m_layer->setScrollPosition(position);
+}
+
+void WebLayerImpl::setScrollable(bool scrollable)
+{
+    m_layer->setScrollable(scrollable);
+}
+
+void WebLayerImpl::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
+{
+    m_layer->setHaveWheelEventHandlers(haveWheelEventHandlers);
+}
+
+void WebLayerImpl::setShouldScrollOnMainThread(bool shouldScrollOnMainThread)
+{
+    m_layer->setShouldScrollOnMainThread(shouldScrollOnMainThread);
+}
+
+void WebLayerImpl::setNonFastScrollableRegion(const WebVector<WebRect>& rects)
+{
+    WebCore::Region region;
+    for (size_t i = 0; i < rects.size(); ++i) {
+        WebCore::IntRect rect = rects[i];
+        region.unite(rect);
+    }
+    m_layer->setNonFastScrollableRegion(region);
+
+}
+
+void WebLayerImpl::setIsContainerForFixedPositionLayers(bool enable)
+{
+    m_layer->setIsContainerForFixedPositionLayers(enable);
+}
+
+void WebLayerImpl::setFixedToContainerLayer(bool enable)
+{
+    m_layer->setFixedToContainerLayer(enable);
+}
+
+LayerChromium* WebLayerImpl::layer() const
+{
+    return m_layer.get();
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebLayerImpl.h b/Source/WebKit/chromium/src/WebLayerImpl.h
index 7e4e75062..7e3b533bc 100644
--- a/Source/WebKit/chromium/src/WebLayerImpl.h
+++ b/Source/WebKit/chromium/src/WebLayerImpl.h
@@ -26,18 +26,84 @@
 #ifndef WebLayerImpl_h
 #define WebLayerImpl_h
 
-#include "LayerChromium.h"
-#include <wtf/PassRefPtr.h>
+#include <public/WebLayer.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+class LayerChromium;
+}
 
 namespace WebKit {
 
-class WebLayerImpl : public WebCore::LayerChromium {
+class WebLayerImpl : public WebLayer {
 public:
-    static PassRefPtr<WebLayerImpl> create();
+    explicit WebLayerImpl(PassRefPtr<WebCore::LayerChromium>);
+    virtual ~WebLayerImpl();
+
+    // WebLayer implementation.
+    virtual int id() const OVERRIDE;
+    virtual void invalidateRect(const WebFloatRect&) OVERRIDE;
+    virtual void invalidate() OVERRIDE;
+    virtual void addChild(WebLayer*) OVERRIDE;
+    virtual void insertChild(WebLayer*, size_t index) OVERRIDE;
+    virtual void replaceChild(WebLayer* reference, WebLayer* newLayer) OVERRIDE;
+    virtual void setChildren(const WebVector<WebLayer*>&) OVERRIDE;
+    virtual void removeFromParent() OVERRIDE;
+    virtual void removeAllChildren() OVERRIDE;
+    virtual void setAnchorPoint(const WebFloatPoint&) OVERRIDE;
+    virtual WebFloatPoint anchorPoint() const OVERRIDE;
+    virtual void setAnchorPointZ(float) OVERRIDE;
+    virtual float anchorPointZ() const OVERRIDE;
+    virtual void setBounds(const WebSize&) OVERRIDE;
+    virtual WebSize bounds() const OVERRIDE;
+    virtual void setMasksToBounds(bool) OVERRIDE;
+    virtual bool masksToBounds() const OVERRIDE;
+    virtual void setMaskLayer(WebLayer*) OVERRIDE;
+    virtual void setReplicaLayer(WebLayer*) OVERRIDE;
+    virtual void setOpacity(float) OVERRIDE;
+    virtual float opacity() const OVERRIDE;
+    virtual void setOpaque(bool) OVERRIDE;
+    virtual bool opaque() const OVERRIDE;
+    virtual void setPosition(const WebFloatPoint&) OVERRIDE;
+    virtual WebFloatPoint position() const OVERRIDE;
+    virtual void setSublayerTransform(const SkMatrix44&) OVERRIDE;
+    virtual void setSublayerTransform(const WebTransformationMatrix&) OVERRIDE;
+    virtual SkMatrix44 sublayerTransform() const OVERRIDE;
+    virtual void setTransform(const SkMatrix44&) OVERRIDE;
+    virtual void setTransform(const WebTransformationMatrix&) OVERRIDE;
+    virtual SkMatrix44 transform() const OVERRIDE;
+    virtual void setDrawsContent(bool) OVERRIDE;
+    virtual bool drawsContent() const OVERRIDE;
+    virtual void setPreserves3D(bool) OVERRIDE;
+    virtual void setUseParentBackfaceVisibility(bool) OVERRIDE;
+    virtual void setBackgroundColor(WebColor) OVERRIDE;
+    virtual void setFilters(const WebFilterOperations&) OVERRIDE;
+    virtual void setBackgroundFilters(const WebFilterOperations&) OVERRIDE;
+    virtual void setDebugBorderColor(const WebColor&) OVERRIDE;
+    virtual void setDebugBorderWidth(float) OVERRIDE;
+    virtual void setDebugName(WebString) OVERRIDE;
+    virtual void setAnimationDelegate(WebAnimationDelegate*) OVERRIDE;
+    virtual bool addAnimation(WebAnimation*) OVERRIDE;
+    virtual void removeAnimation(int animationId) OVERRIDE;
+    virtual void removeAnimation(int animationId, WebAnimation::TargetProperty) OVERRIDE;
+    virtual void pauseAnimation(int animationId, double timeOffset) OVERRIDE;
+    virtual void suspendAnimations(double monotonicTime) OVERRIDE;
+    virtual void resumeAnimations(double monotonicTime) OVERRIDE;
+    virtual bool hasActiveAnimation() OVERRIDE;
+    virtual void transferAnimationsTo(WebLayer*) OVERRIDE;
+    virtual void setForceRenderSurface(bool) OVERRIDE;
+    virtual void setScrollPosition(WebPoint) OVERRIDE;
+    virtual void setScrollable(bool) OVERRIDE;
+    virtual void setHaveWheelEventHandlers(bool) OVERRIDE;
+    virtual void setShouldScrollOnMainThread(bool) OVERRIDE;
+    virtual void setNonFastScrollableRegion(const WebVector<WebRect>&) OVERRIDE;
+    virtual void setIsContainerForFixedPositionLayers(bool) OVERRIDE;
+    virtual void setFixedToContainerLayer(bool) OVERRIDE;
+
+    WebCore::LayerChromium* layer() const;
 
 protected:
-    WebLayerImpl();
-    virtual ~WebLayerImpl();
+    RefPtr<WebCore::LayerChromium> m_layer;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebLayerTreeView.cpp b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
index f397e534a..7dfbcd129 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeView.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeView.cpp
@@ -31,6 +31,7 @@
 #include "CCLayerTreeHost.h"
 #include "CCRenderingStats.h"
 #include "LayerChromium.h"
+#include "WebLayerImpl.h"
 #include "WebLayerTreeViewImpl.h"
 #include <public/WebLayer.h>
 #include <public/WebPoint.h>
@@ -83,7 +84,7 @@ void WebLayerTreeView::setSurfaceReady()
 void WebLayerTreeView::setRootLayer(WebLayer *root)
 {
     if (root)
-        m_private->layerTreeHost()->setRootLayer(*root);
+        m_private->layerTreeHost()->setRootLayer(static_cast<WebLayerImpl*>(root)->layer());
     else
         m_private->layerTreeHost()->setRootLayer(PassRefPtr<LayerChromium>());
 }
diff --git a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
index 1f1933fc9..1fd823976 100644
--- a/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebLayerTreeViewImpl.cpp
@@ -29,6 +29,7 @@
 #include "CCLayerTreeHost.h"
 #include "CCThreadProxy.h"
 #include "LayerChromium.h"
+#include "WebLayerImpl.h"
 #include <public/WebGraphicsContext3D.h>
 #include <public/WebLayer.h>
 #include <public/WebLayerTreeView.h>
@@ -142,7 +143,7 @@ PassOwnPtr<WebLayerTreeViewImpl> WebLayerTreeViewImpl::create(WebLayerTreeViewCl
     OwnPtr<WebLayerTreeViewImpl> impl = adoptPtr(new WebLayerTreeViewImpl(client, settings));
     if (!impl->layerTreeHost())
         return nullptr;
-    impl->layerTreeHost()->setRootLayer(root);
+    impl->layerTreeHost()->setRootLayer(static_cast<const WebLayerImpl*>(&root)->layer());
     return impl.release();
 }
 
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index 4a90a988d..cb756233e 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -109,9 +109,9 @@ void WebMediaPlayerClientImpl::readyStateChanged()
     ASSERT(m_mediaPlayer);
     m_mediaPlayer->readyStateChanged();
 #if USE(ACCELERATED_COMPOSITING)
-    if (hasVideo() && supportsAcceleratedRendering() && m_videoLayer.isNull()) {
-        m_videoLayer = WebVideoLayer::create(this);
-        m_videoLayer.setOpaque(m_opaque);
+    if (hasVideo() && supportsAcceleratedRendering() && !m_videoLayer) {
+        m_videoLayer = adoptPtr(WebVideoLayer::create(this));
+        m_videoLayer->layer()->setOpaque(m_opaque);
     }
 #endif
 }
@@ -138,8 +138,8 @@ void WebMediaPlayerClientImpl::repaint()
 {
     ASSERT(m_mediaPlayer);
 #if USE(ACCELERATED_COMPOSITING)
-    if (!m_videoLayer.isNull() && supportsAcceleratedRendering())
-        m_videoLayer.invalidate();
+    if (m_videoLayer && supportsAcceleratedRendering())
+        m_videoLayer->layer()->invalidate();
 #endif
     m_mediaPlayer->repaint();
 }
@@ -166,8 +166,8 @@ void WebMediaPlayerClientImpl::setOpaque(bool opaque)
 {
 #if USE(ACCELERATED_COMPOSITING)
     m_opaque = opaque;
-    if (!m_videoLayer.isNull())
-        m_videoLayer.setOpaque(m_opaque);
+    if (m_videoLayer)
+        m_videoLayer->layer()->setOpaque(m_opaque);
 #endif
 }
 
@@ -343,7 +343,7 @@ void WebMediaPlayerClientImpl::cancelLoad()
 WebLayer* WebMediaPlayerClientImpl::platformLayer() const
 {
     ASSERT(m_supportsAcceleratedCompositing);
-    return const_cast<WebVideoLayer*>(&m_videoLayer);
+    return m_videoLayer ? m_videoLayer->layer() : 0;
 }
 #endif
 
@@ -745,7 +745,7 @@ bool WebMediaPlayerClientImpl::supportsAcceleratedRendering() const
 
 bool WebMediaPlayerClientImpl::acceleratedRenderingInUse()
 {
-    return !m_videoLayer.isNull() && m_videoLayer.active();
+    return m_videoLayer && m_videoLayer->active();
 }
 
 void WebMediaPlayerClientImpl::setVideoFrameProviderClient(WebVideoFrameProvider::Client* client)
diff --git a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index 373015eb7..329fd9ec0 100644
--- a/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/Source/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -205,7 +205,7 @@ private:
     WebCore::MediaPlayer::Preload m_preload;
     RefPtr<WebHelperPluginImpl> m_helperPlugin;
 #if USE(ACCELERATED_COMPOSITING)
-    WebVideoLayer m_videoLayer;
+    OwnPtr<WebVideoLayer> m_videoLayer;
     bool m_supportsAcceleratedCompositing;
     bool m_opaque;
     WebVideoFrameProvider::Client* m_videoFrameProviderClient;
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
index fe945c063..980f81a8a 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.cpp
@@ -225,7 +225,7 @@ void WebPagePopupImpl::layout()
     PageWidgetDelegate::layout(m_page.get());
 }
 
-void WebPagePopupImpl::paint(WebCanvas* canvas, const WebRect& rect)
+void WebPagePopupImpl::paint(WebCanvas* canvas, const WebRect& rect, PaintOptions)
 {
     PageWidgetDelegate::paint(m_page.get(), 0, canvas, rect, PageWidgetDelegate::Opaque);
 }
diff --git a/Source/WebKit/chromium/src/WebPagePopupImpl.h b/Source/WebKit/chromium/src/WebPagePopupImpl.h
index 76936a4cd..e6844bfd0 100644
--- a/Source/WebKit/chromium/src/WebPagePopupImpl.h
+++ b/Source/WebKit/chromium/src/WebPagePopupImpl.h
@@ -72,7 +72,7 @@ private:
     virtual void setCompositorSurfaceReady() OVERRIDE;
     virtual void composite(bool) OVERRIDE;
     virtual void layout() OVERRIDE;
-    virtual void paint(WebCanvas*, const WebRect&) OVERRIDE;
+    virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable) OVERRIDE;
     virtual void resize(const WebSize&) OVERRIDE;
     virtual void close() OVERRIDE;
     virtual bool handleInputEvent(const WebInputEvent&) OVERRIDE;
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index a35a0407f..75a97e0f6 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -366,11 +366,11 @@ void WebPluginContainerImpl::setBackingTextureId(unsigned textureId)
     if (m_textureId == textureId)
         return;
 
-    ASSERT(m_ioSurfaceLayer.isNull());
+    ASSERT(!m_ioSurfaceLayer);
 
-    if (m_textureLayer.isNull())
-        m_textureLayer = WebExternalTextureLayer::create();
-    m_textureLayer.setTextureId(textureId);
+    if (!m_textureLayer)
+        m_textureLayer = adoptPtr(WebExternalTextureLayer::create());
+    m_textureLayer->setTextureId(textureId);
 
     // If anyone of the IDs is zero we need to switch between hardware
     // and software compositing. This is done by triggering a style recalc
@@ -390,11 +390,11 @@ void WebPluginContainerImpl::setBackingIOSurfaceId(int width,
     if (ioSurfaceId == m_ioSurfaceId)
         return;
 
-    ASSERT(m_textureLayer.isNull());
+    ASSERT(!m_textureLayer);
 
-    if (m_ioSurfaceLayer.isNull())
-        m_ioSurfaceLayer = WebIOSurfaceLayer::create();
-    m_ioSurfaceLayer.setIOSurfaceProperties(ioSurfaceId, WebSize(width, height));
+    if (!m_ioSurfaceLayer)
+        m_ioSurfaceLayer = adoptPtr(WebIOSurfaceLayer::create());
+    m_ioSurfaceLayer->setIOSurfaceProperties(ioSurfaceId, WebSize(width, height));
 
     // If anyone of the IDs is zero we need to switch between hardware
     // and software compositing. This is done by triggering a style recalc
@@ -409,11 +409,11 @@ void WebPluginContainerImpl::setBackingIOSurfaceId(int width,
 void WebPluginContainerImpl::commitBackingTexture()
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (!m_textureLayer.isNull())
-        m_textureLayer.invalidate();
+    if (m_textureLayer)
+        m_textureLayer->layer()->invalidate();
 
-    if (!m_ioSurfaceLayer.isNull())
-        m_ioSurfaceLayer.invalidate();
+    if (m_ioSurfaceLayer)
+        m_ioSurfaceLayer->layer()->invalidate();
 #endif
 }
 
@@ -480,11 +480,11 @@ void WebPluginContainerImpl::zoomLevelChanged(double zoomLevel)
 void WebPluginContainerImpl::setOpaque(bool opaque)
 {
 #if USE(ACCELERATED_COMPOSITING)
-    if (!m_textureLayer.isNull())
-        m_textureLayer.setOpaque(opaque);
+    if (m_textureLayer)
+        m_textureLayer->layer()->setOpaque(opaque);
 
-    if (!m_ioSurfaceLayer.isNull())
-        m_ioSurfaceLayer.setOpaque(opaque);
+    if (m_ioSurfaceLayer)
+        m_ioSurfaceLayer->layer()->setOpaque(opaque);
 #endif
 }
 
@@ -575,9 +575,9 @@ void WebPluginContainerImpl::willDestroyPluginLoadObserver(WebPluginLoadObserver
 WebLayer* WebPluginContainerImpl::platformLayer() const
 {
     if (m_textureId)
-        return const_cast<WebExternalTextureLayer*>(&m_textureLayer);
+        return m_textureLayer->layer();
     if (m_ioSurfaceId)
-        return const_cast<WebIOSurfaceLayer*>(&m_ioSurfaceLayer);
+        return m_ioSurfaceLayer->layer();
     return 0;
 }
 #endif
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index 074a0ccdc..998be6e41 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -186,10 +186,10 @@ private:
     // A composited plugin will either have no composited layer, a texture layer, or an IOSurface layer.
     // It will never have both a texture and IOSurface output.
     unsigned m_textureId;
-    WebExternalTextureLayer m_textureLayer;
+    OwnPtr<WebExternalTextureLayer> m_textureLayer;
 
     unsigned m_ioSurfaceId;
-    WebIOSurfaceLayer m_ioSurfaceLayer;
+    OwnPtr<WebIOSurfaceLayer> m_ioSurfaceLayer;
 #endif
 
     // The associated scrollbar group object, created lazily. Used for Pepper
diff --git a/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp b/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp
index ec89930fb..194dee550 100644
--- a/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPopupMenuImpl.cpp
@@ -193,7 +193,7 @@ void WebPopupMenuImpl::layout()
 {
 }
 
-void WebPopupMenuImpl::paint(WebCanvas* canvas, const WebRect& rect)
+void WebPopupMenuImpl::paint(WebCanvas* canvas, const WebRect& rect, PaintOptions)
 {
     if (!m_widget)
         return;
diff --git a/Source/WebKit/chromium/src/WebPopupMenuImpl.h b/Source/WebKit/chromium/src/WebPopupMenuImpl.h
index c22a0bbec..7f13e4385 100644
--- a/Source/WebKit/chromium/src/WebPopupMenuImpl.h
+++ b/Source/WebKit/chromium/src/WebPopupMenuImpl.h
@@ -73,7 +73,7 @@ public:
     virtual void willEndLiveResize() OVERRIDE;
     virtual void animate(double frameBeginTime) OVERRIDE;
     virtual void layout() OVERRIDE;
-    virtual void paint(WebCanvas*, const WebRect&) OVERRIDE;
+    virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable) OVERRIDE;
     virtual void themeChanged() OVERRIDE;
     virtual void setCompositorSurfaceReady() OVERRIDE;
     virtual void composite(bool finish) OVERRIDE;
diff --git a/Source/WebKit/chromium/src/WebScrollableLayer.cpp b/Source/WebKit/chromium/src/WebScrollableLayer.cpp
deleted file mode 100644
index a20e81d81..000000000
--- a/Source/WebKit/chromium/src/WebScrollableLayer.cpp
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include <public/WebScrollableLayer.h>
-
-#include "LayerChromium.h"
-#include "Region.h"
-
-namespace WebKit {
-
-void WebScrollableLayer::setScrollPosition(WebPoint position)
-{
-    m_private->setScrollPosition(position);
-}
-
-void WebScrollableLayer::setScrollable(bool scrollable)
-{
-    m_private->setScrollable(scrollable);
-}
-
-void WebScrollableLayer::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
-{
-    m_private->setHaveWheelEventHandlers(haveWheelEventHandlers);
-}
-
-void WebScrollableLayer::setShouldScrollOnMainThread(bool shouldScrollOnMainThread)
-{
-    m_private->setShouldScrollOnMainThread(shouldScrollOnMainThread);
-}
-
-void WebScrollableLayer::setNonFastScrollableRegion(const WebVector<WebRect>& rects)
-{
-    WebCore::Region region;
-    for (size_t i = 0; i < rects.size(); ++i) {
-        WebCore::IntRect rect = rects[i];
-        region.unite(rect);
-    }
-    m_private->setNonFastScrollableRegion(region);
-
-}
-
-void WebScrollableLayer::setIsContainerForFixedPositionLayers(bool enable)
-{
-    m_private->setIsContainerForFixedPositionLayers(enable);
-}
-
-void WebScrollableLayer::setFixedToContainerLayer(bool enable)
-{
-    m_private->setFixedToContainerLayer(enable);
-}
-
-} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarLayer.cpp b/Source/WebKit/chromium/src/WebScrollbarLayerImpl.cpp
index 2bd1b20fb..ec6e9895d 100644
--- a/Source/WebKit/chromium/src/WebScrollbarLayer.cpp
+++ b/Source/WebKit/chromium/src/WebScrollbarLayerImpl.cpp
@@ -24,39 +24,42 @@
  */
 
 #include "config.h"
-#include <public/WebScrollbarLayer.h>
+#include "WebScrollbarLayerImpl.h"
 
 #include "ScrollbarLayerChromium.h"
+#include "WebLayerImpl.h"
 
-using namespace WebCore;
+using WebCore::Scrollbar;
+using WebCore::ScrollbarLayerChromium;
 
 namespace WebKit {
 
-void WebScrollbarLayer::setScrollLayer(const WebLayer layer)
+WebScrollbarLayer* WebScrollbarLayer::create(WebCore::Scrollbar* scrollbar, WebScrollbarThemePainter painter, PassOwnPtr<WebScrollbarThemeGeometry> geometry)
 {
-    int id = layer.isNull() ? 0 : layer.constUnwrap<LayerChromium>()->id();
-    unwrap<ScrollbarLayerChromium>()->setScrollLayerId(id);
+    return new WebScrollbarLayerImpl(ScrollbarLayerChromium::create(WebScrollbar::create(scrollbar), painter, geometry, 0));
 }
 
-WebScrollbarLayer WebScrollbarLayer::create(WebCore::Scrollbar* scrollbar, WebScrollbarThemePainter painter, PassOwnPtr<WebScrollbarThemeGeometry> geometry)
+
+WebScrollbarLayerImpl::WebScrollbarLayerImpl(PassRefPtr<WebCore::ScrollbarLayerChromium> layer)
+    : m_layer(adoptPtr(new WebLayerImpl(layer)))
 {
-    return WebScrollbarLayer(ScrollbarLayerChromium::create(WebScrollbar::create(scrollbar), painter, geometry, 0));
 }
 
-WebScrollbarLayer::WebScrollbarLayer(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>& layer)
-    : WebLayer(layer)
+WebScrollbarLayerImpl::~WebScrollbarLayerImpl()
 {
 }
 
-WebScrollbarLayer& WebScrollbarLayer::operator=(const WTF::PassRefPtr<WebCore::ScrollbarLayerChromium>& layer)
+WebLayer* WebScrollbarLayerImpl::layer()
 {
-    m_private = layer;
-    return *this;
+    return m_layer.get();
 }
 
-WebScrollbarLayer::operator PassRefPtr<ScrollbarLayerChromium>() const
+void WebScrollbarLayerImpl::setScrollLayer(WebLayer* layer)
 {
-    return unwrap<ScrollbarLayerChromium>();
+    int id = layer ? static_cast<WebLayerImpl*>(layer)->layer()->id() : 0;
+    static_cast<ScrollbarLayerChromium*>(m_layer->layer())->setScrollLayerId(id);
 }
 
+
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScrollbarLayerImpl.h b/Source/WebKit/chromium/src/WebScrollbarLayerImpl.h
new file mode 100644
index 000000000..720f79c55
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebScrollbarLayerImpl.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScrollbarLayerImpl_h
+#define WebScrollbarLayerImpl_h
+
+#include <public/WebScrollbarLayer.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+class ScrollbarLayerChromium;
+}
+
+namespace WebKit {
+class WebLayerImpl;
+
+class WebScrollbarLayerImpl : public WebScrollbarLayer {
+public:
+    explicit WebScrollbarLayerImpl(PassRefPtr<WebCore::ScrollbarLayerChromium>);
+    virtual ~WebScrollbarLayerImpl();
+
+    // WebScrollbarLayer implementation.
+    virtual WebLayer* layer() OVERRIDE;
+    virtual void setScrollLayer(WebLayer*) OVERRIDE;
+
+private:
+    OwnPtr<WebLayerImpl> m_layer;
+};
+
+}
+
+#endif // WebScrollbarLayerImpl_h
diff --git a/Source/WebKit/chromium/src/WebSolidColorLayerImpl.cpp b/Source/WebKit/chromium/src/WebSolidColorLayerImpl.cpp
index 33b1a30e3..94404262c 100644
--- a/Source/WebKit/chromium/src/WebSolidColorLayerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSolidColorLayerImpl.cpp
@@ -26,24 +26,37 @@
 #include "config.h"
 #include "WebSolidColorLayerImpl.h"
 
-using namespace WebCore;
+#include "SolidColorLayerChromium.h"
+#include "WebLayerImpl.h"
+
+using WebCore::SolidColorLayerChromium;
 
 namespace WebKit {
 
-PassRefPtr<WebSolidColorLayerImpl> WebSolidColorLayerImpl::create()
+WebSolidColorLayer* WebSolidColorLayer::create()
 {
-    return adoptRef(new WebSolidColorLayerImpl());
+    return new WebSolidColorLayerImpl(SolidColorLayerChromium::create());
 }
 
-WebSolidColorLayerImpl::WebSolidColorLayerImpl()
-    : SolidColorLayerChromium()
+WebSolidColorLayerImpl::WebSolidColorLayerImpl(PassRefPtr<SolidColorLayerChromium> layer)
+    : m_layer(adoptPtr(new WebLayerImpl(layer)))
 {
-    setIsDrawable(true);
+    m_layer->layer()->setIsDrawable(true);
 }
 
 WebSolidColorLayerImpl::~WebSolidColorLayerImpl()
 {
 }
 
+WebLayer* WebSolidColorLayerImpl::layer()
+{
+    return m_layer.get();
+}
+
+void WebSolidColorLayerImpl::setBackgroundColor(WebColor color)
+{
+    m_layer->setBackgroundColor(color);
+}
+
 } // namespace WebKit
 
diff --git a/Source/WebKit/chromium/src/WebSolidColorLayerImpl.h b/Source/WebKit/chromium/src/WebSolidColorLayerImpl.h
index d2673b42b..7742ba492 100644
--- a/Source/WebKit/chromium/src/WebSolidColorLayerImpl.h
+++ b/Source/WebKit/chromium/src/WebSolidColorLayerImpl.h
@@ -26,18 +26,28 @@
 #ifndef WebSolidColorLayerImpl_h
 #define WebSolidColorLayerImpl_h
 
-#include "SolidColorLayerChromium.h"
+#include <public/WebSolidColorLayer.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
+namespace WebCore {
+class SolidColorLayerChromium;
+}
+
 namespace WebKit {
+class WebLayerImpl;
 
-class WebSolidColorLayerImpl : public WebCore::SolidColorLayerChromium {
+class WebSolidColorLayerImpl : public WebSolidColorLayer {
 public:
-    static PassRefPtr<WebSolidColorLayerImpl> create();
-
-protected:
-    WebSolidColorLayerImpl();
+    explicit WebSolidColorLayerImpl(PassRefPtr<WebCore::SolidColorLayerChromium>);
     virtual ~WebSolidColorLayerImpl();
+
+    // WebSolidColorLayer implementation.
+    virtual WebLayer* layer() OVERRIDE;
+    virtual void setBackgroundColor(WebColor) OVERRIDE;
+
+private:
+    OwnPtr<WebLayerImpl> m_layer;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebVideoLayerImpl.cpp b/Source/WebKit/chromium/src/WebVideoLayerImpl.cpp
new file mode 100644
index 000000000..5bfed6742
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebVideoLayerImpl.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebVideoLayerImpl.h"
+
+#include "VideoLayerChromium.h"
+#include "WebLayerImpl.h"
+
+namespace WebKit {
+
+WebVideoLayer* WebVideoLayer::create(WebVideoFrameProvider* provider)
+{
+    return new WebVideoLayerImpl(WebCore::VideoLayerChromium::create(provider));
+}
+
+WebVideoLayerImpl::WebVideoLayerImpl(PassRefPtr<WebCore::VideoLayerChromium> layer)
+    : m_layer(adoptPtr(new WebLayerImpl(layer)))
+{
+}
+
+WebVideoLayerImpl::~WebVideoLayerImpl()
+{
+}
+
+WebLayer* WebVideoLayerImpl::layer()
+{
+    return m_layer.get();
+}
+
+bool WebVideoLayerImpl::active() const
+{
+    return m_layer->layer()->layerTreeHost();
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebVideoLayer.cpp b/Source/WebKit/chromium/src/WebVideoLayerImpl.h
index 0f342155d..287e4b5e2 100644
--- a/Source/WebKit/chromium/src/WebVideoLayer.cpp
+++ b/Source/WebKit/chromium/src/WebVideoLayerImpl.h
@@ -23,25 +23,32 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "VideoLayerChromium.h"
+#ifndef WebVideoLayerImpl_h
+#define WebVideoLayerImpl_h
+
 #include <public/WebVideoLayer.h>
 
+namespace WebCore {
+class VideoLayerChromium;
+}
+
 namespace WebKit {
+class WebLayerImpl;
 
-WebVideoLayer WebVideoLayer::create(WebVideoFrameProvider* provider)
-{
-    return WebVideoLayer(WebCore::VideoLayerChromium::create(provider));
-}
+class WebVideoLayerImpl : public WebVideoLayer {
+public:
+    explicit WebVideoLayerImpl(PassRefPtr<WebCore::VideoLayerChromium>);
+    virtual ~WebVideoLayerImpl();
 
-WebVideoLayer::WebVideoLayer(PassRefPtr<WebCore::VideoLayerChromium> layer)
-    : WebLayer(layer)
-{
-}
+    // WebVideoLayer implementation.
+    virtual WebLayer* layer() OVERRIDE;
+    virtual bool active() const OVERRIDE;
+
+private:
+    OwnPtr<WebLayerImpl> m_layer;
+};
 
-bool WebVideoLayer::active() const
-{
-    return m_private->layerTreeHost();
 }
 
-} // namespace WebKit
+#endif // WebVideoLayerImpl_h
+
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index b18e20944..c6f9f7e09 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -83,6 +83,7 @@
 #include "KeyboardCodes.h"
 #include "KeyboardEvent.h"
 #include "LayerPainterChromium.h"
+#include "LinkHighlight.h"
 #include "MIMETypeRegistry.h"
 #include "NodeRenderStyle.h"
 #include "NonCompositedContentHost.h"
@@ -408,6 +409,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client)
     , m_isCancelingFullScreen(false)
     , m_benchmarkSupport(this)
 #if USE(ACCELERATED_COMPOSITING)
+    , m_rootLayer(0)
     , m_rootGraphicsLayer(0)
     , m_isAcceleratedCompositingActive(false)
     , m_compositorCreationFailed(false)
@@ -728,10 +730,17 @@ bool WebViewImpl::handleGestureEvent(const WebGestureEvent& event)
         m_contextMenuAllowed = false;
         return handled;
     }
+    case WebInputEvent::GestureTapDown: {
+        // Queue a highlight animation, then hand off to regular handler.
+#if OS(LINUX)
+        enableTouchHighlight(IntPoint(event.x, event.y));
+#endif
+        PlatformGestureEventBuilder platformEvent(mainFrameImpl()->frameView(), event);
+        return mainFrameImpl()->frame()->eventHandler()->handleGestureEvent(platformEvent);
+    }
     case WebInputEvent::GestureScrollBegin:
     case WebInputEvent::GestureScrollEnd:
     case WebInputEvent::GestureScrollUpdate:
-    case WebInputEvent::GestureTapDown:
     case WebInputEvent::GestureDoubleTap:
     case WebInputEvent::GesturePinchBegin:
     case WebInputEvent::GesturePinchEnd:
@@ -1116,6 +1125,53 @@ void WebViewImpl::computeScaleAndScrollForHitRect(const WebRect& hitRect, AutoZo
     scroll.x = rect.x;
     scroll.y = rect.y;
 }
+
+static bool highlightConditions(Node* node)
+{
+    return node->isLink()
+           || node->supportsFocus()
+           || node->hasEventListeners(eventNames().clickEvent)
+           || node->hasEventListeners(eventNames().mousedownEvent)
+           || node->hasEventListeners(eventNames().mouseupEvent);
+}
+
+Node* WebViewImpl::bestTouchLinkNode(IntPoint touchEventLocation)
+{
+    if (!m_page || !m_page->mainFrame())
+        return 0;
+
+    Node* bestTouchNode = 0;
+
+    // FIXME: Should accept a search region from the caller instead of hard-coding the size.
+    IntSize touchEventSearchRegionSize(4, 2);
+    m_page->mainFrame()->eventHandler()->bestClickableNodeForTouchPoint(touchEventLocation, touchEventSearchRegionSize, touchEventLocation, bestTouchNode);
+    // bestClickableNodeForTouchPoint() doesn't always return a node that is a link, so let's try and find
+    // a link to highlight.
+    while (bestTouchNode && !highlightConditions(bestTouchNode))
+        bestTouchNode = bestTouchNode->parentNode();
+
+    return bestTouchNode;
+}
+
+void WebViewImpl::enableTouchHighlight(IntPoint touchEventLocation)
+{
+    Node* touchNode = bestTouchLinkNode(touchEventLocation);
+
+    if (!touchNode || !touchNode->renderer() || !touchNode->renderer()->enclosingLayer())
+        return;
+
+    Color highlightColor = touchNode->renderer()->style()->tapHighlightColor();
+    // Safari documentation for -webkit-tap-highlight-color says if the specified color has 0 alpha,
+    // then tap highlighting is disabled.
+    // http://developer.apple.com/library/safari/#documentation/appleapplications/reference/safaricssref/articles/standardcssproperties.html
+    if (!highlightColor.alpha())
+        return;
+
+    // This will clear any highlight currently being displayed.
+    m_linkHighlight = LinkHighlight::create(touchNode, this);
+    m_linkHighlight->startHighlightAnimation();
+}
+
 #endif
 
 void WebViewImpl::animateZoomAroundPoint(const IntPoint& point, AutoZoomType zoomType)
@@ -1653,6 +1709,9 @@ void WebViewImpl::layout()
 {
     TRACE_EVENT0("webkit", "WebViewImpl::layout");
     PageWidgetDelegate::layout(m_page.get());
+
+    if (m_linkHighlight)
+        m_linkHighlight->updateGeometry();
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1685,9 +1744,15 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
 }
 #endif
 
-void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
+void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect, PaintOptions option)
 {
-    if (isAcceleratedCompositingActive()) {
+#if !OS(ANDROID)
+    // ReadbackFromCompositorIfAvailable is the only option available on non-Android.
+    // Ideally, Android would always use ReadbackFromCompositorIfAvailable as well.
+    ASSERT(option == ReadbackFromCompositorIfAvailable);
+#endif
+
+    if (option == ReadbackFromCompositorIfAvailable && isAcceleratedCompositingActive()) {
 #if USE(ACCELERATED_COMPOSITING)
         // If a canvas was passed in, we use it to grab a copy of the
         // freshly-rendered pixels.
@@ -1699,12 +1764,24 @@ void WebViewImpl::paint(WebCanvas* canvas, const WebRect& rect)
         }
 #endif
     } else {
+        FrameView* view = page()->mainFrame()->view();
+        PaintBehavior oldPaintBehavior = view->paintBehavior();
+        if (isAcceleratedCompositingActive()) {
+            ASSERT(option == ForceSoftwareRenderingAndIgnoreGPUResidentContent);            
+            view->setPaintBehavior(oldPaintBehavior | PaintBehaviorFlattenCompositingLayers);
+        }
+
         double paintStart = currentTime();
         PageWidgetDelegate::paint(m_page.get(), pageOverlays(), canvas, rect, isTransparent() ? PageWidgetDelegate::Translucent : PageWidgetDelegate::Opaque);
         double paintEnd = currentTime();
         double pixelsPerSec = (rect.width * rect.height) / (paintEnd - paintStart);
         WebKit::Platform::current()->histogramCustomCounts("Renderer4.SoftwarePaintDurationMS", (paintEnd - paintStart) * 1000, 0, 120, 30);
         WebKit::Platform::current()->histogramCustomCounts("Renderer4.SoftwarePaintMegapixPerSecond", pixelsPerSec / 1000000, 10, 210, 30);
+
+        if (isAcceleratedCompositingActive()) {
+            ASSERT(option == ForceSoftwareRenderingAndIgnoreGPUResidentContent);            
+            view->setPaintBehavior(oldPaintBehavior);
+        }
     }
 }
 
@@ -3564,6 +3641,7 @@ bool WebViewImpl::allowsAcceleratedCompositing()
 void WebViewImpl::setRootGraphicsLayer(GraphicsLayer* layer)
 {
     m_rootGraphicsLayer = layer;
+    m_rootLayer = layer ? layer->platformLayer() : 0;
 
     setIsAcceleratedCompositingActive(layer);
     if (m_nonCompositedContentHost) {
@@ -3577,11 +3655,8 @@ void WebViewImpl::setRootGraphicsLayer(GraphicsLayer* layer)
         m_nonCompositedContentHost->setScrollLayer(scrollLayer);
     }
 
-    if (layer)
-        m_rootLayer = *layer->platformLayer();
-
     if (!m_layerTreeView.isNull())
-        m_layerTreeView.setRootLayer(layer ? &m_rootLayer : 0);
+        m_layerTreeView.setRootLayer(m_rootLayer);
 
     IntRect damagedRect(0, 0, m_size.width, m_size.height);
     if (!m_isAcceleratedCompositingActive)
@@ -3694,7 +3769,7 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         m_nonCompositedContentHost->setShowDebugBorders(page()->settings()->showDebugBorders());
         m_nonCompositedContentHost->setOpaque(!isTransparent());
 
-        m_layerTreeView.initialize(this, m_rootLayer, layerTreeViewSettings);
+        m_layerTreeView.initialize(this, *m_rootLayer, layerTreeViewSettings);
         if (!m_layerTreeView.isNull()) {
             if (m_webSettings->applyDefaultDeviceScaleFactorInCompositor() && page()->deviceScaleFactor() != 1) {
                 ASSERT(page()->deviceScaleFactor());
diff --git a/Source/WebKit/chromium/src/WebViewImpl.h b/Source/WebKit/chromium/src/WebViewImpl.h
index b8dcad717..206cf4572 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.h
+++ b/Source/WebKit/chromium/src/WebViewImpl.h
@@ -94,6 +94,7 @@ class ContextMenuClientImpl;
 class DeviceOrientationClientProxy;
 class DragScrollTimer;
 class GeolocationClientProxy;
+class LinkHighlight;
 class WebHelperPluginImpl;
 class NonCompositedContentHost;
 class PrerendererClientImpl;
@@ -143,7 +144,7 @@ public:
     virtual void setCompositorSurfaceReady();
     virtual void animate(double);
     virtual void layout(); // Also implements WebLayerTreeViewClient::layout()
-    virtual void paint(WebCanvas*, const WebRect&);
+    virtual void paint(WebCanvas*, const WebRect&, PaintOptions = ReadbackFromCompositorIfAvailable);
     virtual void themeChanged();
     virtual void composite(bool finish);
     virtual void setNeedsRedraw();
@@ -563,6 +564,8 @@ public:
 
 #if ENABLE(GESTURE_EVENTS)
     void computeScaleAndScrollForHitRect(const WebRect& hitRect, AutoZoomType, float& scale, WebPoint& scroll);
+    WebCore::Node* bestTouchLinkNode(WebCore::IntPoint touchEventLocation);
+    void enableTouchHighlight(WebCore::IntPoint touchEventLocation);
 #endif
     void animateZoomAroundPoint(const WebCore::IntPoint&, AutoZoomType);
 
@@ -586,6 +589,12 @@ public:
     virtual bool isPointerLocked();
 #endif
 
+#if ENABLE(GESTURE_EVENTS)
+    // Exposed for tests.
+    LinkHighlight* linkHighlight() { return m_linkHighlight.get(); }
+#endif
+
+
 private:
     bool computePageScaleFactorLimits();
     float clampPageScaleFactorToLimits(float scale);
@@ -816,7 +825,7 @@ private:
     WebCore::IntRect m_rootLayerScrollDamage;
     OwnPtr<NonCompositedContentHost> m_nonCompositedContentHost;
     WebLayerTreeView m_layerTreeView;
-    WebLayer m_rootLayer;
+    WebLayer* m_rootLayer;
     WebCore::GraphicsLayer* m_rootGraphicsLayer;
     bool m_isAcceleratedCompositingActive;
     bool m_compositorCreationFailed;
@@ -852,6 +861,9 @@ private:
     WebPoint m_lastWheelPosition;
     WebPoint m_lastWheelGlobalPosition;
     int m_flingModifier;
+#if ENABLE(GESTURE_EVENTS)
+    OwnPtr<LinkHighlight> m_linkHighlight;
+#endif
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index c6fd50589..ccf90ca40 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -93,8 +93,9 @@ void WebWorkerClientImpl::startWorkerContext(const KURL& scriptURL, const String
     if (document->page())
         settings = document->page()->group().groupSettings();
     RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, settings, sourceCode, *this, *this, startMode,
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeader(),
-                                                                         m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeaderType());
+                                                                         document->contentSecurityPolicy()->deprecatedHeader(),
+                                                                         document->contentSecurityPolicy()->deprecatedHeaderType(),
+                                                                         document->topDocument()->securityOrigin());
     m_proxy->workerThreadCreated(thread);
     thread->start();
     InspectorInstrumentation::didStartWorkerContext(m_scriptExecutionContext.get(), m_proxy, scriptURL);
diff --git a/Source/WebKit/chromium/src/mac/WebSubstringUtil.mm b/Source/WebKit/chromium/src/mac/WebSubstringUtil.mm
index 7fd19f536..dd9951f83 100644
--- a/Source/WebKit/chromium/src/mac/WebSubstringUtil.mm
+++ b/Source/WebKit/chromium/src/mac/WebSubstringUtil.mm
@@ -36,6 +36,7 @@
 #include "ColorMac.h"
 #include "Document.h"
 #include "Element.h"
+#include "Font.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLElement.h"
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index ac04b505e..0b5aa6be6 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -46,6 +46,27 @@ using namespace WebCore;
 using namespace WebKitTests;
 using WebKit::WebTransformationMatrix;
 
+void WebKitTests::ExpectTransformationMatrixEq(WebTransformationMatrix expected,
+                                               WebTransformationMatrix actual)
+{
+    EXPECT_FLOAT_EQ((expected).m11(), (actual).m11());
+    EXPECT_FLOAT_EQ((expected).m12(), (actual).m12());
+    EXPECT_FLOAT_EQ((expected).m13(), (actual).m13());
+    EXPECT_FLOAT_EQ((expected).m14(), (actual).m14());
+    EXPECT_FLOAT_EQ((expected).m21(), (actual).m21());
+    EXPECT_FLOAT_EQ((expected).m22(), (actual).m22());
+    EXPECT_FLOAT_EQ((expected).m23(), (actual).m23());
+    EXPECT_FLOAT_EQ((expected).m24(), (actual).m24());
+    EXPECT_FLOAT_EQ((expected).m31(), (actual).m31());
+    EXPECT_FLOAT_EQ((expected).m32(), (actual).m32());
+    EXPECT_FLOAT_EQ((expected).m33(), (actual).m33());
+    EXPECT_FLOAT_EQ((expected).m34(), (actual).m34());
+    EXPECT_FLOAT_EQ((expected).m41(), (actual).m41());
+    EXPECT_FLOAT_EQ((expected).m42(), (actual).m42());
+    EXPECT_FLOAT_EQ((expected).m43(), (actual).m43());
+    EXPECT_FLOAT_EQ((expected).m44(), (actual).m44());
+}
+
 namespace {
 
 template<typename LayerType>
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeTestCommon.h b/Source/WebKit/chromium/tests/CCLayerTreeTestCommon.h
index 5c01c8049..7f7e20279 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCLayerTreeTestCommon.h
@@ -25,6 +25,8 @@
 #ifndef CCLayerTreeTestCommon_h
 #define CCLayerTreeTestCommon_h
 
+#include <public/WebTransformationMatrix.h>
+
 namespace WebKitTests {
 
 // These are macros instead of functions so that we get useful line numbers where a test failed.
@@ -40,26 +42,18 @@ namespace WebKitTests {
     EXPECT_EQ((expected).size().width(), (actual).size().width());      \
     EXPECT_EQ((expected).size().height(), (actual).size().height())
 
-// This is a macro instead of a function so that we get useful line numbers where a test failed.
-// Even though WebTransformationMatrix values are double precision, there are many other floating-point values used that affect
-// the transforms, and so we only expect them to be accurate up to floating-point precision.
-#define EXPECT_TRANSFORMATION_MATRIX_EQ(expected, actual)       \
-    EXPECT_FLOAT_EQ((expected).m11(), (actual).m11());          \
-    EXPECT_FLOAT_EQ((expected).m12(), (actual).m12());          \
-    EXPECT_FLOAT_EQ((expected).m13(), (actual).m13());          \
-    EXPECT_FLOAT_EQ((expected).m14(), (actual).m14());          \
-    EXPECT_FLOAT_EQ((expected).m21(), (actual).m21());          \
-    EXPECT_FLOAT_EQ((expected).m22(), (actual).m22());          \
-    EXPECT_FLOAT_EQ((expected).m23(), (actual).m23());          \
-    EXPECT_FLOAT_EQ((expected).m24(), (actual).m24());          \
-    EXPECT_FLOAT_EQ((expected).m31(), (actual).m31());          \
-    EXPECT_FLOAT_EQ((expected).m32(), (actual).m32());          \
-    EXPECT_FLOAT_EQ((expected).m33(), (actual).m33());          \
-    EXPECT_FLOAT_EQ((expected).m34(), (actual).m34());          \
-    EXPECT_FLOAT_EQ((expected).m41(), (actual).m41());          \
-    EXPECT_FLOAT_EQ((expected).m42(), (actual).m42());          \
-    EXPECT_FLOAT_EQ((expected).m43(), (actual).m43());          \
-    EXPECT_FLOAT_EQ((expected).m44(), (actual).m44())
+// This is a function rather than a macro because when this is included as a macro
+// in bulk, it causes a significant slow-down in compilation time. This problem
+// exists with both gcc and clang, and bugs have been filed at
+// http://llvm.org/bugs/show_bug.cgi?id=13651 and http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54337
+void ExpectTransformationMatrixEq(WebKit::WebTransformationMatrix expected,
+                                  WebKit::WebTransformationMatrix actual);
+
+#define EXPECT_TRANSFORMATION_MATRIX_EQ(expected, actual)            \
+    {                                                                \
+        SCOPED_TRACE("");                                            \
+        WebKitTests::ExpectTransformationMatrixEq(expected, actual); \
+    }
 
 } // namespace
 
diff --git a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
index 9e8599c0f..e55c3c5d7 100644
--- a/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
+++ b/Source/WebKit/chromium/tests/CCResourceProviderTest.cpp
@@ -287,23 +287,36 @@ private:
     PendingProduceTextureList m_pendingProduceTextures;
 };
 
-class CCResourceProviderTest : public testing::Test {
+class CCResourceProviderTest : public testing::TestWithParam<CCResourceProvider::ResourceType> {
 public:
     CCResourceProviderTest()
         : m_sharedData(ContextSharedData::create())
         , m_context(FakeWebCompositorOutputSurface::create(ResourceProviderContext::create(m_sharedData.get())))
         , m_resourceProvider(CCResourceProvider::create(m_context.get()))
     {
+        m_resourceProvider->setDefaultResourceType(GetParam());
     }
 
     ResourceProviderContext* context() { return static_cast<ResourceProviderContext*>(m_context->context3D()); }
 
     void getResourcePixels(CCResourceProvider::ResourceId id, const IntSize& size, WGC3Denum format, uint8_t* pixels)
     {
-        CCScopedLockResourceForRead lock(m_resourceProvider.get(), id);
-        ASSERT_NE(0U, lock.textureId());
-        context()->bindTexture(GraphicsContext3D::TEXTURE_2D, lock.textureId());
-        context()->getPixels(size, format, pixels);
+        if (GetParam() == CCResourceProvider::GLTexture) {
+            CCResourceProvider::ScopedReadLockGL lockGL(m_resourceProvider.get(), id);
+            ASSERT_NE(0U, lockGL.textureId());
+            context()->bindTexture(GraphicsContext3D::TEXTURE_2D, lockGL.textureId());
+            context()->getPixels(size, format, pixels);
+        } else if (GetParam() == CCResourceProvider::Bitmap) {
+            CCResourceProvider::ScopedReadLockSoftware lockSoftware(m_resourceProvider.get(), id);
+            memcpy(pixels, lockSoftware.skBitmap()->getPixels(), lockSoftware.skBitmap()->getSize());
+        }
+    }
+
+    void expectNumResources(int count)
+    {
+        EXPECT_EQ(count, static_cast<int>(m_resourceProvider->numResources()));
+        if (GetParam() == CCResourceProvider::GLTexture)
+            EXPECT_EQ(count, context()->textureCount());
     }
 
 protected:
@@ -313,7 +326,7 @@ protected:
     OwnPtr<CCResourceProvider> m_resourceProvider;
 };
 
-TEST_F(CCResourceProviderTest, Basic)
+TEST_P(CCResourceProviderTest, Basic)
 {
     IntSize size(1, 1);
     WGC3Denum format = GraphicsContext3D::RGBA;
@@ -322,7 +335,7 @@ TEST_F(CCResourceProviderTest, Basic)
     ASSERT_EQ(4U, pixelSize);
 
     CCResourceProvider::ResourceId id = m_resourceProvider->createResource(pool, size, format, CCResourceProvider::TextureUsageAny);
-    EXPECT_EQ(1, context()->textureCount());
+    expectNumResources(1);
 
     uint8_t data[4] = {1, 2, 3, 4};
     IntRect rect(IntPoint(), size);
@@ -333,10 +346,10 @@ TEST_F(CCResourceProviderTest, Basic)
     EXPECT_EQ(0, memcmp(data, result, pixelSize));
 
     m_resourceProvider->deleteResource(id);
-    EXPECT_EQ(0, context()->textureCount());
+    expectNumResources(0);
 }
 
-TEST_F(CCResourceProviderTest, DeleteOwnedResources)
+TEST_P(CCResourceProviderTest, DeleteOwnedResources)
 {
     IntSize size(1, 1);
     WGC3Denum format = GraphicsContext3D::RGBA;
@@ -345,16 +358,16 @@ TEST_F(CCResourceProviderTest, DeleteOwnedResources)
     const int count = 3;
     for (int i = 0; i < count; ++i)
         m_resourceProvider->createResource(pool, size, format, CCResourceProvider::TextureUsageAny);
-    EXPECT_EQ(3, context()->textureCount());
+    expectNumResources(3);
 
     m_resourceProvider->deleteOwnedResources(pool+1);
-    EXPECT_EQ(3, context()->textureCount());
+    expectNumResources(3);
 
     m_resourceProvider->deleteOwnedResources(pool);
-    EXPECT_EQ(0, context()->textureCount());
+    expectNumResources(0);
 }
 
-TEST_F(CCResourceProviderTest, Upload)
+TEST_P(CCResourceProviderTest, Upload)
 {
     IntSize size(2, 2);
     WGC3Denum format = GraphicsContext3D::RGBA;
@@ -402,12 +415,28 @@ TEST_F(CCResourceProviderTest, Upload)
         getResourcePixels(id, size, format, result);
         EXPECT_EQ(0, memcmp(expected, result, pixelSize));
     }
+    {
+        IntRect offsetImageRect(IntPoint(100, 100), size);
+        IntRect sourceRect(100, 100, 1, 1);
+        IntSize destOffset(1, 0);
+        m_resourceProvider->upload(id, image, offsetImageRect, sourceRect, destOffset);
+
+        uint8_t expected[16] = {0, 1, 2, 3,   0, 1, 2, 3,
+                                4, 5, 6, 7,   0, 1, 2, 3};
+        getResourcePixels(id, size, format, result);
+        EXPECT_EQ(0, memcmp(expected, result, pixelSize));
+    }
+
 
     m_resourceProvider->deleteResource(id);
 }
 
-TEST_F(CCResourceProviderTest, TransferResources)
+TEST_P(CCResourceProviderTest, TransferResources)
 {
+    // Resource transfer is only supported with GL textures for now.
+    if (GetParam() != CCResourceProvider::GLTexture)
+        return;
+
     OwnPtr<CCGraphicsContext> childContext(FakeWebCompositorOutputSurface::create(ResourceProviderContext::create(m_sharedData.get())));
     OwnPtr<CCResourceProvider> childResourceProvider(CCResourceProvider::create(childContext.get()));
 
@@ -486,14 +515,14 @@ TEST_F(CCResourceProviderTest, TransferResources)
 
     ResourceProviderContext* childContext3D = static_cast<ResourceProviderContext*>(childContext->context3D());
     {
-        CCScopedLockResourceForRead lock(childResourceProvider.get(), id1);
+        CCResourceProvider::ScopedReadLockGL lock(childResourceProvider.get(), id1);
         ASSERT_NE(0U, lock.textureId());
         childContext3D->bindTexture(GraphicsContext3D::TEXTURE_2D, lock.textureId());
         childContext3D->getPixels(size, format, result);
         EXPECT_EQ(0, memcmp(data1, result, pixelSize));
     }
     {
-        CCScopedLockResourceForRead lock(childResourceProvider.get(), id2);
+        CCResourceProvider::ScopedReadLockGL lock(childResourceProvider.get(), id2);
         ASSERT_NE(0U, lock.textureId());
         childContext3D->bindTexture(GraphicsContext3D::TEXTURE_2D, lock.textureId());
         childContext3D->getPixels(size, format, result);
@@ -519,4 +548,9 @@ TEST_F(CCResourceProviderTest, TransferResources)
     EXPECT_EQ(0u, m_resourceProvider->mailboxCount());
 }
 
+INSTANTIATE_TEST_CASE_P(CCResourceProviderTests,
+                        CCResourceProviderTest,
+                        ::testing::Values(CCResourceProvider::GLTexture,
+                                          CCResourceProvider::Bitmap));
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
index 58f37c694..dcaae59ce 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
@@ -115,11 +115,6 @@ void FakeTiledLayerChromium::setNeedsDisplayRect(const FloatRect& rect)
     TiledLayerChromium::setNeedsDisplayRect(rect);
 }
 
-void FakeTiledLayerChromium::update(CCTextureUpdateQueue& queue, const CCOcclusionTracker* occlusion, CCRenderingStats& stats)
-{
-    updateContentRect(queue, visibleContentRect(), occlusion, stats);
-}
-
 void FakeTiledLayerChromium::setTexturePriorities(const CCPriorityCalculator& calculator)
 {
     // Ensure there is always a target render surface available. If none has been
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
index 5de1c5fb3..3adb4bf17 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
@@ -112,7 +112,6 @@ public:
     static WebCore::IntSize tileSize() { return WebCore::IntSize(100, 100); }
 
     using WebCore::TiledLayerChromium::invalidateContentRect;
-    using WebCore::TiledLayerChromium::updateContentRect;
     using WebCore::TiledLayerChromium::needsIdlePaint;
     using WebCore::TiledLayerChromium::skipsDraw;
     using WebCore::TiledLayerChromium::numPaintedTiles;
@@ -121,9 +120,6 @@ public:
     virtual void setNeedsDisplayRect(const WebCore::FloatRect&) OVERRIDE;
     const WebCore::FloatRect& lastNeedsDisplayRect() const { return m_lastNeedsDisplayRect; }
 
-    // Updates the visibleContentRect().
-    virtual void update(WebCore::CCTextureUpdateQueue&, const WebCore::CCOcclusionTracker*, WebCore::CCRenderingStats&) OVERRIDE;
-
     virtual void setTexturePriorities(const WebCore::CCPriorityCalculator&) OVERRIDE;
 
     virtual WebCore::CCPrioritizedTextureManager* textureManager() const OVERRIDE { return m_textureManager; }
diff --git a/Source/WebKit/chromium/tests/IDBKeyPathTest.cpp b/Source/WebKit/chromium/tests/IDBKeyPathTest.cpp
index 7d662c009..c3d47d788 100644
--- a/Source/WebKit/chromium/tests/IDBKeyPathTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBKeyPathTest.cpp
@@ -26,6 +26,10 @@
 #include "config.h"
 #include "IDBKeyPath.h"
 
+#include "IDBBindingUtilities.h"
+#include "IDBKey.h"
+#include "SerializedScriptValue.h"
+
 #include <gtest/gtest.h>
 #include <wtf/Vector.h>
 
@@ -123,6 +127,92 @@ TEST(IDBKeyPathTest, InvalidKeyPath5)
     checkKeyPath(keyPath, expected, 3);
 }
 
+TEST(IDBKeyPathTest, Extract)
+{
+    IDBKeyPath keyPath("foo");
+    RefPtr<IDBKey> stringZooKey(IDBKey::createString("zoo"));
+    RefPtr<IDBKey> invalidKey(IDBKey::createInvalid());
+    RefPtr<SerializedScriptValue> ssv;
+    RefPtr<IDBKey> result;
+
+    // keypath: "foo", value: {foo: "zoo"}, expected: "zoo"
+    UChar dataFooZoo[] = {0x0353, 0x6f66, 0x536f, 0x7a03, 0x6f6f, 0x017b};
+    ssv = SerializedScriptValue::createFromWire(String(dataFooZoo, WTF_ARRAY_LENGTH(dataFooZoo)));
+    result = createIDBKeyFromSerializedValueAndKeyPath(ssv, keyPath);
+    EXPECT_TRUE(stringZooKey->isEqual(result.get()));
+
+    // keypath: "foo", value: {foo: null}, expected: invalid
+    UChar dataFooNull[] = {0x0353, 0x6f66, 0x306f, 0x017b};
+    ssv = SerializedScriptValue::createFromWire(String(dataFooNull, WTF_ARRAY_LENGTH(dataFooNull)));
+    result = createIDBKeyFromSerializedValueAndKeyPath(ssv, keyPath);
+    EXPECT_FALSE(result->isValid());
+
+    // keypath: "foo", value: {}, expected: null
+    UChar dataObject[] = {0x017b};
+    ssv = SerializedScriptValue::createFromWire(String(dataObject, WTF_ARRAY_LENGTH(dataObject)));
+    result = createIDBKeyFromSerializedValueAndKeyPath(ssv, keyPath);
+    EXPECT_EQ(0, result.get());
+
+    // keypath: "foo", value: null, expected: null
+    ssv = SerializedScriptValue::nullValue();
+    result = createIDBKeyFromSerializedValueAndKeyPath(ssv, keyPath);
+    EXPECT_EQ(0, result.get());
+}
+
+TEST(IDBKeyPathTest, IDBKeyPathPropertyNotAvailable)
+{
+    IDBKeyPath keyPath("PropertyNotAvailable");
+    RefPtr<SerializedScriptValue> ssv;
+    // {foo: "zoo", bar: null}
+    UChar data[] = {0x0353, 0x6f66, 0x536f, 0x7a03, 0x6f6f, 0x0353, 0x6162,
+                    0x3072, 0x027b};
+    ssv = SerializedScriptValue::createFromWire(String(data, WTF_ARRAY_LENGTH(data)));
+    RefPtr<IDBKey> result = createIDBKeyFromSerializedValueAndKeyPath(ssv, keyPath);
+    EXPECT_EQ(0, result.get());
+
+    // null
+    ssv = SerializedScriptValue::nullValue();
+    result = createIDBKeyFromSerializedValueAndKeyPath(ssv, keyPath);
+    EXPECT_EQ(0, result.get());
+}
+
+TEST(IDBKeyPathTest, InjectIDBKey)
+{
+    // {foo: 'zoo'}
+    const UChar initialData[] = {0x0353, 0x6f66, 0x536f, 0x7a03, 0x6f6f, 0x017b};
+    RefPtr<SerializedScriptValue> value = SerializedScriptValue::createFromWire(String(initialData, WTF_ARRAY_LENGTH(initialData)));
+
+    RefPtr<IDBKey> key = IDBKey::createString("myNewKey");
+    IDBKeyPath keyPath("bar");
+
+    // {foo: 'zoo', bar: 'myNewKey'}
+    const UChar expectedData[] = {0x01ff, 0x003f, 0x3f6f, 0x5301, 0x6603,
+                                  0x6f6f, 0x013f, 0x0353, 0x6f7a, 0x3f6f,
+                                  0x5301, 0x6203, 0x7261, 0x013f, 0x0853,
+                                  0x796d, 0x654e, 0x4b77, 0x7965, 0x027b};
+    RefPtr<SerializedScriptValue> expectedValue = 
+            SerializedScriptValue::createFromWire(String(expectedData, WTF_ARRAY_LENGTH(expectedData)));
+    RefPtr<SerializedScriptValue> result = injectIDBKeyIntoSerializedValue(key, value, keyPath);
+    EXPECT_EQ(expectedValue->toWireString(), result->toWireString());
+
+    // Should fail - can't apply properties to string value of key foo
+    keyPath = IDBKeyPath("foo.bad.path");
+    result = injectIDBKeyIntoSerializedValue(key, value, keyPath);
+    EXPECT_EQ(0, result.get());
+
+    // {foo: 'zoo', bar: {baz: 'myNewKey'}}
+    const UChar expectedData2[] = {0x01ff, 0x003f, 0x3f6f, 0x5301, 0x6603,
+                                   0x6f6f, 0x013f, 0x0353, 0x6f7a, 0x3f6f,
+                                   0x5301, 0x6203, 0x7261, 0x013f, 0x3f6f,
+                                   0x5302, 0x6203, 0x7a61, 0x023f, 0x0853,
+                                   0x796d, 0x654e, 0x4b77, 0x7965, 0x017b,
+                                   0x027b};
+    RefPtr<SerializedScriptValue> expectedValue2 = SerializedScriptValue::createFromWire(String(expectedData2, WTF_ARRAY_LENGTH(expectedData2)));
+    keyPath = IDBKeyPath("bar.baz");
+    result = injectIDBKeyIntoSerializedValue(key, value, keyPath);
+    EXPECT_EQ(expectedValue2->toWireString(), result->toWireString());
+}
+
 } // namespace
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
index a5ca55124..4948f97cc 100644
--- a/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/ImageLayerChromiumTest.cpp
@@ -122,13 +122,13 @@ TEST(ImageLayerChromiumTest, opaqueImages)
     RefPtr<Image> nonOpaqueImage = TestImage::create(IntSize(100, 100), false);
     ASSERT_TRUE(nonOpaqueImage.get());
 
-    ASSERT_TRUE(graphicsLayer->contentsLayer().isNull());
+    ASSERT_FALSE(graphicsLayer->contentsLayer());
 
     graphicsLayer->setContentsToImage(opaqueImage.get());
-    ASSERT_TRUE(graphicsLayer->contentsLayer().opaque());
+    ASSERT_TRUE(graphicsLayer->contentsLayer()->opaque());
 
     graphicsLayer->setContentsToImage(nonOpaqueImage.get());
-    ASSERT_FALSE(graphicsLayer->contentsLayer().opaque());
+    ASSERT_FALSE(graphicsLayer->contentsLayer()->opaque());
 }
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/LinkHighlightTest.cpp b/Source/WebKit/chromium/tests/LinkHighlightTest.cpp
index be467a0d5..64830ef22 100644
--- a/Source/WebKit/chromium/tests/LinkHighlightTest.cpp
+++ b/Source/WebKit/chromium/tests/LinkHighlightTest.cpp
@@ -26,62 +26,64 @@
 
 #include "LinkHighlight.h"
 
-#include "AnimationIdVendor.h"
-#include "GraphicsLayerChromium.h"
-#include "GraphicsLayerClient.h"
+#include "FrameTestHelpers.h"
 #include "IntRect.h"
-#include "Path.h"
+#include "Node.h"
+#include "URLTestHelpers.h"
+#include "WebFrame.h"
+#include "WebViewImpl.h"
 #include <gtest/gtest.h>
-#include <public/WebTransformationMatrix.h>
+#include <public/WebCompositor.h>
+#include <public/WebContentLayer.h>
+#include <public/WebFloatPoint.h>
+#include <public/WebSize.h>
 #include <wtf/PassOwnPtr.h>
 
+using namespace WebKit;
 using namespace WebCore;
-using WebKit::WebTransformationMatrix;
 
 namespace {
 
-class MockGraphicsLayerClient : public GraphicsLayerClient {
-public:
-    virtual void notifyAnimationStarted(const GraphicsLayer*, double time) OVERRIDE { }
-    virtual void notifySyncRequired(const GraphicsLayer*) OVERRIDE { }
-    virtual void paintContents(const GraphicsLayer*, GraphicsContext&, GraphicsLayerPaintingPhase, const IntRect& inClip) OVERRIDE { }
-    virtual bool showDebugBorders(const GraphicsLayer*) const OVERRIDE { return false; }
-    virtual bool showRepaintCounter(const GraphicsLayer*) const OVERRIDE { return false; }
-};
-
-TEST(LinkHighlightTest, verifyLinkHighlightLayer)
+#if ENABLE(GESTURE_EVENTS)
+TEST(LinkHighlightTest, verifyWebViewImplIntegration)
 {
-    Path highlightPath;
-    highlightPath.addRect(FloatRect(5, 6, 12, 8));
-    IntRect pathBoundingRect = enclosingIntRect(highlightPath.boundingRect());
-
-    RefPtr<LinkHighlight> highlight = LinkHighlight::create(0, highlightPath, AnimationIdVendor::LinkHighlightAnimationId, AnimationIdVendor::getNextGroupId());
-    ASSERT_TRUE(highlight.get());
-    ContentLayerChromium* contentLayer = highlight->contentLayer();
-    ASSERT_TRUE(contentLayer);
-
-    EXPECT_EQ(pathBoundingRect.size(), contentLayer->bounds());
-    EXPECT_TRUE(contentLayer->transform().isIdentityOrTranslation());
-    EXPECT_TRUE(contentLayer->transform().isIntegerTranslation());
-
-    float expectedXTranslation = pathBoundingRect.x() + pathBoundingRect.width() / 2;
-    float expectedYTranslation = pathBoundingRect.y() + pathBoundingRect.height() / 2;
-    EXPECT_FLOAT_EQ(expectedXTranslation, contentLayer->transform().m41());
-    EXPECT_FLOAT_EQ(expectedYTranslation, contentLayer->transform().m42());
-}
+    WebCompositor::initialize(0);
 
-TEST(LinkHighlightTest, verifyGraphicsLayerChromiumEmbedding)
-{
-    MockGraphicsLayerClient client;
-    OwnPtr<GraphicsLayerChromium> graphicsLayer = static_pointer_cast<GraphicsLayerChromium>(GraphicsLayer::create(&client));
-    ASSERT_TRUE(graphicsLayer.get());
+    const std::string baseURL("http://www.test.com/");
+    const std::string fileName("test_touch_link_highlight.html");
+
+    URLTestHelpers::registerMockedURLFromBaseURL(WebString::fromUTF8(baseURL.c_str()), WebString::fromUTF8("test_touch_link_highlight.html"));
+    WebViewImpl* webViewImpl = static_cast<WebViewImpl*>(FrameTestHelpers::createWebViewAndLoad(baseURL + fileName, true));
+    int pageWidth = 640;
+    int pageHeight = 480;
+    webViewImpl->resize(WebSize(pageWidth, pageHeight));
+    webViewImpl->layout();
+
+    // The coordinates below are linked to absolute positions in the referenced .html file.
+    IntPoint touchEventLocation(20, 20);
+    Node* touchNode = webViewImpl->bestTouchLinkNode(touchEventLocation);
+    ASSERT_TRUE(touchNode);
+
+    touchEventLocation = IntPoint(20, 40);
+    EXPECT_FALSE(webViewImpl->bestTouchLinkNode(touchEventLocation));
+
+    touchEventLocation = IntPoint(20, 20);
+    // Shouldn't crash.
+
+    webViewImpl->enableTouchHighlight(touchEventLocation);
+    EXPECT_TRUE(webViewImpl->linkHighlight());
+    EXPECT_TRUE(webViewImpl->linkHighlight()->contentLayer());
+    EXPECT_TRUE(webViewImpl->linkHighlight()->clipLayer());
+
+    // Find a target inside a scrollable div
 
-    Path highlightPath;
-    highlightPath.addRect(FloatRect(5, 5, 10, 8));
+    touchEventLocation = IntPoint(20, 100);
+    webViewImpl->enableTouchHighlight(touchEventLocation);
+    ASSERT_TRUE(webViewImpl->linkHighlight());
 
-    // Neither of the following operations should crash.
-    graphicsLayer->addLinkHighlight(highlightPath);
-    graphicsLayer->didFinishLinkHighlight();
+    webViewImpl->close();
+    WebCompositor::shutdown();
 }
+#endif
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
index 689b817af..2efb8e5dc 100644
--- a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
@@ -77,6 +77,8 @@ class TiledLayerChromiumTest : public testing::Test {
 public:
     TiledLayerChromiumTest()
         : m_context(WebKit::createFakeCCGraphicsContext())
+        , m_textureManager(CCPrioritizedTextureManager::create(60*1024*1024, 1024, CCRenderer::ContentPool))
+        , m_occlusion(0)
     {
         DebugScopedSetImplThread implThread;
         m_resourceProvider = CCResourceProvider::create(m_context.get());
@@ -92,6 +94,42 @@ public:
     {
         CCTextureUpdateController::updateTextures(m_resourceProvider.get(), &m_copier, &m_uploader, &m_queue, count);
     }
+
+    bool updateAndPush(FakeTiledLayerChromium* layer1,
+                       CCLayerImpl* layerImpl1,
+                       FakeTiledLayerChromium* layer2 = 0,
+                       CCLayerImpl* layerImpl2 = 0)
+    {
+        // Get textures
+        m_textureManager->clearPriorities();
+        if (layer1)
+            layer1->setTexturePriorities(m_priorityCalculator);
+        if (layer2)
+            layer2->setTexturePriorities(m_priorityCalculator);     
+        m_textureManager->prioritizeTextures();
+
+        // Update content
+        if (layer1)
+            layer1->update(m_queue, m_occlusion, m_stats);
+        if (layer2)
+            layer2->update(m_queue, m_occlusion, m_stats);
+
+        bool needsUpdate = false;
+        if (layer1)
+            needsUpdate |= layer1->needsIdlePaint();
+        if (layer2)
+            needsUpdate |= layer2->needsIdlePaint();
+
+        // Update textures and push.
+        updateTextures();
+        if (layer1)
+            layer1->pushPropertiesTo(layerImpl1);
+        if (layer2)
+            layer2->pushPropertiesTo(layerImpl2);
+
+        return needsUpdate;
+    }
+
 public:
     OwnPtr<CCGraphicsContext> m_context;
     OwnPtr<CCResourceProvider> m_resourceProvider;
@@ -100,14 +138,13 @@ public:
     FakeTextureCopier m_copier;
     FakeTextureUploader m_uploader;
     CCPriorityCalculator m_priorityCalculator;
+    OwnPtr<CCPrioritizedTextureManager> m_textureManager;
+    TestCCOcclusionTracker* m_occlusion;
 };
 
-
-
 TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
@@ -115,25 +152,17 @@ TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
     layer->setBounds(IntSize(100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
-
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
+    updateAndPush(layer.get(), layerImpl.get());
 
     // We should have both tiles on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 
-    // Invalidates both tiles...
+    // Invalidates both tiles, but then only update one of them.
+    layer->setBounds(IntSize(100, 200));
+    layer->setVisibleContentRect(IntRect(0, 0, 100, 100));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
-    // ....but then only update one of them.
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
-    layer->pushPropertiesTo(layerImpl.get());
+    updateAndPush(layer.get(), layerImpl.get());
 
     // We should only have the first tile since the other tile was invalidated but not painted.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -142,24 +171,17 @@ TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
 
 TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
     TestCCOcclusionTracker occluded;
+    m_occlusion = &occluded;
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
-    layer->setDrawableContentRect(IntRect(0, 0, 100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
-
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), &occluded, m_stats);
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
+    updateAndPush(layer.get(), layerImpl.get());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedTranslucent(), 20000, 1);
@@ -173,9 +195,7 @@ TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
     layer->invalidateContentRect(IntRect(0, 0, 50, 50));
     // ....but the area is occluded.
     occluded.setOcclusion(IntRect(0, 0, 50, 50));
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), &occluded, m_stats);
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
+    updateAndPush(layer.get(), layerImpl.get());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedTranslucent(), 20000 + 2500, 1);
@@ -188,8 +208,7 @@ TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
 
 TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
@@ -197,21 +216,15 @@ TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
     layer->setBounds(IntSize(100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
-
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
+    updateAndPush(layer.get(), layerImpl.get());
 
     // We should have both tiles on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 
-    textureManager->clearPriorities();
-    textureManager->clearAllMemory(m_resourceProvider.get());
-    textureManager->setMaxMemoryLimitBytes(4*1024*1024);
+    m_textureManager->clearPriorities();
+    m_textureManager->clearAllMemory(m_resourceProvider.get());
+    m_textureManager->setMaxMemoryLimitBytes(4*1024*1024);
 
     // This should drop the tiles on the impl thread.
     layer->pushPropertiesTo(layerImpl.get());
@@ -220,203 +233,140 @@ TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
     EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
 
-    // This should recreate and update the deleted textures.
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
+    // This should recreate and update one of the deleted textures.
+    layer->setVisibleContentRect(IntRect(0, 0, 100, 100));
+    updateAndPush(layer.get(), layerImpl.get());
 
-    // We should only have the first tile since the other tile was invalidated but not painted.
+    // We should have one tiles on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
 }
 
 TEST_F(TiledLayerChromiumTest, pushIdlePaintTiles)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // The tile size is 100x100. Setup 5x5 tiles with one visible tile in the center.
-    IntSize contentBounds(500, 500);
-    IntRect contentRect(IntPoint::zero(), contentBounds);
-    IntRect visibleRect(200, 200, 100, 100);
-
-    // This invalidates 25 tiles and then paints one visible tile.
-    layer->setBounds(contentBounds);
-    layer->setVisibleContentRect(visibleRect);
-    layer->invalidateContentRect(contentRect);
-
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-
-    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
-    updateTextures();
-
-    // We should need idle-painting for 3x3 tiles in the center.
-    EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
-
-    layer->pushPropertiesTo(layerImpl.get());
+    // This paints 1 visible of the 25 invalid tiles.
+    layer->setBounds(IntSize(500, 500));
+    layer->setVisibleContentRect(IntRect(200, 200, 100, 100));
+    layer->invalidateContentRect(IntRect(0, 0, 500, 500));
+    bool needsUpdate = updateAndPush(layer.get(), layerImpl.get());
+    // We should need idle-painting for surrounding tiles.
+    EXPECT_TRUE(needsUpdate);
 
     // We should have one tile on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(2, 2));
 
     // For the next four updates, we should detect we still need idle painting.
     for (int i = 0; i < 4; i++) {
-        layer->setTexturePriorities(m_priorityCalculator);
-        textureManager->prioritizeTextures();
-
-        layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
-        EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
-        updateTextures();
-        layer->pushPropertiesTo(layerImpl.get());
+        needsUpdate = updateAndPush(layer.get(), layerImpl.get());
+        EXPECT_TRUE(needsUpdate);
     }
 
-    // After four passes of idle painting, we should be finished painting
-    // EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
-
     // We should have one tile surrounding the visible tile on all sides, but no other tiles.
     IntRect idlePaintTiles(1, 1, 3, 3);
     for (int i = 0; i < 5; i++) {
-        for (int j = 0; j < 5; j++) {
-            if (idlePaintTiles.contains(i, j))
-                EXPECT_TRUE(layerImpl->hasTileAt(i, j));
-            else
-                EXPECT_FALSE(layerImpl->hasTileAt(i, j));
-        }
+        for (int j = 0; j < 5; j++)
+            EXPECT_EQ(layerImpl->hasTileAt(i, j), idlePaintTiles.contains(i, j));
     }
+
+    // We should always finish painting eventually.
+    for (int i = 0; i < 20; i++)
+        needsUpdate = updateAndPush(layer.get(), layerImpl.get());
+    EXPECT_FALSE(needsUpdate);
 }
 
 TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
 {
     // Start with 2mb of memory, but the test is going to try to use just more than 1mb, so we reduce to 1mb later.
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(2*1024*1024, 1024, CCRenderer::ContentPool);
+    m_textureManager->setMaxMemoryLimitBytes(2 * 1024 * 1024);    
     DebugScopedSetImplThread implThread;
-    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     OwnPtr<FakeCCTiledLayerImpl> layerImpl1(adoptPtr(new FakeCCTiledLayerImpl(1)));
-    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     OwnPtr<FakeCCTiledLayerImpl> layerImpl2(adoptPtr(new FakeCCTiledLayerImpl(2)));
 
     // For this test we have two layers. layer1 exhausts most texture memory, leaving room for 2 more tiles from
     // layer2, but not all three tiles. First we paint layer1, and one tile from layer2. Then when we idle paint
     // layer2, we will fail on the third tile of layer2, and this should not leave the second tile in a bad state.
 
+    // This uses 960000 bytes, leaving 88576 bytes of memory left, which is enough for 2 tiles only in the other layer.
+    IntRect layer1Rect(0, 0, 100, 2400);
+    
     // This requires 4*30000 bytes of memory.
     IntRect layer2Rect(0, 0, 100, 300);
-    layer2->setBounds(layer2Rect.size());
-    layer2->setVisibleContentRect(layer2Rect);
-    layer2->invalidateContentRect(layer2Rect);
-
-    // This uses 960000 bytes, leaving 88576 bytes of memory left, which is enough for 2 tiles only in the other layer.
-    IntRect layerRect(IntPoint::zero(), IntSize(100, 2400));
-    layer1->setBounds(layerRect.size());
-    layer1->setVisibleContentRect(layerRect);
-    layer1->invalidateContentRect(layerRect);
 
     // Paint a single tile in layer2 so that it will idle paint.
-    layer2->setTexturePriorities(m_priorityCalculator);
-    layer1->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer1->updateContentRect(m_queue, layerRect, 0, m_stats);
-    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
-
+    layer1->setBounds(layer1Rect.size());
+    layer1->setVisibleContentRect(layer1Rect);
+    layer2->setBounds(layer2Rect.size());
+    layer2->setVisibleContentRect(IntRect(0, 0, 100, 100));
+    bool needsUpdate = updateAndPush(layer1.get(), layerImpl1.get(),
+                                     layer2.get(), layerImpl2.get());
     // We should need idle-painting for both remaining tiles in layer2.
-    EXPECT_TRUE(layer2->needsIdlePaint(layer2Rect));
-
-    // Commit the frame over to impl.
-    updateTextures();
-    layer1->pushPropertiesTo(layerImpl1.get());
-    layer2->pushPropertiesTo(layerImpl2.get());
+    EXPECT_TRUE(needsUpdate);
 
     // Reduce our memory limits to 1mb.
-    textureManager->setMaxMemoryLimitBytes(1024 * 1024);
+    m_textureManager->setMaxMemoryLimitBytes(1024 * 1024);
 
     // Now idle paint layer2. We are going to run out of memory though!
-    layer2->setTexturePriorities(m_priorityCalculator);
-    layer1->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
-
     // Oh well, commit the frame and push.
-    updateTextures();
-    layer1->pushPropertiesTo(layerImpl1.get());
-    layer2->pushPropertiesTo(layerImpl2.get());
+    for (int i = 0; i < 4; i++) {
+        needsUpdate = updateAndPush(layer1.get(), layerImpl1.get(),
+                                    layer2.get(), layerImpl2.get());
+    }
 
     // Sanity check, we should have textures for the big layer.
     EXPECT_TRUE(layerImpl1->hasTextureIdForTileAt(0, 0));
+    EXPECT_TRUE(layerImpl1->hasTextureIdForTileAt(0, 23));
 
-    // We should only have the first tile from layer2 since it failed to idle update.
+    // We should only have the first two tiles from layer2 since
+    // it failed to idle update the last tile.
     EXPECT_TRUE(layerImpl2->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl2->hasTextureIdForTileAt(0, 0));
-    EXPECT_FALSE(layerImpl2->hasTileAt(0, 1));
-    EXPECT_FALSE(layerImpl2->hasTileAt(0, 2));
-
-    // Now if layer2 becomes fully visible, we should be able to paint it and push valid textures.
-    layer2->setTexturePriorities(m_priorityCalculator);
-    layer1->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer2->updateContentRect(m_queue, layer2Rect, 0, m_stats);
-    layer1->updateContentRect(m_queue, layerRect, 0, m_stats);
-
-    updateTextures();
-    layer1->pushPropertiesTo(layerImpl1.get());
-    layer2->pushPropertiesTo(layerImpl2.get());
-
-    EXPECT_TRUE(layerImpl2->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl2->hasTileAt(0, 1));
-    EXPECT_TRUE(layerImpl2->hasTileAt(0, 2));
-    EXPECT_TRUE(layerImpl2->hasTextureIdForTileAt(0, 0));
     EXPECT_TRUE(layerImpl2->hasTextureIdForTileAt(0, 1));
-    EXPECT_TRUE(layerImpl2->hasTextureIdForTileAt(0, 2));
+    
+    EXPECT_FALSE(needsUpdate);
+    EXPECT_FALSE(layerImpl2->hasTileAt(0, 2));
 }
 
 TEST_F(TiledLayerChromiumTest, pushIdlePaintedOccludedTiles)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
     TestCCOcclusionTracker occluded;
-
+    m_occlusion = &occluded;
+    
     // The tile size is 100x100, so this invalidates one occluded tile, culls it during paint, but prepaints it.
     occluded.setOcclusion(IntRect(0, 0, 100, 100));
 
     layer->setBounds(IntSize(100, 100));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 100));
-    layer->invalidateContentRect(IntRect(0, 0, 100, 100));
+    updateAndPush(layer.get(), layerImpl.get());
 
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), &occluded, m_stats);
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
-
-    // We should have the prepainted tile on the impl side.
+    // We should have the prepainted tile on the impl side, but culled it during paint.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
+    EXPECT_EQ(1, occluded.overdrawMetrics().tilesCulledForUpload());
 }
 
 TEST_F(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     // However, during the paint, we invalidate one of the tiles. This should
     // not prevent the tile from being pushed.
-    layer->setBounds(IntSize(100, 200));
-    layer->invalidateContentRect(IntRect(0, 0, 100, 200));
-    layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
     layer->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer.get());
-
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
+    layer->setBounds(IntSize(100, 200));
+    layer->setVisibleContentRect(IntRect(0, 0, 100, 200));    
+    updateAndPush(layer.get(), layerImpl.get());
 
     // We should have both tiles on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -425,34 +375,20 @@ TEST_F(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
 
 TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(1)));
     OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(2)));
 
+    // Invalidate a tile on layer1, during update of layer 2.
+    layer2->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer1.get());
     layer1->setBounds(IntSize(100, 200));
-    layer1->setVisibleContentRect(IntRect(0, 0, 100, 200));
-    layer1->invalidateContentRect(IntRect(0, 0, 100, 200));
-
+    layer1->setVisibleContentRect(IntRect(0, 0, 100, 200));    
     layer2->setBounds(IntSize(100, 200));
-    layer2->setVisibleContentRect(IntRect(0, 0, 100, 200));
-    layer2->invalidateContentRect(IntRect(0, 0, 100, 200));
-
-    layer1->setTexturePriorities(m_priorityCalculator);
-    layer2->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-
-    layer1->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-
-    // Invalidate a tile on layer1
-    layer2->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer1.get());
-    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-
-    updateTextures();
-    layer1->pushPropertiesTo(layer1Impl.get());
-    layer2->pushPropertiesTo(layer2Impl.get());
+    layer2->setVisibleContentRect(IntRect(0, 0, 100, 200));    
+    updateAndPush(layer1.get(), layer1Impl.get(),
+                  layer2.get(), layer2Impl.get());
 
     // We should have both tiles on the impl side for all layers.
     EXPECT_TRUE(layer1Impl->hasTileAt(0, 0));
@@ -463,32 +399,19 @@ TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
 
 TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnPreviousLayer)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(1)));
     OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(2)));
 
+    layer1->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer2.get());
     layer1->setBounds(IntSize(100, 200));
-    layer1->setVisibleContentRect(IntRect(0, 0, 100, 200));
-    layer1->invalidateContentRect(IntRect(0, 0, 100, 200));
-
+    layer1->setVisibleContentRect(IntRect(0, 0, 100, 200));    
     layer2->setBounds(IntSize(100, 200));
-    layer2->setVisibleContentRect(IntRect(0, 0, 100, 200));
-    layer2->invalidateContentRect(IntRect(0, 0, 100, 200));
-
-    layer1->setTexturePriorities(m_priorityCalculator);
-    layer2->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-
-    // Invalidate a tile on layer2
-    layer1->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer2.get());
-    layer1->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    layer2->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures();
-    layer1->pushPropertiesTo(layer1Impl.get());
-    layer2->pushPropertiesTo(layer2Impl.get());
+    layer2->setVisibleContentRect(IntRect(0, 0, 100, 200));    
+    updateAndPush(layer1.get(), layer1Impl.get(),
+                  layer2.get(), layer2Impl.get());
 
     // We should have both tiles on the impl side for all layers.
     EXPECT_TRUE(layer1Impl->hasTileAt(0, 0));
@@ -518,10 +441,10 @@ TEST_F(TiledLayerChromiumTest, paintSmallAnimatedLayersImmediately)
         if (runOutOfMemory[i])
             layerWidth *= 2;
 
-        OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(memoryForLayer, 1024, CCRenderer::ContentPool);
+        m_textureManager->setMaxMemoryLimitBytes(memoryForLayer);
         DebugScopedSetImplThread implThread;
 
-        RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+        RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
         OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
         // Full size layer with half being visible.
@@ -539,8 +462,8 @@ TEST_F(TiledLayerChromiumTest, paintSmallAnimatedLayersImmediately)
         // The layer should paint it's entire contents on the first paint
         // if it is close to the viewport size and has the available memory.
         layer->setTexturePriorities(m_priorityCalculator);
-        textureManager->prioritizeTextures();
-        layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
+        m_textureManager->prioritizeTextures();
+        layer->update(m_queue, 0, m_stats);
         updateTextures();
         layer->pushPropertiesTo(layerImpl.get());
 
@@ -565,49 +488,31 @@ TEST_F(TiledLayerChromiumTest, paintSmallAnimatedLayersImmediately)
 
 TEST_F(TiledLayerChromiumTest, idlePaintOutOfMemory)
 {
-    // The tile size is 100x100. Setup 3x3 tiles with one 1x1 visible tile in the center.
-    IntSize contentBounds(300, 300);
-    IntRect contentRect(IntPoint::zero(), contentBounds);
-    IntRect visibleRect(100, 100, 100, 100);
-
-    // We have enough memory for only the visible rect, so we will run out of memory in first idle paint.
-    int memoryLimit = 4 * 100 * 100; // 1 tiles, 4 bytes per pixel.
-
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(memoryLimit, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
-    // Invalidates 9 tiles and then paints one visible tile.
-    layer->setBounds(contentBounds);
-    layer->setVisibleContentRect(visibleRect);
-    layer->invalidateContentRect(contentRect);
+    // We have enough memory for only the visible rect, so we will run out of memory in first idle paint.
+    int memoryLimit = 4 * 100 * 100; // 1 tiles, 4 bytes per pixel.
+    m_textureManager->setMaxMemoryLimitBytes(memoryLimit);
 
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
+    // The tile size is 100x100, so this invalidates and then paints two tiles.
+    bool needsUpdate = false;
+    layer->setBounds(IntSize(300, 300));
+    layer->setVisibleContentRect(IntRect(100, 100, 100, 100));
+    for (int i = 0; i < 2; i++)
+        needsUpdate = updateAndPush(layer.get(), layerImpl.get());
 
     // Idle-painting should see no more priority tiles for painting.
-    EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
-
-    updateTextures();
-    layer->pushPropertiesTo(layerImpl.get());
+    EXPECT_FALSE(needsUpdate);
 
     // We should have one tile on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(1, 1));
-
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, visibleRect, 0, m_stats);
-
-    // We shouldn't signal we need another idle paint.
-    EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
 }
 
 TEST_F(TiledLayerChromiumTest, idlePaintZeroSizedLayer)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(20000, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
@@ -617,25 +522,16 @@ TEST_F(TiledLayerChromiumTest, idlePaintZeroSizedLayer)
         layer->setDrawTransformIsAnimating(animating[i]);
 
         // The layer's bounds are empty.
-        IntRect contentRect;
-
-        layer->setBounds(contentRect.size());
-        layer->setVisibleContentRect(contentRect);
-        layer->invalidateContentRect(contentRect);
-
-        layer->setTexturePriorities(m_priorityCalculator);
-        textureManager->prioritizeTextures();
-
         // Empty layers don't paint or idle-paint.
-        layer->updateContentRect(m_queue, contentRect, 0, m_stats);
-
+        layer->setBounds(IntSize());
+        layer->setVisibleContentRect(IntRect());
+        bool needsUpdate = updateAndPush(layer.get(), layerImpl.get());
+        
         // Empty layers don't have tiles.
         EXPECT_EQ(0u, layer->numPaintedTiles());
 
         // Empty layers don't need prepaint.
-        EXPECT_FALSE(layer->needsIdlePaint(contentRect));
-
-        layer->pushPropertiesTo(layerImpl.get());
+        EXPECT_FALSE(needsUpdate);
 
         // Empty layers don't have tiles.
         EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
@@ -644,14 +540,9 @@ TEST_F(TiledLayerChromiumTest, idlePaintZeroSizedLayer)
 
 TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleLayers)
 {
-    IntSize contentBounds(100, 100);
-    IntRect contentRect(IntPoint::zero(), contentBounds);
-
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
-    layer->setBounds(contentBounds);
 
     // Alternate between not visible and visible.
     IntRect v(0, 0, 100, 100);
@@ -662,71 +553,53 @@ TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleLayers)
     // We should not have any tiles except for when the layer was visible
     // or after the layer was visible and we didn't invalidate.
     bool haveTile[10] = { false, false, true, true, false, false, true, true, true, true };
-
+    
     for (int i = 0; i < 10; i++) {
+        layer->setBounds(IntSize(100, 100));
         layer->setVisibleContentRect(visibleRect[i]);
 
-        // Skip invalidation once to insure the tile stays in memory while not visible.
         if (invalidate[i])
-            layer->invalidateContentRect(contentRect);
-
-        // Paint / idle-paint.
-        textureManager->clearPriorities();
-        layer->setTexturePriorities(m_priorityCalculator);
-        textureManager->prioritizeTextures();
-        layer->updateContentRect(m_queue, visibleRect[i], 0, m_stats);
-
-        updateTextures();
-
+            layer->invalidateContentRect(IntRect(0, 0, 100, 100));
+        bool needsUpdate = updateAndPush(layer.get(), layerImpl.get());
+        
         // We should never signal idle paint, as we painted the entire layer
         // or the layer was not visible.
-        EXPECT_FALSE(layer->needsIdlePaint(visibleRect[i]));
-
-        layer->pushPropertiesTo(layerImpl.get());
+        EXPECT_FALSE(needsUpdate);
         EXPECT_EQ(layerImpl->hasTileAt(0, 0), haveTile[i]);
     }
 }
 
-
 TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
     layer->setVisibleContentRect(IntRect(0, 0, 100, 200));
-    layer->invalidateContentRect(IntRect(0, 0, 100, 200));
-    layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures(1000);
-    layer->pushPropertiesTo(layerImpl.get());
+    updateAndPush(layer.get(), layerImpl.get());
 
     // We should have both tiles on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
-    // Invoke updateContentRect again. As the layer is valid updateContentRect shouldn't be invoked on
+    // Invoke update again. As the layer is valid update shouldn't be invoked on
     // the LayerTextureUpdater.
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures(1000);
+    updateAndPush(layer.get(), layerImpl.get());
     EXPECT_EQ(0, layer->fakeLayerTextureUpdater()->prepareCount());
 
-    layer->invalidateContentRect(IntRect(0, 0, 50, 50));
-    // setRectToInvalidate triggers invalidateContentRect() being invoked from updateContentRect.
+    // setRectToInvalidate triggers invalidateContentRect() being invoked from update.
     layer->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(25, 25, 50, 50), layer.get());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures(1000);
+    layer->invalidateContentRect(IntRect(0, 0, 50, 50));
+    updateAndPush(layer.get(), layerImpl.get());
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
-    // The layer should still be invalid as updateContentRect invoked invalidate.
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
-    updateTextures(1000);
+
+    // The layer should still be invalid as update invoked invalidate.
+    updateAndPush(layer.get(), layerImpl.get()); // visible
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
 }
 
@@ -734,9 +607,7 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
 {
     // The updateRect (that indicates what was actually painted) should be in
     // layer space, not the content space.
-
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerWithScaledBounds> layer = adoptRef(new FakeTiledLayerWithScaledBounds(textureManager.get()));
+    RefPtr<FakeTiledLayerWithScaledBounds> layer = adoptRef(new FakeTiledLayerWithScaledBounds(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
 
     IntRect layerBounds(0, 0, 300, 200);
@@ -751,16 +622,16 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     layer->invalidateContentRect(contentBounds);
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 300, 300 * 0.8), layer->updateRect());
     updateTextures();
 
     // After the tiles are updated once, another invalidate only needs to update the bounds of the layer.
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
+    layer->update(m_queue, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(layerBounds), layer->updateRect());
     updateTextures();
 
@@ -768,15 +639,14 @@ TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     IntRect partialDamage(30, 100, 10, 10);
     layer->invalidateContentRect(partialDamage);
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, contentBounds, 0, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, 0, m_stats);
     EXPECT_FLOAT_RECT_EQ(FloatRect(45, 80, 15, 8), layer->updateRect());
 }
 
 TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     DebugScopedSetImplThread implThread;
     OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
@@ -790,8 +660,8 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
 
     // Push the tiles to the impl side and check that there is exactly one.
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 100), 0, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -807,8 +677,8 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
 
     // The impl side should get 2x2 tiles now.
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 200, 200), 0, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, 0, m_stats);
     updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
@@ -820,8 +690,7 @@ TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // impl side.
     layer->setNeedsDisplay();
     layer->setTexturePriorities(m_priorityCalculator);
-    layer->updateContentRect(m_queue, IntRect(1, 0, 0, 1), 0, m_stats);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
@@ -883,16 +752,15 @@ TEST_F(TiledLayerChromiumTest, skipsDrawGetsReset)
 
 TEST_F(TiledLayerChromiumTest, resizeToSmaller)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(60*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
 
     layer->setBounds(IntSize(700, 700));
     layer->setVisibleContentRect(IntRect(0, 0, 700, 700));
     layer->invalidateContentRect(IntRect(0, 0, 700, 700));
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 700, 700), 0, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, 0, m_stats);
 
     layer->setBounds(IntSize(200, 200));
     layer->invalidateContentRect(IntRect(0, 0, 200, 200));
@@ -900,8 +768,7 @@ TEST_F(TiledLayerChromiumTest, resizeToSmaller)
 
 TEST_F(TiledLayerChromiumTest, hugeLayerUpdateCrash)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(60*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
 
     int size = 1 << 30;
     layer->setBounds(IntSize(size, size));
@@ -910,8 +777,8 @@ TEST_F(TiledLayerChromiumTest, hugeLayerUpdateCrash)
 
     // Ensure no crash for bounds where size * size would overflow an int.
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 700, 700), 0, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, 0, m_stats);
 }
 
 TEST_F(TiledLayerChromiumTest, partialUpdates)
@@ -1044,8 +911,7 @@ TEST_F(TiledLayerChromiumTest, partialUpdates)
 
 TEST_F(TiledLayerChromiumTest, tilesPaintedWithoutOcclusion)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
@@ -1054,15 +920,14 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithoutOcclusion)
     layer->invalidateContentRect(IntRect(0, 0, 100, 200));
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 100, 200), 0, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, 0, m_stats);
     EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->prepareRectCount());
 }
 
 TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     TestCCOcclusionTracker occluded;
 
     // The tile size is 100x100.
@@ -1075,8 +940,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1085,11 +950,11 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     occluded.setOcclusion(IntRect(250, 200, 300, 100));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(36-2, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1098,11 +963,11 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     occluded.setOcclusion(IntRect(250, 250, 300, 100));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(36, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1112,8 +977,7 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
 
 TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     TestCCOcclusionTracker occluded;
 
     // The tile size is 100x100.
@@ -1127,8 +991,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 360), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(24-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1143,8 +1007,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
     layer->setVisibleContentRect(IntRect(0, 0, 600, 350));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 350), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1159,8 +1023,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
     layer->setVisibleContentRect(IntRect(0, 0, 600, 340));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 340), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1171,8 +1035,7 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
 TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     TestCCOcclusionTracker occluded;
 
     // The tile size is 100x100.
@@ -1184,8 +1047,8 @@ TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
     layer->setVisibleContentRect(IntRect(0, 0, 600, 600));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
     {
         DebugScopedSetImplThread implThread;
@@ -1198,10 +1061,10 @@ TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     // Repaint without marking it dirty. The 3 culled tiles will be pre-painted now.
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1211,8 +1074,7 @@ TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
 
 TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     TestCCOcclusionTracker occluded;
 
     // The tile size is 100x100.
@@ -1230,8 +1092,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1241,8 +1103,7 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
 
 TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     TestCCOcclusionTracker occluded;
 
     // The tile size is 100x100.
@@ -1262,8 +1123,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     // The content is half the size of the layer (so the number of tiles is fewer).
     // In this case, the content is 300x300, and since the tile size is 100, the
     // number of tiles 3x3.
@@ -1283,8 +1144,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1304,8 +1165,8 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     layer->setVisibleContentRect(IntRect(IntPoint(), layer->contentBounds()));
     layer->invalidateContentRect(IntRect(0, 0, 600, 600));
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
-    layer->updateContentRect(m_queue, IntRect(0, 0, 600, 600), &occluded, m_stats);
+    m_textureManager->prioritizeTextures();
+    layer->update(m_queue, &occluded, m_stats);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -1315,8 +1176,7 @@ TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
 
 TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     TestCCOcclusionTracker occluded;
     DebugScopedSetImplThread implThread;
 
@@ -1334,12 +1194,12 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     layer->setDrawOpacity(1);
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     // If the layer doesn't paint opaque content, then the visibleContentOpaqueRegion should be empty.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
 
@@ -1352,7 +1212,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     opaquePaintRect = IntRect(10, 10, 90, 190);
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1365,7 +1225,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
 
     // If we paint again without invalidating, the same stuff should be opaque.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
-    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1380,7 +1240,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // not be affected.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(0, 0, 1, 1));
-    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
@@ -1395,7 +1255,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // not be affected.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(10, 10, 1, 1));
-    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(IntRect(10, 100, 90, 100), visibleBounds), opaqueContents.bounds());
@@ -1409,8 +1269,7 @@ TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
 
 TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024, CCRenderer::ContentPool);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(m_textureManager.get()));
     TestCCOcclusionTracker occluded;
     DebugScopedSetImplThread implThread;
 
@@ -1428,12 +1287,12 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     layer->setDrawOpacity(1);
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     // Invalidates and paints the whole layer.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(contentBounds);
-    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
@@ -1448,7 +1307,7 @@ TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateContentRect(IntRect(0, 0, 1, 1));
     layer->invalidateContentRect(IntRect(50, 200, 10, 10));
-    layer->updateContentRect(m_queue, contentBounds, &occluded, m_stats);
+    layer->update(m_queue, &occluded, m_stats);
     updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
@@ -1662,9 +1521,7 @@ private:
 
 TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager(CCPrioritizedTextureManager::create(4000000, 4000000, CCRenderer::ContentPool));
-
-    RefPtr<UpdateTrackingTiledLayerChromium> layer = adoptRef(new UpdateTrackingTiledLayerChromium(textureManager.get()));
+    RefPtr<UpdateTrackingTiledLayerChromium> layer = adoptRef(new UpdateTrackingTiledLayerChromium(m_textureManager.get()));
 
     IntRect layerRect(0, 0, 30, 31);
     layer->setPosition(layerRect.location());
@@ -1677,10 +1534,10 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
     layer->setDrawableContentRect(contentRect);
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     // Update the whole tile.
-    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
+    layer->update(m_queue, 0, m_stats);
     layer->trackingLayerPainter()->resetPaintedRect();
 
     EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
@@ -1692,16 +1549,14 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
 
     // Invalidate the entire layer in content space. When painting, the rect given to webkit should match the layer's bounds.
     layer->invalidateContentRect(contentRect);
-    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
+    layer->update(m_queue, 0, m_stats);
 
     EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
 }
 
 TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvalidation)
 {
-    OwnPtr<CCPrioritizedTextureManager> textureManager(CCPrioritizedTextureManager::create(4000000, 4000000, CCRenderer::ContentPool));
-
-    RefPtr<UpdateTrackingTiledLayerChromium> layer = adoptRef(new UpdateTrackingTiledLayerChromium(textureManager.get()));
+    RefPtr<UpdateTrackingTiledLayerChromium> layer = adoptRef(new UpdateTrackingTiledLayerChromium(m_textureManager.get()));
 
     IntRect layerRect(0, 0, 30, 31);
     layer->setPosition(layerRect.location());
@@ -1713,10 +1568,10 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvali
     layer->setDrawableContentRect(contentRect);
 
     layer->setTexturePriorities(m_priorityCalculator);
-    textureManager->prioritizeTextures();
+    m_textureManager->prioritizeTextures();
 
     // Update the whole tile.
-    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
+    layer->update(m_queue, 0, m_stats);
     layer->trackingLayerPainter()->resetPaintedRect();
 
     EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
@@ -1728,7 +1583,7 @@ TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvali
 
     // Invalidate the entire layer in layer space. When painting, the rect given to webkit should match the layer's bounds.
     layer->setNeedsDisplayRect(layerRect);
-    layer->updateContentRect(m_queue, contentRect, 0, m_stats);
+    layer->update(m_queue, 0, m_stats);
 
     EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
 }
diff --git a/Source/WebKit/chromium/tests/WebLayerTest.cpp b/Source/WebKit/chromium/tests/WebLayerTest.cpp
index 667200410..9b8e58ca1 100644
--- a/Source/WebKit/chromium/tests/WebLayerTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTest.cpp
@@ -26,6 +26,7 @@
 #include <public/WebLayer.h>
 
 #include "CompositorFakeWebGraphicsContext3D.h"
+#include "WebLayerImpl.h"
 #include <public/WebCompositor.h>
 #include <public/WebContentLayer.h>
 #include <public/WebContentLayerClient.h>
@@ -76,9 +77,9 @@ public:
     {
         // Initialize without threading support.
         WebKit::WebCompositor::initialize(0);
-        m_rootLayer = WebLayer::create();
+        m_rootLayer = adoptPtr(WebLayer::create());
         EXPECT_CALL(m_client, scheduleComposite()).Times(AnyNumber());
-        EXPECT_TRUE(m_view.initialize(&m_client, m_rootLayer, WebLayerTreeView::Settings()));
+        EXPECT_TRUE(m_view.initialize(&m_client, *m_rootLayer, WebLayerTreeView::Settings()));
         Mock::VerifyAndClearExpectations(&m_client);
     }
 
@@ -87,14 +88,14 @@ public:
         // We may get any number of scheduleComposite calls during shutdown.
         EXPECT_CALL(m_client, scheduleComposite()).Times(AnyNumber());
         m_view.setRootLayer(0);
-        m_rootLayer.reset();
+        m_rootLayer.clear();
         m_view.reset();
         WebKit::WebCompositor::shutdown();
     }
 
 protected:
     MockWebLayerTreeViewClient m_client;
-    WebLayer m_rootLayer;
+    OwnPtr<WebLayer> m_rootLayer;
     WebLayerTreeView m_view;
 };
 
@@ -104,73 +105,73 @@ TEST_F(WebLayerTest, Client)
 {
     // Base layer.
     EXPECT_CALL(m_client, scheduleComposite()).Times(AnyNumber());
-    WebLayer layer = WebLayer::create();
-    m_rootLayer.addChild(layer);
+    OwnPtr<WebLayer> layer = adoptPtr(WebLayer::create());
+    m_rootLayer->addChild(layer.get());
     Mock::VerifyAndClearExpectations(&m_client);
 
     WebFloatPoint point(3, 4);
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    layer.setAnchorPoint(point);
+    layer->setAnchorPoint(point);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_EQ(point, layer.anchorPoint());
+    EXPECT_EQ(point, layer->anchorPoint());
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
     float anchorZ = 5;
-    layer.setAnchorPointZ(anchorZ);
+    layer->setAnchorPointZ(anchorZ);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_EQ(anchorZ, layer.anchorPointZ());
+    EXPECT_EQ(anchorZ, layer->anchorPointZ());
 
     WebSize size(7, 8);
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    layer.setBounds(size);
+    layer->setBounds(size);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_EQ(size, layer.bounds());
+    EXPECT_EQ(size, layer->bounds());
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    layer.setMasksToBounds(true);
+    layer->setMasksToBounds(true);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_TRUE(layer.masksToBounds());
+    EXPECT_TRUE(layer->masksToBounds());
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AnyNumber());
-    WebLayer otherLayer = WebLayer::create();
-    m_rootLayer.addChild(otherLayer);
+    OwnPtr<WebLayer> otherLayer = adoptPtr(WebLayer::create());
+    m_rootLayer->addChild(otherLayer.get());
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    layer.setMaskLayer(otherLayer);
+    layer->setMaskLayer(otherLayer.get());
     Mock::VerifyAndClearExpectations(&m_client);
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
     float opacity = 0.123f;
-    layer.setOpacity(opacity);
+    layer->setOpacity(opacity);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_EQ(opacity, layer.opacity());
+    EXPECT_EQ(opacity, layer->opacity());
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    layer.setOpaque(true);
+    layer->setOpaque(true);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_TRUE(layer.opaque());
+    EXPECT_TRUE(layer->opaque());
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    layer.setPosition(point);
+    layer->setPosition(point);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_EQ(point, layer.position());
+    EXPECT_EQ(point, layer->position());
 
     // Texture layer.
     EXPECT_CALL(m_client, scheduleComposite()).Times(AnyNumber());
-    WebExternalTextureLayer textureLayer = WebExternalTextureLayer::create();
-    m_rootLayer.addChild(textureLayer);
+    OwnPtr<WebExternalTextureLayer> textureLayer = adoptPtr(WebExternalTextureLayer::create());
+    m_rootLayer->addChild(textureLayer->layer());
     Mock::VerifyAndClearExpectations(&m_client);
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    textureLayer.setTextureId(3);
+    textureLayer->setTextureId(3);
     Mock::VerifyAndClearExpectations(&m_client);
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    textureLayer.setFlipped(true);
+    textureLayer->setFlipped(true);
     Mock::VerifyAndClearExpectations(&m_client);
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
     WebFloatRect uvRect(0.1f, 0.1f, 0.9f, 0.9f);
-    textureLayer.setUVRect(uvRect);
+    textureLayer->setUVRect(uvRect);
     Mock::VerifyAndClearExpectations(&m_client);
 
 
@@ -178,14 +179,14 @@ TEST_F(WebLayerTest, Client)
     MockWebContentLayerClient contentClient;
     EXPECT_CALL(contentClient, paintContents(_, _, _)).Times(AnyNumber());
     EXPECT_CALL(m_client, scheduleComposite()).Times(AnyNumber());
-    WebContentLayer contentLayer = WebContentLayer::create(&contentClient);
-    m_rootLayer.addChild(contentLayer);
+    OwnPtr<WebContentLayer> contentLayer = adoptPtr(WebContentLayer::create(&contentClient));
+    m_rootLayer->addChild(contentLayer->layer());
     Mock::VerifyAndClearExpectations(&m_client);
 
     EXPECT_CALL(m_client, scheduleComposite()).Times(AtLeast(1));
-    contentLayer.setDrawsContent(false);
+    contentLayer->layer()->setDrawsContent(false);
     Mock::VerifyAndClearExpectations(&m_client);
-    EXPECT_FALSE(contentLayer.drawsContent());
+    EXPECT_FALSE(contentLayer->layer()->drawsContent());
 }
 
 }
diff --git a/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp b/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
index bec2c6035..1c1602c23 100644
--- a/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTreeViewTest.cpp
@@ -60,8 +60,8 @@ public:
     virtual void SetUp()
     {
         initializeCompositor();
-        m_rootLayer = WebLayer::create();
-        EXPECT_TRUE(m_view.initialize(client(), m_rootLayer, WebLayerTreeView::Settings()));
+        m_rootLayer = adoptPtr(WebLayer::create());
+        EXPECT_TRUE(m_view.initialize(client(), *m_rootLayer, WebLayerTreeView::Settings()));
         m_view.setSurfaceReady();
     }
 
@@ -70,13 +70,13 @@ public:
         Mock::VerifyAndClearExpectations(client());
 
         m_view.setRootLayer(0);
-        m_rootLayer.reset();
+        m_rootLayer.clear();
         m_view.reset();
         WebKit::WebCompositor::shutdown();
     }
 
 protected:
-    WebLayer m_rootLayer;
+    OwnPtr<WebLayer> m_rootLayer;
     WebLayerTreeView m_view;
 };
 
diff --git a/Source/WebKit/chromium/tests/data/test_touch_link_highlight.html b/Source/WebKit/chromium/tests/data/test_touch_link_highlight.html
new file mode 100644
index 000000000..89bd15fb0
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/test_touch_link_highlight.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+  <body>
+    <a href="http://www.test.com" style="position: absolute; left: 20px; top: 20px; width: 200px; -webkit-transform:translateZ(0)">A link to highlight</a>
+    <div style="background-color: white; position: absolute; left: 20px; top: 40px; width: 200px; height: 30px">
+      <p id="innerDiv">Not a link to click.</p>
+    </div>
+    <div style="background-color: white; position: absolute; left: 20px; top: 100px; width: 200px; height: 100px; overflow-y: scroll; overflow-x : scroll;">
+        <a href="http://www.test.com">Another link to click</a><br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+        Some stuff.<br>
+    </div>
+<!-- The following is the text for the iframe tag below:
+<html>
+<body>
+<a href="http://www.test.com" position: absolute; left: 50px; top: 30px>
+This is going to be a very long link to force the scrollbars to activate on the iFrame that will contain this page.
+</a>
+</body>
+</html>
+-->
+<!--
+    <iframe style="scrolling: yes; width : 400px; height : 100px; position: absolute; left: 20px; top: 210px;"
+     src="data:text/html,%3Chtml%3E%0A%3Cbody%3E%0A%3Ca%20href%3D%22http%3A%2F%2Fwww.test.com%22%20position%3A%20absolute%3B%20left%3A%2050px%3B%20top%3A%2030px%3E%0AThis%20is%20going%20to%20be%20a%20very%20long%20link%20to%20force%20the%20scrollbars%20to%20activate%20on%20the%20iFrame%20that%20will%20contain%20this%20page.%0A%3C%2Fa%3E%0A%3C%2Fbody%3E%0A%3C%2Fhtml%3E"></iframe>
+-->
+  </body>
+</html>
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index 2ef791908..b27c45863 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,43 @@
+2012-08-22  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Crash when finalizing WebKitWebView
+        https://bugs.webkit.org/show_bug.cgi?id=94699
+
+        Reviewed by Martin Robinson.
+
+        Create the offscreen window the first time accelerated compositing
+        is enabled, so that if it's never enabled the window won't be
+        created.
+
+        * WebCoreSupport/AcceleratedCompositingContextGL.cpp:
+        (WebKit::AcceleratedCompositingContext::AcceleratedCompositingContext):
+        (WebKit::AcceleratedCompositingContext::initialize):
+        (WebKit::AcceleratedCompositingContext::setRootCompositingLayer):
+
+2012-08-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Split WebCore/platform into a separate library
+        https://bugs.webkit.org/show_bug.cgi?id=94435
+
+        Reviewed by Martin Robinson.
+
+        More people have been reporting problems when linking WebCore because
+        the command line limit is being exceeded. Splitting WebCore a bit more
+        is in order.
+
+        * GNUmakefile.am: link libWebCorePlatform into libwebkitgtk
+
+2012-08-22  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Preferred languages and spellchecker APIs are not consistent in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=94683
+
+        Reviewed by Alejandro G. Castro.
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (updateSpellCheckingLanguages): Split the languages string to pass a
+        Vector to updateSpellCheckingLanguages().
+
 2012-08-21  Joanmarie Diggs  <jdiggs@igalia.com>
         [Gtk] No accessible caret-moved events found in certain content
         https://bugs.webkit.org/show_bug.cgi?id=72811
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index 00473f9d5..859508e38 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -77,6 +77,7 @@ libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LDFL
 libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIBADD = \
 	-lpthread \
 	libWebCore.la \
+	libWebCorePlatform.la \
 	libWebCoreModules.la \
 	libWebCoreGtk.la \
 	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
diff --git a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
index 29ba349d8..9a2cae0ad 100644
--- a/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/AcceleratedCompositingContextGL.cpp
@@ -50,7 +50,6 @@ namespace WebKit {
 AcceleratedCompositingContext::AcceleratedCompositingContext(WebKitWebView* webView)
     : m_webView(webView)
     , m_layerFlushTimerCallbackId(0)
-    , m_redirectedWindow(RedirectedXCompositeWindow::create(IntSize(1, 1)))
     , m_lastFlushTime(0)
     , m_redrawPendingTime(0)
     , m_needsExtraFlush(false)
@@ -69,10 +68,14 @@ void AcceleratedCompositingContext::initialize()
     if (m_rootLayer)
         return;
 
+    IntSize pageSize = getWebViewSize(m_webView);
+    if (!m_redirectedWindow)
+        m_redirectedWindow = RedirectedXCompositeWindow::create(pageSize);
+    else
+        m_redirectedWindow->resize(pageSize);
+
     m_rootLayer = GraphicsLayer::create(this);
     m_rootLayer->setDrawsContent(false);
-
-    IntSize pageSize = getWebViewSize(m_webView);
     m_rootLayer->setSize(pageSize);
 
     // The non-composited contents are a child of the root layer.
@@ -239,9 +242,6 @@ void AcceleratedCompositingContext::setRootCompositingLayer(GraphicsLayer* graph
         return;
     }
 
-    if (graphicsLayer && !enabled())
-        m_redirectedWindow->resize(getWebViewSize(m_webView));
-
     // Add the accelerated layer tree hierarchy.
     initialize();
     m_nonCompositedContentLayer->removeAllChildren();
diff --git a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
index 07d34d156..83be3a3d2 100644
--- a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
+++ b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
@@ -99,7 +99,10 @@ static char** getGuessesForWord(WebKitSpellChecker* checker, const char* word, c
 static void updateSpellCheckingLanguages(WebKitSpellChecker* checker, const char* languages)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
-    priv->textCheckerEnchant->updateSpellCheckingLanguages(String::fromUTF8(languages));
+
+    Vector<String> languagesVector;
+    String::fromUTF8(languages).split(static_cast<UChar>(','), languagesVector);
+    priv->textCheckerEnchant->updateSpellCheckingLanguages(languagesVector);
 }
 
 static char* getAutocorrectSuggestionsForMisspelledWord(WebKitSpellChecker* checker, const char* word)
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 0f2e3d42d..53112e658 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,21 @@
+2012-08-22  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=94401
+        Add support for making a web site become paginated using overflow: 
+        paged-x | paged-y
+        -and corresponding-
+        <rdar://problem/11831783> 
+
+        Reviewed by Dave Hyatt.
+
+        WebCore::Page::Pagination is now just WebCore::Pagination.
+        * WebView/WebView.mm:
+        (-[WebView _setPaginationMode:]):
+        (-[WebView _paginationMode]):
+        (-[WebView _setPaginationBehavesLikeColumns:]):
+        (-[WebView _setPageLength:]):
+        (-[WebView _setGapBetweenPages:]):
+
 2012-08-15  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
 
         [css3-text] Add CSS3 Text decoration compile flag
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index 3391ab967..2bfaf2481 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -2806,22 +2806,22 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!page)
         return;
 
-    Page::Pagination pagination = page->pagination();
+    Pagination pagination = page->pagination();
     switch (paginationMode) {
     case WebPaginationModeUnpaginated:
-        pagination.mode = Page::Pagination::Unpaginated;
+        pagination.mode = Pagination::Unpaginated;
         break;
     case WebPaginationModeLeftToRight:
-        pagination.mode = Page::Pagination::LeftToRightPaginated;
+        pagination.mode = Pagination::LeftToRightPaginated;
         break;
     case WebPaginationModeRightToLeft:
-        pagination.mode = Page::Pagination::RightToLeftPaginated;
+        pagination.mode = Pagination::RightToLeftPaginated;
         break;
     case WebPaginationModeTopToBottom:
-        pagination.mode = Page::Pagination::TopToBottomPaginated;
+        pagination.mode = Pagination::TopToBottomPaginated;
         break;
     case WebPaginationModeBottomToTop:
-        pagination.mode = Page::Pagination::BottomToTopPaginated;
+        pagination.mode = Pagination::BottomToTopPaginated;
         break;
     default:
         return;
@@ -2837,15 +2837,15 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
         return WebPaginationModeUnpaginated;
 
     switch (page->pagination().mode) {
-    case Page::Pagination::Unpaginated:
+    case Pagination::Unpaginated:
         return WebPaginationModeUnpaginated;
-    case Page::Pagination::LeftToRightPaginated:
+    case Pagination::LeftToRightPaginated:
         return WebPaginationModeLeftToRight;
-    case Page::Pagination::RightToLeftPaginated:
+    case Pagination::RightToLeftPaginated:
         return WebPaginationModeRightToLeft;
-    case Page::Pagination::TopToBottomPaginated:
+    case Pagination::TopToBottomPaginated:
         return WebPaginationModeTopToBottom;
-    case Page::Pagination::BottomToTopPaginated:
+    case Pagination::BottomToTopPaginated:
         return WebPaginationModeBottomToTop;
     }
 
@@ -2859,7 +2859,7 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!page)
         return;
 
-    Page::Pagination pagination = page->pagination();
+    Pagination pagination = page->pagination();
     pagination.behavesLikeColumns = behavesLikeColumns;
 }
 
@@ -2878,7 +2878,7 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!page)
         return;
 
-    Page::Pagination pagination = page->pagination();
+    Pagination pagination = page->pagination();
     pagination.pageLength = pageLength;
 
     page->setPagination(pagination);
@@ -2899,7 +2899,7 @@ static PassOwnPtr<Vector<String> > toStringVector(NSArray* patterns)
     if (!page)
         return;
 
-    Page::Pagination pagination = page->pagination();
+    Pagination pagination = page->pagination();
     pagination.gap = pageGap;
     page->setPagination(pagination);
 }
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index 774da5d31..741457f47 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -261,6 +261,12 @@ void QWebSettingsPrivate::apply()
         settings->setTiledBackingStoreEnabled(value);
 #endif
 
+#if ENABLE(SMOOTH_SCROLLING)
+        value = attributes.value(QWebSettings::ScrollAnimatorEnabled,
+                                      global->attributes.value(QWebSettings::ScrollAnimatorEnabled));
+        settings->setEnableScrollAnimator(value);
+#endif
+
         value = attributes.value(QWebSettings::SiteSpecificQuirksEnabled,
                                       global->attributes.value(QWebSettings::SiteSpecificQuirksEnabled));
         settings->setNeedsSiteSpecificQuirks(value);
@@ -473,6 +479,7 @@ QWebSettings* QWebSettings::globalSettings()
         This is disabled by default.
     \value SiteSpecificQuirksEnabled This setting enables WebKit's workaround for broken sites. It is
         enabled by default.
+    \value ScrollAnimatorEnabled This setting enables animated scrolling. It is disabled by default.
 */
 
 /*!
@@ -524,6 +531,7 @@ QWebSettings::QWebSettings()
     d->attributes.insert(QWebSettings::TiledBackingStoreEnabled, false);
     d->attributes.insert(QWebSettings::FrameFlatteningEnabled, false);
     d->attributes.insert(QWebSettings::SiteSpecificQuirksEnabled, true);
+    d->attributes.insert(QWebSettings::ScrollAnimatorEnabled, false);
     d->offlineStorageDefaultQuota = 5 * 1024 * 1024;
     d->defaultTextEncoding = QLatin1String("iso-8859-1");
     d->thirdPartyCookiePolicy = AlwaysAllowThirdPartyCookies;
diff --git a/Source/WebKit/qt/Api/qwebsettings.h b/Source/WebKit/qt/Api/qwebsettings.h
index 835a72e24..5b6497afb 100644
--- a/Source/WebKit/qt/Api/qwebsettings.h
+++ b/Source/WebKit/qt/Api/qwebsettings.h
@@ -79,7 +79,8 @@ public:
         WebGLEnabled,
         CSSRegionsEnabled,
         HyperlinkAuditingEnabled,
-        CSSGridLayoutEnabled
+        CSSGridLayoutEnabled,
+        ScrollAnimatorEnabled
     };
     enum WebGraphic {
         MissingImageGraphic,
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 2b5ceb307..8c13066b1 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,47 @@
+2012-08-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r126287.
+        http://trac.webkit.org/changeset/126287
+        https://bugs.webkit.org/show_bug.cgi?id=94708
+
+        It made WK1 layout testing 3.7x slower (>1hours) (Requested by
+        ossy on #webkit).
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::objectDeleted):
+        (tst_QObjectBridge::introspectQtMethods_data):
+        (tst_QObjectBridge::introspectQtMethods):
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Optionally support smooth-scrolling on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=74926
+
+        Reviewed by Simon Hausmann.
+
+        Expose the enable scroll animator setting.
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        (QWebSettings::QWebSettings):
+        * Api/qwebsettings.h:
+
+2012-08-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] REGRESSION(r125428): fast/profiler/nested-start-and-stop-profiler.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=93897
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fixed some test expectations.
+
+        * tests/qobjectbridge/tst_qobjectbridge.cpp:
+        (tst_QObjectBridge::objectDeleted): Since runtime methods are real function objects again, we
+        can go back to testing Function.prototype.call, as it was done before r125428.
+        (tst_QObjectBridge::introspectQtMethods_data): Removed tests for the length property.
+        (tst_QObjectBridge::introspectQtMethods): Changed test expectation of the properties of
+        run-time methods back to being non-configurable, as before r125428.
+
 2012-08-21  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r126146.
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index ed76faf90..96ce099ee 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,14 @@
+2012-08-22  Nikhil Bhargava  <nbhargava@google.com>
+
+        Reduce Font.h includes across project -- improves RenderObject.h compile time
+        https://bugs.webkit.org/show_bug.cgi?id=93629
+
+        Reviewed by Eric Seidel.
+
+        Adds includes due to change in RenderStyle.h
+
+        * DOMCoreClasses.cpp:
+
 2012-08-15  Ryosuke Niwa  <rniwa@webkit.org>
 
         Update manual tests and comments to refer to TestRunner instead of LayoutTestController
diff --git a/Source/WebKit/win/DOMCoreClasses.cpp b/Source/WebKit/win/DOMCoreClasses.cpp
index 26d6ea52d..42fb2e051 100644
--- a/Source/WebKit/win/DOMCoreClasses.cpp
+++ b/Source/WebKit/win/DOMCoreClasses.cpp
@@ -37,6 +37,7 @@
 #include <WebCore/DOMWindow.h>
 #include <WebCore/Document.h>
 #include <WebCore/Element.h>
+#include <WebCore/Font.h>
 #include <WebCore/Frame.h>
 #include <WebCore/SimpleFontData.h>
 #include <WebCore/HTMLFormElement.h>
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index d147a0461..55fef59da 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,200 @@
+2012-08-23  Mikhail Pozdnyakov  <mikhail.pozdnyakov@intel.com>
+
+        [WK2] Refactoring: WebBackForwardList getters should be const
+        https://bugs.webkit.org/show_bug.cgi?id=94711
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Before the change were not consistent with each other
+        (WebBackForwardList::entries() was const but WebBackForwardList::currentIndex() was not).
+        Besides having not const getters is not a good practice in C++. (Please read
+        Scott Meyers. Effective C++ (3rd edition). ISBN: 0-321-33487-6.
+        Item 3: 'Use const whenever possible').
+
+        * UIProcess/WebBackForwardList.cpp:
+        (WebKit::WebBackForwardList::backListCount):
+        (WebKit::WebBackForwardList::forwardListCount):
+        (WebKit::WebBackForwardList::backListAsImmutableArrayWithLimit):
+        (WebKit::WebBackForwardList::forwardListAsImmutableArrayWithLimit):
+        * UIProcess/WebBackForwardList.h:
+        (WebKit::WebBackForwardList::currentIndex):
+        (WebBackForwardList):
+
+2012-08-22  Nikhil Bhargava  <nbhargava@google.com>
+
+        Reduce Font.h includes across project -- improves RenderObject.h compile time
+        https://bugs.webkit.org/show_bug.cgi?id=93629
+
+        Reviewed by Eric Seidel.
+
+        Adds includes due to change in RenderStyle.h
+
+        * WebProcess/WebPage/mac/WebPageMac.mm:
+
+2012-08-22  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=94401
+        Add support for making a web site become paginated using overflow: 
+        paged-x | paged-y
+        -and corresponding-
+        <rdar://problem/11831783> 
+
+        Reviewed by Dave Hyatt.
+
+        WebCore::Page::Pagination is now just WebCore::Pagination.
+        * Shared/WebPageCreationParameters.h:
+        (WebPageCreationParameters):
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPageSetPaginationMode):
+        (WKPageGetPaginationMode):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::WebPageProxy):
+        (WebKit::WebPageProxy::setPaginationMode):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        (WebKit::WebPageProxy::paginationMode):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setPaginationMode):
+        (WebKit::WebPage::setPaginationBehavesLikeColumns):
+        (WebKit::WebPage::setPageLength):
+        (WebKit::WebPage::setGapBetweenPages):
+        * WebProcess/WebPage/WebPage.h:
+        (WebPage):
+
+2012-08-22  Jer Noble  <jer.noble@apple.com>
+
+        Browser menu visible when calling webkitRequestFullscreen after user manually enters full screen mode
+        https://bugs.webkit.org/show_bug.cgi?id=93892
+
+        Reviewed by Eric Carlson.
+
+        Allow the full screen window to "Join All Spaces", so that once it's original full screen space is destroyed,
+        it can join the new one.
+
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[WKFullScreenWindowController _startEnterFullScreenAnimationWithDuration:]):
+
+2012-08-22  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Support posting injected bundle messages to a page
+        https://bugs.webkit.org/show_bug.cgi?id=94630
+
+        Reviewed by Sam Weinig.
+
+        * Shared/APIClientTraits.cpp:
+        * Shared/APIClientTraits.h:
+        * Shared/CoreIPCSupport/InjectedBundleMessageKinds.h:
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPagePostMessageToInjectedBundle):
+        * UIProcess/API/C/WKPage.h:
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::postMessageToInjectedBundle):
+        * UIProcess/WebPageProxy.h:
+        * WebProcess/InjectedBundle/API/c/WKBundle.h:
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::didReceiveMessageToPage):
+        (WebKit::InjectedBundle::didReceiveMessage):
+        * WebProcess/InjectedBundle/InjectedBundle.h:
+        * WebProcess/InjectedBundle/InjectedBundleClient.cpp:
+        (WebKit::InjectedBundleClient::didReceiveMessageToPage):
+        * WebProcess/InjectedBundle/InjectedBundleClient.h:
+        (InjectedBundleClient):
+        Added a PostMessageToPage injected bundle message type, with all associated
+        machinery. API is WKPagePostMessageToInjectedBundle(), and an associated
+        didReceiveMessageToPage() injected bundle client function.
+
+        * WebProcess/qt/QtBuiltinBundle.cpp: (WebKit::QtBuiltinBundle::initialize):
+        Updated for new client API.
+
+        * UIProcess/WebContext.cpp: (WebKit::WebContext::postMessageToInjectedBundle):
+        Implemented multiple process model case.
+
+2012-08-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Split WebCore/platform into a separate library
+        https://bugs.webkit.org/show_bug.cgi?id=94435
+
+        Reviewed by Martin Robinson.
+
+        More people have been reporting problems when linking WebCore because
+        the command line limit is being exceeded. Splitting WebCore a bit more
+        is in order.
+
+        * GNUmakefile.am: link libWebCorePlatform into libwebkit2gtk
+
+2012-08-22  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Preferred languages and spellchecker APIs are not consistent in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=94683
+
+        Reviewed by Alejandro G. Castro.
+
+        Change spell-checker and preferred languages API to use a GStrv
+        instead of a comma-separated string and GList. This makes the API
+        more consistent and convenient to use.
+
+        * UIProcess/API/gtk/WebKitTextChecker.cpp:
+        (WebKitTextChecker::getSpellCheckingLanguages): Return a
+        Vector<String> instead of a String.
+        (WebKitTextChecker::setSpellCheckingLanguages): Receive a
+        Vector<String> instead of a String.
+        * UIProcess/API/gtk/WebKitTextChecker.h:
+        (WebKitTextChecker): Use a GPtrArray to cache languages.
+        * UIProcess/API/gtk/WebKitWebContext.cpp:
+        (webkit_web_context_get_spell_checking_languages):
+        (webkit_web_context_set_spell_checking_languages):
+        (webkit_web_context_set_preferred_languages):
+        * UIProcess/API/gtk/WebKitWebContext.h:
+        * UIProcess/API/gtk/tests/TestWebKitWebContext.cpp:
+        (testWebContextSpellChecker):
+        (testWebContextLanguages):
+
+2012-08-22  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][WK2] Enable runtime enabled features: DeviceMotion and DeviceOrientation
+        https://bugs.webkit.org/show_bug.cgi?id=94692
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * WebProcess/qt/WebProcessQt.cpp:
+        (WebKit::WebProcess::platformInitializeWebProcess):
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Wrong default for new ScrollAnimatorEnabled preference.
+
+        Reviewed by Simon Hausmann.
+
+        ScrollAnimatorEnabled introduced in r126291, should default to 'true'
+        to preserve existing behaviour on WK2 platforms that already enabled 
+        SMOOTH_SCROLLING unconditionally.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Unreviewed, build fixup for r126291.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Optionally support smooth-scrolling on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=74926
+
+        Reviewed by Simon Hausmann.
+
+        Expose scroll-animator preference, but ensure animated smooth scrolling
+        on the web process side is disabled when scrolling has been delegated
+        to the UI process.
+
+        * Shared/WebPreferencesStore.h:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setResizesToContentsUsingLayoutSize):
+        (WebKit::WebPage::updatePreferences):
+
 2012-08-22  Luiz Agostini  <luiz.agostini@nokia.com>
 
         [Qt] Avoid using WebKit macros in qrawwebview_p.h
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index ba0ac6955..7468a36aa 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -158,6 +158,7 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LDF
 libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIBADD = \
 	-lpthread \
 	libWebCore.la \
+	libWebCorePlatform.la \
 	libWebCoreModules.la \
 	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
 	libWebCoreGtk.la \
@@ -475,6 +476,7 @@ Programs_WebKitPluginProcess_LDADD = \
 	-lpthread \
 	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
 	libWebCore.la \
+	libWebCorePlatform.la \
 	libWebCoreGtk2.la \
 	$(CAIRO_LIBS) \
 	$(COVERAGE_LDFLAGS) \
diff --git a/Source/WebKit2/Shared/APIClientTraits.cpp b/Source/WebKit2/Shared/APIClientTraits.cpp
index 1926be817..ad3d22091 100644
--- a/Source/WebKit2/Shared/APIClientTraits.cpp
+++ b/Source/WebKit2/Shared/APIClientTraits.cpp
@@ -31,6 +31,11 @@
 
 namespace WebKit {
 
+const size_t APIClientTraits<WKBundleClient>::interfaceSizesByVersion[] = {
+    offsetof(WKBundleClient, didReceiveMessageToPage),
+    sizeof(WKBundleClient)
+};
+
 const size_t APIClientTraits<WKBundlePageLoaderClient>::interfaceSizesByVersion[] = {
     offsetof(WKBundlePageLoaderClient, didLayoutForFrame),
     offsetof(WKBundlePageLoaderClient, didFinishProgress),
diff --git a/Source/WebKit2/Shared/APIClientTraits.h b/Source/WebKit2/Shared/APIClientTraits.h
index e2cce1781..7352b5667 100644
--- a/Source/WebKit2/Shared/APIClientTraits.h
+++ b/Source/WebKit2/Shared/APIClientTraits.h
@@ -26,6 +26,7 @@
 #ifndef APIClientTraits_h
 #define APIClientTraits_h
 
+#include "WKBundle.h"
 #include "WKBundlePage.h"
 #include "WKContext.h"
 #include "WKPage.h"
@@ -37,6 +38,10 @@ template <typename ClientInterface> struct APIClientTraits {
 };
 template <typename ClientInterface> const size_t APIClientTraits<ClientInterface>::interfaceSizesByVersion[] = { sizeof(ClientInterface) };
 
+template<> struct APIClientTraits<WKBundleClient> {
+    static const size_t interfaceSizesByVersion[2];
+};
+
 template<> struct APIClientTraits<WKBundlePageLoaderClient> {
     static const size_t interfaceSizesByVersion[4];
 };
diff --git a/Source/WebKit2/Shared/CoreIPCSupport/InjectedBundleMessageKinds.h b/Source/WebKit2/Shared/CoreIPCSupport/InjectedBundleMessageKinds.h
index 1ddf0bf95..a1afd6987 100644
--- a/Source/WebKit2/Shared/CoreIPCSupport/InjectedBundleMessageKinds.h
+++ b/Source/WebKit2/Shared/CoreIPCSupport/InjectedBundleMessageKinds.h
@@ -33,7 +33,8 @@
 namespace InjectedBundleMessage {
 
 enum Kind {
-    PostMessage
+    PostMessage,
+    PostMessageToPage
 };
 
 }
diff --git a/Source/WebKit2/Shared/WebPageCreationParameters.h b/Source/WebKit2/Shared/WebPageCreationParameters.h
index ce85dceca..97e88b607 100644
--- a/Source/WebKit2/Shared/WebPageCreationParameters.h
+++ b/Source/WebKit2/Shared/WebPageCreationParameters.h
@@ -67,7 +67,7 @@ struct WebPageCreationParameters {
     bool useFixedLayout;
     WebCore::IntSize fixedLayoutSize;
 
-    WebCore::Page::Pagination::Mode paginationMode;
+    WebCore::Pagination::Mode paginationMode;
     bool paginationBehavesLikeColumns;
     double pageLength;
     double gapBetweenPages;
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.h b/Source/WebKit2/Shared/WebPreferencesStore.h
index af0812d40..569c5186d 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.h
+++ b/Source/WebKit2/Shared/WebPreferencesStore.h
@@ -48,6 +48,12 @@ namespace WebKit {
 #define DEFAULT_WEBKIT_TABSTOLINKS_ENABLED false
 #endif
 
+#if ENABLE(SMOOTH_SCROLLING) && !PLATFORM(QT)
+#define DEFAULT_WEBKIT_SCROLL_ANIMATOR_ENABLED true
+#else
+#define DEFAULT_WEBKIT_SCROLL_ANIMATOR_ENABLED false
+#endif
+
 #define FOR_EACH_WEBKIT_BOOL_PREFERENCE(macro) \
     macro(JavaScriptEnabled, javaScriptEnabled, Bool, bool, true) \
     macro(LoadsImagesAutomatically, loadsImagesAutomatically, Bool, bool, true) \
@@ -119,6 +125,7 @@ namespace WebKit {
     macro(ArtificialPluginInitializationDelayEnabled, artificialPluginInitializationDelayEnabled, Bool, bool, false) \
     macro(ScrollingPerformanceLoggingEnabled, scrollingPerformanceLoggingEnabled, Bool, bool, false) \
     macro(ThirdPartyStorageBlockingEnabled, thirdPartyStorageBlockingEnabled, Bool, bool, false) \
+    macro(ScrollAnimatorEnabled, scrollAnimatorEnabled, Bool, bool, DEFAULT_WEBKIT_SCROLL_ANIMATOR_ENABLED) \
     \
 
 #define FOR_EACH_WEBKIT_DOUBLE_PREFERENCE(macro) \
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.cpp b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
index a53a83161..437179bfb 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
@@ -352,22 +352,22 @@ bool WKPageIsPinnedToRightSide(WKPageRef pageRef)
 
 void WKPageSetPaginationMode(WKPageRef pageRef, WKPaginationMode paginationMode)
 {
-    Page::Pagination::Mode mode;
+    Pagination::Mode mode;
     switch (paginationMode) {
     case kWKPaginationModeUnpaginated:
-        mode = Page::Pagination::Unpaginated;
+        mode = Pagination::Unpaginated;
         break;
     case kWKPaginationModeLeftToRight:
-        mode = Page::Pagination::LeftToRightPaginated;
+        mode = Pagination::LeftToRightPaginated;
         break;
     case kWKPaginationModeRightToLeft:
-        mode = Page::Pagination::RightToLeftPaginated;
+        mode = Pagination::RightToLeftPaginated;
         break;
     case kWKPaginationModeTopToBottom:
-        mode = Page::Pagination::TopToBottomPaginated;
+        mode = Pagination::TopToBottomPaginated;
         break;
     case kWKPaginationModeBottomToTop:
-        mode = Page::Pagination::BottomToTopPaginated;
+        mode = Pagination::BottomToTopPaginated;
         break;
     default:
         return;
@@ -378,15 +378,15 @@ void WKPageSetPaginationMode(WKPageRef pageRef, WKPaginationMode paginationMode)
 WKPaginationMode WKPageGetPaginationMode(WKPageRef pageRef)
 {
     switch (toImpl(pageRef)->paginationMode()) {
-    case Page::Pagination::Unpaginated:
+    case Pagination::Unpaginated:
         return kWKPaginationModeUnpaginated;
-    case Page::Pagination::LeftToRightPaginated:
+    case Pagination::LeftToRightPaginated:
         return kWKPaginationModeLeftToRight;
-    case Page::Pagination::RightToLeftPaginated:
+    case Pagination::RightToLeftPaginated:
         return kWKPaginationModeRightToLeft;
-    case Page::Pagination::TopToBottomPaginated:
+    case Pagination::TopToBottomPaginated:
         return kWKPaginationModeTopToBottom;
-    case Page::Pagination::BottomToTopPaginated:
+    case Pagination::BottomToTopPaginated:
         return kWKPaginationModeBottomToTop;
     }
 
@@ -712,3 +712,9 @@ void WKPageSetMediaVolume(WKPageRef page, float volume)
 {
     toImpl(page)->setMediaVolume(volume);    
 }
+
+void WKPagePostMessageToInjectedBundle(WKPageRef pageRef, WKStringRef messageNameRef, WKTypeRef messageBodyRef)
+{
+    toImpl(pageRef)->postMessageToInjectedBundle(toImpl(messageNameRef)->string(), toImpl(messageBodyRef));
+}
+
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index ab3b8eede..f7946080b 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -489,6 +489,8 @@ typedef void (*WKPageValidateCommandCallback)(WKStringRef command, bool isEnable
 WK_EXPORT void WKPageValidateCommand(WKPageRef page, WKStringRef command, void* context, WKPageValidateCommandCallback callback);
 WK_EXPORT void WKPageExecuteCommand(WKPageRef page, WKStringRef command);
 
+WK_EXPORT void WKPagePostMessageToInjectedBundle(WKPageRef page, WKStringRef messageName, WKTypeRef messageBody);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp
index 5ae62c6fd..39f402227 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.cpp
@@ -29,8 +29,6 @@
 #if ENABLE(SPELLCHECK)
 
 #include "WebKitPrivate.h"
-#include <wtf/Vector.h>
-#include <wtf/text/CString.h>
 
 using namespace WebKit;
 
@@ -140,15 +138,25 @@ void WebKitTextChecker::setSpellCheckingEnabled(bool enabled)
     WKTextCheckerContinuousSpellCheckingEnabledStateChanged(enabled);
 }
 
-const CString& WebKitTextChecker::getSpellCheckingLanguages()
+const char* const* WebKitTextChecker::getSpellCheckingLanguages()
 {
-    String spellCheckingLanguages = m_textChecker->getSpellCheckingLanguages();
-    m_spellCheckingLanguages = spellCheckingLanguages.isEmpty() ? CString() : spellCheckingLanguages.utf8();
-    return m_spellCheckingLanguages;
+    Vector<String> spellCheckingLanguages = m_textChecker->getSpellCheckingLanguages();
+    if (spellCheckingLanguages.isEmpty())
+        return 0;
+
+    m_spellCheckingLanguages = adoptGRef(g_ptr_array_new_with_free_func(g_free));
+    for (size_t i = 0; i < spellCheckingLanguages.size(); ++i)
+        g_ptr_array_add(m_spellCheckingLanguages.get(), g_strdup(spellCheckingLanguages[i].utf8().data()));
+    g_ptr_array_add(m_spellCheckingLanguages.get(), 0);
+
+    return reinterpret_cast<char**>(m_spellCheckingLanguages->pdata);
 }
 
-void WebKitTextChecker::setSpellCheckingLanguages(const CString& languages)
+void WebKitTextChecker::setSpellCheckingLanguages(const char* const* languages)
 {
-    m_textChecker->updateSpellCheckingLanguages(String::fromUTF8(languages.data()));
+    Vector<String> spellCheckingLanguages;
+    for (size_t i = 0; languages[i]; ++i)
+        spellCheckingLanguages.append(String::fromUTF8(languages[i]));
+    m_textChecker->updateSpellCheckingLanguages(spellCheckingLanguages);
 }
 #endif // ENABLE(SPELLCHECK)
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h
index 3cca5622a..15f764f61 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitTextChecker.h
@@ -26,6 +26,7 @@
 #include <wtf/FastAllocBase.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
+#include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
 
 class WebKitTextChecker {
@@ -44,14 +45,14 @@ public:
     void ignoreWord(const String& word);
 
     // To be called from WebKitWebContext only.
-    const CString& getSpellCheckingLanguages();
-    void setSpellCheckingLanguages(const CString& spellCheckingLanguages);
+    const char* const* getSpellCheckingLanguages();
+    void setSpellCheckingLanguages(const char* const* spellCheckingLanguages);
 
 private:
     WebKitTextChecker();
 
     OwnPtr<WebCore::TextCheckerEnchant> m_textChecker;
-    CString m_spellCheckingLanguages;
+    GRefPtr<GPtrArray> m_spellCheckingLanguages;
     bool m_spellCheckingEnabled;
 };
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
index 211133f0a..e9231e47b 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
@@ -495,24 +495,20 @@ void webkit_web_context_set_spell_checking_enabled(WebKitWebContext* context, gb
  * @context: a #WebKitWebContext
  *
  * Get the the list of spell checking languages associated with
- * @context separated by commas, or %NULL if no languages have been
- * previously set.
-
+ * @context, or %NULL if no languages have been previously set.
+ *
  * See webkit_web_context_set_spell_checking_languages() for more
  * details on the format of the languages in the list.
  *
- * Returns: (transfer none): A comma separated list of languages if
- * available, or %NULL otherwise.
+ * Returns: (array zero-terminated=1) (element-type utf8) (transfer none): A %NULL-terminated
+ *    array of languages if available, or %NULL otherwise.
  */
-const gchar* webkit_web_context_get_spell_checking_languages(WebKitWebContext* context)
+const gchar* const* webkit_web_context_get_spell_checking_languages(WebKitWebContext* context)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_CONTEXT(context), 0);
 
 #if ENABLE(SPELLCHECK)
-    CString spellCheckingLanguages = context->priv->textChecker->getSpellCheckingLanguages();
-    if (spellCheckingLanguages.isNull())
-        return 0;
-    return spellCheckingLanguages.data();
+    return context->priv->textChecker->getSpellCheckingLanguages();
 #else
     return 0;
 #endif
@@ -521,11 +517,10 @@ const gchar* webkit_web_context_get_spell_checking_languages(WebKitWebContext* c
 /**
  * webkit_web_context_set_spell_checking_languages:
  * @context: a #WebKitWebContext
- * @languages: new list of spell checking languages separated by
- * commas
+ * @languages: (array zero-terminated=1) (transfer none): a %NULL-terminated list of spell checking languages
  *
  * Set the list of spell checking languages to be used for spell
- * checking, separated by commas.
+ * checking.
  *
  * The locale string typically is in the form lang_COUNTRY, where lang
  * is an ISO-639 language code, and COUNTRY is an ISO-3166 country code.
@@ -536,7 +531,7 @@ const gchar* webkit_web_context_get_spell_checking_languages(WebKitWebContext* c
  * least once in order to properly enable the spell checking feature
  * in WebKit.
  */
-void webkit_web_context_set_spell_checking_languages(WebKitWebContext* context, const gchar* languages)
+void webkit_web_context_set_spell_checking_languages(WebKitWebContext* context, const gchar* const* languages)
 {
     g_return_if_fail(WEBKIT_IS_WEB_CONTEXT(context));
     g_return_if_fail(languages);
@@ -549,23 +544,23 @@ void webkit_web_context_set_spell_checking_languages(WebKitWebContext* context,
 /**
  * webkit_web_context_set_preferred_languages:
  * @context: a #WebKitWebContext
- * @languages: (element-type utf8): a #GList of language identifiers
+ * @languages: (allow-none) (array zero-terminated=1) (element-type utf8) (transfer none): a %NULL-terminated list of language identifiers
  *
  * Set the list of preferred languages, sorted from most desirable
  * to least desirable. The list will be used to build the "Accept-Language"
  * header that will be included in the network requests started by
  * the #WebKitWebContext.
  */
-void webkit_web_context_set_preferred_languages(WebKitWebContext* context, GList* languageList)
+void webkit_web_context_set_preferred_languages(WebKitWebContext* context, const gchar* const* languageList)
 {
     g_return_if_fail(WEBKIT_IS_WEB_CONTEXT(context));
 
-    if (!languageList)
+    if (!languageList || !g_strv_length(const_cast<char**>(languageList)))
         return;
 
     Vector<String> languages;
-    for (GList* iter = languageList; iter; iter = g_list_next(iter))
-        languages.append(String::fromUTF8(static_cast<char*>(iter->data)).lower().replace("_", "-"));
+    for (size_t i = 0; languageList[i]; ++i)
+        languages.append(String::fromUTF8(languageList[i]).lower().replace("_", "-"));
 
     WebCore::overrideUserPreferredLanguages(languages);
     WebCore::languageDidChange();
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h
index 3c97c71cb..a2bf573f5 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h
@@ -140,16 +140,16 @@ webkit_web_context_get_spell_checking_enabled       (WebKitWebContext
 WEBKIT_API void
 webkit_web_context_set_spell_checking_enabled       (WebKitWebContext              *context,
                                                      gboolean                       enabled);
-WEBKIT_API const gchar *
+WEBKIT_API const gchar * const *
 webkit_web_context_get_spell_checking_languages     (WebKitWebContext              *context);
 
 WEBKIT_API void
 webkit_web_context_set_spell_checking_languages     (WebKitWebContext              *context,
-                                                     const gchar                   *languages);
+                                                     const gchar * const           *languages);
 
 WEBKIT_API void
 webkit_web_context_set_preferred_languages          (WebKitWebContext              *context,
-                                                     GList                         *languages);
+                                                     const gchar * const           *languages);
 
 G_END_DECLS
 
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp
index 27f6a5447..7c712244e 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitWebContext.cpp
@@ -210,26 +210,44 @@ static void testWebContextSpellChecker(Test* test, gconstpointer)
     WebKitWebContext* webContext = webkit_web_context_get_default();
 
     // Check what happens if no spell checking language has been set.
-    const gchar* currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
+    const gchar* const* currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
     g_assert(!currentLanguage);
 
     // Set the language to a specific one.
-    webkit_web_context_set_spell_checking_languages(webContext, "en_US");
+    GRefPtr<GPtrArray> languages = adoptGRef(g_ptr_array_new());
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("en_US")));
+    g_ptr_array_add(languages.get(), 0);
+    webkit_web_context_set_spell_checking_languages(webContext, reinterpret_cast<const char* const*>(languages->pdata));
     currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
-    g_assert_cmpstr(currentLanguage, ==, "en_US");
+    g_assert_cmpuint(g_strv_length(const_cast<char**>(currentLanguage)), ==, 1);
+    g_assert_cmpstr(currentLanguage[0], ==, "en_US");
 
     // Set the language string to list of valid languages.
-    webkit_web_context_set_spell_checking_languages(webContext, "en_GB,en_US");
+    g_ptr_array_remove_index_fast(languages.get(), languages->len - 1);
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("en_GB")));
+    g_ptr_array_add(languages.get(), 0);
+    webkit_web_context_set_spell_checking_languages(webContext, reinterpret_cast<const char* const*>(languages->pdata));
     currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
-    g_assert_cmpstr(currentLanguage, ==, "en_GB,en_US");
+    g_assert_cmpuint(g_strv_length(const_cast<char**>(currentLanguage)), ==, 2);
+    g_assert_cmpstr(currentLanguage[0], ==, "en_US");
+    g_assert_cmpstr(currentLanguage[1], ==, "en_GB");
 
     // Try passing a wrong language along with good ones.
-    webkit_web_context_set_spell_checking_languages(webContext, "bd_WR,en_US,en_GB");
+    g_ptr_array_remove_index_fast(languages.get(), languages->len - 1);
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("bd_WR")));
+    g_ptr_array_add(languages.get(), 0);
+    webkit_web_context_set_spell_checking_languages(webContext, reinterpret_cast<const char* const*>(languages->pdata));
     currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
-    g_assert_cmpstr(currentLanguage, ==, "en_US,en_GB");
+    g_assert_cmpuint(g_strv_length(const_cast<char**>(currentLanguage)), ==, 2);
+    g_assert_cmpstr(currentLanguage[0], ==, "en_US");
+    g_assert_cmpstr(currentLanguage[1], ==, "en_GB");
 
     // Try passing a list with only wrong languages.
-    webkit_web_context_set_spell_checking_languages(webContext, "bd_WR,wr_BD");
+    languages = adoptGRef(g_ptr_array_new());
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("bd_WR")));
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("wr_BD")));
+    g_ptr_array_add(languages.get(), 0);
+    webkit_web_context_set_spell_checking_languages(webContext, reinterpret_cast<const char* const*>(languages->pdata));
     currentLanguage = webkit_web_context_get_spell_checking_languages(webContext);
     g_assert(!currentLanguage);
 
@@ -250,11 +268,12 @@ static void testWebContextLanguages(WebViewTest* test, gconstpointer)
     g_assert_cmpuint(mainResourceDataSize, ==, strlen(expectedDefaultLanguage));
     g_assert(!strncmp(mainResourceData, expectedDefaultLanguage, mainResourceDataSize));
 
-    GList* languages = g_list_prepend(0, const_cast<gpointer>(static_cast<const void*>("dE")));
-    languages = g_list_prepend(languages, const_cast<gpointer>(static_cast<const void*>("ES_es")));
-    languages = g_list_prepend(languages, const_cast<gpointer>(static_cast<const void*>("en")));
-    webkit_web_context_set_preferred_languages(webkit_web_context_get_default(), languages);
-    g_list_free(languages);
+    GRefPtr<GPtrArray> languages = adoptGRef(g_ptr_array_new());
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("en")));
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("ES_es")));
+    g_ptr_array_add(languages.get(), const_cast<gpointer>(static_cast<const void*>("dE")));
+    g_ptr_array_add(languages.get(), 0);
+    webkit_web_context_set_preferred_languages(webkit_web_context_get_default(), reinterpret_cast<const char* const*>(languages->pdata));
 
     static const char* expectedLanguages = "en, es-es;q=0.90, de;q=0.80";
     test->loadURI(kServer->getURIForPath("/").data());
diff --git a/Source/WebKit2/UIProcess/WebBackForwardList.cpp b/Source/WebKit2/UIProcess/WebBackForwardList.cpp
index 00e8f4c01..763023d07 100644
--- a/Source/WebKit2/UIProcess/WebBackForwardList.cpp
+++ b/Source/WebKit2/UIProcess/WebBackForwardList.cpp
@@ -186,21 +186,21 @@ WebBackForwardListItem* WebBackForwardList::itemAtIndex(int index)
     return m_entries[index + m_currentIndex].get();
 }
 
-int WebBackForwardList::backListCount()
+int WebBackForwardList::backListCount() const
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
     return m_page && m_hasCurrentIndex ? m_currentIndex : 0;
 }
 
-int WebBackForwardList::forwardListCount()
+int WebBackForwardList::forwardListCount() const
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
     return m_page && m_hasCurrentIndex ? m_entries.size() - (m_currentIndex + 1) : 0;
 }
 
-PassRefPtr<ImmutableArray> WebBackForwardList::backListAsImmutableArrayWithLimit(unsigned limit)
+PassRefPtr<ImmutableArray> WebBackForwardList::backListAsImmutableArrayWithLimit(unsigned limit) const
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
@@ -224,7 +224,7 @@ PassRefPtr<ImmutableArray> WebBackForwardList::backListAsImmutableArrayWithLimit
     return ImmutableArray::adopt(vector);
 }
 
-PassRefPtr<ImmutableArray> WebBackForwardList::forwardListAsImmutableArrayWithLimit(unsigned limit)
+PassRefPtr<ImmutableArray> WebBackForwardList::forwardListAsImmutableArrayWithLimit(unsigned limit) const
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
diff --git a/Source/WebKit2/UIProcess/WebBackForwardList.h b/Source/WebKit2/UIProcess/WebBackForwardList.h
index 16a562d03..d78ed5a67 100644
--- a/Source/WebKit2/UIProcess/WebBackForwardList.h
+++ b/Source/WebKit2/UIProcess/WebBackForwardList.h
@@ -70,12 +70,12 @@ public:
     
     const BackForwardListItemVector& entries() const { return m_entries; }
 
-    uint32_t currentIndex() { return m_currentIndex; }
-    int backListCount();
-    int forwardListCount();
+    uint32_t currentIndex() const { return m_currentIndex; }
+    int backListCount() const;
+    int forwardListCount() const;
 
-    PassRefPtr<ImmutableArray> backListAsImmutableArrayWithLimit(unsigned limit);
-    PassRefPtr<ImmutableArray> forwardListAsImmutableArrayWithLimit(unsigned limit);
+    PassRefPtr<ImmutableArray> backListAsImmutableArrayWithLimit(unsigned limit) const;
+    PassRefPtr<ImmutableArray> forwardListAsImmutableArrayWithLimit(unsigned limit) const;
 
 #if USE(CF)
     CFDictionaryRef createCFDictionaryRepresentation(WebPageProxy::WebPageProxySessionStateFilterCallback, void* context) const;
diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index e024f175e..b5bbea4cd 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -514,17 +514,19 @@ DownloadProxy* WebContext::download(WebPageProxy* initiatingPage, const Resource
 
 void WebContext::postMessageToInjectedBundle(const String& messageName, APIObject* messageBody)
 {
-    if (m_processModel == ProcessModelSharedSecondaryProcess) {
-        if (m_processes.isEmpty() || !m_processes[0]->canSendMessage()) {
+    if (m_processes.isEmpty()) {
+        m_pendingMessagesToPostToInjectedBundle.append(std::make_pair(messageName, messageBody));
+        return;
+    }
+
+    for (size_t i = 0; i < m_processes.size(); ++i) {
+        // FIXME (Multi-WebProcess): Evolve m_pendingMessagesToPostToInjectedBundle to work with multiple secondary processes.
+        if (!m_processes[i]->canSendMessage()) {
             m_pendingMessagesToPostToInjectedBundle.append(std::make_pair(messageName, messageBody));
-            return;
+            continue;
         }
-
-        // FIXME: We should consider returning false from this function if the messageBody cannot
-        // be encoded.
-        m_processes[0]->deprecatedSend(InjectedBundleMessage::PostMessage, 0, CoreIPC::In(messageName, WebContextUserMessageEncoder(messageBody)));
-    } else {
-        // FIXME (Multi-WebProcess): Implement.
+        // FIXME: We should consider returning false from this function if the messageBody cannot be encoded.
+        m_processes[i]->deprecatedSend(InjectedBundleMessage::PostMessage, 0, CoreIPC::In(messageName, WebContextUserMessageEncoder(messageBody)));
     }
 }
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index 8d5cc32df..c88c6655a 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -34,6 +34,7 @@
 #include "DrawingAreaProxy.h"
 #include "EventDispatcherMessages.h"
 #include "FindIndicator.h"
+#include "InjectedBundleMessageKinds.h"
 #include "Logging.h"
 #include "MessageID.h"
 #include "NativeWebKeyboardEvent.h"
@@ -182,7 +183,7 @@ WebPageProxy::WebPageProxy(PageClient* pageClient, PassRefPtr<WebProcessProxy> p
     , m_drawsTransparentBackground(false)
     , m_areMemoryCacheClientCallsEnabled(true)
     , m_useFixedLayout(false)
-    , m_paginationMode(Page::Pagination::Unpaginated)
+    , m_paginationMode(Pagination::Unpaginated)
     , m_paginationBehavesLikeColumns(false)
     , m_pageLength(0)
     , m_gapBetweenPages(0)
@@ -1501,7 +1502,7 @@ void WebPageProxy::setFixedLayoutSize(const IntSize& size)
     m_process->send(Messages::WebPage::SetFixedLayoutSize(size), m_pageID);
 }
 
-void WebPageProxy::setPaginationMode(WebCore::Page::Pagination::Mode mode)
+void WebPageProxy::setPaginationMode(WebCore::Pagination::Mode mode)
 {
     if (mode == m_paginationMode)
         return;
@@ -2887,6 +2888,12 @@ NativeWebMouseEvent* WebPageProxy::currentlyProcessedMouseDownEvent()
     return m_currentlyProcessedMouseDownEvent.get();
 }
 
+void WebPageProxy::postMessageToInjectedBundle(const String& messageName, APIObject* messageBody)
+{
+    // FIXME: We should consider returning false from this function if the messageBody cannot be encoded.
+    process()->deprecatedSend(InjectedBundleMessage::PostMessageToPage, m_pageID, CoreIPC::In(messageName, WebContextUserMessageEncoder(messageBody)));
+}
+
 #if PLATFORM(GTK)
 void WebPageProxy::failedToShowPopupMenu()
 {
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index b88a5d498..9a19a566b 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -488,8 +488,8 @@ public:
     bool isPinnedToLeftSide() const { return m_mainFrameIsPinnedToLeftSide; }
     bool isPinnedToRightSide() const { return m_mainFrameIsPinnedToRightSide; }
 
-    void setPaginationMode(WebCore::Page::Pagination::Mode);
-    WebCore::Page::Pagination::Mode paginationMode() const { return m_paginationMode; }
+    void setPaginationMode(WebCore::Pagination::Mode);
+    WebCore::Pagination::Mode paginationMode() const { return m_paginationMode; }
     void setPaginationBehavesLikeColumns(bool);
     bool paginationBehavesLikeColumns() const { return m_paginationBehavesLikeColumns; }
     void setPageLength(double);
@@ -715,6 +715,8 @@ public:
     void setSuppressVisibilityUpdates(bool flag) { m_suppressVisibilityUpdates = flag; }
     bool suppressVisibilityUpdates() { return m_suppressVisibilityUpdates; }
 
+    void postMessageToInjectedBundle(const String& messageName, APIObject* messageBody);
+
 private:
     WebPageProxy(PageClient*, PassRefPtr<WebProcessProxy>, WebPageGroup*, uint64_t pageID);
 
@@ -1093,7 +1095,7 @@ private:
     bool m_useFixedLayout;
     WebCore::IntSize m_fixedLayoutSize;
 
-    WebCore::Page::Pagination::Mode m_paginationMode;
+    WebCore::Pagination::Mode m_paginationMode;
     bool m_paginationBehavesLikeColumns;
     double m_pageLength;
     double m_gapBetweenPages;
diff --git a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
index b5fc012c9..238a67516 100644
--- a/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
+++ b/Source/WebKit2/UIProcess/mac/WKFullScreenWindowController.mm
@@ -552,7 +552,12 @@ static NSRect windowFrameFromApparentFrames(NSRect screenFrame, NSRect initialFr
     finalBounds.origin = [[self window] convertScreenToBase:finalBounds.origin];
     WKWindowSetClipRect([self window], finalBounds);
 
-    [[self window] makeKeyAndOrderFront:self];
+    NSWindow* window = [self window];
+    NSWindowCollectionBehavior behavior = [window collectionBehavior];
+    [window setCollectionBehavior:(behavior | NSWindowCollectionBehaviorCanJoinAllSpaces)];
+    [window makeKeyAndOrderFront:self];
+    [window setCollectionBehavior:behavior];
+
 
     if (!_backgroundWindow)
         _backgroundWindow = createBackgroundFullscreenWindow(screenFrame);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.h
index 9e273bae3..86232e607 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundle.h
@@ -38,6 +38,7 @@ typedef void (*WKBundleDidCreatePageCallback)(WKBundleRef bundle, WKBundlePageRe
 typedef void (*WKBundleWillDestroyPageCallback)(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo);
 typedef void (*WKBundleDidInitializePageGroupCallback)(WKBundleRef bundle, WKBundlePageGroupRef pageGroup, const void* clientInfo);
 typedef void (*WKBundleDidReceiveMessageCallback)(WKBundleRef bundle, WKStringRef name, WKTypeRef messageBody, const void* clientInfo);
+typedef void (*WKBundleDidReceiveMessageToPageCallback)(WKBundleRef bundle, WKBundlePageRef page, WKStringRef name, WKTypeRef messageBody, const void* clientInfo);
 
 struct WKBundleClient {
     int                                                                 version;
@@ -46,14 +47,17 @@ struct WKBundleClient {
     WKBundleWillDestroyPageCallback                                     willDestroyPage;
     WKBundleDidInitializePageGroupCallback                              didInitializePageGroup;
     WKBundleDidReceiveMessageCallback                                   didReceiveMessage;
+
+    // Version 1.
+    WKBundleDidReceiveMessageToPageCallback                             didReceiveMessageToPage;
 };
 typedef struct WKBundleClient WKBundleClient;
 
-enum { kWKBundleClientCurrentVersion = 0 };
+enum { kWKBundleClientCurrentVersion = 1 };
 
 WK_EXPORT WKTypeID WKBundleGetTypeID();
 
-WK_EXPORT void WKBundleSetClient(WKBundleRef bundle, WKBundleClient * client);
+WK_EXPORT void WKBundleSetClient(WKBundleRef bundle, WKBundleClient* client);
 
 WK_EXPORT void WKBundlePostMessage(WKBundleRef bundle, WKStringRef messageName, WKTypeRef messageBody);
 WK_EXPORT void WKBundlePostSynchronousMessage(WKBundleRef bundle, WKStringRef messageName, WKTypeRef messageBody, WKTypeRef* returnData);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index 127715c7a..1e8310729 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -478,6 +478,11 @@ void InjectedBundle::didReceiveMessage(const String& messageName, APIObject* mes
     m_client.didReceiveMessage(this, messageName, messageBody);
 }
 
+void InjectedBundle::didReceiveMessageToPage(WebPage* page, const String& messageName, APIObject* messageBody)
+{
+    m_client.didReceiveMessageToPage(this, page, messageName, messageBody);
+}
+
 void InjectedBundle::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
 {
     switch (messageID.get<InjectedBundleMessage::Kind>()) {
@@ -491,6 +496,25 @@ void InjectedBundle::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC:
             didReceiveMessage(messageName, messageBody.get());
             return;
         }
+
+        case InjectedBundleMessage::PostMessageToPage: {
+            uint64_t pageID = arguments->destinationID();
+            if (!pageID)
+                return;
+            
+            WebPage* page = WebProcess::shared().webPage(pageID);
+            if (!page)
+                return;
+
+            String messageName;
+            RefPtr<APIObject> messageBody;
+            InjectedBundleUserMessageDecoder messageDecoder(messageBody);
+            if (!arguments->decode(CoreIPC::Out(messageName, messageDecoder)))
+                return;
+
+            didReceiveMessageToPage(page, messageName, messageBody.get());
+            return;
+        }
     }
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
index 1e240503b..87f7ef3b0 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.h
@@ -152,6 +152,7 @@ public:
     void willDestroyPage(WebPage*);
     void didInitializePageGroup(WebPageGroupProxy*);
     void didReceiveMessage(const String&, APIObject*);
+    void didReceiveMessageToPage(WebPage*, const String&, APIObject*);
 
     void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
 
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.cpp
index f2e4f2b9f..8ebf89781 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.cpp
@@ -62,4 +62,12 @@ void InjectedBundleClient::didReceiveMessage(InjectedBundle* bundle, const Strin
     m_client.didReceiveMessage(toAPI(bundle), toAPI(messageName.impl()), toAPI(messageBody), m_client.clientInfo);
 }
 
+void InjectedBundleClient::didReceiveMessageToPage(InjectedBundle* bundle, WebPage* page, const String& messageName, APIObject* messageBody)
+{
+    if (!m_client.didReceiveMessageToPage)
+        return;
+
+    m_client.didReceiveMessageToPage(toAPI(bundle), toAPI(page), toAPI(messageName.impl()), toAPI(messageBody), m_client.clientInfo);
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.h b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.h
index 32be290c9..ef1414274 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundleClient.h
@@ -43,6 +43,7 @@ public:
     void willDestroyPage(InjectedBundle*, WebPage*);
     void didInitializePageGroup(InjectedBundle*, WebPageGroupProxy*);
     void didReceiveMessage(InjectedBundle*, const String& messageName, APIObject* messageBody);
+    void didReceiveMessageToPage(InjectedBundle*, WebPage*, const String& messageName, APIObject* messageBody);
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index 947a06a43..ecac12cf6 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -902,6 +902,10 @@ void WebPage::setResizesToContentsUsingLayoutSize(const IntSize& targetLayoutSiz
     m_page->settings()->setAcceleratedCompositingForFixedPositionEnabled(true);
     m_page->settings()->setFixedElementsLayoutRelativeToFrame(true);
     m_page->settings()->setFixedPositionCreatesStackingContext(true);
+#if ENABLE(SMOOTH_SCROLLING)
+    // Ensure we don't do animated scrolling in the WebProcess when scrolling is delegated.
+    m_page->settings()->setEnableScrollAnimator(false);
+#endif
 
     // Always reset even when empty. This also takes care of the relayout.
     setFixedLayoutSize(targetLayoutSize);
@@ -1122,28 +1126,28 @@ void WebPage::setFixedLayoutSize(const IntSize& size)
 
 void WebPage::setPaginationMode(uint32_t mode)
 {
-    Page::Pagination pagination = m_page->pagination();
-    pagination.mode = static_cast<Page::Pagination::Mode>(mode);
+    Pagination pagination = m_page->pagination();
+    pagination.mode = static_cast<Pagination::Mode>(mode);
     m_page->setPagination(pagination);
 }
 
 void WebPage::setPaginationBehavesLikeColumns(bool behavesLikeColumns)
 {
-    Page::Pagination pagination = m_page->pagination();
+    Pagination pagination = m_page->pagination();
     pagination.behavesLikeColumns = behavesLikeColumns;
     m_page->setPagination(pagination);
 }
 
 void WebPage::setPageLength(double pageLength)
 {
-    Page::Pagination pagination = m_page->pagination();
+    Pagination pagination = m_page->pagination();
     pagination.pageLength = pageLength;
     m_page->setPagination(pagination);
 }
 
 void WebPage::setGapBetweenPages(double gap)
 {
-    Page::Pagination pagination = m_page->pagination();
+    Pagination pagination = m_page->pagination();
     pagination.gap = gap;
     m_page->setPagination(pagination);
 }
@@ -2059,6 +2063,9 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     settings->setMockScrollbarsEnabled(store.getBoolValueForKey(WebPreferencesKey::mockScrollbarsEnabledKey()));
     settings->setHyperlinkAuditingEnabled(store.getBoolValueForKey(WebPreferencesKey::hyperlinkAuditingEnabledKey()));
     settings->setRequestAnimationFrameEnabled(store.getBoolValueForKey(WebPreferencesKey::requestAnimationFrameEnabledKey()));
+#if ENABLE(SMOOTH_SCROLLING)
+    settings->setEnableScrollAnimator(store.getBoolValueForKey(WebPreferencesKey::scrollAnimatorEnabledKey()));
+#endif
 
     // <rdar://problem/10697417>: It is necessary to force compositing when accelerate drawing
     // is enabled on Mac so that scrollbars are always in their own layers.
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index ec5af0e96..789727ad3 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -309,7 +309,7 @@ public:
     bool useFixedLayout() const { return m_useFixedLayout; }
     void setFixedLayoutSize(const WebCore::IntSize&);
 
-    void setPaginationMode(uint32_t /* WebCore::Page::Pagination::Mode */);
+    void setPaginationMode(uint32_t /* WebCore::Pagination::Mode */);
     void setPaginationBehavesLikeColumns(bool);
     void setPageLength(double);
     void setGapBetweenPages(double);
diff --git a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
index 43d381ecd..c2f016537 100644
--- a/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
+++ b/Source/WebKit2/WebProcess/WebPage/mac/WebPageMac.mm
@@ -55,6 +55,7 @@
 #import <WebCore/RenderObject.h>
 #import <WebCore/RenderStyle.h>
 #import <WebCore/ScrollView.h>
+#import <WebCore/StyleInheritedData.h>
 #import <WebCore/TextIterator.h>
 #import <WebCore/WindowsKeyboardCodes.h>
 #import <WebCore/visible_units.h>
diff --git a/Source/WebKit2/WebProcess/qt/QtBuiltinBundle.cpp b/Source/WebKit2/WebProcess/qt/QtBuiltinBundle.cpp
index a5a75d0c3..8847c8b99 100644
--- a/Source/WebKit2/WebProcess/qt/QtBuiltinBundle.cpp
+++ b/Source/WebKit2/WebProcess/qt/QtBuiltinBundle.cpp
@@ -58,7 +58,8 @@ void QtBuiltinBundle::initialize(WKBundleRef bundle)
         didCreatePage,
         willDestroyPage,
         0, // didInitializePageGroup
-        didReceiveMessage
+        didReceiveMessage,
+        0 // didReceiveMessageToPage
     };
     WKBundleSetClient(m_bundle, &client);
 }
diff --git a/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp b/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
index 268c4b093..02a90ec43 100644
--- a/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
+++ b/Source/WebKit2/WebProcess/qt/WebProcessQt.cpp
@@ -160,11 +160,6 @@ void WebProcess::platformInitializeWebProcess(const WebProcessCreationParameters
     }
 #endif
 
-    // Disable runtime enabled features that have no WebKit2 implementation yet.
-#if ENABLE(DEVICE_ORIENTATION)
-    WebCore::RuntimeEnabledFeatures::setDeviceMotionEnabled(false);
-    WebCore::RuntimeEnabledFeatures::setDeviceOrientationEnabled(false);
-#endif
 #if ENABLE(SPEECH_INPUT)
     WebCore::RuntimeEnabledFeatures::setSpeechInputEnabled(false);
 #endif
diff --git a/Source/WebKit2/win/WebKit2.def b/Source/WebKit2/win/WebKit2.def
index 12c1f3033..5f68abc3a 100644
--- a/Source/WebKit2/win/WebKit2.def
+++ b/Source/WebKit2/win/WebKit2.def
@@ -221,7 +221,7 @@ EXPORTS
         ?setFixedFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
         ?setMockScrollbarsEnabled@Settings@WebCore@@SAX_N@Z
         ?setPageScaleFactor@Page@WebCore@@QAEXMABVIntPoint@2@@Z
-        ?setPagination@Page@WebCore@@QAEXABUPagination@12@@Z
+        ?setPagination@Page@WebCore@@QAEXABUPagination@2@@Z
         ?setPictographFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
         ?setResourcesDataSizeLimitsFromInternals@InspectorController@WebCore@@QAEXHH@Z
         ?setSansSerifFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
diff --git a/Source/WebKit2/win/WebKit2CFLite.def b/Source/WebKit2/win/WebKit2CFLite.def
index 1a47d2f3a..b53c69e57 100644
--- a/Source/WebKit2/win/WebKit2CFLite.def
+++ b/Source/WebKit2/win/WebKit2CFLite.def
@@ -215,7 +215,7 @@ EXPORTS
         ?setFixedFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
         ?setMockScrollbarsEnabled@Settings@WebCore@@SAX_N@Z
         ?setPageScaleFactor@Page@WebCore@@QAEXMABVIntPoint@2@@Z
-        ?setPagination@Page@WebCore@@QAEXABUPagination@12@@Z
+        ?setPagination@Page@WebCore@@QAEXABUPagination@2@@Z
         ?setPictographFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
         ?setResourcesDataSizeLimitsFromInternals@InspectorController@WebCore@@QAEXHH@Z
         ?setSansSerifFontFamily@Settings@WebCore@@QAEXABVAtomicString@WTF@@W4UScriptCode@@@Z
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index 44d7c60a7..af4bff6a9 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -27,7 +27,7 @@ _ZN3WTF7CStringC2EPKcm;
 _ZN3WTF7CStringD1Ev;
 _ZN3WTF7CStringaSERKS0_;
 _ZN24DumpRenderTreeSupportGtk*;
-_ZN7WebCore4Page13setPaginationERKNS0_10PaginationE;
+_ZN7WebCore4Page13setPaginationERKNS_10PaginationE;
 _ZN7WebCore4Page18setPageScaleFactorEfRKNS_8IntPointE;
 _ZN7WebCore4Page20setDeviceScaleFactorEf;
 _ZN7WebCore4Page16setCanStartMediaEb;
diff --git a/Tools/CMakeLists.txt b/Tools/CMakeLists.txt
index aed71442e..1a6a69be8 100644
--- a/Tools/CMakeLists.txt
+++ b/Tools/CMakeLists.txt
@@ -3,6 +3,8 @@ IF (ENABLE_WEBKIT2)
 ENDIF ()
 
 IF ("${PORT}" STREQUAL "Efl")
+    ADD_SUBDIRECTORY(EWebLauncher/ControlTheme)
+
     IF (ENABLE_WEBKIT)
         ADD_SUBDIRECTORY(DumpRenderTree/efl)
         ADD_SUBDIRECTORY(EWebLauncher)
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index 4ba5645cf..348316eaf 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,3 +1,378 @@
+2012-08-23  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [EFL] Add url bar to EWebLauncher and MiniBrowser/Efl.
+        https://bugs.webkit.org/show_bug.cgi?id=63966
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        EWebLauncher and MiniBrowser/Efl did not have functionality that users
+        navigates the site which they want.
+        This patch adds the urlbar and functionality to load url which users want.
+
+        * CMakeLists.txt:
+        Added to share urlbar theme for both EWebLauncher and MiniBrowser/Efl.
+        * EWebLauncher/CMakeLists.txt:
+        Added urlbar.c and dependency of urlbar theme.
+        In addition, changed macro name to THEME_DIR to share the code easily.
+        * EWebLauncher/ControlTheme/CMakeLists.txt: Added for urlbar theme.
+        * EWebLauncher/ControlTheme/entry.edc: Implemented urlbar theme.
+        * EWebLauncher/main.c:
+        Implemented to use the urlbar.
+        In addition, remove unnecessary border of webview to control webview and urlbar easily.
+        (_ELauncher):
+        (on_url_changed):
+        (browserCreate):
+        (closeWindow):
+        (findThemePath):
+        * EWebLauncher/url_bar.c: Implemented functionality of the urlbar.
+        (_url_bar_url_get_with_protocol):
+        (on_urlbar_key_down):
+        (on_urlbar_mouse_down):
+        (on_urlbar_focus_out):
+        (url_bar_add):
+        (url_bar_del):
+        (url_bar_url_set):
+        * EWebLauncher/url_bar.h: Added.
+        * MiniBrowser/efl/CMakeLists.txt:
+        * MiniBrowser/efl/main.c: Implemented to use the urlbar.
+        (_MiniBrowser):
+        (on_url_changed):
+        (browserCreate):
+
+2012-08-23  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [nrwt, WTR] Remove workaround for timeout handing from r126062
+        https://bugs.webkit.org/show_bug.cgi?id=94609
+
+        Reviewed by Dirk Pranke.
+
+        Don't try to reset state if a timeout occured but inform
+        the harness that the web process is no longer reliable.
+
+        * Scripts/webkitpy/layout_tests/port/driver.py:
+        (Driver.run_test): Remove the workaround. Furthermore, handle the case when
+        the pid is unknown.
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::run):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::invoke):
+        (WTR::TestInvocation::dumpWebProcessUnresponsiveness):
+        * WebKitTestRunner/TestInvocation.h:
+        (TestInvocation):
+
+2012-08-23  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        Unreviewed. Adding myself to committers list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-08-22  Alexis Menard  <alexis@webkit.org>
+
+        Unreviewed update of my email.
+
+        * Scripts/webkitpy/common/config/committers.py:
+        * Scripts/webkitpy/common/config/watchlist:
+
+2012-08-22  Dirk Pranke  <dpranke@chromium.org>
+
+        Fix typos in r126374
+        https://bugs.webkit.org/show_bug.cgi?id=94665
+        Unreviewed, build fix.
+
+        Fix two issues that snuck in, one that caused a crash if there
+        were no baselines to optimize and one that occurred as a result
+        of failing to rename a variable when I changed the recursion to
+        a loop in the previous patch.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        (BaselineOptimizer._optimize_by_pushing_results_up):
+
+2012-08-22  Dirk Pranke  <dpranke@chromium.org>
+
+        Baseline optimizer should try to optimize per-port if global optimization fails
+        https://bugs.webkit.org/show_bug.cgi?id=94665
+
+        Reviewed by Adam Barth.
+
+        Add a fallback strategy for optimizing baselines if the default
+        one fails; this one simply attempts to shift baselines up in the
+        tree and consolidates them if a parent and child in the fallback
+        path have the same result. This strategy is somewhat flawed in
+        that we will always put something in a parent dir even if we
+        "shouldn't"; for example, if chromium-mac produces a different
+        result from chromium-win and chromium-linux, then the new
+        algorithm will move the mac result into platform/chromium,
+        leaving chromium-mac empty. This result is still correct, but
+        perhaps confusing.
+
+        I haven't done much testing of this algorithm yet, so it's not
+        clear how many cases where this does a better job than the
+        default algorithm and how many it'll do a worse job.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        (BaselineOptimizer._find_optimal_result_placement):
+        (BaselineOptimizer._optimize_by_most_specific_common_directory):
+        (BaselineOptimizer):
+        (BaselineOptimizer._optimize_by_pushing_results_up):
+        (BaselineOptimizer._find_in_fallbackpath):
+        * Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py:
+        (BaselineOptimizerTest.test_platform_mac_different):
+
+2012-08-22  Dirk Pranke  <dpranke@chromium.org>
+
+        add debug info, another test to webkit-patch optimize-baselines
+        https://bugs.webkit.org/show_bug.cgi?id=94762
+
+        Reviewed by Adam Barth.
+
+        This patch adds more debug logging for optimize-baselines so
+        that you can tell the before and after states and figure out
+        what the command is actually deciding to do.
+
+        Also, this command adds a (disabled) test for the problem in bug
+        94665. It's disabled because we don't have the fix yet (that
+        will be posted in a patch to that bug).
+
+        There should be no functional changes in this patch apart from
+        the additional logging.
+
+        Note that adding the debug logging exposed a bug in
+        filesystem_mock.relpath() (that would return None if the path
+        wasn't a subpath of the start); the real relpath computes a
+        relpath with parent dirs. Fixing this revealed a bad check in
+        the style checker's change_directory() call which was checking
+        for None.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        (BaselineOptimizer._find_optimal_result_placement):
+        (BaselineOptimizer):
+        (BaselineOptimizer._optimize_by_most_specific_common_directory):
+        (BaselineOptimizer._move_baselines):
+        (BaselineOptimizer.optimize):
+        * Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py:
+        (BaselineOptimizerTest.disabled_test_platform_mac_different):
+        * Scripts/webkitpy/common/system/filesystem.py:
+        (FileSystem):
+        * Scripts/webkitpy/common/system/filesystem_mock.py:
+        (MockFileSystem):
+        (MockFileSystem.__init__):
+        (MockFileSystem.relpath):
+        * Scripts/webkitpy/common/system/filesystem_unittest.py:
+        (RealFileSystemTest.test_sep):
+        * Scripts/webkitpy/style/main.py:
+        (change_directory):
+
+2012-08-22  Alejandro Piñeiro  <apinheiro@igalia.com>
+
+        Dojo toggle buttons should expose ROLE_TOGGLE_BUTTON not ROLE_PUSH_BUTTON
+        https://bugs.webkit.org/show_bug.cgi?id=73819
+
+        Reviewed by Chris Fleizach.
+
+        Added a new role, Toggle Button, based on whether aria-pressed is present.
+        http://www.w3.org/TR/wai-aria/states_and_properties#aria-pressed
+
+        * DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp:
+        (roleToString): added "ToggleButton" string for WebAccessibilityRoleToggleButton
+
+2012-08-23  Victor Carbune  <victor@rosedu.org>
+
+        Add myself to the committer list
+        https://bugs.webkit.org/show_bug.cgi?id=94659
+
+        Reviewed by James Robinson.
+
+        Added my email and IRC handle.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-08-22  Scott Graham  <scottmg@chromium.org>
+
+        Don't unconditionally define NOMINMAX on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=94742
+
+        Reviewed by Adrienne Walker.
+
+        Avoids a warning when building on Windows when NOMINMAX is defined
+        elsewhere or on the command line.
+
+        * TestWebKitAPI/config.h:
+
+2012-08-22  Zan Dobersek  <zandobersek@gmail.com>
+
+        REGRESSION(r126189): Reftest mismatches are (again) run through ImageDiff with 0.1 tolerance
+        https://bugs.webkit.org/show_bug.cgi?id=94704
+
+        Reviewed by Dirk Pranke.
+
+        Use tolerance=0 when acquiring diff image of reftest output.
+
+        * Scripts/webkitpy/layout_tests/controllers/single_test_runner.py:
+        (SingleTestRunner._compare_output_with_reference):
+
+2012-08-22  Tommy Widenflycht  <tommyw@google.com>
+
+        [chromium] MediaStream API: Add MockWebRTCPeerConnectionHandler
+        https://bugs.webkit.org/show_bug.cgi?id=93091
+
+        Reviewed by Adam Barth.
+
+        Add a skeleton MockWebRTCPeerConnectionHandler to DumpRenderTree,
+        to complete the infrastructure for RTCPeerConnection.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/chromium/MockWebKitPlatformSupport.cpp:
+        (MockWebKitPlatformSupport::createRTCPeerConnectionHandler):
+        * DumpRenderTree/chromium/MockWebKitPlatformSupport.h:
+        (MockWebKitPlatformSupport):
+        * DumpRenderTree/chromium/MockWebMediaStreamCenter.cpp:
+        * DumpRenderTree/chromium/MockWebMediaStreamCenter.h:
+        * DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp: Copied from Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h.
+        (MockWebRTCPeerConnectionHandler::MockWebRTCPeerConnectionHandler):
+        (MockWebRTCPeerConnectionHandler::initialize):
+        * DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.h: Copied from Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h.
+        (WebKit):
+        (MockWebRTCPeerConnectionHandler):
+        (MockWebRTCPeerConnectionHandler::MockWebRTCPeerConnectionHandler):
+
+2012-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Merge TestExpectationSerializer into TestExpectationLine
+        https://bugs.webkit.org/show_bug.cgi?id=94638
+
+        Reviewed by Dimitri Glazkov.
+
+        Moved all methods except, list_to_string which was moved to TestExpectations
+        from TestExpectationSerializer to TestExpectationLine and removed TestExpectationSerializer.
+
+        * Scripts/webkitpy/layout_tests/controllers/test_expectations_editor_unittest.py:
+        (TestExpectationEditorTests.assert_remove_roundtrip):
+        (TestExpectationEditorTests.assert_update_roundtrip):
+        * Scripts/webkitpy/layout_tests/models/test_expectations.py:
+        (ParseError.__repr__):
+        (TestExpectationLine):
+        (TestExpectationLine.create_passing_expectation):
+        (TestExpectationLine.to_string): Moved from TestExpectationSerializer.
+        (TestExpectationLine.to_csv): Ditto.
+        (TestExpectationLine._serialize_parsed_expectations): Ditto.
+        (TestExpectationLine._serialize_parsed_modifiers): Ditto.
+        (TestExpectationLine._format_line):
+        (TestExpectations.remove_configuration_from_test):
+        (TestExpectations.remove_rebaselined_tests):
+        (TestExpectations.add_skipped_tests):
+        (TestExpectations):
+        (TestExpectations.list_to_string): Moved from TestExpectationSerializer.
+        (TestExpectations.list_to_string.serialize):
+        (TestExpectations.list_to_string.nones_out):
+        * Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py:
+        (TestExpectationSerializationTests): Renamed from TestExpectationSerializerTests.
+        (TestExpectationSerializationTests.__init__):
+        (TestExpectationSerializationTests.assert_round_trip):
+        (TestExpectationSerializationTests.assert_list_round_trip):
+        (TestExpectationSerializationTests.test_unparsed_to_string):
+        (TestExpectationSerializationTests.test_unparsed_list_to_string):
+        (TestExpectationSerializationTests.test_parsed_to_string):
+        (TestExpectationSerializationTests.test_serialize_parsed_expectations):
+        (TestExpectationSerializationTests.test_serialize_parsed_modifier_string):
+        (TestExpectationSerializationTests.test_format_line):
+        (TestExpectationSerializationTests.test_reconstitute_only_these):
+        * Scripts/webkitpy/tool/commands/expectations.py:
+        (OptimizeExpectations.execute):
+        * Scripts/webkitpy/tool/commands/queries.py:
+        (PrintExpectations.execute):
+        (PrintExpectations._format_lines):
+        * Scripts/webkitpy/tool/servers/gardeningserver.py:
+        (GardeningExpectationsUpdater.update_expectations):
+
+2012-08-22  Alexandre Elias  <aelias@chromium.org>
+
+        Unreviewed, add aelias@chromium.org to committers
+
+        I (aelias@chromium.org) have been approved for commit access and Apple
+        has confirmed receipt of my committer agreement.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-08-22  Alexey Proskuryakov  <ap@apple.com>
+
+        [WK2] Support posting injected bundle messages to a page
+        https://bugs.webkit.org/show_bug.cgi?id=94630
+
+        Reviewed by Sam Weinig.
+
+        * MiniBrowser/mac/WebBundle/WebBundleMain.m:
+        * TestWebKitAPI/InjectedBundleController.cpp:
+        (TestWebKitAPI::InjectedBundleController::initialize):
+        (TestWebKitAPI::InjectedBundleController::didReceiveMessageToPage):
+        * TestWebKitAPI/InjectedBundleController.h:
+        * TestWebKitAPI/InjectedBundleTest.h:
+        (TestWebKitAPI::InjectedBundleTest::didReceiveMessageToPage):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::didReceiveMessage):
+        (WTR::InjectedBundle::didReceiveMessageToPage):
+        (WTR::InjectedBundle::initialize):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
+        Updated for new client API call.
+
+2012-08-22  Dominic Mazzoni  <dmazzoni@google.com>
+
+        REGRESSION (r125710): accessibility/accessibility-node-reparent.html, accessibility/accessibility-node-memory-management.html failing on GTK Linux
+        https://bugs.webkit.org/show_bug.cgi?id=94200
+
+        Reviewed by Chris Fleizach.
+
+        Adds reference counting for AtkObjects referenced by
+        AccessibilityUIElementGtk. This prevents bogus results and
+        assertion failures on AccessibilityUIElements whose underlying
+        object has been deleted (as opposed to just made defunct).
+
+        This fixes two tests that were previously failing because of this bug.
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::AccessibilityUIElement):
+        (AccessibilityUIElement::~AccessibilityUIElement):
+
+2012-08-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        [GTK] Split WebCore/platform into a separate library
+        https://bugs.webkit.org/show_bug.cgi?id=94435
+
+        Reviewed by Martin Robinson.
+
+        More people have been reporting problems when linking WebCore because
+        the command line limit is being exceeded. Splitting WebCore a bit more
+        is in order.
+
+        * GNUmakefile.am: link libWebCorePlatform into DRT
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Unreviewed buildfix for Qt-minimal after r126291
+
+        Disable smooth scrolling when request-animation-frame has been disabled either
+        explicitly or as part of --minimal.
+
+        * qmake/mkspecs/features/features.prf:
+
+2012-08-22  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt] Optionally support smooth-scrolling on all platforms
+        https://bugs.webkit.org/show_bug.cgi?id=74926
+
+        Reviewed by Simon Hausmann.
+
+        Enabled SMOOTH_SCROLLING on Qt, and expose the enable scroll animator
+        setting in QtTestBrowser so it can be tested.
+
+        * QtTestBrowser/launcherwindow.cpp:
+        (LauncherWindow::createChrome):
+        (LauncherWindow::toggleScrollAnimator):
+        * QtTestBrowser/launcherwindow.h:
+        (WindowOptions::WindowOptions):
+        (WindowOptions):
+        (LauncherWindow):
+        * qmake/mkspecs/features/features.pri:
+
 2012-08-22  Dominik Röttsches  <dominik.rottsches@intel.com>
 
         Unreviewed, adding myself to committers.py.
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gypi b/Tools/DumpRenderTree/DumpRenderTree.gypi
index cfc478ec9..15cd94441 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gypi
+++ b/Tools/DumpRenderTree/DumpRenderTree.gypi
@@ -18,6 +18,8 @@
             'chromium/MockWebMediaStreamCenter.h',
             'chromium/MockWebPrerenderingSupport.cpp',
             'chromium/MockWebPrerenderingSupport.h',
+            'chromium/MockWebRTCPeerConnectionHandler.cpp',
+            'chromium/MockWebRTCPeerConnectionHandler.h',
             'chromium/MockWebSpeechInputController.cpp',
             'chromium/MockWebSpeechInputController.h',
             'chromium/MockWebSpeechRecognizer.cpp',
diff --git a/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.cpp b/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.cpp
index 0a8b29507..79ae9f229 100644
--- a/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.cpp
+++ b/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.cpp
@@ -32,6 +32,7 @@
 #include "MockWebKitPlatformSupport.h"
 
 #include "MockWebMediaStreamCenter.h"
+#include "MockWebRTCPeerConnectionHandler.h"
 #include <wtf/Assertions.h>
 #include <wtf/PassOwnPtr.h>
 
@@ -63,4 +64,9 @@ WebMediaStreamCenter* MockWebKitPlatformSupport::createMediaStreamCenter(WebMedi
 
     return m_mockMediaStreamCenter.get();
 }
+
+WebRTCPeerConnectionHandler* MockWebKitPlatformSupport::createRTCPeerConnectionHandler(WebRTCPeerConnectionHandlerClient* client)
+{
+    return new MockWebRTCPeerConnectionHandler(client);
+}
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h b/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h
index 1c9d30b9c..1e5443809 100644
--- a/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h
+++ b/Tools/DumpRenderTree/chromium/MockWebKitPlatformSupport.h
@@ -44,6 +44,7 @@ public:
 
 #if ENABLE(MEDIA_STREAM)
     virtual WebKit::WebMediaStreamCenter* createMediaStreamCenter(WebKit::WebMediaStreamCenterClient*) OVERRIDE;
+    virtual WebKit::WebRTCPeerConnectionHandler* createRTCPeerConnectionHandler(WebKit::WebRTCPeerConnectionHandlerClient*) OVERRIDE;
 #endif // ENABLE(MEDIA_STREAM)
 
 private:
diff --git a/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.cpp b/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.cpp
index 30b56f1f1..46448c7b2 100644
--- a/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.cpp
+++ b/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.cpp
@@ -33,14 +33,14 @@
 
 #include "MockWebMediaStreamCenter.h"
 
-#include "platform/WebICECandidateDescriptor.h"
-#include "platform/WebMediaStreamCenterClient.h"
-#include "platform/WebMediaStreamComponent.h"
-#include "platform/WebMediaStreamDescriptor.h"
-#include "platform/WebMediaStreamSource.h"
-#include "platform/WebMediaStreamSourcesRequest.h"
-#include "platform/WebSessionDescriptionDescriptor.h"
-#include "platform/WebVector.h"
+#include <public/WebICECandidateDescriptor.h>
+#include <public/WebMediaStreamCenterClient.h>
+#include <public/WebMediaStreamComponent.h>
+#include <public/WebMediaStreamDescriptor.h>
+#include <public/WebMediaStreamSource.h>
+#include <public/WebMediaStreamSourcesRequest.h>
+#include <public/WebSessionDescriptionDescriptor.h>
+#include <public/WebVector.h>
 
 using namespace WebKit;
 
diff --git a/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.h b/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.h
index 75baf247a..34ca92bf6 100644
--- a/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.h
+++ b/Tools/DumpRenderTree/chromium/MockWebMediaStreamCenter.h
@@ -32,7 +32,7 @@
 #define MockWebMediaStreamCenter_h
 
 #if ENABLE(MEDIA_STREAM)
-#include "platform/WebMediaStreamCenter.h"
+#include <public/WebMediaStreamCenter.h>
 
 namespace WebKit {
 class WebMediaStreamCenterClient;
diff --git a/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp b/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp
new file mode 100644
index 000000000..273fc4431
--- /dev/null
+++ b/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(MEDIA_STREAM)
+
+#include "MockWebRTCPeerConnectionHandler.h"
+
+#include <public/WebRTCPeerConnectionHandlerClient.h>
+
+using namespace WebKit;
+
+MockWebRTCPeerConnectionHandler::MockWebRTCPeerConnectionHandler(WebRTCPeerConnectionHandlerClient* client)
+{
+}
+
+bool MockWebRTCPeerConnectionHandler::initialize()
+{
+    return true;
+}
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.h b/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.h
new file mode 100644
index 000000000..e15abefd1
--- /dev/null
+++ b/Tools/DumpRenderTree/chromium/MockWebRTCPeerConnectionHandler.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MockWebRTCPeerConnectionHandler_h
+#define MockWebRTCPeerConnectionHandler_h
+
+#if ENABLE(MEDIA_STREAM)
+#include <public/WebRTCPeerConnectionHandler.h>
+
+namespace WebKit {
+class WebRTCPeerConnectionHandlerClient;
+};
+
+class MockWebRTCPeerConnectionHandler : public WebKit::WebRTCPeerConnectionHandler {
+public:
+    explicit MockWebRTCPeerConnectionHandler(WebKit::WebRTCPeerConnectionHandlerClient*);
+
+    virtual bool initialize() OVERRIDE;
+
+private:
+    MockWebRTCPeerConnectionHandler() { }
+};
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // MockWebRTCPeerConnectionHandler_h
+
diff --git a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp
index c56b151e6..df0fb0a1f 100644
--- a/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp
+++ b/Tools/DumpRenderTree/chromium/TestRunner/AccessibilityUIElementChromium.cpp
@@ -204,6 +204,8 @@ static string roleToString(WebAccessibilityRole role)
         return result.append("DocumentRegion");
     case WebAccessibilityRoleUserInterfaceTooltip:
         return result.append("UserInterfaceTooltip");
+    case WebAccessibilityRoleToggleButton:
+        return result.append("ToggleButton");
     default:
         // Also matches WebAccessibilityRoleUnknown.
         return result.append("Unknown");
diff --git a/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp b/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
index bee371960..9a0fb606f 100644
--- a/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
@@ -38,15 +38,18 @@
 AccessibilityUIElement::AccessibilityUIElement(PlatformUIElement element)
     : m_element(element)
 {
+    g_object_ref(m_element);
 }
 
 AccessibilityUIElement::AccessibilityUIElement(const AccessibilityUIElement& other)
     : m_element(other.m_element)
 {
+    g_object_ref(m_element);
 }
 
 AccessibilityUIElement::~AccessibilityUIElement()
 {
+    g_object_unref(m_element);
 }
 
 void AccessibilityUIElement::getLinkedUIElements(Vector<AccessibilityUIElement>& elements)
diff --git a/Tools/EWebLauncher/CMakeLists.txt b/Tools/EWebLauncher/CMakeLists.txt
index 3c489a4fd..bd879ad2a 100644
--- a/Tools/EWebLauncher/CMakeLists.txt
+++ b/Tools/EWebLauncher/CMakeLists.txt
@@ -1,4 +1,5 @@
 SET(EWebLauncher_SOURCES
+    ${TOOLS_DIR}/EWebLauncher/url_bar.c
     ${TOOLS_DIR}/EWebLauncher/main.c
 )
 
@@ -35,10 +36,12 @@ SET(EWebLauncher_LINK_FLAGS
     ${EVAS_LDFLAGS}
 )
 
-ADD_DEFINITIONS(-DDATA_DIR=\"${THEME_BINARY_DIR}\")
+ADD_DEFINITIONS(-DTHEME_DIR=\"${THEME_BINARY_DIR}\")
 
 INCLUDE_DIRECTORIES(${EWebLauncher_INCLUDE_DIRECTORIES})
 ADD_EXECUTABLE(EWebLauncher ${EWebLauncher_SOURCES})
 TARGET_LINK_LIBRARIES(EWebLauncher ${EWebLauncher_LIBRARIES})
 ADD_TARGET_PROPERTIES(EWebLauncher LINK_FLAGS "${EWebLauncher_LINK_FLAGS}")
 SET_TARGET_PROPERTIES(EWebLauncher PROPERTIES FOLDER "Tools")
+
+ADD_DEPENDENCIES(EWebLauncher ControlTheme)
diff --git a/Tools/EWebLauncher/ControlTheme/CMakeLists.txt b/Tools/EWebLauncher/ControlTheme/CMakeLists.txt
new file mode 100644
index 000000000..68aa8cf19
--- /dev/null
+++ b/Tools/EWebLauncher/ControlTheme/CMakeLists.txt
@@ -0,0 +1,8 @@
+SET(ControlTheme_DIR "${TOOLS_DIR}/EWebLauncher/ControlTheme")
+
+ADD_CUSTOM_TARGET(ControlTheme ALL
+    COMMAND ${EDJE_CC_EXECUTABLE} -v ${ControlTheme_DIR}/entry.edc ${THEME_BINARY_DIR}/entry.edj
+    DEPENDS
+        ${ControlTheme_DIR}/entry.edc
+    VERBATIM
+)
diff --git a/Tools/EWebLauncher/ControlTheme/entry.edc b/Tools/EWebLauncher/ControlTheme/entry.edc
new file mode 100644
index 000000000..7a1a5f739
--- /dev/null
+++ b/Tools/EWebLauncher/ControlTheme/entry.edc
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+collections {
+   group {
+      name: "control/entry/base/default";
+      styles {
+         style {
+            name: "entry_textblock_style";
+            base: "font=Roman font_size=14 color=#000000 wrap=mixed";
+         }
+      }
+      parts {
+         part {
+            name: "url.text";
+            type: TEXTBLOCK;
+            mouse_events: 1;
+            scale: 1;
+            entry_mode: EDITABLE;
+            multiline: 0;
+            source: "control/entry/selection/default"; // selection under
+            source4: "control/entry/cursor/default"; // cursor over
+            description {
+               state: "default" 0.0;
+               fixed: 1 0;
+               text {
+                  style: "entry_textblock_style";
+                  min: 0 1;
+               }
+            }
+         }
+      }
+      programs {
+         program {
+            name: "focus";
+            signal: "load";
+            source: "";
+            action: FOCUS_SET;
+            target: "url.text";
+         }
+      }
+   }
+
+   group {
+      name: "control/entry/cursor/default";
+      parts {
+         part {
+            name: "clip";
+            type: RECT;
+            mouse_events: 0;
+            scale: 1;
+            description {
+               state: "default" 0.0;
+               rel1.offset: -10 0;
+               rel2.offset: 9 9;
+               visible: 0;
+            }
+            description {
+               state: "focused" 0.0;
+               inherit: "default" 0.0;
+               visible: 1;
+            }
+         }
+         part {
+            name: "cursor";
+            type: RECT;
+            mouse_events: 0;
+            scale: 1;
+            clip_to: "clip";
+            description {
+               state: "default" 0.0;
+               min: 1 0;
+               fixed: 1 0;
+               align: 0.5 0.5;
+               visible: 1;
+               rel1 {
+                  relative: 0.0  0.0;
+                  offset: 0 2;
+               }
+               rel2 {
+                  relative: 0.0  1.0;
+                  offset: 0 -2;
+               }
+               color: 0 0 0 255; // cursor color
+            }
+         }
+      }
+      programs {
+         program {
+            name: "focused";
+            signal: "entry,action,focus";
+            source: "entry";
+            action: STATE_SET "focused" 0.0;
+            target: "clip";
+         }
+         program {
+            name: "unfocused";
+            signal: "entry,action,unfocus";
+            source: "entry";
+            action: STATE_SET "default" 0.0;
+            target: "clip";
+         }
+      }
+   }
+
+   group {
+      name: "control/entry/selection/default";
+      parts {
+         part {
+            name: "bg";
+            type: RECT;
+            scale: 1;
+            mouse_events: 0;
+            description {
+               state: "default" 0.0;
+               color: 138 183 223 128;
+            }
+         }
+      }
+   }
+}
diff --git a/Tools/EWebLauncher/main.c b/Tools/EWebLauncher/main.c
index 4089d6eca..06703cff9 100644
--- a/Tools/EWebLauncher/main.c
+++ b/Tools/EWebLauncher/main.c
@@ -30,7 +30,7 @@
 
 #include "EWebKit.h"
 
-#include <ctype.h>
+#include "url_bar.h"
 #include <Ecore.h>
 #include <Ecore_Evas.h>
 #include <Ecore_File.h>
@@ -38,6 +38,7 @@
 #include <Ecore_X.h>
 #include <Edje.h>
 #include <Evas.h>
+#include <ctype.h>
 #include <inttypes.h>
 #include <limits.h>
 #include <stdio.h>
@@ -143,6 +144,7 @@ typedef struct _ELauncher {
     Evas *evas;
     Evas_Object *bg;
     Evas_Object *browser;
+    Url_Bar *url_bar;
     const char *theme;
     const char *userAgent;
     const char *backingStore;
@@ -402,6 +404,13 @@ on_inputmethod_changed(void* user_data, Evas_Object* webview, void* event_info)
 }
 
 static void
+on_url_changed(void* user_data, Evas_Object* webview, void* event_info)
+{
+    ELauncher *app = (ELauncher *)user_data;
+    url_bar_url_set(app->url_bar, ewk_view_uri_get(app->browser));
+}
+
+static void
 on_mouse_down(void* data, Evas* e, Evas_Object* webview, void* event_info)
 {
     Evas_Event_Mouse_Down *ev = (Evas_Event_Mouse_Down*) event_info;
@@ -695,6 +704,7 @@ browserCreate(const char *url, const char *theme, const char *userAgent, Eina_Re
     evas_object_smart_callback_add(app->browser, "menubar,visible,get", on_menubar_visible_get, app);
     evas_object_smart_callback_add(app->browser, "tooltip,text,set", on_tooltip_text_set, app);
     evas_object_smart_callback_add(app->browser, "inputmethod,changed", on_inputmethod_changed, app);
+    evas_object_smart_callback_add(app->browser, "uri,changed", on_url_changed, app);
 
 /*     ewk_callback_resize_requested_add(app->browser, on_resize_requested, app->ee); */
 
@@ -704,8 +714,10 @@ browserCreate(const char *url, const char *theme, const char *userAgent, Eina_Re
     evas_object_event_callback_add(app->browser, EVAS_CALLBACK_FOCUS_OUT, on_focus_out, app);
     evas_object_event_callback_add(app->browser, EVAS_CALLBACK_DEL, on_browser_del, app);
 
-    evas_object_move(app->browser, 10, 10);
-    evas_object_resize(app->browser, geometry.w - 20, geometry.h - 20);
+    app->url_bar = url_bar_add(app->browser, DEFAULT_WIDTH);
+
+    evas_object_move(app->browser, 0, URL_BAR_HEIGHT);
+    evas_object_resize(app->browser, geometry.w, geometry.h - URL_BAR_HEIGHT);
 
     if (url && (url[0] != '\0'))
         ewk_view_uri_set(app->browser, url);
@@ -739,6 +751,7 @@ closeWindow(Ecore_Evas *ee)
             break;
     }
     windows = eina_list_remove(windows, app);
+    url_bar_del(((ELauncher *)app)->url_bar);
     browserDestroy(ee);
     free(app);
 }
@@ -760,12 +773,12 @@ main_signal_exit(void *data, int ev_type, void *ev)
 static char *
 findThemePath(const char *theme)
 {
-    const char *defaultTheme = DATA_DIR"/default.edj";
+    const char *default_theme = THEME_DIR"/default.edj";
     char *rpath;
     struct stat st;
 
     if (!theme)
-        theme = defaultTheme;
+        theme = default_theme;
 
     rpath = ecore_file_realpath(theme);
     if (!strlen(rpath) || stat(rpath, &st)) {
diff --git a/Tools/EWebLauncher/url_bar.c b/Tools/EWebLauncher/url_bar.c
new file mode 100644
index 000000000..4ec6b1b28
--- /dev/null
+++ b/Tools/EWebLauncher/url_bar.c
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "url_bar.h"
+
+#include <Edje.h>
+#include <Ecore_File.h>
+
+#define PADDING_SIZE 5
+
+static const char *
+_url_bar_url_get_with_protocol(Url_Bar *urlBar)
+{
+    const char *url = edje_object_part_text_get(urlBar->entry, "url.text");
+    if (ecore_file_exists(url))
+        return eina_stringshare_printf("file://%s", url);
+
+    if (!strstr(url, "://"))
+        return eina_stringshare_printf("http://%s", url);
+    return eina_stringshare_add(url);
+}
+
+static void
+on_urlbar_key_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
+{
+    Evas_Event_Key_Down *ev = event_info;
+    Url_Bar *urlBar = (Url_Bar *)data;
+
+    if (!ev->key || strcmp(ev->key, "Return"))
+        return;
+
+    const char *url = _url_bar_url_get_with_protocol(urlBar);
+    if (url) {
+        ewk_view_uri_set(urlBar->webView, url);
+        eina_stringshare_del(url);
+    }
+    evas_object_focus_set(urlBar->webView, EINA_TRUE);
+}
+
+static void
+on_urlbar_mouse_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
+{
+    Evas_Event_Mouse_Down *ev = event_info;
+    Url_Bar *urlBar = (Url_Bar *)data;
+
+    if (ev->button == 1) {
+        evas_object_focus_set(urlBar->entry, EINA_TRUE);
+        edje_object_signal_emit(urlBar->entry, "entry,action,focus", "entry");
+    }
+}
+
+static void
+on_urlbar_focus_out(void *data, Evas *e, Evas_Object *obj, void *event_info)
+{
+    Url_Bar *urlBar = (Url_Bar *)data;
+
+    edje_object_signal_emit(urlBar->entry, "entry,action,unfocus", "entry");
+}
+
+Url_Bar *
+url_bar_add(Evas_Object *webView, int width)
+{
+    Evas *evas;
+    Url_Bar *url_bar;
+    if (!webView)
+        return NULL;
+    evas = evas_object_evas_get(webView);
+
+    url_bar = (Url_Bar *)malloc(sizeof(Url_Bar));
+    url_bar->webView = webView;
+
+    url_bar->area = evas_object_rectangle_add(evas);
+    evas_object_name_set(url_bar->area, "url_barArea");
+    evas_object_color_set(url_bar->area, 255, 255, 255, 255);
+    evas_object_move(url_bar->area, 0, 0);
+    evas_object_resize(url_bar->area, width, URL_BAR_HEIGHT);
+    evas_object_show(url_bar->area);
+
+    url_bar->entry = edje_object_add(evas);
+    Eina_Bool ret = edje_object_file_set(url_bar->entry, THEME_DIR"/entry.edj", "control/entry/base/default");
+    if (!ret) {
+        evas_object_del(url_bar->area);
+
+        free(url_bar);
+        return NULL;
+    }
+
+    edje_object_part_text_set(url_bar->entry, "url.text", "");
+    evas_object_move(url_bar->entry, PADDING_SIZE, PADDING_SIZE);
+    evas_object_resize(url_bar->entry, width - PADDING_SIZE * 2, URL_BAR_HEIGHT - PADDING_SIZE * 2);
+    evas_object_show(url_bar->entry);
+    evas_object_event_callback_add(url_bar->entry, EVAS_CALLBACK_MOUSE_DOWN, on_urlbar_mouse_down, url_bar);
+    evas_object_event_callback_add(url_bar->entry, EVAS_CALLBACK_KEY_DOWN, on_urlbar_key_down, url_bar);
+    evas_object_event_callback_add(url_bar->entry, EVAS_CALLBACK_FOCUS_OUT, on_urlbar_focus_out, url_bar);
+
+    return url_bar;
+}
+
+void
+url_bar_del(Url_Bar *urlBar)
+{
+    if (!urlBar)
+        return;
+
+    evas_object_event_callback_del(urlBar->entry, EVAS_CALLBACK_KEY_DOWN, on_urlbar_key_down);
+    evas_object_event_callback_del(urlBar->entry, EVAS_CALLBACK_MOUSE_DOWN, on_urlbar_mouse_down);
+    evas_object_event_callback_del(urlBar->entry, EVAS_CALLBACK_FOCUS_OUT, on_urlbar_focus_out);
+
+    evas_object_del(urlBar->area);
+    evas_object_del(urlBar->entry);
+    free(urlBar);
+}
+
+void
+url_bar_url_set(Url_Bar *urlBar, const char *url)
+{
+    if (!urlBar || !url)
+        return;
+
+    edje_object_part_text_set(urlBar->entry, "url.text", url);
+}
diff --git a/Tools/EWebLauncher/url_bar.h b/Tools/EWebLauncher/url_bar.h
new file mode 100644
index 000000000..472576fb5
--- /dev/null
+++ b/Tools/EWebLauncher/url_bar.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef url_bar_h
+#define url_bar_h
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <Evas.h>
+
+#define URL_BAR_HEIGHT 30
+
+typedef struct _Url_Bar {
+    Evas_Object *webView;
+    Evas_Object *area;
+    Evas_Object *entry;
+} Url_Bar;
+
+Url_Bar *url_bar_add(Evas_Object* webview, int width);
+void url_bar_del(Url_Bar *urlBar);
+void url_bar_url_set(Url_Bar *urlBar, const char *url);
+
+#ifdef __cplusplus
+}
+#endif
+#endif // url_bar_h
diff --git a/Tools/GNUmakefile.am b/Tools/GNUmakefile.am
index 72ca88d7a..d5a43337b 100644
--- a/Tools/GNUmakefile.am
+++ b/Tools/GNUmakefile.am
@@ -164,6 +164,7 @@ Programs_DumpRenderTree_CFLAGS = \
 Programs_DumpRenderTree_LDADD = \
 	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
 	libwebkitgtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
+	libWebCorePlatform.la \
 	libWebCoreModules.la \
 	libWebCoreInternals.la \
 	$(GLOBALDEPS_LIBS) \
diff --git a/Tools/MiniBrowser/efl/CMakeLists.txt b/Tools/MiniBrowser/efl/CMakeLists.txt
index 753c4495a..79ab3e5fb 100644
--- a/Tools/MiniBrowser/efl/CMakeLists.txt
+++ b/Tools/MiniBrowser/efl/CMakeLists.txt
@@ -1,6 +1,7 @@
 SET(MiniBrowser_DIR "${TOOLS_DIR}/MiniBrowser/efl")
 
 SET(MiniBrowser_SOURCES
+    ${TOOLS_DIR}/EWebLauncher/url_bar.c
     ${MiniBrowser_DIR}/main.c
 )
 
@@ -10,6 +11,7 @@ SET(MiniBrowser_INCLUDE_DIRECTORIES
     ${EDJE_INCLUDE_DIRS}
     ${EFLDEPS_INCLUDE_DIRS}
     ${EVAS_INCLUDE_DIRS}
+    ${TOOLS_DIR}/EWebLauncher
     ${WEBKIT2_DIR}/UIProcess/API/efl
     ${WEBKIT2_DIR}
     ${CMAKE_SOURCE_DIR}/Source
@@ -54,3 +56,5 @@ ADD_EXECUTABLE(MiniBrowser ${MiniBrowser_SOURCES})
 TARGET_LINK_LIBRARIES(MiniBrowser ${MiniBrowser_LIBRARIES})
 ADD_TARGET_PROPERTIES(MiniBrowser LINK_FLAGS "${MiniBrowser_LINK_FLAGS}")
 SET_TARGET_PROPERTIES(MiniBrowser PROPERTIES FOLDER "Tools")
+
+ADD_DEPENDENCIES(MiniBrowser ThemeControl)
diff --git a/Tools/MiniBrowser/efl/main.c b/Tools/MiniBrowser/efl/main.c
index 02630f1a8..1cbf7844a 100644
--- a/Tools/MiniBrowser/efl/main.c
+++ b/Tools/MiniBrowser/efl/main.c
@@ -18,6 +18,7 @@
  */
 
 #include "EWebKit2.h"
+#include "url_bar.h"
 #include <Ecore.h>
 #include <Ecore_Evas.h>
 #include <Eina.h>
@@ -41,6 +42,7 @@ typedef struct _MiniBrowser {
     Evas *evas;
     Evas_Object *bg;
     Evas_Object *browser;
+    Url_Bar *url_bar;
 } MiniBrowser;
 
 static const Ecore_Getopt options = {
@@ -155,6 +157,13 @@ on_title_changed(void *user_data, Evas_Object *webview, void *event_info)
 }
 
 static void
+on_url_changed(void *user_data, Evas_Object *webview, void *event_info)
+{
+    MiniBrowser *app = (MiniBrowser *)user_data;
+    url_bar_url_set(app->url_bar, ewk_view_uri_get(app->browser));
+}
+
+static void
 on_progress(void *user_data, Evas_Object *webview, void *event_info)
 {
     MiniBrowser *app = (MiniBrowser *)user_data;
@@ -224,14 +233,18 @@ static MiniBrowser *browserCreate(const char *url, const char *engine)
     evas_object_smart_callback_add(app->browser, "load,error", on_error, app);
     evas_object_smart_callback_add(app->browser, "load,progress", on_progress, app);
     evas_object_smart_callback_add(app->browser, "title,changed", on_title_changed, app);
+    evas_object_smart_callback_add(app->browser, "uri,changed", on_url_changed, app);
 
     evas_object_event_callback_add(app->browser, EVAS_CALLBACK_KEY_DOWN, on_key_down, app);
 
     evas_object_size_hint_weight_set(app->browser, EVAS_HINT_EXPAND, EVAS_HINT_EXPAND);
-    evas_object_resize(app->browser, DEFAULT_WIDTH, DEFAULT_HEIGHT);
+    evas_object_move(app->browser, 0, URL_BAR_HEIGHT);
+    evas_object_resize(app->browser, DEFAULT_WIDTH, DEFAULT_HEIGHT - URL_BAR_HEIGHT);
     evas_object_show(app->browser);
     evas_object_focus_set(app->browser, EINA_TRUE);
 
+    app->url_bar = url_bar_add(app->browser, DEFAULT_WIDTH);
+
     ewk_view_uri_set(app->browser, url);
 
     return app;
diff --git a/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m b/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m
index 46a8c1cbf..16e86b404 100644
--- a/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m
+++ b/Tools/MiniBrowser/mac/WebBundle/WebBundleMain.m
@@ -99,7 +99,8 @@ void WKBundleInitialize(WKBundleRef bundle, WKTypeRef initializationUserData)
         didCreatePage,
         willDestroyPage,
         0, // didInitializePageGroup
-        didReceiveMessage
+        didReceiveMessage,
+        0 // didReceiveMessageToPage
     };
     WKBundleSetClient(bundle, &client);
 }
diff --git a/Tools/QtTestBrowser/launcherwindow.cpp b/Tools/QtTestBrowser/launcherwindow.cpp
index caa79c994..d9dd0f93f 100644
--- a/Tools/QtTestBrowser/launcherwindow.cpp
+++ b/Tools/QtTestBrowser/launcherwindow.cpp
@@ -469,6 +469,14 @@ void LauncherWindow::createChrome()
     togglePlugins->setCheckable(true);
     togglePlugins->setChecked(false);
 
+    QAction* toggleScrollAnimator = settingsMenu->addAction("Enable Scroll Animator", this, SLOT(toggleScrollAnimator(bool)));
+#if ENABLE(SMOOTH_SCROLLING)
+    toggleScrollAnimator->setCheckable(true);
+#else
+    toggleScrollAnimator->setCheckable(false);
+#endif
+    toggleScrollAnimator->setChecked(false);
+
     QAction* toggleInterruptingJavaScripteEnabled = settingsMenu->addAction("Enable interrupting js scripts", this, SLOT(toggleInterruptingJavaScriptEnabled(bool)));
     toggleInterruptingJavaScripteEnabled->setCheckable(true);
     toggleInterruptingJavaScripteEnabled->setChecked(false);
@@ -1085,6 +1093,12 @@ void LauncherWindow::setOfflineStorageDefaultQuota()
     }
 }
 
+void LauncherWindow::toggleScrollAnimator(bool toggle)
+{
+    m_windowOptions.enableScrollAnimator = toggle;
+    page()->settings()->setAttribute(QWebSettings::ScrollAnimatorEnabled, toggle);
+}
+
 LauncherWindow* LauncherWindow::newWindow()
 {
     LauncherWindow* mw = new LauncherWindow(&m_windowOptions);
diff --git a/Tools/QtTestBrowser/launcherwindow.h b/Tools/QtTestBrowser/launcherwindow.h
index 69ebe65d2..3de8667fa 100644
--- a/Tools/QtTestBrowser/launcherwindow.h
+++ b/Tools/QtTestBrowser/launcherwindow.h
@@ -77,6 +77,7 @@ public:
         , useOfflineStorageDatabase(false)
         , useOfflineWebApplicationCache(false)
         , useDiskCookies(true)
+        , enableScrollAnimator(false)
         , offlineStorageDefaultQuotaSize(0)
 #ifndef QT_NO_OPENGL
         , useQGLWidgetViewport(false)
@@ -100,6 +101,7 @@ public:
     bool useOfflineStorageDatabase;
     bool useOfflineWebApplicationCache;
     bool useDiskCookies;
+    bool enableScrollAnimator;
     quint64 offlineStorageDefaultQuotaSize;
 #ifndef QT_NO_OPENGL
     bool useQGLWidgetViewport;
@@ -162,6 +164,7 @@ protected Q_SLOTS:
     void toggleLocalStorage(bool toggle);
     void toggleOfflineStorageDatabase(bool toggle);
     void toggleOfflineWebApplicationCache(bool toggle);
+    void toggleScrollAnimator(bool toggle);
     void setOfflineStorageDefaultQuota();
 #ifndef QT_NO_LINEEDIT
     void showFindBar();
diff --git a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
index f9767168c..562d19ec8 100644
--- a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
+++ b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
@@ -26,6 +26,11 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import copy
+import logging
+
+
+_log = logging.getLogger(__name__)
 
 # Yes, it's a hypergraph.
 # FIXME: Should this function live with the ports somewhere?
@@ -121,6 +126,13 @@ class BaselineOptimizer(object):
         results_by_port_name = self._results_by_port_name(results_by_directory)
         port_names_by_result = _invert_dictionary(results_by_port_name)
 
+        new_results_by_directory = self._optimize_by_most_specific_common_directory(results_by_directory, results_by_port_name, port_names_by_result)
+        if not new_results_by_directory:
+            new_results_by_directory = self._optimize_by_pushing_results_up(results_by_directory, results_by_port_name, port_names_by_result)
+
+        return results_by_directory, new_results_by_directory
+
+    def _optimize_by_most_specific_common_directory(self, results_by_directory, results_by_port_name, port_names_by_result):
         new_results_by_directory = {}
         unsatisfied_port_names_by_result = port_names_by_result
         while unsatisfied_port_names_by_result:
@@ -133,10 +145,49 @@ class BaselineOptimizer(object):
             new_unsatisfied_port_names_by_result = self._filter_port_names_by_result(is_unsatisfied, port_names_by_result)
 
             if len(new_unsatisfied_port_names_by_result.values()) >= len(unsatisfied_port_names_by_result.values()):
-                break  # Frowns. We do not appear to be converging.
+                return {}  # Frowns. We do not appear to be converging.
             unsatisfied_port_names_by_result = new_unsatisfied_port_names_by_result
 
-        return results_by_directory, new_results_by_directory
+        return new_results_by_directory
+
+    def _optimize_by_pushing_results_up(self, results_by_directory, results_by_port_name, port_names_by_result):
+        try:
+            results_by_directory = results_by_directory
+            best_so_far = results_by_directory
+            while True:
+                new_results_by_directory = copy.copy(best_so_far)
+                for port_name in self._hypergraph.keys():
+                    fallback_path = self._hypergraph[port_name]
+                    current_index, current_directory = self._find_in_fallbackpath(fallback_path, results_by_port_name[port_name], best_so_far)
+                    current_result = results_by_port_name[port_name]
+                    for index in range(current_index + 1, len(fallback_path)):
+                        new_directory = fallback_path[index]
+                        if not new_directory in new_results_by_directory:
+                            new_results_by_directory[new_directory] = current_result
+                            if current_directory in new_results_by_directory:
+                                del new_results_by_directory[current_directory]
+                        elif new_results_by_directory[new_directory] == current_result:
+                            if current_directory in new_results_by_directory:
+                                del new_results_by_directory[current_directory]
+                        else:
+                            # The new_directory contains a different result, so stop trying to push results up.
+                            break
+
+                if len(new_results_by_directory) >= len(best_so_far):
+                    # We've failed to improve, so give up.
+                    break
+                best_so_far = new_results_by_directory
+
+            return best_so_far
+        except KeyError as e:
+            # FIXME: KeyErrors get raised if we're missing baselines. We should handle this better.
+            return results_by_directory
+
+    def _find_in_fallbackpath(self, fallback_path, current_result, results_by_directory):
+        for index, directory in enumerate(fallback_path):
+            if directory in results_by_directory and (results_by_directory[directory] == current_result):
+                return index, directory
+        assert False, "result %s not found in fallback_path %s, %s" % (current_result, fallback_path, results_by_directory)
 
     def _filtered_results_by_port_name(self, results_by_directory):
         results_by_port_name = self._results_by_port_name(results_by_directory)
@@ -157,7 +208,12 @@ class BaselineOptimizer(object):
             if new_results_by_directory.get(directory) != result:
                 file_names.append(self._filesystem.join(self._scm.checkout_root, directory, baseline_name))
         if file_names:
+            _log.debug("deleting:")
+            for filename in file_names:
+                _log.debug("  " + self._filesystem.relpath(filename, self._scm.checkout_root).replace(baseline_name, ''))
             self._scm.delete_list(file_names)
+        else:
+            _log.debug("nothing to delete")
 
         file_names = []
         for directory, result in new_results_by_directory.items():
@@ -167,7 +223,12 @@ class BaselineOptimizer(object):
                 self._filesystem.write_binary_file(destination, data_for_result[result])
                 file_names.append(destination)
         if file_names:
+            _log.debug("adding:")
+            for filename in file_names:
+                _log.debug("  " + self._filesystem.relpath(filename, self._scm.checkout_root).replace(baseline_name, ''))
             self._scm.add_list(file_names)
+        else:
+            _log.debug("nothing to add")
 
     def directories_by_result(self, baseline_name):
         results_by_directory = self._read_results_by_directory(baseline_name)
@@ -175,7 +236,20 @@ class BaselineOptimizer(object):
 
     def optimize(self, baseline_name):
         results_by_directory, new_results_by_directory = self._find_optimal_result_placement(baseline_name)
+        self.new_results_by_directory = new_results_by_directory
+        if new_results_by_directory == results_by_directory:
+            _log.debug("No optimization found, optimal?")
+            return True
         if self._filtered_results_by_port_name(results_by_directory) != self._filtered_results_by_port_name(new_results_by_directory):
+            _log.warning("Optimization failed")
             return False
+
+        _log.debug("before: ")
+        for path, result in results_by_directory.items():
+            _log.debug("  %s: %s" % (self._filesystem.relpath(path, self._scm.checkout_root).replace(baseline_name, ''), result[0:6]))
+        _log.debug("after: ")
+        for path, result in new_results_by_directory.items():
+            _log.debug("  %s: %s" % (self._filesystem.relpath(path, self._scm.checkout_root).replace(baseline_name, ''), result[0:6]))
+
         self._move_baselines(baseline_name, results_by_directory, new_results_by_directory)
         return True
diff --git a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
index 0325991d1..082bc6576 100644
--- a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
+++ b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
@@ -74,6 +74,20 @@ class BaselineOptimizerTest(unittest.TestCase):
         })
         self.assertEqual(host.filesystem.read_binary_file('/mock-checkout/LayoutTests/platform/chromium/another/test-expected.txt'), 'result A')
 
+    def test_platform_mac_different(self):
+        self._assertOptimization({
+            'LayoutTests': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
+            'LayoutTests/platform/mac': '453e67177a75b2e79905154ece0efba6e5bfb65d',
+            'LayoutTests/platform/mac-lion': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
+            'LayoutTests/platform/chromium-mac': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
+            'LayoutTests/platform/chromium-win': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
+        }, {
+            'LayoutTests': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
+            'LayoutTests/platform/mac': '453e67177a75b2e79905154ece0efba6e5bfb65d',
+            'LayoutTests/platform/mac-lion': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
+            'LayoutTests/platform/chromium': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
+        })
+
     def test_chromium_linux_redundant_with_win(self):
         self._assertOptimization({
             'LayoutTests/platform/chromium-win': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
diff --git a/Tools/Scripts/webkitpy/common/config/committers.py b/Tools/Scripts/webkitpy/common/config/committers.py
index 693b47ed4..1b170847b 100644
--- a/Tools/Scripts/webkitpy/common/config/committers.py
+++ b/Tools/Scripts/webkitpy/common/config/committers.py
@@ -107,10 +107,8 @@ watchers_who_are_not_contributors = [
 
 
 contributors_who_are_not_committers = [
-    Contributor("Adam Kallai", "kadam@inf.u-szeged.hu", 'kadam'),
     Contributor("Aharon Lanin", "aharon@google.com"),
     Contributor("Alan Stearns", "stearns@adobe.com", 'astearns'),
-    Contributor("Alexandre Elias", "aelias@chromium.org"),
     Contributor("Alexey Marinichev", ["amarinichev@chromium.org", "amarinichev@google.com"], "amarinichev"),
     Contributor("Andras Piroska", "pandras@inf.u-szeged.hu", "andris88"),
     Contributor("Andrei Bucur", "abucur@adobe.com", "abucur"),
@@ -181,6 +179,7 @@ contributors_who_are_not_committers = [
 committers_unable_to_review = [
     Committer("Aaron Boodman", "aa@chromium.org", "aboodman"),
     Committer("Adam Bergkvist", "adam.bergkvist@ericsson.com", "adambe"),
+    Committer("Adam Kallai", "kadam@inf.u-szeged.hu", 'kadam'),
     Committer("Adam Klein", "adamk@chromium.org", "aklein"),
     Committer("Adam Langley", "agl@chromium.org", "agl"),
     Committer("Ademar de Souza Reis Jr", ["ademar.reis@gmail.com", "ademar@webkit.org"], "ademar"),
@@ -188,6 +187,7 @@ committers_unable_to_review = [
     Committer("Alec Flett", ["alecflett@chromium.org", "alecflett@google.com"], "alecf"),
     Committer(u"Alexander F\u00e6r\u00f8y", ["ahf@0x90.dk", "alexander.faeroy@nokia.com"], "ahf"),
     Committer("Alexander Kellett", ["lypanov@mac.com", "a-lists001@lypanov.net", "lypanov@kde.org"], "lypanov"),
+    Committer("Alexandre Elias", ["aelias@chromium.org", "aelias@google.com"], "aelias"),
     Committer("Alexandru Chiculita", "achicu@adobe.com", "achicu"),
     Committer("Alice Boxhall", "aboxhall@chromium.org", "aboxhall"),
     Committer("Allan Sandfeld Jensen", ["allan.jensen@nokia.com", "kde@carewolf.com", "sandfeld@kde.org"], "carewolf"),
@@ -384,6 +384,7 @@ committers_unable_to_review = [
     Committer("Tristan O'Tierney", ["tristan@otierney.net", "tristan@apple.com"]),
     Committer("Vangelis Kokkevis", "vangelis@chromium.org", "vangelis"),
     Committer("Viatcheslav Ostapenko", "ostapenko.viatcheslav@nokia.com", "ostap"),
+    Committer("Victor Carbune", "victor@rosedu.org", "vcarbune"),
     Committer("Victor Wang", "victorw@chromium.org", "victorw"),
     Committer("Victoria Kirst", ["vrk@chromium.org", "vrk@google.com"], "vrk"),
     Committer("Vincent Scheib", "scheib@chromium.org", "scheib"),
@@ -424,7 +425,7 @@ reviewers_list = [
     Reviewer("Alejandro G. Castro", ["alex@igalia.com", "alex@webkit.org"], "alexg__"),
     Reviewer("Alexander Pavlov", ["apavlov@chromium.org", "pavlov81@gmail.com"], "apavlov"),
     Reviewer("Alexey Proskuryakov", ["ap@webkit.org", "ap@apple.com"], "ap"),
-    Reviewer("Alexis Menard", ["alexis.menard@openbossa.org", "menard@kde.org"], "darktears"),
+    Reviewer("Alexis Menard", ["alexis@webkit.org", "menard@kde.org"], "darktears"),
     Reviewer("Alice Liu", "alice.liu@apple.com", "aliu"),
     Reviewer("Alp Toker", ["alp@nuanti.com", "alp@atoker.com", "alp@webkit.org"], "alp"),
     Reviewer("Anders Carlsson", ["andersca@apple.com", "acarlsson@apple.com"], "andersca"),
diff --git a/Tools/Scripts/webkitpy/common/config/watchlist b/Tools/Scripts/webkitpy/common/config/watchlist
index ce7b7fe9a..513403bc7 100755
--- a/Tools/Scripts/webkitpy/common/config/watchlist
+++ b/Tools/Scripts/webkitpy/common/config/watchlist
@@ -224,7 +224,7 @@
         "Battery": [ "gyuyoung.kim@samsung.com" ],
         "BlackBerry": [ "mifenton@rim.com" ],
         "CMake": [ "rakuco@webkit.org", "gyuyoung.kim@samsung.com" ],
-        "CSS": [ "alexis.menard@openbossa.org", "macpherson@chromium.org", "cmarcelo@webkit.org" ],
+        "CSS": [ "alexis@webkit.org", "macpherson@chromium.org", "cmarcelo@webkit.org" ],
         "ChromiumGraphics": [ "jamesr@chromium.org", "cc-bugs@google.com" ],
         "ChromiumPublicApi": [ "abarth@webkit.org", "dglazkov@chromium.org", "fishd@chromium.org", "jamesr@chromium.org", "tkent+wkapi@chromium.org" ],
         "DOMAttributes": [ "cmarcelo@webkit.org", ],
@@ -234,7 +234,7 @@
         "Editing": [ "mifenton@rim.com" ],
         "Forms": [ "tkent@chromium.org", "mifenton@rim.com" ],
         "FrameLoader": [ "abarth@webkit.org", "japhet@chromium.org" ],
-        "GStreamerGraphics": [ "alexis.menard@openbossa.org", "pnormand@igalia.com", "gns@gnome.org", "mrobinson@webkit.org" ],
+        "GStreamerGraphics": [ "alexis@webkit.org", "pnormand@igalia.com", "gns@gnome.org", "mrobinson@webkit.org" ],
         "GtkWebKit2PublicAPI": [ "cgarcia@igalia.com", "gns@gnome.org", "mrobinson@webkit.org" ],
         "Loader": [ "japhet@chromium.org" ],
         "MathML": [ "dbarton@mathscribe.com" ],
@@ -244,8 +244,8 @@
         "SkiaGraphics": [ "senorblanco@chromium.org" ],
         "QtBuildSystem" : [ "vestbo@webkit.org", ],
         "QtGraphics" : [ "noam.rosenthal@nokia.com" ],
-        "QtWebKit2PlatformSpecific": [ "alexis.menard@openbossa.org", "zoltan@webkit.org", "cmarcelo@webkit.org" ],
-        "QtWebKit2PublicAPI": [ "alexis.menard@openbossa.org", "zoltan@webkit.org", "cmarcelo@webkit.org" ],
+        "QtWebKit2PlatformSpecific": [ "alexis@webkit.org", "zoltan@webkit.org", "cmarcelo@webkit.org" ],
+        "QtWebKit2PublicAPI": [ "alexis@webkit.org", "zoltan@webkit.org", "cmarcelo@webkit.org" ],
         "Rendering": [ "eric@webkit.org" ],
         "ScrollingCoordinator": [ "andersca@apple.com", "jamesr@chromium.org", "tonikitoo@webkit.org" ],
         "SecurityCritical": [ "abarth@webkit.org" ],
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem.py b/Tools/Scripts/webkitpy/common/system/filesystem.py
index d8ee167ae..3786c6fed 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem.py
@@ -44,13 +44,8 @@ class FileSystem(object):
 
     Unless otherwise noted, all paths are allowed to be either absolute
     or relative."""
-    def __init__(self):
-        self._sep = os.sep
-
-    def _get_sep(self):
-        return self._sep
-
-    sep = property(_get_sep, doc="pathname separator")
+    sep = os.sep
+    pardir = os.pardir
 
     def abspath(self, path):
         return os.path.abspath(path)
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
index c2d823a81..d87fe1b8e 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_mock.py
@@ -36,6 +36,9 @@ from webkitpy.common.system import path
 
 
 class MockFileSystem(object):
+    sep = '/'
+    pardir = '..'
+
     def __init__(self, files=None, dirs=None, cwd='/'):
         """Initializes a "mock" filesystem that can be used to completely
         stub out a filesystem.
@@ -48,7 +51,6 @@ class MockFileSystem(object):
         self.files = files or {}
         self.written_files = {}
         self.last_tmpdir = None
-        self._sep = '/'
         self.current_tmpno = 0
         self.cwd = cwd
         self.dirs = set(dirs or [])
@@ -59,11 +61,6 @@ class MockFileSystem(object):
                 self.dirs.add(d)
                 d = self.dirname(d)
 
-    def _get_sep(self):
-        return self._sep
-
-    sep = property(_get_sep, doc="pathname separator")
-
     def clear_written_files(self):
         # This function can be used to track what is written between steps in a test.
         self.written_files = {}
@@ -343,8 +340,8 @@ class MockFileSystem(object):
         path = self.abspath(path)
 
         if not path.lower().startswith(start.lower()):
-            # Then path is outside the directory given by start.
-            return None  # FIXME: os.relpath still returns a path here.
+            # path is outside the directory given by start; compute path from root
+            return '../' * start.count('/') + path
 
         rel_path = path[len(start):]
 
@@ -359,7 +356,8 @@ class MockFileSystem(object):
         else:
             # We are in the case typified by the following example:
             # path = "/tmp/foobar", start = "/tmp/foo" -> rel_path = "bar"
-            return None
+            # FIXME: We return a less-than-optimal result here.
+            return '../' * start.count('/') + path
 
         return rel_path
 
diff --git a/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py b/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py
index 4859f7294..e6d1e428f 100644
--- a/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/filesystem_unittest.py
@@ -255,11 +255,6 @@ class RealFileSystemTest(unittest.TestCase, GenericFileSystemTests):
         self.assertEquals(fs.join("foo", "bar"),
                           os.path.join("foo", "bar"))
 
-    def test_sep__is_readonly(self):
-        def assign_sep():
-            fs.sep = ' '
-        fs = FileSystem()
-        self.assertRaises(AttributeError, assign_sep)
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py b/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
index ae3470a5d..edac8ebb3 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/single_test_runner.py
@@ -321,14 +321,14 @@ class SingleTestRunner(object):
             failures.append(test_failures.FailureReftestNoImagesGenerated(reference_filename))
         elif mismatch:
             if reference_driver_output.image_hash == actual_driver_output.image_hash:
-                diff_result = self._port.diff_image(reference_driver_output.image, actual_driver_output.image)
+                diff_result = self._port.diff_image(reference_driver_output.image, actual_driver_output.image, tolerance=0)
                 if not diff_result[0]:
                     failures.append(test_failures.FailureReftestMismatchDidNotOccur(reference_filename))
                 else:
                     _log.warning("  %s -> ref test hashes matched but diff failed" % self._test_name)
 
         elif reference_driver_output.image_hash != actual_driver_output.image_hash:
-            diff_result = self._port.diff_image(reference_driver_output.image, actual_driver_output.image)
+            diff_result = self._port.diff_image(reference_driver_output.image, actual_driver_output.image, tolerance=0)
             if diff_result[0]:
                 failures.append(test_failures.FailureReftestMismatch(reference_filename))
             else:
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/test_expectations_editor_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/test_expectations_editor_unittest.py
index 09f9670a0..ad8aabd11 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/test_expectations_editor_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/test_expectations_editor_unittest.py
@@ -88,7 +88,7 @@ class TestExpectationEditorTests(unittest.TestCase):
         editor = TestExpectationsEditor(expectation_lines, MockBugManager())
         editor.remove_expectation(test, test_config_set, remove_flakes)
         converter = TestConfigurationConverter(self.test_port.all_test_configurations(), self.test_port.configuration_specifier_macros())
-        result = TestExpectationSerializer.list_to_string(expectation_lines, converter)
+        result = TestExpectations.list_to_string(expectation_lines, converter)
         self.assertEquals(result, expected_string)
 
     def assert_update_roundtrip(self, in_string, test, expectation_set, expected_string, expected_update_count, remove_flakes=False, parsed_bug_modifiers=None, test_configs=None):
@@ -100,7 +100,7 @@ class TestExpectationEditorTests(unittest.TestCase):
             self.assertTrue(updated_expectation_line in expectation_lines)
         self.assertEquals(len(updated_expectation_lines), expected_update_count)
         converter = TestConfigurationConverter(self.test_port.all_test_configurations(), self.test_port.configuration_specifier_macros())
-        result = TestExpectationSerializer.list_to_string(expectation_lines, converter)
+        result = TestExpectations.list_to_string(expectation_lines, converter)
         self.assertEquals(result, expected_string)
 
     def test_remove_expectation(self):
@@ -188,35 +188,35 @@ BUGX2 WIN : failures/expected/audio.html = IMAGE"""
         test = "failures/expected/keyboard.html"
 
         editor.remove_expectation(test, set([TestConfiguration('xp', 'x86', 'release')]))
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 XP DEBUG : failures/expected/keyboard.html = IMAGE
 BUGX1 VISTA WIN7 : failures/expected/keyboard.html = IMAGE
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.remove_expectation(test, set([TestConfiguration('xp', 'x86', 'debug')]))
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 VISTA WIN7 : failures/expected/keyboard.html = IMAGE
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.remove_expectation(test, set([TestConfiguration('vista', 'x86', 'debug'), TestConfiguration('win7', 'x86', 'release')]))
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 VISTA RELEASE : failures/expected/keyboard.html = IMAGE
 BUGX1 WIN7 DEBUG : failures/expected/keyboard.html = IMAGE
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.remove_expectation(test, set([TestConfiguration('vista', 'x86', 'debug'), TestConfiguration('vista', 'x86', 'release')]))
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 WIN7 DEBUG : failures/expected/keyboard.html = IMAGE
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.remove_expectation(test, set(self.test_port.all_test_configurations()))
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         test = "failures/expected/audio.html"
 
         editor.remove_expectation(test, set(self.test_port.all_test_configurations()))
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), "")
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), "")
 
     def test_update_expectation(self):
         self.assert_update_roundtrip("""
@@ -306,35 +306,35 @@ BUGX2 WIN : failures/expected/audio.html = IMAGE"""
         test = "failures/expected/keyboard.html"
 
         editor.update_expectation(test, set([TestConfiguration('xp', 'x86', 'release')]), set([IMAGE_PLUS_TEXT]), ['BUG_UPDATE1'])
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 XP DEBUG : failures/expected/keyboard.html = IMAGE
 BUGX1 VISTA WIN7 : failures/expected/keyboard.html = IMAGE
 BUG_UPDATE1 XP RELEASE : failures/expected/keyboard.html = IMAGE+TEXT
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.update_expectation(test, set([TestConfiguration('xp', 'x86', 'debug')]), set([TEXT]), ['BUG_UPDATE2'])
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 VISTA WIN7 : failures/expected/keyboard.html = IMAGE
 BUG_UPDATE2 XP DEBUG : failures/expected/keyboard.html = TEXT
 BUG_UPDATE1 XP RELEASE : failures/expected/keyboard.html = IMAGE+TEXT
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.update_expectation(test, self.WIN_RELEASE_CONFIGS, set([CRASH]), ['BUG_UPDATE3'])
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 VISTA WIN7 DEBUG : failures/expected/keyboard.html = IMAGE
 BUG_UPDATE2 XP DEBUG : failures/expected/keyboard.html = TEXT
 BUG_UPDATE3 WIN RELEASE : failures/expected/keyboard.html = CRASH
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.update_expectation(test, self.RELEASE_CONFIGS, set([IMAGE_PLUS_TEXT]), ['BUG_UPDATE4'])
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUGX1 VISTA WIN7 DEBUG : failures/expected/keyboard.html = IMAGE
 BUG_UPDATE2 XP DEBUG : failures/expected/keyboard.html = TEXT
 BUG_UPDATE4 RELEASE : failures/expected/keyboard.html = IMAGE+TEXT
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
         editor.update_expectation(test, set(self.test_port.all_test_configurations()), set([TIMEOUT]), ['BUG_UPDATE5'])
-        self.assertEquals(TestExpectationSerializer.list_to_string(expectation_lines, converter), """
+        self.assertEquals(TestExpectations.list_to_string(expectation_lines, converter), """
 BUG_UPDATE5 : failures/expected/keyboard.html = TIMEOUT
 BUGX2 WIN : failures/expected/audio.html = IMAGE""")
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
index 6b949397b..b02baf38d 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations.py
@@ -61,83 +61,6 @@ class ParseError(Exception):
         return 'ParseError(warnings=%s)' % self.warnings
 
 
-class TestExpectationSerializer(object):
-    """Provides means of serializing TestExpectationLine instances."""
-    def __init__(self, test_configuration_converter=None):
-        self._test_configuration_converter = test_configuration_converter
-        self._parsed_expectation_to_string = dict([[parsed_expectation, expectation_string] for expectation_string, parsed_expectation in TestExpectations.EXPECTATIONS.items()])
-
-    def to_string(self, expectation_line, include_modifiers=True, include_expectations=True, include_comment=True):
-        if expectation_line.is_invalid():
-            return expectation_line.original_string or ''
-
-        if expectation_line.name is None:
-            return '' if expectation_line.comment is None else "//%s" % expectation_line.comment
-
-        if self._test_configuration_converter and expectation_line.parsed_bug_modifiers:
-            specifiers_list = self._test_configuration_converter.to_specifiers_list(expectation_line.matching_configurations)
-            result = []
-            for specifiers in specifiers_list:
-                modifiers = self._parsed_modifier_string(expectation_line, specifiers)
-                expectations = self._parsed_expectations_string(expectation_line)
-                result.append(self._format_result(modifiers, expectation_line.name, expectations, expectation_line.comment))
-            return "\n".join(result) if result else None
-
-        return self._format_result(" ".join(expectation_line.modifiers),
-                                   expectation_line.name,
-                                   " ".join(expectation_line.expectations),
-                                   expectation_line.comment,
-                                   include_modifiers, include_expectations, include_comment)
-
-    def to_csv(self, expectation_line):
-        # Note that this doesn't include the comments.
-        return '%s,%s,%s' % (expectation_line.name, ' '.join(expectation_line.modifiers), ' '.join(expectation_line.expectations))
-
-    def _parsed_expectations_string(self, expectation_line):
-        result = []
-        for index in TestExpectations.EXPECTATION_ORDER:
-            if index in expectation_line.parsed_expectations:
-                result.append(self._parsed_expectation_to_string[index])
-        return ' '.join(result)
-
-    def _parsed_modifier_string(self, expectation_line, specifiers):
-        assert(self._test_configuration_converter)
-        result = []
-        if expectation_line.parsed_bug_modifiers:
-            result.extend(sorted(expectation_line.parsed_bug_modifiers))
-        result.extend(sorted(expectation_line.parsed_modifiers))
-        result.extend(self._test_configuration_converter.specifier_sorter().sort_specifiers(specifiers))
-        return ' '.join(result)
-
-    @classmethod
-    def _format_result(cls, modifiers, name, expectations, comment, include_modifiers=True, include_expectations=True, include_comment=True):
-        result = ''
-        if include_modifiers:
-            result += '%s : ' % modifiers.upper()
-        result += name
-        if include_expectations:
-            result += ' = %s' % expectations.upper()
-        if include_comment and comment is not None:
-            result += " //%s" % comment
-        return result
-
-    @classmethod
-    def list_to_string(cls, expectation_lines, test_configuration_converter=None, reconstitute_only_these=None):
-        serializer = cls(test_configuration_converter)
-
-        def serialize(expectation_line):
-            # If reconstitute_only_these is an empty list, we want to return original_string.
-            # So we need to compare reconstitute_only_these to None, not just check if it's falsey.
-            if reconstitute_only_these is None or expectation_line in reconstitute_only_these:
-                return serializer.to_string(expectation_line)
-            return expectation_line.original_string
-
-        def nones_out(expectation_line):
-            return expectation_line is not None
-
-        return "\n".join(filter(nones_out, map(serialize, expectation_lines)))
-
-
 class TestExpectationParser(object):
     """Provides parsing facilities for lines in the test_expectation.txt file."""
 
@@ -352,8 +275,8 @@ class TestExpectationLine(object):
     def is_flaky(self):
         return len(self.parsed_expectations) > 1
 
-    @classmethod
-    def create_passing_expectation(cls, test):
+    @staticmethod
+    def create_passing_expectation(test):
         expectation_line = TestExpectationLine()
         expectation_line.name = test
         expectation_line.path = test
@@ -362,6 +285,58 @@ class TestExpectationLine(object):
         expectation_line.matching_tests = [test]
         return expectation_line
 
+    def to_string(self, test_configuration_converter, include_modifiers=True, include_expectations=True, include_comment=True):
+        parsed_expectation_to_string = dict([[parsed_expectation, expectation_string] for expectation_string, parsed_expectation in TestExpectations.EXPECTATIONS.items()])
+
+        if self.is_invalid():
+            return self.original_string or ''
+
+        if self.name is None:
+            return '' if self.comment is None else "//%s" % self.comment
+
+        if test_configuration_converter and self.parsed_bug_modifiers:
+            specifiers_list = test_configuration_converter.to_specifiers_list(self.matching_configurations)
+            result = []
+            for specifiers in specifiers_list:
+                modifiers = self._serialize_parsed_modifiers(test_configuration_converter, specifiers)
+                expectations = self._serialize_parsed_expectations(parsed_expectation_to_string)
+                result.append(self._format_line(modifiers, self.name, expectations, self.comment))
+            return "\n".join(result) if result else None
+
+        return self._format_line(" ".join(self.modifiers), self.name, " ".join(self.expectations), self.comment,
+            include_modifiers, include_expectations, include_comment)
+
+    def to_csv(self):
+        # Note that this doesn't include the comments.
+        return '%s,%s,%s' % (self.name, ' '.join(self.modifiers), ' '.join(self.expectations))
+
+    def _serialize_parsed_expectations(self, parsed_expectation_to_string):
+        result = []
+        for index in TestExpectations.EXPECTATION_ORDER:
+            if index in self.parsed_expectations:
+                result.append(parsed_expectation_to_string[index])
+        return ' '.join(result)
+
+    def _serialize_parsed_modifiers(self, test_configuration_converter, specifiers):
+        result = []
+        if self.parsed_bug_modifiers:
+            result.extend(sorted(self.parsed_bug_modifiers))
+        result.extend(sorted(self.parsed_modifiers))
+        result.extend(test_configuration_converter.specifier_sorter().sort_specifiers(specifiers))
+        return ' '.join(result)
+
+    @staticmethod
+    def _format_line(modifiers, name, expectations, comment, include_modifiers=True, include_expectations=True, include_comment=True):
+        result = ''
+        if include_modifiers:
+            result += '%s : ' % modifiers.upper()
+        result += name
+        if include_expectations:
+            result += ' = %s' % expectations.upper()
+        if include_comment and comment is not None:
+            result += " //%s" % comment
+        return result
+
 
 # FIXME: Refactor API to be a proper CRUD.
 class TestExpectationsModel(object):
@@ -842,7 +817,7 @@ class TestExpectations(object):
         for expectation in expectations_to_remove:
             self._expectations.remove(expectation)
 
-        return TestExpectationSerializer.list_to_string(self._expectations, self._parser._test_configuration_converter, modified_expectations)
+        return self.list_to_string(self._expectations, self._parser._test_configuration_converter, modified_expectations)
 
     def remove_rebaselined_tests(self, except_these_tests, filename):
         """Returns a copy of the expectations in the file with the tests removed."""
@@ -852,7 +827,7 @@ class TestExpectations(object):
                         'rebaseline' in expectation.parsed_modifiers and
                         filename == expectation.filename)
 
-        return TestExpectationSerializer.list_to_string(filter(without_rebaseline_modifier, self._expectations))
+        return self.list_to_string(filter(without_rebaseline_modifier, self._expectations))
 
     def _add_expectations(self, expectation_list):
         for expectation_line in expectation_list:
@@ -872,3 +847,17 @@ class TestExpectations(object):
         for test_name in tests_to_skip:
             expectation_line = self._parser.expectation_for_skipped_test(test_name)
             self._model.add_expectation_line(expectation_line, in_skipped=True)
+
+    @staticmethod
+    def list_to_string(expectation_lines, test_configuration_converter=None, reconstitute_only_these=None):
+        def serialize(expectation_line):
+            # If reconstitute_only_these is an empty list, we want to return original_string.
+            # So we need to compare reconstitute_only_these to None, not just check if it's falsey.
+            if reconstitute_only_these is None or expectation_line in reconstitute_only_these:
+                return expectation_line.to_string(test_configuration_converter)
+            return expectation_line.original_string
+
+        def nones_out(expectation_line):
+            return expectation_line is not None
+
+        return "\n".join(filter(nones_out, map(serialize, expectation_lines)))
diff --git a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
index 5abb21302..6c740baae 100644
--- a/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/models/test_expectations_unittest.py
@@ -544,12 +544,11 @@ class TestExpectationParserTests(unittest.TestCase):
         self.assertFalse(expectation_line.is_invalid())
 
 
-class TestExpectationSerializerTests(unittest.TestCase):
+class TestExpectationSerializationTests(unittest.TestCase):
     def __init__(self, testFunc):
         host = MockHost()
         test_port = host.port_factory.get('test-win-xp', None)
         self._converter = TestConfigurationConverter(test_port.all_test_configurations(), test_port.configuration_specifier_macros())
-        self._serializer = TestExpectationSerializer(self._converter)
         unittest.TestCase.__init__(self, testFunc)
 
     def _tokenize(self, line):
@@ -559,7 +558,7 @@ class TestExpectationSerializerTests(unittest.TestCase):
         expectation = self._tokenize(in_string)
         if expected_string is None:
             expected_string = in_string
-        self.assertEqual(expected_string, self._serializer.to_string(expectation))
+        self.assertEqual(expected_string, expectation.to_string(self._converter))
 
     def assert_list_round_trip(self, in_string, expected_string=None):
         host = MockHost()
@@ -567,29 +566,28 @@ class TestExpectationSerializerTests(unittest.TestCase):
         expectations = parser.parse('path', in_string)
         if expected_string is None:
             expected_string = in_string
-        self.assertEqual(expected_string, TestExpectationSerializer.list_to_string(expectations, self._converter))
+        self.assertEqual(expected_string, TestExpectations.list_to_string(expectations, self._converter))
 
     def test_unparsed_to_string(self):
         expectation = TestExpectationLine()
-        serializer = TestExpectationSerializer()
 
-        self.assertEqual(serializer.to_string(expectation), '')
+        self.assertEqual(expectation.to_string(self._converter), '')
         expectation.comment = 'Qux.'
-        self.assertEqual(serializer.to_string(expectation), '//Qux.')
+        self.assertEqual(expectation.to_string(self._converter), '//Qux.')
         expectation.name = 'bar'
-        self.assertEqual(serializer.to_string(expectation), ' : bar =  //Qux.')
+        self.assertEqual(expectation.to_string(self._converter), ' : bar =  //Qux.')
         expectation.modifiers = ['foo']
-        self.assertEqual(serializer.to_string(expectation), 'FOO : bar =  //Qux.')
+        self.assertEqual(expectation.to_string(self._converter), 'FOO : bar =  //Qux.')
         expectation.expectations = ['bAz']
-        self.assertEqual(serializer.to_string(expectation), 'FOO : bar = BAZ //Qux.')
+        self.assertEqual(expectation.to_string(self._converter), 'FOO : bar = BAZ //Qux.')
         expectation.expectations = ['bAz1', 'baZ2']
-        self.assertEqual(serializer.to_string(expectation), 'FOO : bar = BAZ1 BAZ2 //Qux.')
+        self.assertEqual(expectation.to_string(self._converter), 'FOO : bar = BAZ1 BAZ2 //Qux.')
         expectation.modifiers = ['foo1', 'foO2']
-        self.assertEqual(serializer.to_string(expectation), 'FOO1 FOO2 : bar = BAZ1 BAZ2 //Qux.')
+        self.assertEqual(expectation.to_string(self._converter), 'FOO1 FOO2 : bar = BAZ1 BAZ2 //Qux.')
         expectation.warnings.append('Oh the horror.')
-        self.assertEqual(serializer.to_string(expectation), '')
+        self.assertEqual(expectation.to_string(self._converter), '')
         expectation.original_string = 'Yes it is!'
-        self.assertEqual(serializer.to_string(expectation), 'Yes it is!')
+        self.assertEqual(expectation.to_string(self._converter), 'Yes it is!')
 
     def test_unparsed_list_to_string(self):
         expectation = TestExpectationLine()
@@ -597,49 +595,50 @@ class TestExpectationSerializerTests(unittest.TestCase):
         expectation.name = 'bar'
         expectation.modifiers = ['foo']
         expectation.expectations = ['bAz1', 'baZ2']
-        self.assertEqual(TestExpectationSerializer.list_to_string([expectation]), 'FOO : bar = BAZ1 BAZ2 //Qux.')
+        self.assertEqual(TestExpectations.list_to_string([expectation]), 'FOO : bar = BAZ1 BAZ2 //Qux.')
 
     def test_parsed_to_string(self):
         expectation_line = TestExpectationLine()
         expectation_line.parsed_bug_modifiers = ['BUGX']
         expectation_line.name = 'test/name/for/realz.html'
         expectation_line.parsed_expectations = set([IMAGE])
-        self.assertEqual(self._serializer.to_string(expectation_line), None)
+        self.assertEqual(expectation_line.to_string(self._converter), None)
         expectation_line.matching_configurations = set([TestConfiguration('xp', 'x86', 'release')])
-        self.assertEqual(self._serializer.to_string(expectation_line), 'BUGX XP RELEASE : test/name/for/realz.html = IMAGE')
+        self.assertEqual(expectation_line.to_string(self._converter), 'BUGX XP RELEASE : test/name/for/realz.html = IMAGE')
         expectation_line.matching_configurations = set([TestConfiguration('xp', 'x86', 'release'), TestConfiguration('xp', 'x86', 'debug')])
-        self.assertEqual(self._serializer.to_string(expectation_line), 'BUGX XP : test/name/for/realz.html = IMAGE')
+        self.assertEqual(expectation_line.to_string(self._converter), 'BUGX XP : test/name/for/realz.html = IMAGE')
 
-    def test_parsed_expectations_string(self):
+    def test_serialize_parsed_expectations(self):
         expectation_line = TestExpectationLine()
         expectation_line.parsed_expectations = set([])
-        self.assertEqual(self._serializer._parsed_expectations_string(expectation_line), '')
+        parsed_expectation_to_string = dict([[parsed_expectation, expectation_string] for expectation_string, parsed_expectation in TestExpectations.EXPECTATIONS.items()])
+        self.assertEqual(expectation_line._serialize_parsed_expectations(parsed_expectation_to_string), '')
         expectation_line.parsed_expectations = set([IMAGE_PLUS_TEXT])
-        self.assertEqual(self._serializer._parsed_expectations_string(expectation_line), 'image+text')
+        self.assertEqual(expectation_line._serialize_parsed_expectations(parsed_expectation_to_string), 'image+text')
         expectation_line.parsed_expectations = set([PASS, IMAGE])
-        self.assertEqual(self._serializer._parsed_expectations_string(expectation_line), 'pass image')
+        self.assertEqual(expectation_line._serialize_parsed_expectations(parsed_expectation_to_string), 'pass image')
         expectation_line.parsed_expectations = set([TEXT, PASS])
-        self.assertEqual(self._serializer._parsed_expectations_string(expectation_line), 'pass text')
+        self.assertEqual(expectation_line._serialize_parsed_expectations(parsed_expectation_to_string), 'pass text')
 
-    def test_parsed_modifier_string(self):
+    def test_serialize_parsed_modifier_string(self):
         expectation_line = TestExpectationLine()
         expectation_line.parsed_bug_modifiers = ['garden-o-matic']
         expectation_line.parsed_modifiers = ['for', 'the']
-        self.assertEqual(self._serializer._parsed_modifier_string(expectation_line, []), 'garden-o-matic for the')
-        self.assertEqual(self._serializer._parsed_modifier_string(expectation_line, ['win']), 'garden-o-matic for the win')
+        self.assertEqual(expectation_line._serialize_parsed_modifiers(self._converter, []), 'garden-o-matic for the')
+        self.assertEqual(expectation_line._serialize_parsed_modifiers(self._converter, ['win']), 'garden-o-matic for the win')
         expectation_line.parsed_bug_modifiers = []
         expectation_line.parsed_modifiers = []
-        self.assertEqual(self._serializer._parsed_modifier_string(expectation_line, []), '')
-        self.assertEqual(self._serializer._parsed_modifier_string(expectation_line, ['win']), 'win')
+        self.assertEqual(expectation_line._serialize_parsed_modifiers(self._converter, []), '')
+        self.assertEqual(expectation_line._serialize_parsed_modifiers(self._converter, ['win']), 'win')
         expectation_line.parsed_bug_modifiers = ['garden-o-matic', 'total', 'is']
-        self.assertEqual(self._serializer._parsed_modifier_string(expectation_line, ['win']), 'garden-o-matic is total win')
+        self.assertEqual(expectation_line._serialize_parsed_modifiers(self._converter, ['win']), 'garden-o-matic is total win')
         expectation_line.parsed_bug_modifiers = []
         expectation_line.parsed_modifiers = ['garden-o-matic', 'total', 'is']
-        self.assertEqual(self._serializer._parsed_modifier_string(expectation_line, ['win']), 'garden-o-matic is total win')
+        self.assertEqual(expectation_line._serialize_parsed_modifiers(self._converter, ['win']), 'garden-o-matic is total win')
 
-    def test_format_result(self):
-        self.assertEqual(TestExpectationSerializer._format_result('modifiers', 'name', 'expectations', 'comment'), 'MODIFIERS : name = EXPECTATIONS //comment')
-        self.assertEqual(TestExpectationSerializer._format_result('modifiers', 'name', 'expectations', None), 'MODIFIERS : name = EXPECTATIONS')
+    def test_format_line(self):
+        self.assertEqual(TestExpectationLine._format_line('modifiers', 'name', 'expectations', 'comment'), 'MODIFIERS : name = EXPECTATIONS //comment')
+        self.assertEqual(TestExpectationLine._format_line('modifiers', 'name', 'expectations', None), 'MODIFIERS : name = EXPECTATIONS')
 
     def test_string_roundtrip(self):
         self.assert_round_trip('')
@@ -690,9 +689,9 @@ class TestExpectationSerializerTests(unittest.TestCase):
 
         add_line(set([TestConfiguration('xp', 'x86', 'release')]), True)
         add_line(set([TestConfiguration('xp', 'x86', 'release'), TestConfiguration('xp', 'x86', 'debug')]), False)
-        serialized = TestExpectationSerializer.list_to_string(lines, self._converter)
+        serialized = TestExpectations.list_to_string(lines, self._converter)
         self.assertEquals(serialized, "BUGX XP RELEASE : Yay = IMAGE\nBUGX XP : Yay = IMAGE")
-        serialized = TestExpectationSerializer.list_to_string(lines, self._converter, reconstitute_only_these=reconstitute_only_these)
+        serialized = TestExpectations.list_to_string(lines, self._converter, reconstitute_only_these=reconstitute_only_these)
         self.assertEquals(serialized, "BUGX XP RELEASE : Yay = IMAGE\nNay")
 
     def test_string_whitespace_stripping(self):
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/driver.py b/Tools/Scripts/webkitpy/layout_tests/port/driver.py
index c343c570d..5feb842c7 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/driver.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/driver.py
@@ -160,14 +160,6 @@ class Driver(object):
 
         crashed = self.has_crashed()
         timed_out = self._server_process.timed_out
-        if text and ('Timed out waiting for final message from web process' in text):
-            # FIXME: This is a hack to work around the issues in https://bugs.webkit.org/show_bug.cgi?id=94505.
-            # We need to either fix the underlying problem in WTR or return a more canonical error.
-            if not timed_out:
-                _log.warning("webprocess timed out but WTR didn't, killing WTR")
-                timed_out = True
-            else:
-                _log.warning("webprocess timed out and so did WTR")
 
         if stop_when_done or crashed or timed_out:
             # We call stop() even if we crashed or timed out in order to get any remaining stdout/stderr output.
@@ -183,7 +175,8 @@ class Driver(object):
 
             # If we don't find a crash log use a placeholder error message instead.
             if not crash_log:
-                crash_log = 'no crash log found for %s:%d.' % (self._crashed_process_name, self._crashed_pid)
+                pid_str = str(self._crashed_pid) if self._crashed_pid else "unknown pid"
+                crash_log = 'no crash log found for %s:%s.' % (self._crashed_process_name, pid_str)
                 # If we were unresponsive append a message informing there may not have been a crash.
                 if self._subprocess_was_unresponsive:
                     crash_log += '  Process failed to become responsive before timing out.'
diff --git a/Tools/Scripts/webkitpy/style/main.py b/Tools/Scripts/webkitpy/style/main.py
index 35ca73490..e90d98a42 100644
--- a/Tools/Scripts/webkitpy/style/main.py
+++ b/Tools/Scripts/webkitpy/style/main.py
@@ -68,7 +68,7 @@ def change_directory(filesystem, checkout_root, paths):
         rel_paths = []
         for path in paths:
             rel_path = filesystem.relpath(path, checkout_root)
-            if rel_path is None:
+            if rel_path.startswith(filesystem.pardir):
                 # Then the path is not below the checkout root.  Since all
                 # paths should be interpreted relative to the same root,
                 # do not interpret any of the paths as relative to the
diff --git a/Tools/Scripts/webkitpy/tool/commands/expectations.py b/Tools/Scripts/webkitpy/tool/commands/expectations.py
index 8af155c18..0e1050ba7 100644
--- a/Tools/Scripts/webkitpy/tool/commands/expectations.py
+++ b/Tools/Scripts/webkitpy/tool/commands/expectations.py
@@ -27,7 +27,8 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 from webkitpy.layout_tests.models.test_configuration import TestConfigurationConverter
-from webkitpy.layout_tests.models.test_expectations import TestExpectationParser, TestExpectationSerializer
+from webkitpy.layout_tests.models.test_expectations import TestExpectationParser
+from webkitpy.layout_tests.models.test_expectations import TestExpectations
 from webkitpy.tool.multicommandtool import AbstractDeclarativeCommand
 
 
@@ -40,4 +41,4 @@ class OptimizeExpectations(AbstractDeclarativeCommand):
         parser = TestExpectationParser(port, [], allow_rebaseline_modifier=False)
         expectation_lines = parser.parse(port.test_expectations())
         converter = TestConfigurationConverter(port.all_test_configurations(), port.configuration_specifier_macros())
-        tool.filesystem.write_text_file(port.path_to_test_expectations_file(), TestExpectationSerializer.list_to_string(expectation_lines, converter))
+        tool.filesystem.write_text_file(port.path_to_test_expectations_file(), TestExpectations.list_to_string(expectation_lines, converter))
diff --git a/Tools/Scripts/webkitpy/tool/commands/queries.py b/Tools/Scripts/webkitpy/tool/commands/queries.py
index 731b598a6..9fe8ef353 100644
--- a/Tools/Scripts/webkitpy/tool/commands/queries.py
+++ b/Tools/Scripts/webkitpy/tool/commands/queries.py
@@ -46,7 +46,7 @@ from webkitpy.common.system.user import User
 from webkitpy.tool.grammar import pluralize
 from webkitpy.tool.multicommandtool import AbstractDeclarativeCommand
 from webkitpy.common.system.deprecated_logging import log
-from webkitpy.layout_tests.models.test_expectations import TestExpectations, TestExpectationSerializer
+from webkitpy.layout_tests.models.test_expectations import TestExpectations
 from webkitpy.layout_tests.port import port_options
 
 
@@ -465,7 +465,6 @@ class PrintExpectations(AbstractDeclarativeCommand):
             default_port = tool.port_factory.get(options=options)
             port_names = [default_port.name()]
 
-        serializer = TestExpectationSerializer()
         tests = default_port.tests(args)
         for port_name in port_names:
             model = self._model(options, port_name, tests)
@@ -473,7 +472,7 @@ class PrintExpectations(AbstractDeclarativeCommand):
             lines = [model.get_expectation_line(test) for test in sorted(tests_to_print)]
             if port_name != port_names[0]:
                 print
-            print '\n'.join(self._format_lines(options, port_name, serializer, lines))
+            print '\n'.join(self._format_lines(options, port_name, lines))
 
     def _filter_tests(self, options, model, tests):
         filtered_tests = set()
@@ -487,17 +486,17 @@ class PrintExpectations(AbstractDeclarativeCommand):
             filtered_tests.difference_update(model.get_test_set_for_keyword(keyword))
         return filtered_tests
 
-    def _format_lines(self, options, port_name, serializer, lines):
+    def _format_lines(self, options, port_name, lines):
         output = []
         if options.csv:
             for line in lines:
-                output.append("%s,%s" % (port_name, serializer.to_csv(line)))
+                output.append("%s,%s" % (port_name, line.to_csv()))
         elif lines:
             include_modifiers = options.full
             include_expectations = options.full or len(options.include_keyword) != 1 or len(options.exclude_keyword)
             output.append("// For %s" % port_name)
             for line in lines:
-                output.append("%s" % serializer.to_string(line, include_modifiers, include_expectations, include_comment=False))
+                output.append("%s" % line.to_string(None, include_modifiers, include_expectations, include_comment=False))
         return output
 
     def _model(self, options, port_name, tests):
diff --git a/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py b/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
index 46d9751db..a506cd703 100644
--- a/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
+++ b/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
@@ -30,7 +30,7 @@ import os
 from webkitpy.common.memoized import memoized
 from webkitpy.tool.servers.reflectionhandler import ReflectionHandler
 from webkitpy.layout_tests.controllers.test_expectations_editor import BugManager, TestExpectationsEditor
-from webkitpy.layout_tests.models.test_expectations import TestExpectationParser, TestExpectations, TestExpectationSerializer
+from webkitpy.layout_tests.models.test_expectations import TestExpectationParser, TestExpectations
 from webkitpy.layout_tests.models.test_configuration import TestConfigurationConverter
 from webkitpy.layout_tests.port import builders
 
@@ -82,7 +82,7 @@ class GardeningExpectationsUpdater(BugManager):
             builder_name = failure_info['builderName']
             affected_test_configuration_set = self._extrapolator.extrapolate_test_configurations(builder_name)
             updated_expectation_lines.extend(editor.update_expectation(test_name, affected_test_configuration_set, expectation_set))
-        self._tool.filesystem.write_text_file(self._path_to_test_expectations_file, TestExpectationSerializer.list_to_string(expectation_lines, self._converter, reconstitute_only_these=updated_expectation_lines))
+        self._tool.filesystem.write_text_file(self._path_to_test_expectations_file, TestExpectations.list_to_string(expectation_lines, self._converter, reconstitute_only_these=updated_expectation_lines))
 
 
 class GardeningHTTPServer(BaseHTTPServer.HTTPServer):
diff --git a/Tools/TestWebKitAPI/InjectedBundleController.cpp b/Tools/TestWebKitAPI/InjectedBundleController.cpp
index 13375c5ac..537104fb9 100644
--- a/Tools/TestWebKitAPI/InjectedBundleController.cpp
+++ b/Tools/TestWebKitAPI/InjectedBundleController.cpp
@@ -60,7 +60,8 @@ void InjectedBundleController::initialize(WKBundleRef bundle, WKTypeRef initiali
         didCreatePage,
         willDestroyPage,
         didInitializePageGroup,
-        didReceiveMessage
+        didReceiveMessage,
+        didReceiveMessageToPage
     };
     WKBundleSetClient(m_bundle, &client);
 
@@ -103,6 +104,13 @@ void InjectedBundleController::didReceiveMessage(WKBundleRef bundle, WKStringRef
     self->m_currentTest->didReceiveMessage(bundle, messageName, messageBody);
 }
 
+void InjectedBundleController::didReceiveMessageToPage(WKBundleRef bundle, WKBundlePageRef page, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo)
+{
+    InjectedBundleController* self = static_cast<InjectedBundleController*>(const_cast<void*>(clientInfo));
+    assert(self->m_currentTest);
+    self->m_currentTest->didReceiveMessageToPage(bundle, page, messageName, messageBody);
+}
+
 void InjectedBundleController::dumpTestNames()
 {
     std::map<std::string, CreateInjectedBundleTestFunction>::const_iterator it = m_createInjectedBundleTestFunctions.begin();
diff --git a/Tools/TestWebKitAPI/InjectedBundleController.h b/Tools/TestWebKitAPI/InjectedBundleController.h
index 5ee7156b4..0ca112584 100644
--- a/Tools/TestWebKitAPI/InjectedBundleController.h
+++ b/Tools/TestWebKitAPI/InjectedBundleController.h
@@ -58,6 +58,7 @@ private:
     static void willDestroyPage(WKBundleRef, WKBundlePageRef, const void* clientInfo);
     static void didInitializePageGroup(WKBundleRef, WKBundlePageGroupRef, const void* clientInfo);
     static void didReceiveMessage(WKBundleRef, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo);
+    static void didReceiveMessageToPage(WKBundleRef, WKBundlePageRef, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo);
 
     std::map<std::string, CreateInjectedBundleTestFunction> m_createInjectedBundleTestFunctions;
     WKBundleRef m_bundle;
diff --git a/Tools/TestWebKitAPI/InjectedBundleTest.h b/Tools/TestWebKitAPI/InjectedBundleTest.h
index 5285cdf3a..d0f996aff 100644
--- a/Tools/TestWebKitAPI/InjectedBundleTest.h
+++ b/Tools/TestWebKitAPI/InjectedBundleTest.h
@@ -40,6 +40,7 @@ public:
     virtual void willDestroyPage(WKBundleRef, WKBundlePageRef) { }
     virtual void didInitializePageGroup(WKBundleRef, WKBundlePageGroupRef) { }
     virtual void didReceiveMessage(WKBundleRef, WKStringRef messageName, WKTypeRef messageBody) { }
+    virtual void didReceiveMessageToPage(WKBundleRef, WKBundlePageRef, WKStringRef messageName, WKTypeRef messageBody) { }
 
     std::string name() const { return m_identifier; }
     
diff --git a/Tools/TestWebKitAPI/config.h b/Tools/TestWebKitAPI/config.h
index 97bb958ef..e796ebc98 100644
--- a/Tools/TestWebKitAPI/config.h
+++ b/Tools/TestWebKitAPI/config.h
@@ -43,7 +43,9 @@
 
 #elif defined(WIN32) || defined(_WIN32)
 
+#ifndef NOMINMAX
 #define NOMINMAX
+#endif
 
 #endif
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
index a44cc54d6..63ed17823 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
@@ -72,11 +72,16 @@ void InjectedBundle::didInitializePageGroup(WKBundleRef bundle, WKBundlePageGrou
     static_cast<InjectedBundle*>(const_cast<void*>(clientInfo))->didInitializePageGroup(pageGroup);
 }
 
-void InjectedBundle::didReceiveMessage(WKBundleRef bundle, WKStringRef messageName, WKTypeRef messageBody, const void *clientInfo)
+void InjectedBundle::didReceiveMessage(WKBundleRef bundle, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo)
 {
     static_cast<InjectedBundle*>(const_cast<void*>(clientInfo))->didReceiveMessage(messageName, messageBody);
 }
 
+void InjectedBundle::didReceiveMessageToPage(WKBundleRef bundle, WKBundlePageRef page, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo)
+{
+    static_cast<InjectedBundle*>(const_cast<void*>(clientInfo))->didReceiveMessageToPage(page, messageName, messageBody);
+}
+
 void InjectedBundle::initialize(WKBundleRef bundle, WKTypeRef initializationUserData)
 {
     m_bundle = bundle;
@@ -88,7 +93,8 @@ void InjectedBundle::initialize(WKBundleRef bundle, WKTypeRef initializationUser
         didCreatePage,
         willDestroyPage,
         didInitializePageGroup,
-        didReceiveMessage
+        didReceiveMessage,
+        didReceiveMessageToPage
     };
     WKBundleSetClient(m_bundle, &client);
 
@@ -190,6 +196,13 @@ void InjectedBundle::didReceiveMessage(WKStringRef messageName, WKTypeRef messag
     WKBundlePostMessage(m_bundle, errorMessageName.get(), errorMessageBody.get());
 }
 
+void InjectedBundle::didReceiveMessageToPage(WKBundlePageRef page, WKStringRef messageName, WKTypeRef messageBody)
+{
+    WKRetainPtr<WKStringRef> errorMessageName(AdoptWK, WKStringCreateWithUTF8CString("Error"));
+    WKRetainPtr<WKStringRef> errorMessageBody(AdoptWK, WKStringCreateWithUTF8CString("Unknown"));
+    WKBundlePostMessage(m_bundle, errorMessageName.get(), errorMessageBody.get());
+}
+
 bool InjectedBundle::booleanForKey(WKDictionaryRef dictionary, const char* key)
 {
     WKRetainPtr<WKStringRef> wkKey(AdoptWK, WKStringCreateWithUTF8CString(key));
diff --git a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
index 5309900da..d1f198f61 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
@@ -97,11 +97,13 @@ private:
     static void willDestroyPage(WKBundleRef, WKBundlePageRef, const void* clientInfo);
     static void didInitializePageGroup(WKBundleRef, WKBundlePageGroupRef, const void* clientInfo);
     static void didReceiveMessage(WKBundleRef, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo);
+    static void didReceiveMessageToPage(WKBundleRef, WKBundlePageRef, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo);
 
     void didCreatePage(WKBundlePageRef);
     void willDestroyPage(WKBundlePageRef);
     void didInitializePageGroup(WKBundlePageGroupRef);
     void didReceiveMessage(WKStringRef messageName, WKTypeRef messageBody);
+    void didReceiveMessageToPage(WKBundlePageRef, WKStringRef messageName, WKTypeRef messageBody);
 
     void platformInitialize(WKTypeRef initializationUserData);
     void resetLocalSettings();
diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
index badb64643..d18fe3f30 100644
--- a/Tools/WebKitTestRunner/TestController.cpp
+++ b/Tools/WebKitTestRunner/TestController.cpp
@@ -625,8 +625,10 @@ void TestController::runTestingServerLoop()
 
 void TestController::run()
 {
-    bool resetDone = resetStateToConsistentValues();
-    ASSERT_UNUSED(resetDone, resetDone);
+    if (!resetStateToConsistentValues()) {
+        TestInvocation::dumpWebProcessUnresponsiveness("Failed to reset to consistent state before the first test");
+        return;
+    }
 
     if (m_usingServerMode)
         runTestingServerLoop();
diff --git a/Tools/WebKitTestRunner/TestInvocation.cpp b/Tools/WebKitTestRunner/TestInvocation.cpp
index d340f0f84..fd35af98e 100644
--- a/Tools/WebKitTestRunner/TestInvocation.cpp
+++ b/Tools/WebKitTestRunner/TestInvocation.cpp
@@ -198,32 +198,30 @@ end:
         WKInspectorClose(WKPageGetInspector(TestController::shared().mainWebView()->page()));
 #endif // ENABLE(INSPECTOR)
 
-    bool resetDone = TestController::shared().resetStateToConsistentValues();
-    // We expect resetting to not fail if there was no error or timeout.
-    ASSERT(resetDone || errorMessage);
+    if (errorMessage || !TestController::shared().resetStateToConsistentValues())
+        dumpWebProcessUnresponsiveness(errorMessage);
+}
 
+void TestInvocation::dumpWebProcessUnresponsiveness(const char* textToStdout)
+{
     const char* errorMessageToStderr = 0;
 #if PLATFORM(MAC)
     char buffer[64];
-    if (!resetDone) {
-        pid_t pid = WKPageGetProcessIdentifier(TestController::shared().mainWebView()->page());
-        sprintf(buffer, "#PROCESS UNRESPONSIVE - WebProcess (pid %ld)\n", static_cast<long>(pid));
-        errorMessageToStderr = buffer;
-    }
+    pid_t pid = WKPageGetProcessIdentifier(TestController::shared().mainWebView()->page());
+    sprintf(buffer, "#PROCESS UNRESPONSIVE - WebProcess (pid %ld)\n", static_cast<long>(pid));
+    errorMessageToStderr = buffer;
 #else
-    if (!resetDone)
-        errorMessageToStderr = "#PROCESS UNRESPONSIVE - WebProcess";
+    errorMessageToStderr = "#PROCESS UNRESPONSIVE - WebProcess";
 #endif
 
-    if (errorMessage)
-        dump(errorMessage, errorMessageToStderr, true);
+    dump(textToStdout, errorMessageToStderr, true);
 }
 
 void TestInvocation::dump(const char* textToStdout, const char* textToStderr, bool seenError)
 {
     printf("Content-Type: text/plain\n");
-    printf("%s", textToStdout);
-
+    if (textToStdout)
+        fputs(textToStdout, stdout);
     if (textToStderr)
         fputs(textToStderr, stderr);
 
diff --git a/Tools/WebKitTestRunner/TestInvocation.h b/Tools/WebKitTestRunner/TestInvocation.h
index 903cf066c..49641e9ee 100644
--- a/Tools/WebKitTestRunner/TestInvocation.h
+++ b/Tools/WebKitTestRunner/TestInvocation.h
@@ -44,6 +44,7 @@ public:
     void didReceiveMessageFromInjectedBundle(WKStringRef messageName, WKTypeRef messageBody);
     WKRetainPtr<WKTypeRef> didReceiveSynchronousMessageFromInjectedBundle(WKStringRef messageName, WKTypeRef messageBody);
 
+    static void dumpWebProcessUnresponsiveness(const char* textToStdout);
 private:
     static void dump(const char* textToStdout, const char* textToStderr = 0, bool seenError = false);
     void dumpPixelsAndCompareWithExpected(WKImageRef, WKArrayRef repaintRects);
diff --git a/Tools/qmake/mkspecs/features/features.prf b/Tools/qmake/mkspecs/features/features.prf
index 4307bc727..592663191 100644
--- a/Tools/qmake/mkspecs/features/features.prf
+++ b/Tools/qmake/mkspecs/features/features.prf
@@ -214,6 +214,9 @@ contains(DEFINES, ENABLE_INSPECTOR=0) {
     DEFINES += ENABLE_INSPECTOR_SERVER=0
 }
 
+# Disable animated smooth scrolling if request-animation-frame is disabled
+contains(DEFINES, ENABLE_REQUEST_ANIMATION_FRAME=0): DEFINES += ENABLE_SMOOTH_SCROLLING=0
+
 # Remove conflicting defines. The preprocessor would take care of this
 # anyways, but doing it here makes for nicer command lines when building.
 for(define, DEFINES) {
diff --git a/Tools/qmake/mkspecs/features/features.pri b/Tools/qmake/mkspecs/features/features.pri
index 99cc70b78..feac85dd4 100644
--- a/Tools/qmake/mkspecs/features/features.pri
+++ b/Tools/qmake/mkspecs/features/features.pri
@@ -88,6 +88,7 @@ FEATURE_DEFAULTS = \
     ENABLE_SCRIPTED_SPEECH=0 \
     ENABLE_SHADOW_DOM=0 \
     ENABLE_SHARED_WORKERS=1 \
+    ENABLE_SMOOTH_SCROLLING=1 \
     ENABLE_SQL_DATABASE=1 \
     ENABLE_STYLE_SCOPED=0 \
     ENABLE_SVG=1 \