Imported WebKit commit 8ff1f22783a32de82fee915abd55bd1b298f2644 (http://svn.webkit.org/repository/webkit/trunk@122325)

New snapshot that should work with the latest Qt build system changes

1742 files changed, 66177 insertions, 17432 deletions

diff --git a/.qmake.conf b/.qmake.conf
new file mode 100644
index 000000000..78f46ce6a
--- /dev/null
+++ b/.qmake.conf
@@ -0,0 +1 @@
+QMAKEPATH += $$PWD/Tools/qmake $$shadowed($$PWD/Tools/qmake)
diff --git a/ChangeLog b/ChangeLog
index 72a7486bf..eb7171d93 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,552 @@
+2012-07-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [CMAKE] Add missing feature macros
+        https://bugs.webkit.org/show_bug.cgi?id=90890
+
+        Reviewed by Eric Seidel.
+
+        ENABLE_CSS_EXCLUSIONS, ENABLE_CSS_REGIONS, ENABLE_TEXT_AUTOSIZING macros
+        haven't defined in cmake feature list.
+
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-10  Kent Tamura  <tkent@chromium.org>
+
+        RTL calendar picker for <input type=date> is too narrow and clipped
+        https://bugs.webkit.org/show_bug.cgi?id=90864
+
+        Reviewed by Kentaro Hara.
+
+        * ManualTests/forms/calendar-picker.html:
+        - Add isRTL:true for the arabic setting
+        - Reset the iframe size when the setting is changed.
+
+2012-07-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122178.
+        http://trac.webkit.org/changeset/122178
+        https://bugs.webkit.org/show_bug.cgi?id=90857
+
+        browser tests, PrerenderBrowserTest.PrerenderFavicon and other
+        tests, started to fail (Requested by hayato on #webkit).
+
+        * Source/autotools/symbols.filter:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-09  Pete Williamson  <petewil@google.com>
+
+        Expose an export for the iconUrl list so Internals can use it
+        https://bugs.webkit.org/show_bug.cgi?id=88665
+
+        Reviewed by Kent Tamura.
+
+        * Source/autotools/symbols.filter: export iconURLs
+
+2012-07-09  Mike Lattanzio  <mlattanzio@rim.com>
+
+        [BlackBerry] meta viewport initial-scale doesn't factor in device pixel ratio
+        https://bugs.webkit.org/show_bug.cgi?id=90575
+
+        Reviewed by Rob Buis.
+
+        Add a manual test to verify wide content doesn't interfere
+        with initial-scale calculations.
+
+        Internal review from Konrad Piascik.
+
+        * ManualTests/blackberry/meta-viewport-initial-scale-wide-content.html: Added.
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-06  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL][CMake] Move gtest sources to an upper level
+        https://bugs.webkit.org/show_bug.cgi?id=90602
+
+        Reviewed by Chang Shu.
+
+        CTest was enabled for all the ports, but used only by EFL. Now
+        ENABLE_API_TESTS has to be defined, which will also build gtest.
+
+        * CMakeLists.txt:
+        * Source/CMakeLists.txt:
+        * Source/cmake/OptionsEfl.cmake:
+        * Source/cmake/gtest/CMakeLists.txt: Added.
+
+2012-07-06  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add a configuration option for disabling unstable features in releases
+        https://bugs.webkit.org/show_bug.cgi?id=87995
+
+        Reviewed by Martin Robinson.
+
+        Add a configuration flag for enabling the unstable features - features of which
+        support in the Gtk port is being worked on but is not yet complete. The primary
+        use of this flag is when compiling through the build-webkit script.
+
+        All the features that are currently enabled when building through build-webkit but
+        are disabled by default when executing the configure script directly have their default
+        value (when the correspondent flag is not passed) set to 'yes' when unstable features
+        are enabled and 'no' otherwise. This way unstable features are kept disabled when performing
+        a release build (unless they are specifically enabled).
+
+        * configure.ac:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove custom qmake logic for module creation
+
+        Qmake now has the necessary hooks to cleanly override the build locations.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Source/api.pri:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Add top-level .qmake.conf
+
+        With Qt5, this makes setting $QMAKEPATH externally unnecessary.
+
+        The magic in the perl scripts to set QMAKEPATH is still there, as it doesn't
+        hurt, and is still required for Qt4.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * .qmake.conf: Added.
+        * WebKit.pro:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Let qt_module_config create the forwarding module pri file
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Source/sync.profile:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Don't let qt_webkit.pri proclaim its own location
+
+        This won't work any more with recent Qt5 versions, as the forwarding
+        pri is created by qt_module_config, which needs MODULE_PRI to be set
+        up already.
+
+        We also need to load build_config, not qt_module.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Source/api.pri:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove redundant CONFIG+=module
+
+        qt_module_config takes care of that.
+
+        In api.pri we are actually testing the flag ourselves, so now we need to
+        test a related flag qt_module_config sets instead.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Source/api.pri:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Adjust to changed generation of master include file
+
+        The responsiblity for creating the master include was moved out of syncqt.
+        @ignore_for_master_contents still stays, as syncqt (ab-)uses this for
+        determining whether a header is private.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Source/sync.profile:
+
+2012-07-05  Rob Buis  <rbuis@rim.com>
+
+        [CMake] Fix some CMake warnings
+        https://bugs.webkit.org/show_bug.cgi?id=90558
+
+        Fix WebKit options so they match with FeatureList.pm.
+
+        Reviewed by Dan Bates.
+
+        * Source/cmake/WebKitFeatures.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Move Webkit1 before WebKit2 in the build order
+
+        Reviewed by Csaba Osztrogonác.
+
+        * WebKit.pro:
+
+2012-07-05  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [CMAKE] Unreviewd typo fix after r121857
+
+        * Source/cmake/WebKitMacros.cmake:
+
+2012-07-05  Dongwoo Im  <dw.im@samsung.com>
+
+        [EFL] Enable the CUSTOM_SCHEME_HANDLER feature as default.
+        https://bugs.webkit.org/show_bug.cgi?id=88608
+
+        Reviewed by Hajime Morita.
+
+        * Source/cmake/OptionsEfl.cmake: Enable the CUSTOM_SCHEME_HANDLER feature as default.
+
+2012-07-05  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [Wk2][EFL] EFL needs a WebKitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=87659
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Source/CMakeLists.txt:
+        Set compiler flags for WebCoreTestSupport to be linked into TestRunnerInjectedBundle
+        shared library.
+        * Source/cmake/WebKitMacros.cmake: Remove unnecessary dependency.
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing.
+
+        Reviewed by Adam Barth.
+
+        * configure.ac:
+
+2012-07-04  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [CMAKE] Add GENERATE_BINDINGS macro to share the codes which use generate-bindings.pl.
+        https://bugs.webkit.org/show_bug.cgi?id=90258
+
+        Reviewed by Rob Buis.
+
+        This new macro calls generate-bindings.pl and append generated sources
+        into proper source list.
+
+        * Source/cmake/WebKitMacros.cmake:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Get rid of un-needed QT += declarative for Qt 5
+
+        The declarative module has been renamed to quick1 in Qt 5, and the
+        engine-only module for Qt 5 is named 'qml'. For many of the instances
+        we could just remove 'declarative', since the project file was only
+        used for Qt5/WebKit2 builds. In the other cases the module was wrapped
+        in a haveQt(4) scope.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Source/api.pri:
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Enable CSS variables support at compile time
+        https://bugs.webkit.org/show_bug.cgi?id=90448
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Turn on CSS_VARIABLES flag by default on EFL port.
+
+        * Source/cmake/OptionsEfl.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable microdata support for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90429
+
+        Reviewed by Rob Buis.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Source/QtWebKit.pro:
+        * Source/api.pri:
+        * Source/tests.pri:
+        * WebKit.pro:
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121766.
+        http://trac.webkit.org/changeset/121766
+        https://bugs.webkit.org/show_bug.cgi?id=90465
+
+        It caused flakey build errors on the bots (Requested by Ossy
+        on #webkit).
+
+        * Source/QtWebKit.pro:
+        * Source/api.pri:
+        * Source/tests.pri:
+        * WebKit.pro:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable Custom Scheme Handlers for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable RegisterProtocolHandler for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+
+2012-07-03  Priit Laes  <plaes@plaes.org>
+
+        [GTK] Need to bump libsoup requirements (for `soup_cookie_jar_get_cookie_list`)
+        https://bugs.webkit.org/show_bug.cgi?id=90332
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * configure.ac: Bump libsoup requirements to 2.39.2
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Source/QtWebKit.pro:
+        * Source/api.pri:
+        * Source/tests.pri:
+        * WebKit.pro:
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Enable MICRODATA support
+        https://bugs.webkit.org/show_bug.cgi?id=90377
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Turn on MICRODATA support by default for EFL port.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-07-02  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable scoped style for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90418
+
+        Reviewed by Rob Buis.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-02  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Use PUBLIC_BUILD to enable/disable DRT
+        https://bugs.webkit.org/show_bug.cgi?id=90271
+
+        Reviewed by George Staikos.
+
+        RIM PR #154707
+
+        Currently DRT code will be compiled only if ENABLE_DRT is set, and it's not
+        defined by default.
+        We should enable DRT by default unless PUBLIC_BUILD is set. In this way we don't
+        need to rebuild webkit before running DRT.
+
+        * Source/cmake/OptionsBlackBerry.cmake:
+        * Source/cmakeconfig.h.cmake:
+
+2012-07-02  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL][CMake] Integrate API unit tests with CTest
+        https://bugs.webkit.org/show_bug.cgi?id=87251
+
+        Reviewed by Daniel Bates.
+
+        Enable CTest on the root CMakeLists.txt as it is expected
+        to be here. This will create a new build target ("make test")
+        to run all the API unit tests.
+
+        * CMakeLists.txt:
+
+2012-07-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Add Gamepad support
+        https://bugs.webkit.org/show_bug.cgi?id=90170
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Source/cmake/FindEFL.cmake: Bump EFL libs dependencies.
+        * Source/cmake/OptionsEfl.cmake: Turn on GAMEPAD flag on EFL port.
+        * Source/cmakeconfig.h.cmake: Add GAMEPAD flag to CMake.
+
+2012-06-30  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry] WebView/Browser cause blank screen when selecting a dropdown field.
+        https://bugs.webkit.org/show_bug.cgi?id=90241
+
+        This issue is caused by single quotes in option's labels.
+        We should use the escape character of single quotes in JavaScript's string which 
+        starts and ends with single quotes.
+        So we replace lablels' single quotes with its escape character during generating the 
+        select popUp's HTML.
+
+
+        Reviewed by George Staikos.
+
+        * ManualTests/blackberry/select-popup-items-unicode-display.html:
+
+2012-06-29  Luiz Agostini  <luiz.agostini@nokia.com>
+
+        [Qt][WK2] Private non-QtQuick API
+        https://bugs.webkit.org/show_bug.cgi?id=84532
+
+        Reviewed by Noam Rosenthal.
+
+        API tests for QRawWebView.
+
+        * Source/tests.pri:
+
+2012-06-29  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed build fix after r121518, adding a missing symbol to symbols.filter.
+
+        * Source/autotools/symbols.filter:
+
+2012-06-28  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] NodeRenderingContext ctor could be built on top of the ComposedShadowTreeWalker
+        https://bugs.webkit.org/show_bug.cgi?id=89732
+
+        Reviewed by Dimitri Glazkov.
+
+        * Source/autotools/symbols.filter:
+
+2012-06-28  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry] Selection items show as garbage for non-ascii characters.
+        https://bugs.webkit.org/show_bug.cgi?id=89969
+
+        Add charset utf-8 to the select popup's page.
+
+        Reviewed by Antonio Gomes.
+
+        * ManualTests/blackberry/select-popup-items-unicode-display.html: Added.
+
+2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Enable support for HTML5 datalist
+        https://bugs.webkit.org/show_bug.cgi?id=90157
+
+        Reviewed by Martin Robinson.
+
+        Turn on DATALIST flag by default on EFL port to
+        support HTML5 datalist tag.
+
+        * Source/cmake/OptionsEfl.cmake:
+
+2012-06-27  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=87503
+
+        Reviewed by Carlos Garcia Campos.
+
+        Only enable the Gamepad feature on Linux as support
+        for other operating systems is not present.
+
+        Check for the GIO Unix and GUdev dependencies when the
+        Gamepad feature is enabled.
+
+        * configure.ac:
+
 2012-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Make it possible to build WebKit without QtWidgets
diff --git a/Source/CMakeLists.txt b/Source/CMakeLists.txt
index 2ddb3932b..fb3092aaf 100644
--- a/Source/CMakeLists.txt
+++ b/Source/CMakeLists.txt
@@ -5,6 +5,10 @@ ADD_SUBDIRECTORY(WTF)
 
 ADD_SUBDIRECTORY(JavaScriptCore)
 
+IF (ENABLE_API_TESTS)
+    ADD_SUBDIRECTORY(cmake/gtest)
+ENDIF ()
+
 IF (ENABLE_WEBCORE)
     ADD_SUBDIRECTORY(WebCore)
 ENDIF ()
@@ -22,6 +26,7 @@ ENDIF ()
 # -----------------------------------------------------------------------------
 WEBKIT_SET_EXTRA_COMPILER_FLAGS(${WTF_LIBRARY_NAME})
 WEBKIT_SET_EXTRA_COMPILER_FLAGS(${JavaScriptCore_LIBRARY_NAME})
+WEBKIT_SET_EXTRA_COMPILER_FLAGS(${WebCoreTestSupport_LIBRARY_NAME})
 
 IF (ENABLE_WEBCORE)
     WEBKIT_SET_EXTRA_COMPILER_FLAGS(${WebCore_LIBRARY_NAME})
diff --git a/Source/JavaScriptCore/API/APIShims.h b/Source/JavaScriptCore/API/APIShims.h
index 02495110b..ef5f10466 100644
--- a/Source/JavaScriptCore/API/APIShims.h
+++ b/Source/JavaScriptCore/API/APIShims.h
@@ -28,31 +28,40 @@
 
 #include "CallFrame.h"
 #include "GCActivityCallback.h"
+#include "IncrementalSweeper.h"
 #include "JSLock.h"
 #include <wtf/WTFThreadData.h>
 
 namespace JSC {
 
 class APIEntryShimWithoutLock {
+public:
+    enum RefGlobalDataTag { DontRefGlobalData = 0, RefGlobalData };
+
 protected:
-    APIEntryShimWithoutLock(JSGlobalData* globalData, bool registerThread)
-        : m_globalData(globalData)
+    APIEntryShimWithoutLock(JSGlobalData* globalData, bool registerThread, RefGlobalDataTag shouldRefGlobalData)
+        : m_shouldRefGlobalData(shouldRefGlobalData)
+        , m_globalData(globalData)
         , m_entryIdentifierTable(wtfThreadData().setCurrentIdentifierTable(globalData->identifierTable))
     {
+        if (shouldRefGlobalData)
+            m_globalData->ref();
         UNUSED_PARAM(registerThread);
         if (registerThread)
             globalData->heap.machineThreads().addCurrentThread();
         m_globalData->heap.activityCallback()->synchronize();
-        m_globalData->timeoutChecker.start();
+        m_globalData->heap.sweeper()->synchronize();
     }
 
     ~APIEntryShimWithoutLock()
     {
-        m_globalData->timeoutChecker.stop();
         wtfThreadData().setCurrentIdentifierTable(m_entryIdentifierTable);
+        if (m_shouldRefGlobalData)
+            m_globalData->deref();
     }
 
-private:
+protected:
+    RefGlobalDataTag m_shouldRefGlobalData;
     JSGlobalData* m_globalData;
     IdentifierTable* m_entryIdentifierTable;
 };
@@ -61,20 +70,38 @@ class APIEntryShim : public APIEntryShimWithoutLock {
 public:
     // Normal API entry
     APIEntryShim(ExecState* exec, bool registerThread = true)
-        : APIEntryShimWithoutLock(&exec->globalData(), registerThread)
-        , m_lock(exec)
+        : APIEntryShimWithoutLock(&exec->globalData(), registerThread, RefGlobalData)
+    {
+        init();
+    }
+
+    // This constructor is necessary for HeapTimer to prevent it from accidentally resurrecting 
+    // the ref count of a "dead" JSGlobalData.
+    APIEntryShim(JSGlobalData* globalData, RefGlobalDataTag refGlobalData, bool registerThread = true)
+        : APIEntryShimWithoutLock(globalData, registerThread, refGlobalData)
     {
+        init();
     }
 
     // JSPropertyNameAccumulator only has a globalData.
     APIEntryShim(JSGlobalData* globalData, bool registerThread = true)
-        : APIEntryShimWithoutLock(globalData, registerThread)
-        , m_lock(globalData->isSharedInstance() ? LockForReal : SilenceAssertionsOnly)
+        : APIEntryShimWithoutLock(globalData, registerThread, RefGlobalData)
     {
+        init();
+    }
+
+    ~APIEntryShim()
+    {
+        m_globalData->timeoutChecker.stop();
+        m_globalData->apiLock().unlock();
     }
 
 private:
-    JSLock m_lock;
+    void init()
+    {
+        m_globalData->apiLock().lock();
+        m_globalData->timeoutChecker.start();
+    }
 };
 
 class APICallbackShim {
@@ -88,7 +115,6 @@ public:
 
     ~APICallbackShim()
     {
-        m_globalData->heap.activityCallback()->synchronize();
         wtfThreadData().setCurrentIdentifierTable(m_globalData->identifierTable);
     }
 
diff --git a/Source/JavaScriptCore/API/JSContextRef.cpp b/Source/JavaScriptCore/API/JSContextRef.cpp
index 92e03a671..7a57287de 100644
--- a/Source/JavaScriptCore/API/JSContextRef.cpp
+++ b/Source/JavaScriptCore/API/JSContextRef.cpp
@@ -78,7 +78,6 @@ JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
     // If the application was linked before JSGlobalContextCreate was changed to use a unique JSGlobalData,
     // we use a shared one for backwards compatibility.
     if (NSVersionOfLinkTimeLibrary("JavaScriptCore") <= webkitFirstVersionWithConcurrentGlobalContexts) {
-        JSLock lock(LockForReal);
         return JSGlobalContextCreateInGroup(toRef(&JSGlobalData::sharedInstance()), globalObjectClass);
     }
 #endif // OS(DARWIN)
@@ -90,11 +89,9 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 {
     initializeThreading();
 
-    JSLock lock(LockForReal);
     RefPtr<JSGlobalData> globalData = group ? PassRefPtr<JSGlobalData>(toJS(group)) : JSGlobalData::createContextGroup(ThreadStackTypeSmall);
 
     APIEntryShim entryShim(globalData.get(), false);
-
     globalData->makeUsableFromMultipleThreads();
 
     if (!globalObjectClass) {
@@ -124,18 +121,19 @@ JSGlobalContextRef JSGlobalContextRetain(JSGlobalContextRef ctx)
 
 void JSGlobalContextRelease(JSGlobalContextRef ctx)
 {
+    IdentifierTable* savedIdentifierTable;
     ExecState* exec = toJS(ctx);
-    JSLock lock(exec);
+    {
+        JSLockHolder lock(exec);
 
-    JSGlobalData& globalData = exec->globalData();
-    IdentifierTable* savedIdentifierTable = wtfThreadData().setCurrentIdentifierTable(globalData.identifierTable);
+        JSGlobalData& globalData = exec->globalData();
+        savedIdentifierTable = wtfThreadData().setCurrentIdentifierTable(globalData.identifierTable);
 
-    bool protectCountIsZero = Heap::heap(exec->dynamicGlobalObject())->unprotect(exec->dynamicGlobalObject());
-    if (protectCountIsZero) {
-        globalData.heap.activityCallback()->synchronize();
-        globalData.heap.reportAbandonedObjectGraph();
+        bool protectCountIsZero = Heap::heap(exec->dynamicGlobalObject())->unprotect(exec->dynamicGlobalObject());
+        if (protectCountIsZero)
+            globalData.heap.reportAbandonedObjectGraph();
+        globalData.deref();
     }
-    globalData.deref();
 
     wtfThreadData().setCurrentIdentifierTable(savedIdentifierTable);
 }
@@ -166,7 +164,7 @@ JSGlobalContextRef JSContextGetGlobalContext(JSContextRef ctx)
 JSStringRef JSContextCreateBacktrace(JSContextRef ctx, unsigned maxStackSize)
 {
     ExecState* exec = toJS(ctx);
-    JSLock lock(exec);
+    JSLockHolder lock(exec);
 
     unsigned count = 0;
     UStringBuilder builder;
diff --git a/Source/JavaScriptCore/API/JSObjectRef.cpp b/Source/JavaScriptCore/API/JSObjectRef.cpp
index 91aa3c6bd..e6c0c528a 100644
--- a/Source/JavaScriptCore/API/JSObjectRef.cpp
+++ b/Source/JavaScriptCore/API/JSObjectRef.cpp
@@ -428,6 +428,8 @@ JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObject
     if (!jsThisObject)
         jsThisObject = exec->globalThisValue();
 
+    jsThisObject = jsThisObject->methodTable()->toThisObject(jsThisObject, exec);
+    
     MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; i++)
         argList.append(toJS(exec, arguments[i]));
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 06139a4d2..412be293f 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -78,6 +78,7 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGFixupPhase.cpp
     dfg/DFGGraph.cpp
     dfg/DFGJITCompiler.cpp
+    dfg/DFGMinifiedNode.cpp
     dfg/DFGNodeFlags.cpp
     dfg/DFGOSREntry.cpp
     dfg/DFGOSRExit.cpp
@@ -93,6 +94,9 @@ SET(JavaScriptCore_SOURCES
     dfg/DFGSpeculativeJIT32_64.cpp
     dfg/DFGSpeculativeJIT64.cpp
     dfg/DFGThunks.cpp
+    dfg/DFGValueSource.cpp
+    dfg/DFGVariableEvent.cpp
+    dfg/DFGVariableEventStream.cpp
     dfg/DFGValidate.cpp
     dfg/DFGVirtualRegisterAllocationPhase.cpp
 
@@ -105,6 +109,7 @@ SET(JavaScriptCore_SOURCES
     heap/Heap.cpp
     heap/HeapTimer.cpp
     heap/IncrementalSweeper.cpp
+    heap/JITStubRoutineSet.cpp
     heap/MachineStackMarker.cpp
     heap/MarkedAllocator.cpp
     heap/MarkedBlock.cpp
@@ -125,6 +130,7 @@ SET(JavaScriptCore_SOURCES
 
     jit/ExecutableAllocator.cpp
     jit/HostCallReturnValue.cpp
+    jit/GCAwareJITStubRoutine.cpp
     jit/JITArithmetic32_64.cpp
     jit/JITArithmetic.cpp
     jit/JITCall32_64.cpp
@@ -135,6 +141,7 @@ SET(JavaScriptCore_SOURCES
     jit/JITOpcodes.cpp
     jit/JITPropertyAccess32_64.cpp
     jit/JITPropertyAccess.cpp
+    jit/JITStubRoutine.cpp
     jit/JITStubs.cpp
     jit/ThunkGenerators.cpp
 
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 5de8f1d11..a1cbefa36 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,33 +1,2074 @@
-2012-06-19  Joel Dillon <joel.dillon@codethink.co.uk>  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2012-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r122166): It made 170 tests crash on 32 bit platforms
+        https://bugs.webkit.org/show_bug.cgi?id=90852
+
+        Reviewed by Zoltan Herczeg.
+        
+        If we can't use the range filter, we should still make sure that the
+        address is remotely sane, otherwise the hashtables will assert.
+
+        * jit/JITStubRoutine.h:
+        (JSC::JITStubRoutine::passesFilter):
+
+2012-07-10  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG recompilation heuristics should be based on count, not rate
+        https://bugs.webkit.org/show_bug.cgi?id=90146
+
+        Reviewed by Oliver Hunt.
+        
+        Rolling r121511 back in after fixing the DFG's interpretation of op_div
+        profiling, with Gavin's rubber stamp.
+
+        This removes a bunch of code that was previously trying to prevent spurious
+        reoptimizations if a large enough majority of executions of a code block did
+        not result in OSR exit. It turns out that this code was purely harmful. This
+        patch removes all of that logic and replaces it with a dead-simple
+        heuristic: if you exit more than N times (where N is an exponential function
+        of the number of times the code block has already been recompiled) then we
+        will recompile.
+        
+        This appears to be a broad ~1% win on many benchmarks large and small.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::couldTakeSpecialFastCase):
+        (CodeBlock):
+        (JSC::CodeBlock::osrExitCounter):
+        (JSC::CodeBlock::countOSRExit):
+        (JSC::CodeBlock::addressOfOSRExitCounter):
+        (JSC::CodeBlock::offsetOfOSRExitCounter):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        (JSC::ExecutionCounter::clippedThreshold):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::makeDivSafe):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.h:
+        (JSC):
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, roll out http://trac.webkit.org/changeset/121511
+        It made in-browser V8v7 10% slower.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::countSpeculationSuccess):
+        (JSC::CodeBlock::countSpeculationFailure):
+        (JSC::CodeBlock::speculativeSuccessCounter):
+        (JSC::CodeBlock::speculativeFailCounter):
+        (JSC::CodeBlock::forcedOSRExitCounter):
+        (JSC::CodeBlock::addressOfSpeculativeSuccessCounter):
+        (JSC::CodeBlock::addressOfSpeculativeFailCounter):
+        (JSC::CodeBlock::addressOfForcedOSRExitCounter):
+        (JSC::CodeBlock::offsetOfSpeculativeSuccessCounter):
+        (JSC::CodeBlock::offsetOfSpeculativeFailCounter):
+        (JSC::CodeBlock::offsetOfForcedOSRExitCounter):
+        (JSC::CodeBlock::largeFailCountThreshold):
+        (JSC::CodeBlock::largeFailCountThresholdForLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.h:
+        (JSC):
+
+2012-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG may get stuck in an infinite fix point if it constant folds a mispredicted node
+        https://bugs.webkit.org/show_bug.cgi?id=90829
+        <rdar://problem/11823843>
+
+        Reviewed by Oliver Hunt.
+        
+        If a node is shown to have been mispredicted during CFA, then don't allow constant
+        folding to make the graph even more degenerate. Instead, pull back on constant folding
+        and allow the normal OSR machinery to fix our profiling so that a future recompilation
+        doesn't see the same mistake.
+
+        * dfg/DFGAbstractState.cpp:
+        (JSC::DFG::AbstractState::execute):
+        * dfg/DFGAbstractState.h:
+        (JSC::DFG::AbstractState::trySetConstant):
+        (AbstractState):
+        * dfg/DFGPhase.h:
+        (JSC::DFG::Phase::name):
+        (Phase):
+        (JSC::DFG::runAndLog):
+        (DFG):
+        (JSC::DFG::runPhase):
+
+2012-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        It should be possible to jettison JIT stub routines even if they are currently running
+        https://bugs.webkit.org/show_bug.cgi?id=90731
+
+        Reviewed by Gavin Barraclough.
+        
+        This gives the GC awareness of all JIT-generated stubs for inline caches. That
+        means that if you want to delete a JIT-generated stub, you don't have to worry
+        about whether or not it is currently running: if there is a chance that it might
+        be, the GC will kindly defer deletion until non-running-ness is proved.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/Instruction.h:
+        (JSC):
+        (PolymorphicStubInfo):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/PolymorphicPutByIdList.cpp:
+        (JSC::PutByIdAccess::fromStructureStubInfo):
+        * bytecode/PolymorphicPutByIdList.h:
+        (JSC::PutByIdAccess::transition):
+        (JSC::PutByIdAccess::replace):
+        (JSC::PutByIdAccess::stubRoutine):
+        (PutByIdAccess):
+        (JSC::PolymorphicPutByIdList::currentSlowPathTarget):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::reset):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * heap/ConservativeRoots.cpp:
+        (JSC):
+        (DummyMarkHook):
+        (JSC::DummyMarkHook::mark):
+        (JSC::ConservativeRoots::add):
+        (CompositeMarkHook):
+        (JSC::CompositeMarkHook::CompositeMarkHook):
+        (JSC::CompositeMarkHook::mark):
+        * heap/ConservativeRoots.h:
+        (JSC):
+        (ConservativeRoots):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        * heap/Heap.h:
+        (JSC):
+        (Heap):
+        * heap/JITStubRoutineSet.cpp: Added.
+        (JSC):
+        (JSC::JITStubRoutineSet::JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::~JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::add):
+        (JSC::JITStubRoutineSet::clearMarks):
+        (JSC::JITStubRoutineSet::markSlow):
+        (JSC::JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines):
+        (JSC::JITStubRoutineSet::traceMarkedStubRoutines):
+        * heap/JITStubRoutineSet.h: Added.
+        (JSC):
+        (JITStubRoutineSet):
+        (JSC::JITStubRoutineSet::mark):
+        * heap/MachineStackMarker.h:
+        (JSC):
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::gatherConservativeRoots):
+        * interpreter/RegisterFile.h:
+        (JSC):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::DemandExecutableAllocator::DemandExecutableAllocator):
+        * jit/ExecutableAllocator.h:
+        (JSC):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC):
+        (JSC::FixedVMPoolExecutableAllocator::FixedVMPoolExecutableAllocator):
+        * jit/GCAwareJITStubRoutine.cpp: Added.
+        (JSC):
+        (JSC::GCAwareJITStubRoutine::GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::~GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::observeZeroRefCount):
+        (JSC::GCAwareJITStubRoutine::deleteFromGC):
+        (JSC::GCAwareJITStubRoutine::markRequiredObjectsInternal):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject):
+        (JSC::MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal):
+        (JSC::createJITStubRoutine):
+        * jit/GCAwareJITStubRoutine.h: Added.
+        (JSC):
+        (GCAwareJITStubRoutine):
+        (JSC::GCAwareJITStubRoutine::markRequiredObjects):
+        (MarkingGCAwareJITStubRoutineWithOneObject):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubRoutine.cpp: Added.
+        (JSC):
+        (JSC::JITStubRoutine::~JITStubRoutine):
+        (JSC::JITStubRoutine::observeZeroRefCount):
+        * jit/JITStubRoutine.h: Added.
+        (JSC):
+        (JITStubRoutine):
+        (JSC::JITStubRoutine::JITStubRoutine):
+        (JSC::JITStubRoutine::createSelfManagedRoutine):
+        (JSC::JITStubRoutine::code):
+        (JSC::JITStubRoutine::asCodePtr):
+        (JSC::JITStubRoutine::ref):
+        (JSC::JITStubRoutine::deref):
+        (JSC::JITStubRoutine::startAddress):
+        (JSC::JITStubRoutine::endAddress):
+        (JSC::JITStubRoutine::addressStep):
+        (JSC::JITStubRoutine::canPerformRangeFilter):
+        (JSC::JITStubRoutine::filteringStartAddress):
+        (JSC::JITStubRoutine::filteringExtentSize):
+        (JSC::JITStubRoutine::passesFilter):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        gcc build fix after r121925.
+
+        * runtime/JSObject.h:
+        (JSC::JSFinalObject::finishCreation):
+
+2012-07-08  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt][ARM] Implementing missing macro assembler instructions after r121925
+        https://bugs.webkit.org/show_bug.cgi?id=90657
+
+        Reviewed by Csaba Osztrogonác.
+
+        Implementing convertibleLoadPtr, replaceWithLoad and
+        replaceWithAddressComputation.
+
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::replaceWithLoad):
+        (ARMAssembler):
+        (JSC::ARMAssembler::replaceWithAddressComputation):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::convertibleLoadPtr):
+        (MacroAssemblerARM):
+
+2012-07-06  Filip Pizlo  <fpizlo@apple.com>
+
+        WebKit Version 5.1.7 (6534.57.2, r121935): Double-click no longer works on OpenStreetMap
+        https://bugs.webkit.org/show_bug.cgi?id=90703
+
+        Reviewed by Michael Saboff.
+        
+        It turns out that in my object model refactoring, I managed to fix get_by_pname in all
+        execution engines except 64-bit baseline JIT.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_pname):
+
+2012-07-06  Pravin D  <pravind.2k4@gmail.com>
+
+        Build Error on Qt Linux build
+        https://bugs.webkit.org/show_bug.cgi?id=90699
+
+        Reviewed by Laszlo Gombos.
+
+        * parser/Parser.cpp:
+        (JSC::::parseForStatement):
+        Removed unused boolean variable as this was causing build error on Qt Linux.
+
+2012-07-06  Nuno Lopes  <nlopes@apple.com>
+
+        Fix build with recent clang.
+        https://bugs.webkit.org/show_bug.cgi?id=90634
+
+        Reviewed by Oliver Hunt.
+
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (SpecializedThunkJIT):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createAssignResolve):
+        (JSC::ASTBuilder::createForLoop):
+        (JSC::ASTBuilder::createForInLoop):
+        (JSC::ASTBuilder::makeAssignNode):
+        (JSC::ASTBuilder::makePrefixNode):
+        (JSC::ASTBuilder::makePostfixNode):
+        * parser/NodeConstructors.h:
+        (JSC::PostfixErrorNode::PostfixErrorNode):
+        (JSC::PrefixErrorNode::PrefixErrorNode):
+        (JSC::AssignResolveNode::AssignResolveNode):
+        (JSC::AssignErrorNode::AssignErrorNode):
+        (JSC::ForNode::ForNode):
+        (JSC::ForInNode::ForInNode):
+        * parser/Nodes.h:
+        (FunctionCallResolveNode):
+        (PostfixErrorNode):
+        (PrefixErrorNode):
+        (ReadModifyResolveNode):
+        (AssignResolveNode):
+        (AssignErrorNode):
+        (ForNode):
+        (ForInNode):
+        * parser/Parser.cpp:
+        (JSC::::parseVarDeclarationList):
+        (JSC::::parseForStatement):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createForLoop):
+
+2012-07-06  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt][ARM] REGRESSION(r121885): It broke 30 jsc tests, 500+ layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=90656
+
+        Reviewed by Csaba Osztrogonác.
+
+        Typo fixes.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        Rename getOp2Byte() -> getOp2Half()
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
+        Add a necessary space.
+        * jit/JITStubs.cpp:
+        (JSC):
+        Revert INLINE_ARM_FUNCTION macro.
+
+2012-07-05  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r121925): It broke 5 sputnik tests on x86 platforms
+        https://bugs.webkit.org/show_bug.cgi?id=90658
+
+        Reviewed by Zoltan Herczeg.
+        
+        Under the new object model, out-of-line property accesses such as those
+        in ResolveGlobal must account for the fact that the offset to the Kth
+        property is represented by K + inlineStorageCapacity. Hence, the property
+        loads in ResolveGlobal must have an additional -inlineStorageCapacity *
+        sizeof(JSValue) offset.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+
+2012-07-05  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Unreviewed 64 bit buildfix after r121925.
+
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+
+2012-07-05  Michael Saboff  <msaboff@apple.com>
+
+        JSString::tryHashConstLock() fails to get exclusive lock
+        https://bugs.webkit.org/show_bug.cgi?id=90639
+
+        Reviewed by Oliver Hunt.
+
+        Added check that the string is already locked even before compare and swap.
+
+        * heap/MarkStack.cpp:
+        (JSC::JSString::tryHashConstLock):
+
+2012-07-04  Filip Pizlo  <fpizlo@apple.com>
+
+        Inline property storage should not be wasted when it is exhausted
+        https://bugs.webkit.org/show_bug.cgi?id=90347
+
+        Reviewed by Gavin Barraclough.
+        
+        Previously, if we switched an object from using inline storage to out-of-line
+        storage, we would abandon the inline storage. This would have two main implications:
+        (i) all accesses to the object, even for properties that were previously in inline
+        storage, must now take an extra indirection; and (ii) we waste a non-trivial amount
+        of space since we must allocate additional out-of-line storage to hold properties
+        that would have fit in the inline storage. There's also the copying cost when
+        switching to out-of-line storage - we must copy all inline properties into ouf-of-line
+        storage.
+        
+        This patch changes the way that object property storage works so that we can use both
+        inline and out-of-line storage concurrently. This is accomplished by introducing a
+        new notion of property offset. This PropertyOffset is a 32-bit signed integer and it
+        behaves as follows:
+        
+        offset == -1: invalid offset, indicating a property that does not exist.
+        
+        0 <= offset <= inlineStorageCapacity: offset into inline storage.
+        
+        inlineStorageCapacity < offset: offset into out-of-line storage.
+        
+        Because non-final objects don't have inline storage, the only valid PropertyOffsets
+        for those objects' properties are -1 or > inlineStorageCapacity.
+        
+        This now means that the decision to use inline or out-of-line storage for an access is
+        made based on the offset, rather than the structure. It also means that any access
+        where the offset is a variable must have an extra branch, unless the type of the
+        object is also known (if it's known to be a non-final object then we can just assert
+        that the offset is >= inlineStorageCapacity).
+        
+        This looks like a big Kraken speed-up and a slight V8 speed-up.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/ARMv7Assembler.h:
+        (ARMv7Assembler):
+        (JSC::ARMv7Assembler::ldrWide8BitImmediate):
+        (JSC::ARMv7Assembler::replaceWithLoad):
+        (JSC::ARMv7Assembler::replaceWithAddressComputation):
+        * assembler/AbstractMacroAssembler.h:
+        (AbstractMacroAssembler):
+        (ConvertibleLoadLabel):
+        (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::ConvertibleLoadLabel):
+        (JSC::AbstractMacroAssembler::ConvertibleLoadLabel::isSet):
+        (JSC::AbstractMacroAssembler::labelIgnoringWatchpoints):
+        (JSC::AbstractMacroAssembler::replaceWithLoad):
+        (JSC::AbstractMacroAssembler::replaceWithAddressComputation):
+        * assembler/CodeLocation.h:
+        (JSC):
+        (CodeLocationCommon):
+        (CodeLocationConvertibleLoad):
+        (JSC::CodeLocationConvertibleLoad::CodeLocationConvertibleLoad):
+        (JSC::CodeLocationCommon::convertibleLoadAtOffset):
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * assembler/LinkBuffer.h:
+        (LinkBuffer):
+        (JSC::LinkBuffer::locationOf):
+        * assembler/MacroAssemblerARMv7.h:
+        (MacroAssemblerARMv7):
+        (JSC::MacroAssemblerARMv7::convertibleLoadPtr):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::convertibleLoadPtr):
+        (MacroAssemblerX86):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::convertibleLoadPtr):
+        (MacroAssemblerX86_64):
+        * assembler/RepatchBuffer.h:
+        (RepatchBuffer):
+        (JSC::RepatchBuffer::replaceWithLoad):
+        (JSC::RepatchBuffer::replaceWithAddressComputation):
+        (JSC::RepatchBuffer::setLoadInstructionIsActive):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::replaceWithLoad):
+        (X86Assembler):
+        (JSC::X86Assembler::replaceWithAddressComputation):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::printGetByIdOp):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeFromLLInt):
+        (JSC::GetByIdStatus::computeForChain):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::GetByIdStatus):
+        (JSC::GetByIdStatus::offset):
+        (GetByIdStatus):
+        * bytecode/Opcode.h:
+        (JSC):
+        (JSC::padOpcodeName):
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::computeFromLLInt):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        (JSC::PutByIdStatus::PutByIdStatus):
+        (JSC::PutByIdStatus::offset):
+        (PutByIdStatus):
+        * bytecode/ResolveGlobalStatus.cpp:
+        (JSC):
+        (JSC::computeForStructure):
+        * bytecode/ResolveGlobalStatus.h:
+        (JSC::ResolveGlobalStatus::ResolveGlobalStatus):
+        (JSC::ResolveGlobalStatus::offset):
+        (ResolveGlobalStatus):
+        * bytecode/StructureSet.h:
+        (StructureSet):
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGByteCodeParser.cpp:
+        (ByteCodeParser):
+        (JSC::DFG::ByteCodeParser::handleGetByOffset):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::canCompileOpcode):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGJITCompiler.h:
+        (JSC::DFG::PropertyAccessRecord::PropertyAccessRecord):
+        (PropertyAccessRecord):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::dfgRepatchByIdSelfAccess):
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::emitPutReplaceStub):
+        (JSC::DFG::emitPutTransitionStub):
+        (JSC::DFG::tryCachePutByID):
+        (JSC::DFG::tryBuildPutByIdList):
+        * dfg/DFGSpeculativeJIT.h:
+        (JSC::DFG::SpeculativeJIT::emitAllocateBasicJSObject):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        (JSC::DFG::SpeculativeJIT::cachedPutById):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * heap/MarkStack.cpp:
+        (JSC::visitChildren):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::PropertyStubCompilationInfo::copyToStubInfo):
+        * jit/JIT.h:
+        (JSC::PropertyStubCompilationInfo::PropertyStubCompilationInfo):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JIT):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_global):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::emit_op_get_by_pname):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::DEFINE_STUB_FUNCTION):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * offlineasm/x86.rb:
+        * runtime/JSGlobalObject.h:
+        (JSGlobalObject):
+        (JSC::JSGlobalObject::functionNameOffset):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::visitChildren):
+        (JSC):
+        (JSC::JSFinalObject::visitChildren):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertySpecificValue):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::growOutOfLineStorage):
+        (JSC::JSObject::getOwnPropertyDescriptor):
+        * runtime/JSObject.h:
+        (JSObject):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::hasInlineStorage):
+        (JSC::JSObject::inlineStorageUnsafe):
+        (JSC::JSObject::inlineStorage):
+        (JSC::JSObject::outOfLineStorage):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::putUndefinedAtDirectOffset):
+        (JSC::JSObject::addressOfOutOfLineStorage):
+        (JSC::JSObject::finishCreation):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSFinalObject):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSFinalObject::JSFinalObject):
+        (JSC::JSObject::offsetOfOutOfLineStorage):
+        (JSC::JSObject::setOutOfLineStorage):
+        (JSC::JSObject::JSObject):
+        (JSC):
+        (JSC::JSCell::fastGetOwnProperty):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::offsetRelativeToPatchedStorage):
+        (JSC::indexRelativeToBase):
+        (JSC::offsetRelativeToBase):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSPropertyNameIterator.h:
+        (JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::getOffset):
+        (JSC::JSPropertyNameIterator::finishCreation):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/Operations.h:
+        (JSC::normalizePrototypeChain):
+        * runtime/Options.cpp:
+        (JSC):
+        (JSC::Options::initialize):
+        * runtime/PropertyMapHashTable.h:
+        (PropertyMapEntry):
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (PropertyTable):
+        (JSC::PropertyTable::PropertyTable):
+        (JSC::PropertyTable::getDeletedOffset):
+        (JSC::PropertyTable::addDeletedOffset):
+        (JSC::PropertyTable::nextOffset):
+        (JSC):
+        (JSC::PropertyTable::sizeInMemory):
+        * runtime/PropertyOffset.h: Added.
+        (JSC):
+        (JSC::checkOffset):
+        (JSC::validateOffset):
+        (JSC::isValidOffset):
+        (JSC::isInlineOffset):
+        (JSC::isOutOfLineOffset):
+        (JSC::offsetInInlineStorage):
+        (JSC::offsetInOutOfLineStorage):
+        (JSC::offsetInRespectiveStorage):
+        (JSC::numberOfOutOfLineSlotsForLastOffset):
+        (JSC::numberOfSlotsForLastOffset):
+        (JSC::nextPropertyOffsetFor):
+        (JSC::firstPropertyOffsetFor):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::cachedOffset):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCacheableGetterSlot):
+        (JSC::PropertySlot::clearOffset):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::setExistingProperty):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::cachedOffset):
+        (PutPropertySlot):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::nextOutOfLineStorageCapacity):
+        (JSC::Structure::growOutOfLineCapacity):
+        (JSC::Structure::suggestedNewOutOfLineStorageCapacity):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::copyPropertyTableForPinning):
+        (JSC::Structure::get):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (Structure):
+        (JSC::Structure::putWillGrowOutOfLineStorage):
+        (JSC::Structure::previousID):
+        (JSC::Structure::outOfLineCapacity):
+        (JSC::Structure::outOfLineSizeForKnownFinalObject):
+        (JSC::Structure::outOfLineSizeForKnownNonFinalObject):
+        (JSC::Structure::outOfLineSize):
+        (JSC::Structure::hasInlineStorage):
+        (JSC::Structure::inlineCapacity):
+        (JSC::Structure::inlineSizeForKnownFinalObject):
+        (JSC::Structure::inlineSize):
+        (JSC::Structure::totalStorageSize):
+        (JSC::Structure::totalStorageCapacity):
+        (JSC::Structure::firstValidOffset):
+        (JSC::Structure::lastValidOffset):
+        (JSC::Structure::isValidOffset):
+        (JSC::Structure::isEmpty):
+        (JSC::Structure::transitionCount):
+        (JSC::Structure::get):
+
+2012-07-05  Oliver Hunt  <oliver@apple.com>
+
+        JSObjectCallAsFunction should thisConvert the provided thisObject
+        https://bugs.webkit.org/show_bug.cgi?id=90628
+
+        Reviewed by Gavin Barraclough.
+
+        Perform this conversion on the provided this object.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCallAsFunction):
+
+2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        [Qt] Unreviewed buildfix after r121886. Typo fix.
+
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+
+2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Port DFG JIT to traditional ARM
+        https://bugs.webkit.org/show_bug.cgi?id=90198
+
+        Reviewed by Filip Pizlo.
+
+        This patch contains the macro assembler part of the
+        DFG JIT support on ARM systems with fixed 32 bit instruction
+        width. A large amount of old code was refactored, and the ARMv4
+        or lower support is removed from the macro assembler.
+
+        Sunspider is improved by 8%, and V8 is 92%.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+        (JSC::ARMAssembler::baseIndexTransfer32):
+        (JSC):
+        (JSC::ARMAssembler::dataTransfer16):
+        (JSC::ARMAssembler::baseIndexTransfer16):
+        (JSC::ARMAssembler::dataTransferFloat):
+        (JSC::ARMAssembler::baseIndexTransferFloat):
+        (JSC::ARMAssembler::executableCopy):
+        * assembler/ARMAssembler.h:
+        (JSC::ARMAssembler::ARMAssembler):
+        (JSC::ARMAssembler::emitInst):
+        (JSC::ARMAssembler::vmov_f64_r):
+        (ARMAssembler):
+        (JSC::ARMAssembler::vabs_f64_r):
+        (JSC::ARMAssembler::vneg_f64_r):
+        (JSC::ARMAssembler::ldr_imm):
+        (JSC::ARMAssembler::ldr_un_imm):
+        (JSC::ARMAssembler::dtr_u):
+        (JSC::ARMAssembler::dtr_ur):
+        (JSC::ARMAssembler::dtr_d):
+        (JSC::ARMAssembler::dtr_dr):
+        (JSC::ARMAssembler::dtrh_u):
+        (JSC::ARMAssembler::dtrh_ur):
+        (JSC::ARMAssembler::dtrh_d):
+        (JSC::ARMAssembler::dtrh_dr):
+        (JSC::ARMAssembler::fdtr_u):
+        (JSC::ARMAssembler::fdtr_d):
+        (JSC::ARMAssembler::push_r):
+        (JSC::ARMAssembler::pop_r):
+        (JSC::ARMAssembler::poke_r):
+        (JSC::ARMAssembler::peek_r):
+        (JSC::ARMAssembler::vmov_vfp64_r):
+        (JSC::ARMAssembler::vmov_arm64_r):
+        (JSC::ARMAssembler::vmov_vfp32_r):
+        (JSC::ARMAssembler::vmov_arm32_r):
+        (JSC::ARMAssembler::vcvt_u32_f64_r):
+        (JSC::ARMAssembler::vcvt_f64_f32_r):
+        (JSC::ARMAssembler::vcvt_f32_f64_r):
+        (JSC::ARMAssembler::clz_r):
+        (JSC::ARMAssembler::bkpt):
+        (JSC::ARMAssembler::bx):
+        (JSC::ARMAssembler::blx):
+        (JSC::ARMAssembler::labelIgnoringWatchpoints):
+        (JSC::ARMAssembler::labelForWatchpoint):
+        (JSC::ARMAssembler::label):
+        (JSC::ARMAssembler::getLdrImmAddress):
+        (JSC::ARMAssembler::replaceWithJump):
+        (JSC::ARMAssembler::maxJumpReplacementSize):
+        (JSC::ARMAssembler::getOp2Byte):
+        (JSC::ARMAssembler::getOp2Half):
+        (JSC::ARMAssembler::RM):
+        (JSC::ARMAssembler::RS):
+        (JSC::ARMAssembler::RD):
+        (JSC::ARMAssembler::RN):
+        * assembler/AssemblerBufferWithConstantPool.h:
+        (JSC::AssemblerBufferWithConstantPool::ensureSpaceForAnyInstruction):
+        * assembler/MacroAssemblerARM.cpp:
+        (JSC::MacroAssemblerARM::load32WithUnalignedHalfWords):
+        * assembler/MacroAssemblerARM.h:
+        (JSC::MacroAssemblerARM::add32):
+        (MacroAssemblerARM):
+        (JSC::MacroAssemblerARM::and32):
+        (JSC::MacroAssemblerARM::lshift32):
+        (JSC::MacroAssemblerARM::mul32):
+        (JSC::MacroAssemblerARM::neg32):
+        (JSC::MacroAssemblerARM::rshift32):
+        (JSC::MacroAssemblerARM::urshift32):
+        (JSC::MacroAssemblerARM::xor32):
+        (JSC::MacroAssemblerARM::load8):
+        (JSC::MacroAssemblerARM::load8Signed):
+        (JSC::MacroAssemblerARM::load16):
+        (JSC::MacroAssemblerARM::load16Signed):
+        (JSC::MacroAssemblerARM::load32):
+        (JSC::MacroAssemblerARM::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerARM::store8):
+        (JSC::MacroAssemblerARM::store16):
+        (JSC::MacroAssemblerARM::store32):
+        (JSC::MacroAssemblerARM::move):
+        (JSC::MacroAssemblerARM::jump):
+        (JSC::MacroAssemblerARM::branchAdd32):
+        (JSC::MacroAssemblerARM::mull32):
+        (JSC::MacroAssemblerARM::branchMul32):
+        (JSC::MacroAssemblerARM::nearCall):
+        (JSC::MacroAssemblerARM::compare32):
+        (JSC::MacroAssemblerARM::test32):
+        (JSC::MacroAssemblerARM::sub32):
+        (JSC::MacroAssemblerARM::call):
+        (JSC::MacroAssemblerARM::loadFloat):
+        (JSC::MacroAssemblerARM::loadDouble):
+        (JSC::MacroAssemblerARM::storeFloat):
+        (JSC::MacroAssemblerARM::storeDouble):
+        (JSC::MacroAssemblerARM::moveDouble):
+        (JSC::MacroAssemblerARM::addDouble):
+        (JSC::MacroAssemblerARM::divDouble):
+        (JSC::MacroAssemblerARM::subDouble):
+        (JSC::MacroAssemblerARM::mulDouble):
+        (JSC::MacroAssemblerARM::absDouble):
+        (JSC::MacroAssemblerARM::negateDouble):
+        (JSC::MacroAssemblerARM::convertInt32ToDouble):
+        (JSC::MacroAssemblerARM::convertFloatToDouble):
+        (JSC::MacroAssemblerARM::convertDoubleToFloat):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::branchTruncateDoubleToUint32):
+        (JSC::MacroAssemblerARM::truncateDoubleToInt32):
+        (JSC::MacroAssemblerARM::truncateDoubleToUint32):
+        (JSC::MacroAssemblerARM::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerARM::branchDoubleNonZero):
+        (JSC::MacroAssemblerARM::branchDoubleZeroOrNaN):
+        (JSC::MacroAssemblerARM::invert):
+        (JSC::MacroAssemblerARM::replaceWithJump):
+        (JSC::MacroAssemblerARM::maxJumpReplacementSize):
+        (JSC::MacroAssemblerARM::call32):
+        * assembler/SH4Assembler.h:
+        (JSC::SH4Assembler::label):
+        * dfg/DFGAssemblyHelpers.h:
+        (JSC::DFG::AssemblyHelpers::debugCall):
+        (JSC::DFG::AssemblyHelpers::boxDouble):
+        (JSC::DFG::AssemblyHelpers::unboxDouble):
+        * dfg/DFGCCallHelpers.h:
+        (CCallHelpers):
+        (JSC::DFG::CCallHelpers::setupArguments):
+        * dfg/DFGFPRInfo.h:
+        (DFG):
+        * dfg/DFGGPRInfo.h:
+        (DFG):
+        (GPRInfo):
+        * dfg/DFGOperations.cpp:
+        (JSC):
+        * dfg/DFGSpeculativeJIT.h:
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::appendCallWithExceptionCheckSetResult):
+        (JSC::DFG::SpeculativeJIT::appendCallSetResult):
+        * jit/JITStubs.cpp:
+        (JSC):
+        * jit/JITStubs.h:
+        (JITStackFrame):
+        * jit/JSInterfaceJIT.h:
+        (JSInterfaceJIT):
+
+2012-07-04  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Added member functions to expose function name, urlString, and line #.
+        Refactored toString to make use of these member functions to reduce
+        duplicated code for future maintenance.
+
+        Manually tested refactoring of toString by tracing thrown exceptions.
+
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+        (JSC::StackFrame::friendlySourceURL):
+        (JSC::StackFrame::friendlyFunctionName):
+        (JSC::StackFrame::friendlyLineNumber):
+
+2012-07-04  Andy Wingo  <wingo@igalia.com>
+
+        [GTK] Enable parallel GC
+        https://bugs.webkit.org/show_bug.cgi?id=90568
+
+        Reviewed by Martin Robinson.
+
+        * runtime/Options.cpp: Include <algorithm.h> for std::min.
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing.
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-03  Michael Saboff  <msaboff@apple.com>
+
+        Enh: Hash Const JSString in Backing Stores to Save Memory
+        https://bugs.webkit.org/show_bug.cgi?id=86024
+
+        Reviewed by Oliver Hunt.
+
+        During garbage collection, each marking thread keeps a HashMap of
+        strings.  While visiting via MarkStack::copyAndAppend(), we check to
+        see if the string we are visiting is already in the HashMap.  If not
+        we add it. If so, we change the reference to the current string we're
+        visiting to the prior string.
+
+        To reduce the performance impact of this change, two throttles have
+        ben added.  1) We only try hash consting if a significant number of new 
+        strings have been created since the last hash const.  Currently this is
+        set at 100 strings.  2) If a string is unique at the end of a marking
+        it will not be checked during further GC phases. In some cases this
+        won't catch all duplicates, but we are trying to catch the growth of
+        duplicate strings.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackThreadSharedData::resetChildren):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::MarkStackThreadSharedData::reset):
+        (JSC::MarkStack::setup): Check to see if enough strings have been created
+        to hash const.
+        (JSC::MarkStack::reset): Added call to clear m_uniqueStrings.
+        (JSC::JSString::tryHashConstLock): New method to lock JSString for
+        hash consting.
+        (JSC::JSString::releaseHashConstLock): New unlock method.
+        (JSC::JSString::shouldTryHashConst): Set of checks to see if we should
+        try to hash const the string.
+        (JSC::MarkStack::internalAppend): New method that performs the hash consting.
+        (JSC::SlotVisitor::copyAndAppend): Changed to call the new hash
+        consting internalAppend().
+        * heap/MarkStack.h:
+        (MarkStackThreadSharedData):
+        (MarkStack):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSGlobalData):
+        (JSC::JSGlobalData::haveEnoughNewStringsToHashConst):
+        (JSC::JSGlobalData::resetNewStringsSinceLastHashConst):
+        * runtime/JSString.h:
+        (JSString): Changed from using bool flags to using an unsigned
+        m_flags field.  This works better with the weakCompareAndSwap in
+        JSString::tryHashConstLock(). Changed the 8bitness setting and
+        checking to use new accessors.
+        (JSC::JSString::JSString):
+        (JSC::JSString::finishCreation):
+        (JSC::JSString::is8Bit): Updated for new m_flags.
+        (JSC::JSString::setIs8Bit): New setter.
+        New hash const flags accessors:
+        (JSC::JSString::isHashConstSingleton):
+        (JSC::JSString::clearHashConstSingleton):
+        (JSC::JSString::setHashConstSingleton):
+        (JSC::JSRopeString::finishCreation):
+        (JSC::JSRopeString::append):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * JavaScriptCore.gyp/.gitignore:
+
+2012-07-03  Mark Lam  <mark.lam@apple.com>
+
+        Add ability to symbolically set and dump JSC VM options.
+        See comments in runtime/Options.h for details on how the options work.
+        https://bugs.webkit.org/show_bug.cgi?id=90420
+
+        Reviewed by Filip Pizlo.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * assembler/LinkBuffer.h:
+        (JSC):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldOptimizeNow):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::likelyToTakeSlowCase):
+        (JSC::CodeBlock::couldTakeSlowCase):
+        (JSC::CodeBlock::likelyToTakeSpecialFastCase):
+        (JSC::CodeBlock::likelyToTakeDeepestSlowCase):
+        (JSC::CodeBlock::likelyToTakeAnySlowCase):
+        (JSC::CodeBlock::jitAfterWarmUp):
+        (JSC::CodeBlock::jitSoon):
+        (JSC::CodeBlock::reoptimizationRetryCounter):
+        (JSC::CodeBlock::countReoptimization):
+        (JSC::CodeBlock::counterValueForOptimizeAfterWarmUp):
+        (JSC::CodeBlock::counterValueForOptimizeAfterLongWarmUp):
+        (JSC::CodeBlock::optimizeSoon):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        * bytecode/ExecutionCounter.h:
+        (JSC::ExecutionCounter::clippedThreshold):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        * dfg/DFGCapabilities.h:
+        (JSC::DFG::mightCompileEval):
+        (JSC::DFG::mightCompileProgram):
+        (JSC::DFG::mightCompileFunctionForCall):
+        (JSC::DFG::mightCompileFunctionForConstruct):
+        (JSC::DFG::mightInlineFunctionForCall):
+        (JSC::DFG::mightInlineFunctionForConstruct):
+        * dfg/DFGCommon.h:
+        (JSC::DFG::shouldShowDisassembly):
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compile):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGVariableAccessData.h:
+        (JSC::DFG::VariableAccessData::shouldUseDoubleFormatAccordingToVote):
+        * heap/MarkStack.cpp:
+        (JSC::MarkStackSegmentAllocator::allocate):
+        (JSC::MarkStackSegmentAllocator::shrinkReserve):
+        (JSC::MarkStackArray::MarkStackArray):
+        (JSC::MarkStackThreadSharedData::MarkStackThreadSharedData):
+        (JSC::SlotVisitor::donateKnownParallel):
+        (JSC::SlotVisitor::drain):
+        (JSC::SlotVisitor::drainFromShared):
+        * heap/MarkStack.h:
+        (JSC::MarkStack::mergeOpaqueRootsIfProfitable):
+        (JSC::MarkStack::addOpaqueRoot):
+        * heap/SlotVisitor.h:
+        (JSC::SlotVisitor::donate):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitOptimizationCheck):
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::enableAssembler):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * runtime/Options.cpp:
+        (JSC):
+        (JSC::overrideOptionWithHeuristic):
+        (JSC::Options::initialize):
+        (JSC::Options::setOption):
+        (JSC::Options::dumpAllOptions):
+        (JSC::Options::dumpOption):
+        * runtime/Options.h:
+        (JSC):
+        (Options):
+        (EntryInfo):
+
+2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
 
         [Qt][Win] Fix broken QtWebKit5.lib linking
         https://bugs.webkit.org/show_bug.cgi?id=88321
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Kenneth Rohde Christiansen.
 
-        Also update the Wx build to use the new define.
+        The goal is to have different ports build systems define STATICALLY_LINKED_WITH_WTF
+        when building JavaScriptCore, if both are packaged in the same DLL, instead
+        of relying on the code to handle this.
+        The effects of BUILDING_* and STATICALLY_LINKED_WITH_* are currently the same
+        except for a check in Source/JavaScriptCore/config.h.
+
+        Keeping the old way for the WX port as requested by the port's contributors.
+        For non-Windows ports there is no difference between IMPORT and EXPORT, no
+        change is needed.
 
         * API/JSBase.h:
+          JS symbols shouldn't be included by WTF objects anymore. Remove the export when BUILDING_WTF.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+          Make sure that JavaScriptCore uses import symbols of WTF for the Win port.
         * runtime/JSExportMacros.h:
-        * wscript:
 
-2012-06-13  Patrick Gansterer  <paroga@webkit.org>
+2012-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG OSR exit value recoveries should be computed lazily
+        https://bugs.webkit.org/show_bug.cgi?id=82155
+
+        Reviewed by Gavin Barraclough.
+        
+        This change aims to reduce one aspect of DFG compile times: the fact
+        that we currently compute the value recoveries for each local and
+        argument on every speculation check. We compile many speculation checks,
+        so this can add up quick. The strategy that this change takes is to
+        have the DFG save just enough information about how the compiler is
+        choosing to represent state, that the DFG::OSRExitCompiler can reify
+        the value recoveries lazily.
+        
+        This appears to be an 0.3% SunSpider speed-up and is neutral elsewhere.
+        
+        I also took the opportunity to fix the sampling regions profiler (it
+        was missing an export macro) and to put in more sampling regions in
+        the DFG (which are disabled so long as ENABLE(SAMPLING_REGIONS) is
+        false).
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Target.pri:
+        * bytecode/CodeBlock.cpp:
+        (JSC):
+        (JSC::CodeBlock::shrinkDFGDataToFit):
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::minifiedDFG):
+        (JSC::CodeBlock::variableEventStream):
+        (DFGData):
+        * bytecode/Operands.h:
+        (JSC::Operands::hasOperand):
+        (Operands):
+        (JSC::Operands::size):
+        (JSC::Operands::at):
+        (JSC::Operands::operator[]):
+        (JSC::Operands::isArgument):
+        (JSC::Operands::isVariable):
+        (JSC::Operands::argumentForIndex):
+        (JSC::Operands::variableForIndex):
+        (JSC::Operands::operandForIndex):
+        (JSC):
+        (JSC::dumpOperands):
+        * bytecode/SamplingTool.h:
+        (SamplingRegion):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::parse):
+        * dfg/DFGCFAPhase.cpp:
+        (JSC::DFG::performCFA):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::performCSE):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::performFixup):
+        * dfg/DFGGenerationInfo.h:
+        (JSC::DFG::GenerationInfo::GenerationInfo):
+        (JSC::DFG::GenerationInfo::initConstant):
+        (JSC::DFG::GenerationInfo::initInteger):
+        (JSC::DFG::GenerationInfo::initJSValue):
+        (JSC::DFG::GenerationInfo::initCell):
+        (JSC::DFG::GenerationInfo::initBoolean):
+        (JSC::DFG::GenerationInfo::initDouble):
+        (JSC::DFG::GenerationInfo::initStorage):
+        (GenerationInfo):
+        (JSC::DFG::GenerationInfo::noticeOSRBirth):
+        (JSC::DFG::GenerationInfo::use):
+        (JSC::DFG::GenerationInfo::spill):
+        (JSC::DFG::GenerationInfo::setSpilled):
+        (JSC::DFG::GenerationInfo::fillJSValue):
+        (JSC::DFG::GenerationInfo::fillCell):
+        (JSC::DFG::GenerationInfo::fillInteger):
+        (JSC::DFG::GenerationInfo::fillBoolean):
+        (JSC::DFG::GenerationInfo::fillDouble):
+        (JSC::DFG::GenerationInfo::fillStorage):
+        (JSC::DFG::GenerationInfo::appendFill):
+        (JSC::DFG::GenerationInfo::appendSpill):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGMinifiedGraph.h: Added.
+        (DFG):
+        (MinifiedGraph):
+        (JSC::DFG::MinifiedGraph::MinifiedGraph):
+        (JSC::DFG::MinifiedGraph::at):
+        (JSC::DFG::MinifiedGraph::append):
+        (JSC::DFG::MinifiedGraph::prepareAndShrink):
+        (JSC::DFG::MinifiedGraph::setOriginalGraphSize):
+        (JSC::DFG::MinifiedGraph::originalGraphSize):
+        * dfg/DFGMinifiedNode.cpp: Added.
+        (DFG):
+        (JSC::DFG::MinifiedNode::fromNode):
+        * dfg/DFGMinifiedNode.h: Added.
+        (DFG):
+        (JSC::DFG::belongsInMinifiedGraph):
+        (MinifiedNode):
+        (JSC::DFG::MinifiedNode::MinifiedNode):
+        (JSC::DFG::MinifiedNode::index):
+        (JSC::DFG::MinifiedNode::op):
+        (JSC::DFG::MinifiedNode::hasChild1):
+        (JSC::DFG::MinifiedNode::child1):
+        (JSC::DFG::MinifiedNode::hasConstant):
+        (JSC::DFG::MinifiedNode::hasConstantNumber):
+        (JSC::DFG::MinifiedNode::constantNumber):
+        (JSC::DFG::MinifiedNode::hasWeakConstant):
+        (JSC::DFG::MinifiedNode::weakConstant):
+        (JSC::DFG::MinifiedNode::getIndex):
+        (JSC::DFG::MinifiedNode::compareByNodeIndex):
+        (JSC::DFG::MinifiedNode::hasChild):
+        * dfg/DFGNode.h:
+        (Node):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::OSRExit):
+        * dfg/DFGOSRExit.h:
+        (OSRExit):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * dfg/DFGOSRExitCompiler.h:
+        (OSRExitCompiler):
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGOSRExitCompiler64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::performPredictionPropagation):
+        * dfg/DFGRedundantPhiEliminationPhase.cpp:
+        (JSC::DFG::performRedundantPhiElimination):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::SpeculativeJIT):
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::fillStorage):
+        (JSC::DFG::SpeculativeJIT::noticeOSRBirth):
+        (JSC::DFG::SpeculativeJIT::compileMovHint):
+        (JSC::DFG::SpeculativeJIT::compile):
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+        * dfg/DFGSpeculativeJIT.h:
+        (DFG):
+        (JSC::DFG::SpeculativeJIT::use):
+        (SpeculativeJIT):
+        (JSC::DFG::SpeculativeJIT::spill):
+        (JSC::DFG::SpeculativeJIT::speculationCheck):
+        (JSC::DFG::SpeculativeJIT::forwardSpeculationCheck):
+        (JSC::DFG::SpeculativeJIT::recordSetLocal):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillInteger):
+        (JSC::DFG::SpeculativeJIT::fillDouble):
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGValueRecoveryOverride.h: Added.
+        (DFG):
+        (ValueRecoveryOverride):
+        (JSC::DFG::ValueRecoveryOverride::ValueRecoveryOverride):
+        * dfg/DFGValueSource.cpp: Added.
+        (DFG):
+        (JSC::DFG::ValueSource::dump):
+        * dfg/DFGValueSource.h: Added.
+        (DFG):
+        (JSC::DFG::dataFormatToValueSourceKind):
+        (JSC::DFG::valueSourceKindToDataFormat):
+        (JSC::DFG::isInRegisterFile):
+        (ValueSource):
+        (JSC::DFG::ValueSource::ValueSource):
+        (JSC::DFG::ValueSource::forPrediction):
+        (JSC::DFG::ValueSource::forDataFormat):
+        (JSC::DFG::ValueSource::isSet):
+        (JSC::DFG::ValueSource::kind):
+        (JSC::DFG::ValueSource::isInRegisterFile):
+        (JSC::DFG::ValueSource::dataFormat):
+        (JSC::DFG::ValueSource::valueRecovery):
+        (JSC::DFG::ValueSource::nodeIndex):
+        (JSC::DFG::ValueSource::nodeIndexFromKind):
+        (JSC::DFG::ValueSource::kindFromNodeIndex):
+        * dfg/DFGVariableEvent.cpp: Added.
+        (DFG):
+        (JSC::DFG::VariableEvent::dump):
+        (JSC::DFG::VariableEvent::dumpFillInfo):
+        (JSC::DFG::VariableEvent::dumpSpillInfo):
+        * dfg/DFGVariableEvent.h: Added.
+        (DFG):
+        (VariableEvent):
+        (JSC::DFG::VariableEvent::VariableEvent):
+        (JSC::DFG::VariableEvent::reset):
+        (JSC::DFG::VariableEvent::fillGPR):
+        (JSC::DFG::VariableEvent::fillPair):
+        (JSC::DFG::VariableEvent::fillFPR):
+        (JSC::DFG::VariableEvent::spill):
+        (JSC::DFG::VariableEvent::death):
+        (JSC::DFG::VariableEvent::setLocal):
+        (JSC::DFG::VariableEvent::movHint):
+        (JSC::DFG::VariableEvent::kind):
+        (JSC::DFG::VariableEvent::nodeIndex):
+        (JSC::DFG::VariableEvent::dataFormat):
+        (JSC::DFG::VariableEvent::gpr):
+        (JSC::DFG::VariableEvent::tagGPR):
+        (JSC::DFG::VariableEvent::payloadGPR):
+        (JSC::DFG::VariableEvent::fpr):
+        (JSC::DFG::VariableEvent::virtualRegister):
+        (JSC::DFG::VariableEvent::operand):
+        (JSC::DFG::VariableEvent::variableRepresentation):
+        * dfg/DFGVariableEventStream.cpp: Added.
+        (DFG):
+        (JSC::DFG::VariableEventStream::logEvent):
+        (MinifiedGenerationInfo):
+        (JSC::DFG::MinifiedGenerationInfo::MinifiedGenerationInfo):
+        (JSC::DFG::MinifiedGenerationInfo::update):
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * dfg/DFGVariableEventStream.h: Added.
+        (DFG):
+        (VariableEventStream):
+        (JSC::DFG::VariableEventStream::appendAndLog):
+        * dfg/DFGVirtualRegisterAllocationPhase.cpp:
+        (JSC::DFG::performVirtualRegisterAllocation):
+
+2012-07-02  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG::ArgumentsSimplificationPhase should assert that the PhantomArguments nodes it creates are not shouldGenerate()
+        https://bugs.webkit.org/show_bug.cgi?id=90407
 
-        [WIN] Remove dependency on pthread from MachineStackMarker
-        https://bugs.webkit.org/show_bug.cgi?id=68429
+        Reviewed by Mark Hahnenberg.
 
-        Reviewed by NOBODY (OOPS!).
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
 
-        Implement pthread TLS functionality with native windows functions.
+2012-07-02  Gavin Barraclough  <barraclough@apple.com>
 
-        * heap/MachineStackMarker.cpp: Use the new functions instead of pthread directly.
-        * heap/MachineStackMarker.h:
-        * wtf/ThreadSpecific.h:
-        (WTF::ThreadSpecificKeyCreate): Added wrapper around pthread_key_create.
-        (WTF::ThreadSpecificKeyDelete): Added wrapper around pthread_key_delete.
-        (WTF::ThreadSpecificSet): Added wrapper around pthread_setspecific.
-        (WTF::ThreadSpecificGet): Added wrapper around pthread_getspecific.
-        * wtf/ThreadSpecificWin.cpp:
+        Array.prototype.pop should throw if property is not configurable
+        https://bugs.webkit.org/show_bug.cgi?id=75788
+
+        Rubber Stamped by Oliver Hunt.
+
+        No real bug here any more, but the error we throw sometimes has a misleading message.
+ 
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::pop):
+
+2012-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject wastes too much memory on unused property slots
+        https://bugs.webkit.org/show_bug.cgi?id=90255
+
+        Reviewed by Mark Hahnenberg.
+        
+        Rolling back in after applying a simple fix: it appears that
+        JSObject::setStructureAndReallocateStorageIfNecessary() was allocating more
+        property storage than necessary. Fixing this appears to resolve the crash.
+        
+        This does a few things:
+        
+        - JSNonFinalObject no longer has inline property storage.
+        
+        - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
+          or 2x the inline storage for JSFinalObject.
+        
+        - Property storage is only reallocated if it needs to be. Previously, we
+          would reallocate the property storage on any transition where the original
+          structure said shouldGrowProperyStorage(), but this led to spurious
+          reallocations when doing transitionless property adds and there are
+          deleted property slots available. That in turn led to crashes, because we
+          would switch to out-of-line storage even if the capacity matched the
+          criteria for inline storage.
+        
+        - Inline JSFunction allocation is killed off because we don't have a good
+          way of inlining property storage allocation. This didn't hurt performance.
+          Killing off code is better than fixing it if that code wasn't doing any
+          good.
+        
+        This looks like a 1% progression on V8.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC):
+        (JSC::JIT::emit_op_new_func_exp):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSObject):
+        (JSC::JSObject::finishCreation):
+        (JSC):
+        (JSC::JSNonFinalObject::hasInlineStorage):
+        (JSNonFinalObject):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSC::JSFinalObject::hasInlineStorage):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::JSObject::setPropertyStorage):
+        (JSC::Structure::inlineStorageCapacity):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::nextPropertyStorageCapacity):
+        (JSC):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::suggestedNewPropertyStorageSize):
+        * runtime/Structure.h:
+        (JSC::Structure::putWillGrowPropertyStorage):
+        (Structure):
+
+2012-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        Webkit crashes in DFG on Google Docs when creating a new document
+        https://bugs.webkit.org/show_bug.cgi?id=90209
+
+        Reviewed by Gavin Barraclough.
+        
+        Don't attempt to short-circuit Phantom(GetLocal) if the GetLocal is for a
+        captured variable.
+
+        * dfg/DFGCFGSimplificationPhase.cpp:
+        (JSC::DFG::CFGSimplificationPhase::mergeBlocks):
+
+2012-06-30  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed, rolling out r121605.
+        http://trac.webkit.org/changeset/121605
+        https://bugs.webkit.org/show_bug.cgi?id=90336
+
+        Changes caused flaky crashes in sputnik/Unicode tests on Apple
+        WK1 and GTK Linux builders
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC::JIT::emitAllocateJSFinalObject):
+        (JSC):
+        (JSC::JIT::emitAllocateJSFunction):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC::JIT::emitSlow_op_new_func):
+        (JSC):
+        (JSC::JIT::emit_op_new_func_exp):
+        (JSC::JIT::emitSlow_op_new_func_exp):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSObject):
+        (JSC::JSObject::finishCreation):
+        (JSC):
+        (JSNonFinalObject):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSFinalObject):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::JSObject::setPropertyStorage):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::suggestedNewPropertyStorageSize):
+        * runtime/Structure.h:
+        (JSC::Structure::shouldGrowPropertyStorage):
+        (JSC::Structure::propertyStorageSize):
+
+2012-06-29  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Remove warning about protected values when the Heap is being destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=90302
+
+        Reviewed by Geoffrey Garen.
+
+        Having to do book-keeping about whether values allocated from a certain 
+        VM are or are not protected makes the JSC API much more difficult to use 
+        correctly. Clients should be able to throw an entire VM away and not have 
+        to worry about unprotecting all of the values that they protected earlier.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::lastChanceToFinalize):
+
+2012-06-29  Filip Pizlo  <fpizlo@apple.com>
+
+        JSObject wastes too much memory on unused property slots
+        https://bugs.webkit.org/show_bug.cgi?id=90255
+
+        Reviewed by Mark Hahnenberg.
+        
+        This does a few things:
+        
+        - JSNonFinalObject no longer has inline property storage.
+        
+        - Initial out-of-line property storage size is 4 slots for JSNonFinalObject,
+          or 2x the inline storage for JSFinalObject.
+        
+        - Property storage is only reallocated if it needs to be. Previously, we
+          would reallocate the property storage on any transition where the original
+          structure said shouldGrowProperyStorage(), but this led to spurious
+          reallocations when doing transitionless property adds and there are
+          deleted property slots available. That in turn led to crashes, because we
+          would switch to out-of-line storage even if the capacity matched the
+          criteria for inline storage.
+        
+        - Inline JSFunction allocation is killed off because we don't have a good
+          way of inlining property storage allocation. This didn't hurt performance.
+          Killing off code is better than fixing it if that code wasn't doing any
+          good.
+        
+        This looks like a 1% progression on V8.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitAllocateBasicJSObject):
+        (JSC):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_new_func):
+        (JSC):
+        (JSC::JIT::emit_op_new_func_exp):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::finishCreation):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSObject):
+        (JSC::JSObject::finishCreation):
+        (JSC):
+        (JSC::JSNonFinalObject::hasInlineStorage):
+        (JSNonFinalObject):
+        (JSC::JSNonFinalObject::JSNonFinalObject):
+        (JSC::JSNonFinalObject::finishCreation):
+        (JSC::JSFinalObject::hasInlineStorage):
+        (JSC::JSFinalObject::finishCreation):
+        (JSC::JSObject::offsetOfInlineStorage):
+        (JSC::JSObject::setPropertyStorage):
+        (JSC::Structure::inlineStorageCapacity):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::setStructureAndReallocateStorageIfNecessary):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::nextPropertyStorageCapacity):
+        (JSC):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::suggestedNewPropertyStorageSize):
+        * runtime/Structure.h:
+        (JSC::Structure::putWillGrowPropertyStorage):
+        (Structure):
+
+2012-06-28  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG recompilation heuristics should be based on count, not rate
+        https://bugs.webkit.org/show_bug.cgi?id=90146
+
+        Reviewed by Oliver Hunt.
+        
+        This removes a bunch of code that was previously trying to prevent spurious
+        reoptimizations if a large enough majority of executions of a code block did
+        not result in OSR exit. It turns out that this code was purely harmful. This
+        patch removes all of that logic and replaces it with a dead-simple
+        heuristic: if you exit more than N times (where N is an exponential function
+        of the number of times the code block has already been recompiled) then we
+        will recompile.
+        
+        This appears to be a broad ~1% win on many benchmarks large and small.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::osrExitCounter):
+        (JSC::CodeBlock::countOSRExit):
+        (CodeBlock):
+        (JSC::CodeBlock::addressOfOSRExitCounter):
+        (JSC::CodeBlock::offsetOfOSRExitCounter):
+        (JSC::CodeBlock::adjustedExitCountThreshold):
+        (JSC::CodeBlock::exitCountThresholdForReoptimization):
+        (JSC::CodeBlock::exitCountThresholdForReoptimizationFromLoop):
+        (JSC::CodeBlock::shouldReoptimizeNow):
+        (JSC::CodeBlock::shouldReoptimizeFromLoopNow):
+        * bytecode/ExecutionCounter.cpp:
+        (JSC::ExecutionCounter::setThreshold):
+        * bytecode/ExecutionCounter.h:
+        (ExecutionCounter):
+        (JSC::ExecutionCounter::clippedThreshold):
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compileBody):
+        * dfg/DFGOSRExit.cpp:
+        (JSC::DFG::OSRExit::considerAddingAsFrequentExitSiteSlow):
+        * dfg/DFGOSRExitCompiler.cpp:
+        (JSC::DFG::OSRExitCompiler::handleExitCounts):
+        * dfg/DFGOperations.cpp:
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Options.cpp:
+        (Options):
+        (JSC::Options::initializeOptions):
+        * runtime/Options.h:
+        (Options):
+
+2012-06-28  Mark Lam  <mark.lam@apple.com>
+
+        Adding a commenting utility to record BytecodeGenerator comments
+        with opcodes that are emitted.  Presently, the comments can only
+        be constant strings.  Adding comments for opcodes is optional.
+        If a comment is added, the comment will be printed following the
+        opcode when CodeBlock::dump() is called.
+
+        This utility is disabled by default, and is only meant for VM
+        development purposes.  It should not be enabled for product builds.
+
+        To enable this utility, set ENABLE_BYTECODE_COMMENTS in CodeBlock.h
+        to 1.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90095
+
+        Reviewed by Geoffrey Garen.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecodeCommentAndNewLine): Dumps the comment.
+        (JSC):
+        (JSC::CodeBlock::printUnaryOp): Add comment dumps.
+        (JSC::CodeBlock::printBinaryOp): Add comment dumps.
+        (JSC::CodeBlock::printConditionalJump): Add comment dumps.
+        (JSC::CodeBlock::printCallOp): Add comment dumps.
+        (JSC::CodeBlock::printPutByIdOp): Add comment dumps.
+        (JSC::CodeBlock::dump): Add comment dumps.
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::commentForBytecodeOffset):
+            Finds the comment for an opcode if available.
+        (JSC::CodeBlock::dumpBytecodeComments):
+            For debugging whether comments are collected.
+            It is not being called anywhere.
+        * bytecode/CodeBlock.h:
+        (CodeBlock):
+        (JSC::CodeBlock::bytecodeComments):
+        * bytecode/Comment.h: Added.
+        (JSC):
+        (Comment):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitOpcode): Calls emitComment().
+        (JSC):
+        (JSC::BytecodeGenerator::emitComment): Adds comment to CodeBlock.
+        (JSC::BytecodeGenerator::prependComment):
+            Registers a comment for emitComemnt() to use later.
+        * bytecompiler/BytecodeGenerator.h:
+        (BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitComment):
+        (JSC::BytecodeGenerator::prependComment):
+            These are inlined versions of these functions that nullify them
+            when ENABLE_BYTECODE_COMMENTS is 0.
+        (JSC::BytecodeGenerator::comments):
+
+2012-06-28  Oliver Hunt  <oliver@apple.com>
+
+        32bit DFG incorrectly claims an fpr is fillable even if it has not been proven double
+        https://bugs.webkit.org/show_bug.cgi?id=90127
+
+        Reviewed by Filip Pizlo.
+
+        The 32-bit version of fillSpeculateDouble doesn't handle Number->fpr loads
+        correctly.  This patch fixes this by killing the fill info in the GenerationInfo
+        when the spillFormat doesn't guarantee the value is a double.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+
+2012-06-28  Kent Tamura  <tkent@chromium.org>
+
+        Classify form control states by their owner forms
+        https://bugs.webkit.org/show_bug.cgi?id=89950
+
+        Reviewed by Hajime Morita.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        Expose WTF::StringBuilder::canShrink()
+
+2012-06-27  Michael Saboff  <msaboff@apple.com>
+
+        [Win] jscore-tests flakey
+        https://bugs.webkit.org/show_bug.cgi?id=88118
+
+        Reviewed by Jessie Berlin.
+
+        jsDriver.pl on windows intermittently doesn't get the returned value from jsc,
+        instead it gets 126.  Added a new option to jsc (-x) which prints the exit
+        code before exiting.  jsDriver.pl uses this option on Windows and parses the
+        exit code output for the exit code, removing it before comparing the actual
+        and expected outputs.  Filed a follow on "FIXME" defect:
+        [WIN] Intermittent failure for jsc return value to propagate through jsDriver.pl
+        https://bugs.webkit.org/show_bug.cgi?id=90119
+
+        * jsc.cpp:
+        (CommandLine::CommandLine):
+        (CommandLine):
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+        * tests/mozilla/jsDriver.pl:
+        (execute_tests):
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121359.
+        http://trac.webkit.org/changeset/121359
+        https://bugs.webkit.org/show_bug.cgi?id=90115
+
+        Broke many inspector tests (Requested by jpfau on #webkit).
+
+        * interpreter/Interpreter.h:
+        (JSC::StackFrame::toString):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Javascript SHA-512 gives wrong hash on second and subsequent runs unless Web Inspector Javascript Debugging is on
+        https://bugs.webkit.org/show_bug.cgi?id=90053
+        <rdar://problem/11764613>
+
+        Reviewed by Mark Hahnenberg.
+        
+        The problem is that the code was assuming that the recovery should be Undefined if the source of
+        the SetLocal was !shouldGenerate(). But that's wrong, since the DFG optimizer may skip around a
+        UInt32ToNumber node (hence making it !shouldGenerate()) and keep the source of that node alive.
+        In that case we should base the recovery on the source of the UInt32ToNumber. The logic for this
+        was already in place but the fast check for !shouldGenerate() broke it.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::computeValueRecoveryFor):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG disassembly should be easier to read
+        https://bugs.webkit.org/show_bug.cgi?id=90106
+
+        Reviewed by Mark Hahnenberg.
+        
+        Did a few things:
+        
+        - Options::showDFGDisassembly now shows OSR exit disassembly as well.
+        
+        - Phi node dumping doesn't attempt to do line wrapping since it just made the dump harder
+          to read.
+        
+        - DFG graph disassembly view shows a few additional node types that turn out to be
+          essential for understanding OSR exits.
+        
+        Put together, these changes reinforce the philosophy that anything needed for computing
+        OSR exit is just as important as the machine code itself. Of course, we still don't take
+        that philosophy to its full extreme - for example Phantom nodes are not dumped. We may
+        revisit that in the future.
+
+        * assembler/LinkBuffer.cpp:
+        (JSC::LinkBuffer::finalizeCodeWithDisassembly):
+        * assembler/LinkBuffer.h:
+        (JSC):
+        * dfg/DFGDisassembler.cpp:
+        (JSC::DFG::Disassembler::dump):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::dumpBlockHeader):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGOSRExitCompiler.cpp:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        * API/APIShims.h:
+        (APIEntryShimWithoutLock):
+        (JSC::APIEntryShimWithoutLock::APIEntryShimWithoutLock): Added an extra parameter to the constructor to 
+        determine whether we should ref the JSGlobalData or not. We want to ref all the time except for in the 
+        HeapTimer class because timerDidFire could run after somebody has started to tear down that particular 
+        JSGlobalData, so we wouldn't want to resurrect the ref count of that JSGlobalData from 0 back to 1 after 
+        its destruction has begun. 
+        (JSC::APIEntryShimWithoutLock::~APIEntryShimWithoutLock):
+        (JSC::APIEntryShim::APIEntryShim):
+        (APIEntryShim):
+        (JSC::APIEntryShim::~APIEntryShim):
+        (JSC::APIEntryShim::init): Factored out common initialization code for the various APIEntryShim constructors.
+        Also moved the timeoutChecker stop and start here because we need to start after we've grabbed the API lock
+        and before we've released it, which can only done in APIEntryShim.
+        (JSC::APICallbackShim::~APICallbackShim): We no longer need to synchronize here.
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate):
+        (JSGlobalContextCreateInGroup):
+        (JSGlobalContextRelease):
+        (JSContextCreateBacktrace):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::tryAllocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::collect):
+        (JSC::Heap::setActivityCallback):
+        (JSC::Heap::activityCallback):
+        (JSC::Heap::sweeper):
+        * heap/Heap.h: Changed m_activityCallback and m_sweeper to be raw pointers rather than OwnPtrs because they 
+        are now responsible for their own lifetime. Also changed the order of declaration of the GCActivityCallback
+        and the IncrementalSweeper to make sure they're the last things that get initialized during construction to 
+        prevent any issues with uninitialized memory in the JSGlobalData/Heap they might care about.
+        (Heap):
+        * heap/HeapTimer.cpp: Refactored to allow for thread-safe operation and shutdown.
+        (JSC::HeapTimer::~HeapTimer):
+        (JSC::HeapTimer::invalidate):
+        (JSC):
+        (JSC::HeapTimer::didStartVMShutdown): Called at the beginning of ~JSGlobalData. If we're on the same thread 
+        that the HeapTimer is running on, we kill the HeapTimer ourselves. If not, then we set some state in the 
+        HeapTimer and schedule it to fire immediately so that it can notice and kill itself.
+        (JSC::HeapTimer::timerDidFire): We grab our mutex and check our JSGlobalData pointer. If it has been zero-ed
+        out, then we know the VM has started to shutdown and we should kill ourselves. Otherwise, grab the APIEntryShim,
+        but without ref-ing the JSGlobalData (we don't want to bring the JSGlobalData's ref-count from 0 to 1) in case 
+        we were interrupted between releasing our mutex and trying to grab the APILock.
+        * heap/HeapTimer.h:
+        (HeapTimer):
+        * heap/IncrementalSweeper.cpp:
+        (JSC::IncrementalSweeper::doWork): We no longer need the API shim here since HeapTimer::timerDidFire handles 
+        all of that for us. 
+        (JSC::IncrementalSweeper::create):
+        * heap/IncrementalSweeper.h:
+        (IncrementalSweeper):
+        * heap/MarkedAllocator.cpp:
+        (JSC::MarkedAllocator::allocateSlowCase):
+        * heap/WeakBlock.cpp:
+        (JSC::WeakBlock::reap):
+        * jsc.cpp:
+        (functionGC):
+        (functionReleaseExecutableMemory):
+        (jscmain):
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        (JSC::evaluate):
+        * runtime/GCActivityCallback.h:
+        (DefaultGCActivityCallback):
+        (JSC::DefaultGCActivityCallback::create):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData): Signals to the two HeapTimers (GCActivityCallback and IncrementalSweeper)
+        that the VM has started shutting down. It then waits until the HeapTimer is done with whatever activity 
+        it needs to do before continuing with any further destruction. Also asserts that we do not currently hold the 
+        APILock because this could potentially cause deadlock when we try to signal to the HeapTimers using their mutexes.
+        (JSC::JSGlobalData::sharedInstance): Protect the initialization for the shared instance with the GlobalJSLock.
+        (JSC::JSGlobalData::sharedInstanceInternal):
+        * runtime/JSGlobalData.h: Change to be ThreadSafeRefCounted so that we don't have to worry about refing and 
+        de-refing JSGlobalDatas on separate threads since we don't do it that often anyways.
+        (JSGlobalData):
+        (JSC::JSGlobalData::apiLock):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::init):
+        * runtime/JSLock.cpp:
+        (JSC):
+        (JSC::GlobalJSLock::GlobalJSLock): For accessing the shared instance.
+        (JSC::GlobalJSLock::~GlobalJSLock):
+        (JSC::JSLockHolder::JSLockHolder): MutexLocker for JSLock. Also refs the JSGlobalData to keep it alive so that 
+        it can successfully unlock it later without it disappearing from underneath it.
+        (JSC::JSLockHolder::~JSLockHolder):
+        (JSC::JSLock::JSLock):
+        (JSC::JSLock::~JSLock):
+        (JSC::JSLock::lock): Uses the spin lock for guarding the lock count and owner thread fields. Uses the mutex for 
+        actually waiting for long periods. 
+        (JSC::JSLock::unlock):
+        (JSC::JSLock::currentThreadIsHoldingLock):
+        (JSC::JSLock::dropAllLocks):
+        (JSC::JSLock::dropAllLocksUnconditionally):
+        (JSC::JSLock::grabAllLocks):
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+        * runtime/JSLock.h:
+        (JSC):
+        (GlobalJSLock):
+        (JSLockHolder):
+        (JSLock):
+        (DropAllLocks):
+        * runtime/WeakGCMap.h:
+        (JSC::WeakGCMap::set):
+        * testRegExp.cpp:
+        (realMain):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        x86 disassembler confuses immediates with addresses
+        https://bugs.webkit.org/show_bug.cgi?id=90099
+
+        Reviewed by Mark Hahnenberg.
+        
+        Prepend "$" to immediates to disambiguate between immediates and addresses. This is in
+        accordance with the gas and AT&T syntax.
+
+        * disassembler/udis86/udis86_syn-att.c:
+        (gen_operand):
+
+2012-06-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Add a comment clarifying Options::showDisassembly versus Options::showDFGDisassembly.
+
+        Rubber stamped by Mark Hahnenberg.
+
+        * runtime/Options.cpp:
+        (JSC::Options::initializeOptions):
+
+2012-06-27  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Added member functions to expose function name, urlString, and line #.
+        Refactored toString to make use of these member functions to reduce
+        duplicated code for future maintenance.
+
+        Manually tested refactoring of toString by tracing thrown exceptions.
+
+        * interpreter/Interpreter.h:
+        (StackFrame):
+        (JSC::StackFrame::toString):
+        (JSC::StackFrame::friendlySourceURL):
+        (JSC::StackFrame::friendlyFunctionName):
+        (JSC::StackFrame::friendlyLineNumber):
+
+2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove redundant c++11 warning suppression code
+
+        This is already handled in default_post.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri:
+
+2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Add missing heades to HEADERS
+
+        For JavaScriptCore there aren't any Qt specific files, so we include all
+        headers for easy editing in Qt Creator.
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+
+2012-06-26  Dominic Cooney  <dominicc@chromium.org>
+
+        [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
+        https://bugs.webkit.org/show_bug.cgi?id=90029
+
+        Reviewed by Adam Barth.
+
+        * gyp: Removed.
+        * gyp/generate-derived-sources.sh: Removed.
+        * gyp/generate-dtrace-header.sh: Removed.
+        * gyp/run-if-exists.sh: Removed.
+        * gyp/update-info-plist.sh: Removed.
 
 2012-06-26  Geoffrey Garen  <ggaren@apple.com>
 
diff --git a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index ae2c393b1..5fa30a6e9 100644
--- a/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -51,11 +51,11 @@ ENABLE_DATALIST = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
 ENABLE_DETAILS = ENABLE_DETAILS;
 ENABLE_DEVICE_ORIENTATION = ;
+ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_FILE_SYSTEM = ;
 ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
 ENABLE_FILTERS_macosx = ENABLE_FILTERS;
-ENABLE_FONT_BOOSTING = ;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
@@ -119,6 +119,7 @@ ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
+ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_UNDO_MANAGER = ;
@@ -132,4 +133,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FONT_BOOSTING) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
index 84d6e60ff..7e6056e97 100644
--- a/Source/JavaScriptCore/GNUmakefile.list.am
+++ b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -92,6 +92,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/bytecode/CodeBlock.cpp \
 	Source/JavaScriptCore/bytecode/CodeBlock.h \
 	Source/JavaScriptCore/bytecode/CodeOrigin.h \
+	Source/JavaScriptCore/bytecode/Comment.h \
 	Source/JavaScriptCore/bytecode/DataFormat.h \
 	Source/JavaScriptCore/bytecode/DFGExitProfile.cpp \
 	Source/JavaScriptCore/bytecode/DFGExitProfile.h \
@@ -187,6 +188,9 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGInsertionSet.h \
 	Source/JavaScriptCore/dfg/DFGJITCompiler.cpp \
 	Source/JavaScriptCore/dfg/DFGJITCompiler.h \
+	Source/JavaScriptCore/dfg/DFGMinifiedGraph.h \
+	Source/JavaScriptCore/dfg/DFGMinifiedNode.cpp \
+	Source/JavaScriptCore/dfg/DFGMinifiedNode.h \
 	Source/JavaScriptCore/dfg/DFGNode.h \
 	Source/JavaScriptCore/dfg/DFGNodeFlags.cpp \
 	Source/JavaScriptCore/dfg/DFGNodeFlags.h \
@@ -221,6 +225,13 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h \
 	Source/JavaScriptCore/dfg/DFGThunks.cpp \
 	Source/JavaScriptCore/dfg/DFGThunks.h \
+	Source/JavaScriptCore/dfg/DFGValueRecoveryOverride.h \
+	Source/JavaScriptCore/dfg/DFGValueSource.cpp \
+	Source/JavaScriptCore/dfg/DFGValueSource.h \
+	Source/JavaScriptCore/dfg/DFGVariableEvent.cpp \
+	Source/JavaScriptCore/dfg/DFGVariableEvent.h \
+	Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp \
+	Source/JavaScriptCore/dfg/DFGVariableEventStream.h \
 	Source/JavaScriptCore/dfg/DFGValidate.cpp \
 	Source/JavaScriptCore/dfg/DFGValidate.h \
 	Source/JavaScriptCore/dfg/DFGVariableAccessData.h \
@@ -254,6 +265,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/heap/BlockAllocator.h \
 	Source/JavaScriptCore/heap/Heap.cpp \
 	Source/JavaScriptCore/heap/Heap.h \
+	Source/JavaScriptCore/heap/JITStubRoutineSet.cpp \
+	Source/JavaScriptCore/heap/JITStubRoutineSet.h \
 	Source/JavaScriptCore/heap/ListableHandler.h \
 	Source/JavaScriptCore/heap/Local.h \
 	Source/JavaScriptCore/heap/LocalScope.h \
@@ -343,6 +356,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/jit/CompactJITCodeMap.h \
 	Source/JavaScriptCore/jit/ExecutableAllocator.cpp \
 	Source/JavaScriptCore/jit/ExecutableAllocator.h \
+	Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp \
+	Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h \
 	Source/JavaScriptCore/jit/HostCallReturnValue.cpp \
 	Source/JavaScriptCore/jit/HostCallReturnValue.h \
 	Source/JavaScriptCore/jit/JITArithmetic32_64.cpp \
@@ -362,6 +377,8 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp \
 	Source/JavaScriptCore/jit/JITPropertyAccess.cpp \
 	Source/JavaScriptCore/jit/JITStubCall.h \
+	Source/JavaScriptCore/jit/JITStubRoutine.cpp \
+	Source/JavaScriptCore/jit/JITStubRoutine.h \
 	Source/JavaScriptCore/jit/JITStubs.cpp \
 	Source/JavaScriptCore/jit/JITStubs.h \
 	Source/JavaScriptCore/jit/JITWriteBarrier.h \
@@ -571,6 +588,7 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/PropertyName.h \
 	Source/JavaScriptCore/runtime/PropertyNameArray.cpp \
 	Source/JavaScriptCore/runtime/PropertyNameArray.h \
+	Source/JavaScriptCore/runtime/PropertyOffset.h \
 	Source/JavaScriptCore/runtime/PropertySlot.cpp \
 	Source/JavaScriptCore/runtime/PropertySlot.h \
 	Source/JavaScriptCore/runtime/Protect.h \
diff --git a/Source/JavaScriptCore/JavaScriptCore.gyp/.gitignore b/Source/JavaScriptCore/JavaScriptCore.gyp/.gitignore
index 9b06f58bf..f6c1348f3 100644
--- a/Source/JavaScriptCore/JavaScriptCore.gyp/.gitignore
+++ b/Source/JavaScriptCore/JavaScriptCore.gyp/.gitignore
@@ -2,4 +2,5 @@
 *.mk
 *.sln
 *.vcproj*
+*.vcxproj*
 JavaScriptCore.xcodeproj
diff --git a/Source/JavaScriptCore/JavaScriptCore.pri b/Source/JavaScriptCore/JavaScriptCore.pri
index f6580c51f..380bbaf1b 100644
--- a/Source/JavaScriptCore/JavaScriptCore.pri
+++ b/Source/JavaScriptCore/JavaScriptCore.pri
@@ -34,6 +34,12 @@ INCLUDEPATH += \
 
 win32-* {
     LIBS += -lwinmm
+
+    win32-g++* {
+        LIBS += -lpthreadGC2
+    } else:win32-msvc* {
+        LIBS += -lpthreadVC2
+    }
 }
 
 wince* {
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index 6a8a89372..c50013ac1 100755
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -6,11 +6,14 @@ EXPORTS
     ??0Collator@WTF@@QAE@PBD@Z
     ??0DateInstance@JSC@@IAE@PAVExecState@1@PAVStructure@1@@Z
     ??0DefaultGCActivityCallback@JSC@@QAE@PAVHeap@1@@Z
-    ??0DropAllLocks@JSLock@JSC@@QAE@W4JSLockBehavior@2@@Z
+    ??0DropAllLocks@JSLock@JSC@@QAE@PAVExecState@2@@Z
+    ??0DropAllLocks@JSLock@JSC@@QAE@PAVJSGlobalData@2@@Z
     ??0DynamicGlobalObjectScope@JSC@@QAE@AAVJSGlobalData@1@PAVJSGlobalObject@1@@Z 
     ??0InternalFunction@JSC@@IAE@PAVJSGlobalObject@1@PAVStructure@1@@Z
     ??0JSGlobalObject@JSC@@IAE@AAVJSGlobalData@1@PAVStructure@1@PBUGlobalObjectMethodTable@1@@Z
-    ??0JSLock@JSC@@QAE@PAVExecState@1@@Z
+    ??0JSLockHolder@JSC@@QAE@AAVJSGlobalData@1@@Z
+    ??0JSLockHolder@JSC@@QAE@PAVExecState@1@@Z
+    ??0JSLockHolder@JSC@@QAE@PAVJSGlobalData@1@@Z
     ??0MD5@WTF@@QAE@XZ
     ??0Mutex@WTF@@QAE@XZ
     ??0ParallelEnvironment@WTF@@QAE@P6AXPAX@ZIH@Z
@@ -33,6 +36,7 @@ EXPORTS
     ??1DropAllLocks@JSLock@JSC@@QAE@XZ
     ??1JSGlobalData@JSC@@QAE@XZ
     ??1JSGlobalObject@JSC@@QAE@XZ
+    ??1JSLockHolder@JSC@@QAE@XZ
     ??1Mutex@WTF@@QAE@XZ
     ??1RefCountedLeakCounter@WTF@@QAE@XZ
     ??1SourceProviderCache@JSC@@QAE@XZ
@@ -57,9 +61,9 @@ EXPORTS
     ?addBytes@SHA1@WTF@@QAEXPBEI@Z
     ?addCurrentThread@MachineThreads@JSC@@QAEXXZ
     ?addFinalizer@Heap@JSC@@QAEXPAVJSCell@2@P6AX0@Z@Z
-    ?addPropertyTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@VPropertyName@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SAPAV12@PAV12@VPropertyName@2@IPAVJSCell@2@AAI@Z
-    ?addPropertyWithoutTransition@Structure@JSC@@QAEIAAVJSGlobalData@2@VPropertyName@2@IPAVJSCell@2@@Z
+    ?addPropertyTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@VPropertyName@2@IPAVJSCell@2@AAH@Z
+    ?addPropertyTransitionToExistingStructure@Structure@JSC@@SAPAV12@PAV12@VPropertyName@2@IPAVJSCell@2@AAH@Z
+    ?addPropertyWithoutTransition@Structure@JSC@@QAEHAAVJSGlobalData@2@VPropertyName@2@IPAVJSCell@2@@Z
     ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVExecState@2@PAVStringImpl@4@@Z
     ?addSlowCase@Identifier@JSC@@CA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVJSGlobalData@2@PAVStringImpl@4@@Z
     ?addStaticGlobals@JSGlobalObject@JSC@@IAEXPAUGlobalPropertyInfo@12@H@Z
@@ -81,6 +85,7 @@ EXPORTS
     ?callHostFunctionAsConstructor@JSC@@YI_JPAVExecState@1@@Z
     ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
     ?callOnMainThreadAndWait@WTF@@YAXP6AXPAX@Z0@Z
+    ?canShrink@StringBuilder@WTF@@QBE_NXZ
     ?cancelCallOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
     ?capacity@Heap@JSC@@QAEIXZ
     ?changePrototypeTransition@Structure@JSC@@SAPAV12@AAVJSGlobalData@2@PAV12@VJSValue@2@@Z
@@ -124,7 +129,6 @@ EXPORTS
     ?cryptographicallyRandomNumber@WTF@@YAIXZ
     ?cryptographicallyRandomValues@WTF@@YAXPAXI@Z
     ?currentThread@WTF@@YAIXZ
-    ?currentThreadIsHoldingLock@JSLock@JSC@@SA_NXZ
     ?currentTime@WTF@@YANXZ
     ?data@CString@WTF@@QBEPBDXZ
     ?dataLog@WTF@@YAXPBDZZ
@@ -155,6 +159,7 @@ EXPORTS
     ?deleteAllCompiledCode@Heap@JSC@@QAEXXZ
     ?displayName@JSFunction@JSC@@QAE?BVUString@2@PAVExecState@2@@Z
     ?dtoa@WTF@@YAXQADNAA_NAAHAAI@Z
+    ?dumpAllOptions@Options@JSC@@SAXPAU_iobuf@@@Z
     ?dumpSampleData@JSGlobalData@JSC@@QAEXPAVExecState@2@@Z
     ?empty@StringImpl@WTF@@SAPAV12@XZ
     ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ
@@ -187,7 +192,6 @@ EXPORTS
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@I@Z
     ?functionGetter@PropertySlot@JSC@@ABE?AVJSValue@2@PAVExecState@2@@Z
     ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
-    ?get@Structure@JSC@@QAEIAAVJSGlobalData@2@VPropertyName@2@AAIAAPAVJSCell@2@@Z
     ?getCalculatedDisplayName@JSC@@YA?AVUString@1@PAVExecState@1@PAVJSObject@1@@Z
     ?getCallData@JSCell@JSC@@SA?AW4CallType@2@PAV12@AATCallData@2@@Z
     ?getCallableObjectSlow@JSC@@YAPAVJSCell@1@PAV21@@Z
@@ -206,11 +210,12 @@ EXPORTS
     ?getStackTrace@Interpreter@JSC@@SAXPAVJSGlobalData@2@AAV?$Vector@UStackFrame@JSC@@$0A@@WTF@@@Z
     ?getString@JSCell@JSC@@QBE?AVUString@2@PAVExecState@2@@Z
     ?getString@JSCell@JSC@@QBE_NPAVExecState@2@AAVUString@2@@Z
+    ?get@Structure@JSC@@QAEHAAVJSGlobalData@2@VPropertyName@2@AAIAAPAVJSCell@2@@Z
     ?getter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
     ?globalExec@JSGlobalObject@JSC@@QAEPAVExecState@2@XZ
     ?globalObjectCount@Heap@JSC@@QAEIXZ
+    ?growOutOfLineStorage@JSObject@JSC@@QAEPAV?$WriteBarrierBase@W4Unknown@JSC@@@2@AAVJSGlobalData@2@II@Z
     ?grow@HandleSet@JSC@@AAEXXZ
-    ?growPropertyStorage@JSObject@JSC@@QAEPAV?$WriteBarrierBase@W4Unknown@JSC@@@2@AAVJSGlobalData@2@II@Z
     ?hasInstance@JSObject@JSC@@SA_NPAV12@PAVExecState@2@VJSValue@2@2@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@I@Z
     ?hasProperty@JSObject@JSC@@QBE_NPAVExecState@2@VPropertyName@2@@Z
@@ -236,10 +241,9 @@ EXPORTS
     ?jsOwnedString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?jsString@JSC@@YAPAVJSString@1@PAVJSGlobalData@1@ABVUString@1@@Z
     ?length@CString@WTF@@QBEIXZ
-    ?lock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
+    ?lock@JSLock@JSC@@QAEXXZ
     ?lock@Mutex@WTF@@QAEXXZ
     ?lockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
-    ?lockCount@JSLock@JSC@@SAHXZ
     ?match@RegExp@JSC@@QAEHAAVJSGlobalData@2@ABVUString@2@IAAV?$Vector@H$0CA@@WTF@@@Z
     ?materializePropertyMap@Structure@JSC@@AAEXAAVJSGlobalData@2@@Z
     ?monotonicallyIncreasingTime@WTF@@YANXZ
@@ -302,6 +306,7 @@ EXPORTS
     ?setGetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
     ?setLoc@StatementNode@JSC@@QAEXHH@Z
     ?setMainThreadCallbacksPaused@WTF@@YAX_N@Z
+    ?setOption@Options@JSC@@SA_NPBD@Z
     ?setOrderLowerFirst@Collator@WTF@@QAEX_N@Z
     ?setPrototype@JSObject@JSC@@QAEXAAVJSGlobalData@2@VJSValue@2@@Z
     ?setSetter@PropertyDescriptor@JSC@@QAEXVJSValue@2@@Z
@@ -323,7 +328,8 @@ EXPORTS
     ?stopProfiling@Profiler@JSC@@QAE?AV?$PassRefPtr@VProfile@JSC@@@WTF@@PAVExecState@2@ABVUString@2@@Z
     ?stopSampling@JSGlobalData@JSC@@QAEXXZ
     ?substringSharingImpl@UString@JSC@@QBE?AV12@II@Z
-    ?suggestedNewPropertyStorageSize@Structure@JSC@@QAEIXZ
+    ?suggestedNewOutOfLineStorageCapacity@Structure@JSC@@QAEIXZ
+    ?sweeper@Heap@JSC@@QAEPAVIncrementalSweeper@2@XZ
     ?synthesizePrototype@JSValue@JSC@@QBEPAVJSObject@2@PAVExecState@2@@Z
     ?thisObject@DebuggerCallFrame@JSC@@QBEPAVJSObject@2@XZ
     ?throwError@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@@Z
@@ -353,7 +359,7 @@ EXPORTS
     ?tryFinishCreationUninitialized@JSArray@JSC@@IAEPAV12@AAVJSGlobalData@2@I@Z
     ?tryLock@Mutex@WTF@@QAE_NXZ
     ?type@DebuggerCallFrame@JSC@@QBE?AW4Type@12@XZ
-    ?unlock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
+    ?unlock@JSLock@JSC@@QAEXXZ
     ?unlock@Mutex@WTF@@QAEXXZ
     ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
     ?unprotect@Heap@JSC@@QAE_NVJSValue@2@@Z
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 78ca7dd6e..92749eb75 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -1094,6 +1094,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\runtime\PropertyOffset.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\runtime\PropertySlot.cpp"
 				>
 			</File>
@@ -1562,6 +1566,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\bytecode\Comment.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\bytecode\EvalCodeCache.h"
 				>
 			</File>
@@ -1850,6 +1858,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\jit\GCAwareJITStubRoutine.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\jit\GCAwareJITStubRoutine.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\jit\JIT.cpp"
 				>
 			</File>
@@ -1910,6 +1926,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\jit\JITStubRoutine.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\jit\JITStubRoutine.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\jit\JITStubs.cpp"
 				>
 			</File>
@@ -2206,6 +2230,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\..\heap\JITStubRoutineSet.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\..\heap\JITStubRoutineSet.h"
+				>
+			</File>
+			<File
 				RelativePath="..\..\heap\IncrementalSweeper.h"
 				>
 			</File>
diff --git a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index df0724e7c..7d2461d11 100644
--- a/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	<Tool
 		Name="VCCLCompilerTool"
 		AdditionalIncludeDirectories="&quot;$(ConfigurationBuildDir)\obj\JavaScriptCore\DerivedSources\&quot;;../../;../../API/;../../parser/;../../bytecompiler/;../../dfg/;../../disassembler;../../jit/;../../llint/;../../runtime/;../../tools/;../../bytecode/;../../interpreter/;../../wtf/;../../profiler;../../assembler/;../../debugger/;../../heap/;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;"
-		PreprocessorDefinitions="__STD_C"
+		PreprocessorDefinitions="STATICALLY_LINKED_WITH_WTF;__STD_C"
 		ForcedIncludeFiles="ICUVersion.h"
 	/>
 	<Tool
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index a64a1065f..188c1ffe7 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -92,6 +92,16 @@
 		0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC2B151FDE8B00CD8910 /* Operands.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC451522801B00CD8910 /* DFGMinifiedGraph.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC3D1522801700CD8910 /* DFGMinifiedGraph.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC461522802000CD8910 /* DFGMinifiedNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC3E1522801700CD8910 /* DFGMinifiedNode.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC471522802500CD8910 /* DFGValueRecoveryOverride.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC3F1522801700CD8910 /* DFGValueRecoveryOverride.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC481522802900CD8910 /* DFGValueSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC401522801700CD8910 /* DFGValueSource.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC491522809600CD8910 /* DFGVariableEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC411522801700CD8910 /* DFGVariableEvent.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC4A1522809A00CD8910 /* DFGVariableEventStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC421522801700CD8910 /* DFGVariableEventStream.cpp */; };
+		0F2BDC4B1522809D00CD8910 /* DFGVariableEventStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */; };
+		0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */; };
+		0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */; };
 		0F2C556F14738F3100121E4F /* DFGCodeBlocks.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F2C557014738F3500121E4F /* DFGCodeBlocks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */; };
 		0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3B3A17153E68EF003ED0FF /* DFGConstantFoldingPhase.cpp */; };
@@ -130,6 +140,12 @@
 		0F620179143FCD480068B77C /* DFGAbstractState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F62016D143FCD2F0068B77C /* DFGAbstractState.cpp */; };
 		0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F66E16C14DF3F1600B7B2E4 /* DFGEdge.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F766D2815A8CC1E008F363E /* JITStubRoutine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */; };
+		0F766D2B15A8CC38008F363E /* JITStubRoutineSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2915A8CC34008F363E /* JITStubRoutineSet.cpp */; };
+		0F766D2C15A8CC3A008F363E /* JITStubRoutineSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D2A15A8CC34008F363E /* JITStubRoutineSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F766D2F15A8DCE0008F363E /* GCAwareJITStubRoutine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D2D15A8DCDD008F363E /* GCAwareJITStubRoutine.cpp */; };
+		0F766D3015A8DCE2008F363E /* GCAwareJITStubRoutine.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D2E15A8DCDD008F363E /* GCAwareJITStubRoutine.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0F766D3115AA8112008F363E /* JITStubRoutine.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D1C15A5028D008F363E /* JITStubRoutine.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7700911402FF280078EB39 /* SamplingCounter.cpp */; };
 		0F7B294A14C3CD29007C3DB1 /* DFGCCallHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7B294814C3CD23007C3DB1 /* DFGCCallHelpers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -213,6 +229,7 @@
 		0FF427651591A1CE004CB9FF /* DFGDisassembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FF42771159275D5004CB9FF /* ResolveGlobalStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */; };
 		0FF42772159275D8004CB9FF /* ResolveGlobalStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0FF7168C15A3B235008F5DAA /* PropertyOffset.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF7168A15A3B231008F5DAA /* PropertyOffset.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0FF922D414F46B410041A24E /* LLIntOffsetsExtractor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4680A114BA7F8200BFE272 /* LLIntOffsetsExtractor.cpp */; };
 		0FFFC95714EF90A000C72532 /* DFGCFAPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */; };
 		0FFFC95814EF90A200C72532 /* DFGCFAPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -814,6 +831,16 @@
 		0F2BDC13151C5D4A00CD8910 /* DFGFixupPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFixupPhase.h; path = dfg/DFGFixupPhase.h; sourceTree = "<group>"; };
 		0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInsertionSet.h; path = dfg/DFGInsertionSet.h; sourceTree = "<group>"; };
 		0F2BDC2B151FDE8B00CD8910 /* Operands.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Operands.h; sourceTree = "<group>"; };
+		0F2BDC3D1522801700CD8910 /* DFGMinifiedGraph.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedGraph.h; path = dfg/DFGMinifiedGraph.h; sourceTree = "<group>"; };
+		0F2BDC3E1522801700CD8910 /* DFGMinifiedNode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedNode.h; path = dfg/DFGMinifiedNode.h; sourceTree = "<group>"; };
+		0F2BDC3F1522801700CD8910 /* DFGValueRecoveryOverride.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValueRecoveryOverride.h; path = dfg/DFGValueRecoveryOverride.h; sourceTree = "<group>"; };
+		0F2BDC401522801700CD8910 /* DFGValueSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValueSource.h; path = dfg/DFGValueSource.h; sourceTree = "<group>"; };
+		0F2BDC411522801700CD8910 /* DFGVariableEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableEvent.h; path = dfg/DFGVariableEvent.h; sourceTree = "<group>"; };
+		0F2BDC421522801700CD8910 /* DFGVariableEventStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEventStream.cpp; path = dfg/DFGVariableEventStream.cpp; sourceTree = "<group>"; };
+		0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableEventStream.h; path = dfg/DFGVariableEventStream.h; sourceTree = "<group>"; };
+		0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMinifiedNode.cpp; path = dfg/DFGMinifiedNode.cpp; sourceTree = "<group>"; };
+		0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValueSource.cpp; path = dfg/DFGValueSource.cpp; sourceTree = "<group>"; };
+		0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEvent.cpp; path = dfg/DFGVariableEvent.cpp; sourceTree = "<group>"; };
 		0F2C556D14738F2E00121E4F /* DFGCodeBlocks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DFGCodeBlocks.cpp; sourceTree = "<group>"; };
 		0F2C556E14738F2E00121E4F /* DFGCodeBlocks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DFGCodeBlocks.h; sourceTree = "<group>"; };
 		0F3B3A17153E68EF003ED0FF /* DFGConstantFoldingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGConstantFoldingPhase.cpp; path = dfg/DFGConstantFoldingPhase.cpp; sourceTree = "<group>"; };
@@ -854,6 +881,12 @@
 		0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableAccessData.h; path = dfg/DFGVariableAccessData.h; sourceTree = "<group>"; };
 		0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAdjacencyList.h; path = dfg/DFGAdjacencyList.h; sourceTree = "<group>"; };
 		0F66E16914DF3F1300B7B2E4 /* DFGEdge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGEdge.h; path = dfg/DFGEdge.h; sourceTree = "<group>"; };
+		0F766D1C15A5028D008F363E /* JITStubRoutine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITStubRoutine.h; sourceTree = "<group>"; };
+		0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubRoutine.cpp; sourceTree = "<group>"; };
+		0F766D2915A8CC34008F363E /* JITStubRoutineSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITStubRoutineSet.cpp; sourceTree = "<group>"; };
+		0F766D2A15A8CC34008F363E /* JITStubRoutineSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITStubRoutineSet.h; sourceTree = "<group>"; };
+		0F766D2D15A8DCDD008F363E /* GCAwareJITStubRoutine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCAwareJITStubRoutine.cpp; sourceTree = "<group>"; };
+		0F766D2E15A8DCDD008F363E /* GCAwareJITStubRoutine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GCAwareJITStubRoutine.h; sourceTree = "<group>"; };
 		0F77008E1402FDD60078EB39 /* SamplingCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SamplingCounter.h; sourceTree = "<group>"; };
 		0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = "<group>"; };
 		0F7B294814C3CD23007C3DB1 /* DFGCCallHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCCallHelpers.h; path = dfg/DFGCCallHelpers.h; sourceTree = "<group>"; };
@@ -937,6 +970,7 @@
 		0FF427621591A1C9004CB9FF /* DFGDisassembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDisassembler.h; path = dfg/DFGDisassembler.h; sourceTree = "<group>"; };
 		0FF4276E159275D2004CB9FF /* ResolveGlobalStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResolveGlobalStatus.cpp; sourceTree = "<group>"; };
 		0FF4276F159275D2004CB9FF /* ResolveGlobalStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResolveGlobalStatus.h; sourceTree = "<group>"; };
+		0FF7168A15A3B231008F5DAA /* PropertyOffset.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertyOffset.h; sourceTree = "<group>"; };
 		0FF922CF14F46B130041A24E /* JSCLLIntOffsetsExtractor */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = JSCLLIntOffsetsExtractor; sourceTree = BUILT_PRODUCTS_DIR; };
 		0FFFC94B14EF909500C72532 /* DFGCFAPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCFAPhase.cpp; path = dfg/DFGCFAPhase.cpp; sourceTree = "<group>"; };
 		0FFFC94C14EF909500C72532 /* DFGCFAPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFAPhase.h; path = dfg/DFGCFAPhase.h; sourceTree = "<group>"; };
@@ -1446,6 +1480,7 @@
 		F692A8850255597D01FF60F7 /* UString.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UString.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		F692A8860255597D01FF60F7 /* UString.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = UString.h; sourceTree = "<group>"; tabWidth = 8; };
 		F692A8870255597D01FF60F7 /* JSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSValue.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		FEB63AA2159B9DA3008932A6 /* Comment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Comment.h; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -1669,6 +1704,8 @@
 				A7B48DB60EE74CFC00DCBDB6 /* ExecutableAllocator.cpp */,
 				A7B48DB50EE74CFC00DCBDB6 /* ExecutableAllocator.h */,
 				86DB64630F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp */,
+				0F766D2D15A8DCDD008F363E /* GCAwareJITStubRoutine.cpp */,
+				0F766D2E15A8DCDD008F363E /* GCAwareJITStubRoutine.h */,
 				0F4680D014BBC5F800BFE272 /* HostCallReturnValue.cpp */,
 				0F4680D114BBC5F800BFE272 /* HostCallReturnValue.h */,
 				1429D92D0ED22D7000B89619 /* JIT.cpp */,
@@ -1688,6 +1725,8 @@
 				86CC85C30EE7A89400288682 /* JITPropertyAccess.cpp */,
 				A7C1E8C8112E701C00A37F98 /* JITPropertyAccess32_64.cpp */,
 				960626950FB8EC02009798AB /* JITStubCall.h */,
+				0F766D2615A8CC1B008F363E /* JITStubRoutine.cpp */,
+				0F766D1C15A5028D008F363E /* JITStubRoutine.h */,
 				14A23D6C0F4E19CE0023CDAD /* JITStubs.cpp */,
 				14A6581A0F4E36F4000150FD /* JITStubs.h */,
 				A76F54A213B28AAB00EF2BCE /* JITWriteBarrier.h */,
@@ -1729,6 +1768,8 @@
 				14BA7A9613AADFF8005B7C2C /* Heap.h */,
 				C2C8D02F14A3CEFC00578E65 /* HeapBlock.h */,
 				14F97446138C853E00DA1C67 /* HeapRootVisitor.h */,
+				0F766D2915A8CC34008F363E /* JITStubRoutineSet.cpp */,
+				0F766D2A15A8CC34008F363E /* JITStubRoutineSet.h */,
 				0F431736146BAC65007E3890 /* ListableHandler.h */,
 				142E3130134FF0A600AFADB5 /* Local.h */,
 				142E3131134FF0A600AFADB5 /* LocalScope.h */,
@@ -2086,6 +2127,7 @@
 				86158AB2155C8B3F00B45C9C /* PropertyName.h */,
 				65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */,
 				65400C100A69BAF200509887 /* PropertyNameArray.h */,
+				0FF7168A15A3B231008F5DAA /* PropertyOffset.h */,
 				65621E6B089E859700760F35 /* PropertySlot.cpp */,
 				65621E6C089E859700760F35 /* PropertySlot.h */,
 				65C02FBB0637462A003E7EE6 /* Protect.h */,
@@ -2226,6 +2268,9 @@
 				0F2BDC1F151E803800CD8910 /* DFGInsertionSet.h */,
 				86EC9DBB1328DF82002B2AD7 /* DFGJITCompiler.cpp */,
 				86EC9DBC1328DF82002B2AD7 /* DFGJITCompiler.h */,
+				0F2BDC3D1522801700CD8910 /* DFGMinifiedGraph.h */,
+				0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */,
+				0F2BDC3E1522801700CD8910 /* DFGMinifiedNode.h */,
 				86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */,
 				0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */,
 				0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */,
@@ -2260,9 +2305,16 @@
 				86880F4C14353B2100B08D42 /* DFGSpeculativeJIT64.cpp */,
 				0FC0979F146B28C700CF2442 /* DFGThunks.cpp */,
 				0FC097A0146B28C700CF2442 /* DFGThunks.h */,
+				0F2BDC3F1522801700CD8910 /* DFGValueRecoveryOverride.h */,
+				0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */,
+				0F2BDC401522801700CD8910 /* DFGValueSource.h */,
 				0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */,
 				0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */,
 				0F620172143FCD2F0068B77C /* DFGVariableAccessData.h */,
+				0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */,
+				0F2BDC411522801700CD8910 /* DFGVariableEvent.h */,
+				0F2BDC421522801700CD8910 /* DFGVariableEventStream.cpp */,
+				0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */,
 				0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */,
 				0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */,
 			);
@@ -2360,6 +2412,7 @@
 				0F0B83B314BCF85E00885B4F /* MethodCallLinkInfo.h */,
 				0F0B83AE14BCF71400885B4F /* CallLinkInfo.cpp */,
 				0F0B83AF14BCF71400885B4F /* CallLinkInfo.h */,
+				FEB63AA2159B9DA3008932A6 /* Comment.h */,
 				0F0B83AC14BCF60200885B4F /* LineInfo.h */,
 				0F0B83AA14BCF5B900885B4F /* ExpressionRangeInfo.h */,
 				0F0B83A814BCF55E00885B4F /* HandlerInfo.h */,
@@ -2745,6 +2798,12 @@
 				0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */,
 				0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */,
 				0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */,
+				0F2BDC451522801B00CD8910 /* DFGMinifiedGraph.h in Headers */,
+				0F2BDC461522802000CD8910 /* DFGMinifiedNode.h in Headers */,
+				0F2BDC471522802500CD8910 /* DFGValueRecoveryOverride.h in Headers */,
+				0F2BDC481522802900CD8910 /* DFGValueSource.h in Headers */,
+				0F2BDC491522809600CD8910 /* DFGVariableEvent.h in Headers */,
+				0F2BDC4B1522809D00CD8910 /* DFGVariableEventStream.h in Headers */,
 				8612E4CD152389EC00C836BE /* MatchResult.h in Headers */,
 				0F1E3A461534CBAF000F9456 /* DFGArgumentPosition.h in Headers */,
 				0F3B3A1B153E68F4003ED0FF /* DFGConstantFoldingPhase.h in Headers */,
@@ -2773,6 +2832,10 @@
 				0FF4274B158EBE91004CB9FF /* udis86.h in Headers */,
 				0FF427651591A1CE004CB9FF /* DFGDisassembler.h in Headers */,
 				0FF42772159275D8004CB9FF /* ResolveGlobalStatus.h in Headers */,
+				0FF7168C15A3B235008F5DAA /* PropertyOffset.h in Headers */,
+				0F766D2C15A8CC3A008F363E /* JITStubRoutineSet.h in Headers */,
+				0F766D3015A8DCE2008F363E /* GCAwareJITStubRoutine.h in Headers */,
+				0F766D3115AA8112008F363E /* JITStubRoutine.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -3334,6 +3397,10 @@
 				8642C510151C06A90046D4EF /* RegExpCachedResult.cpp in Sources */,
 				8642C512151C083D0046D4EF /* RegExpMatchesArray.cpp in Sources */,
 				863C6D9C1521111A00585E4E /* YarrCanonicalizeUCS2.cpp in Sources */,
+				0F2BDC4A1522809A00CD8910 /* DFGVariableEventStream.cpp in Sources */,
+				0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */,
+				0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */,
+				0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */,
 				14816E1B154CC56C00B8054C /* BlockAllocator.cpp in Sources */,
 				86EBF2FF1560F06A008E9222 /* NameConstructor.cpp in Sources */,
 				86EBF3011560F06A008E9222 /* NameInstance.cpp in Sources */,
@@ -3361,6 +3428,9 @@
 				C2D58C3415912FEE0021A844 /* GCActivityCallback.cpp in Sources */,
 				0FF427641591A1CC004CB9FF /* DFGDisassembler.cpp in Sources */,
 				0FF42771159275D5004CB9FF /* ResolveGlobalStatus.cpp in Sources */,
+				0F766D2815A8CC1E008F363E /* JITStubRoutine.cpp in Sources */,
+				0F766D2B15A8CC38008F363E /* JITStubRoutineSet.cpp in Sources */,
+				0F766D2F15A8DCE0008F363E /* GCAwareJITStubRoutine.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/JavaScriptCore/Target.pri b/Source/JavaScriptCore/Target.pri
index 2f479222a..b019e417e 100644
--- a/Source/JavaScriptCore/Target.pri
+++ b/Source/JavaScriptCore/Target.pri
@@ -83,6 +83,7 @@ SOURCES += \
     heap/Heap.cpp \
     heap/HeapTimer.cpp \
     heap/IncrementalSweeper.cpp \
+    heap/JITStubRoutineSet.cpp \
     heap/MachineStackMarker.cpp \
     heap/MarkStack.cpp \
     heap/MarkedAllocator.cpp \
@@ -109,6 +110,7 @@ SOURCES += \
     dfg/DFGFixupPhase.cpp \
     dfg/DFGGraph.cpp \
     dfg/DFGJITCompiler.cpp \
+    dfg/DFGMinifiedNode.cpp \
     dfg/DFGNodeFlags.cpp \
     dfg/DFGOperations.cpp \
     dfg/DFGOSREntry.cpp \
@@ -124,6 +126,9 @@ SOURCES += \
     dfg/DFGSpeculativeJIT32_64.cpp \
     dfg/DFGSpeculativeJIT64.cpp \
     dfg/DFGThunks.cpp \
+    dfg/DFGValueSource.cpp \
+    dfg/DFGVariableEvent.cpp \
+    dfg/DFGVariableEventStream.cpp \
     dfg/DFGValidate.cpp \
     dfg/DFGVirtualRegisterAllocationPhase.cpp \
     interpreter/AbstractPC.cpp \
@@ -133,6 +138,7 @@ SOURCES += \
     jit/ExecutableAllocatorFixedVMPool.cpp \
     jit/ExecutableAllocator.cpp \
     jit/HostCallReturnValue.cpp \
+    jit/GCAwareJITStubRoutine.cpp \
     jit/JITArithmetic.cpp \
     jit/JITArithmetic32_64.cpp \
     jit/JITCall.cpp \
@@ -143,6 +149,7 @@ SOURCES += \
     jit/JITOpcodes32_64.cpp \
     jit/JITPropertyAccess.cpp \
     jit/JITPropertyAccess32_64.cpp \
+    jit/JITStubRoutine.cpp \
     jit/JITStubs.cpp \
     jit/ThunkGenerators.cpp \
     parser/Lexer.cpp \
@@ -248,6 +255,8 @@ SOURCES += \
     tools/CodeProfiling.cpp \
     yarr/YarrJIT.cpp \
 
+HEADERS += $$files(*.h, true)
+
 *sh4* {
     QMAKE_CXXFLAGS += -mieee -w
     QMAKE_CFLAGS   += -mieee -w
@@ -259,15 +268,4 @@ lessThan(QT_GCC_MAJOR_VERSION, 5) {
         # Disable C++0x mode in JSC for those who enabled it in their Qt's mkspec.
         *-g++*:QMAKE_CXXFLAGS -= -std=c++0x -std=gnu++0x
     }
-
-    # GCC 4.6 and after.
-    greaterThan(QT_GCC_MINOR_VERSION, 5) {
-        if (!contains(QMAKE_CXXFLAGS, -std=c++0x) && !contains(QMAKE_CXXFLAGS, -std=gnu++0x)) {
-            # We need to deactivate those warnings because some names conflicts with upcoming c++0x types (e.g.nullptr).
-            QMAKE_CFLAGS_WARN_ON += -Wno-c++0x-compat
-            QMAKE_CXXFLAGS_WARN_ON += -Wno-c++0x-compat
-            QMAKE_CFLAGS += -Wno-c++0x-compat
-            QMAKE_CXXFLAGS += -Wno-c++0x-compat
-        }
-    }
 }
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.cpp b/Source/JavaScriptCore/assembler/ARMAssembler.cpp
index 74809cadb..362fcc630 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.cpp
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.cpp
@@ -262,86 +262,117 @@ ARMWord ARMAssembler::encodeComplexImm(ARMWord imm, int dest)
 
 // Memory load/store helpers
 
-void ARMAssembler::dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes)
+void ARMAssembler::dataTransfer32(DataTransferTypeA transferType, RegisterID srcDst, RegisterID base, int32_t offset)
 {
-    ARMWord transferFlag = bytes ? DT_BYTE : 0;
     if (offset >= 0) {
         if (offset <= 0xfff)
-            dtr_u(isLoad, srcDst, base, offset | transferFlag);
+            dtr_u(transferType, srcDst, base, offset);
         else if (offset <= 0xfffff) {
             add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_u(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
+            dtr_u(transferType, srcDst, ARMRegisters::S0, (offset & 0xfff));
         } else {
             moveImm(offset, ARMRegisters::S0);
-            dtr_ur(isLoad, srcDst, base, ARMRegisters::S0 | transferFlag);
+            dtr_ur(transferType, srcDst, base, ARMRegisters::S0);
         }
     } else {
         if (offset >= -0xfff)
-            dtr_d(isLoad, srcDst, base, -offset | transferFlag);
+            dtr_d(transferType, srcDst, base, -offset);
         else if (offset >= -0xfffff) {
             sub_r(ARMRegisters::S0, base, OP2_IMM | (-offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARMRegisters::S0, (-offset & 0xfff) | transferFlag);
+            dtr_d(transferType, srcDst, ARMRegisters::S0, (-offset & 0xfff));
         } else {
             moveImm(offset, ARMRegisters::S0);
-            dtr_ur(isLoad, srcDst, base, ARMRegisters::S0 | transferFlag);
+            dtr_ur(transferType, srcDst, base, ARMRegisters::S0);
         }
     }
 }
 
-void ARMAssembler::baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset, bool bytes)
+void ARMAssembler::baseIndexTransfer32(DataTransferTypeA transferType, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset)
 {
-    ARMWord op2;
-    ARMWord transferFlag = bytes ? DT_BYTE : 0;
-
     ASSERT(scale >= 0 && scale <= 3);
-    op2 = lsl(index, scale);
+    ARMWord op2 = lsl(index, scale);
 
-    if (offset >= 0 && offset <= 0xfff) {
-        add_r(ARMRegisters::S0, base, op2);
-        dtr_u(isLoad, srcDst, ARMRegisters::S0, offset | transferFlag);
+    if (!offset) {
+        dtr_ur(transferType, srcDst, base, op2);
         return;
     }
-    if (offset <= 0 && offset >= -0xfff) {
-        add_r(ARMRegisters::S0, base, op2);
-        dtr_d(isLoad, srcDst, ARMRegisters::S0, (-offset & 0xfff) | transferFlag);
+
+    add_r(ARMRegisters::S1, base, op2);
+    dataTransfer32(transferType, srcDst, ARMRegisters::S1, offset);
+}
+
+void ARMAssembler::dataTransfer16(DataTransferTypeB transferType, RegisterID srcDst, RegisterID base, int32_t offset)
+{
+    if (offset >= 0) {
+        if (offset <= 0xff)
+            dtrh_u(transferType, srcDst, base, getOp2Half(offset));
+        else if (offset <= 0xffff) {
+            add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 8) | (12 << 8));
+            dtrh_u(transferType, srcDst, ARMRegisters::S0, getOp2Half(offset & 0xff));
+        } else {
+            moveImm(offset, ARMRegisters::S0);
+            dtrh_ur(transferType, srcDst, base, ARMRegisters::S0);
+        }
+    } else {
+        if (offset >= -0xff)
+            dtrh_d(transferType, srcDst, base, getOp2Half(-offset));
+        else if (offset >= -0xffff) {
+            sub_r(ARMRegisters::S0, base, OP2_IMM | (-offset >> 8) | (12 << 8));
+            dtrh_d(transferType, srcDst, ARMRegisters::S0, getOp2Half(-offset & 0xff));
+        } else {
+            moveImm(offset, ARMRegisters::S0);
+            dtrh_ur(transferType, srcDst, base, ARMRegisters::S0);
+        }
+    }
+}
+
+void ARMAssembler::baseIndexTransfer16(DataTransferTypeB transferType, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset)
+{
+    if (!scale && !offset) {
+        dtrh_ur(transferType, srcDst, base, index);
         return;
     }
 
-    ldr_un_imm(ARMRegisters::S0, offset);
-    add_r(ARMRegisters::S0, ARMRegisters::S0, op2);
-    dtr_ur(isLoad, srcDst, base, ARMRegisters::S0 | transferFlag);
+    add_r(ARMRegisters::S1, base, lsl(index, scale));
+    dataTransfer16(transferType, srcDst, ARMRegisters::S1, offset);
 }
 
-void ARMAssembler::doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset)
+void ARMAssembler::dataTransferFloat(DataTransferTypeFloat transferType, FPRegisterID srcDst, RegisterID base, int32_t offset)
 {
     // VFP cannot directly access memory that is not four-byte-aligned
     if (!(offset & 0x3)) {
         if (offset <= 0x3ff && offset >= 0) {
-            fdtr_u(isLoad, srcDst, base, offset >> 2);
+            fdtr_u(transferType, srcDst, base, offset >> 2);
             return;
         }
         if (offset <= 0x3ffff && offset >= 0) {
             add_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
-            fdtr_u(isLoad, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
+            fdtr_u(transferType, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
             return;
         }
         offset = -offset;
 
         if (offset <= 0x3ff && offset >= 0) {
-            fdtr_d(isLoad, srcDst, base, offset >> 2);
+            fdtr_d(transferType, srcDst, base, offset >> 2);
             return;
         }
         if (offset <= 0x3ffff && offset >= 0) {
             sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 10) | (11 << 8));
-            fdtr_d(isLoad, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
+            fdtr_d(transferType, srcDst, ARMRegisters::S0, (offset >> 2) & 0xff);
             return;
         }
         offset = -offset;
     }
 
-    ldr_un_imm(ARMRegisters::S0, offset);
+    moveImm(offset, ARMRegisters::S0);
     add_r(ARMRegisters::S0, ARMRegisters::S0, base);
-    fdtr_u(isLoad, srcDst, ARMRegisters::S0, 0);
+    fdtr_u(transferType, srcDst, ARMRegisters::S0, 0);
+}
+
+void ARMAssembler::baseIndexTransferFloat(DataTransferTypeFloat transferType, FPRegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset)
+{
+    add_r(ARMRegisters::S1, base, lsl(index, scale));
+    dataTransferFloat(transferType, srcDst, ARMRegisters::S1, offset);
 }
 
 PassRefPtr<ExecutableMemoryHandle> ARMAssembler::executableCopy(JSGlobalData& globalData, void* ownerUID, JITCompilationEffort effort)
@@ -361,10 +392,10 @@ PassRefPtr<ExecutableMemoryHandle> ARMAssembler::executableCopy(JSGlobalData& gl
         ARMWord* addr = getLdrImmAddress(ldrAddr);
         if (*addr != InvalidBranchTarget) {
             if (!(iter->m_offset & 1)) {
-                int diff = reinterpret_cast_ptr<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetching);
+                intptr_t difference = reinterpret_cast_ptr<ARMWord*>(data + *addr) - (ldrAddr + DefaultPrefetching);
 
-                if ((diff <= BOFFSET_MAX && diff >= BOFFSET_MIN)) {
-                    *ldrAddr = B | getConditionalField(*ldrAddr) | (diff & BRANCH_MASK);
+                if ((difference <= BOFFSET_MAX && difference >= BOFFSET_MIN)) {
+                    *ldrAddr = B | getConditionalField(*ldrAddr) | (difference & BRANCH_MASK);
                     continue;
                 }
             }
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.h b/Source/JavaScriptCore/assembler/ARMAssembler.h
index 16dc0cfc2..a0d7d27c3 100644
--- a/Source/JavaScriptCore/assembler/ARMAssembler.h
+++ b/Source/JavaScriptCore/assembler/ARMAssembler.h
@@ -41,16 +41,16 @@ namespace JSC {
             r0 = 0,
             r1,
             r2,
-            r3, S0 = r3,
+            r3, S0 = r3, /* Same as thumb assembler. */
             r4,
             r5,
             r6,
             r7,
-            r8, S1 = r8,
+            r8,
             r9,
             r10,
             r11,
-            r12,
+            r12, S1 = r12,
             r13, sp = r13,
             r14, lr = r14,
             r15, pc = r15
@@ -60,11 +60,11 @@ namespace JSC {
             d0,
             d1,
             d2,
-            d3, SD0 = d3,
+            d3,
             d4,
             d5,
             d6,
-            d7,
+            d7, SD0 = d7, /* Same as thumb assembler. */
             d8,
             d9,
             d10,
@@ -100,7 +100,10 @@ namespace JSC {
         typedef AssemblerBufferWithConstantPool<2048, 4, 4, ARMAssembler> ARMBuffer;
         typedef SegmentedVector<AssemblerLabel, 64> Jumps;
 
-        ARMAssembler() { }
+        ARMAssembler()
+            : m_indexOfTailOfLastWatchpoint(1)
+        {
+        }
 
         // ARM conditional constants
         typedef enum {
@@ -141,33 +144,33 @@ namespace JSC {
             MVN = (0xf << 21),
             MUL = 0x00000090,
             MULL = 0x00c00090,
+            VMOV_F64 = 0x0eb00b40,
             VADD_F64 = 0x0e300b00,
             VDIV_F64 = 0x0e800b00,
             VSUB_F64 = 0x0e300b40,
             VMUL_F64 = 0x0e200b00,
             VCMP_F64 = 0x0eb40b40,
             VSQRT_F64 = 0x0eb10bc0,
-            DTR = 0x05000000,
-            LDRH = 0x00100090,
-            STRH = 0x00000090,
+            VABS_F64 = 0x0eb00bc0,
+            VNEG_F64 = 0x0eb10b40,
             STMDB = 0x09200000,
             LDMIA = 0x08b00000,
-            FDTR = 0x0d000b00,
             B = 0x0a000000,
             BL = 0x0b000000,
-#if WTF_ARM_ARCH_AT_LEAST(5) || defined(__ARM_ARCH_4T__)
             BX = 0x012fff10,
-#endif
-            VMOV_VFP = 0x0e000a10,
-            VMOV_ARM = 0x0e100a10,
+            VMOV_VFP64 = 0x0c400a10,
+            VMOV_ARM64 = 0x0c500a10,
+            VMOV_VFP32 = 0x0e000a10,
+            VMOV_ARM32 = 0x0e100a10,
             VCVT_F64_S32 = 0x0eb80bc0,
             VCVT_S32_F64 = 0x0ebd0b40,
+            VCVT_U32_F64 = 0x0ebc0b40,
+            VCVT_F32_F64 = 0x0eb70bc0,
+            VCVT_F64_F32 = 0x0eb70ac0,
             VMRS_APSR = 0x0ef1fa10,
-#if WTF_ARM_ARCH_AT_LEAST(5)
             CLZ = 0x016f0f10,
             BKPT = 0xe1200070,
             BLX = 0x012fff30,
-#endif
 #if WTF_ARM_ARCH_AT_LEAST(7)
             MOVW = 0x03000000,
             MOVT = 0x03400000,
@@ -177,17 +180,37 @@ namespace JSC {
 
         enum {
             OP2_IMM = (1 << 25),
-            OP2_IMMh = (1 << 22),
+            OP2_IMM_HALF = (1 << 22),
             OP2_INV_IMM = (1 << 26),
             SET_CC = (1 << 20),
             OP2_OFSREG = (1 << 25),
+            // Data transfer flags.
             DT_UP = (1 << 23),
-            DT_BYTE = (1 << 22),
             DT_WB = (1 << 21),
-            // This flag is inlcuded in LDR and STR
             DT_PRE = (1 << 24),
-            HDT_UH = (1 << 5),
             DT_LOAD = (1 << 20),
+            DT_BYTE = (1 << 22),
+        };
+
+        enum DataTransferTypeA {
+            LoadUint32 = 0x05000000 | DT_LOAD,
+            LoadUint8 = 0x05400000 | DT_LOAD,
+            StoreUint32 = 0x05000000,
+            StoreUint8 = 0x05400000,
+        };
+
+        enum DataTransferTypeB {
+            LoadUint16 = 0x010000b0 | DT_LOAD,
+            LoadInt16 = 0x010000f0 | DT_LOAD,
+            LoadInt8 = 0x010000d0 | DT_LOAD,
+            StoreUint16 = 0x010000b0,
+        };
+
+        enum DataTransferTypeFloat {
+            LoadFloat = 0x0d000a00 | DT_LOAD,
+            LoadDouble = 0x0d000b00 | DT_LOAD,
+            StoreFloat = 0x0d000a00,
+            StoreDouble = 0x0d000b00,
         };
 
         // Masks of ARM instructions
@@ -218,7 +241,7 @@ namespace JSC {
 
         void emitInst(ARMWord op, int rd, int rn, ARMWord op2)
         {
-            ASSERT(((op2 & ~OP2_IMM) <= 0xfff) || (((op2 & ~OP2_IMMh) <= 0xfff)));
+            ASSERT(((op2 & ~OP2_IMM) <= 0xfff) || (((op2 & ~OP2_IMM_HALF) <= 0xfff)));
             m_buffer.putInt(op | RN(rn) | RD(rd) | op2);
         }
 
@@ -407,6 +430,11 @@ namespace JSC {
             m_buffer.putInt(static_cast<ARMWord>(cc) | MULL | RN(rdhi) | RD(rdlo) | RS(rn) | RM(rm));
         }
 
+        void vmov_f64_r(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VMOV_F64, dd, 0, dm);
+        }
+
         void vadd_f64_r(int dd, int dn, int dm, Condition cc = AL)
         {
             emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VADD_F64, dd, dn, dm);
@@ -437,100 +465,124 @@ namespace JSC {
             emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VSQRT_F64, dd, 0, dm);
         }
 
+        void vabs_f64_r(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VABS_F64, dd, 0, dm);
+        }
+
+        void vneg_f64_r(int dd, int dm, Condition cc = AL)
+        {
+            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VNEG_F64, dd, 0, dm);
+        }
+
         void ldr_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm, true);
+            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | LoadUint32 | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm, true);
         }
 
         void ldr_un_imm(int rd, ARMWord imm, Condition cc = AL)
         {
-            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm);
+            m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | LoadUint32 | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm);
         }
 
-        void dtr_u(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
+        void dtr_u(DataTransferTypeA transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | DTR | (isLoad ? DT_LOAD : 0) | DT_UP, rd, rb, op2);
+            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP, rd, rb, op2);
         }
 
-        void dtr_ur(bool isLoad, int rd, int rb, int rm, Condition cc = AL)
+        void dtr_ur(DataTransferTypeA transferType, int rd, int rb, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | DTR | (isLoad ? DT_LOAD : 0) | DT_UP | OP2_OFSREG, rd, rb, rm);
+            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP | OP2_OFSREG, rd, rb, rm);
         }
 
-        void dtr_d(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
+        void dtr_d(DataTransferTypeA transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | DTR | (isLoad ? DT_LOAD : 0), rd, rb, op2);
+            emitInst(static_cast<ARMWord>(cc) | transferType, rd, rb, op2);
         }
 
-        void dtr_dr(bool isLoad, int rd, int rb, int rm, Condition cc = AL)
+        void dtr_dr(DataTransferTypeA transferType, int rd, int rb, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | DTR | (isLoad ? DT_LOAD : 0) | OP2_OFSREG, rd, rb, rm);
+            emitInst(static_cast<ARMWord>(cc) | transferType | OP2_OFSREG, rd, rb, rm);
         }
 
-        void ldrh_r(int rd, int rn, int rm, Condition cc = AL)
+        void dtrh_u(DataTransferTypeB transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | LDRH | HDT_UH | DT_UP | DT_PRE, rd, rn, rm);
+            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP, rd, rb, op2);
         }
 
-        void ldrh_d(int rd, int rb, ARMWord op2, Condition cc = AL)
+        void dtrh_ur(DataTransferTypeB transferType, int rd, int rn, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | LDRH | HDT_UH | DT_PRE, rd, rb, op2);
+            emitInst(static_cast<ARMWord>(cc) | transferType | DT_UP, rd, rn, rm);
         }
 
-        void ldrh_u(int rd, int rb, ARMWord op2, Condition cc = AL)
+        void dtrh_d(DataTransferTypeB transferType, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | LDRH | HDT_UH | DT_UP | DT_PRE, rd, rb, op2);
+            emitInst(static_cast<ARMWord>(cc) | transferType, rd, rb, op2);
         }
 
-        void strh_r(int rn, int rm, int rd, Condition cc = AL)
+        void dtrh_dr(DataTransferTypeB transferType, int rd, int rn, int rm, Condition cc = AL)
         {
-            emitInst(static_cast<ARMWord>(cc) | STRH | HDT_UH | DT_UP | DT_PRE, rd, rn, rm);
+            emitInst(static_cast<ARMWord>(cc) | transferType, rd, rn, rm);
         }
 
-        void fdtr_u(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
+        void fdtr_u(DataTransferTypeFloat type, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            ASSERT(op2 <= 0xff);
-            emitInst(static_cast<ARMWord>(cc) | FDTR | DT_UP | (isLoad ? DT_LOAD : 0), rd, rb, op2);
+            ASSERT(op2 <= 0xff && rd <= 15);
+            /* Only d0-d15 and s0, s2, s4 ... s30 are supported. */
+            m_buffer.putInt(static_cast<ARMWord>(cc) | DT_UP | type | (rd << 12) | RN(rb) | op2);
         }
 
-        void fdtr_d(bool isLoad, int rd, int rb, ARMWord op2, Condition cc = AL)
+        void fdtr_d(DataTransferTypeFloat type, int rd, int rb, ARMWord op2, Condition cc = AL)
         {
-            ASSERT(op2 <= 0xff);
-            emitInst(static_cast<ARMWord>(cc) | FDTR | (isLoad ? DT_LOAD : 0), rd, rb, op2);
+            ASSERT(op2 <= 0xff && rd <= 15);
+            /* Only d0-d15 and s0, s2, s4 ... s30 are supported. */
+            m_buffer.putInt(static_cast<ARMWord>(cc) | type | (rd << 12) | RN(rb) | op2);
         }
 
         void push_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(cc | DTR | DT_WB | RN(ARMRegisters::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | StoreUint32 | DT_WB | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         void pop_r(int reg, Condition cc = AL)
         {
             ASSERT(ARMWord(reg) <= 0xf);
-            m_buffer.putInt(cc | (DTR ^ DT_PRE) | DT_LOAD | DT_UP | RN(ARMRegisters::sp) | RD(reg) | 0x4);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | (LoadUint32 ^ DT_PRE) | DT_UP | RN(ARMRegisters::sp) | RD(reg) | 0x4);
         }
 
         inline void poke_r(int reg, Condition cc = AL)
         {
-            dtr_d(false, ARMRegisters::sp, 0, reg, cc);
+            dtr_d(StoreUint32, ARMRegisters::sp, 0, reg, cc);
         }
 
         inline void peek_r(int reg, Condition cc = AL)
         {
-            dtr_u(true, reg, ARMRegisters::sp, 0, cc);
+            dtr_u(LoadUint32, reg, ARMRegisters::sp, 0, cc);
         }
 
-        void vmov_vfp_r(int sn, int rt, Condition cc = AL)
+        void vmov_vfp64_r(int sm, int rt, int rt2, Condition cc = AL)
+        {
+            ASSERT(rt != rt2);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | VMOV_VFP64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
+        }
+
+        void vmov_arm64_r(int rt, int rt2, int sm, Condition cc = AL)
+        {
+            ASSERT(rt != rt2);
+            m_buffer.putInt(static_cast<ARMWord>(cc) | VMOV_ARM64 | RN(rt2) | RD(rt) | (sm & 0xf) | ((sm & 0x10) << (5 - 4)));
+        }
+
+        void vmov_vfp32_r(int sn, int rt, Condition cc = AL)
         {
             ASSERT(rt <= 15);
-            emitSinglePrecisionInst(static_cast<ARMWord>(cc) | VMOV_VFP, rt << 1, sn, 0);
+            emitSinglePrecisionInst(static_cast<ARMWord>(cc) | VMOV_VFP32, rt << 1, sn, 0);
         }
 
-        void vmov_arm_r(int rt, int sn, Condition cc = AL)
+        void vmov_arm32_r(int rt, int sn, Condition cc = AL)
         {
             ASSERT(rt <= 15);
-            emitSinglePrecisionInst(static_cast<ARMWord>(cc) | VMOV_ARM, rt << 1, sn, 0);
+            emitSinglePrecisionInst(static_cast<ARMWord>(cc) | VMOV_ARM32, rt << 1, sn, 0);
         }
 
         void vcvt_f64_s32_r(int dd, int sm, Condition cc = AL)
@@ -545,26 +597,37 @@ namespace JSC {
             emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_S32_F64, (sd >> 1), 0, dm);
         }
 
+        void vcvt_u32_f64_r(int sd, int dm, Condition cc = AL)
+        {
+            ASSERT(!(sd & 0x1)); // sd must be divisible by 2
+            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_U32_F64, (sd >> 1), 0, dm);
+        }
+
+        void vcvt_f64_f32_r(int dd, int sm, Condition cc = AL)
+        {
+            ASSERT(dd <= 15 && sm <= 15);
+            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_F64_F32, dd, 0, sm);
+        }
+
+        void vcvt_f32_f64_r(int dd, int sm, Condition cc = AL)
+        {
+            ASSERT(dd <= 15 && sm <= 15);
+            emitDoublePrecisionInst(static_cast<ARMWord>(cc) | VCVT_F32_F64, dd, 0, sm);
+        }
+
         void vmrs_apsr(Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | VMRS_APSR);
         }
 
-#if WTF_ARM_ARCH_AT_LEAST(5)
         void clz_r(int rd, int rm, Condition cc = AL)
         {
             m_buffer.putInt(static_cast<ARMWord>(cc) | CLZ | RD(rd) | RM(rm));
         }
-#endif
 
         void bkpt(ARMWord value)
         {
-#if WTF_ARM_ARCH_AT_LEAST(5)
             m_buffer.putInt(BKPT | ((value & 0xff0) << 4) | (value & 0xf));
-#else
-            // Cannot access to Zero memory address
-            dtr_dr(true, ARMRegisters::S0, ARMRegisters::S0, ARMRegisters::S0);
-#endif
         }
 
         void nop()
@@ -574,23 +637,12 @@ namespace JSC {
 
         void bx(int rm, Condition cc = AL)
         {
-#if WTF_ARM_ARCH_AT_LEAST(5) || defined(__ARM_ARCH_4T__)
             emitInst(static_cast<ARMWord>(cc) | BX, 0, 0, RM(rm));
-#else
-            mov_r(ARMRegisters::pc, RM(rm), cc);
-#endif
         }
 
         AssemblerLabel blx(int rm, Condition cc = AL)
         {
-#if WTF_ARM_ARCH_AT_LEAST(5)
             emitInst(static_cast<ARMWord>(cc) | BLX, 0, 0, RM(rm));
-#else
-            ASSERT(rm != 14);
-            ensureSpace(2 * sizeof(ARMWord), 0);
-            mov_r(ARMRegisters::lr, ARMRegisters::pc, cc);
-            bx(rm, cc);
-#endif
             return m_buffer.label();
         }
 
@@ -653,12 +705,33 @@ namespace JSC {
             return m_buffer.sizeOfConstantPool();
         }
 
-        AssemblerLabel label()
+        AssemblerLabel labelIgnoringWatchpoints()
         {
-            m_buffer.ensureSpaceForAnyOneInstruction();
+            m_buffer.ensureSpaceForAnyInstruction();
             return m_buffer.label();
         }
 
+        AssemblerLabel labelForWatchpoint()
+        {
+            m_buffer.ensureSpaceForAnyInstruction(maxJumpReplacementSize() / sizeof(ARMWord));
+            AssemblerLabel result = m_buffer.label();
+            if (result.m_offset != (m_indexOfTailOfLastWatchpoint - maxJumpReplacementSize()))
+                result = label();
+            m_indexOfTailOfLastWatchpoint = result.m_offset + maxJumpReplacementSize();
+            return label();
+        }
+
+        AssemblerLabel label()
+        {
+            AssemblerLabel result = labelIgnoringWatchpoints();
+            while (result.m_offset + 1 < m_indexOfTailOfLastWatchpoint) {
+                nop();
+                // The available number of instructions are ensured by labelForWatchpoint.
+                result = m_buffer.label();
+            }
+            return result;
+        }
+
         AssemblerLabel align(int alignment)
         {
             while (!m_buffer.isAligned(alignment))
@@ -684,18 +757,28 @@ namespace JSC {
 
         unsigned debugOffset() { return m_buffer.debugOffset(); }
 
+        // DFG assembly helpers for moving data between fp and registers.
+        void vmov(RegisterID rd1, RegisterID rd2, FPRegisterID rn)
+        {
+            vmov_arm64_r(rd1, rd2, rn);
+        }
+
+        void vmov(FPRegisterID rd, RegisterID rn1, RegisterID rn2)
+        {
+            vmov_vfp64_r(rd, rn1, rn2);
+        }
+
         // Patching helpers
 
         static ARMWord* getLdrImmAddress(ARMWord* insn)
         {
-#if WTF_ARM_ARCH_AT_LEAST(5)
             // Check for call
             if ((*insn & 0x0f7f0000) != 0x051f0000) {
                 // Must be BLX
                 ASSERT((*insn & 0x012fff30) == 0x012fff30);
                 insn--;
             }
-#endif
+
             // Must be an ldr ..., [pc +/- imm]
             ASSERT((*insn & 0x0f7f0000) == 0x051f0000);
 
@@ -799,6 +882,56 @@ namespace JSC {
             return reinterpret_cast<void*>(readPointer(reinterpret_cast<void*>(getAbsoluteJumpAddress(from))));
         }
 
+        static void replaceWithJump(void* instructionStart, void* to)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart) - 1;
+            intptr_t difference = reinterpret_cast<intptr_t>(to) - (reinterpret_cast<intptr_t>(instruction) + DefaultPrefetching * sizeof(ARMWord));
+
+            if (!(difference & 1)) {
+                difference >>= 2;
+                if ((difference <= BOFFSET_MAX && difference >= BOFFSET_MIN)) {
+                     // Direct branch.
+                     instruction[0] = B | AL | (difference & BRANCH_MASK);
+                     cacheFlush(instruction, sizeof(ARMWord));
+                     return;
+                }
+            }
+
+            // Load target.
+            instruction[0] = LoadUint32 | AL | RN(ARMRegisters::pc) | RD(ARMRegisters::pc) | 4;
+            instruction[1] = reinterpret_cast<ARMWord>(to);
+            cacheFlush(instruction, sizeof(ARMWord) * 2);
+        }
+
+        static ptrdiff_t maxJumpReplacementSize()
+        {
+            return sizeof(ARMWord) * 2;
+        }
+
+        static void replaceWithLoad(void* instructionStart)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
+            cacheFlush(instruction, sizeof(ARMWord));
+
+            ASSERT((*instruction & 0x0ff00000) == 0x02800000 || (*instruction & 0x0ff00000) == 0x05900000);
+            if ((*instruction & 0x0ff00000) == 0x02800000) {
+                 *instruction = (*instruction & 0xf00fffff) | 0x05900000;
+                 cacheFlush(instruction, sizeof(ARMWord));
+            }
+        }
+
+        static void replaceWithAddressComputation(void* instructionStart)
+        {
+            ARMWord* instruction = reinterpret_cast<ARMWord*>(instructionStart);
+            cacheFlush(instruction, sizeof(ARMWord));
+
+            ASSERT((*instruction & 0x0ff00000) == 0x02800000 || (*instruction & 0x0ff00000) == 0x05900000);
+            if ((*instruction & 0x0ff00000) == 0x05900000) {
+                 *instruction = (*instruction & 0xf00fffff) | 0x02800000;
+                 cacheFlush(instruction, sizeof(ARMWord));
+            }
+        }
+
         // Address operations
 
         static void* getRelocatedAddress(void* code, AssemblerLabel label)
@@ -820,13 +953,20 @@ namespace JSC {
 
         // Handle immediates
 
+        static ARMWord getOp2(ARMWord imm);
+
+        // Fast case if imm is known to be between 0 and 0xff
         static ARMWord getOp2Byte(ARMWord imm)
         {
             ASSERT(imm <= 0xff);
-            return OP2_IMMh | (imm & 0x0f) | ((imm & 0xf0) << 4) ;
+            return OP2_IMM | imm;
         }
 
-        static ARMWord getOp2(ARMWord imm);
+        static ARMWord getOp2Half(ARMWord imm)
+        {
+            ASSERT(imm <= 0xff);
+            return OP2_IMM_HALF | (imm & 0x0f) | ((imm & 0xf0) << 4);
+        }
 
 #if WTF_ARM_ARCH_AT_LEAST(7)
         static ARMWord getImm16Op2(ARMWord imm)
@@ -840,20 +980,14 @@ namespace JSC {
         void moveImm(ARMWord imm, int dest);
         ARMWord encodeComplexImm(ARMWord imm, int dest);
 
-        ARMWord getOffsetForHalfwordDataTransfer(ARMWord imm, int tmpReg)
-        {
-            // Encode immediate data in the instruction if it is possible
-            if (imm <= 0xff)
-                return getOp2Byte(imm);
-            // Otherwise, store the data in a temporary register
-            return encodeComplexImm(imm, tmpReg);
-        }
-
         // Memory load/store helpers
 
-        void dataTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, int32_t offset, bool bytes = false);
-        void baseIndexTransfer32(bool isLoad, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset, bool bytes = false);
-        void doubleTransfer(bool isLoad, FPRegisterID srcDst, RegisterID base, int32_t offset);
+        void dataTransfer32(DataTransferTypeA, RegisterID srcDst, RegisterID base, int32_t offset);
+        void baseIndexTransfer32(DataTransferTypeA, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
+        void dataTransfer16(DataTransferTypeB, RegisterID srcDst, RegisterID base, int32_t offset);
+        void baseIndexTransfer16(DataTransferTypeB, RegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
+        void dataTransferFloat(DataTransferTypeFloat, FPRegisterID srcDst, RegisterID base, int32_t offset);
+        void baseIndexTransferFloat(DataTransferTypeFloat, FPRegisterID srcDst, RegisterID base, RegisterID index, int scale, int32_t offset);
 
         // Constant pool hnadlers
 
@@ -901,25 +1035,25 @@ namespace JSC {
 #endif
 
     private:
-        ARMWord RM(int reg)
+        static ARMWord RM(int reg)
         {
             ASSERT(reg <= ARMRegisters::pc);
             return reg;
         }
 
-        ARMWord RS(int reg)
+        static ARMWord RS(int reg)
         {
             ASSERT(reg <= ARMRegisters::pc);
             return reg << 8;
         }
 
-        ARMWord RD(int reg)
+        static ARMWord RD(int reg)
         {
             ASSERT(reg <= ARMRegisters::pc);
             return reg << 12;
         }
 
-        ARMWord RN(int reg)
+        static ARMWord RN(int reg)
         {
             ASSERT(reg <= ARMRegisters::pc);
             return reg << 16;
@@ -934,6 +1068,7 @@ namespace JSC {
 
         ARMBuffer m_buffer;
         Jumps m_jumps;
+        uint32_t m_indexOfTailOfLastWatchpoint;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/assembler/ARMv7Assembler.h b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
index 81977e2bd..eef0ba8a7 100644
--- a/Source/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/Source/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -1018,6 +1018,12 @@ public:
         else
             m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, imm.getUInt12());
     }
+    
+    ALWAYS_INLINE void ldrWide8BitImmediate(RegisterID rt, RegisterID rn, uint8_t immediate)
+    {
+        ASSERT(rn != ARMRegisters::pc);
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, immediate);
+    }
 
     ALWAYS_INLINE void ldrCompact(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
     {
@@ -2117,6 +2123,46 @@ public:
     {
         return 6;
     }
+    
+    static void replaceWithLoad(void* instructionStart)
+    {
+        ASSERT(!(bitwise_cast<uintptr_t>(instructionStart) & 1));
+        uint16_t* ptr = reinterpret_cast<uint16_t*>(instructionStart);
+        switch (ptr[0] & 0xFFF0) {
+        case OP_LDR_imm_T3:
+            break;
+        case OP_ADD_imm_T3:
+            ASSERT(!(ptr[1] & 0xF000));
+            ptr[0] &= 0x000F;
+            ptr[0] |= OP_LDR_imm_T3;
+            ptr[1] |= (ptr[1] & 0x0F00) << 4;
+            ptr[1] &= 0xF0FF;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+        cacheFlush(ptr, sizeof(uint16_t) * 2);
+    }
+
+    static void replaceWithAddressComputation(void* instructionStart)
+    {
+        ASSERT(!(bitwise_cast<uintptr_t>(instructionStart) & 1));
+        uint16_t* ptr = reinterpret_cast<uint16_t*>(instructionStart);
+        switch (ptr[0] & 0xFFF0) {
+        case OP_LDR_imm_T3:
+            ASSERT(!(ptr[1] & 0x0F00));
+            ptr[0] &= 0x000F;
+            ptr[0] |= OP_ADD_imm_T3;
+            ptr[1] |= (ptr[1] & 0xF000) >> 4;
+            ptr[1] &= 0x0FFF;
+            break;
+        case OP_ADD_imm_T3:
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+        cacheFlush(ptr, sizeof(uint16_t) * 2);
+    }
 
     unsigned debugOffset() { return m_formatter.debugOffset(); }
 
diff --git a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 0080446c2..a24f7573a 100644
--- a/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -295,6 +295,36 @@ public:
     private:
         AssemblerLabel m_label;
     };
+    
+    // ConvertibleLoadLabel:
+    //
+    // A ConvertibleLoadLabel records a loadPtr instruction that can be patched to an addPtr
+    // so that:
+    //
+    // loadPtr(Address(a, i), b)
+    //
+    // becomes:
+    //
+    // addPtr(TrustedImmPtr(i), a, b)
+    class ConvertibleLoadLabel {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+        
+    public:
+        ConvertibleLoadLabel()
+        {
+        }
+        
+        ConvertibleLoadLabel(AbstractMacroAssembler<AssemblerType>* masm)
+            : m_label(masm->m_assembler.labelIgnoringWatchpoints())
+        {
+        }
+        
+        bool isSet() const { return m_label.isSet(); }
+    private:
+        AssemblerLabel m_label;
+    };
 
     // DataLabelPtr:
     //
@@ -562,6 +592,11 @@ public:
         result.m_label = m_assembler.labelIgnoringWatchpoints();
         return result;
     }
+#else
+    Label labelIgnoringWatchpoints()
+    {
+        return label();
+    }
 #endif
     
     Label label()
@@ -672,6 +707,16 @@ protected:
     {
         return AssemblerType::readPointer(dataLabelPtr.dataLocation());
     }
+    
+    static void replaceWithLoad(CodeLocationConvertibleLoad label)
+    {
+        AssemblerType::replaceWithLoad(label.dataLocation());
+    }
+    
+    static void replaceWithAddressComputation(CodeLocationConvertibleLoad label)
+    {
+        AssemblerType::replaceWithAddressComputation(label.dataLocation());
+    }
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
index e2ea261ee..430147280 100644
--- a/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
+++ b/Source/JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h
@@ -127,9 +127,9 @@ public:
         AssemblerBuffer::ensureSpace(insnSpace);
     }
 
-    void ensureSpaceForAnyOneInstruction()
+    void ensureSpaceForAnyInstruction(int amount = 1)
     {
-        flushIfNoSpaceFor(maxInstructionSize, sizeof(uint64_t));
+        flushIfNoSpaceFor(amount * maxInstructionSize, amount * sizeof(uint64_t));
     }
 
     bool isAligned(int alignment)
diff --git a/Source/JavaScriptCore/assembler/CodeLocation.h b/Source/JavaScriptCore/assembler/CodeLocation.h
index 9500b1ee4..86d1f2b75 100644
--- a/Source/JavaScriptCore/assembler/CodeLocation.h
+++ b/Source/JavaScriptCore/assembler/CodeLocation.h
@@ -40,6 +40,7 @@ class CodeLocationNearCall;
 class CodeLocationDataLabelCompact;
 class CodeLocationDataLabel32;
 class CodeLocationDataLabelPtr;
+class CodeLocationConvertibleLoad;
 
 // The CodeLocation* types are all pretty much do-nothing wrappers around
 // CodePtr (or MacroAssemblerCodePtr, to give it its full name).  These
@@ -62,6 +63,7 @@ public:
     CodeLocationDataLabelPtr dataLabelPtrAtOffset(int offset);
     CodeLocationDataLabel32 dataLabel32AtOffset(int offset);
     CodeLocationDataLabelCompact dataLabelCompactAtOffset(int offset);
+    CodeLocationConvertibleLoad convertibleLoadAtOffset(int offset);
 
 protected:
     CodeLocationCommon()
@@ -146,6 +148,15 @@ public:
         : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
 };
 
+class CodeLocationConvertibleLoad : public CodeLocationCommon {
+public:
+    CodeLocationConvertibleLoad() { }
+    explicit CodeLocationConvertibleLoad(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) { }
+    explicit CodeLocationConvertibleLoad(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) { }
+};
+
 inline CodeLocationInstruction CodeLocationCommon::instructionAtOffset(int offset)
 {
     ASSERT_VALID_CODE_OFFSET(offset);
@@ -194,6 +205,12 @@ inline CodeLocationDataLabelCompact CodeLocationCommon::dataLabelCompactAtOffset
     return CodeLocationDataLabelCompact(reinterpret_cast<char*>(dataLocation()) + offset);
 }
 
+inline CodeLocationConvertibleLoad CodeLocationCommon::convertibleLoadAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationConvertibleLoad(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
 } // namespace JSC
 
 #endif // ENABLE(ASSEMBLER)
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.cpp b/Source/JavaScriptCore/assembler/LinkBuffer.cpp
index 58030ba7d..0176e4307 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.cpp
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.cpp
@@ -41,7 +41,7 @@ LinkBuffer::CodeRef LinkBuffer::finalizeCodeWithoutDisassembly()
 
 LinkBuffer::CodeRef LinkBuffer::finalizeCodeWithDisassembly(const char* format, ...)
 {
-    ASSERT(Options::showDisassembly);
+    ASSERT(Options::showDisassembly() || Options::showDFGDisassembly());
     
     CodeRef result = finalizeCodeWithoutDisassembly();
     
@@ -54,7 +54,7 @@ LinkBuffer::CodeRef LinkBuffer::finalizeCodeWithDisassembly(const char* format,
     
     dataLog("    Code at [%p, %p):\n", result.code().executableAddress(), static_cast<char*>(result.code().executableAddress()) + result.size());
     if (!tryToDisassemble(result.code(), m_size, "    ", WTF::dataFile()))
-        dataLog("        <no disassembly available>");
+        dataLog("        <no disassembly available>\n");
     
     return result;
 }
diff --git a/Source/JavaScriptCore/assembler/LinkBuffer.h b/Source/JavaScriptCore/assembler/LinkBuffer.h
index c6e003142..484d3a73f 100644
--- a/Source/JavaScriptCore/assembler/LinkBuffer.h
+++ b/Source/JavaScriptCore/assembler/LinkBuffer.h
@@ -69,6 +69,7 @@ class LinkBuffer {
     typedef MacroAssembler::DataLabelCompact DataLabelCompact;
     typedef MacroAssembler::DataLabel32 DataLabel32;
     typedef MacroAssembler::DataLabelPtr DataLabelPtr;
+    typedef MacroAssembler::ConvertibleLoadLabel ConvertibleLoadLabel;
 #if ENABLE(BRANCH_COMPACTION)
     typedef MacroAssembler::LinkRecord LinkRecord;
     typedef MacroAssembler::JumpLinkType JumpLinkType;
@@ -180,6 +181,11 @@ public:
         return CodeLocationDataLabelCompact(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
     }
 
+    CodeLocationConvertibleLoad locationOf(ConvertibleLoadLabel label)
+    {
+        return CodeLocationConvertibleLoad(MacroAssembler::getLinkerAddress(code(), applyOffset(label.m_label)));
+    }
+
     // This method obtains the return address of the call, given as an offset from
     // the start of the code.
     unsigned returnAddressOffset(Call call)
@@ -257,6 +263,11 @@ private:
 #endif
 };
 
+#define FINALIZE_CODE_IF(condition, linkBufferReference, dataLogArgumentsForHeading)  \
+    (UNLIKELY((condition))                                              \
+     ? ((linkBufferReference).finalizeCodeWithDisassembly dataLogArgumentsForHeading) \
+     : (linkBufferReference).finalizeCodeWithoutDisassembly())
+
 // Use this to finalize code, like so:
 //
 // CodeRef code = FINALIZE_CODE(linkBuffer, ("my super thingy number %d", number));
@@ -274,9 +285,7 @@ private:
 // is true, so you can hide expensive disassembly-only computations inside there.
 
 #define FINALIZE_CODE(linkBufferReference, dataLogArgumentsForHeading)  \
-    (UNLIKELY(Options::showDisassembly)                                 \
-     ? ((linkBufferReference).finalizeCodeWithDisassembly dataLogArgumentsForHeading) \
-     : (linkBufferReference).finalizeCodeWithoutDisassembly())
+    FINALIZE_CODE_IF(Options::showDisassembly(), linkBufferReference, dataLogArgumentsForHeading)
 
 } // namespace JSC
 
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp b/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp
index 2db5df1f8..3408c1230 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.cpp
@@ -77,18 +77,18 @@ void MacroAssemblerARM::load32WithUnalignedHalfWords(BaseIndex address, Register
 
     if (address.offset >= 0 && address.offset + 0x2 <= 0xff) {
         m_assembler.add_r(ARMRegisters::S0, address.base, op2);
-        m_assembler.ldrh_u(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset));
-        m_assembler.ldrh_u(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(address.offset + 0x2));
+        m_assembler.dtrh_u(ARMAssembler::LoadUint16, dest, ARMRegisters::S0, ARMAssembler::getOp2Half(address.offset));
+        m_assembler.dtrh_u(ARMAssembler::LoadUint16, ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Half(address.offset + 0x2));
     } else if (address.offset < 0 && address.offset >= -0xff) {
         m_assembler.add_r(ARMRegisters::S0, address.base, op2);
-        m_assembler.ldrh_d(dest, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset));
-        m_assembler.ldrh_d(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(-address.offset - 0x2));
+        m_assembler.dtrh_d(ARMAssembler::LoadUint16, dest, ARMRegisters::S0, ARMAssembler::getOp2Half(-address.offset));
+        m_assembler.dtrh_d(ARMAssembler::LoadUint16, ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Half(-address.offset - 0x2));
     } else {
-        m_assembler.ldr_un_imm(ARMRegisters::S0, address.offset);
+        m_assembler.moveImm(address.offset, ARMRegisters::S0);
         m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, op2);
-        m_assembler.ldrh_r(dest, address.base, ARMRegisters::S0);
+        m_assembler.dtrh_ur(ARMAssembler::LoadUint16, dest, address.base, ARMRegisters::S0);
         m_assembler.add_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::OP2_IMM | 0x2);
-        m_assembler.ldrh_r(ARMRegisters::S0, address.base, ARMRegisters::S0);
+        m_assembler.dtrh_ur(ARMAssembler::LoadUint16, ARMRegisters::S0, address.base, ARMRegisters::S0);
     }
     m_assembler.orr_r(dest, dest, m_assembler.lsl(ARMRegisters::S0, 16));
 }
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
index 8ea29e3a0..8e123d423 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -90,6 +90,11 @@ public:
         m_assembler.adds_r(dest, dest, src);
     }
 
+    void add32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.adds_r(dest, op1, op2);
+    }
+
     void add32(TrustedImm32 imm, Address address)
     {
         load32(address, ARMRegisters::S1);
@@ -118,6 +123,11 @@ public:
         m_assembler.ands_r(dest, dest, src);
     }
 
+    void and32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.ands_r(dest, op1, op2);
+    }
+
     void and32(TrustedImm32 imm, RegisterID dest)
     {
         ARMWord w = m_assembler.getImm(imm.m_value, ARMRegisters::S0, true);
@@ -136,13 +146,17 @@ public:
             m_assembler.ands_r(dest, src, w);
     }
 
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+    void lshift32(RegisterID shiftAmount, RegisterID dest)
     {
-        ARMWord w = ARMAssembler::getOp2(0x1f);
-        ASSERT(w != ARMAssembler::INVALID_IMM);
-        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+        lshift32(dest, shiftAmount, dest);
+    }
+
+    void lshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        ARMWord w = ARMAssembler::getOp2Byte(0x1f);
+        m_assembler.and_r(ARMRegisters::S0, shiftAmount, w);
 
-        m_assembler.movs_r(dest, m_assembler.lsl_r(dest, ARMRegisters::S0));
+        m_assembler.movs_r(dest, m_assembler.lsl_r(src, ARMRegisters::S0));
     }
 
     void lshift32(TrustedImm32 imm, RegisterID dest)
@@ -155,13 +169,25 @@ public:
         m_assembler.movs_r(dest, m_assembler.lsl(src, imm.m_value & 0x1f));
     }
 
-    void mul32(RegisterID src, RegisterID dest)
+    void mul32(RegisterID op1, RegisterID op2, RegisterID dest)
     {
-        if (src == dest) {
-            move(src, ARMRegisters::S0);
-            src = ARMRegisters::S0;
+        if (op2 == dest) {
+            if (op1 == dest) {
+                move(op2, ARMRegisters::S0);
+                op2 = ARMRegisters::S0;
+            } else {
+                // Swap the operands.
+                RegisterID tmp = op1;
+                op1 = op2;
+                op2 = tmp;
+            }
         }
-        m_assembler.muls_r(dest, dest, src);
+        m_assembler.muls_r(dest, op1, op2);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        mul32(src, dest, dest);
     }
 
     void mul32(TrustedImm32 imm, RegisterID src, RegisterID dest)
@@ -172,7 +198,7 @@ public:
 
     void neg32(RegisterID srcDest)
     {
-        m_assembler.rsbs_r(srcDest, srcDest, ARMAssembler::getOp2(0));
+        m_assembler.rsbs_r(srcDest, srcDest, ARMAssembler::getOp2Byte(0));
     }
 
     void or32(RegisterID src, RegisterID dest)
@@ -195,15 +221,19 @@ public:
         m_assembler.orrs_r(dest, op1, op2);
     }
 
-    void rshift32(RegisterID shift_amount, RegisterID dest)
+    void rshift32(RegisterID shiftAmount, RegisterID dest)
     {
-        ARMWord w = ARMAssembler::getOp2(0x1f);
-        ASSERT(w != ARMAssembler::INVALID_IMM);
-        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
+        rshift32(dest, shiftAmount, dest);
+    }
+
+    void rshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        ARMWord w = ARMAssembler::getOp2Byte(0x1f);
+        m_assembler.and_r(ARMRegisters::S0, shiftAmount, w);
 
-        m_assembler.movs_r(dest, m_assembler.asr_r(dest, ARMRegisters::S0));
+        m_assembler.movs_r(dest, m_assembler.asr_r(src, ARMRegisters::S0));
     }
-    
+
     void rshift32(TrustedImm32 imm, RegisterID dest)
     {
         rshift32(dest, imm, dest);
@@ -213,16 +243,20 @@ public:
     {
         m_assembler.movs_r(dest, m_assembler.asr(src, imm.m_value & 0x1f));
     }
-    
-    void urshift32(RegisterID shift_amount, RegisterID dest)
+
+    void urshift32(RegisterID shiftAmount, RegisterID dest)
     {
-        ARMWord w = ARMAssembler::getOp2(0x1f);
-        ASSERT(w != ARMAssembler::INVALID_IMM);
-        m_assembler.and_r(ARMRegisters::S0, shift_amount, w);
-        
-        m_assembler.movs_r(dest, m_assembler.lsr_r(dest, ARMRegisters::S0));
+        urshift32(dest, shiftAmount, dest);
     }
-    
+
+    void urshift32(RegisterID src, RegisterID shiftAmount, RegisterID dest)
+    {
+        ARMWord w = ARMAssembler::getOp2Byte(0x1f);
+        m_assembler.and_r(ARMRegisters::S0, shiftAmount, w);
+
+        m_assembler.movs_r(dest, m_assembler.lsr_r(src, ARMRegisters::S0));
+    }
+
     void urshift32(TrustedImm32 imm, RegisterID dest)
     {
         m_assembler.movs_r(dest, m_assembler.lsr(dest, imm.m_value & 0x1f));
@@ -266,6 +300,11 @@ public:
         m_assembler.eors_r(dest, dest, src);
     }
 
+    void xor32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        m_assembler.eors_r(dest, op1, op2);
+    }
+
     void xor32(TrustedImm32 imm, RegisterID dest)
     {
         if (imm.m_value == -1)
@@ -295,22 +334,42 @@ public:
 
     void load8(ImplicitAddress address, RegisterID dest)
     {
-        m_assembler.dataTransfer32(true, dest, address.base, address.offset, true);
+        m_assembler.dataTransfer32(ARMAssembler::LoadUint8, dest, address.base, address.offset);
     }
 
     void load8(BaseIndex address, RegisterID dest)
     {
-        m_assembler.baseIndexTransfer32(true, dest, address.base, address.index, static_cast<int>(address.scale), address.offset, true);
+        m_assembler.baseIndexTransfer32(ARMAssembler::LoadUint8, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void load8Signed(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer16(ARMAssembler::LoadInt8, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void load16(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.dataTransfer16(ARMAssembler::LoadUint16, dest, address.base, address.offset);
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer16(ARMAssembler::LoadUint16, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void load16Signed(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.baseIndexTransfer16(ARMAssembler::LoadInt16, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
     void load32(ImplicitAddress address, RegisterID dest)
     {
-        m_assembler.dataTransfer32(true, dest, address.base, address.offset);
+        m_assembler.dataTransfer32(ARMAssembler::LoadUint32, dest, address.base, address.offset);
     }
 
     void load32(BaseIndex address, RegisterID dest)
     {
-        m_assembler.baseIndexTransfer32(true, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+        m_assembler.baseIndexTransfer32(ARMAssembler::LoadUint32, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
 #if CPU(ARMV5_OR_LOWER)
@@ -327,11 +386,19 @@ public:
         load16(address, dest);
     }
 
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+        ASSERT(address.offset >= 0 && address.offset <= 255);
+        m_assembler.dtr_u(ARMAssembler::LoadUint32, dest, address.base, address.offset);
+        return result;
+    }
+
     DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
     {
         DataLabel32 dataLabel(this);
         m_assembler.ldr_un_imm(ARMRegisters::S0, 0);
-        m_assembler.dtr_ur(true, dest, address.base, ARMRegisters::S0);
+        m_assembler.dtr_ur(ARMAssembler::LoadUint32, dest, address.base, ARMRegisters::S0);
         return dataLabel;
     }
     
@@ -342,36 +409,32 @@ public:
         return dataLabel;
     }
 
-    void load16(BaseIndex address, RegisterID dest)
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
     {
-        m_assembler.add_r(ARMRegisters::S1, address.base, m_assembler.lsl(address.index, address.scale));
-        load16(Address(ARMRegisters::S1, address.offset), dest);
+        DataLabel32 dataLabel(this);
+        m_assembler.ldr_un_imm(ARMRegisters::S0, 0);
+        m_assembler.dtr_ur(ARMAssembler::StoreUint32, src, address.base, ARMRegisters::S0);
+        return dataLabel;
     }
-    
-    void load16(ImplicitAddress address, RegisterID dest)
+
+    void store8(RegisterID src, BaseIndex address)
     {
-        if (address.offset >= 0)
-            m_assembler.ldrh_u(dest, address.base, m_assembler.getOffsetForHalfwordDataTransfer(address.offset, ARMRegisters::S0));
-        else
-            m_assembler.ldrh_d(dest, address.base, m_assembler.getOffsetForHalfwordDataTransfer(-address.offset, ARMRegisters::S0));
+        m_assembler.baseIndexTransfer32(ARMAssembler::StoreUint8, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
-    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    void store16(RegisterID src, BaseIndex address)
     {
-        DataLabel32 dataLabel(this);
-        m_assembler.ldr_un_imm(ARMRegisters::S0, 0);
-        m_assembler.dtr_ur(false, src, address.base, ARMRegisters::S0);
-        return dataLabel;
+        m_assembler.baseIndexTransfer16(ARMAssembler::StoreUint16, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
     void store32(RegisterID src, ImplicitAddress address)
     {
-        m_assembler.dataTransfer32(false, src, address.base, address.offset);
+        m_assembler.dataTransfer32(ARMAssembler::StoreUint32, src, address.base, address.offset);
     }
 
     void store32(RegisterID src, BaseIndex address)
     {
-        m_assembler.baseIndexTransfer32(false, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
+        m_assembler.baseIndexTransfer32(ARMAssembler::StoreUint32, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
     void store32(TrustedImm32 imm, ImplicitAddress address)
@@ -380,17 +443,23 @@ public:
         store32(ARMRegisters::S1, address);
     }
 
+    void store32(TrustedImm32 imm, BaseIndex address)
+    {
+        move(imm, ARMRegisters::S1);
+        m_assembler.baseIndexTransfer32(ARMAssembler::StoreUint32, ARMRegisters::S1, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
     void store32(RegisterID src, void* address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
-        m_assembler.dtr_u(false, src, ARMRegisters::S0, 0);
+        m_assembler.dtr_u(ARMAssembler::StoreUint32, src, ARMRegisters::S0, 0);
     }
 
     void store32(TrustedImm32 imm, void* address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
         m_assembler.moveImm(imm.m_value, ARMRegisters::S1);
-        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
+        m_assembler.dtr_u(ARMAssembler::StoreUint32, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void pop(RegisterID dest)
@@ -422,7 +491,8 @@ public:
 
     void move(RegisterID src, RegisterID dest)
     {
-        m_assembler.mov_r(dest, src);
+        if (src != dest)
+            m_assembler.mov_r(dest, src);
     }
 
     void move(TrustedImmPtr imm, RegisterID dest)
@@ -566,6 +636,12 @@ public:
         load32(address, ARMRegisters::pc);
     }
 
+    void jump(AbsoluteAddress address)
+    {
+        move(TrustedImmPtr(address.m_ptr), ARMRegisters::S0);
+        load32(Address(ARMRegisters::S0, 0), ARMRegisters::pc);
+    }
+
     Jump branchAdd32(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -573,6 +649,13 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchAdd32(ResultCondition cond, RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        add32(op1, op2, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
     Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -587,28 +670,47 @@ public:
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
-    void mull32(RegisterID src1, RegisterID src2, RegisterID dest)
+    Jump branchAdd32(ResultCondition cond, TrustedImm32 imm, AbsoluteAddress dest)
     {
-        if (src1 == dest) {
-            move(src1, ARMRegisters::S0);
-            src1 = ARMRegisters::S0;
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        add32(imm, dest);
+        return Jump(m_assembler.jmp(ARMCondition(cond)));
+    }
+
+    void mull32(RegisterID op1, RegisterID op2, RegisterID dest)
+    {
+        if (op2 == dest) {
+            if (op1 == dest) {
+                move(op2, ARMRegisters::S0);
+                op2 = ARMRegisters::S0;
+            } else {
+                // Swap the operands.
+                RegisterID tmp = op1;
+                op1 = op2;
+                op2 = tmp;
+            }
         }
-        m_assembler.mull_r(ARMRegisters::S1, dest, src2, src1);
+        m_assembler.mull_r(ARMRegisters::S1, dest, op1, op2);
         m_assembler.cmp_r(ARMRegisters::S1, m_assembler.asr(dest, 31));
     }
 
-    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    Jump branchMul32(ResultCondition cond, RegisterID src1, RegisterID src2, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
         if (cond == Overflow) {
-            mull32(src, dest, dest);
+            mull32(src1, src2, dest);
             cond = NonZero;
         }
         else
-            mul32(src, dest);
+            mul32(src1, src2, dest);
         return Jump(m_assembler.jmp(ARMCondition(cond)));
     }
 
+    Jump branchMul32(ResultCondition cond, RegisterID src, RegisterID dest)
+    {
+        return branchMul32(cond, src, dest, dest);
+    }
+
     Jump branchMul32(ResultCondition cond, TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -671,14 +773,8 @@ public:
 
     Call nearCall()
     {
-#if WTF_ARM_ARCH_AT_LEAST(5)
-        ensureSpace(2 * sizeof(ARMWord), sizeof(ARMWord));
         m_assembler.loadBranchTarget(ARMRegisters::S1, ARMAssembler::AL, true);
         return Call(m_assembler.blx(ARMRegisters::S1), Call::LinkableNear);
-#else
-        prepareCall();
-        return Call(m_assembler.jmp(ARMAssembler::AL, true), Call::LinkableNear);
-#endif
     }
 
     Call call(RegisterID target)
@@ -699,15 +795,15 @@ public:
     void compare32(RelationalCondition cond, RegisterID left, RegisterID right, RegisterID dest)
     {
         m_assembler.cmp_r(left, right);
-        m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
-        m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
+        m_assembler.mov_r(dest, ARMAssembler::getOp2Byte(0));
+        m_assembler.mov_r(dest, ARMAssembler::getOp2Byte(1), ARMCondition(cond));
     }
 
     void compare32(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
         m_assembler.cmp_r(left, m_assembler.getImm(right.m_value, ARMRegisters::S0));
-        m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
-        m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
+        m_assembler.mov_r(dest, ARMAssembler::getOp2Byte(0));
+        m_assembler.mov_r(dest, ARMAssembler::getOp2Byte(1), ARMCondition(cond));
     }
 
     void compare8(RelationalCondition cond, Address left, TrustedImm32 right, RegisterID dest)
@@ -722,8 +818,8 @@ public:
             m_assembler.cmp_r(0, reg);
         else
             m_assembler.tst_r(reg, m_assembler.getImm(mask.m_value, ARMRegisters::S0));
-        m_assembler.mov_r(dest, ARMAssembler::getOp2(0));
-        m_assembler.mov_r(dest, ARMAssembler::getOp2(1), ARMCondition(cond));
+        m_assembler.mov_r(dest, ARMAssembler::getOp2Byte(0));
+        m_assembler.mov_r(dest, ARMAssembler::getOp2Byte(1), ARMCondition(cond));
     }
 
     void test32(ResultCondition cond, Address address, TrustedImm32 mask, RegisterID dest)
@@ -746,25 +842,25 @@ public:
     void add32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        m_assembler.dtr_u(ARMAssembler::LoadUint32, ARMRegisters::S1, ARMRegisters::S1, 0);
         add32(imm, ARMRegisters::S1);
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
+        m_assembler.dtr_u(ARMAssembler::StoreUint32, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void sub32(TrustedImm32 imm, AbsoluteAddress address)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S1, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        m_assembler.dtr_u(ARMAssembler::LoadUint32, ARMRegisters::S1, ARMRegisters::S1, 0);
         sub32(imm, ARMRegisters::S1);
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address.m_ptr));
-        m_assembler.dtr_u(false, ARMRegisters::S1, ARMRegisters::S0, 0);
+        m_assembler.dtr_u(ARMAssembler::StoreUint32, ARMRegisters::S1, ARMRegisters::S0, 0);
     }
 
     void load32(const void* address, RegisterID dest)
     {
         m_assembler.ldr_un_imm(ARMRegisters::S0, reinterpret_cast<ARMWord>(address));
-        m_assembler.dtr_u(true, dest, ARMRegisters::S0, 0);
+        m_assembler.dtr_u(ARMAssembler::LoadUint32, dest, ARMRegisters::S0, 0);
     }
 
     Jump branch32(RelationalCondition cond, AbsoluteAddress left, RegisterID right)
@@ -790,14 +886,9 @@ public:
 
     Call call()
     {
-#if WTF_ARM_ARCH_AT_LEAST(5)
         ensureSpace(2 * sizeof(ARMWord), sizeof(ARMWord));
         m_assembler.loadBranchTarget(ARMRegisters::S1, ARMAssembler::AL, true);
         return Call(m_assembler.blx(ARMRegisters::S1), Call::Linkable);
-#else
-        prepareCall();
-        return Call(m_assembler.jmp(ARMAssembler::AL, true), Call::Linkable);
-#endif
     }
 
     Call tailRecursiveCall()
@@ -861,20 +952,52 @@ public:
     }
     static bool supportsFloatingPointAbs() { return false; }
 
+    void loadFloat(BaseIndex address, FPRegisterID dest)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::LoadFloat, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
     void loadDouble(ImplicitAddress address, FPRegisterID dest)
     {
-        m_assembler.doubleTransfer(true, dest, address.base, address.offset);
+        m_assembler.dataTransferFloat(ARMAssembler::LoadDouble, dest, address.base, address.offset);
+    }
+
+    void loadDouble(BaseIndex address, FPRegisterID dest)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::LoadDouble, dest, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
     void loadDouble(const void* address, FPRegisterID dest)
     {
-        m_assembler.ldr_un_imm(ARMRegisters::S0, (ARMWord)address);
-        m_assembler.fdtr_u(true, dest, ARMRegisters::S0, 0);
+        move(TrustedImm32(reinterpret_cast<ARMWord>(address)), ARMRegisters::S0);
+        m_assembler.fdtr_u(ARMAssembler::LoadDouble, dest, ARMRegisters::S0, 0);
+    }
+
+    void storeFloat(FPRegisterID src, BaseIndex address)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::StoreFloat, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
     }
 
     void storeDouble(FPRegisterID src, ImplicitAddress address)
     {
-        m_assembler.doubleTransfer(false, src, address.base, address.offset);
+        m_assembler.dataTransferFloat(ARMAssembler::StoreDouble, src, address.base, address.offset);
+    }
+
+    void storeDouble(FPRegisterID src, BaseIndex address)
+    {
+        m_assembler.baseIndexTransferFloat(ARMAssembler::StoreDouble, src, address.base, address.index, static_cast<int>(address.scale), address.offset);
+    }
+
+    void storeDouble(FPRegisterID src, const void* address)
+    {
+        move(TrustedImm32(reinterpret_cast<ARMWord>(address)), ARMRegisters::S0);
+        m_assembler.dataTransferFloat(ARMAssembler::StoreDouble, src, ARMRegisters::S0, 0);
+    }
+
+    void moveDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.vmov_f64_r(dest, src);
     }
 
     void addDouble(FPRegisterID src, FPRegisterID dest)
@@ -882,17 +1005,33 @@ public:
         m_assembler.vadd_f64_r(dest, dest, src);
     }
 
+    void addDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vadd_f64_r(dest, op1, op2);
+    }
+
     void addDouble(Address src, FPRegisterID dest)
     {
         loadDouble(src, ARMRegisters::SD0);
         addDouble(ARMRegisters::SD0, dest);
     }
 
+    void addDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        loadDouble(address.m_ptr, ARMRegisters::SD0);
+        addDouble(ARMRegisters::SD0, dest);
+    }
+
     void divDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.vdiv_f64_r(dest, dest, src);
     }
 
+    void divDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vdiv_f64_r(dest, op1, op2);
+    }
+
     void divDouble(Address src, FPRegisterID dest)
     {
         ASSERT_NOT_REACHED(); // Untested
@@ -905,6 +1044,11 @@ public:
         m_assembler.vsub_f64_r(dest, dest, src);
     }
 
+    void subDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vsub_f64_r(dest, op1, op2);
+    }
+
     void subDouble(Address src, FPRegisterID dest)
     {
         loadDouble(src, ARMRegisters::SD0);
@@ -922,39 +1066,55 @@ public:
         mulDouble(ARMRegisters::SD0, dest);
     }
 
+    void mulDouble(FPRegisterID op1, FPRegisterID op2, FPRegisterID dest)
+    {
+        m_assembler.vmul_f64_r(dest, op1, op2);
+    }
+
     void sqrtDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.vsqrt_f64_r(dest, src);
     }
     
-    void absDouble(FPRegisterID, FPRegisterID)
+    void absDouble(FPRegisterID src, FPRegisterID dest)
     {
-        ASSERT_NOT_REACHED();
+        m_assembler.vabs_f64_r(dest, src);
+    }
+
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vneg_f64_r(dest, src);
     }
 
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
-        m_assembler.vmov_vfp_r(dest << 1, src);
+        m_assembler.vmov_vfp32_r(dest << 1, src);
         m_assembler.vcvt_f64_s32_r(dest, dest << 1);
     }
 
     void convertInt32ToDouble(Address src, FPRegisterID dest)
     {
-        ASSERT_NOT_REACHED(); // Untested
-        // flds does not worth the effort here
         load32(src, ARMRegisters::S1);
         convertInt32ToDouble(ARMRegisters::S1, dest);
     }
 
     void convertInt32ToDouble(AbsoluteAddress src, FPRegisterID dest)
     {
-        ASSERT_NOT_REACHED(); // Untested
-        // flds does not worth the effort here
-        m_assembler.ldr_un_imm(ARMRegisters::S1, (ARMWord)src.m_ptr);
-        m_assembler.dtr_u(true, ARMRegisters::S1, ARMRegisters::S1, 0);
+        move(TrustedImmPtr(src.m_ptr), ARMRegisters::S1);
+        load32(Address(ARMRegisters::S1), ARMRegisters::S1);
         convertInt32ToDouble(ARMRegisters::S1, dest);
     }
 
+    void convertFloatToDouble(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.vcvt_f64_f32_r(dst, src);
+    }
+
+    void convertDoubleToFloat(FPRegisterID src, FPRegisterID dst)
+    {
+        m_assembler.vcvt_f32_f64_r(dst, src);
+    }
+
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         m_assembler.vcmp_f64_r(left, right);
@@ -968,12 +1128,42 @@ public:
     // If the result is not representable as a 32 bit value, branch.
     // May also branch for some values that are representable in 32 bits
     // (specifically, in this case, INT_MIN).
-    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    enum BranchTruncateType { BranchIfTruncateFailed, BranchIfTruncateSuccessful };
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
     {
-        UNUSED_PARAM(src);
-        UNUSED_PARAM(dest);
-        ASSERT_NOT_REACHED();
-        return jump();
+        truncateDoubleToInt32(src, dest);
+
+        m_assembler.add_r(ARMRegisters::S0, dest, ARMAssembler::getOp2Byte(1));
+        m_assembler.bic_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(1));
+
+        ARMWord w = ARMAssembler::getOp2(0x80000000);
+        ASSERT(w != ARMAssembler::INVALID_IMM);
+        m_assembler.cmp_r(ARMRegisters::S0, w);
+        return Jump(m_assembler.jmp(branchType == BranchIfTruncateFailed ? ARMAssembler::EQ : ARMAssembler::NE));
+    }
+
+    Jump branchTruncateDoubleToUint32(FPRegisterID src, RegisterID dest, BranchTruncateType branchType = BranchIfTruncateFailed)
+    {
+        truncateDoubleToUint32(src, dest);
+
+        m_assembler.add_r(ARMRegisters::S0, dest, ARMAssembler::getOp2Byte(1));
+        m_assembler.bic_r(ARMRegisters::S0, ARMRegisters::S0, ARMAssembler::getOp2Byte(1));
+
+        m_assembler.cmp_r(ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
+        return Jump(m_assembler.jmp(branchType == BranchIfTruncateFailed ? ARMAssembler::EQ : ARMAssembler::NE));
+    }
+
+    // Result is undefined if the value is outside of the integer range.
+    void truncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.vcvt_s32_f64_r(ARMRegisters::SD0 << 1, src);
+        m_assembler.vmov_arm32_r(dest, ARMRegisters::SD0 << 1);
+    }
+
+    void truncateDoubleToUint32(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.vcvt_u32_f64_r(ARMRegisters::SD0 << 1, src);
+        m_assembler.vmov_arm32_r(dest, ARMRegisters::SD0 << 1);
     }
 
     // Convert 'src' to an integer, and places the resulting 'dest'.
@@ -983,7 +1173,7 @@ public:
     void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID fpTemp)
     {
         m_assembler.vcvt_s32_f64_r(ARMRegisters::SD0 << 1, src);
-        m_assembler.vmov_arm_r(dest, ARMRegisters::SD0 << 1);
+        m_assembler.vmov_arm32_r(dest, ARMRegisters::SD0 << 1);
 
         // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
         m_assembler.vcvt_f64_s32_r(ARMRegisters::SD0, ARMRegisters::SD0 << 1);
@@ -995,18 +1185,25 @@ public:
 
     Jump branchDoubleNonZero(FPRegisterID reg, FPRegisterID scratch)
     {
-        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2(0));
+        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
         convertInt32ToDouble(ARMRegisters::S0, scratch);
         return branchDouble(DoubleNotEqual, reg, scratch);
     }
 
     Jump branchDoubleZeroOrNaN(FPRegisterID reg, FPRegisterID scratch)
     {
-        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2(0));
+        m_assembler.mov_r(ARMRegisters::S0, ARMAssembler::getOp2Byte(0));
         convertInt32ToDouble(ARMRegisters::S0, scratch);
         return branchDouble(DoubleEqualOrUnordered, reg, scratch);
     }
 
+    // Invert a relational condition, e.g. == becomes !=, < becomes >=, etc.
+    static RelationalCondition invert(RelationalCondition cond)
+    {
+        ASSERT((static_cast<uint32_t>(cond & 0x0fffffff)) == 0 && static_cast<uint32_t>(cond) < static_cast<uint32_t>(ARMAssembler::AL));
+        return static_cast<RelationalCondition>(cond ^ 0x10000000);
+    }
+
     void nop()
     {
         m_assembler.nop();
@@ -1019,12 +1216,12 @@ public:
 
     static void replaceWithJump(CodeLocationLabel instructionStart, CodeLocationLabel destination)
     {
-        ASSERT_NOT_REACHED();
+        ARMAssembler::replaceWithJump(instructionStart.dataLocation(), destination.dataLocation());
     }
     
     static ptrdiff_t maxJumpReplacementSize()
     {
-        ASSERT_NOT_REACHED();
+        ARMAssembler::maxJumpReplacementSize();
         return 0;
     }
 
@@ -1049,58 +1246,10 @@ protected:
         return m_assembler.sizeOfConstantPool();
     }
 
-    void prepareCall()
-    {
-#if WTF_ARM_ARCH_VERSION < 5
-        ensureSpace(2 * sizeof(ARMWord), sizeof(ARMWord));
-
-        m_assembler.mov_r(linkRegister, ARMRegisters::pc);
-#endif
-    }
-
     void call32(RegisterID base, int32_t offset)
     {
-#if WTF_ARM_ARCH_AT_LEAST(5)
-        int targetReg = ARMRegisters::S1;
-#else
-        int targetReg = ARMRegisters::pc;
-#endif
-        int tmpReg = ARMRegisters::S1;
-
-        if (base == ARMRegisters::sp)
-            offset += 4;
-
-        if (offset >= 0) {
-            if (offset <= 0xfff) {
-                prepareCall();
-                m_assembler.dtr_u(true, targetReg, base, offset);
-            } else if (offset <= 0xfffff) {
-                m_assembler.add_r(tmpReg, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
-                prepareCall();
-                m_assembler.dtr_u(true, targetReg, tmpReg, offset & 0xfff);
-            } else {
-                m_assembler.moveImm(offset, tmpReg);
-                prepareCall();
-                m_assembler.dtr_ur(true, targetReg, base, tmpReg);
-            }
-        } else  {
-            offset = -offset;
-            if (offset <= 0xfff) {
-                prepareCall();
-                m_assembler.dtr_d(true, targetReg, base, offset);
-            } else if (offset <= 0xfffff) {
-                m_assembler.sub_r(tmpReg, base, ARMAssembler::OP2_IMM | (offset >> 12) | (10 << 8));
-                prepareCall();
-                m_assembler.dtr_d(true, targetReg, tmpReg, offset & 0xfff);
-            } else {
-                m_assembler.moveImm(offset, tmpReg);
-                prepareCall();
-                m_assembler.dtr_dr(true, targetReg, base, tmpReg);
-            }
-        }
-#if WTF_ARM_ARCH_AT_LEAST(5)
-        m_assembler.blx(targetReg);
-#endif
+        load32(Address(base, offset), ARMRegisters::S1);
+        m_assembler.blx(ARMRegisters::S1);
     }
 
 private:
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index 6c0feffcf..3694c9163 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -600,6 +600,14 @@ public:
         move(TrustedImmPtr(address), addressTempRegister);
         m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
     }
+    
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result(this);
+        ASSERT(address.offset >= 0 && address.offset <= 255);
+        m_assembler.ldrWide8BitImmediate(dest, address.base, address.offset);
+        return result;
+    }
 
     void load8(ImplicitAddress address, RegisterID dest)
     {
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
index 3ea40c967..45de8139f 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -89,6 +89,13 @@ public:
         m_assembler.movl_mr(address, dest);
     }
 
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result = ConvertibleLoadLabel(this);
+        m_assembler.movl_mr(address.offset, address.base, dest);
+        return result;
+    }
+
     void addDouble(AbsoluteAddress address, FPRegisterID dest)
     {
         m_assembler.addsd_mr(address.m_ptr, dest);
diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
index fa95b335b..1fb574b51 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -258,6 +258,13 @@ public:
         m_assembler.movq_mr(address.offset, address.base, dest);
     }
 
+    ConvertibleLoadLabel convertibleLoadPtr(Address address, RegisterID dest)
+    {
+        ConvertibleLoadLabel result = ConvertibleLoadLabel(this);
+        m_assembler.movq_mr(address.offset, address.base, dest);
+        return result;
+    }
+
     void loadPtr(BaseIndex address, RegisterID dest)
     {
         m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
diff --git a/Source/JavaScriptCore/assembler/RepatchBuffer.h b/Source/JavaScriptCore/assembler/RepatchBuffer.h
index a87294b1b..531dda934 100644
--- a/Source/JavaScriptCore/assembler/RepatchBuffer.h
+++ b/Source/JavaScriptCore/assembler/RepatchBuffer.h
@@ -122,6 +122,24 @@ public:
     {
         relinkNearCallerToTrampoline(returnAddress, CodeLocationLabel(newCalleeFunction));
     }
+    
+    void replaceWithLoad(CodeLocationConvertibleLoad label)
+    {
+        MacroAssembler::replaceWithLoad(label);
+    }
+    
+    void replaceWithAddressComputation(CodeLocationConvertibleLoad label)
+    {
+        MacroAssembler::replaceWithAddressComputation(label);
+    }
+    
+    void setLoadInstructionIsActive(CodeLocationConvertibleLoad label, bool isActive)
+    {
+        if (isActive)
+            replaceWithLoad(label);
+        else
+            replaceWithAddressComputation(label);
+    }
 
 private:
     void* m_start;
diff --git a/Source/JavaScriptCore/assembler/SH4Assembler.h b/Source/JavaScriptCore/assembler/SH4Assembler.h
index 59d042244..d55d393f2 100644
--- a/Source/JavaScriptCore/assembler/SH4Assembler.h
+++ b/Source/JavaScriptCore/assembler/SH4Assembler.h
@@ -1241,7 +1241,7 @@ public:
 
     AssemblerLabel label()
     {
-        m_buffer.ensureSpaceForAnyOneInstruction();
+        m_buffer.ensureSpaceForAnyInstruction();
         return m_buffer.label();
     }
 
diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
index 9c35be8b5..cf8133266 100644
--- a/Source/JavaScriptCore/assembler/X86Assembler.h
+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
@@ -1839,6 +1839,42 @@ public:
         return 5;
     }
     
+    static void replaceWithLoad(void* instructionStart)
+    {
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+#if CPU(X86_64)
+        if ((*ptr & ~15) == PRE_REX)
+            ptr++;
+#endif
+        switch (*ptr) {
+        case OP_MOV_GvEv:
+            break;
+        case OP_LEA:
+            *ptr = OP_MOV_GvEv;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    
+    static void replaceWithAddressComputation(void* instructionStart)
+    {
+        uint8_t* ptr = reinterpret_cast<uint8_t*>(instructionStart);
+#if CPU(X86_64)
+        if ((*ptr & ~15) == PRE_REX)
+            ptr++;
+#endif
+        switch (*ptr) {
+        case OP_MOV_GvEv:
+            *ptr = OP_LEA;
+            break;
+        case OP_LEA:
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+    
     static unsigned getCallReturnOffset(AssemblerLabel call)
     {
         ASSERT(call.isSet());
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index e0a4da71d..48d0fe728 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -48,6 +48,7 @@
 #include "UStringConcatenate.h"
 #include <stdio.h>
 #include <wtf/StringExtras.h>
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(DFG_JIT)
 #include "DFGOperations.h"
@@ -93,6 +94,18 @@ static CString idName(int id0, const Identifier& ident)
     return makeUString(ident.ustring(), "(@id", UString::number(id0), ")").utf8();
 }
 
+void CodeBlock::dumpBytecodeCommentAndNewLine(int location)
+{
+#if ENABLE(BYTECODE_COMMENTS)
+    const char* comment = commentForBytecodeOffset(location);
+    if (comment)
+        dataLog("\t\t ; %s", comment);
+#else
+    UNUSED_PARAM(location);
+#endif
+    dataLog("\n");
+}
+
 CString CodeBlock::registerName(ExecState* exec, int r) const
 {
     if (r == missingThisObjectMarker())
@@ -156,7 +169,8 @@ void CodeBlock::printUnaryOp(ExecState* exec, int location, Vector<Instruction>:
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
 
-    dataLog("[%4d] %s\t\t %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data());
+    dataLog("[%4d] %s\t\t %s, %s", location, op, registerName(exec, r0).data(), registerName(exec, r1).data());
+    dumpBytecodeCommentAndNewLine(location);
 }
 
 void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it, const char* op)
@@ -164,14 +178,16 @@ void CodeBlock::printBinaryOp(ExecState* exec, int location, Vector<Instruction>
     int r0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
     int r2 = (++it)->u.operand;
-    dataLog("[%4d] %s\t\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+    dataLog("[%4d] %s\t\t %s, %s, %s", location, op, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+    dumpBytecodeCommentAndNewLine(location);
 }
 
 void CodeBlock::printConditionalJump(ExecState* exec, const Vector<Instruction>::const_iterator&, Vector<Instruction>::const_iterator& it, int location, const char* op)
 {
     int r0 = (++it)->u.operand;
     int offset = (++it)->u.operand;
-    dataLog("[%4d] %s\t\t %s, %d(->%d)\n", location, op, registerName(exec, r0).data(), offset, location + offset);
+    dataLog("[%4d] %s\t\t %s, %d(->%d)", location, op, registerName(exec, r0).data(), offset, location + offset);
+    dumpBytecodeCommentAndNewLine(location);
 }
 
 void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction>::const_iterator& it)
@@ -181,6 +197,9 @@ void CodeBlock::printGetByIdOp(ExecState* exec, int location, Vector<Instruction
     case op_get_by_id:
         op = "get_by_id";
         break;
+    case op_get_by_id_out_of_line:
+        op = "get_by_id_out_of_line";
+        break;
     case op_get_by_id_self:
         op = "get_by_id_self";
         break;
@@ -402,7 +421,7 @@ void CodeBlock::printCallOp(ExecState* exec, int location, Vector<Instruction>::
         }
 #endif
     }
-    dataLog("\n");
+    dumpBytecodeCommentAndNewLine(location);
     it += 2;
 }
 
@@ -411,7 +430,8 @@ void CodeBlock::printPutByIdOp(ExecState* exec, int location, Vector<Instruction
     int r0 = (++it)->u.operand;
     int id0 = (++it)->u.operand;
     int r1 = (++it)->u.operand;
-    dataLog("[%4d] %s\t %s, %s, %s\n", location, op, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
+    dataLog("[%4d] %s\t %s, %s, %s", location, op, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
+    dumpBytecodeCommentAndNewLine(location);
     it += 5;
 }
 
@@ -650,52 +670,61 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
     int location = it - begin;
     switch (exec->interpreter()->getOpcodeID(it->u.opcode)) {
         case op_enter: {
-            dataLog("[%4d] enter\n", location);
+            dataLog("[%4d] enter", location);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_create_activation: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] create_activation %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] create_activation %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_create_arguments: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] create_arguments\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] create_arguments\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_init_lazy_reg: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] init_lazy_reg\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] init_lazy_reg\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_create_this: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] create_this %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] create_this %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] convert_this\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] convert_this\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             ++it; // Skip value profile.
             break;
         }
         case op_new_object: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] new_object\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] new_object\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_new_array: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            dataLog("[%4d] new_array\t %s, %s, %d\n", location, registerName(exec, dst).data(), registerName(exec, argv).data(), argc);
+            dataLog("[%4d] new_array\t %s, %s, %d", location, registerName(exec, dst).data(), registerName(exec, argv).data(), argc);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_new_array_buffer: {
             int dst = (++it)->u.operand;
             int argv = (++it)->u.operand;
             int argc = (++it)->u.operand;
-            dataLog("[%4d] new_array_buffer %s, %d, %d\n", location, registerName(exec, dst).data(), argv, argc);
+            dataLog("[%4d] new_array_buffer %s, %d, %d", location, registerName(exec, dst).data(), argv, argc);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_new_regexp: {
@@ -703,15 +732,17 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int re0 = (++it)->u.operand;
             dataLog("[%4d] new_regexp\t %s, ", location, registerName(exec, r0).data());
             if (r0 >=0 && r0 < (int)numberOfRegExps())
-                dataLog("%s\n", regexpName(re0, regexp(re0)).data());
+                dataLog("%s", regexpName(re0, regexp(re0)).data());
             else
-                dataLog("bad_regexp(%d)\n", re0);
+                dataLog("bad_regexp(%d)", re0);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_mov: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            dataLog("[%4d] mov\t\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] mov\t\t %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_not: {
@@ -760,12 +791,14 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_pre_inc: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] pre_inc\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] pre_inc\t\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_pre_dec: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] pre_dec\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] pre_dec\t\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_post_inc: {
@@ -837,7 +870,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_check_has_instance: {
             int base = (++it)->u.operand;
-            dataLog("[%4d] check_has_instance\t\t %s\n", location, registerName(exec, base).data());
+            dataLog("[%4d] check_has_instance\t\t %s", location, registerName(exec, base).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_instanceof: {
@@ -845,7 +879,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
             int r3 = (++it)->u.operand;
-            dataLog("[%4d] instanceof\t\t %s, %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data());
+            dataLog("[%4d] instanceof\t\t %s, %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_typeof: {
@@ -883,7 +918,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_resolve: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            dataLog("[%4d] resolve\t\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve\t\t %s, %s", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
@@ -891,14 +927,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            dataLog("[%4d] resolve_skip\t %s, %s, %d\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), skipLevels);
+            dataLog("[%4d] resolve_skip\t %s, %s, %d", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), skipLevels);
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            dataLog("[%4d] resolve_global\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_global\t %s, %s", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dumpBytecodeCommentAndNewLine(location);
             it += 3;
             break;
         }
@@ -908,7 +946,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             JSValue scope = JSValue((++it)->u.jsCell.get());
             ++it;
             int depth = (++it)->u.operand;
-            dataLog("[%4d] resolve_global_dynamic\t %s, %s, %s, %d\n", location, registerName(exec, r0).data(), valueToSourceString(exec, scope).utf8().data(), idName(id0, m_identifiers[id0]).data(), depth);
+            dataLog("[%4d] resolve_global_dynamic\t %s, %s, %s, %d", location, registerName(exec, r0).data(), valueToSourceString(exec, scope).utf8().data(), idName(id0, m_identifiers[id0]).data(), depth);
+            dumpBytecodeCommentAndNewLine(location);
             ++it;
             break;
         }
@@ -916,7 +955,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
-            dataLog("[%4d] get_scoped_var\t %s, %d, %d\n", location, registerName(exec, r0).data(), index, skipLevels);
+            dataLog("[%4d] get_scoped_var\t %s, %d, %d", location, registerName(exec, r0).data(), index, skipLevels);
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
@@ -924,20 +964,23 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int index = (++it)->u.operand;
             int skipLevels = (++it)->u.operand;
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] put_scoped_var\t %d, %d, %s\n", location, index, skipLevels, registerName(exec, r0).data());
+            dataLog("[%4d] put_scoped_var\t %d, %d, %s", location, index, skipLevels, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_get_global_var: {
             int r0 = (++it)->u.operand;
             WriteBarrier<Unknown>* registerPointer = (++it)->u.registerPointer;
-            dataLog("[%4d] get_global_var\t %s, g%d(%p)\n", location, registerName(exec, r0).data(), m_globalObject->findRegisterIndex(registerPointer), registerPointer);
+            dataLog("[%4d] get_global_var\t %s, g%d(%p)", location, registerName(exec, r0).data(), m_globalObject->findRegisterIndex(registerPointer), registerPointer);
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
         case op_get_global_var_watchable: {
             int r0 = (++it)->u.operand;
             WriteBarrier<Unknown>* registerPointer = (++it)->u.registerPointer;
-            dataLog("[%4d] get_global_var_watchable\t %s, g%d(%p)\n", location, registerName(exec, r0).data(), m_globalObject->findRegisterIndex(registerPointer), registerPointer);
+            dataLog("[%4d] get_global_var_watchable\t %s, g%d(%p)", location, registerName(exec, r0).data(), m_globalObject->findRegisterIndex(registerPointer), registerPointer);
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             it++;
             break;
@@ -945,13 +988,15 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_put_global_var: {
             WriteBarrier<Unknown>* registerPointer = (++it)->u.registerPointer;
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] put_global_var\t g%d(%p), %s\n", location, m_globalObject->findRegisterIndex(registerPointer), registerPointer, registerName(exec, r0).data());
+            dataLog("[%4d] put_global_var\t g%d(%p), %s", location, m_globalObject->findRegisterIndex(registerPointer), registerPointer, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_put_global_var_check: {
             WriteBarrier<Unknown>* registerPointer = (++it)->u.registerPointer;
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] put_global_var_check\t g%d(%p), %s\n", location, m_globalObject->findRegisterIndex(registerPointer), registerPointer, registerName(exec, r0).data());
+            dataLog("[%4d] put_global_var_check\t g%d(%p), %s", location, m_globalObject->findRegisterIndex(registerPointer), registerPointer, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             it++;
             break;
@@ -960,21 +1005,24 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int isStrict = (++it)->u.operand;
-            dataLog("[%4d] resolve_base%s\t %s, %s\n", location, isStrict ? "_strict" : "", registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_base%s\t %s, %s", location, isStrict ? "_strict" : "", registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
         case op_ensure_property_exists: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            dataLog("[%4d] ensure_property_exists\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] ensure_property_exists\t %s, %s", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_resolve_with_base: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            dataLog("[%4d] resolve_with_base %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_with_base %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
@@ -982,11 +1030,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            dataLog("[%4d] resolve_with_this %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] resolve_with_this %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
         case op_get_by_id:
+        case op_get_by_id_out_of_line:
         case op_get_by_id_self:
         case op_get_by_id_proto:
         case op_get_by_id_chain:
@@ -1001,7 +1051,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_get_string_length: {
             printGetByIdOp(exec, location, it);
             printGetByIdCacheStatus(exec, location);
-            dataLog("\n");
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_get_arguments_length: {
@@ -1013,6 +1063,10 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printPutByIdOp(exec, location, it, "put_by_id");
             break;
         }
+        case op_put_by_id_out_of_line: {
+            printPutByIdOp(exec, location, it, "put_by_id_out_of_line");
+            break;
+        }
         case op_put_by_id_replace: {
             printPutByIdOp(exec, location, it, "put_by_id_replace");
             break;
@@ -1025,10 +1079,18 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printPutByIdOp(exec, location, it, "put_by_id_transition_direct");
             break;
         }
+        case op_put_by_id_transition_direct_out_of_line: {
+            printPutByIdOp(exec, location, it, "put_by_id_transition_direct_out_of_line");
+            break;
+        }
         case op_put_by_id_transition_normal: {
             printPutByIdOp(exec, location, it, "put_by_id_transition_normal");
             break;
         }
+        case op_put_by_id_transition_normal_out_of_line: {
+            printPutByIdOp(exec, location, it, "put_by_id_transition_normal_out_of_line");
+            break;
+        }
         case op_put_by_id_generic: {
             printPutByIdOp(exec, location, it, "put_by_id_generic");
             break;
@@ -1038,7 +1100,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            dataLog("[%4d] put_getter_setter\t %s, %s, %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] put_getter_setter\t %s, %s, %s, %s", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_method_check: {
@@ -1070,7 +1133,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
                 dataLog(")");
             }
 #endif
-            dataLog("\n");
+            dumpBytecodeCommentAndNewLine(location);
             ++it;
             printGetByIdOp(exec, location, it);
             printGetByIdCacheStatus(exec, location);
@@ -1081,14 +1144,16 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            dataLog("[%4d] del_by_id\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dataLog("[%4d] del_by_id\t %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), idName(id0, m_identifiers[id0]).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_get_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            dataLog("[%4d] get_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] get_by_val\t %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
@@ -1096,7 +1161,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            dataLog("[%4d] get_argument_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] get_argument_by_val\t %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dumpBytecodeCommentAndNewLine(location);
             ++it;
             break;
         }
@@ -1107,38 +1173,44 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r3 = (++it)->u.operand;
             int r4 = (++it)->u.operand;
             int r5 = (++it)->u.operand;
-            dataLog("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), registerName(exec, r4).data(), registerName(exec, r5).data());
+            dataLog("[%4d] get_by_pname\t %s, %s, %s, %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), registerName(exec, r4).data(), registerName(exec, r5).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_put_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            dataLog("[%4d] put_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] put_by_val\t %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_del_by_val: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int r2 = (++it)->u.operand;
-            dataLog("[%4d] del_by_val\t %s, %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dataLog("[%4d] del_by_val\t %s, %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_put_by_index: {
             int r0 = (++it)->u.operand;
             unsigned n0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            dataLog("[%4d] put_by_index\t %s, %u, %s\n", location, registerName(exec, r0).data(), n0, registerName(exec, r1).data());
+            dataLog("[%4d] put_by_index\t %s, %u, %s", location, registerName(exec, r0).data(), n0, registerName(exec, r1).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jmp: {
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jmp\t\t %d(->%d)\n", location, offset, location + offset);
+            dataLog("[%4d] jmp\t\t %d(->%d)", location, offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_loop: {
             int offset = (++it)->u.operand;
-            dataLog("[%4d] loop\t\t %d(->%d)\n", location, offset, location + offset);
+            dataLog("[%4d] loop\t\t %d(->%d)", location, offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jtrue: {
@@ -1169,129 +1241,148 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             void* pointer = (++it)->u.pointer;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jneq_ptr\t\t %s, %p, %d(->%d)\n", location, registerName(exec, r0).data(), pointer, offset, location + offset);
+            dataLog("[%4d] jneq_ptr\t\t %s, %p, %d(->%d)", location, registerName(exec, r0).data(), pointer, offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jless\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jlesseq\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jgreater: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jgreater\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jgreater\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jgreatereq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jgreatereq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jgreatereq\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jnless\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jnlesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jnlesseq\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jngreater: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jngreater\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jngreater\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jngreatereq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jngreatereq\t\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] jngreatereq\t\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] loop_if_less\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_less\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_loop_if_lesseq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_lesseq\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_loop_if_greater: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] loop_if_greater\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_greater\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_loop_if_greatereq: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] loop_if_greatereq\t %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dataLog("[%4d] loop_if_greatereq\t %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_loop_hint: {
-            dataLog("[%4d] loop_hint\n", location);
+            dataLog("[%4d] loop_hint", location);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_switch_imm: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            dataLog("[%4d] switch_imm\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dataLog("[%4d] switch_imm\t %d, %d(->%d), %s", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_switch_char: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            dataLog("[%4d] switch_char\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dataLog("[%4d] switch_char\t %d, %d(->%d), %s", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_switch_string: {
             int tableIndex = (++it)->u.operand;
             int defaultTarget = (++it)->u.operand;
             int scrutineeRegister = (++it)->u.operand;
-            dataLog("[%4d] switch_string\t %d, %d(->%d), %s\n", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dataLog("[%4d] switch_string\t %d, %d(->%d), %s", location, tableIndex, defaultTarget, location + defaultTarget, registerName(exec, scrutineeRegister).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_new_func: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
             int shouldCheck = (++it)->u.operand;
-            dataLog("[%4d] new_func\t\t %s, f%d, %s\n", location, registerName(exec, r0).data(), f0, shouldCheck ? "<Checked>" : "<Unchecked>");
+            dataLog("[%4d] new_func\t\t %s, f%d, %s", location, registerName(exec, r0).data(), f0, shouldCheck ? "<Checked>" : "<Unchecked>");
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_new_func_exp: {
             int r0 = (++it)->u.operand;
             int f0 = (++it)->u.operand;
-            dataLog("[%4d] new_func_exp\t %s, f%d\n", location, registerName(exec, r0).data(), f0);
+            dataLog("[%4d] new_func_exp\t %s, f%d", location, registerName(exec, r0).data(), f0);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_call: {
@@ -1307,35 +1398,41 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int thisValue = (++it)->u.operand;
             int arguments = (++it)->u.operand;
             int firstFreeRegister = (++it)->u.operand;
-            dataLog("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(exec, callee).data(), registerName(exec, thisValue).data(), registerName(exec, arguments).data(), firstFreeRegister);
+            dataLog("[%4d] call_varargs\t %s, %s, %s, %d", location, registerName(exec, callee).data(), registerName(exec, thisValue).data(), registerName(exec, arguments).data(), firstFreeRegister);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            dataLog("[%4d] tear_off_activation\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] tear_off_activation\t %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_tear_off_arguments: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] tear_off_arguments %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] tear_off_arguments %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_ret: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] ret\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] ret\t\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_call_put_result: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] call_put_result\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] call_put_result\t\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             it++;
             break;
         }
         case op_ret_object_or_this: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            dataLog("[%4d] constructor_ret\t\t %s %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] constructor_ret\t\t %s %s", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_construct: {
@@ -1346,13 +1443,15 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
             int count = (++it)->u.operand;
-            dataLog("[%4d] strcat\t\t %s, %s, %d\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), count);
+            dataLog("[%4d] strcat\t\t %s, %s, %d", location, registerName(exec, r0).data(), registerName(exec, r1).data(), count);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_to_primitive: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            dataLog("[%4d] to_primitive\t %s, %s\n", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dataLog("[%4d] to_primitive\t %s, %s", location, registerName(exec, r0).data(), registerName(exec, r1).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_get_pnames: {
@@ -1361,7 +1460,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int r2 = it[3].u.operand;
             int r3 = it[4].u.operand;
             int offset = it[5].u.operand;
-            dataLog("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), offset, location + offset);
+            dataLog("[%4d] get_pnames\t %s, %s, %s, %s, %d(->%d)", location, registerName(exec, r0).data(), registerName(exec, r1).data(), registerName(exec, r2).data(), registerName(exec, r3).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             it += OPCODE_LENGTH(op_get_pnames) - 1;
             break;
         }
@@ -1372,67 +1472,79 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int size = it[4].u.operand;
             int iter = it[5].u.operand;
             int offset = it[6].u.operand;
-            dataLog("[%4d] next_pname\t %s, %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, dest).data(), registerName(exec, base).data(), registerName(exec, i).data(), registerName(exec, size).data(), registerName(exec, iter).data(), offset, location + offset);
+            dataLog("[%4d] next_pname\t %s, %s, %s, %s, %s, %d(->%d)", location, registerName(exec, dest).data(), registerName(exec, base).data(), registerName(exec, i).data(), registerName(exec, size).data(), registerName(exec, iter).data(), offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
         case op_push_scope: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] push_scope\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] push_scope\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_pop_scope: {
-            dataLog("[%4d] pop_scope\n", location);
+            dataLog("[%4d] pop_scope", location);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_push_new_scope: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
-            dataLog("[%4d] push_new_scope \t%s, %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
+            dataLog("[%4d] push_new_scope \t%s, %s, %s", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data(), registerName(exec, r1).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_jmp_scopes: {
             int scopeDelta = (++it)->u.operand;
             int offset = (++it)->u.operand;
-            dataLog("[%4d] jmp_scopes\t^%d, %d(->%d)\n", location, scopeDelta, offset, location + offset);
+            dataLog("[%4d] jmp_scopes\t^%d, %d(->%d)", location, scopeDelta, offset, location + offset);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_catch: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] catch\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] catch\t\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_throw: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] throw\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] throw\t\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_throw_reference_error: {
             int k0 = (++it)->u.operand;
-            dataLog("[%4d] throw_reference_error\t %s\n", location, constantName(exec, k0, getConstant(k0)).data());
+            dataLog("[%4d] throw_reference_error\t %s", location, constantName(exec, k0, getConstant(k0)).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_debug: {
             int debugHookID = (++it)->u.operand;
             int firstLine = (++it)->u.operand;
             int lastLine = (++it)->u.operand;
-            dataLog("[%4d] debug\t\t %s, %d, %d\n", location, debugHookName(debugHookID), firstLine, lastLine);
+            dataLog("[%4d] debug\t\t %s, %d, %d", location, debugHookName(debugHookID), firstLine, lastLine);
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_profile_will_call: {
             int function = (++it)->u.operand;
-            dataLog("[%4d] profile_will_call %s\n", location, registerName(exec, function).data());
+            dataLog("[%4d] profile_will_call %s", location, registerName(exec, function).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_profile_did_call: {
             int function = (++it)->u.operand;
-            dataLog("[%4d] profile_did_call\t %s\n", location, registerName(exec, function).data());
+            dataLog("[%4d] profile_did_call\t %s", location, registerName(exec, function).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
         case op_end: {
             int r0 = (++it)->u.operand;
-            dataLog("[%4d] end\t\t %s\n", location, registerName(exec, r0).data());
+            dataLog("[%4d] end\t\t %s", location, registerName(exec, r0).data());
+            dumpBytecodeCommentAndNewLine(location);
             break;
         }
     }
@@ -1595,12 +1707,13 @@ CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock& other, SymbolTable* symTab)
     , m_functionDecls(other.m_functionDecls)
     , m_functionExprs(other.m_functionExprs)
     , m_symbolTable(symTab)
-    , m_speculativeSuccessCounter(0)
-    , m_speculativeFailCounter(0)
-    , m_forcedOSRExitCounter(0)
+    , m_osrExitCounter(0)
     , m_optimizationDelayCounter(0)
     , m_reoptimizationRetryCounter(0)
     , m_lineInfo(other.m_lineInfo)
+#if ENABLE(BYTECODE_COMMENTS)
+    , m_bytecodeCommentIterator(0)
+#endif
 #if ENABLE(JIT)
     , m_canCompileWithDFGState(DFG::CapabilityLevelNotSet)
 #endif
@@ -1649,10 +1762,12 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
 #endif
     , m_symbolTable(symTab)
     , m_alternative(alternative)
-    , m_speculativeSuccessCounter(0)
-    , m_speculativeFailCounter(0)
+    , m_osrExitCounter(0)
     , m_optimizationDelayCounter(0)
     , m_reoptimizationRetryCounter(0)
+#if ENABLE(BYTECODE_COMMENTS)
+    , m_bytecodeCommentIterator(0)
+#endif
 {
     ASSERT(m_source);
     
@@ -1930,7 +2045,9 @@ void CodeBlock::finalizeUnconditionally()
             Instruction* curInstruction = &instructions()[m_propertyAccessInstructions[i]];
             switch (interpreter->getOpcodeID(curInstruction[0].u.opcode)) {
             case op_get_by_id:
+            case op_get_by_id_out_of_line:
             case op_put_by_id:
+            case op_put_by_id_out_of_line:
                 if (!curInstruction[4].u.structure || Heap::isMarked(curInstruction[4].u.structure.get()))
                     break;
                 if (verboseUnlinking)
@@ -1940,6 +2057,8 @@ void CodeBlock::finalizeUnconditionally()
                 break;
             case op_put_by_id_transition_direct:
             case op_put_by_id_transition_normal:
+            case op_put_by_id_transition_direct_out_of_line:
+            case op_put_by_id_transition_normal_out_of_line:
                 if (Heap::isMarked(curInstruction[4].u.structure.get())
                     && Heap::isMarked(curInstruction[6].u.structure.get())
                     && Heap::isMarked(curInstruction[7].u.structureChain.get()))
@@ -2127,6 +2246,82 @@ void CodeBlock::stronglyVisitWeakReferences(SlotVisitor& visitor)
 #endif    
 }
 
+#if ENABLE(BYTECODE_COMMENTS)
+// Finds the comment string for the specified bytecode offset/PC is available. 
+const char* CodeBlock::commentForBytecodeOffset(unsigned bytecodeOffset)
+{
+    ASSERT(bytecodeOffset < instructions().size());
+
+    Vector<Comment>& comments = m_bytecodeComments;
+    size_t numberOfComments = comments.size();
+    const char* result = 0;
+
+    if (!numberOfComments)
+        return 0; // No comments to match with.
+
+    // The next match is most likely the next comment in the list.
+    // Do a quick check to see if that is a match first.
+    // m_bytecodeCommentIterator should already be pointing to the
+    // next comment we should check.
+
+    ASSERT(m_bytecodeCommentIterator < comments.size());
+
+    size_t i = m_bytecodeCommentIterator;
+    size_t commentPC = comments[i].pc;
+    if (commentPC == bytecodeOffset) {
+        // We've got a match. All done!
+        m_bytecodeCommentIterator = i;
+        result = comments[i].string;
+    } else if (commentPC > bytecodeOffset) {
+        // The current comment is already greater than the requested PC.
+        // Start searching from the first comment.
+        i = 0;
+    } else {
+        // Otherwise, the current comment's PC is less than the requested PC.
+        // Hence, we can just start searching from the next comment in the
+        // list.
+        i++;
+    }
+
+    // If the result is still not found, do a linear search in the range
+    // that we've determined above.
+    if (!result) {
+        for (; i < comments.size(); ++i) {
+            commentPC = comments[i].pc;
+            if (commentPC == bytecodeOffset) {
+                result = comments[i].string;
+                break;
+            }
+            if (comments[i].pc > bytecodeOffset) {
+                // The current comment PC is already past the requested
+                // bytecodeOffset. Hence, there are no more possible
+                // matches. Just fail.
+                break;
+            }
+        }
+    }
+
+    // Update the iterator to point to the next comment.
+    if (++i >= numberOfComments) {
+        // At most point to the last comment entry. This ensures that the
+        // next time we call this function, the quick checks will at least
+        // have one entry to check and can fail fast if appropriate.
+        i = numberOfComments - 1;
+    }
+    m_bytecodeCommentIterator = i;
+    return result;
+}
+
+void CodeBlock::dumpBytecodeComments()
+{
+    Vector<Comment>& comments = m_bytecodeComments;
+    printf("Comments for codeblock %p: size %lu\n", this, comments.size());
+    for (size_t i = 0; i < comments.size(); ++i)
+        printf("     pc %lu : '%s'\n", comments[i].pc, comments[i].string);
+    printf("End of comments for codeblock %p\n", this);
+}
+#endif // ENABLE_BYTECODE_COMMENTS
+
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 {
     ASSERT(bytecodeOffset < instructions().size());
@@ -2303,6 +2498,8 @@ void CodeBlock::shrinkToFit(ShrinkMode shrinkMode)
         m_dfgData->speculationRecovery.shrinkToFit();
         m_dfgData->weakReferences.shrinkToFit();
         m_dfgData->transitions.shrinkToFit();
+        m_dfgData->minifiedDFG.prepareAndShrink();
+        m_dfgData->variableEventStream.shrinkToFit();
     }
 #endif
 }
@@ -2596,7 +2793,7 @@ bool CodeBlock::shouldOptimizeNow()
     dumpValueProfiles();
 #endif
 
-    if (m_optimizationDelayCounter >= Options::maximumOptimizationDelay)
+    if (m_optimizationDelayCounter >= Options::maximumOptimizationDelay())
         return true;
     
     unsigned numberOfLiveNonArgumentValueProfiles;
@@ -2607,9 +2804,9 @@ bool CodeBlock::shouldOptimizeNow()
     dataLog("Profile hotness: %lf, %lf\n", (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles(), (double)numberOfSamplesInProfiles / ValueProfile::numberOfBuckets / numberOfValueProfiles());
 #endif
 
-    if ((!numberOfValueProfiles() || (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles() >= Options::desiredProfileLivenessRate)
-        && (!totalNumberOfValueProfiles() || (double)numberOfSamplesInProfiles / ValueProfile::numberOfBuckets / totalNumberOfValueProfiles() >= Options::desiredProfileFullnessRate)
-        && static_cast<unsigned>(m_optimizationDelayCounter) + 1 >= Options::minimumOptimizationDelay)
+    if ((!numberOfValueProfiles() || (double)numberOfLiveNonArgumentValueProfiles / numberOfValueProfiles() >= Options::desiredProfileLivenessRate())
+        && (!totalNumberOfValueProfiles() || (double)numberOfSamplesInProfiles / ValueProfile::numberOfBuckets / totalNumberOfValueProfiles() >= Options::desiredProfileFullnessRate())
+        && static_cast<unsigned>(m_optimizationDelayCounter) + 1 >= Options::minimumOptimizationDelay())
         return true;
     
     ASSERT(m_optimizationDelayCounter < std::numeric_limits<uint8_t>::max());
@@ -2670,7 +2867,7 @@ void CodeBlock::dumpValueProfiles()
         dataLog("   bc = %d: %u\n", profile->m_bytecodeOffset, profile->m_counter);
     }
 }
-#endif
+#endif // ENABLE(VERBOSE_VALUE_PROFILE)
 
 size_t CodeBlock::predictedMachineCodeSize()
 {
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
index 4e4fee2b7..ed072f832 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -35,12 +35,15 @@
 #include "CallReturnOffsetToBytecodeOffset.h"
 #include "CodeOrigin.h"
 #include "CodeType.h"
+#include "Comment.h"
 #include "CompactJITCodeMap.h"
 #include "DFGCodeBlocks.h"
 #include "DFGCommon.h"
 #include "DFGExitProfile.h"
+#include "DFGMinifiedGraph.h"
 #include "DFGOSREntry.h"
 #include "DFGOSRExit.h"
+#include "DFGVariableEventStream.h"
 #include "EvalCodeCache.h"
 #include "ExecutionCounter.h"
 #include "ExpressionRangeInfo.h"
@@ -66,10 +69,35 @@
 #include <wtf/RefCountedArray.h>
 #include <wtf/FastAllocBase.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
 
+// Set ENABLE_BYTECODE_COMMENTS to 1 to enable recording bytecode generator
+// comments for the bytecodes that it generates. This will allow
+// CodeBlock::dump() to provide some contextual info about the bytecodes.
+//
+// The way this comment system works is as follows:
+// 1. The BytecodeGenerator calls prependComment() with a constant comment
+//    string in .text. The string must not be a stack or heap allocated
+//    string.
+// 2. When the BytecodeGenerator's emitOpcode() is called, the last
+//    prepended comment will be recorded with the PC of the opcode being
+//    emitted. This comment is being recorded in the CodeBlock's
+//    m_bytecodeComments.
+// 3. When CodeBlock::dump() is called, it will pair up the comments with
+//    their corresponding bytecodes based on the bytecode and comment's
+//    PC. If a matching pair is found, the comment will be printed after
+//    the bytecode. If not, no comment is printed.
+//
+// NOTE: Enabling this will consume additional memory at runtime to store
+// the comments. Since these comments are only useful for VM debugging
+// (as opposed to app debugging), this feature is to be disabled by default,
+// and can be enabled as needed for VM development use only.
+
+#define ENABLE_BYTECODE_COMMENTS 0
+
 namespace JSC {
 
     class DFGCodeBlocks;
@@ -155,6 +183,12 @@ namespace JSC {
             return index >= m_numVars;
         }
 
+        void dumpBytecodeCommentAndNewLine(int location);
+#if ENABLE(BYTECODE_COMMENTS)
+        const char* commentForBytecodeOffset(unsigned bytecodeOffset);
+        void dumpBytecodeComments();
+#endif
+
         HandlerInfo* handlerForBytecodeOffset(unsigned bytecodeOffset);
         int lineNumberForBytecodeOffset(unsigned bytecodeOffset);
         void expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset);
@@ -350,6 +384,18 @@ namespace JSC {
             m_dfgData->transitions.append(
                 WeakReferenceTransition(*globalData(), ownerExecutable(), codeOrigin, from, to));
         }
+        
+        DFG::MinifiedGraph& minifiedDFG()
+        {
+            createDFGDataIfNecessary();
+            return m_dfgData->minifiedDFG;
+        }
+        
+        DFG::VariableEventStream& variableEventStream()
+        {
+            createDFGDataIfNecessary();
+            return m_dfgData->variableEventStream;
+        }
 #endif
 
         unsigned bytecodeOffset(Instruction* returnAddress)
@@ -365,6 +411,10 @@ namespace JSC {
         RefCountedArray<Instruction>& instructions() { return m_instructions; }
         const RefCountedArray<Instruction>& instructions() const { return m_instructions; }
         
+#if ENABLE(BYTECODE_COMMENTS)
+        Vector<Comment>& bytecodeComments() { return m_bytecodeComments; }
+#endif
+
         size_t predictedMachineCodeSize();
         
         bool usesOpcode(OpcodeID);
@@ -635,7 +685,7 @@ namespace JSC {
             if (!numberOfRareCaseProfiles())
                 return false;
             unsigned value = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
-            return value >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
+            return value >= Options::likelyToTakeSlowCaseMinimumCount() && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold();
         }
         
         bool couldTakeSlowCase(int bytecodeOffset)
@@ -643,7 +693,7 @@ namespace JSC {
             if (!numberOfRareCaseProfiles())
                 return false;
             unsigned value = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
-            return value >= Options::couldTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::couldTakeSlowCaseThreshold;
+            return value >= Options::couldTakeSlowCaseMinimumCount() && static_cast<double>(value) / m_executionEntryCount >= Options::couldTakeSlowCaseThreshold();
         }
         
         RareCaseProfile* addSpecialFastCaseProfile(int bytecodeOffset)
@@ -663,7 +713,15 @@ namespace JSC {
             if (!numberOfRareCaseProfiles())
                 return false;
             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
-            return specialFastCaseCount >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(specialFastCaseCount) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
+            return specialFastCaseCount >= Options::likelyToTakeSlowCaseMinimumCount() && static_cast<double>(specialFastCaseCount) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold();
+        }
+        
+        bool couldTakeSpecialFastCase(int bytecodeOffset)
+        {
+            if (!numberOfRareCaseProfiles())
+                return false;
+            unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
+            return specialFastCaseCount >= Options::couldTakeSlowCaseMinimumCount() && static_cast<double>(specialFastCaseCount) / m_executionEntryCount >= Options::couldTakeSlowCaseThreshold();
         }
         
         bool likelyToTakeDeepestSlowCase(int bytecodeOffset)
@@ -673,7 +731,7 @@ namespace JSC {
             unsigned slowCaseCount = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned value = slowCaseCount - specialFastCaseCount;
-            return value >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
+            return value >= Options::likelyToTakeSlowCaseMinimumCount() && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold();
         }
         
         bool likelyToTakeAnySlowCase(int bytecodeOffset)
@@ -683,7 +741,7 @@ namespace JSC {
             unsigned slowCaseCount = rareCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned specialFastCaseCount = specialFastCaseProfileForBytecodeOffset(bytecodeOffset)->m_counter;
             unsigned value = slowCaseCount + specialFastCaseCount;
-            return value >= Options::likelyToTakeSlowCaseMinimumCount && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold;
+            return value >= Options::likelyToTakeSlowCaseMinimumCount() && static_cast<double>(value) / m_executionEntryCount >= Options::likelyToTakeSlowCaseThreshold();
         }
         
         unsigned executionEntryCount() const { return m_executionEntryCount; }
@@ -905,12 +963,12 @@ namespace JSC {
         
         void jitAfterWarmUp()
         {
-            m_llintExecuteCounter.setNewThreshold(Options::thresholdForJITAfterWarmUp, this);
+            m_llintExecuteCounter.setNewThreshold(Options::thresholdForJITAfterWarmUp(), this);
         }
         
         void jitSoon()
         {
-            m_llintExecuteCounter.setNewThreshold(Options::thresholdForJITSoon, this);
+            m_llintExecuteCounter.setNewThreshold(Options::thresholdForJITSoon(), this);
         }
         
         const ExecutionCounter& llintExecuteCounter() const
@@ -941,25 +999,25 @@ namespace JSC {
         // to avoid thrashing.
         unsigned reoptimizationRetryCounter() const
         {
-            ASSERT(m_reoptimizationRetryCounter <= Options::reoptimizationRetryCounterMax);
+            ASSERT(m_reoptimizationRetryCounter <= Options::reoptimizationRetryCounterMax());
             return m_reoptimizationRetryCounter;
         }
         
         void countReoptimization()
         {
             m_reoptimizationRetryCounter++;
-            if (m_reoptimizationRetryCounter > Options::reoptimizationRetryCounterMax)
-                m_reoptimizationRetryCounter = Options::reoptimizationRetryCounterMax;
+            if (m_reoptimizationRetryCounter > Options::reoptimizationRetryCounterMax())
+                m_reoptimizationRetryCounter = Options::reoptimizationRetryCounterMax();
         }
         
         int32_t counterValueForOptimizeAfterWarmUp()
         {
-            return Options::thresholdForOptimizeAfterWarmUp << reoptimizationRetryCounter();
+            return Options::thresholdForOptimizeAfterWarmUp() << reoptimizationRetryCounter();
         }
         
         int32_t counterValueForOptimizeAfterLongWarmUp()
         {
-            return Options::thresholdForOptimizeAfterLongWarmUp << reoptimizationRetryCounter();
+            return Options::thresholdForOptimizeAfterLongWarmUp() << reoptimizationRetryCounter();
         }
         
         int32_t* addressOfJITExecuteCounter()
@@ -1039,62 +1097,51 @@ namespace JSC {
         // in the baseline code.
         void optimizeSoon()
         {
-            m_jitExecuteCounter.setNewThreshold(Options::thresholdForOptimizeSoon << reoptimizationRetryCounter(), this);
+            m_jitExecuteCounter.setNewThreshold(Options::thresholdForOptimizeSoon() << reoptimizationRetryCounter(), this);
         }
         
-        // The speculative JIT tracks its success rate, so that we can
-        // decide when to reoptimize. It's interesting to note that these
-        // counters may overflow without any protection. The success
-        // counter will overflow before the fail one does, becuase the
-        // fail one is used as a trigger to reoptimize. So the worst case
-        // is that the success counter overflows and we reoptimize without
-        // needing to. But this is harmless. If a method really did
-        // execute 2^32 times then compiling it again probably won't hurt
-        // anyone.
+        uint32_t osrExitCounter() const { return m_osrExitCounter; }
         
-        void countSpeculationSuccess()
-        {
-            m_speculativeSuccessCounter++;
+        void countOSRExit() { m_osrExitCounter++; }
+        
+        uint32_t* addressOfOSRExitCounter() { return &m_osrExitCounter; }
+        
+        static ptrdiff_t offsetOfOSRExitCounter() { return OBJECT_OFFSETOF(CodeBlock, m_osrExitCounter); }
+
+#if ENABLE(JIT)
+        uint32_t adjustedExitCountThreshold(uint32_t desiredThreshold)
+        {
+            ASSERT(getJITType() == JITCode::DFGJIT);
+            // Compute this the lame way so we don't saturate. This is called infrequently
+            // enough that this loop won't hurt us.
+            unsigned result = desiredThreshold;
+            for (unsigned n = baselineVersion()->reoptimizationRetryCounter(); n--;) {
+                unsigned newResult = result << 1;
+                if (newResult < result)
+                    return std::numeric_limits<uint32_t>::max();
+                result = newResult;
+            }
+            return result;
         }
         
-        void countSpeculationFailure()
+        uint32_t exitCountThresholdForReoptimization()
         {
-            m_speculativeFailCounter++;
+            return adjustedExitCountThreshold(Options::osrExitCountForReoptimization());
         }
         
-        uint32_t speculativeSuccessCounter() const { return m_speculativeSuccessCounter; }
-        uint32_t speculativeFailCounter() const { return m_speculativeFailCounter; }
-        uint32_t forcedOSRExitCounter() const { return m_forcedOSRExitCounter; }
-        
-        uint32_t* addressOfSpeculativeSuccessCounter() { return &m_speculativeSuccessCounter; }
-        uint32_t* addressOfSpeculativeFailCounter() { return &m_speculativeFailCounter; }
-        uint32_t* addressOfForcedOSRExitCounter() { return &m_forcedOSRExitCounter; }
-        
-        static ptrdiff_t offsetOfSpeculativeSuccessCounter() { return OBJECT_OFFSETOF(CodeBlock, m_speculativeSuccessCounter); }
-        static ptrdiff_t offsetOfSpeculativeFailCounter() { return OBJECT_OFFSETOF(CodeBlock, m_speculativeFailCounter); }
-        static ptrdiff_t offsetOfForcedOSRExitCounter() { return OBJECT_OFFSETOF(CodeBlock, m_forcedOSRExitCounter); }
-
-#if ENABLE(JIT)
-        // The number of failures that triggers the use of the ratio.
-        unsigned largeFailCountThreshold() { return Options::largeFailCountThresholdBase << baselineVersion()->reoptimizationRetryCounter(); }
-        unsigned largeFailCountThresholdForLoop() { return Options::largeFailCountThresholdBaseForLoop << baselineVersion()->reoptimizationRetryCounter(); }
+        uint32_t exitCountThresholdForReoptimizationFromLoop()
+        {
+            return adjustedExitCountThreshold(Options::osrExitCountForReoptimizationFromLoop());
+        }
 
         bool shouldReoptimizeNow()
         {
-            return (Options::desiredSpeculativeSuccessFailRatio *
-                        speculativeFailCounter() >= speculativeSuccessCounter()
-                    && speculativeFailCounter() >= largeFailCountThreshold())
-                || forcedOSRExitCounter() >=
-                       Options::forcedOSRExitCountForReoptimization;
+            return osrExitCounter() >= exitCountThresholdForReoptimization();
         }
-
+        
         bool shouldReoptimizeFromLoopNow()
         {
-            return (Options::desiredSpeculativeSuccessFailRatio *
-                        speculativeFailCounter() >= speculativeSuccessCounter()
-                    && speculativeFailCounter() >= largeFailCountThresholdForLoop())
-                || forcedOSRExitCounter() >=
-                       Options::forcedOSRExitCountForReoptimization;
+            return osrExitCounter() >= exitCountThresholdForReoptimizationFromLoop();
         }
 #endif
 
@@ -1255,6 +1302,8 @@ namespace JSC {
             SegmentedVector<Watchpoint, 1, 0> watchpoints;
             Vector<WeakReferenceTransition> transitions;
             Vector<WriteBarrier<JSCell> > weakReferences;
+            DFG::VariableEventStream variableEventStream;
+            DFG::MinifiedGraph minifiedDFG;
             bool mayBeExecuting;
             bool isJettisoned;
             bool livenessHasBeenProved; // Initialized and used on every GC.
@@ -1295,13 +1344,15 @@ namespace JSC {
         
         ExecutionCounter m_jitExecuteCounter;
         int32_t m_totalJITExecutions;
-        uint32_t m_speculativeSuccessCounter;
-        uint32_t m_speculativeFailCounter;
-        uint32_t m_forcedOSRExitCounter;
+        uint32_t m_osrExitCounter;
         uint16_t m_optimizationDelayCounter;
         uint16_t m_reoptimizationRetryCounter;
 
         Vector<LineInfo> m_lineInfo;
+#if ENABLE(BYTECODE_COMMENTS)
+        Vector<Comment>  m_bytecodeComments;
+        size_t m_bytecodeCommentIterator;
+#endif
 
         struct RareData {
            WTF_MAKE_FAST_ALLOCATED;
diff --git a/Source/JavaScriptCore/bytecode/Comment.h b/Source/JavaScriptCore/bytecode/Comment.h
new file mode 100644
index 000000000..c28f3a068
--- /dev/null
+++ b/Source/JavaScriptCore/bytecode/Comment.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Comment_h
+#define Comment_h
+
+namespace JSC {
+
+struct Comment {
+    size_t pc;
+    const char* string;
+};
+
+} // namespace JSC
+
+#endif // Comment_h
diff --git a/Source/JavaScriptCore/bytecode/DataFormat.h b/Source/JavaScriptCore/bytecode/DataFormat.h
index 4f015486a..51c8afbf6 100644
--- a/Source/JavaScriptCore/bytecode/DataFormat.h
+++ b/Source/JavaScriptCore/bytecode/DataFormat.h
@@ -47,7 +47,14 @@ enum DataFormat {
     DataFormatJSInteger = DataFormatJS | DataFormatInteger,
     DataFormatJSDouble = DataFormatJS | DataFormatDouble,
     DataFormatJSCell = DataFormatJS | DataFormatCell,
-    DataFormatJSBoolean = DataFormatJS | DataFormatBoolean
+    DataFormatJSBoolean = DataFormatJS | DataFormatBoolean,
+    
+    // Marker deliminating ordinary data formats and OSR-only data formats.
+    DataFormatOSRMarker = 32, 
+    
+    // Special data formats used only for OSR.
+    DataFormatDead = 33, // Implies jsUndefined().
+    DataFormatArguments = 34 // Implies that the arguments object must be reified.
 };
 
 inline const char* dataFormatToString(DataFormat dataFormat)
diff --git a/Source/JavaScriptCore/bytecode/ExecutionCounter.cpp b/Source/JavaScriptCore/bytecode/ExecutionCounter.cpp
index 1f2e8260a..12a404981 100644
--- a/Source/JavaScriptCore/bytecode/ExecutionCounter.cpp
+++ b/Source/JavaScriptCore/bytecode/ExecutionCounter.cpp
@@ -144,13 +144,7 @@ bool ExecutionCounter::setThreshold(CodeBlock* codeBlock)
         return true;
     }
 
-    int32_t maxThreshold;
-    if (Options::randomizeExecutionCountsBetweenCheckpoints)
-        maxThreshold = codeBlock->globalObject()->weakRandomInteger() % Options::maximumExecutionCountsBetweenCheckpoints;
-    else
-        maxThreshold = Options::maximumExecutionCountsBetweenCheckpoints;
-    if (threshold > maxThreshold)
-        threshold = maxThreshold;
+    threshold = clippedThreshold(codeBlock->globalObject(), threshold);
     
     m_counter = static_cast<int32_t>(-threshold);
         
diff --git a/Source/JavaScriptCore/bytecode/ExecutionCounter.h b/Source/JavaScriptCore/bytecode/ExecutionCounter.h
index 1c0d23f0f..f40650a31 100644
--- a/Source/JavaScriptCore/bytecode/ExecutionCounter.h
+++ b/Source/JavaScriptCore/bytecode/ExecutionCounter.h
@@ -26,6 +26,8 @@
 #ifndef ExecutionCounter_h
 #define ExecutionCounter_h
 
+#include "JSGlobalObject.h"
+#include "Options.h"
 #include <wtf/SimpleStats.h>
 
 namespace JSC {
@@ -42,6 +44,18 @@ public:
     const char* status() const;
     static double applyMemoryUsageHeuristics(int32_t value, CodeBlock*);
     static int32_t applyMemoryUsageHeuristicsAndConvertToInt(int32_t value, CodeBlock*);
+    template<typename T>
+    static T clippedThreshold(JSGlobalObject* globalObject, T threshold)
+    {
+        int32_t maxThreshold;
+        if (Options::randomizeExecutionCountsBetweenCheckpoints())
+            maxThreshold = globalObject->weakRandomInteger() % Options::maximumExecutionCountsBetweenCheckpoints();
+        else
+            maxThreshold = Options::maximumExecutionCountsBetweenCheckpoints();
+        if (threshold > maxThreshold)
+            threshold = maxThreshold;
+        return threshold;
+    }
 
     static int32_t formattedTotalCount(float value)
     {
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
index a62a43f7f..cb3e8e8b6 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
@@ -48,9 +48,9 @@ GetByIdStatus GetByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
     
     unsigned attributesIgnored;
     JSCell* specificValue;
-    size_t offset = structure->get(
+    PropertyOffset offset = structure->get(
         *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
-    if (offset == notFound)
+    if (!isValidOffset(offset))
         return GetByIdStatus(NoInformation, false);
     
     return GetByIdStatus(Simple, false, StructureSet(structure), offset, specificValue);
@@ -88,7 +88,7 @@ void GetByIdStatus::computeForChain(GetByIdStatus& result, CodeBlock* profiledBl
         
     result.m_offset = currentStructure->get(
         *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
-    if (result.m_offset == notFound)
+    if (!isValidOffset(result.m_offset))
         return;
         
     result.m_structureSet.add(structure);
@@ -156,12 +156,12 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
         result.m_offset = structure->get(
             *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
         
-        if (result.m_offset != notFound) {
+        if (isValidOffset(result.m_offset)) {
             result.m_structureSet.add(structure);
             result.m_specificValue = JSValue(specificValue);
         }
         
-        if (result.m_offset != notFound)
+        if (isValidOffset(result.m_offset))
             ASSERT(result.m_structureSet.size());
         break;
     }
@@ -176,11 +176,11 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
             
             unsigned attributesIgnored;
             JSCell* specificValue;
-            size_t myOffset = structure->get(
+            PropertyOffset myOffset = structure->get(
                 *profiledBlock->globalData(), ident, attributesIgnored, specificValue);
             
-            if (myOffset == notFound) {
-                result.m_offset = notFound;
+            if (!isValidOffset(myOffset)) {
+                result.m_offset = invalidOffset;
                 break;
             }
                     
@@ -188,7 +188,7 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
                 result.m_offset = myOffset;
                 result.m_specificValue = JSValue(specificValue);
             } else if (result.m_offset != myOffset) {
-                result.m_offset = notFound;
+                result.m_offset = invalidOffset;
                 break;
             } else if (result.m_specificValue != JSValue(specificValue))
                 result.m_specificValue = JSValue();
@@ -196,7 +196,7 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
             result.m_structureSet.add(structure);
         }
                     
-        if (result.m_offset != notFound)
+        if (isValidOffset(result.m_offset))
             ASSERT(result.m_structureSet.size());
         break;
     }
@@ -223,11 +223,11 @@ GetByIdStatus GetByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
     }
         
     default:
-        ASSERT(result.m_offset == notFound);
+        ASSERT(!isValidOffset(result.m_offset));
         break;
     }
     
-    if (result.m_offset == notFound) {
+    if (!isValidOffset(result.m_offset)) {
         result.m_state = TakesSlowPath;
         result.m_structureSet.clear();
         result.m_chain.clear();
diff --git a/Source/JavaScriptCore/bytecode/GetByIdStatus.h b/Source/JavaScriptCore/bytecode/GetByIdStatus.h
index 42eadfd68..297ec335f 100644
--- a/Source/JavaScriptCore/bytecode/GetByIdStatus.h
+++ b/Source/JavaScriptCore/bytecode/GetByIdStatus.h
@@ -26,6 +26,7 @@
 #ifndef GetByIdStatus_h
 #define GetByIdStatus_h
 
+#include "PropertyOffset.h"
 #include "StructureSet.h"
 #include <wtf/NotFound.h>
 
@@ -46,13 +47,13 @@ public:
 
     GetByIdStatus()
         : m_state(NoInformation)
-        , m_offset(notFound)
+        , m_offset(invalidOffset)
     {
     }
     
     GetByIdStatus(
         State state, bool wasSeenInJIT, const StructureSet& structureSet = StructureSet(),
-        size_t offset = notFound, JSValue specificValue = JSValue(), Vector<Structure*> chain = Vector<Structure*>())
+        size_t offset = invalidOffset, JSValue specificValue = JSValue(), Vector<Structure*> chain = Vector<Structure*>())
         : m_state(state)
         , m_structureSet(structureSet)
         , m_chain(chain)
@@ -76,7 +77,7 @@ public:
     const StructureSet& structureSet() const { return m_structureSet; }
     const Vector<Structure*>& chain() const { return m_chain; } // Returns empty vector if this is a direct access.
     JSValue specificValue() const { return m_specificValue; } // Returns JSValue() if there is no specific value.
-    size_t offset() const { return m_offset; }
+    PropertyOffset offset() const { return m_offset; }
     
     bool wasSeenInJIT() const { return m_wasSeenInJIT; }
     
@@ -88,7 +89,7 @@ private:
     StructureSet m_structureSet;
     Vector<Structure*> m_chain;
     JSValue m_specificValue;
-    size_t m_offset;
+    PropertyOffset m_offset;
     bool m_wasSeenInJIT;
 };
 
diff --git a/Source/JavaScriptCore/bytecode/Instruction.h b/Source/JavaScriptCore/bytecode/Instruction.h
index 6e76512ff..2e94b452c 100644
--- a/Source/JavaScriptCore/bytecode/Instruction.h
+++ b/Source/JavaScriptCore/bytecode/Instruction.h
@@ -29,6 +29,7 @@
 #ifndef Instruction_h
 #define Instruction_h
 
+#include "JITStubRoutine.h"
 #include "MacroAssembler.h"
 #include "Opcode.h"
 #include "PropertySlot.h"
@@ -52,8 +53,6 @@ namespace JSC {
     struct ValueProfile;
 
 #if ENABLE(JIT)
-    typedef MacroAssemblerCodeRef PolymorphicAccessStructureListStubRoutineType;
-
     // Structure used by op_get_by_id_self_list and op_get_by_id_proto_list instruction to hold data off the main opcode stream.
     struct PolymorphicAccessStructureList {
         WTF_MAKE_FAST_ALLOCATED;
@@ -61,7 +60,7 @@ namespace JSC {
         struct PolymorphicStubInfo {
             bool isChain;
             bool isDirect;
-            PolymorphicAccessStructureListStubRoutineType stubRoutine;
+            RefPtr<JITStubRoutine> stubRoutine;
             WriteBarrier<Structure> base;
             union {
                 WriteBarrierBase<Structure> proto;
@@ -73,7 +72,7 @@ namespace JSC {
                 u.proto.clear();
             }
 
-            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, bool isDirect)
+            void set(JSGlobalData& globalData, JSCell* owner, PassRefPtr<JITStubRoutine> _stubRoutine, Structure* _base, bool isDirect)
             {
                 stubRoutine = _stubRoutine;
                 base.set(globalData, owner, _base);
@@ -82,7 +81,7 @@ namespace JSC {
                 this->isDirect = isDirect;
             }
             
-            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto, bool isDirect)
+            void set(JSGlobalData& globalData, JSCell* owner, PassRefPtr<JITStubRoutine> _stubRoutine, Structure* _base, Structure* _proto, bool isDirect)
             {
                 stubRoutine = _stubRoutine;
                 base.set(globalData, owner, _base);
@@ -91,7 +90,7 @@ namespace JSC {
                 this->isDirect = isDirect;
             }
             
-            void set(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain, bool isDirect)
+            void set(JSGlobalData& globalData, JSCell* owner, PassRefPtr<JITStubRoutine> _stubRoutine, Structure* _base, StructureChain* _chain, bool isDirect)
             {
                 stubRoutine = _stubRoutine;
                 base.set(globalData, owner, _base);
@@ -105,17 +104,17 @@ namespace JSC {
         {
         }
         
-        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, bool isDirect)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PassRefPtr<JITStubRoutine> stubRoutine, Structure* firstBase, bool isDirect)
         {
             list[0].set(globalData, owner, stubRoutine, firstBase, isDirect);
         }
 
-        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto, bool isDirect)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PassRefPtr<JITStubRoutine> stubRoutine, Structure* firstBase, Structure* firstProto, bool isDirect)
         {
             list[0].set(globalData, owner, stubRoutine, firstBase, firstProto, isDirect);
         }
 
-        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain, bool isDirect)
+        PolymorphicAccessStructureList(JSGlobalData& globalData, JSCell* owner, PassRefPtr<JITStubRoutine> stubRoutine, Structure* firstBase, StructureChain* firstChain, bool isDirect)
         {
             list[0].set(globalData, owner, stubRoutine, firstBase, firstChain, isDirect);
         }
diff --git a/Source/JavaScriptCore/bytecode/Opcode.h b/Source/JavaScriptCore/bytecode/Opcode.h
index e0cff165a..14cefb9d9 100644
--- a/Source/JavaScriptCore/bytecode/Opcode.h
+++ b/Source/JavaScriptCore/bytecode/Opcode.h
@@ -108,6 +108,7 @@ namespace JSC {
         macro(op_resolve_with_base, 5) /* has value profiling */ \
         macro(op_resolve_with_this, 5) /* has value profiling */ \
         macro(op_get_by_id, 9) /* has value profiling */ \
+        macro(op_get_by_id_out_of_line, 9) /* has value profiling */ \
         macro(op_get_by_id_self, 9) /* has value profiling */ \
         macro(op_get_by_id_proto, 9) /* has value profiling */ \
         macro(op_get_by_id_chain, 9) /* has value profiling */ \
@@ -122,9 +123,12 @@ namespace JSC {
         macro(op_get_string_length, 9) /* has value profiling */ \
         macro(op_get_arguments_length, 4) \
         macro(op_put_by_id, 9) \
+        macro(op_put_by_id_out_of_line, 9) \
         macro(op_put_by_id_transition, 9) \
         macro(op_put_by_id_transition_direct, 9) \
+        macro(op_put_by_id_transition_direct_out_of_line, 9) \
         macro(op_put_by_id_transition_normal, 9) \
+        macro(op_put_by_id_transition_normal_out_of_line, 9) \
         macro(op_put_by_id_replace, 9) \
         macro(op_put_by_id_generic, 9) \
         macro(op_del_by_id, 4) \
diff --git a/Source/JavaScriptCore/bytecode/Operands.h b/Source/JavaScriptCore/bytecode/Operands.h
index 05a24d0fd..8ea3e5b60 100644
--- a/Source/JavaScriptCore/bytecode/Operands.h
+++ b/Source/JavaScriptCore/bytecode/Operands.h
@@ -115,6 +115,13 @@ public:
     
     const T& operand(int operand) const { return const_cast<const T&>(const_cast<Operands*>(this)->operand(operand)); }
     
+    bool hasOperand(int operand) const
+    {
+        if (operandIsArgument(operand))
+            return true;
+        return static_cast<size_t>(operand) < numberOfLocals();
+    }
+    
     void setOperand(int operand, const T& value)
     {
         if (operandIsArgument(operand)) {
@@ -126,6 +133,39 @@ public:
         setLocal(operand, value);
     }
     
+    size_t size() const { return numberOfArguments() + numberOfLocals(); }
+    const T& at(size_t index) const
+    {
+        if (index < numberOfArguments())
+            return m_arguments[index];
+        return m_locals[index - numberOfArguments()];
+    }
+    T& at(size_t index)
+    {
+        if (index < numberOfArguments())
+            return m_arguments[index];
+        return m_locals[index - numberOfArguments()];
+    }
+    const T& operator[](size_t index) const { return at(index); }
+    T& operator[](size_t index) { return at(index); }
+
+    bool isArgument(size_t index) const { return index < numberOfArguments(); }
+    bool isVariable(size_t index) const { return !isArgument(index); }
+    int argumentForIndex(size_t index) const
+    {
+        return index;
+    }
+    int variableForIndex(size_t index) const
+    {
+        return index - m_arguments.size();
+    }
+    int operandForIndex(size_t index) const
+    {
+        if (index < numberOfArguments())
+            return argumentToOperand(index);
+        return index - numberOfArguments();
+    }
+    
     void setOperandFirstTime(int operand, const T& value)
     {
         if (operandIsArgument(operand)) {
@@ -165,6 +205,16 @@ void dumpOperands(Operands<T, Traits>& operands, FILE* out)
     }
 }
 
+template<typename T, typename Traits>
+void dumpOperands(const Operands<T, Traits>& operands, FILE* out)
+{
+    // Use const-cast because:
+    // 1) I don't feel like writing this code twice, and
+    // 2) Some dump() methods may not be const, and I don't really care if that's
+    //    the case.
+    dumpOperands(*const_cast<Operands<T, Traits>*>(&operands), out);
+}
+
 } // namespace JSC
 
 #endif // Operands_h
diff --git a/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp
index 170615b73..3a87567d8 100644
--- a/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp
+++ b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.cpp
@@ -42,7 +42,7 @@ PutByIdAccess PutByIdAccess::fromStructureStubInfo(
     case access_put_by_id_replace:
         result.m_type = Replace;
         result.m_oldStructure.copyFrom(stubInfo.u.putByIdReplace.baseObjectStructure);
-        result.m_stubRoutine = MacroAssemblerCodeRef::createSelfManagedCodeRef(initialSlowPath);
+        result.m_stubRoutine = JITStubRoutine::createSelfManagedRoutine(initialSlowPath);
         break;
         
     case access_put_by_id_transition_direct:
diff --git a/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h
index 60b632d52..4a20b6d1c 100644
--- a/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h
+++ b/Source/JavaScriptCore/bytecode/PolymorphicPutByIdList.h
@@ -60,7 +60,7 @@ public:
         Structure* oldStructure,
         Structure* newStructure,
         StructureChain* chain,
-        MacroAssemblerCodeRef stubRoutine)
+        PassRefPtr<JITStubRoutine> stubRoutine)
     {
         PutByIdAccess result;
         result.m_type = Transition;
@@ -75,7 +75,7 @@ public:
         JSGlobalData& globalData,
         JSCell* owner,
         Structure* structure,
-        MacroAssemblerCodeRef stubRoutine)
+        PassRefPtr<JITStubRoutine> stubRoutine)
     {
         PutByIdAccess result;
         result.m_type = Replace;
@@ -123,7 +123,7 @@ public:
         return m_chain.get();
     }
     
-    MacroAssemblerCodeRef stubRoutine() const
+    PassRefPtr<JITStubRoutine> stubRoutine() const
     {
         ASSERT(isTransition() || isReplace());
         return m_stubRoutine;
@@ -136,7 +136,7 @@ private:
     WriteBarrier<Structure> m_oldStructure;
     WriteBarrier<Structure> m_newStructure;
     WriteBarrier<StructureChain> m_chain;
-    MacroAssemblerCodeRef m_stubRoutine;
+    RefPtr<JITStubRoutine> m_stubRoutine;
 };
 
 class PolymorphicPutByIdList {
@@ -161,7 +161,7 @@ public:
     
     MacroAssemblerCodePtr currentSlowPathTarget() const
     {
-        return m_list.last().stubRoutine().code();
+        return m_list.last().stubRoutine()->code().code();
     }
     
     void addAccess(const PutByIdAccess&);
diff --git a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
index 3715606fe..e9456313a 100644
--- a/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
@@ -43,12 +43,13 @@ PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
 
     Structure* structure = instruction[4].u.structure.get();
     if (!structure)
-        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+        return PutByIdStatus(NoInformation, 0, 0, 0, invalidOffset);
     
-    if (instruction[0].u.opcode == llint_op_put_by_id) {
-        size_t offset = structure->get(*profiledBlock->globalData(), ident);
-        if (offset == notFound)
-            return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+    if (instruction[0].u.opcode == llint_op_put_by_id
+        || instruction[0].u.opcode == llint_op_put_by_id_out_of_line) {
+        PropertyOffset offset = structure->get(*profiledBlock->globalData(), ident);
+        if (!isValidOffset(offset))
+            return PutByIdStatus(NoInformation, 0, 0, 0, invalidOffset);
         
         return PutByIdStatus(SimpleReplace, structure, 0, 0, offset);
     }
@@ -56,20 +57,22 @@ PutByIdStatus PutByIdStatus::computeFromLLInt(CodeBlock* profiledBlock, unsigned
     ASSERT(structure->transitionWatchpointSetHasBeenInvalidated());
     
     ASSERT(instruction[0].u.opcode == llint_op_put_by_id_transition_direct
-           || instruction[0].u.opcode == llint_op_put_by_id_transition_normal);
+           || instruction[0].u.opcode == llint_op_put_by_id_transition_normal
+           || instruction[0].u.opcode == llint_op_put_by_id_transition_direct_out_of_line
+           || instruction[0].u.opcode == llint_op_put_by_id_transition_normal_out_of_line);
     
     Structure* newStructure = instruction[6].u.structure.get();
     StructureChain* chain = instruction[7].u.structureChain.get();
     ASSERT(newStructure);
     ASSERT(chain);
     
-    size_t offset = newStructure->get(*profiledBlock->globalData(), ident);
-    if (offset == notFound)
-        return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+    PropertyOffset offset = newStructure->get(*profiledBlock->globalData(), ident);
+    if (!isValidOffset(offset))
+        return PutByIdStatus(NoInformation, 0, 0, 0, invalidOffset);
     
     return PutByIdStatus(SimpleTransition, structure, newStructure, chain, offset);
 #else
-    return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+    return PutByIdStatus(NoInformation, 0, 0, 0, invalidOffset);
 #endif
 }
 
@@ -83,7 +86,7 @@ PutByIdStatus PutByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
         return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
     
     if (profiledBlock->likelyToTakeSlowCase(bytecodeIndex))
-        return PutByIdStatus(TakesSlowPath, 0, 0, 0, notFound);
+        return PutByIdStatus(TakesSlowPath, 0, 0, 0, invalidOffset);
     
     StructureStubInfo& stubInfo = profiledBlock->getStubInfo(bytecodeIndex);
     if (!stubInfo.seen)
@@ -94,24 +97,24 @@ PutByIdStatus PutByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
         return computeFromLLInt(profiledBlock, bytecodeIndex, ident);
         
     case access_put_by_id_replace: {
-        size_t offset = stubInfo.u.putByIdReplace.baseObjectStructure->get(
+        PropertyOffset offset = stubInfo.u.putByIdReplace.baseObjectStructure->get(
             *profiledBlock->globalData(), ident);
-        if (offset != notFound) {
+        if (isValidOffset(offset)) {
             return PutByIdStatus(
                 SimpleReplace,
                 stubInfo.u.putByIdReplace.baseObjectStructure.get(),
                 0, 0,
                 offset);
         }
-        return PutByIdStatus(TakesSlowPath, 0, 0, 0, notFound);
+        return PutByIdStatus(TakesSlowPath, 0, 0, 0, invalidOffset);
     }
         
     case access_put_by_id_transition_normal:
     case access_put_by_id_transition_direct: {
         ASSERT(stubInfo.u.putByIdTransition.previousStructure->transitionWatchpointSetHasBeenInvalidated());
-        size_t offset = stubInfo.u.putByIdTransition.structure->get(
+        PropertyOffset offset = stubInfo.u.putByIdTransition.structure->get(
             *profiledBlock->globalData(), ident);
-        if (offset != notFound) {
+        if (isValidOffset(offset)) {
             return PutByIdStatus(
                 SimpleTransition,
                 stubInfo.u.putByIdTransition.previousStructure.get(),
@@ -119,14 +122,14 @@ PutByIdStatus PutByIdStatus::computeFor(CodeBlock* profiledBlock, unsigned bytec
                 stubInfo.u.putByIdTransition.chain.get(),
                 offset);
         }
-        return PutByIdStatus(TakesSlowPath, 0, 0, 0, notFound);
+        return PutByIdStatus(TakesSlowPath, 0, 0, 0, invalidOffset);
     }
         
     default:
-        return PutByIdStatus(TakesSlowPath, 0, 0, 0, notFound);
+        return PutByIdStatus(TakesSlowPath, 0, 0, 0, invalidOffset);
     }
 #else // ENABLE(JIT)
-    return PutByIdStatus(NoInformation, 0, 0, 0, notFound);
+    return PutByIdStatus(NoInformation, 0, 0, 0, invalidOffset);
 #endif // ENABLE(JIT)
 }
 
diff --git a/Source/JavaScriptCore/bytecode/PutByIdStatus.h b/Source/JavaScriptCore/bytecode/PutByIdStatus.h
index a6d95a449..694915244 100644
--- a/Source/JavaScriptCore/bytecode/PutByIdStatus.h
+++ b/Source/JavaScriptCore/bytecode/PutByIdStatus.h
@@ -26,6 +26,7 @@
 #ifndef PutByIdStatus_h
 #define PutByIdStatus_h
 
+#include "PropertyOffset.h"
 #include <wtf/NotFound.h>
 
 namespace JSC {
@@ -55,7 +56,7 @@ public:
         , m_oldStructure(0)
         , m_newStructure(0)
         , m_structureChain(0)
-        , m_offset(notFound)
+        , m_offset(invalidOffset)
     {
     }
     
@@ -64,7 +65,7 @@ public:
         Structure* oldStructure,
         Structure* newStructure,
         StructureChain* structureChain,
-        size_t offset)
+        PropertyOffset offset)
         : m_state(state)
         , m_oldStructure(oldStructure)
         , m_newStructure(newStructure)
@@ -74,7 +75,7 @@ public:
         ASSERT((m_state == NoInformation || m_state == TakesSlowPath) == !m_oldStructure);
         ASSERT((m_state != SimpleTransition) == !m_newStructure);
         ASSERT((m_state != SimpleTransition) == !m_structureChain);
-        ASSERT((m_state == NoInformation || m_state == TakesSlowPath) == (m_offset == notFound));
+        ASSERT((m_state == NoInformation || m_state == TakesSlowPath) == (m_offset == invalidOffset));
     }
     
     static PutByIdStatus computeFor(CodeBlock*, unsigned bytecodeIndex, Identifier&);
@@ -90,7 +91,7 @@ public:
     Structure* oldStructure() const { return m_oldStructure; }
     Structure* newStructure() const { return m_newStructure; }
     StructureChain* structureChain() const { return m_structureChain; }
-    size_t offset() const { return m_offset; }
+    PropertyOffset offset() const { return m_offset; }
     
 private:
     static PutByIdStatus computeFromLLInt(CodeBlock*, unsigned bytecodeIndex, Identifier&);
@@ -99,7 +100,7 @@ private:
     Structure* m_oldStructure;
     Structure* m_newStructure;
     StructureChain* m_structureChain;
-    size_t m_offset;
+    PropertyOffset m_offset;
 };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
index ff138704c..4afee248d 100644
--- a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
+++ b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.cpp
@@ -32,17 +32,19 @@
 
 namespace JSC {
 
+#if ENABLE(LLINT) || ENABLE(JIT)
 static ResolveGlobalStatus computeForStructure(CodeBlock* codeBlock, Structure* structure, Identifier& identifier)
 {
     unsigned attributesIgnored;
     JSCell* specificValue;
-    size_t offset = structure->get(
+    PropertyOffset offset = structure->get(
         *codeBlock->globalData(), identifier, attributesIgnored, specificValue);
-    if (offset == notFound)
+    if (!isValidOffset(offset))
         return ResolveGlobalStatus();
     
     return ResolveGlobalStatus(ResolveGlobalStatus::Simple, structure, offset, specificValue);
 }
+#endif // ENABLE(LLINT) || ENABLE(JIT)
 
 static ResolveGlobalStatus computeForLLInt(CodeBlock* codeBlock, unsigned bytecodeIndex, Identifier& identifier)
 {
diff --git a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h
index 4698332f7..cbe4d3b5f 100644
--- a/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h
+++ b/Source/JavaScriptCore/bytecode/ResolveGlobalStatus.h
@@ -27,6 +27,7 @@
 #define ResolveGlobalStatus_h
 
 #include "JSValue.h"
+#include "PropertyOffset.h"
 #include <wtf/NotFound.h>
 
 namespace JSC {
@@ -46,12 +47,12 @@ public:
     ResolveGlobalStatus()
         : m_state(NoInformation)
         , m_structure(0)
-        , m_offset(notFound)
+        , m_offset(invalidOffset)
     {
     }
     
     ResolveGlobalStatus(
-        State state, Structure* structure = 0, size_t offset = notFound,
+        State state, Structure* structure = 0, PropertyOffset offset = invalidOffset,
         JSValue specificValue = JSValue())
         : m_state(state)
         , m_structure(structure)
@@ -70,13 +71,13 @@ public:
     bool takesSlowPath() const { return m_state == TakesSlowPath; }
     
     Structure* structure() const { return m_structure; }
-    size_t offset() const { return m_offset; }
+    PropertyOffset offset() const { return m_offset; }
     JSValue specificValue() const { return m_specificValue; }
 
 private:
     State m_state;
     Structure* m_structure;
-    size_t m_offset;
+    PropertyOffset m_offset;
     JSValue m_specificValue;
 }; // class ResolveGlobalStatus
 
diff --git a/Source/JavaScriptCore/bytecode/StructureSet.h b/Source/JavaScriptCore/bytecode/StructureSet.h
index 2bbc50cad..ebde9779f 100644
--- a/Source/JavaScriptCore/bytecode/StructureSet.h
+++ b/Source/JavaScriptCore/bytecode/StructureSet.h
@@ -113,15 +113,6 @@ public:
     
     size_t size() const { return m_structures.size(); }
     
-    bool allAreUsingInlinePropertyStorage() const
-    {
-        for (size_t i = 0; i < m_structures.size(); ++i) {
-            if (!m_structures[i]->isUsingInlineStorage())
-                return false;
-        }
-        return true;
-    }
-    
     // Call this if you know that the structure set must consist of exactly
     // one structure.
     Structure* singletonStructure() const
diff --git a/Source/JavaScriptCore/bytecode/StructureStubInfo.h b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
index 573f6e975..807966cf3 100644
--- a/Source/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/Source/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -32,6 +32,7 @@
 
 #include "CodeOrigin.h"
 #include "Instruction.h"
+#include "JITStubRoutine.h"
 #include "MacroAssembler.h"
 #include "Opcode.h"
 #include "Structure.h"
@@ -168,7 +169,7 @@ namespace JSC {
         {
             deref();
             accessType = access_unset;
-            stubRoutine = MacroAssemblerCodeRef();
+            stubRoutine.clear();
         }
 
         void deref();
@@ -204,6 +205,7 @@ namespace JSC {
                 int8_t valueGPR;
                 int8_t scratchGPR;
                 int32_t deltaCallToDone;
+                int32_t deltaCallToStorageLoad;
                 int32_t deltaCallToStructCheck;
                 int32_t deltaCallToSlowCase;
                 int32_t deltaCheckImmToCall;
@@ -219,6 +221,7 @@ namespace JSC {
                     struct {
                         int16_t structureToCompare;
                         int16_t structureCheck;
+                        int16_t propertyStorageLoad;
 #if USE(JSVALUE64)
                         int16_t displacementLabel;
 #else
@@ -230,6 +233,7 @@ namespace JSC {
                     } get;
                     struct {
                         int16_t structureToCompare;
+                        int16_t propertyStorageLoad;
 #if USE(JSVALUE64)
                         int16_t displacementLabel;
 #else
@@ -283,7 +287,7 @@ namespace JSC {
             } putByIdList;
         } u;
 
-        MacroAssemblerCodeRef stubRoutine;
+        RefPtr<JITStubRoutine> stubRoutine;
         CodeLocationCall callReturnLocation;
         CodeLocationLabel hotPathBegin;
     };
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 8969a7f25..b104788c8 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -32,6 +32,7 @@
 #include "BytecodeGenerator.h"
 
 #include "BatchedTransitionOptimizer.h"
+#include "Comment.h"
 #include "JSActivation.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -245,6 +246,9 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
     , m_shouldEmitRichSourceInfo(scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()))
     , m_scopeChain(*scopeChain->globalData, scopeChain)
     , m_symbolTable(symbolTable)
+#if ENABLE(BYTECODE_COMMENTS)
+    , m_currentCommentString(0)
+#endif
     , m_scopeNode(programNode)
     , m_codeBlock(codeBlock)
     , m_thisRegister(CallFrame::thisArgumentOffset())
@@ -270,6 +274,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, ScopeChainNode* s
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
 
+    prependComment("entering Program block");
     emitOpcode(op_enter);
     codeBlock->setGlobalData(m_globalData);
 
@@ -322,6 +327,9 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
     , m_shouldEmitRichSourceInfo(scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()))
     , m_scopeChain(*scopeChain->globalData, scopeChain)
     , m_symbolTable(symbolTable)
+#if ENABLE(BYTECODE_COMMENTS)
+    , m_currentCommentString(0)
+#endif
     , m_scopeNode(functionBody)
     , m_codeBlock(codeBlock)
     , m_activationRegister(0)
@@ -349,9 +357,11 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
 
     codeBlock->setGlobalData(m_globalData);
     
+    prependComment("entering Function block");
     emitOpcode(op_enter);
     if (m_codeBlock->needsFullScopeChain()) {
         m_activationRegister = addVar();
+        prependComment("activation for Full Scope Chain");
         emitInitLazyRegister(m_activationRegister);
         m_codeBlock->setActivationRegister(m_activationRegister->index());
     }
@@ -368,10 +378,13 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
         codeBlock->setArgumentsRegister(argumentsRegister->index());
         ASSERT_UNUSED(unmodifiedArgumentsRegister, unmodifiedArgumentsRegister->index() == JSC::unmodifiedArgumentsRegister(codeBlock->argumentsRegister()));
 
+        prependComment("arguments for Full Scope Chain");
         emitInitLazyRegister(argumentsRegister);
+        prependComment("unmodified arguments for Full Scope Chain");
         emitInitLazyRegister(unmodifiedArgumentsRegister);
         
         if (m_codeBlock->isStrictMode()) {
+            prependComment("create arguments for strict mode");
             emitOpcode(op_create_arguments);
             instructions().append(argumentsRegister->index());
         }
@@ -380,6 +393,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
         // it from a call frame.  In the long-term it should stop doing that (<rdar://problem/6911886>),
         // but for now we force eager creation of the arguments object when debugging.
         if (m_shouldEmitDebugHooks) {
+            prependComment("create arguments for debug hooks");
             emitOpcode(op_create_arguments);
             instructions().append(argumentsRegister->index());
         }
@@ -398,10 +412,12 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
             if (functionBody->captures(ident)) {
                 if (!m_hasCreatedActivation) {
                     m_hasCreatedActivation = true;
+                    prependComment("activation for captured vars");
                     emitOpcode(op_create_activation);
                     instructions().append(m_activationRegister->index());
                 }
                 m_functions.add(ident.impl());
+                prependComment("captured function var");
                 emitNewFunction(addVar(ident, false), function);
             }
         }
@@ -414,6 +430,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
     bool canLazilyCreateFunctions = !functionBody->needsActivationForMoreThanVariables() && !m_shouldEmitDebugHooks;
     if (!canLazilyCreateFunctions && !m_hasCreatedActivation) {
         m_hasCreatedActivation = true;
+        prependComment("cannot lazily create functions");
         emitOpcode(op_create_activation);
         instructions().append(m_activationRegister->index());
     }
@@ -428,6 +445,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
             RefPtr<RegisterID> reg = addVar(ident, false);
             // Don't lazily create functions that override the name 'arguments'
             // as this would complicate lazy instantiation of actual arguments.
+            prependComment("a function that override 'arguments'");
             if (!canLazilyCreateFunctions || ident == propertyNames().arguments)
                 emitNewFunction(reg.get(), function);
             else {
@@ -460,6 +478,7 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, ScopeChainN
     preserveLastVar();
 
     if (isConstructor()) {
+        prependComment("'this' because we are a Constructor function");
         emitOpcode(op_create_this);
         instructions().append(m_thisRegister.index());
     } else if (!codeBlock->isStrictMode() && (functionBody->usesThis() || codeBlock->usesEval() || m_shouldEmitDebugHooks)) {
@@ -475,6 +494,9 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, ScopeChainNode* scopeCh
     , m_shouldEmitRichSourceInfo(scopeChain->globalObject->globalObjectMethodTable()->supportsRichSourceInfo(scopeChain->globalObject.get()))
     , m_scopeChain(*scopeChain->globalData, scopeChain)
     , m_symbolTable(symbolTable)
+#if ENABLE(BYTECODE_COMMENTS)
+    , m_currentCommentString(0)
+#endif
     , m_scopeNode(evalNode)
     , m_codeBlock(codeBlock)
     , m_thisRegister(CallFrame::thisArgumentOffset())
@@ -500,6 +522,7 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, ScopeChainNode* scopeCh
     if (m_shouldEmitDebugHooks || m_baseScopeDepth)
         m_codeBlock->setNeedsFullScopeChain(true);
 
+    prependComment("entering Eval block");
     emitOpcode(op_enter);
     codeBlock->setGlobalData(m_globalData);
     m_codeBlock->setNumParameters(1);
@@ -658,10 +681,31 @@ void BytecodeGenerator::emitOpcode(OpcodeID opcodeID)
     ASSERT(opcodePosition - m_lastOpcodePosition == opcodeLength(m_lastOpcodeID) || m_lastOpcodeID == op_end);
     m_lastOpcodePosition = opcodePosition;
 #endif
+    emitComment();
     instructions().append(globalData()->interpreter->getOpcode(opcodeID));
     m_lastOpcodeID = opcodeID;
 }
 
+#if ENABLE(BYTECODE_COMMENTS)
+// Record a comment in the CodeBlock's comments list for the current opcode
+// that is about to be emitted.
+void BytecodeGenerator::emitComment()
+{
+    if (m_currentCommentString) {
+        size_t opcodePosition = instructions().size();
+        Comment comment = { opcodePosition, m_currentCommentString };
+        m_codeBlock->bytecodeComments().append(comment);
+        m_currentCommentString = 0;
+    }
+}
+
+// Register a comment to be associated with the next opcode that will be emitted.
+void BytecodeGenerator::prependComment(const char* string)
+{
+    m_currentCommentString = string;
+}
+#endif
+
 ValueProfile* BytecodeGenerator::emitProfiledOpcode(OpcodeID opcodeID)
 {
 #if ENABLE(VALUE_PROFILER)
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 8b1d1d744..52fd7e83c 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -542,6 +542,18 @@ namespace JSC {
     private:
         friend class Label;
         
+#if ENABLE(BYTECODE_COMMENTS)
+        // Record a comment in the CodeBlock's comments list for the current
+        // opcode that is about to be emitted.
+        void emitComment();
+        // Register a comment to be associated with the next opcode that will
+        // be emitted.
+        void prependComment(const char* string);
+#else
+        ALWAYS_INLINE void emitComment() { }
+        ALWAYS_INLINE void prependComment(const char*) { }
+#endif
+
         void emitOpcode(OpcodeID);
         ValueProfile* emitProfiledOpcode(OpcodeID);
         void retrieveLastBinaryOp(int& dstIndex, int& src1Index, int& src2Index);
@@ -623,6 +635,9 @@ namespace JSC {
 
         Vector<Instruction>& instructions() { return m_instructions; }
         SymbolTable& symbolTable() { return *m_symbolTable; }
+#if ENABLE(BYTECODE_COMMENTS)
+        Vector<Comment>& comments() { return m_comments; }
+#endif
 
         bool shouldOptimizeLocals()
         {
@@ -664,6 +679,11 @@ namespace JSC {
         Strong<ScopeChainNode> m_scopeChain;
         SymbolTable* m_symbolTable;
 
+#if ENABLE(BYTECODE_COMMENTS)
+        Vector<Comment> m_comments;
+        const char *m_currentCommentString;
+#endif
+
         ScopeNode* m_scopeNode;
         CodeBlock* m_codeBlock;
 
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index c2d49f7ee..4cd31f2a8 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -311,31 +311,35 @@ bool AbstractState::execute(unsigned indexInBlock)
         if (left && right && left.isInt32() && right.isInt32()) {
             int32_t a = left.asInt32();
             int32_t b = right.asInt32();
+            bool constantWasSet;
             switch (node.op()) {
             case BitAnd:
-                forNode(nodeIndex).set(JSValue(a & b));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a & b));
                 break;
             case BitOr:
-                forNode(nodeIndex).set(JSValue(a | b));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a | b));
                 break;
             case BitXor:
-                forNode(nodeIndex).set(JSValue(a ^ b));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a ^ b));
                 break;
             case BitRShift:
-                forNode(nodeIndex).set(JSValue(a >> static_cast<uint32_t>(b)));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a >> static_cast<uint32_t>(b)));
                 break;
             case BitLShift:
-                forNode(nodeIndex).set(JSValue(a << static_cast<uint32_t>(b)));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a << static_cast<uint32_t>(b)));
                 break;
             case BitURShift:
-                forNode(nodeIndex).set(JSValue(static_cast<uint32_t>(a) >> static_cast<uint32_t>(b)));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(static_cast<uint32_t>(a) >> static_cast<uint32_t>(b)));
                 break;
             default:
                 ASSERT_NOT_REACHED();
+                constantWasSet = false;
+            }
+            if (constantWasSet) {
+                m_foundConstants = true;
+                node.setCanExit(false);
+                break;
             }
-            m_foundConstants = true;
-            node.setCanExit(false);
-            break;
         }
         speculateInt32Binary(node);
         forNode(nodeIndex).set(SpecInt32);
@@ -346,10 +350,11 @@ bool AbstractState::execute(unsigned indexInBlock)
         JSValue child = forNode(node.child1()).value();
         if (child && child.isNumber()) {
             ASSERT(child.isInt32());
-            forNode(nodeIndex).set(JSValue(child.asUInt32()));
-            m_foundConstants = true;
-            node.setCanExit(false);
-            break;
+            if (trySetConstant(nodeIndex, JSValue(child.asUInt32()))) {
+                m_foundConstants = true;
+                node.setCanExit(false);
+                break;
+            }
         }
         if (!node.canSpeculateInteger()) {
             forNode(nodeIndex).set(SpecDouble);
@@ -367,8 +372,8 @@ bool AbstractState::execute(unsigned indexInBlock)
         if (child && child.isNumber()) {
             double asDouble = child.asNumber();
             int32_t asInt = JSC::toInt32(asDouble);
-            if (bitwise_cast<int64_t>(static_cast<double>(asInt)) == bitwise_cast<int64_t>(asDouble)) {
-                forNode(nodeIndex).set(JSValue(asInt));
+            if (bitwise_cast<int64_t>(static_cast<double>(asInt)) == bitwise_cast<int64_t>(asDouble)
+                && trySetConstant(nodeIndex, JSValue(asInt))) {
                 m_foundConstants = true;
                 break;
             }
@@ -382,13 +387,16 @@ bool AbstractState::execute(unsigned indexInBlock)
     case ValueToInt32: {
         JSValue child = forNode(node.child1()).value();
         if (child && child.isNumber()) {
+            bool constantWasSet;
             if (child.isInt32())
-                forNode(nodeIndex).set(child);
+                constantWasSet = trySetConstant(nodeIndex, child);
             else
-                forNode(nodeIndex).set(JSValue(JSC::toInt32(child.asDouble())));
-            m_foundConstants = true;
-            node.setCanExit(false);
-            break;
+                constantWasSet = trySetConstant(nodeIndex, JSValue(JSC::toInt32(child.asDouble())));
+            if (constantWasSet) {
+                m_foundConstants = true;
+                node.setCanExit(false);
+                break;
+            }
         }
         if (m_graph[node.child1()].shouldSpeculateInteger())
             speculateInt32Unary(node);
@@ -405,8 +413,8 @@ bool AbstractState::execute(unsigned indexInBlock)
         
     case Int32ToDouble: {
         JSValue child = forNode(node.child1()).value();
-        if (child && child.isNumber()) {
-            forNode(nodeIndex).set(JSValue(JSValue::EncodeAsDouble, child.asNumber()));
+        if (child && child.isNumber()
+            && trySetConstant(nodeIndex, JSValue(JSValue::EncodeAsDouble, child.asNumber()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -424,8 +432,8 @@ bool AbstractState::execute(unsigned indexInBlock)
     case ArithAdd: {
         JSValue left = forNode(node.child1()).value();
         JSValue right = forNode(node.child2()).value();
-        if (left && right && left.isNumber() && right.isNumber()) {
-            forNode(nodeIndex).set(JSValue(left.asNumber() + right.asNumber()));
+        if (left && right && left.isNumber() && right.isNumber()
+            && trySetConstant(nodeIndex, JSValue(left.asNumber() + right.asNumber()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -456,8 +464,8 @@ bool AbstractState::execute(unsigned indexInBlock)
     case ArithSub: {
         JSValue left = forNode(node.child1()).value();
         JSValue right = forNode(node.child2()).value();
-        if (left && right && left.isNumber() && right.isNumber()) {
-            forNode(nodeIndex).set(JSValue(left.asNumber() - right.asNumber()));
+        if (left && right && left.isNumber() && right.isNumber()
+            && trySetConstant(nodeIndex, JSValue(left.asNumber() - right.asNumber()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -475,8 +483,8 @@ bool AbstractState::execute(unsigned indexInBlock)
         
     case ArithNegate: {
         JSValue child = forNode(node.child1()).value();
-        if (child && child.isNumber()) {
-            forNode(nodeIndex).set(JSValue(-child.asNumber()));
+        if (child && child.isNumber()
+            && trySetConstant(nodeIndex, JSValue(-child.asNumber()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -495,8 +503,8 @@ bool AbstractState::execute(unsigned indexInBlock)
     case ArithMul: {
         JSValue left = forNode(node.child1()).value();
         JSValue right = forNode(node.child2()).value();
-        if (left && right && left.isNumber() && right.isNumber()) {
-            forNode(nodeIndex).set(JSValue(left.asNumber() * right.asNumber()));
+        if (left && right && left.isNumber() && right.isNumber()
+            && trySetConstant(nodeIndex, JSValue(left.asNumber() * right.asNumber()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -523,26 +531,30 @@ bool AbstractState::execute(unsigned indexInBlock)
         if (left && right && left.isNumber() && right.isNumber()) {
             double a = left.asNumber();
             double b = right.asNumber();
+            bool constantWasSet;
             switch (node.op()) {
             case ArithDiv:
-                forNode(nodeIndex).set(JSValue(a / b));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a / b));
                 break;
             case ArithMin:
-                forNode(nodeIndex).set(JSValue(a < b ? a : (b <= a ? b : a + b)));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a < b ? a : (b <= a ? b : a + b)));
                 break;
             case ArithMax:
-                forNode(nodeIndex).set(JSValue(a > b ? a : (b >= a ? b : a + b)));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(a > b ? a : (b >= a ? b : a + b)));
                 break;
             case ArithMod:
-                forNode(nodeIndex).set(JSValue(fmod(a, b)));
+                constantWasSet = trySetConstant(nodeIndex, JSValue(fmod(a, b)));
                 break;
             default:
                 ASSERT_NOT_REACHED();
+                constantWasSet = false;
+                break;
+            }
+            if (constantWasSet) {
+                m_foundConstants = true;
+                node.setCanExit(false);
                 break;
             }
-            m_foundConstants = true;
-            node.setCanExit(false);
-            break;
         }
         if (Node::shouldSpeculateInteger(
                 m_graph[node.child1()], m_graph[node.child2()])
@@ -558,8 +570,8 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case ArithAbs: {
         JSValue child = forNode(node.child1()).value();
-        if (child && child.isNumber()) {
-            forNode(nodeIndex).set(JSValue(fabs(child.asNumber())));
+        if (child && child.isNumber()
+            && trySetConstant(nodeIndex, JSValue(fabs(child.asNumber())))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -577,8 +589,8 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case ArithSqrt: {
         JSValue child = forNode(node.child1()).value();
-        if (child && child.isNumber()) {
-            forNode(nodeIndex).set(JSValue(sqrt(child.asNumber())));
+        if (child && child.isNumber()
+            && trySetConstant(nodeIndex, JSValue(sqrt(child.asNumber())))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -590,8 +602,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case LogicalNot: {
         JSValue childConst = forNode(node.child1()).value();
-        if (childConst) {
-            forNode(nodeIndex).set(jsBoolean(!childConst.toBoolean()));
+        if (childConst && trySetConstant(nodeIndex, jsBoolean(!childConst.toBoolean()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -626,27 +637,28 @@ bool AbstractState::execute(unsigned indexInBlock)
         node.setCanExit(false);
         JSValue child = forNode(node.child1()).value();
         if (child) {
-            bool foundConstant = true;
+            bool constantWasSet;
             switch (node.op()) {
             case IsUndefined:
-                forNode(nodeIndex).set(jsBoolean(
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(
                     child.isCell()
                     ? child.asCell()->structure()->typeInfo().masqueradesAsUndefined()
                     : child.isUndefined()));
                 break;
             case IsBoolean:
-                forNode(nodeIndex).set(jsBoolean(child.isBoolean()));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(child.isBoolean()));
                 break;
             case IsNumber:
-                forNode(nodeIndex).set(jsBoolean(child.isNumber()));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(child.isNumber()));
                 break;
             case IsString:
-                forNode(nodeIndex).set(jsBoolean(isJSString(child)));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(isJSString(child)));
                 break;
             default:
+                constantWasSet = false;
                 break;
             }
-            if (foundConstant) {
+            if (constantWasSet) {
                 m_foundConstants = true;
                 break;
             }
@@ -665,29 +677,33 @@ bool AbstractState::execute(unsigned indexInBlock)
         if (leftConst && rightConst && leftConst.isNumber() && rightConst.isNumber()) {
             double a = leftConst.asNumber();
             double b = rightConst.asNumber();
+            bool constantWasSet;
             switch (node.op()) {
             case CompareLess:
-                forNode(nodeIndex).set(jsBoolean(a < b));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a < b));
                 break;
             case CompareLessEq:
-                forNode(nodeIndex).set(jsBoolean(a <= b));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a <= b));
                 break;
             case CompareGreater:
-                forNode(nodeIndex).set(jsBoolean(a > b));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a > b));
                 break;
             case CompareGreaterEq:
-                forNode(nodeIndex).set(jsBoolean(a >= b));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a >= b));
                 break;
             case CompareEq:
-                forNode(nodeIndex).set(jsBoolean(a == b));
+                constantWasSet = trySetConstant(nodeIndex, jsBoolean(a == b));
                 break;
             default:
                 ASSERT_NOT_REACHED();
+                constantWasSet = false;
+                break;
+            }
+            if (constantWasSet) {
+                m_foundConstants = true;
+                node.setCanExit(false);
                 break;
             }
-            m_foundConstants = true;
-            node.setCanExit(false);
-            break;
         }
         
         forNode(nodeIndex).set(SpecBoolean);
@@ -767,8 +783,8 @@ bool AbstractState::execute(unsigned indexInBlock)
     case CompareStrictEq: {
         JSValue left = forNode(node.child1()).value();
         JSValue right = forNode(node.child2()).value();
-        if (left && right && left.isNumber() && right.isNumber()) {
-            forNode(nodeIndex).set(jsBoolean(left.asNumber() == right.asNumber()));
+        if (left && right && left.isNumber() && right.isNumber()
+            && trySetConstant(nodeIndex, jsBoolean(left.asNumber() == right.asNumber()))) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
@@ -1106,8 +1122,7 @@ bool AbstractState::execute(unsigned indexInBlock)
             
     case ToPrimitive: {
         JSValue childConst = forNode(node.child1()).value();
-        if (childConst && childConst.isNumber()) {
-            forNode(nodeIndex).set(childConst);
+        if (childConst && childConst.isNumber() && trySetConstant(nodeIndex, childConst)) {
             m_foundConstants = true;
             node.setCanExit(false);
             break;
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.h b/Source/JavaScriptCore/dfg/DFGAbstractState.h
index 9bb74cd86..95cadecbb 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.h
@@ -267,6 +267,23 @@ private:
         childValue2.filter(SpecNumber);
     }
     
+    bool trySetConstant(NodeIndex nodeIndex, JSValue value)
+    {
+        // Make sure we don't constant fold something that will produce values that contravene
+        // predictions. If that happens then we know that the code will OSR exit, forcing
+        // recompilation. But if we tried to constant fold then we'll have a very degenerate
+        // IR: namely we'll have a JSConstant that contravenes its own prediction. There's a
+        // lot of subtle code that assumes that
+        // speculationFromValue(jsConstant) == jsConstant.prediction(). "Hardening" that code
+        // is probably less sane than just pulling back on constant folding.
+        SpeculatedType oldType = m_graph[nodeIndex].prediction();
+        if (mergeSpeculations(speculationFromValue(value), oldType) != oldType)
+            return false;
+        
+        forNode(nodeIndex).set(value);
+        return true;
+    }
+    
     CodeBlock* m_codeBlock;
     Graph& m_graph;
     
diff --git a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
index 28e686aef..9208cde1b 100644
--- a/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp
@@ -627,8 +627,9 @@ public:
                     continue;
                 // If this is a CreateArguments for an InlineCallFrame* that does
                 // not create arguments, then replace it with a PhantomArguments.
-                // PhantomArguments is a constant that represents JSValue() (the
-                // empty value) in DFG and arguments creation for OSR exit.
+                // PhantomArguments is a non-executing node that just indicates
+                // that the node should be reified as an arguments object on OSR
+                // exit.
                 if (m_createsArguments.contains(node.codeOrigin.inlineCallFrame))
                     continue;
                 if (node.shouldGenerate()) {
@@ -641,12 +642,30 @@ public:
                 }
                 node.setOpAndDefaultFlags(PhantomArguments);
                 node.children.reset();
+                changed = true;
             }
             insertionSet.execute(*block);
         }
         
-        if (changed)
+        if (changed) {
             m_graph.collectGarbage();
+            
+            // Verify that PhantomArguments nodes are not shouldGenerate().
+#if !ASSERT_DISABLED
+            for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+                BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+                if (!block)
+                    continue;
+                for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
+                    NodeIndex nodeIndex = block->at(indexInBlock);
+                    Node& node = m_graph[nodeIndex];
+                    if (node.op() != PhantomArguments)
+                        continue;
+                    ASSERT(!node.shouldGenerate());
+                }
+            }
+#endif
+        }
         
         return changed;
     }
@@ -815,6 +834,7 @@ private:
 
 bool performArgumentsSimplification(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG Arguments Simplification Phase");
     return runPhase<ArgumentsSimplificationPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h b/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
index f86c15e65..4bea292f3 100644
--- a/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
+++ b/Source/JavaScriptCore/dfg/DFGAssemblyHelpers.h
@@ -182,7 +182,7 @@ public:
         move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT0);
         storePtr(TrustedImmPtr(scratchSize), GPRInfo::regT0);
 
-#if CPU(X86_64) || CPU(ARM_THUMB2)
+#if CPU(X86_64) || CPU(ARM)
         move(TrustedImmPtr(argument), GPRInfo::argumentGPR1);
         move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
         GPRReg scratch = selectScratchGPR(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1);
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index cdb0b639a..91b882399 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -99,7 +99,7 @@ private:
     bool handleConstantInternalFunction(bool usesResult, int resultOperand, InternalFunction*, int registerOffset, int argumentCountIncludingThis, SpeculatedType prediction, CodeSpecializationKind);
     void handleGetByOffset(
         int destinationOperand, SpeculatedType, NodeIndex base, unsigned identifierNumber,
-        bool useInlineStorage, size_t offset);
+        PropertyOffset);
     void handleGetById(
         int destinationOperand, SpeculatedType, NodeIndex base, unsigned identifierNumber,
         const GetByIdStatus&);
@@ -871,7 +871,7 @@ private:
         // care about when the outcome of the division is not an integer, which
         // is what the special fast case counter tells us.
         
-        if (!m_inlineStackTop->m_profiledBlock->likelyToTakeSpecialFastCase(m_currentIndex)
+        if (!m_inlineStackTop->m_profiledBlock->couldTakeSpecialFastCase(m_currentIndex)
             && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, Overflow)
             && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, NegativeZero))
             return nodeIndex;
@@ -1273,7 +1273,7 @@ bool ByteCodeParser::handleInlining(bool usesResult, int callTarget, NodeIndex c
     unsigned depth = 0;
     for (InlineStackEntry* entry = m_inlineStackTop; entry; entry = entry->m_caller) {
         ++depth;
-        if (depth >= Options::maximumInliningDepth)
+        if (depth >= Options::maximumInliningDepth())
             return false; // Depth exceeded.
         
         if (entry->executable() == executable)
@@ -1630,25 +1630,20 @@ bool ByteCodeParser::handleConstantInternalFunction(
 
 void ByteCodeParser::handleGetByOffset(
     int destinationOperand, SpeculatedType prediction, NodeIndex base, unsigned identifierNumber,
-    bool useInlineStorage, size_t offset)
+    PropertyOffset offset)
 {
     NodeIndex propertyStorage;
-    size_t offsetOffset;
-    if (useInlineStorage) {
+    if (isInlineOffset(offset))
         propertyStorage = base;
-        ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
-        offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
-    } else {
+    else
         propertyStorage = addToGraph(GetPropertyStorage, base);
-        offsetOffset = 0;
-    }
     set(destinationOperand,
         addToGraph(
             GetByOffset, OpInfo(m_graph.m_storageAccessData.size()), OpInfo(prediction),
             propertyStorage));
         
     StorageAccessData storageAccessData;
-    storageAccessData.offset = offset + offsetOffset;
+    storageAccessData.offset = indexRelativeToBase(offset);
     storageAccessData.identifierNumber = identifierNumber;
     m_graph.m_storageAccessData.append(storageAccessData);
 }
@@ -1677,7 +1672,6 @@ void ByteCodeParser::handleGetById(
                 
     addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(getByIdStatus.structureSet())), base);
     
-    bool useInlineStorage;
     if (!getByIdStatus.chain().isEmpty()) {
         Structure* currentStructure = getByIdStatus.structureSet().singletonStructure();
         JSObject* currentObject = 0;
@@ -1686,9 +1680,7 @@ void ByteCodeParser::handleGetById(
             currentStructure = getByIdStatus.chain()[i];
             base = addStructureTransitionCheck(currentObject, currentStructure);
         }
-        useInlineStorage = currentStructure->isUsingInlineStorage();
-    } else
-        useInlineStorage = getByIdStatus.structureSet().allAreUsingInlinePropertyStorage();
+    }
     
     // Unless we want bugs like https://bugs.webkit.org/show_bug.cgi?id=88783, we need to
     // ensure that the base of the original get_by_id is kept alive until we're done with
@@ -1707,8 +1699,7 @@ void ByteCodeParser::handleGetById(
     }
     
     handleGetByOffset(
-        destinationOperand, prediction, base, identifierNumber, useInlineStorage,
-        getByIdStatus.offset());
+        destinationOperand, prediction, base, identifierNumber, getByIdStatus.offset());
 }
 
 void ByteCodeParser::prepareToParseBlock()
@@ -2172,7 +2163,8 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             
             SpeculatedType prediction = getPrediction();
             
-            ASSERT(interpreter->getOpcodeID(getInstruction->u.opcode) == op_get_by_id);
+            ASSERT(interpreter->getOpcodeID(getInstruction->u.opcode) == op_get_by_id
+                   || interpreter->getOpcodeID(getInstruction->u.opcode) == op_get_by_id_out_of_line);
             
             NodeIndex base = get(getInstruction[2].u.operand);
             unsigned identifier = m_inlineStackTop->m_identifierRemap[getInstruction[3].u.operand];
@@ -2225,7 +2217,8 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             addToGraph(PutScopedVar, OpInfo(slot), getScopeChain, get(source));
             NEXT_OPCODE(op_put_scoped_var);
         }
-        case op_get_by_id: {
+        case op_get_by_id:
+        case op_get_by_id_out_of_line: {
             SpeculatedType prediction = getPredictionWithoutOSRExit();
             
             NodeIndex base = get(currentInstruction[2].u.operand);
@@ -2241,8 +2234,11 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             NEXT_OPCODE(op_get_by_id);
         }
         case op_put_by_id:
+        case op_put_by_id_out_of_line:
         case op_put_by_id_transition_direct:
-        case op_put_by_id_transition_normal: {
+        case op_put_by_id_transition_normal:
+        case op_put_by_id_transition_direct_out_of_line:
+        case op_put_by_id_transition_normal_out_of_line: {
             NodeIndex value = get(currentInstruction[3].u.operand);
             NodeIndex base = get(currentInstruction[1].u.operand);
             unsigned identifierNumber = m_inlineStackTop->m_identifierRemap[currentInstruction[2].u.operand];
@@ -2259,25 +2255,20 @@ bool ByteCodeParser::parseBlock(unsigned limit)
             
             if (!hasExitSite && putByIdStatus.isSimpleReplace()) {
                 addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(putByIdStatus.oldStructure())), base);
-                size_t offsetOffset;
                 NodeIndex propertyStorage;
-                if (putByIdStatus.oldStructure()->isUsingInlineStorage()) {
+                if (isInlineOffset(putByIdStatus.offset()))
                     propertyStorage = base;
-                    ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
-                    offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
-                } else {
+                else
                     propertyStorage = addToGraph(GetPropertyStorage, base);
-                    offsetOffset = 0;
-                }
                 addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), propertyStorage, base, value);
                 
                 StorageAccessData storageAccessData;
-                storageAccessData.offset = putByIdStatus.offset() + offsetOffset;
+                storageAccessData.offset = indexRelativeToBase(putByIdStatus.offset());
                 storageAccessData.identifierNumber = identifierNumber;
                 m_graph.m_storageAccessData.append(storageAccessData);
             } else if (!hasExitSite
                        && putByIdStatus.isSimpleTransition()
-                       && putByIdStatus.oldStructure()->propertyStorageCapacity() == putByIdStatus.newStructure()->propertyStorageCapacity()
+                       && putByIdStatus.oldStructure()->outOfLineCapacity() == putByIdStatus.newStructure()->outOfLineCapacity()
                        && structureChainIsStillValid(
                            direct,
                            putByIdStatus.oldStructure(),
@@ -2308,16 +2299,11 @@ bool ByteCodeParser::parseBlock(unsigned limit)
                                 putByIdStatus.newStructure()))),
                     base);
                 
-                size_t offsetOffset;
                 NodeIndex propertyStorage;
-                if (putByIdStatus.newStructure()->isUsingInlineStorage()) {
+                if (isInlineOffset(putByIdStatus.offset()))
                     propertyStorage = base;
-                    ASSERT(!(sizeof(JSObject) % sizeof(EncodedJSValue)));
-                    offsetOffset = sizeof(JSObject) / sizeof(EncodedJSValue);
-                } else {
+                else
                     propertyStorage = addToGraph(GetPropertyStorage, base);
-                    offsetOffset = 0;
-                }
                 addToGraph(
                     PutByOffset,
                     OpInfo(m_graph.m_storageAccessData.size()),
@@ -2326,7 +2312,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
                     value);
                 
                 StorageAccessData storageAccessData;
-                storageAccessData.offset = putByIdStatus.offset() + offsetOffset;
+                storageAccessData.offset = indexRelativeToBase(putByIdStatus.offset());
                 storageAccessData.identifierNumber = identifierNumber;
                 m_graph.m_storageAccessData.append(storageAccessData);
             } else {
@@ -2738,8 +2724,7 @@ bool ByteCodeParser::parseBlock(unsigned limit)
                 } else {
                     handleGetByOffset(
                         currentInstruction[1].u.operand, prediction, globalObject,
-                        identifierNumber, status.structure()->isUsingInlineStorage(),
-                        status.offset());
+                        identifierNumber, status.offset());
                 }
                 
                 m_globalResolveNumber++; // Skip over the unused global resolve info.
@@ -3341,6 +3326,7 @@ bool ByteCodeParser::parse()
 
 bool parse(ExecState* exec, Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG Parsing");
 #if DFG_DEBUG_LOCAL_DISBALE
     UNUSED_PARAM(exec);
     UNUSED_PARAM(graph);
diff --git a/Source/JavaScriptCore/dfg/DFGCCallHelpers.h b/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
index b60290870..9c1718bdb 100644
--- a/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
+++ b/Source/JavaScriptCore/dfg/DFGCCallHelpers.h
@@ -434,7 +434,7 @@ public:
     {
         setupTwoStubArgs<FPRInfo::argumentFPR0, FPRInfo::argumentFPR1>(arg1, arg2);
     }
-#else
+#elif CPU(ARM)
     ALWAYS_INLINE void setupArguments(FPRReg arg1)
     {
         assembler().vmov(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, arg1);
@@ -445,6 +445,8 @@ public:
         assembler().vmov(GPRInfo::argumentGPR0, GPRInfo::argumentGPR1, arg1);
         assembler().vmov(GPRInfo::argumentGPR2, GPRInfo::argumentGPR3, arg2);
     }
+#else
+#error "DFG JIT not supported on this platform."
 #endif
 
     ALWAYS_INLINE void setupArguments(GPRReg arg1)
diff --git a/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp b/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
index c6042448a..c52349645 100644
--- a/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp
@@ -132,6 +132,7 @@ private:
 
 bool performCFA(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG CFA Phase");
     return runPhase<CFAPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp b/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp
index 161f51e30..c234e6e4e 100644
--- a/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp
@@ -613,7 +613,7 @@ private:
                 
                 ASSERT(node.shouldGenerate());
                 Node& possibleLocalOp = m_graph[node.child1()];
-                if (possibleLocalOp.hasLocal()) {
+                if (possibleLocalOp.hasLocal() && !possibleLocalOp.variableAccessData()->isCaptured()) {
                     NodeIndex setLocalIndex =
                         firstBlock->variablesAtTail.operand(possibleLocalOp.local());
                     Node& setLocal = m_graph[setLocalIndex];
@@ -745,6 +745,7 @@ private:
 
 bool performCFGSimplification(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG CFG Simplification Phase");
     return runPhase<CFGSimplificationPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
index be0012f56..108cf1965 100644
--- a/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
@@ -1172,6 +1172,7 @@ private:
 
 bool performCSE(Graph& graph, OptimizationFixpointState fixpointState)
 {
+    SamplingRegion samplingRegion("DFG CSE Phase");
     return runPhase<CSEPhase>(graph, fixpointState);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.h b/Source/JavaScriptCore/dfg/DFGCapabilities.h
index 1aec0bca1..2bc9b2965 100644
--- a/Source/JavaScriptCore/dfg/DFGCapabilities.h
+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.h
@@ -41,29 +41,29 @@ namespace JSC { namespace DFG {
 // check opcodes.
 inline bool mightCompileEval(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount;
+    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount();
 }
 inline bool mightCompileProgram(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount;
+    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount();
 }
 inline bool mightCompileFunctionForCall(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount;
+    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount();
 }
 inline bool mightCompileFunctionForConstruct(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount;
+    return codeBlock->instructionCount() <= Options::maximumOptimizationCandidateInstructionCount();
 }
 
 inline bool mightInlineFunctionForCall(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumFunctionForCallInlineCandidateInstructionCount
+    return codeBlock->instructionCount() <= Options::maximumFunctionForCallInlineCandidateInstructionCount()
         && !codeBlock->ownerExecutable()->needsActivation();
 }
 inline bool mightInlineFunctionForConstruct(CodeBlock* codeBlock)
 {
-    return codeBlock->instructionCount() <= Options::maximumFunctionForConstructInlineCandidateInstructionCount
+    return codeBlock->instructionCount() <= Options::maximumFunctionForConstructInlineCandidateInstructionCount()
         && !codeBlock->ownerExecutable()->needsActivation();
 }
 
@@ -119,9 +119,13 @@ inline CapabilityLevel canCompileOpcode(OpcodeID opcodeID, CodeBlock*, Instructi
     case op_get_scoped_var:
     case op_put_scoped_var:
     case op_get_by_id:
+    case op_get_by_id_out_of_line:
     case op_put_by_id:
+    case op_put_by_id_out_of_line:
     case op_put_by_id_transition_direct:
+    case op_put_by_id_transition_direct_out_of_line:
     case op_put_by_id_transition_normal:
+    case op_put_by_id_transition_normal_out_of_line:
     case op_get_global_var:
     case op_get_global_var_watchable:
     case op_put_global_var:
diff --git a/Source/JavaScriptCore/dfg/DFGCommon.h b/Source/JavaScriptCore/dfg/DFGCommon.h
index c9d3cbc32..1a64a248c 100644
--- a/Source/JavaScriptCore/dfg/DFGCommon.h
+++ b/Source/JavaScriptCore/dfg/DFGCommon.h
@@ -136,7 +136,7 @@ enum OptimizationFixpointState { FixpointConverged, FixpointNotConverged };
 
 inline bool shouldShowDisassembly()
 {
-    return Options::showDisassembly || Options::showDFGDisassembly;
+    return Options::showDisassembly() || Options::showDFGDisassembly();
 }
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
index 9e6720c80..d3029b39a 100644
--- a/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
@@ -159,6 +159,7 @@ public:
 
 bool performConstantFolding(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG Constant Folding Phase");
     return runPhase<ConstantFoldingPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGDisassembler.cpp b/Source/JavaScriptCore/dfg/DFGDisassembler.cpp
index 1dde37cf2..cfbb936b8 100644
--- a/Source/JavaScriptCore/dfg/DFGDisassembler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDisassembler.cpp
@@ -43,7 +43,7 @@ void Disassembler::dump(LinkBuffer& linkBuffer)
 {
     m_graph.m_dominators.computeIfNecessary(m_graph);
     
-    dataLog("Generated JIT code for DFG CodeBlock %p:\n", m_graph.m_codeBlock);
+    dataLog("Generated JIT code for DFG CodeBlock %p, instruction count = %u:\n", m_graph.m_codeBlock, m_graph.m_codeBlock->instructionCount());
     dataLog("    Code at [%p, %p):\n", linkBuffer.debugAddress(), static_cast<char*>(linkBuffer.debugAddress()) + linkBuffer.debugSize());
     
     const char* prefix = "    ";
@@ -59,7 +59,7 @@ void Disassembler::dump(LinkBuffer& linkBuffer)
         m_graph.dumpBlockHeader(prefix, blockIndex, Graph::DumpLivePhisOnly);
         NodeIndex lastNodeIndexForDisassembly = block->at(0);
         for (size_t i = 0; i < block->size(); ++i) {
-            if (!m_graph[block->at(i)].willHaveCodeGen())
+            if (!m_graph[block->at(i)].willHaveCodeGenOrOSR())
                 continue;
             MacroAssembler::Label currentLabel;
             if (m_labelForNodeIndex[block->at(i)].isSet())
diff --git a/Source/JavaScriptCore/dfg/DFGDriver.cpp b/Source/JavaScriptCore/dfg/DFGDriver.cpp
index 5033aa2c0..64fc0c7e5 100644
--- a/Source/JavaScriptCore/dfg/DFGDriver.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDriver.cpp
@@ -40,6 +40,7 @@
 #include "DFGRedundantPhiEliminationPhase.h"
 #include "DFGValidate.h"
 #include "DFGVirtualRegisterAllocationPhase.h"
+#include "Options.h"
 
 namespace JSC { namespace DFG {
 
@@ -60,7 +61,10 @@ inline bool compile(CompileMode compileMode, ExecState* exec, CodeBlock* codeBlo
     ASSERT(codeBlock);
     ASSERT(codeBlock->alternative());
     ASSERT(codeBlock->alternative()->getJITType() == JITCode::BaselineJIT);
-    
+
+    if (!Options::useDFGJIT())
+        return false;
+
 #if DFG_ENABLE(DEBUG_VERBOSE)
     dataLog("DFG compiling code block %p(%p) for executable %p, number of instructions = %u.\n", codeBlock, codeBlock->alternative(), codeBlock->ownerExecutable(), codeBlock->instructionCount());
 #endif
diff --git a/Source/JavaScriptCore/dfg/DFGFPRInfo.h b/Source/JavaScriptCore/dfg/DFGFPRInfo.h
index 6af45dd81..e817ed396 100644
--- a/Source/JavaScriptCore/dfg/DFGFPRInfo.h
+++ b/Source/JavaScriptCore/dfg/DFGFPRInfo.h
@@ -102,7 +102,7 @@ public:
 
 #endif
 
-#if CPU(ARM_THUMB2)
+#if CPU(ARM)
 
 class FPRInfo {
 public:
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index f6e3c0a96..2e7389f21 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -402,6 +402,7 @@ private:
     
 bool performFixup(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG Fixup Phase");
     return runPhase<FixupPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGGPRInfo.h b/Source/JavaScriptCore/dfg/DFGGPRInfo.h
index bd4fa32d1..89faef94b 100644
--- a/Source/JavaScriptCore/dfg/DFGGPRInfo.h
+++ b/Source/JavaScriptCore/dfg/DFGGPRInfo.h
@@ -384,7 +384,7 @@ private:
 
 #endif
 
-#if CPU(ARM_THUMB2)
+#if CPU(ARM)
 #define NUMBER_OF_ARGUMENT_REGISTERS 4
 
 class GPRInfo {
@@ -410,7 +410,7 @@ public:
     static const GPRReg argumentGPR1 = ARMRegisters::r1; // regT1
     static const GPRReg argumentGPR2 = ARMRegisters::r2; // regT2
     // FIXME: r3 is currently used be the MacroAssembler as a temporary - it seems
-    // This could threoretically be a problem if theis is used in code generation
+    // This could threoretically be a problem if this is used in code generation
     // between the arguments being set up, and the call being made. That said,
     // any change introducing a problem here is likely to be immediately apparent!
     static const GPRReg argumentGPR3 = ARMRegisters::r3; // FIXME!
diff --git a/Source/JavaScriptCore/dfg/DFGGenerationInfo.h b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
index 125a5a4f9..905c5c5fb 100644
--- a/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
+++ b/Source/JavaScriptCore/dfg/DFGGenerationInfo.h
@@ -29,8 +29,10 @@
 
 #if ENABLE(DFG_JIT)
 
+#include "DFGJITCompiler.h"
+#include "DFGVariableEvent.h"
+#include "DFGVariableEventStream.h"
 #include "DataFormat.h"
-#include <dfg/DFGJITCompiler.h>
 
 namespace JSC { namespace DFG {
 
@@ -51,6 +53,7 @@ public:
         , m_registerFormat(DataFormatNone)
         , m_spillFormat(DataFormatNone)
         , m_canFill(false)
+        , m_bornForOSR(false)
     {
     }
 
@@ -61,6 +64,7 @@ public:
         m_registerFormat = DataFormatNone;
         m_spillFormat = DataFormatNone;
         m_canFill = true;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
     void initInteger(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr)
@@ -71,6 +75,7 @@ public:
         m_spillFormat = DataFormatNone;
         m_canFill = false;
         u.gpr = gpr;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
 #if USE(JSVALUE64)
@@ -84,6 +89,7 @@ public:
         m_spillFormat = DataFormatNone;
         m_canFill = false;
         u.gpr = gpr;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
 #elif USE(JSVALUE32_64)
@@ -98,6 +104,7 @@ public:
         m_canFill = false;
         u.v.tagGPR = tagGPR;
         u.v.payloadGPR = payloadGPR;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
 #endif
@@ -109,6 +116,7 @@ public:
         m_spillFormat = DataFormatNone;
         m_canFill = false;
         u.gpr = gpr;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
     void initBoolean(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr)
@@ -119,6 +127,7 @@ public:
         m_spillFormat = DataFormatNone;
         m_canFill = false;
         u.gpr = gpr;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
     void initDouble(NodeIndex nodeIndex, uint32_t useCount, FPRReg fpr)
@@ -130,6 +139,7 @@ public:
         m_spillFormat = DataFormatNone;
         m_canFill = false;
         u.fpr = fpr;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
     void initStorage(NodeIndex nodeIndex, uint32_t useCount, GPRReg gpr)
@@ -140,19 +150,44 @@ public:
         m_spillFormat = DataFormatNone;
         m_canFill = false;
         u.gpr = gpr;
+        m_bornForOSR = false;
         ASSERT(m_useCount);
     }
 
     // Get the index of the node that produced this value.
     NodeIndex nodeIndex() { return m_nodeIndex; }
+    
+    void noticeOSRBirth(VariableEventStream& stream, NodeIndex nodeIndex, VirtualRegister virtualRegister)
+    {
+        if (m_nodeIndex != nodeIndex)
+            return;
+        if (!alive())
+            return;
+        if (m_bornForOSR)
+            return;
+        
+        m_bornForOSR = true;
+        
+        if (m_registerFormat != DataFormatNone)
+            appendFill(BirthToFill, stream);
+        else if (m_spillFormat != DataFormatNone)
+            appendSpill(BirthToSpill, stream, virtualRegister);
+    }
 
     // Mark the value as having been used (decrement the useCount).
     // Returns true if this was the last use of the value, and any
     // associated machine registers may be freed.
-    bool use()
+    bool use(VariableEventStream& stream)
     {
         ASSERT(m_useCount);
-        return !--m_useCount;
+        bool result = !--m_useCount;
+        
+        if (result && m_bornForOSR) {
+            ASSERT(m_nodeIndex != NoNode);
+            stream.appendAndLog(VariableEvent::death(m_nodeIndex));
+        }
+        
+        return result;
     }
 
     // Used to check the operands of operations to see if they are on
@@ -225,7 +260,7 @@ public:
     }
 
     // Called when a VirtualRegister is being spilled to the RegisterFile for the first time.
-    void spill(DataFormat spillFormat)
+    void spill(VariableEventStream& stream, VirtualRegister virtualRegister, DataFormat spillFormat)
     {
         // We shouldn't be spill values that don't need spilling.
         ASSERT(!m_canFill);
@@ -236,15 +271,21 @@ public:
         m_registerFormat = DataFormatNone;
         m_spillFormat = spillFormat;
         m_canFill = true;
+        
+        if (m_bornForOSR)
+            appendSpill(Spill, stream, virtualRegister);
     }
 
     // Called on values that don't need spilling (constants and values that have
     // already been spilled), to mark them as no longer being in machine registers.
-    void setSpilled()
+    void setSpilled(VariableEventStream& stream, VirtualRegister virtualRegister)
     {
         // Should only be called on values that don't need spilling, and are currently in registers.
         ASSERT(m_canFill && m_registerFormat != DataFormatNone);
         m_registerFormat = DataFormatNone;
+        
+        if (m_bornForOSR)
+            appendSpill(Spill, stream, virtualRegister);
     }
     
     void killSpilled()
@@ -256,46 +297,67 @@ public:
     // Record that this value is filled into machine registers,
     // tracking which registers, and what format the value has.
 #if USE(JSVALUE64)
-    void fillJSValue(GPRReg gpr, DataFormat format = DataFormatJS)
+    void fillJSValue(VariableEventStream& stream, GPRReg gpr, DataFormat format = DataFormatJS)
     {
         ASSERT(format & DataFormatJS);
         m_registerFormat = format;
         u.gpr = gpr;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
     }
 #elif USE(JSVALUE32_64)
-    void fillJSValue(GPRReg tagGPR, GPRReg payloadGPR, DataFormat format = DataFormatJS)
+    void fillJSValue(VariableEventStream& stream, GPRReg tagGPR, GPRReg payloadGPR, DataFormat format = DataFormatJS)
     {
         ASSERT(format & DataFormatJS);
         m_registerFormat = format;
         u.v.tagGPR = tagGPR; // FIXME: for JSValues with known type (boolean, integer, cell etc.) no tagGPR is needed?
         u.v.payloadGPR = payloadGPR;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
     }
-    void fillCell(GPRReg gpr)
+    void fillCell(VariableEventStream& stream, GPRReg gpr)
     {
         m_registerFormat = DataFormatCell;
         u.gpr = gpr;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
     }
 #endif
-    void fillInteger(GPRReg gpr)
+    void fillInteger(VariableEventStream& stream, GPRReg gpr)
     {
         m_registerFormat = DataFormatInteger;
         u.gpr = gpr;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
     }
-    void fillBoolean(GPRReg gpr)
+    void fillBoolean(VariableEventStream& stream, GPRReg gpr)
     {
         m_registerFormat = DataFormatBoolean;
         u.gpr = gpr;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
     }
-    void fillDouble(FPRReg fpr)
+    void fillDouble(VariableEventStream& stream, FPRReg fpr)
     {
         ASSERT(fpr != InvalidFPRReg);
         m_registerFormat = DataFormatDouble;
         u.fpr = fpr;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
     }
-    void fillStorage(GPRReg gpr)
+    void fillStorage(VariableEventStream& stream, GPRReg gpr)
     {
         m_registerFormat = DataFormatStorage;
         u.gpr = gpr;
+        
+        if (m_bornForOSR)
+            appendFill(Fill, stream);
     }
 
     bool alive()
@@ -304,12 +366,33 @@ public:
     }
 
 private:
+    void appendFill(VariableEventKind kind, VariableEventStream& stream)
+    {
+        if (m_registerFormat == DataFormatDouble) {
+            stream.appendAndLog(VariableEvent::fillFPR(kind, m_nodeIndex, u.fpr));
+            return;
+        }
+#if USE(JSVALUE32_64)
+        if (m_registerFormat & DataFormatJS) {
+            stream.appendAndLog(VariableEvent::fillPair(kind, m_nodeIndex, u.v.tagGPR, u.v.payloadGPR));
+            return;
+        }
+#endif
+        stream.appendAndLog(VariableEvent::fillGPR(kind, m_nodeIndex, u.gpr, m_registerFormat));
+    }
+    
+    void appendSpill(VariableEventKind kind, VariableEventStream& stream, VirtualRegister virtualRegister)
+    {
+        stream.appendAndLog(VariableEvent::spill(kind, m_nodeIndex, virtualRegister, m_spillFormat));
+    }
+    
     // The index of the node whose result is stored in this virtual register.
     NodeIndex m_nodeIndex;
     uint32_t m_useCount;
     DataFormat m_registerFormat;
     DataFormat m_spillFormat;
     bool m_canFill;
+    bool m_bornForOSR;
     union {
         GPRReg gpr;
         FPRReg fpr;
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
index 4689470c8..c7a4d94d2 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.cpp
+++ b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -327,14 +327,11 @@ void Graph::dumpBlockHeader(const char* prefix, BlockIndex blockIndex, PhiNodeDu
         dataLog("\n");
     }
     dataLog("%s  Phi Nodes:", prefix);
-    unsigned count = 0;
     for (size_t i = 0; i < block->phis.size(); ++i) {
         NodeIndex phiNodeIndex = block->phis[i];
         Node& phiNode = at(phiNodeIndex);
         if (!phiNode.shouldGenerate() && phiNodeDumpMode == DumpLivePhisOnly)
             continue;
-        if (!((++count) % 4))
-            dataLog("\n%s      ", prefix);
         dataLog(" @%u->(", phiNodeIndex);
         if (phiNode.child1()) {
             dataLog("@%u", phiNode.child1().index());
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
index 3c85cc77c..497fc346f 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
@@ -88,8 +88,6 @@ void JITCompiler::compileBody(SpeculativeJIT& speculative)
     breakpoint();
 #endif
     
-    addPtr(TrustedImm32(1), AbsoluteAddress(codeBlock()->addressOfSpeculativeSuccessCounter()));
-
     bool compiledSpeculative = speculative.compile();
     ASSERT_UNUSED(compiledSpeculative, compiledSpeculative);
 }
@@ -174,6 +172,7 @@ void JITCompiler::link(LinkBuffer& linkBuffer)
 #endif
         info.patch.dfg.deltaCallToSlowCase = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_slowPathGenerator->label()));
         info.patch.dfg.deltaCallToDone = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_done));
+        info.patch.dfg.deltaCallToStorageLoad = differenceBetweenCodePtr(callReturnLocation, linkBuffer.locationOf(m_propertyAccesses[i].m_propertyStorageLoad));
         info.patch.dfg.baseGPR = m_propertyAccesses[i].m_baseGPR;
 #if USE(JSVALUE64)
         info.patch.dfg.valueGPR = m_propertyAccesses[i].m_valueGPR;
@@ -205,11 +204,14 @@ void JITCompiler::link(LinkBuffer& linkBuffer)
             codeBlock()->watchpoint(exit.m_watchpointIndex).correctLabels(linkBuffer);
     }
     
+    codeBlock()->minifiedDFG().setOriginalGraphSize(m_graph.size());
     codeBlock()->shrinkToFit(CodeBlock::LateShrink);
 }
 
 bool JITCompiler::compile(JITCode& entry)
 {
+    SamplingRegion samplingRegion("DFG Backend");
+
     setStartOfCode();
     compileEntry();
     SpeculativeJIT speculative(*this);
@@ -243,6 +245,8 @@ bool JITCompiler::compile(JITCode& entry)
 
 bool JITCompiler::compileFunction(JITCode& entry, MacroAssemblerCodePtr& entryWithArityCheck)
 {
+    SamplingRegion samplingRegion("DFG Backend");
+    
     setStartOfCode();
     compileEntry();
 
diff --git a/Source/JavaScriptCore/dfg/DFGJITCompiler.h b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
index ed16459cc..24dbbdcd0 100644
--- a/Source/JavaScriptCore/dfg/DFGJITCompiler.h
+++ b/Source/JavaScriptCore/dfg/DFGJITCompiler.h
@@ -136,6 +136,7 @@ struct PropertyAccessRecord {
         CodeOrigin codeOrigin,
         MacroAssembler::DataLabelPtr structureImm,
         MacroAssembler::PatchableJump structureCheck,
+        MacroAssembler::ConvertibleLoadLabel propertyStorageLoad,
         MacroAssembler::DataLabelCompact loadOrStore,
         SlowPathGenerator* slowPathGenerator,
         MacroAssembler::Label done,
@@ -148,6 +149,7 @@ struct PropertyAccessRecord {
         CodeOrigin codeOrigin,
         MacroAssembler::DataLabelPtr structureImm,
         MacroAssembler::PatchableJump structureCheck,
+        MacroAssembler::ConvertibleLoadLabel propertyStorageLoad,
         MacroAssembler::DataLabelCompact tagLoadOrStore,
         MacroAssembler::DataLabelCompact payloadLoadOrStore,
         SlowPathGenerator* slowPathGenerator,
@@ -161,6 +163,7 @@ struct PropertyAccessRecord {
         : m_codeOrigin(codeOrigin)
         , m_structureImm(structureImm)
         , m_structureCheck(structureCheck)
+        , m_propertyStorageLoad(propertyStorageLoad)
 #if USE(JSVALUE64)
         , m_loadOrStore(loadOrStore)
 #elif USE(JSVALUE32_64)
@@ -182,6 +185,7 @@ struct PropertyAccessRecord {
     CodeOrigin m_codeOrigin;
     MacroAssembler::DataLabelPtr m_structureImm;
     MacroAssembler::PatchableJump m_structureCheck;
+    MacroAssembler::ConvertibleLoadLabel m_propertyStorageLoad;
 #if USE(JSVALUE64)
     MacroAssembler::DataLabelCompact m_loadOrStore;
 #elif USE(JSVALUE32_64)
diff --git a/Source/JavaScriptCore/dfg/DFGMinifiedGraph.h b/Source/JavaScriptCore/dfg/DFGMinifiedGraph.h
new file mode 100644
index 000000000..b38ef07ed
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGMinifiedGraph.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGMinifiedGraph_h
+#define DFGMinifiedGraph_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGMinifiedNode.h"
+#include <algorithm>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class MinifiedGraph {
+public:
+    MinifiedGraph() { }
+
+    MinifiedNode* at(NodeIndex nodeIndex)
+    {
+        if (!m_list.size())
+            return 0;
+        MinifiedNode* entry =
+            binarySearch<MinifiedNode, NodeIndex, MinifiedNode::getIndex>(
+                m_list.begin(), m_list.size(), nodeIndex, WTF::KeyMustNotBePresentInArray);
+        if (entry->index() != nodeIndex)
+            return 0;
+        return entry;
+    }
+    
+    void append(const MinifiedNode& node)
+    {
+        m_list.append(node);
+    }
+    
+    void prepareAndShrink()
+    {
+        std::sort(m_list.begin(), m_list.end(), MinifiedNode::compareByNodeIndex);
+        m_list.shrinkToFit();
+    }
+    
+    void setOriginalGraphSize(size_t size) { m_size = size; }
+    
+    size_t originalGraphSize() const { return m_size; }
+
+private:
+    Vector<MinifiedNode> m_list;
+    size_t m_size;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGMinifiedGraph_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGMinifiedNode.cpp b/Source/JavaScriptCore/dfg/DFGMinifiedNode.cpp
new file mode 100644
index 000000000..6362344fb
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGMinifiedNode.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGMinifiedNode.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGNode.h"
+
+namespace JSC { namespace DFG {
+
+MinifiedNode MinifiedNode::fromNode(NodeIndex nodeIndex, Node& node)
+{
+    ASSERT(belongsInMinifiedGraph(node.op()));
+    MinifiedNode result;
+    result.m_index = nodeIndex;
+    result.m_op = node.op();
+    if (hasChild(node.op()))
+        result.m_childOrInfo = node.child1().index();
+    else if (hasConstantNumber(node.op()))
+        result.m_childOrInfo = node.constantNumber();
+    else if (hasWeakConstant(node.op()))
+        result.m_childOrInfo = bitwise_cast<uintptr_t>(node.weakConstant());
+    else {
+        ASSERT(node.op() == PhantomArguments);
+        result.m_childOrInfo = 0;
+    }
+    return result;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGMinifiedNode.h b/Source/JavaScriptCore/dfg/DFGMinifiedNode.h
new file mode 100644
index 000000000..b80cbd777
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGMinifiedNode.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGMinifiedNode_h
+#define DFGMinifiedNode_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGNodeType.h"
+
+namespace JSC { namespace DFG {
+
+struct Node;
+
+inline bool belongsInMinifiedGraph(NodeType type)
+{
+    switch (type) {
+    case JSConstant:
+    case WeakJSConstant:
+    case ValueToInt32:
+    case Int32ToDouble:
+    case UInt32ToNumber:
+    case DoubleAsInt32:
+    case PhantomArguments:
+        return true;
+    default:
+        return false;
+    }
+}
+
+class MinifiedNode {
+public:
+    MinifiedNode() { }
+    
+    static MinifiedNode fromNode(NodeIndex, Node&);
+    
+    NodeIndex index() const { return m_index; }
+    NodeType op() const { return m_op; }
+    
+    bool hasChild1() const { return hasChild(m_op); }
+    
+    NodeIndex child1() const
+    {
+        ASSERT(hasChild(m_op));
+        return m_childOrInfo;
+    }
+    
+    bool hasConstant() const { return hasConstantNumber() || hasWeakConstant(); }
+    
+    bool hasConstantNumber() const { return hasConstantNumber(m_op); }
+    
+    unsigned constantNumber() const
+    {
+        ASSERT(hasConstantNumber(m_op));
+        return m_childOrInfo;
+    }
+    
+    bool hasWeakConstant() const { return hasWeakConstant(m_op); }
+    
+    JSCell* weakConstant() const
+    {
+        ASSERT(hasWeakConstant(m_op));
+        return bitwise_cast<JSCell*>(m_childOrInfo);
+    }
+    
+    static NodeIndex getIndex(MinifiedNode* node) { return node->index(); }
+    static bool compareByNodeIndex(const MinifiedNode& a, const MinifiedNode& b)
+    {
+        return a.m_index < b.m_index;
+    }
+    
+private:
+    static bool hasChild(NodeType type)
+    {
+        switch (type) {
+        case ValueToInt32:
+        case Int32ToDouble:
+        case UInt32ToNumber:
+        case DoubleAsInt32:
+            return true;
+        default:
+            return false;
+        }
+    }
+    static bool hasConstantNumber(NodeType type)
+    {
+        return type == JSConstant;
+    }
+    static bool hasWeakConstant(NodeType type)
+    {
+        return type == WeakJSConstant;
+    }
+    
+    NodeIndex m_index;
+    NodeType m_op;
+    uintptr_t m_childOrInfo; // Nodes in the minified graph have only one child each.
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGMinifiedNode_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 40701c3bd..ae07d5512 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -40,6 +40,7 @@
 #include "JSValue.h"
 #include "Operands.h"
 #include "SpeculatedType.h"
+#include "StructureSet.h"
 #include "ValueProfile.h"
 
 namespace JSC { namespace DFG {
@@ -707,7 +708,7 @@ struct Node {
         ASSERT(m_virtualRegister != InvalidVirtualRegister);
         return m_virtualRegister;
     }
-
+    
     void setVirtualRegister(VirtualRegister virtualRegister)
     {
         ASSERT(hasResult());
@@ -731,9 +732,21 @@ struct Node {
         return m_refCount;
     }
     
-    bool willHaveCodeGen()
+    bool willHaveCodeGenOrOSR()
     {
-        return shouldGenerate() && op() != Phantom && op() != Nop;
+        switch (op()) {
+        case SetLocal:
+        case Int32ToDouble:
+        case ValueToInt32:
+        case UInt32ToNumber:
+        case DoubleAsInt32:
+            return true;
+        case Phantom:
+        case Nop:
+            return false;
+        default:
+            return shouldGenerate();
+        }
     }
 
     unsigned refCount()
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
index d0e0de9da..e9b02b2e3 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.cpp
@@ -33,17 +33,7 @@
 
 namespace JSC { namespace DFG {
 
-static unsigned computeNumVariablesForCodeOrigin(
-    CodeBlock* codeBlock, const CodeOrigin& codeOrigin)
-{
-    if (!codeOrigin.inlineCallFrame)
-        return codeBlock->m_numCalleeRegisters;
-    return
-        codeOrigin.inlineCallFrame->stackOffset +
-        baselineCodeBlockForInlineCallFrame(codeOrigin.inlineCallFrame)->m_numCalleeRegisters;
-}
-
-OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAValueProfile valueProfile, MacroAssembler::Jump check, SpeculativeJIT* jit, unsigned recoveryIndex)
+OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAValueProfile valueProfile, MacroAssembler::Jump check, SpeculativeJIT* jit, unsigned streamIndex, unsigned recoveryIndex)
     : m_jsValueSource(jsValueSource)
     , m_valueProfile(valueProfile)
     , m_check(check)
@@ -54,29 +44,15 @@ OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAVal
     , m_watchpointIndex(std::numeric_limits<unsigned>::max())
     , m_kind(kind)
     , m_count(0)
-    , m_arguments(jit->m_arguments.size())
-    , m_variables(computeNumVariablesForCodeOrigin(jit->m_jit.graph().m_profiledBlock, jit->m_codeOriginForOSR))
+    , m_streamIndex(streamIndex)
     , m_lastSetOperand(jit->m_lastSetOperand)
 {
     ASSERT(m_codeOrigin.isSet());
-    for (unsigned argument = 0; argument < m_arguments.size(); ++argument)
-        m_arguments[argument] = jit->computeValueRecoveryFor(jit->m_arguments[argument]);
-    for (unsigned variable = 0; variable < m_variables.size(); ++variable)
-        m_variables[variable] = jit->computeValueRecoveryFor(jit->m_variables[variable]);
-}
-
-void OSRExit::dump(FILE* out) const
-{
-    for (unsigned argument = 0; argument < m_arguments.size(); ++argument)
-        m_arguments[argument].dump(out);
-    fprintf(out, " : ");
-    for (unsigned variable = 0; variable < m_variables.size(); ++variable)
-        m_variables[variable].dump(out);
 }
 
 bool OSRExit::considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
 {
-    if (static_cast<double>(m_count) / dfgCodeBlock->speculativeFailCounter() <= Options::osrExitProminenceForFrequentExitSite)
+    if (static_cast<double>(m_count) / dfgCodeBlock->osrExitCounter() <= Options::osrExitProminenceForFrequentExitSite())
         return false;
     
     FrequentExitSite exitSite;
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExit.h b/Source/JavaScriptCore/dfg/DFGOSRExit.h
index 683f260f1..cd2434c11 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExit.h
+++ b/Source/JavaScriptCore/dfg/DFGOSRExit.h
@@ -35,6 +35,7 @@
 #include "DFGCorrectableJumpPoint.h"
 #include "DFGExitProfile.h"
 #include "DFGGPRInfo.h"
+#include "DFGValueRecoveryOverride.h"
 #include "MacroAssembler.h"
 #include "MethodOfGettingAValueProfile.h"
 #include "Operands.h"
@@ -83,7 +84,7 @@ private:
 // This structure describes how to exit the speculative path by
 // going into baseline code.
 struct OSRExit {
-    OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, MacroAssembler::Jump, SpeculativeJIT*, unsigned recoveryIndex = 0);
+    OSRExit(ExitKind, JSValueSource, MethodOfGettingAValueProfile, MacroAssembler::Jump, SpeculativeJIT*, unsigned streamIndex, unsigned recoveryIndex = 0);
     
     MacroAssemblerCodeRef m_code;
     
@@ -101,38 +102,6 @@ struct OSRExit {
     ExitKind m_kind;
     uint32_t m_count;
     
-    // Convenient way of iterating over ValueRecoveries while being
-    // generic over argument versus variable.
-    int numberOfRecoveries() const { return m_arguments.size() + m_variables.size(); }
-    const ValueRecovery& valueRecovery(int index) const
-    {
-        if (index < (int)m_arguments.size())
-            return m_arguments[index];
-        return m_variables[index - m_arguments.size()];
-    }
-    ValueRecovery& valueRecoveryForOperand(int operand)
-    {
-        if (operandIsArgument(operand))
-            return m_arguments[operandToArgument(operand)];
-        return m_variables[operand];
-    }
-    bool isArgument(int index) const { return index < (int)m_arguments.size(); }
-    bool isVariable(int index) const { return !isArgument(index); }
-    int argumentForIndex(int index) const
-    {
-        return index;
-    }
-    int variableForIndex(int index) const
-    {
-        return index - m_arguments.size();
-    }
-    int operandForIndex(int index) const
-    {
-        if (index < (int)m_arguments.size())
-            return operandToArgument(index);
-        return index - m_arguments.size();
-    }
-    
     bool considerAddingAsFrequentExitSite(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock)
     {
         if (!m_count || !exitKindIsCountable(m_kind))
@@ -140,11 +109,10 @@ struct OSRExit {
         return considerAddingAsFrequentExitSiteSlow(dfgCodeBlock, profiledCodeBlock);
     }
     
-    void dump(FILE* out) const;
-    
-    Vector<ValueRecovery, 0> m_arguments;
-    Vector<ValueRecovery, 0> m_variables;
+    unsigned m_streamIndex;
     int m_lastSetOperand;
+    
+    RefPtr<ValueRecoveryOverride> m_valueRecoveryOverride;
 
 private:
     bool considerAddingAsFrequentExitSiteSlow(CodeBlock* dfgCodeBlock, CodeBlock* profiledCodeBlock);
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
index e617b5479..2ce1c887b 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.cpp
@@ -29,6 +29,7 @@
 #if ENABLE(DFG_JIT)
 
 #include "CallFrame.h"
+#include "DFGCommon.h"
 #include "LinkBuffer.h"
 #include "RepatchBuffer.h"
 
@@ -38,6 +39,8 @@ extern "C" {
 
 void compileOSRExit(ExecState* exec)
 {
+    SamplingRegion samplingRegion("DFG OSR Exit Compilation");
+    
     CodeBlock* codeBlock = exec->codeBlock();
     
     ASSERT(codeBlock);
@@ -63,12 +66,22 @@ void compileOSRExit(ExecState* exec)
             ->jitCompile(exec);
     }
     
+    // Compute the value recoveries.
+    Operands<ValueRecovery> operands;
+    codeBlock->variableEventStream().reconstruct(codeBlock, exit.m_codeOrigin, codeBlock->minifiedDFG(), exit.m_streamIndex, operands);
+    
+    // There may be an override, for forward speculations.
+    if (!!exit.m_valueRecoveryOverride) {
+        operands.setOperand(
+            exit.m_valueRecoveryOverride->operand, exit.m_valueRecoveryOverride->recovery);
+    }
+    
     SpeculationRecovery* recovery = 0;
     if (exit.m_recoveryIndex)
         recovery = &codeBlock->speculationRecovery(exit.m_recoveryIndex - 1);
 
 #if DFG_ENABLE(DEBUG_VERBOSE)
-    dataLog("Generating OSR exit #%u (bc#%u, @%u, %s) for code block %p.\n", exitIndex, exit.m_codeOrigin.bytecodeIndex, exit.m_nodeIndex, exitKindToString(exit.m_kind), codeBlock);
+    dataLog("Generating OSR exit #%u (seq#%u, bc#%u, @%u, %s) for code block %p.\n", exitIndex, exit.m_streamIndex, exit.m_codeOrigin.bytecodeIndex, exit.m_nodeIndex, exitKindToString(exit.m_kind), codeBlock);
 #endif
 
     {
@@ -76,10 +89,11 @@ void compileOSRExit(ExecState* exec)
         OSRExitCompiler exitCompiler(jit);
 
         jit.jitAssertHasValidCallFrame();
-        exitCompiler.compileExit(exit, recovery);
+        exitCompiler.compileExit(exit, operands, recovery);
         
         LinkBuffer patchBuffer(*globalData, &jit, codeBlock);
-        exit.m_code = FINALIZE_CODE(
+        exit.m_code = FINALIZE_CODE_IF(
+            shouldShowDisassembly(),
             patchBuffer,
             ("DFG OSR exit #%u (bc#%u, @%u, %s) from CodeBlock %p",
              exitIndex, exit.m_codeOrigin.bytecodeIndex, exit.m_nodeIndex,
@@ -102,42 +116,14 @@ void OSRExitCompiler::handleExitCounts(const OSRExit& exit)
     
     m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.codeBlock()), GPRInfo::regT0);
     
-    AssemblyHelpers::JumpList tooFewFails;
+    AssemblyHelpers::Jump tooFewFails;
     
-    if (exit.m_kind == InadequateCoverage) {
-        // Proceed based on the assumption that we can profitably optimize this code once
-        // it has executed enough times.
-        
-        m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfForcedOSRExitCounter()), GPRInfo::regT2);
-        m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()), GPRInfo::regT1);
-        m_jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);
-        m_jit.add32(AssemblyHelpers::TrustedImm32(-1), GPRInfo::regT1);
-        m_jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfForcedOSRExitCounter()));
-        m_jit.store32(GPRInfo::regT1, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()));
-        
-        m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.baselineCodeBlock()), GPRInfo::regT0);
-
-        tooFewFails.append(m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(Options::forcedOSRExitCountForReoptimization)));
-
-    } else {
-        // Proceed based on the assumption that we can handle these exits so long as they
-        // don't get too frequent.
-        
-        m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeFailCounter()), GPRInfo::regT2);
-        m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()), GPRInfo::regT1);
-        m_jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);
-        m_jit.add32(AssemblyHelpers::TrustedImm32(-1), GPRInfo::regT1);
-        m_jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeFailCounter()));
-        m_jit.store32(GPRInfo::regT1, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfSpeculativeSuccessCounter()));
-    
-        m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.baselineCodeBlock()), GPRInfo::regT0);
+    m_jit.load32(AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()), GPRInfo::regT2);
+    m_jit.add32(AssemblyHelpers::TrustedImm32(1), GPRInfo::regT2);
+    m_jit.store32(GPRInfo::regT2, AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfOSRExitCounter()));
+    m_jit.move(AssemblyHelpers::TrustedImmPtr(m_jit.baselineCodeBlock()), GPRInfo::regT0);
+    tooFewFails = m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(m_jit.codeBlock()->exitCountThresholdForReoptimization()));
     
-        tooFewFails.append(m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, AssemblyHelpers::TrustedImm32(m_jit.codeBlock()->largeFailCountThreshold())));
-        m_jit.mul32(AssemblyHelpers::TrustedImm32(Options::desiredSpeculativeSuccessFailRatio), GPRInfo::regT2, GPRInfo::regT2);
-    
-        tooFewFails.append(m_jit.branch32(AssemblyHelpers::BelowOrEqual, GPRInfo::regT2, GPRInfo::regT1));
-    }
-
     // Reoptimize as soon as possible.
 #if !NUMBER_OF_ARGUMENT_REGISTERS
     m_jit.poke(GPRInfo::regT0);
@@ -157,6 +143,7 @@ void OSRExitCompiler::handleExitCounts(const OSRExit& exit)
             m_jit.baselineCodeBlock()->counterValueForOptimizeAfterLongWarmUp(),
             m_jit.baselineCodeBlock());
     m_jit.store32(AssemblyHelpers::TrustedImm32(-targetValue), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecuteCounter()));
+    targetValue = ExecutionCounter::clippedThreshold(m_jit.codeBlock()->globalObject(), targetValue);
     m_jit.store32(AssemblyHelpers::TrustedImm32(targetValue), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionActiveThreshold()));
     m_jit.store32(AssemblyHelpers::TrustedImm32(ExecutionCounter::formattedTotalCount(targetValue)), AssemblyHelpers::Address(GPRInfo::regT0, CodeBlock::offsetOfJITExecutionTotalCount()));
     
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.h b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.h
index ae29a92d5..a2be5b849 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.h
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler.h
@@ -48,7 +48,7 @@ public:
     {
     }
     
-    void compileExit(const OSRExit&, SpeculationRecovery*);
+    void compileExit(const OSRExit&, const Operands<ValueRecovery>&, SpeculationRecovery*);
 
 private:
 #if !ASSERT_DISABLED
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
index 09912b3e5..6bc136da4 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler32_64.cpp
@@ -29,10 +29,11 @@
 #if ENABLE(DFG_JIT) && USE(JSVALUE32_64)
 
 #include "DFGOperations.h"
+#include <wtf/DataLog.h>
 
 namespace JSC { namespace DFG {
 
-void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* recovery)
+void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecovery>& operands, SpeculationRecovery* recovery)
 {
     // 1) Pro-forma stuff.
 #if DFG_ENABLE(DEBUG_VERBOSE)
@@ -44,7 +45,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
         dataLog(" -> %p ", codeOrigin.inlineCallFrame->executable.get());
     }
     dataLog(") at JIT offset 0x%x  ", m_jit.debugOffset());
-    exit.dump(WTF::dataFile());
+    dumpOperands(operands, WTF::dataFile());
 #endif
 #if DFG_ENABLE(VERBOSE_SPECULATION_FAILURE)
     SpeculationFailureDebugInfo* debugInfo = new SpeculationFailureDebugInfo;
@@ -113,7 +114,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //    GPRInfo::numberOfRegisters of them. Also see if there are any constants,
     //    any undefined slots, any FPR slots, and any unboxed ints.
             
-    Vector<bool> poisonedVirtualRegisters(exit.m_variables.size());
+    Vector<bool> poisonedVirtualRegisters(operands.numberOfLocals());
     for (unsigned i = 0; i < poisonedVirtualRegisters.size(); ++i)
         poisonedVirtualRegisters[i] = false;
 
@@ -133,8 +134,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     bool haveUndefined = false;
     bool haveArguments = false;
     
-    for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-        const ValueRecovery& recovery = exit.valueRecovery(index);
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
         switch (recovery.technique()) {
         case DisplacedInRegisterFile:
         case Int32DisplacedInRegisterFile:
@@ -150,8 +151,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             // to ensure this happens efficiently. Note that we expect this case
             // to be rare, so the handling of it is optimized for the cases in
             // which it does not happen.
-            if (recovery.virtualRegister() < (int)exit.m_variables.size()) {
-                switch (exit.m_variables[recovery.virtualRegister()].technique()) {
+            if (recovery.virtualRegister() < (int)operands.numberOfLocals()) {
+                switch (operands.local(recovery.virtualRegister()).technique()) {
                 case InGPR:
                 case UnboxedInt32InGPR:
                 case UnboxedBooleanInGPR:
@@ -214,19 +215,19 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     // 5) Perform all reboxing of integers and cells, except for those in registers.
 
     if (haveUnboxedInt32InRegisterFile || haveUnboxedCellInRegisterFile || haveUnboxedBooleanInRegisterFile) {
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             switch (recovery.technique()) {
             case AlreadyInRegisterFileAsUnboxedInt32:
-                m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::Int32Tag), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(exit.operandForIndex(index))));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::Int32Tag), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(operands.operandForIndex(index))));
                 break;
 
             case AlreadyInRegisterFileAsUnboxedCell:
-                m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(exit.operandForIndex(index))));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(operands.operandForIndex(index))));
                 break;
 
             case AlreadyInRegisterFileAsUnboxedBoolean:
-                m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::BooleanTag), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(exit.operandForIndex(index))));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::BooleanTag), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(operands.operandForIndex(index))));
                 break;
 
             default:
@@ -239,19 +240,19 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //    Note that GPRs do not have a fast change (like haveFPRs) because we expect that
     //    most OSR failure points will have at least one GPR that needs to be dumped.
     
-    initializePoisoned(exit.m_variables.size());
+    initializePoisoned(operands.numberOfLocals());
     unsigned currentPoisonIndex = 0;
     
-    for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-        const ValueRecovery& recovery = exit.valueRecovery(index);
-        int operand = exit.operandForIndex(index);
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        int operand = operands.operandForIndex(index);
         switch (recovery.technique()) {
         case InGPR:
         case UnboxedInt32InGPR:
         case UnboxedBooleanInGPR:
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
                 m_jit.store32(recovery.gpr(), reinterpret_cast<char*>(scratchDataBuffer + currentPoisonIndex) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
-                m_poisonScratchIndices[exit.variableForIndex(index)] = currentPoisonIndex;
+                m_poisonScratchIndices[operands.variableForIndex(index)] = currentPoisonIndex;
                 currentPoisonIndex++;
             } else {
                 uint32_t tag = JSValue::EmptyValueTag;
@@ -266,10 +267,10 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             }
             break;
         case InPair:
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
                 m_jit.store32(recovery.tagGPR(), reinterpret_cast<char*>(scratchDataBuffer + currentPoisonIndex) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
                 m_jit.store32(recovery.payloadGPR(), reinterpret_cast<char*>(scratchDataBuffer + currentPoisonIndex) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
-                m_poisonScratchIndices[exit.variableForIndex(index)] = currentPoisonIndex;
+                m_poisonScratchIndices[operands.variableForIndex(index)] = currentPoisonIndex;
                 currentPoisonIndex++;
             } else {
                 m_jit.store32(recovery.tagGPR(), AssemblyHelpers::tagFor((VirtualRegister)operand));
@@ -291,7 +292,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             
             m_jit.convertInt32ToDouble(recovery.gpr(), FPRInfo::fpRegT0);
             m_jit.addDouble(AssemblyHelpers::AbsoluteAddress(&AssemblyHelpers::twoToThe32), FPRInfo::fpRegT0);
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
                 m_jit.move(AssemblyHelpers::TrustedImmPtr(scratchDataBuffer + currentPoisonIndex), addressGPR);
                 m_jit.storeDouble(FPRInfo::fpRegT0, addressGPR);
             } else
@@ -301,7 +302,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             
             positive.link(&m_jit);
             
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
                 m_jit.store32(recovery.gpr(), reinterpret_cast<char*>(scratchDataBuffer + currentPoisonIndex) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
                 m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::Int32Tag), reinterpret_cast<char*>(scratchDataBuffer + currentPoisonIndex) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
             } else {
@@ -315,8 +316,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             m_jit.loadDouble(addressGPR, FPRInfo::fpRegT0);
             m_jit.loadPtr(myScratch, addressGPR);
                               
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
-                m_poisonScratchIndices[exit.variableForIndex(index)] = currentPoisonIndex;
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
+                m_poisonScratchIndices[operands.variableForIndex(index)] = currentPoisonIndex;
                 currentPoisonIndex++;
             }
             break;
@@ -329,16 +330,16 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     // 7) Dump all doubles into the register file, or to the scratch storage if the
     //    destination virtual register is poisoned.
     if (haveFPRs) {
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != InFPR)
                 continue;
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
                 m_jit.storeDouble(recovery.fpr(), scratchDataBuffer + currentPoisonIndex);
-                m_poisonScratchIndices[exit.variableForIndex(index)] = currentPoisonIndex;
+                m_poisonScratchIndices[operands.variableForIndex(index)] = currentPoisonIndex;
                 currentPoisonIndex++;
             } else
-                m_jit.storeDouble(recovery.fpr(), AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)));
+                m_jit.storeDouble(recovery.fpr(), AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)));
         }
     }
     
@@ -356,8 +357,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             // that is far from guaranteed.
         
             unsigned displacementIndex = 0;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
                     m_jit.load32(AssemblyHelpers::payloadFor(recovery.virtualRegister()), GPRInfo::toRegister(displacementIndex++));
@@ -381,15 +382,15 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             }
         
             displacementIndex = 0;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
                 case Int32DisplacedInRegisterFile:
                 case CellDisplacedInRegisterFile:
                 case BooleanDisplacedInRegisterFile:
-                    m_jit.store32(GPRInfo::toRegister(displacementIndex++), AssemblyHelpers::payloadFor((VirtualRegister)exit.operandForIndex(index)));
-                    m_jit.store32(GPRInfo::toRegister(displacementIndex++), AssemblyHelpers::tagFor((VirtualRegister)exit.operandForIndex(index)));
+                    m_jit.store32(GPRInfo::toRegister(displacementIndex++), AssemblyHelpers::payloadFor((VirtualRegister)operands.operandForIndex(index)));
+                    m_jit.store32(GPRInfo::toRegister(displacementIndex++), AssemblyHelpers::tagFor((VirtualRegister)operands.operandForIndex(index)));
                     break;
                 default:
                     break;
@@ -414,8 +415,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             // to their new (old JIT) locations.
         
             unsigned scratchIndex = numberOfPoisonedVirtualRegisters;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
                     m_jit.load32(AssemblyHelpers::payloadFor(recovery.virtualRegister()), GPRInfo::regT0);
@@ -436,30 +437,30 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             }
         
             scratchIndex = numberOfPoisonedVirtualRegisters;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
                     m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + scratchIndex) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), GPRInfo::regT0);
                     m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + scratchIndex) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag), GPRInfo::regT1);
-                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)exit.operandForIndex(index)));
-                    m_jit.store32(GPRInfo::regT1, AssemblyHelpers::tagFor((VirtualRegister)exit.operandForIndex(index)));
+                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)operands.operandForIndex(index)));
+                    m_jit.store32(GPRInfo::regT1, AssemblyHelpers::tagFor((VirtualRegister)operands.operandForIndex(index)));
                     scratchIndex++;
                     break;
                 case Int32DisplacedInRegisterFile:
                     m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + scratchIndex++) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), GPRInfo::regT0);
-                    m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::Int32Tag), AssemblyHelpers::tagFor((VirtualRegister)exit.operandForIndex(index)));
-                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)exit.operandForIndex(index)));
+                    m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::Int32Tag), AssemblyHelpers::tagFor((VirtualRegister)operands.operandForIndex(index)));
+                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)operands.operandForIndex(index)));
                     break;
                 case CellDisplacedInRegisterFile:
                     m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + scratchIndex++) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), GPRInfo::regT0);
-                    m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)exit.operandForIndex(index)));
-                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)exit.operandForIndex(index)));
+                    m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::CellTag), AssemblyHelpers::tagFor((VirtualRegister)operands.operandForIndex(index)));
+                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)operands.operandForIndex(index)));
                     break;
                 case BooleanDisplacedInRegisterFile:
                     m_jit.load32(reinterpret_cast<char*>(scratchDataBuffer + scratchIndex++) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload), GPRInfo::regT0);
-                    m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::BooleanTag), AssemblyHelpers::tagFor((VirtualRegister)exit.operandForIndex(index)));
-                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)exit.operandForIndex(index)));
+                    m_jit.store32(AssemblyHelpers::TrustedImm32(JSValue::BooleanTag), AssemblyHelpers::tagFor((VirtualRegister)operands.operandForIndex(index)));
+                    m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)operands.operandForIndex(index)));
                     break;
                 default:
                     break;
@@ -473,11 +474,11 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     // 9) Dump all poisoned virtual registers.
     
     if (numberOfPoisonedVirtualRegisters) {
-        for (int virtualRegister = 0; virtualRegister < (int)exit.m_variables.size(); ++virtualRegister) {
+        for (int virtualRegister = 0; virtualRegister < (int)operands.numberOfLocals(); ++virtualRegister) {
             if (!poisonedVirtualRegisters[virtualRegister])
                 continue;
             
-            const ValueRecovery& recovery = exit.m_variables[virtualRegister];
+            const ValueRecovery& recovery = operands.local(virtualRegister);
             switch (recovery.technique()) {
             case InGPR:
             case UnboxedInt32InGPR:
@@ -519,16 +520,16 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             m_jit.move(AssemblyHelpers::TrustedImm32(jsUndefined().tag()), GPRInfo::regT1);
         }
         
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != Constant)
                 continue;
             if (recovery.constant().isUndefined()) {
-                m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)exit.operandForIndex(index)));
-                m_jit.store32(GPRInfo::regT1, AssemblyHelpers::tagFor((VirtualRegister)exit.operandForIndex(index)));
+                m_jit.store32(GPRInfo::regT0, AssemblyHelpers::payloadFor((VirtualRegister)operands.operandForIndex(index)));
+                m_jit.store32(GPRInfo::regT1, AssemblyHelpers::tagFor((VirtualRegister)operands.operandForIndex(index)));
             } else {
-                m_jit.store32(AssemblyHelpers::TrustedImm32(recovery.constant().payload()), AssemblyHelpers::payloadFor((VirtualRegister)exit.operandForIndex(index)));
-                m_jit.store32(AssemblyHelpers::TrustedImm32(recovery.constant().tag()), AssemblyHelpers::tagFor((VirtualRegister)exit.operandForIndex(index)));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(recovery.constant().payload()), AssemblyHelpers::payloadFor((VirtualRegister)operands.operandForIndex(index)));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(recovery.constant().tag()), AssemblyHelpers::tagFor((VirtualRegister)operands.operandForIndex(index)));
             }
         }
     }
@@ -611,11 +612,11 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //     registers.
     
     if (haveArguments) {
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != ArgumentsThatWereNotCreated)
                 continue;
-            int operand = exit.operandForIndex(index);
+            int operand = operands.operandForIndex(index);
             // Find the right inline call frame.
             InlineCallFrame* inlineCallFrame = 0;
             for (InlineCallFrame* current = exit.m_codeOrigin.inlineCallFrame;
diff --git a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
index 33ba69a35..2f38ba79b 100644
--- a/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOSRExitCompiler64.cpp
@@ -29,10 +29,11 @@
 #if ENABLE(DFG_JIT) && USE(JSVALUE64)
 
 #include "DFGOperations.h"
+#include <wtf/DataLog.h>
 
 namespace JSC { namespace DFG {
 
-void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* recovery)
+void OSRExitCompiler::compileExit(const OSRExit& exit, const Operands<ValueRecovery>& operands, SpeculationRecovery* recovery)
 {
     // 1) Pro-forma stuff.
 #if DFG_ENABLE(DEBUG_VERBOSE)
@@ -44,7 +45,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
         dataLog(" -> %p ", codeOrigin.inlineCallFrame->executable.get());
     }
     dataLog(")  ");
-    exit.dump(WTF::dataFile());
+    dumpOperands(operands, WTF::dataFile());
 #endif
 #if DFG_ENABLE(VERBOSE_SPECULATION_FAILURE)
     SpeculationFailureDebugInfo* debugInfo = new SpeculationFailureDebugInfo;
@@ -110,7 +111,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //    GPRInfo::numberOfRegisters of them. Also see if there are any constants,
     //    any undefined slots, any FPR slots, and any unboxed ints.
             
-    Vector<bool> poisonedVirtualRegisters(exit.m_variables.size());
+    Vector<bool> poisonedVirtualRegisters(operands.numberOfLocals());
     for (unsigned i = 0; i < poisonedVirtualRegisters.size(); ++i)
         poisonedVirtualRegisters[i] = false;
 
@@ -129,8 +130,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     bool haveUInt32s = false;
     bool haveArguments = false;
     
-    for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-        const ValueRecovery& recovery = exit.valueRecovery(index);
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
         switch (recovery.technique()) {
         case Int32DisplacedInRegisterFile:
         case DoubleDisplacedInRegisterFile:
@@ -145,8 +146,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             // to ensure this happens efficiently. Note that we expect this case
             // to be rare, so the handling of it is optimized for the cases in
             // which it does not happen.
-            if (recovery.virtualRegister() < (int)exit.m_variables.size()) {
-                switch (exit.m_variables[recovery.virtualRegister()].technique()) {
+            if (recovery.virtualRegister() < (int)operands.numberOfLocals()) {
+                switch (operands.local(recovery.virtualRegister()).technique()) {
                 case InGPR:
                 case UnboxedInt32InGPR:
                 case UInt32InGPR:
@@ -224,8 +225,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     // 5) Perform all reboxing of integers.
     
     if (haveUnboxedInt32s || haveUInt32s) {
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             switch (recovery.technique()) {
             case UnboxedInt32InGPR:
                 if (recovery.gpr() != alreadyBoxed)
@@ -233,7 +234,7 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
                 break;
                 
             case AlreadyInRegisterFileAsUnboxedInt32:
-                m_jit.store32(AssemblyHelpers::TrustedImm32(static_cast<uint32_t>(TagTypeNumber >> 32)), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(exit.operandForIndex(index))));
+                m_jit.store32(AssemblyHelpers::TrustedImm32(static_cast<uint32_t>(TagTypeNumber >> 32)), AssemblyHelpers::tagFor(static_cast<VirtualRegister>(operands.operandForIndex(index))));
                 break;
                 
             case UInt32InGPR: {
@@ -284,19 +285,19 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //    Note that GPRs do not have a fast change (like haveFPRs) because we expect that
     //    most OSR failure points will have at least one GPR that needs to be dumped.
     
-    initializePoisoned(exit.m_variables.size());
+    initializePoisoned(operands.numberOfLocals());
     unsigned currentPoisonIndex = 0;
     
-    for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-        const ValueRecovery& recovery = exit.valueRecovery(index);
-        int operand = exit.operandForIndex(index);
+    for (size_t index = 0; index < operands.size(); ++index) {
+        const ValueRecovery& recovery = operands[index];
+        int operand = operands.operandForIndex(index);
         switch (recovery.technique()) {
         case InGPR:
         case UnboxedInt32InGPR:
         case UInt32InGPR:
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
                 m_jit.storePtr(recovery.gpr(), scratchDataBuffer + currentPoisonIndex);
-                m_poisonScratchIndices[exit.variableForIndex(index)] = currentPoisonIndex;
+                m_poisonScratchIndices[operands.variableForIndex(index)] = currentPoisonIndex;
                 currentPoisonIndex++;
             } else
                 m_jit.storePtr(recovery.gpr(), AssemblyHelpers::addressFor((VirtualRegister)operand));
@@ -311,8 +312,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     if (haveFPRs) {
         // 7) Box all doubles (relies on there being more GPRs than FPRs)
         
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != InFPR)
                 continue;
             FPRReg fpr = recovery.fpr();
@@ -323,17 +324,17 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
         // 8) Dump all doubles into the register file, or to the scratch storage if
         //    the destination virtual register is poisoned.
         
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != InFPR)
                 continue;
             GPRReg gpr = GPRInfo::toRegister(FPRInfo::toIndex(recovery.fpr()));
-            if (exit.isVariable(index) && poisonedVirtualRegisters[exit.variableForIndex(index)]) {
+            if (operands.isVariable(index) && poisonedVirtualRegisters[operands.variableForIndex(index)]) {
                 m_jit.storePtr(gpr, scratchDataBuffer + currentPoisonIndex);
-                m_poisonScratchIndices[exit.variableForIndex(index)] = currentPoisonIndex;
+                m_poisonScratchIndices[operands.variableForIndex(index)] = currentPoisonIndex;
                 currentPoisonIndex++;
             } else
-                m_jit.storePtr(gpr, AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)));
+                m_jit.storePtr(gpr, AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)));
         }
     }
     
@@ -341,13 +342,13 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     
     // 9) Box all unboxed doubles in the register file.
     if (haveUnboxedDoubles) {
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != AlreadyInRegisterFileAsUnboxedDouble)
                 continue;
-            m_jit.loadDouble(AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)), FPRInfo::fpRegT0);
+            m_jit.loadDouble(AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)), FPRInfo::fpRegT0);
             m_jit.boxDouble(FPRInfo::fpRegT0, GPRInfo::regT0);
-            m_jit.storePtr(GPRInfo::regT0, AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)));
+            m_jit.storePtr(GPRInfo::regT0, AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)));
         }
     }
     
@@ -363,8 +364,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             // that is far from guaranteed.
         
             unsigned displacementIndex = 0;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
                     m_jit.loadPtr(AssemblyHelpers::addressFor(recovery.virtualRegister()), GPRInfo::toRegister(displacementIndex++));
@@ -390,13 +391,13 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             }
         
             displacementIndex = 0;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
                 case Int32DisplacedInRegisterFile:
                 case DoubleDisplacedInRegisterFile:
-                    m_jit.storePtr(GPRInfo::toRegister(displacementIndex++), AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)));
+                    m_jit.storePtr(GPRInfo::toRegister(displacementIndex++), AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)));
                     break;
                     
                 default:
@@ -422,8 +423,8 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             // to their new (old JIT) locations.
         
             unsigned scratchIndex = numberOfPoisonedVirtualRegisters;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
@@ -451,14 +452,14 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
             }
         
             scratchIndex = numberOfPoisonedVirtualRegisters;
-            for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-                const ValueRecovery& recovery = exit.valueRecovery(index);
+            for (size_t index = 0; index < operands.size(); ++index) {
+                const ValueRecovery& recovery = operands[index];
                 switch (recovery.technique()) {
                 case DisplacedInRegisterFile:
                 case Int32DisplacedInRegisterFile:
                 case DoubleDisplacedInRegisterFile:
                     m_jit.loadPtr(scratchDataBuffer + scratchIndex++, GPRInfo::regT0);
-                    m_jit.storePtr(GPRInfo::regT0, AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)));
+                    m_jit.storePtr(GPRInfo::regT0, AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)));
                     break;
                     
                 default:
@@ -473,11 +474,11 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     // 11) Dump all poisoned virtual registers.
     
     if (numberOfPoisonedVirtualRegisters) {
-        for (int virtualRegister = 0; virtualRegister < (int)exit.m_variables.size(); ++virtualRegister) {
+        for (int virtualRegister = 0; virtualRegister < (int)operands.numberOfLocals(); ++virtualRegister) {
             if (!poisonedVirtualRegisters[virtualRegister])
                 continue;
             
-            const ValueRecovery& recovery = exit.m_variables[virtualRegister];
+            const ValueRecovery& recovery = operands.local(virtualRegister);
             switch (recovery.technique()) {
             case InGPR:
             case UnboxedInt32InGPR:
@@ -500,14 +501,14 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
         if (haveUndefined)
             m_jit.move(AssemblyHelpers::TrustedImmPtr(JSValue::encode(jsUndefined())), GPRInfo::regT0);
         
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != Constant)
                 continue;
             if (recovery.constant().isUndefined())
-                m_jit.storePtr(GPRInfo::regT0, AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)));
+                m_jit.storePtr(GPRInfo::regT0, AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)));
             else
-                m_jit.storePtr(AssemblyHelpers::TrustedImmPtr(JSValue::encode(recovery.constant())), AssemblyHelpers::addressFor((VirtualRegister)exit.operandForIndex(index)));
+                m_jit.storePtr(AssemblyHelpers::TrustedImmPtr(JSValue::encode(recovery.constant())), AssemblyHelpers::addressFor((VirtualRegister)operands.operandForIndex(index)));
         }
     }
     
@@ -586,11 +587,11 @@ void OSRExitCompiler::compileExit(const OSRExit& exit, SpeculationRecovery* reco
     //     registers.
     
     if (haveArguments) {
-        for (int index = 0; index < exit.numberOfRecoveries(); ++index) {
-            const ValueRecovery& recovery = exit.valueRecovery(index);
+        for (size_t index = 0; index < operands.size(); ++index) {
+            const ValueRecovery& recovery = operands[index];
             if (recovery.technique() != ArgumentsThatWereNotCreated)
                 continue;
-            int operand = exit.operandForIndex(index);
+            int operand = operands.operandForIndex(index);
             // Find the right inline call frame.
             InlineCallFrame* inlineCallFrame = 0;
             for (InlineCallFrame* current = exit.m_codeOrigin.inlineCallFrame;
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 11362f432..5d6575a6f 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -140,6 +140,62 @@
         "b " LOCAL_REFERENCE(function) "WithReturnAddress" "\n" \
     );
 
+#elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
+
+#define FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_E(function) \
+    asm ( \
+    ".text" "\n" \
+    ".globl " SYMBOL_STRING(function) "\n" \
+    HIDE_SYMBOL(function) "\n" \
+    INLINE_ARM_FUNCTION(function) \
+    SYMBOL_STRING(function) ":" "\n" \
+        "mov a2, lr" "\n" \
+        "b " LOCAL_REFERENCE(function) "WithReturnAddress" "\n" \
+    );
+
+#define FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_ECI(function) \
+    asm ( \
+    ".text" "\n" \
+    ".globl " SYMBOL_STRING(function) "\n" \
+    HIDE_SYMBOL(function) "\n" \
+    INLINE_ARM_FUNCTION(function) \
+    SYMBOL_STRING(function) ":" "\n" \
+        "mov a4, lr" "\n" \
+        "b " LOCAL_REFERENCE(function) "WithReturnAddress" "\n" \
+    );
+
+// EncodedJSValue in JSVALUE32_64 is a 64-bit integer. When being compiled in ARM EABI, it must be aligned even-numbered register (r0, r2 or [sp]).
+// As a result, return address will be at a 4-byte further location in the following cases.
+#if COMPILER_SUPPORTS(EABI) && CPU(ARM)
+#define INSTRUCTION_STORE_RETURN_ADDRESS_EJI "str lr, [sp, #4]"
+#define INSTRUCTION_STORE_RETURN_ADDRESS_EJCI "str lr, [sp, #8]"
+#else
+#define INSTRUCTION_STORE_RETURN_ADDRESS_EJI "str lr, [sp, #0]"
+#define INSTRUCTION_STORE_RETURN_ADDRESS_EJCI "str lr, [sp, #4]"
+#endif
+
+#define FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_EJI(function) \
+    asm ( \
+    ".text" "\n" \
+    ".globl " SYMBOL_STRING(function) "\n" \
+    HIDE_SYMBOL(function) "\n" \
+    INLINE_ARM_FUNCTION(function) \
+    SYMBOL_STRING(function) ":" "\n" \
+        INSTRUCTION_STORE_RETURN_ADDRESS_EJI "\n" \
+        "b " LOCAL_REFERENCE(function) "WithReturnAddress" "\n" \
+    );
+
+#define FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_EJCI(function) \
+    asm ( \
+    ".text" "\n" \
+    ".globl " SYMBOL_STRING(function) "\n" \
+    HIDE_SYMBOL(function) "\n" \
+    INLINE_ARM_FUNCTION(function) \
+    SYMBOL_STRING(function) ":" "\n" \
+        INSTRUCTION_STORE_RETURN_ADDRESS_EJCI "\n" \
+        "b " LOCAL_REFERENCE(function) "WithReturnAddress" "\n" \
+    );
+
 #endif
 
 #define P_FUNCTION_WRAPPER_WITH_RETURN_ADDRESS_E(function) \
@@ -1250,15 +1306,13 @@ void DFG_OPERATION debugOperationPrintSpeculationFailure(ExecState* exec, void*
     CodeBlock* alternative = codeBlock->alternative();
     dataLog("Speculation failure in %p at @%u with executeCounter = %s, "
             "reoptimizationRetryCounter = %u, optimizationDelayCounter = %u, "
-            "success/fail %u/(%u+%u)\n",
+            "osrExitCounter = %u\n",
             codeBlock,
             debugInfo->nodeIndex,
             alternative ? alternative->jitExecuteCounter().status() : 0,
             alternative ? alternative->reoptimizationRetryCounter() : 0,
             alternative ? alternative->optimizationDelayCounter() : 0,
-            codeBlock->speculativeSuccessCounter(),
-            codeBlock->speculativeFailCounter(),
-            codeBlock->forcedOSRExitCounter());
+            codeBlock->osrExitCounter());
 }
 #endif
 
@@ -1324,6 +1378,17 @@ SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
     "mov r0, r5" "\n"
     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
 );
+#elif CPU(ARM_TRADITIONAL)
+asm (
+".text" "\n"
+".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
+HIDE_SYMBOL(getHostCallReturnValue) "\n"
+INLINE_ARM_FUNCTION(getHostCallReturnValue)
+SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
+    "ldr r5, [r5, #-40]" "\n"
+    "mov r0, r5" "\n"
+    "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+);
 #endif
 
 extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState* exec)
diff --git a/Source/JavaScriptCore/dfg/DFGPhase.h b/Source/JavaScriptCore/dfg/DFGPhase.h
index 53055a215..80fd6914a 100644
--- a/Source/JavaScriptCore/dfg/DFGPhase.h
+++ b/Source/JavaScriptCore/dfg/DFGPhase.h
@@ -49,6 +49,8 @@ public:
         endPhase();
     }
     
+    const char* name() const { return m_name; }
+    
     // Each phase must have a run() method.
     
 protected:
@@ -76,17 +78,28 @@ private:
 };
 
 template<typename PhaseType>
+bool runAndLog(PhaseType& phase)
+{
+    bool result = phase.run();
+#if DFG_ENABLE(DEBUG_VERBOSE)
+    if (result)
+        dataLog("Phase %s changed the IR.\n", phase.name());
+#endif
+    return result;
+}
+
+template<typename PhaseType>
 bool runPhase(Graph& graph)
 {
     PhaseType phase(graph);
-    return phase.run();
+    return runAndLog(phase);
 }
 
 template<typename PhaseType, typename ArgumentType1>
 bool runPhase(Graph& graph, ArgumentType1 arg1)
 {
     PhaseType phase(graph, arg1);
-    return phase.run();
+    return runAndLog(phase);
 }
 
 } } // namespace JSC::DFG
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index 0bd81ec44..320eb6cb6 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -908,6 +908,7 @@ private:
     
 bool performPredictionPropagation(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG Prediction Propagation Phase");
     return runPhase<PredictionPropagationPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp b/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp
index 5453469fe..32e4ef157 100644
--- a/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGRedundantPhiEliminationPhase.cpp
@@ -169,6 +169,7 @@ private:
 
 bool performRedundantPhiElimination(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG Redundant Phi Elimination Phase");
     return runPhase<RedundantPhiEliminationPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.cpp b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
index 9c3391be5..752316f9c 100644
--- a/Source/JavaScriptCore/dfg/DFGRepatch.cpp
+++ b/Source/JavaScriptCore/dfg/DFGRepatch.cpp
@@ -30,6 +30,7 @@
 
 #include "DFGCCallHelpers.h"
 #include "DFGSpeculativeJIT.h"
+#include "GCAwareJITStubRoutine.h"
 #include "LinkBuffer.h"
 #include "Operations.h"
 #include "PolymorphicPutByIdList.h"
@@ -43,7 +44,7 @@ static void dfgRepatchCall(CodeBlock* codeblock, CodeLocationCall call, Function
     repatchBuffer.relink(call, newCalleeFunction);
 }
 
-static void dfgRepatchByIdSelfAccess(CodeBlock* codeBlock, StructureStubInfo& stubInfo, Structure* structure, size_t offset, const FunctionPtr &slowPathFunction, bool compact)
+static void dfgRepatchByIdSelfAccess(CodeBlock* codeBlock, StructureStubInfo& stubInfo, Structure* structure, PropertyOffset offset, const FunctionPtr &slowPathFunction, bool compact)
 {
     RepatchBuffer repatchBuffer(codeBlock);
 
@@ -52,18 +53,19 @@ static void dfgRepatchByIdSelfAccess(CodeBlock* codeBlock, StructureStubInfo& st
 
     // Patch the structure check & the offset of the load.
     repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelPtrAtOffset(-(intptr_t)stubInfo.patch.dfg.deltaCheckImmToCall), structure);
+    repatchBuffer.setLoadInstructionIsActive(stubInfo.callReturnLocation.convertibleLoadAtOffset(stubInfo.patch.dfg.deltaCallToStorageLoad), isOutOfLineOffset(offset));
 #if USE(JSVALUE64)
     if (compact)
-        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.patch.dfg.deltaCallToLoadOrStore), sizeof(JSValue) * offset);
+        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.patch.dfg.deltaCallToLoadOrStore), offsetRelativeToPatchedStorage(offset));
     else
-        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.patch.dfg.deltaCallToLoadOrStore), sizeof(JSValue) * offset);
+        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.patch.dfg.deltaCallToLoadOrStore), offsetRelativeToPatchedStorage(offset));
 #elif USE(JSVALUE32_64)
     if (compact) {
-        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.patch.dfg.deltaCallToTagLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
-        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.patch.dfg.deltaCallToPayloadLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.patch.dfg.deltaCallToTagLoadOrStore), offsetRelativeToPatchedStorage(offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabelCompactAtOffset(stubInfo.patch.dfg.deltaCallToPayloadLoadOrStore), offsetRelativeToPatchedStorage(offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     } else {
-        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.patch.dfg.deltaCallToTagLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
-        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.patch.dfg.deltaCallToPayloadLoadOrStore), sizeof(JSValue) * offset + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
+        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.patch.dfg.deltaCallToTagLoadOrStore), offsetRelativeToPatchedStorage(offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag));
+        repatchBuffer.repatch(stubInfo.callReturnLocation.dataLabel32AtOffset(stubInfo.patch.dfg.deltaCallToPayloadLoadOrStore), offsetRelativeToPatchedStorage(offset) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload));
     }
 #endif
 }
@@ -105,7 +107,7 @@ static void linkRestoreScratch(LinkBuffer& patchBuffer, bool needToRestoreScratc
     linkRestoreScratch(patchBuffer, needToRestoreScratch, success, fail, failureCases, stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToDone), stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToSlowCase));
 }
 
-static void generateProtoChainAccessStub(ExecState* exec, StructureStubInfo& stubInfo, StructureChain* chain, size_t count, size_t offset, Structure* structure, CodeLocationLabel successLabel, CodeLocationLabel slowCaseLabel, MacroAssemblerCodeRef& stubRoutine)
+static void generateProtoChainAccessStub(ExecState* exec, StructureStubInfo& stubInfo, StructureChain* chain, size_t count, PropertyOffset offset, Structure* structure, CodeLocationLabel successLabel, CodeLocationLabel slowCaseLabel, RefPtr<JITStubRoutine>& stubRoutine)
 {
     JSGlobalData* globalData = &exec->globalData();
 
@@ -139,13 +141,23 @@ static void generateProtoChainAccessStub(ExecState* exec, StructureStubInfo& stu
         currStructure = it->get();
     }
     
-    stubJit.loadPtr(protoObject->addressOfPropertyStorage(), resultGPR);
+    if (isInlineOffset(offset)) {
 #if USE(JSVALUE64)
-    stubJit.loadPtr(MacroAssembler::Address(resultGPR, offset * sizeof(WriteBarrier<Unknown>)), resultGPR);
+        stubJit.loadPtr(protoObject->locationForOffset(offset), resultGPR);
 #elif USE(JSVALUE32_64)
-    stubJit.load32(MacroAssembler::Address(resultGPR, offset * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
-    stubJit.load32(MacroAssembler::Address(resultGPR, offset * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultGPR);
+        stubJit.move(MacroAssembler::TrustedImmPtr(protoObject->locationForOffset(offset)), resultGPR);
+        stubJit.load32(MacroAssembler::Address(resultGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
+        stubJit.load32(MacroAssembler::Address(resultGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultGPR);
 #endif
+    } else {
+        stubJit.loadPtr(protoObject->addressOfOutOfLineStorage(), resultGPR);
+#if USE(JSVALUE64)
+        stubJit.loadPtr(MacroAssembler::Address(resultGPR, offsetInOutOfLineStorage(offset) * sizeof(WriteBarrier<Unknown>)), resultGPR);
+#elif USE(JSVALUE32_64)
+        stubJit.load32(MacroAssembler::Address(resultGPR, offsetInOutOfLineStorage(offset) * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
+        stubJit.load32(MacroAssembler::Address(resultGPR, offsetInOutOfLineStorage(offset) * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultGPR);
+#endif
+    }
 
     MacroAssembler::Jump success, fail;
     
@@ -155,7 +167,7 @@ static void generateProtoChainAccessStub(ExecState* exec, StructureStubInfo& stu
     
     linkRestoreScratch(patchBuffer, needToRestoreScratch, success, fail, failureCases, successLabel, slowCaseLabel);
     
-    stubRoutine = FINALIZE_CODE(
+    stubRoutine = FINALIZE_CODE_FOR_STUB(
         patchBuffer,
         ("DFG prototype chain access stub for CodeBlock %p, return point %p",
          exec->codeBlock(), successLabel.executableAddress()));
@@ -209,14 +221,14 @@ static bool tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier
         
         linkRestoreScratch(patchBuffer, needToRestoreScratch, stubInfo, success, fail, failureCases);
         
-        stubInfo.stubRoutine = FINALIZE_CODE(
+        stubInfo.stubRoutine = FINALIZE_CODE_FOR_STUB(
             patchBuffer,
             ("DFG GetById array length stub for CodeBlock %p, return point %p",
              exec->codeBlock(), stubInfo.callReturnLocation.labelAtOffset(
                  stubInfo.patch.dfg.deltaCallToDone).executableAddress()));
         
         RepatchBuffer repatchBuffer(codeBlock);
-        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine.code()));
+        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine->code().code()));
         repatchBuffer.relink(stubInfo.callReturnLocation, operationGetById);
         
         return true;
@@ -253,7 +265,7 @@ static bool tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier
     if (slot.cachedPropertyType() != PropertySlot::Value)
         return false;
     
-    size_t offset = slot.cachedOffset();
+    PropertyOffset offset = slot.cachedOffset();
     size_t count = normalizePrototypeChain(exec, baseValue, slot.slotBase(), propertyName, offset);
     if (!count)
         return false;
@@ -265,7 +277,7 @@ static bool tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier
     generateProtoChainAccessStub(exec, stubInfo, prototypeChain, count, offset, structure, stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToDone), stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToSlowCase), stubInfo.stubRoutine);
     
     RepatchBuffer repatchBuffer(codeBlock);
-    repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine.code()));
+    repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine->code().code()));
     repatchBuffer.relink(stubInfo.callReturnLocation, operationGetByIdProtoBuildList);
     
     stubInfo.initGetByIdChain(*globalData, codeBlock->ownerExecutable(), structure, prototypeChain, count, true);
@@ -312,7 +324,7 @@ static bool tryBuildGetByIDList(ExecState* exec, JSValue baseValue, const Identi
         listIndex = 0;
     } else if (stubInfo.accessType == access_get_by_id_self) {
         ASSERT(!stubInfo.stubRoutine);
-        polymorphicStructureList = new PolymorphicAccessStructureList(*globalData, codeBlock->ownerExecutable(), MacroAssemblerCodeRef::createSelfManagedCodeRef(stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToSlowCase)), stubInfo.u.getByIdSelf.baseObjectStructure.get(), true);
+        polymorphicStructureList = new PolymorphicAccessStructureList(*globalData, codeBlock->ownerExecutable(), JITStubRoutine::createSelfManagedRoutine(stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToSlowCase)), stubInfo.u.getByIdSelf.baseObjectStructure.get(), true);
         stubInfo.initGetByIdSelfList(polymorphicStructureList, 1);
         listIndex = 1;
     } else {
@@ -349,12 +361,20 @@ static bool tryBuildGetByIDList(ExecState* exec, JSValue baseValue, const Identi
             || slot.cachedPropertyType() == PropertySlot::Custom) {
             if (slot.cachedPropertyType() == PropertySlot::Getter) {
                 ASSERT(baseGPR != scratchGPR);
-                stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
+                if (isInlineOffset(slot.cachedOffset())) {
 #if USE(JSVALUE64)
-                stubJit.loadPtr(MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue)), scratchGPR);
-#elif USE(JSVALUE32_64)
-                stubJit.load32(MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), scratchGPR);
+                    stubJit.loadPtr(MacroAssembler::Address(baseGPR, offsetRelativeToBase(slot.cachedOffset())), scratchGPR);
+#else
+                    stubJit.load32(MacroAssembler::Address(baseGPR, offsetRelativeToBase(slot.cachedOffset())), scratchGPR);
 #endif
+                } else {
+                    stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), scratchGPR);
+#if USE(JSVALUE64)
+                    stubJit.loadPtr(MacroAssembler::Address(scratchGPR, offsetRelativeToBase(slot.cachedOffset())), scratchGPR);
+#else
+                    stubJit.load32(MacroAssembler::Address(scratchGPR, offsetRelativeToBase(slot.cachedOffset())), scratchGPR);
+#endif
+                }
                 stubJit.setupArgumentsWithExecState(baseGPR, scratchGPR);
                 operationFunction = operationCallGetter;
             } else {
@@ -385,13 +405,27 @@ static bool tryBuildGetByIDList(ExecState* exec, JSValue baseValue, const Identi
             handlerCall = stubJit.call();
             stubJit.jump(GPRInfo::returnValueGPR2);
         } else {
-            stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), resultGPR);
+            if (isInlineOffset(slot.cachedOffset())) {
 #if USE(JSVALUE64)
-            stubJit.loadPtr(MacroAssembler::Address(resultGPR, slot.cachedOffset() * sizeof(JSValue)), resultGPR);
-#elif USE(JSVALUE32_64)
-            stubJit.load32(MacroAssembler::Address(resultGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
-            stubJit.load32(MacroAssembler::Address(resultGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultGPR);
+                stubJit.loadPtr(MacroAssembler::Address(baseGPR, offsetRelativeToBase(slot.cachedOffset())), resultGPR);
+#else
+                if (baseGPR == resultTagGPR) {
+                    stubJit.load32(MacroAssembler::Address(baseGPR, offsetRelativeToBase(slot.cachedOffset()) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultGPR);
+                    stubJit.load32(MacroAssembler::Address(baseGPR, offsetRelativeToBase(slot.cachedOffset()) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
+                } else {
+                    stubJit.load32(MacroAssembler::Address(baseGPR, offsetRelativeToBase(slot.cachedOffset()) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
+                    stubJit.load32(MacroAssembler::Address(baseGPR, offsetRelativeToBase(slot.cachedOffset()) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultGPR);
+                }
+#endif
+            } else {
+                stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), resultGPR);
+#if USE(JSVALUE64)
+                stubJit.loadPtr(MacroAssembler::Address(resultGPR, offsetRelativeToBase(slot.cachedOffset())), resultGPR);
+#else
+                stubJit.load32(MacroAssembler::Address(resultGPR, offsetRelativeToBase(slot.cachedOffset()) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
+                stubJit.load32(MacroAssembler::Address(resultGPR, offsetRelativeToBase(slot.cachedOffset()) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultGPR);
 #endif
+            }
             success = stubJit.jump();
             isDirect = true;
         }
@@ -400,7 +434,7 @@ static bool tryBuildGetByIDList(ExecState* exec, JSValue baseValue, const Identi
         
         CodeLocationLabel lastProtoBegin;
         if (listIndex)
-            lastProtoBegin = CodeLocationLabel(polymorphicStructureList->list[listIndex - 1].stubRoutine.code());
+            lastProtoBegin = CodeLocationLabel(polymorphicStructureList->list[listIndex - 1].stubRoutine->code().code());
         else
             lastProtoBegin = stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToSlowCase);
         ASSERT(!!lastProtoBegin);
@@ -412,17 +446,23 @@ static bool tryBuildGetByIDList(ExecState* exec, JSValue baseValue, const Identi
             patchBuffer.link(handlerCall, lookupExceptionHandlerInStub);
         }
         
-        MacroAssemblerCodeRef stubRoutine = FINALIZE_CODE(
-            patchBuffer,
-            ("DFG GetById polymorphic list access for CodeBlock %p, return point %p",
-             exec->codeBlock(), stubInfo.callReturnLocation.labelAtOffset(
-                 stubInfo.patch.dfg.deltaCallToDone).executableAddress()));
+        RefPtr<JITStubRoutine> stubRoutine =
+            createJITStubRoutine(
+                FINALIZE_CODE(
+                    patchBuffer,
+                    ("DFG GetById polymorphic list access for CodeBlock %p, return point %p",
+                     exec->codeBlock(), stubInfo.callReturnLocation.labelAtOffset(
+                         stubInfo.patch.dfg.deltaCallToDone).executableAddress())),
+                *globalData,
+                codeBlock->ownerExecutable(),
+                slot.cachedPropertyType() == PropertySlot::Getter
+                || slot.cachedPropertyType() == PropertySlot::Custom);
         
         polymorphicStructureList->list[listIndex].set(*globalData, codeBlock->ownerExecutable(), stubRoutine, structure, isDirect);
         
         CodeLocationJump jumpLocation = stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck);
         RepatchBuffer repatchBuffer(codeBlock);
-        repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+        repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
         
         if (listIndex < (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             return true;
@@ -450,7 +490,7 @@ static bool tryBuildGetByIDProtoList(ExecState* exec, JSValue baseValue, const I
     
     ASSERT(slot.slotBase().isObject());
     
-    size_t offset = slot.cachedOffset();
+    PropertyOffset offset = slot.cachedOffset();
     size_t count = normalizePrototypeChain(exec, baseValue, slot.slotBase(), propertyName, offset);
     if (!count)
         return false;
@@ -466,7 +506,7 @@ static bool tryBuildGetByIDProtoList(ExecState* exec, JSValue baseValue, const I
     if (stubInfo.accessType == access_get_by_id_chain) {
         ASSERT(!!stubInfo.stubRoutine);
         polymorphicStructureList = new PolymorphicAccessStructureList(*globalData, codeBlock->ownerExecutable(), stubInfo.stubRoutine, stubInfo.u.getByIdChain.baseObjectStructure.get(), stubInfo.u.getByIdChain.chain.get(), true);
-        stubInfo.stubRoutine = MacroAssemblerCodeRef();
+        stubInfo.stubRoutine.clear();
         stubInfo.initGetByIdProtoList(polymorphicStructureList, 1);
     } else {
         ASSERT(stubInfo.accessType == access_get_by_id_proto_list);
@@ -477,10 +517,10 @@ static bool tryBuildGetByIDProtoList(ExecState* exec, JSValue baseValue, const I
     if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
         stubInfo.u.getByIdProtoList.listSize++;
         
-        CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructureList->list[listIndex - 1].stubRoutine.code());
+        CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructureList->list[listIndex - 1].stubRoutine->code().code());
         ASSERT(!!lastProtoBegin);
 
-        MacroAssemblerCodeRef stubRoutine;
+        RefPtr<JITStubRoutine> stubRoutine;
         
         generateProtoChainAccessStub(exec, stubInfo, prototypeChain, count, offset, structure, stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToDone), lastProtoBegin, stubRoutine);
         
@@ -488,7 +528,7 @@ static bool tryBuildGetByIDProtoList(ExecState* exec, JSValue baseValue, const I
         
         CodeLocationJump jumpLocation = stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck);
         RepatchBuffer repatchBuffer(codeBlock);
-        repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+        repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
         
         if (listIndex < (POLYMORPHIC_LIST_CACHE_SIZE - 1))
             return true;
@@ -548,7 +588,7 @@ static void emitPutReplaceStub(
     PutKind,
     Structure* structure,
     CodeLocationLabel failureLabel,
-    MacroAssemblerCodeRef& stubRoutine)
+    RefPtr<JITStubRoutine>& stubRoutine)
 {
     JSGlobalData* globalData = &exec->globalData();
     GPRReg baseGPR = static_cast<GPRReg>(stubInfo.patch.dfg.baseGPR);
@@ -567,7 +607,7 @@ static void emitPutReplaceStub(
     
     MacroAssembler stubJit;
     
-    if (scratchGPR == InvalidGPRReg && (writeBarrierNeeded || !structure->isUsingInlineStorage())) {
+    if (scratchGPR == InvalidGPRReg && (writeBarrierNeeded || isOutOfLineOffset(slot.cachedOffset()))) {
         scratchGPR = SpeculativeJIT::selectScratchGPR(baseGPR, valueGPR);
         needToRestoreScratch = true;
         stubJit.push(scratchGPR);
@@ -586,20 +626,20 @@ static void emitPutReplaceStub(
 #endif
     
 #if USE(JSVALUE64)
-    if (structure->isUsingInlineStorage())
-        stubJit.storePtr(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue)));
+    if (isInlineOffset(slot.cachedOffset()))
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue)));
     else {
-        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
-        stubJit.storePtr(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue)));
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), scratchGPR);
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(scratchGPR, offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue)));
     }
 #elif USE(JSVALUE32_64)
-    if (structure->isUsingInlineStorage()) {
-        stubJit.store32(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
-        stubJit.store32(valueTagGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    if (isInlineOffset(slot.cachedOffset())) {
+        stubJit.store32(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
     } else {
-        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
-        stubJit.store32(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
-        stubJit.store32(valueTagGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), scratchGPR);
+        stubJit.store32(valueGPR, MacroAssembler::Address(scratchGPR, offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(scratchGPR, offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
     }
 #endif
     
@@ -622,7 +662,7 @@ static void emitPutReplaceStub(
     patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.dfg.deltaCallToDone));
     patchBuffer.link(failure, failureLabel);
             
-    stubRoutine = FINALIZE_CODE(
+    stubRoutine = FINALIZE_CODE_FOR_STUB(
         patchBuffer,
         ("DFG PutById replace stub for CodeBlock %p, return point %p",
          exec->codeBlock(), stubInfo.callReturnLocation.labelAtOffset(
@@ -640,7 +680,7 @@ static void emitPutTransitionStub(
     Structure* oldStructure,
     StructureChain* prototypeChain,
     CodeLocationLabel failureLabel,
-    MacroAssemblerCodeRef& stubRoutine)
+    RefPtr<JITStubRoutine>& stubRoutine)
 {
     JSGlobalData* globalData = &exec->globalData();
 
@@ -685,20 +725,20 @@ static void emitPutTransitionStub(
 
     stubJit.storePtr(MacroAssembler::TrustedImmPtr(structure), MacroAssembler::Address(baseGPR, JSCell::structureOffset()));
 #if USE(JSVALUE64)
-    if (structure->isUsingInlineStorage())
-        stubJit.storePtr(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue)));
+    if (isInlineOffset(slot.cachedOffset()))
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue)));
     else {
-        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
-        stubJit.storePtr(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue)));
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), scratchGPR);
+        stubJit.storePtr(valueGPR, MacroAssembler::Address(scratchGPR, offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue)));
     }
 #elif USE(JSVALUE32_64)
-    if (structure->isUsingInlineStorage()) {
-        stubJit.store32(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
-        stubJit.store32(valueTagGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+    if (isInlineOffset(slot.cachedOffset())) {
+        stubJit.store32(valueGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(baseGPR, JSObject::offsetOfInlineStorage() + offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
     } else {
-        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
-        stubJit.store32(valueGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
-        stubJit.store32(valueTagGPR, MacroAssembler::Address(scratchGPR, slot.cachedOffset() * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
+        stubJit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), scratchGPR);
+        stubJit.store32(valueGPR, MacroAssembler::Address(scratchGPR, offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
+        stubJit.store32(valueTagGPR, MacroAssembler::Address(scratchGPR, offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue) + OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
     }
 #endif
             
@@ -721,8 +761,8 @@ static void emitPutTransitionStub(
         patchBuffer.link(failure, failureLabel);
     else
         patchBuffer.link(failureCases, failureLabel);
-            
-    stubRoutine = FINALIZE_CODE(
+    
+    stubRoutine = FINALIZE_CODE_FOR_STUB(
         patchBuffer,
         ("DFG PutById transition stub for CodeBlock %p, return point %p",
          exec->codeBlock(), stubInfo.callReturnLocation.labelAtOffset(
@@ -752,7 +792,7 @@ static bool tryCachePutByID(ExecState* exec, JSValue baseValue, const Identifier
                 return false;
             
             // skip optimizing the case where we need a realloc
-            if (oldStructure->propertyStorageCapacity() != structure->propertyStorageCapacity())
+            if (oldStructure->outOfLineCapacity() != structure->outOfLineCapacity())
                 return false;
             
             normalizePrototypeChain(exec, baseCell);
@@ -766,7 +806,7 @@ static bool tryCachePutByID(ExecState* exec, JSValue baseValue, const Identifier
                 stubInfo.stubRoutine);
             
             RepatchBuffer repatchBuffer(codeBlock);
-            repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine.code()));
+            repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine->code().code()));
             repatchBuffer.relink(stubInfo.callReturnLocation, appropriateListBuildingPutByIdFunction(slot, putKind));
             
             stubInfo.initPutByIdTransition(*globalData, codeBlock->ownerExecutable(), oldStructure, structure, prototypeChain, putKind == Direct);
@@ -808,14 +848,14 @@ static bool tryBuildPutByIdList(ExecState* exec, JSValue baseValue, const Identi
     // Optimize self access.
     if (slot.base() == baseValue) {
         PolymorphicPutByIdList* list;
-        MacroAssemblerCodeRef stubRoutine;
+        RefPtr<JITStubRoutine> stubRoutine;
         
         if (slot.type() == PutPropertySlot::NewProperty) {
             if (structure->isDictionary())
                 return false;
             
             // skip optimizing the case where we need a realloc
-            if (oldStructure->propertyStorageCapacity() != structure->propertyStorageCapacity())
+            if (oldStructure->outOfLineCapacity() != structure->outOfLineCapacity())
                 return false;
             
             normalizePrototypeChain(exec, baseCell);
@@ -855,7 +895,7 @@ static bool tryBuildPutByIdList(ExecState* exec, JSValue baseValue, const Identi
         }
         
         RepatchBuffer repatchBuffer(codeBlock);
-        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubRoutine.code()));
+        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.dfg.deltaCallToStructCheck), CodeLocationLabel(stubRoutine->code().code()));
         
         if (list->isFull())
             repatchBuffer.relink(stubInfo.callReturnLocation, appropriateGenericPutByIdFunction(slot, putKind));
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index 0c0f3260f..c6ec62129 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -45,6 +45,8 @@ SpeculativeJIT::SpeculativeJIT(JITCompiler& jit)
     , m_variables(jit.graph().m_localVars)
     , m_lastSetOperand(std::numeric_limits<int>::max())
     , m_state(m_jit.graph())
+    , m_stream(&jit.codeBlock()->variableEventStream())
+    , m_minifiedGraph(&jit.codeBlock()->minifiedDFG())
     , m_isCheckingArgumentTypes(false)
 {
 }
@@ -99,7 +101,7 @@ GPRReg SpeculativeJIT::fillStorage(NodeIndex nodeIndex)
             GPRReg gpr = allocate();
             m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
-            info.fillStorage(gpr);
+            info.fillStorage(*m_stream, gpr);
             return gpr;
         }
         
@@ -780,39 +782,6 @@ FPRTemporary::FPRTemporary(SpeculativeJIT* jit, JSValueOperand& op1)
 }
 #endif
 
-void ValueSource::dump(FILE* out) const
-{
-    switch (kind()) {
-    case SourceNotSet:
-        fprintf(out, "NotSet");
-        break;
-    case SourceIsDead:
-        fprintf(out, "IsDead");
-        break;
-    case ValueInRegisterFile:
-        fprintf(out, "InRegFile");
-        break;
-    case Int32InRegisterFile:
-        fprintf(out, "Int32");
-        break;
-    case CellInRegisterFile:
-        fprintf(out, "Cell");
-        break;
-    case BooleanInRegisterFile:
-        fprintf(out, "Bool");
-        break;
-    case DoubleInRegisterFile:
-        fprintf(out, "Double");
-        break;
-    case ArgumentsSource:
-        fprintf(out, "Arguments");
-        break;
-    case HaveNode:
-        fprintf(out, "Node(%d)", m_nodeIndex);
-        break;
-    }
-}
-
 void SpeculativeJIT::compilePeepHoleDoubleBranch(Node& node, NodeIndex branchNodeIndex, JITCompiler::DoubleCondition condition)
 {
     Node& branchNode = at(branchNodeIndex);
@@ -953,12 +922,30 @@ bool SpeculativeJIT::compilePeepHoleBranch(Node& node, MacroAssembler::Relationa
     return false;
 }
 
+void SpeculativeJIT::noticeOSRBirth(NodeIndex nodeIndex, Node& node)
+{
+    if (!node.hasVirtualRegister())
+        return;
+    
+    VirtualRegister virtualRegister = node.virtualRegister();
+    GenerationInfo& info = m_generationInfo[virtualRegister];
+    
+    info.noticeOSRBirth(*m_stream, nodeIndex, virtualRegister);
+}
+
 void SpeculativeJIT::compileMovHint(Node& node)
 {
     ASSERT(node.op() == SetLocal);
     
-    setNodeIndexForOperand(node.child1().index(), node.local());
     m_lastSetOperand = node.local();
+    
+    Node& child = at(node.child1());
+    noticeOSRBirth(node.child1().index(), child);
+    
+    if (child.op() == UInt32ToNumber)
+        noticeOSRBirth(child.child1().index(), at(child.child1()));
+    
+    m_stream->appendAndLog(VariableEvent::movHint(node.child1().index(), node.local()));
 }
 
 void SpeculativeJIT::compile(BasicBlock& block)
@@ -983,11 +970,20 @@ void SpeculativeJIT::compile(BasicBlock& block)
     m_jit.breakpoint();
 #endif
     
+#if DFG_ENABLE(DEBUG_VERBOSE)
+    dataLog("Setting up state for block #%u: ", m_block);
+#endif
+    
+    m_stream->appendAndLog(VariableEvent::reset());
+    
     m_jit.jitAssertHasValidCallFrame();
 
     ASSERT(m_arguments.size() == block.variablesAtHead.numberOfArguments());
-    for (size_t i = 0; i < m_arguments.size(); ++i)
-        m_arguments[i] = ValueSource(ValueInRegisterFile);
+    for (size_t i = 0; i < m_arguments.size(); ++i) {
+        ValueSource valueSource = ValueSource(ValueInRegisterFile);
+        m_arguments[i] = valueSource;
+        m_stream->appendAndLog(VariableEvent::setLocal(argumentToOperand(i), valueSource.dataFormat()));
+    }
     
     m_state.reset();
     m_state.beginBasicBlock(&block);
@@ -995,18 +991,21 @@ void SpeculativeJIT::compile(BasicBlock& block)
     ASSERT(m_variables.size() == block.variablesAtHead.numberOfLocals());
     for (size_t i = 0; i < m_variables.size(); ++i) {
         NodeIndex nodeIndex = block.variablesAtHead.local(i);
+        ValueSource valueSource;
         if (nodeIndex == NoNode)
-            m_variables[i] = ValueSource(SourceIsDead);
+            valueSource = ValueSource(SourceIsDead);
         else if (at(nodeIndex).variableAccessData()->isArgumentsAlias())
-            m_variables[i] = ValueSource(ArgumentsSource);
+            valueSource = ValueSource(ArgumentsSource);
         else if (at(nodeIndex).variableAccessData()->isCaptured())
-            m_variables[i] = ValueSource(ValueInRegisterFile);
+            valueSource = ValueSource(ValueInRegisterFile);
         else if (!at(nodeIndex).refCount())
-            m_variables[i] = ValueSource(SourceIsDead);
+            valueSource = ValueSource(SourceIsDead);
         else if (at(nodeIndex).variableAccessData()->shouldUseDoubleFormat())
-            m_variables[i] = ValueSource(DoubleInRegisterFile);
+            valueSource = ValueSource(DoubleInRegisterFile);
         else
-            m_variables[i] = ValueSource::forSpeculation(at(nodeIndex).variableAccessData()->argumentAwarePrediction());
+            valueSource = ValueSource::forSpeculation(at(nodeIndex).variableAccessData()->argumentAwarePrediction());
+        m_variables[i] = valueSource;
+        m_stream->appendAndLog(VariableEvent::setLocal(i, valueSource.dataFormat()));
     }
     
     m_lastSetOperand = std::numeric_limits<int>::max();
@@ -1019,6 +1018,10 @@ void SpeculativeJIT::compile(BasicBlock& block)
         verificationSucceeded.link(&m_jit);
     }
 
+#if DFG_ENABLE(DEBUG_VERBOSE)
+    dataLog("\n");
+#endif
+
     for (m_indexInBlock = 0; m_indexInBlock < block.size(); ++m_indexInBlock) {
         m_compileIndex = block[m_indexInBlock];
         m_jit.setForNode(m_compileIndex);
@@ -1029,6 +1032,15 @@ void SpeculativeJIT::compile(BasicBlock& block)
             dataLog("SpeculativeJIT skipping Node @%d (bc#%u) at JIT offset 0x%x     ", (int)m_compileIndex, node.codeOrigin.bytecodeIndex, m_jit.debugOffset());
 #endif
             switch (node.op()) {
+            case JSConstant:
+                m_minifiedGraph->append(MinifiedNode::fromNode(m_compileIndex, node));
+                break;
+                
+            case WeakJSConstant:
+                m_jit.addWeakReference(node.weakConstant());
+                m_minifiedGraph->append(MinifiedNode::fromNode(m_compileIndex, node));
+                break;
+                
             case SetLocal:
                 compileMovHint(node);
                 break;
@@ -1073,11 +1085,9 @@ void SpeculativeJIT::compile(BasicBlock& block)
                 break;
             }
                 
-            case WeakJSConstant:
-                m_jit.addWeakReference(node.weakConstant());
-                break;
-                
             default:
+                if (belongsInMinifiedGraph(node.op()))
+                    m_minifiedGraph->append(MinifiedNode::fromNode(m_compileIndex, node));
                 break;
             }
         } else {
@@ -1100,6 +1110,11 @@ void SpeculativeJIT::compile(BasicBlock& block)
                 return;
             }
             
+            if (belongsInMinifiedGraph(node.op())) {
+                m_minifiedGraph->append(MinifiedNode::fromNode(m_compileIndex, node));
+                noticeOSRBirth(m_compileIndex, node);
+            }
+            
 #if DFG_ENABLE(DEBUG_VERBOSE)
             if (node.hasResult()) {
                 GenerationInfo& info = m_generationInfo[node.virtualRegister()];
@@ -1120,16 +1135,6 @@ void SpeculativeJIT::compile(BasicBlock& block)
 #endif
         }
         
-#if DFG_ENABLE(VERBOSE_VALUE_RECOVERIES)
-        for (size_t i = 0; i < m_arguments.size(); ++i)
-            computeValueRecoveryFor(argumentToOperand(i)).dump(stderr);
-        
-        dataLog(" : ");
-        
-        for (int operand = 0; operand < (int)m_variables.size(); ++operand)
-            computeValueRecoveryFor(operand).dump(stderr);
-#endif
-
 #if DFG_ENABLE(DEBUG_VERBOSE)
         dataLog("\n");
 #endif
@@ -1366,154 +1371,14 @@ void SpeculativeJIT::linkOSREntries(LinkBuffer& linkBuffer)
 
 ValueRecovery SpeculativeJIT::computeValueRecoveryFor(const ValueSource& valueSource)
 {
-    switch (valueSource.kind()) {
-    case SourceIsDead:
-        return ValueRecovery::constant(jsUndefined());
-        
-    case ValueInRegisterFile:
-        return ValueRecovery::alreadyInRegisterFile();
+    if (valueSource.isInRegisterFile())
+        return valueSource.valueRecovery();
         
-    case Int32InRegisterFile:
-        return ValueRecovery::alreadyInRegisterFileAsUnboxedInt32();
-
-    case CellInRegisterFile:
-        return ValueRecovery::alreadyInRegisterFileAsUnboxedCell();
-
-    case BooleanInRegisterFile:
-        return ValueRecovery::alreadyInRegisterFileAsUnboxedBoolean();
-        
-    case DoubleInRegisterFile:
-        return ValueRecovery::alreadyInRegisterFileAsUnboxedDouble();
-        
-    case ArgumentsSource:
-        return ValueRecovery::argumentsThatWereNotCreated();
-
-    case HaveNode: {
-        Node* nodePtr = &at(valueSource.nodeIndex());
-
-        if (nodePtr->isPhantomArguments())
-            return ValueRecovery::argumentsThatWereNotCreated();
-        
-        if (nodePtr->hasConstant())
-            return ValueRecovery::constant(valueOfJSConstant(valueSource.nodeIndex()));
-        
-        if (!nodePtr->shouldGenerate()) {
-            // It's legitimately dead. As in, nobody will ever use this node, or operand,
-            // ever. Set it to Undefined to make the GC happy after the OSR.
-            return ValueRecovery::constant(jsUndefined());
-        }
+    ASSERT(valueSource.kind() == HaveNode);
+    if (isConstant(valueSource.nodeIndex()))
+        return ValueRecovery::constant(valueOfJSConstant(valueSource.nodeIndex()));
     
-        GenerationInfo* infoPtr = &m_generationInfo[nodePtr->virtualRegister()];
-        if (!infoPtr->alive() || infoPtr->nodeIndex() != valueSource.nodeIndex()) {
-            // Try to see if there is an alternate node that would contain the value we want.
-            // There are four possibilities:
-            //
-            // Int32ToDouble: We can use this in place of the original node, but
-            //    we'd rather not; so we use it only if it is the only remaining
-            //    live version.
-            //
-            // ValueToInt32: If the only remaining live version of the value is
-            //    ValueToInt32, then we can use it.
-            //
-            // UInt32ToNumber: If the only live version of the value is a UInt32ToNumber
-            //    then the only remaining uses are ones that want a properly formed number
-            //    rather than a UInt32 intermediate.
-            //
-            // The reverse of the above: This node could be a UInt32ToNumber, but its
-            //    alternative is still alive. This means that the only remaining uses of
-            //    the number would be fine with a UInt32 intermediate.
-            //
-            // DoubleAsInt32: Same as UInt32ToNumber.
-            //
-        
-            bool found = false;
-        
-            if (nodePtr->op() == UInt32ToNumber || nodePtr->op() == DoubleAsInt32) {
-                NodeIndex nodeIndex = nodePtr->child1().index();
-                nodePtr = &at(nodeIndex);
-                infoPtr = &m_generationInfo[nodePtr->virtualRegister()];
-                if (infoPtr->alive() && infoPtr->nodeIndex() == nodeIndex)
-                    found = true;
-            }
-        
-            if (!found) {
-                NodeIndex int32ToDoubleIndex = NoNode;
-                NodeIndex valueToInt32Index = NoNode;
-                NodeIndex uint32ToNumberIndex = NoNode;
-                NodeIndex doubleAsInt32Index = NoNode;
-            
-                for (unsigned virtualRegister = 0; virtualRegister < m_generationInfo.size(); ++virtualRegister) {
-                    GenerationInfo& info = m_generationInfo[virtualRegister];
-                    if (!info.alive())
-                        continue;
-                    if (info.nodeIndex() == NoNode)
-                        continue;
-                    Node& node = at(info.nodeIndex());
-                    if (node.child1Unchecked() != valueSource.nodeIndex())
-                        continue;
-                    switch (node.op()) {
-                    case Int32ToDouble:
-                        int32ToDoubleIndex = info.nodeIndex();
-                        break;
-                    case ValueToInt32:
-                        valueToInt32Index = info.nodeIndex();
-                        break;
-                    case UInt32ToNumber:
-                        uint32ToNumberIndex = info.nodeIndex();
-                        break;
-                    case DoubleAsInt32:
-                        doubleAsInt32Index = info.nodeIndex();
-                    default:
-                        break;
-                    }
-                }
-            
-                NodeIndex nodeIndexToUse;
-                if (doubleAsInt32Index != NoNode)
-                    nodeIndexToUse = doubleAsInt32Index;
-                else if (int32ToDoubleIndex != NoNode)
-                    nodeIndexToUse = int32ToDoubleIndex;
-                else if (valueToInt32Index != NoNode)
-                    nodeIndexToUse = valueToInt32Index;
-                else if (uint32ToNumberIndex != NoNode)
-                    nodeIndexToUse = uint32ToNumberIndex;
-                else
-                    nodeIndexToUse = NoNode;
-            
-                if (nodeIndexToUse != NoNode) {
-                    nodePtr = &at(nodeIndexToUse);
-                    infoPtr = &m_generationInfo[nodePtr->virtualRegister()];
-                    ASSERT(infoPtr->alive() && infoPtr->nodeIndex() == nodeIndexToUse);
-                    found = true;
-                }
-            }
-        
-            if (!found)
-                return ValueRecovery::constant(jsUndefined());
-        }
-    
-        ASSERT(infoPtr->alive());
-
-        if (infoPtr->registerFormat() != DataFormatNone) {
-            if (infoPtr->registerFormat() == DataFormatDouble)
-                return ValueRecovery::inFPR(infoPtr->fpr());
-#if USE(JSVALUE32_64)
-            if (infoPtr->registerFormat() & DataFormatJS)
-                return ValueRecovery::inPair(infoPtr->tagGPR(), infoPtr->payloadGPR());
-#endif
-            return ValueRecovery::inGPR(infoPtr->gpr(), infoPtr->registerFormat());
-        }
-        if (infoPtr->spillFormat() != DataFormatNone)
-            return ValueRecovery::displacedInRegisterFile(static_cast<VirtualRegister>(nodePtr->virtualRegister()), infoPtr->spillFormat());
-    
-        ASSERT_NOT_REACHED();
-        return ValueRecovery();
-    }
-        
-    default:
-        ASSERT_NOT_REACHED();
-        return ValueRecovery();
-    }
+    return ValueRecovery();
 }
 
 void SpeculativeJIT::compileGetCharCodeAt(Node& node)
@@ -1652,10 +1517,11 @@ GeneratedOperandType SpeculativeJIT::checkGeneratedTypeForToInt32(NodeIndex node
     case DataFormatJSDouble:
     case DataFormatDouble:
         return GeneratedOperandDouble;
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return GeneratedOperandTypeUnknown;
     }
-
-    ASSERT_NOT_REACHED();
-    return GeneratedOperandTypeUnknown;
 }
 
 void SpeculativeJIT::compileValueToInt32(Node& node)
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index 67a22b767..57bc84a12 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #ifndef DFGSpeculativeJIT_h
 #define DFGSpeculativeJIT_h
 
+#include <wtf/Platform.h>
+
 #if ENABLE(DFG_JIT)
 
 #include "DFGAbstractState.h"
@@ -34,6 +36,7 @@
 #include "DFGOSRExit.h"
 #include "DFGOperations.h"
 #include "DFGSilentRegisterSavePlan.h"
+#include "DFGValueSource.h"
 #include "MarkedAllocator.h"
 #include "ValueRecovery.h"
 
@@ -48,87 +51,6 @@ class SpeculateDoubleOperand;
 class SpeculateCellOperand;
 class SpeculateBooleanOperand;
 
-
-enum ValueSourceKind {
-    SourceNotSet,
-    ValueInRegisterFile,
-    Int32InRegisterFile,
-    CellInRegisterFile,
-    BooleanInRegisterFile,
-    DoubleInRegisterFile,
-    ArgumentsSource,
-    SourceIsDead,
-    HaveNode
-};
-
-class ValueSource {
-public:
-    ValueSource()
-        : m_nodeIndex(nodeIndexFromKind(SourceNotSet))
-    {
-    }
-    
-    explicit ValueSource(ValueSourceKind valueSourceKind)
-        : m_nodeIndex(nodeIndexFromKind(valueSourceKind))
-    {
-        ASSERT(kind() != SourceNotSet);
-        ASSERT(kind() != HaveNode);
-    }
-    
-    explicit ValueSource(NodeIndex nodeIndex)
-        : m_nodeIndex(nodeIndex)
-    {
-        ASSERT(kind() == HaveNode);
-    }
-    
-    static ValueSource forSpeculation(SpeculatedType prediction)
-    {
-        if (isInt32Speculation(prediction))
-            return ValueSource(Int32InRegisterFile);
-        if (isArraySpeculation(prediction))
-            return ValueSource(CellInRegisterFile);
-        if (isBooleanSpeculation(prediction))
-            return ValueSource(BooleanInRegisterFile);
-        return ValueSource(ValueInRegisterFile);
-    }
-    
-    bool isSet() const
-    {
-        return kindFromNodeIndex(m_nodeIndex) != SourceNotSet;
-    }
-    
-    ValueSourceKind kind() const
-    {
-        return kindFromNodeIndex(m_nodeIndex);
-    }
-    
-    NodeIndex nodeIndex() const
-    {
-        ASSERT(kind() == HaveNode);
-        return m_nodeIndex;
-    }
-    
-    void dump(FILE* out) const;
-    
-private:
-    static NodeIndex nodeIndexFromKind(ValueSourceKind kind)
-    {
-        ASSERT(kind >= SourceNotSet && kind < HaveNode);
-        return NoNode - kind;
-    }
-    
-    static ValueSourceKind kindFromNodeIndex(NodeIndex nodeIndex)
-    {
-        unsigned kind = static_cast<unsigned>(NoNode - nodeIndex);
-        if (kind >= static_cast<unsigned>(HaveNode))
-            return HaveNode;
-        return static_cast<ValueSourceKind>(kind);
-    }
-    
-    NodeIndex m_nodeIndex;
-};
-
-
 enum GeneratedOperandType { GeneratedOperandTypeUnknown, GeneratedOperandInteger, GeneratedOperandDouble, GeneratedOperandJSValue};
 
 // === SpeculativeJIT ===
@@ -326,7 +248,7 @@ public:
 
         // use() returns true when the value becomes dead, and any
         // associated resources may be freed.
-        if (!info.use())
+        if (!info.use(*m_stream))
             return;
 
         // Release the associated machine registers.
@@ -376,6 +298,7 @@ public:
     void runSlowPathGenerators();
     
     void compile(Node&);
+    void noticeOSRBirth(NodeIndex, Node&);
     void compileMovHint(Node&);
     void compile(BasicBlock&);
 
@@ -777,7 +700,7 @@ public:
         // Check the GenerationInfo to see if this value need writing
         // to the RegisterFile - if not, mark it as spilled & return.
         if (!info.needsSpill()) {
-            info.setSpilled();
+            info.setSpilled(*m_stream, spillMe);
             return;
         }
 
@@ -787,20 +710,20 @@ public:
             // This is special, since it's not a JS value - as in it's not visible to JS
             // code.
             m_jit.storePtr(info.gpr(), JITCompiler::addressFor(spillMe));
-            info.spill(DataFormatStorage);
+            info.spill(*m_stream, spillMe, DataFormatStorage);
             return;
         }
 
         case DataFormatInteger: {
             m_jit.store32(info.gpr(), JITCompiler::payloadFor(spillMe));
-            info.spill(DataFormatInteger);
+            info.spill(*m_stream, spillMe, DataFormatInteger);
             return;
         }
 
 #if USE(JSVALUE64)
         case DataFormatDouble: {
             m_jit.storeDouble(info.fpr(), JITCompiler::addressFor(spillMe));
-            info.spill(DataFormatDouble);
+            info.spill(*m_stream, spillMe, DataFormatDouble);
             return;
         }
             
@@ -816,13 +739,13 @@ public:
             
             // Spill the value, and record it as spilled in its boxed form.
             m_jit.storePtr(reg, JITCompiler::addressFor(spillMe));
-            info.spill((DataFormat)(spillFormat | DataFormatJS));
+            info.spill(*m_stream, spillMe, (DataFormat)(spillFormat | DataFormatJS));
             return;
 #elif USE(JSVALUE32_64)
         case DataFormatCell:
         case DataFormatBoolean: {
             m_jit.store32(info.gpr(), JITCompiler::payloadFor(spillMe));
-            info.spill(spillFormat);
+            info.spill(*m_stream, spillMe, spillFormat);
             return;
         }
 
@@ -830,7 +753,7 @@ public:
         case DataFormatJSDouble: {
             // On JSVALUE32_64 boxing a double is a no-op.
             m_jit.storeDouble(info.fpr(), JITCompiler::addressFor(spillMe));
-            info.spill(DataFormatJSDouble);
+            info.spill(*m_stream, spillMe, DataFormatJSDouble);
             return;
         }
 
@@ -839,7 +762,7 @@ public:
             ASSERT(spillFormat & DataFormatJS);
             m_jit.store32(info.tagGPR(), JITCompiler::tagFor(spillMe));
             m_jit.store32(info.payloadGPR(), JITCompiler::payloadFor(spillMe));
-            info.spill(spillFormat);
+            info.spill(*m_stream, spillMe, spillFormat);
             return;
 #endif
         }
@@ -1800,7 +1723,7 @@ public:
     }
 #endif
     
-#if !defined(NDEBUG) && !CPU(ARM_THUMB2)
+#if !defined(NDEBUG) && !CPU(ARM)
     void prepareForExternalCall()
     {
         for (unsigned i = 0; i < sizeof(void*) / 4; i++)
@@ -2180,8 +2103,7 @@ public:
         m_jit.storePtr(MacroAssembler::TrustedImmPtr(0), MacroAssembler::Address(resultGPR, JSObject::offsetOfInheritorID()));
         
         // Initialize the object's property storage pointer.
-        m_jit.addPtr(MacroAssembler::TrustedImm32(sizeof(JSObject)), resultGPR, scratchGPR);
-        m_jit.storePtr(scratchGPR, MacroAssembler::Address(resultGPR, ClassType::offsetOfPropertyStorage()));
+        m_jit.storePtr(MacroAssembler::TrustedImmPtr(0), MacroAssembler::Address(resultGPR, ClassType::offsetOfOutOfLineStorage()));
     }
 
     // It is acceptable to have structure be equal to scratch, so long as you're fine
@@ -2204,7 +2126,7 @@ public:
         if (!m_compileOkay)
             return;
         ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
-        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this));
+        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_stream->size()));
     }
     void speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail)
     {
@@ -2231,7 +2153,7 @@ public:
             return;
         ASSERT(at(m_compileIndex).canExit() || m_isCheckingArgumentTypes);
         m_jit.codeBlock()->appendSpeculationRecovery(recovery);
-        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_jit.codeBlock()->numberOfSpeculationRecoveries()));
+        m_jit.codeBlock()->appendOSRExit(OSRExit(kind, jsValueSource, m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex), jumpToFail, this, m_stream->size(), m_jit.codeBlock()->numberOfSpeculationRecoveries()));
     }
     void speculationCheck(ExitKind kind, JSValueSource jsValueSource, Edge nodeUse, MacroAssembler::Jump jumpToFail, const SpeculationRecovery& recovery)
     {
@@ -2252,7 +2174,7 @@ public:
             m_jit.codeBlock()->appendOSRExit(
                 OSRExit(kind, jsValueSource,
                         m_jit.graph().methodOfGettingAValueProfileFor(nodeIndex),
-                        JITCompiler::Jump(), this)));
+                        JITCompiler::Jump(), this, m_stream->size())));
         exit.m_watchpointIndex = m_jit.codeBlock()->appendWatchpoint(
             Watchpoint(m_jit.watchpointLabel()));
         return &m_jit.codeBlock()->watchpoint(exit.m_watchpointIndex);
@@ -2295,7 +2217,8 @@ public:
         exit.m_codeOrigin = nextNode->codeOrigin;
         exit.m_lastSetOperand = setLocal->local();
         
-        exit.valueRecoveryForOperand(setLocal->local()) = valueRecovery;
+        exit.m_valueRecoveryOverride = adoptRef(
+            new ValueRecoveryOverride(setLocal->local(), valueRecovery));
     }
     void forwardSpeculationCheck(ExitKind kind, JSValueSource jsValueSource, NodeIndex nodeIndex, MacroAssembler::JumpList& jumpsToFail, const ValueRecovery& valueRecovery)
     {
@@ -2362,6 +2285,13 @@ public:
         return m_variables[operand];
     }
     
+    void recordSetLocal(int operand, ValueSource valueSource)
+    {
+        valueSourceReferenceForOperand(operand) = valueSource;
+        m_stream->appendAndLog(VariableEvent::setLocal(operand, valueSource.dataFormat()));
+    }
+    
+    // The JIT, while also provides MacroAssembler functionality.
     JITCompiler& m_jit;
 
     // The current node being generated.
@@ -2395,6 +2325,9 @@ public:
     
     AbstractState m_state;
     
+    VariableEventStream* m_stream;
+    MinifiedGraph* m_minifiedGraph;
+    
     bool m_isCheckingArgumentTypes;
     
     Vector<SlowPathGenerator*, 8> m_slowPathGenerators; // doesn't use OwnPtr<> because I don't want to include DFGSlowPathGenerator.h
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index 05609baa8..bbbf3c40c 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -62,7 +62,7 @@ GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
         }
 
-        info.fillInteger(gpr);
+        info.fillInteger(*m_stream, gpr);
         returnFormat = DataFormatInteger;
         return gpr;
     }
@@ -91,7 +91,7 @@ GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat
         m_gprs.release(tagGPR);
         m_gprs.release(payloadGPR);
         m_gprs.retain(payloadGPR, virtualRegister, SpillOrderInteger);
-        info.fillInteger(payloadGPR);
+        info.fillInteger(*m_stream, payloadGPR);
         returnFormat = DataFormatInteger;
         return payloadGPR;
     }
@@ -103,10 +103,11 @@ GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat
         returnFormat = DataFormatInteger;
         return gpr;
     }
-    }
 
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
+    }
 }
 
 FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
@@ -123,13 +124,13 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 GPRReg gpr = allocate();
                 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-                info.fillInteger(gpr);
+                info.fillInteger(*m_stream, gpr);
                 unlock(gpr);
             } else if (isNumberConstant(nodeIndex)) {
                 FPRReg fpr = fprAllocate();
                 m_jit.loadDouble(addressOfDoubleConstant(nodeIndex), fpr);
                 m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             } else {
                 // FIXME: should not be reachable?
@@ -142,7 +143,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 FPRReg fpr = fprAllocate();
                 m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
                 m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             }
 
@@ -162,7 +163,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 hasUnboxedDouble.link(&m_jit);
 
             m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
-            info.fillDouble(fpr);
+            info.fillDouble(*m_stream, fpr);
             return fpr;
         }
     }
@@ -207,7 +208,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
         m_gprs.unlock(tagGPR);
         m_gprs.unlock(payloadGPR);
         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-        info.fillDouble(fpr);
+        info.fillDouble(*m_stream, fpr);
         info.killSpilled();
         return fpr;
     }
@@ -227,10 +228,11 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
         m_fprs.lock(fpr);
         return fpr;
     }
-    }
 
-    ASSERT_NOT_REACHED();
-    return InvalidFPRReg;
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidFPRReg;
+    }
 }
 
 bool SpeculativeJIT::fillJSValue(NodeIndex nodeIndex, GPRReg& tagGPR, GPRReg& payloadGPR, FPRReg& fpr)
@@ -252,7 +254,7 @@ bool SpeculativeJIT::fillJSValue(NodeIndex nodeIndex, GPRReg& tagGPR, GPRReg& pa
             m_jit.move(Imm32(valueOfJSConstant(nodeIndex).payload()), payloadGPR);
             m_gprs.retain(tagGPR, virtualRegister, SpillOrderConstant);
             m_gprs.retain(payloadGPR, virtualRegister, SpillOrderConstant);
-            info.fillJSValue(tagGPR, payloadGPR, isInt32Constant(nodeIndex) ? DataFormatJSInteger : DataFormatJS);
+            info.fillJSValue(*m_stream, tagGPR, payloadGPR, isInt32Constant(nodeIndex) ? DataFormatJSInteger : DataFormatJS);
         } else {
             DataFormat spillFormat = info.spillFormat();
             ASSERT(spillFormat != DataFormatNone && spillFormat != DataFormatStorage);
@@ -278,7 +280,7 @@ bool SpeculativeJIT::fillJSValue(NodeIndex nodeIndex, GPRReg& tagGPR, GPRReg& pa
             m_jit.load32(JITCompiler::payloadFor(virtualRegister), payloadGPR);
             m_gprs.retain(tagGPR, virtualRegister, SpillOrderSpilled);
             m_gprs.retain(payloadGPR, virtualRegister, SpillOrderSpilled);
-            info.fillJSValue(tagGPR, payloadGPR, spillFormat == DataFormatJSDouble ? DataFormatJS : spillFormat);
+            info.fillJSValue(*m_stream, tagGPR, payloadGPR, spillFormat == DataFormatJSDouble ? DataFormatJS : spillFormat);
         }
 
         return true;
@@ -320,7 +322,7 @@ bool SpeculativeJIT::fillJSValue(NodeIndex nodeIndex, GPRReg& tagGPR, GPRReg& pa
         m_gprs.release(gpr);
         m_gprs.retain(tagGPR, virtualRegister, SpillOrderJS);
         m_gprs.retain(payloadGPR, virtualRegister, SpillOrderJS);
-        info.fillJSValue(tagGPR, payloadGPR, fillFormat);
+        info.fillJSValue(*m_stream, tagGPR, payloadGPR, fillFormat);
         return true;
     }
 
@@ -335,7 +337,7 @@ bool SpeculativeJIT::fillJSValue(NodeIndex nodeIndex, GPRReg& tagGPR, GPRReg& pa
         m_fprs.release(oldFPR);
         m_gprs.retain(tagGPR, virtualRegister, SpillOrderJS);
         m_gprs.retain(payloadGPR, virtualRegister, SpillOrderJS);
-        info.fillJSValue(tagGPR, payloadGPR, DataFormatJS);
+        info.fillJSValue(*m_stream, tagGPR, payloadGPR, DataFormatJS);
         return true;
     }
 
@@ -353,10 +355,11 @@ bool SpeculativeJIT::fillJSValue(NodeIndex nodeIndex, GPRReg& tagGPR, GPRReg& pa
     case DataFormatStorage:
         // this type currently never occurs
         ASSERT_NOT_REACHED();
-    }
 
-    ASSERT_NOT_REACHED();
-    return true;
+    default:
+        ASSERT_NOT_REACHED();
+        return true;
+    }
 }
 
 class ValueToNumberSlowPathGenerator
@@ -505,7 +508,7 @@ void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseTagGPROrNon
     JITCompiler::DataLabelPtr structureToCompare;
     JITCompiler::PatchableJump structureCheck = m_jit.patchableBranchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(basePayloadGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(-1)));
     
-    m_jit.loadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfPropertyStorage()), resultPayloadGPR);
+    JITCompiler::ConvertibleLoadLabel propertyStorageLoad = m_jit.convertibleLoadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfOutOfLineStorage()), resultPayloadGPR);
     JITCompiler::DataLabelCompact tagLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
     JITCompiler::DataLabelCompact payloadLoadWithPatch = m_jit.load32WithCompactAddressOffsetPatch(JITCompiler::Address(resultPayloadGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
     
@@ -547,7 +550,7 @@ void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseTagGPROrNon
     }
     m_jit.addPropertyAccess(
         PropertyAccessRecord(
-            codeOrigin, structureToCompare, structureCheck,
+            codeOrigin, structureToCompare, structureCheck, propertyStorageLoad,
             tagLoadWithPatch, payloadLoadWithPatch, slowPath.get(), doneLabel,
             safeCast<int8_t>(basePayloadGPR), safeCast<int8_t>(resultTagGPR),
             safeCast<int8_t>(resultPayloadGPR), safeCast<int8_t>(scratchGPR),
@@ -562,7 +565,7 @@ void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg basePayloadGPR,
 
     writeBarrier(basePayloadGPR, valueTagGPR, valueUse, WriteBarrierForPropertyAccess, scratchGPR);
 
-    m_jit.loadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
+    JITCompiler::ConvertibleLoadLabel propertyStorageLoad = m_jit.convertibleLoadPtr(JITCompiler::Address(basePayloadGPR, JSObject::offsetOfOutOfLineStorage()), scratchGPR);
     JITCompiler::DataLabel32 tagStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valueTagGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)));
     JITCompiler::DataLabel32 payloadStoreWithPatch = m_jit.store32WithAddressOffsetPatch(valuePayloadGPR, JITCompiler::Address(scratchGPR, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)));
 
@@ -594,7 +597,7 @@ void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg basePayloadGPR,
     }
     m_jit.addPropertyAccess(
         PropertyAccessRecord(
-            codeOrigin, structureToCompare, structureCheck,
+            codeOrigin, structureToCompare, structureCheck, propertyStorageLoad,
             JITCompiler::DataLabelCompact(tagStoreWithPatch.label()),
             JITCompiler::DataLabelCompact(payloadStoreWithPatch.label()),
             slowPath.get(), doneLabel, safeCast<int8_t>(basePayloadGPR),
@@ -1065,7 +1068,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
             GPRReg gpr = allocate();
             m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
             m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-            info.fillInteger(gpr);
+            info.fillInteger(*m_stream, gpr);
             returnFormat = DataFormatInteger;
             return gpr;
         }
@@ -1080,7 +1083,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
         GPRReg gpr = allocate();
         m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
-        info.fillInteger(gpr);
+        info.fillInteger(*m_stream, gpr);
         returnFormat = DataFormatInteger;
         return gpr;
     }
@@ -1098,7 +1101,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
         m_gprs.release(tagGPR);
         m_gprs.release(payloadGPR);
         m_gprs.retain(payloadGPR, virtualRegister, SpillOrderInteger);
-        info.fillInteger(payloadGPR);
+        info.fillInteger(*m_stream, payloadGPR);
         // If !strict we're done, return.
         returnFormat = DataFormatInteger;
         return payloadGPR;
@@ -1119,10 +1122,11 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
     case DataFormatJSBoolean:
     case DataFormatStorage:
         ASSERT_NOT_REACHED();
-    }
 
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
+    }
 }
 
 GPRReg SpeculativeJIT::fillSpeculateInt(NodeIndex nodeIndex, DataFormat& returnFormat)
@@ -1160,24 +1164,24 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
                 GPRReg gpr = allocate();
                 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-                info.fillInteger(gpr);
+                info.fillInteger(*m_stream, gpr);
                 unlock(gpr);
             } else if (isNumberConstant(nodeIndex)) {
                 FPRReg fpr = fprAllocate();
                 m_jit.loadDouble(addressOfDoubleConstant(nodeIndex), fpr);
                 m_fprs.retain(fpr, virtualRegister, SpillOrderConstant);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             } else
                 ASSERT_NOT_REACHED();
         } else {
             DataFormat spillFormat = info.spillFormat();
             ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInteger);
-            if (spillFormat == DataFormatJSDouble) {
+            if (spillFormat == DataFormatJSDouble || spillFormat == DataFormatDouble) {
                 FPRReg fpr = fprAllocate();
                 m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
                 m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             }
 
@@ -1200,7 +1204,8 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
                 hasUnboxedDouble.link(&m_jit);
 
             m_fprs.retain(fpr, virtualRegister, SpillOrderSpilled);
-            info.fillDouble(fpr);
+            info.fillDouble(*m_stream, fpr);
+            info.killSpilled();
             return fpr;
         }
     }
@@ -1237,7 +1242,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
         m_gprs.unlock(tagGPR);
         m_gprs.unlock(payloadGPR);
         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-        info.fillDouble(fpr);
+        info.fillDouble(*m_stream, fpr);
         info.killSpilled();
         return fpr;
     }
@@ -1265,10 +1270,11 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
     case DataFormatBoolean:
     case DataFormatJSBoolean:
         ASSERT_NOT_REACHED();
-    }
 
-    ASSERT_NOT_REACHED();
-    return InvalidFPRReg;
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidFPRReg;
+    }
 }
 
 GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
@@ -1295,7 +1301,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
             GPRReg gpr = allocate();
             m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
             m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
-            info.fillCell(gpr);
+            info.fillCell(*m_stream, gpr);
             return gpr;
         }
 
@@ -1305,7 +1311,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
         GPRReg gpr = allocate();
         m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
-        info.fillCell(gpr);
+        info.fillCell(*m_stream, gpr);
         return gpr;
     }
 
@@ -1327,7 +1333,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
         m_gprs.release(tagGPR);
         m_gprs.release(payloadGPR);
         m_gprs.retain(payloadGPR, virtualRegister, SpillOrderCell);
-        info.fillCell(payloadGPR);
+        info.fillCell(*m_stream, payloadGPR);
         return payloadGPR;
     }
 
@@ -1339,10 +1345,11 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
     case DataFormatBoolean:
     case DataFormatStorage:
         ASSERT_NOT_REACHED();
-    }
 
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
+    }
 }
 
 GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
@@ -1369,7 +1376,7 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
             GPRReg gpr = allocate();
             m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
             m_jit.move(MacroAssembler::TrustedImm32(jsValue.asBoolean()), gpr);
-            info.fillBoolean(gpr);
+            info.fillBoolean(*m_stream, gpr);
             return gpr;
         }
 
@@ -1381,7 +1388,7 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
         GPRReg gpr = allocate();
         m_jit.load32(JITCompiler::payloadFor(virtualRegister), gpr);
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
-        info.fillBoolean(gpr);
+        info.fillBoolean(*m_stream, gpr);
         return gpr;
     }
 
@@ -1404,7 +1411,7 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
         m_gprs.release(tagGPR);
         m_gprs.release(payloadGPR);
         m_gprs.retain(payloadGPR, virtualRegister, SpillOrderBoolean);
-        info.fillBoolean(payloadGPR);
+        info.fillBoolean(*m_stream, payloadGPR);
         return payloadGPR;
     }
 
@@ -1416,10 +1423,11 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
     case DataFormatCell:
     case DataFormatStorage:
         ASSERT_NOT_REACHED();
-    }
 
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
+    }
 }
 
 JITCompiler::Jump SpeculativeJIT::convertToDouble(JSValueOperand& op, FPRReg result)
@@ -2003,7 +2011,7 @@ void SpeculativeJIT::compile(Node& node)
                 // Indicate that it's no longer necessary to retrieve the value of
                 // this bytecode variable from registers or other locations in the register file,
                 // but that it is stored as a double.
-                valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
+                recordSetLocal(node.local(), ValueSource(DoubleInRegisterFile));
                 break;
             }
             SpeculatedType predictedType = node.variableAccessData()->argumentAwarePrediction();
@@ -2011,14 +2019,14 @@ void SpeculativeJIT::compile(Node& node)
                 DoubleOperand value(this, node.child1());
                 m_jit.storeDouble(value.fpr(), JITCompiler::addressFor(node.local()));
                 noResult(m_compileIndex);
-                valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
+                recordSetLocal(node.local(), ValueSource(DoubleInRegisterFile));
                 break;
             }
             if (isInt32Speculation(predictedType)) {
                 SpeculateIntegerOperand value(this, node.child1());
                 m_jit.store32(value.gpr(), JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-                valueSourceReferenceForOperand(node.local()) = ValueSource(Int32InRegisterFile);
+                recordSetLocal(node.local(), ValueSource(Int32InRegisterFile));
                 break;
             }
             if (isArraySpeculation(predictedType)) {
@@ -2028,14 +2036,14 @@ void SpeculativeJIT::compile(Node& node)
                     speculationCheck(BadType, JSValueSource::unboxedCell(cellGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(cellGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
                 m_jit.storePtr(cellGPR, JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-                valueSourceReferenceForOperand(node.local()) = ValueSource(CellInRegisterFile);
+                recordSetLocal(node.local(), ValueSource(CellInRegisterFile));
                 break;
             }
             if (isBooleanSpeculation(predictedType)) {
                 SpeculateBooleanOperand value(this, node.child1());
                 m_jit.store32(value.gpr(), JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-                valueSourceReferenceForOperand(node.local()) = ValueSource(BooleanInRegisterFile);
+                recordSetLocal(node.local(), ValueSource(BooleanInRegisterFile));
                 break;
             }
         }
@@ -2043,7 +2051,7 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.store32(value.payloadGPR(), JITCompiler::payloadFor(node.local()));
         m_jit.store32(value.tagGPR(), JITCompiler::tagFor(node.local()));
         noResult(m_compileIndex);
-        valueSourceReferenceForOperand(node.local()) = ValueSource(ValueInRegisterFile);
+        recordSetLocal(node.local(), ValueSource(ValueInRegisterFile));
         break;
     }
 
@@ -3542,7 +3550,7 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg baseGPR = base.gpr();
         GPRReg resultGPR = result.gpr();
         
-        m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), resultGPR);
+        m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), resultGPR);
         
         storageResult(resultGPR, m_compileIndex);
         break;
@@ -3883,10 +3891,15 @@ void SpeculativeJIT::compile(Node& node)
         JITCompiler::Jump structuresNotMatch = m_jit.branchPtr(JITCompiler::NotEqual, resultPayloadGPR, JITCompiler::Address(globalObjectGPR, JSCell::structureOffset()));
 
         // Fast case
-        m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::offsetOfPropertyStorage()), resultPayloadGPR);
+        m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::offsetOfOutOfLineStorage()), resultPayloadGPR);
         m_jit.load32(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(GlobalResolveInfo, offset)), resolveInfoGPR);
-        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag)), resultTagGPR);
-        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload)), resultPayloadGPR);
+#if DFG_ENABLE(JIT_ASSERT)
+        JITCompiler::Jump isOutOfLine = m_jit.branch32(JITCompiler::GreaterThanOrEqual, resolveInfoGPR, TrustedImm32(inlineStorageCapacity));
+        m_jit.breakpoint();
+        isOutOfLine.link(&m_jit);
+#endif
+        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.tag) - inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), resultTagGPR);
+        m_jit.load32(JITCompiler::BaseIndex(resultPayloadGPR, resolveInfoGPR, JITCompiler::TimesEight, OBJECT_OFFSETOF(EncodedValueDescriptor, asBits.payload) - inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), resultPayloadGPR);
 
         addSlowPathGenerator(
             slowPathCall(
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index 215f8013d..27eb28fa7 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -48,7 +48,7 @@ GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat
             m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
             if (isInt32Constant(nodeIndex)) {
                 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
-                info.fillInteger(gpr);
+                info.fillInteger(*m_stream, gpr);
                 returnFormat = DataFormatInteger;
                 return gpr;
             }
@@ -74,7 +74,7 @@ GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat
         // Since we statically know that we're filling an integer, and values
         // in the RegisterFile are boxed, this must be DataFormatJSInteger.
         // We will check this with a jitAssert below.
-        info.fillJSValue(gpr, DataFormatJSInteger);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);
         unlock(gpr);
     }
     
@@ -107,10 +107,11 @@ GPRReg SpeculativeJIT::fillInteger(NodeIndex nodeIndex, DataFormat& returnFormat
         returnFormat = DataFormatInteger;
         return gpr;
     }
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
     }
-
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
 }
 
 FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
@@ -127,7 +128,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 // FIXME: should not be reachable?
                 m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-                info.fillInteger(gpr);
+                info.fillInteger(*m_stream, gpr);
                 unlock(gpr);
             } else if (isNumberConstant(nodeIndex)) {
                 FPRReg fpr = fprAllocate();
@@ -136,7 +137,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 unlock(gpr);
 
                 m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             } else {
                 // FIXME: should not be reachable?
@@ -144,7 +145,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 JSValue jsValue = valueOfJSConstant(nodeIndex);
                 m_jit.move(MacroAssembler::TrustedImmPtr(JSValue::encode(jsValue)), gpr);
                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-                info.fillJSValue(gpr, DataFormatJS);
+                info.fillJSValue(*m_stream, gpr, DataFormatJS);
                 unlock(gpr);
             }
         } else {
@@ -154,7 +155,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 FPRReg fpr = fprAllocate();
                 m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
                 m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             }
                 
@@ -163,7 +164,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 
                 m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
                 m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
-                info.fillInteger(gpr);
+                info.fillInteger(*m_stream, gpr);
                 unlock(gpr);
                 break;
             }
@@ -174,7 +175,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
                 ASSERT(spillFormat & DataFormatJS);
                 m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
                 m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
-                info.fillJSValue(gpr, spillFormat);
+                info.fillJSValue(*m_stream, gpr, spillFormat);
                 unlock(gpr);
                 break;
             }
@@ -216,7 +217,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
         m_gprs.unlock(jsValueGpr);
         m_gprs.unlock(tempGpr);
         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-        info.fillDouble(fpr);
+        info.fillDouble(*m_stream, fpr);
         info.killSpilled();
         return fpr;
     }
@@ -247,7 +248,7 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
         m_gprs.release(gpr);
         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
 
-        info.fillDouble(fpr);
+        info.fillDouble(*m_stream, fpr);
         return fpr;
     }
 
@@ -256,10 +257,11 @@ FPRReg SpeculativeJIT::fillDouble(NodeIndex nodeIndex)
         m_fprs.lock(fpr);
         return fpr;
     }
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidFPRReg;
     }
-
-    ASSERT_NOT_REACHED();
-    return InvalidFPRReg;
 }
 
 GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)
@@ -274,18 +276,18 @@ GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)
 
         if (node.hasConstant()) {
             if (isInt32Constant(nodeIndex)) {
-                info.fillJSValue(gpr, DataFormatJSInteger);
+                info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);
                 JSValue jsValue = jsNumber(valueOfInt32Constant(nodeIndex));
                 m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);
             } else if (isNumberConstant(nodeIndex)) {
-                info.fillJSValue(gpr, DataFormatJSDouble);
+                info.fillJSValue(*m_stream, gpr, DataFormatJSDouble);
                 JSValue jsValue(JSValue::EncodeAsDouble, valueOfNumberConstant(nodeIndex));
                 m_jit.move(MacroAssembler::ImmPtr(JSValue::encode(jsValue)), gpr);
             } else {
                 ASSERT(isJSConstant(nodeIndex));
                 JSValue jsValue = valueOfJSConstant(nodeIndex);
                 m_jit.move(MacroAssembler::TrustedImmPtr(JSValue::encode(jsValue)), gpr);
-                info.fillJSValue(gpr, DataFormatJS);
+                info.fillJSValue(*m_stream, gpr, DataFormatJS);
             }
 
             m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
@@ -305,7 +307,7 @@ GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)
                 } else
                     ASSERT(spillFormat & DataFormatJS);
             }
-            info.fillJSValue(gpr, spillFormat);
+            info.fillJSValue(*m_stream, gpr, spillFormat);
         }
         return gpr;
     }
@@ -321,7 +323,7 @@ GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)
         }
         m_gprs.lock(gpr);
         m_jit.orPtr(GPRInfo::tagTypeNumberRegister, gpr);
-        info.fillJSValue(gpr, DataFormatJSInteger);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);
         return gpr;
     }
 
@@ -330,7 +332,7 @@ GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)
         GPRReg gpr = boxDouble(fpr);
 
         // Update all info
-        info.fillJSValue(gpr, DataFormatJSDouble);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSDouble);
         m_fprs.release(fpr);
         m_gprs.retain(gpr, virtualRegister, SpillOrderJS);
 
@@ -353,10 +355,11 @@ GPRReg SpeculativeJIT::fillJSValue(NodeIndex nodeIndex)
     case DataFormatStorage:
         // this type currently never occurs
         ASSERT_NOT_REACHED();
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
     }
-
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
 }
 
 class ValueToNumberSlowPathGenerator
@@ -494,7 +497,8 @@ void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg
     JITCompiler::DataLabelPtr structureToCompare;
     JITCompiler::PatchableJump structureCheck = m_jit.patchableBranchPtrWithPatch(JITCompiler::NotEqual, JITCompiler::Address(baseGPR, JSCell::structureOffset()), structureToCompare, JITCompiler::TrustedImmPtr(reinterpret_cast<void*>(-1)));
     
-    m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), resultGPR);
+    JITCompiler::ConvertibleLoadLabel propertyStorageLoad =
+        m_jit.convertibleLoadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), resultGPR);
     JITCompiler::DataLabelCompact loadWithPatch = m_jit.loadPtrWithCompactAddressOffsetPatch(JITCompiler::Address(resultGPR, 0), resultGPR);
     
     JITCompiler::Label doneLabel = m_jit.label();
@@ -514,8 +518,8 @@ void SpeculativeJIT::cachedGetById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg
     }
     m_jit.addPropertyAccess(
         PropertyAccessRecord(
-            codeOrigin, structureToCompare, structureCheck, loadWithPatch, slowPath.get(),
-            doneLabel, safeCast<int8_t>(baseGPR), safeCast<int8_t>(resultGPR),
+            codeOrigin, structureToCompare, structureCheck, propertyStorageLoad, loadWithPatch,
+            slowPath.get(), doneLabel, safeCast<int8_t>(baseGPR), safeCast<int8_t>(resultGPR),
             safeCast<int8_t>(scratchGPR),
             spillMode == NeedToSpill ? PropertyAccessRecord::RegistersInUse : PropertyAccessRecord::RegistersFlushed));
     addSlowPathGenerator(slowPath.release());
@@ -533,7 +537,8 @@ void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg
 
     writeBarrier(baseGPR, valueGPR, valueUse, WriteBarrierForPropertyAccess, scratchGPR);
 
-    m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), scratchGPR);
+    JITCompiler::ConvertibleLoadLabel propertyStorageLoad =
+        m_jit.convertibleLoadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), scratchGPR);
     JITCompiler::DataLabel32 storeWithPatch = m_jit.storePtrWithAddressOffsetPatch(valueGPR, JITCompiler::Address(scratchGPR, 0));
 
     JITCompiler::Label doneLabel = m_jit.label();
@@ -563,7 +568,11 @@ void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg baseGPR, GPRReg
             slowCases, this, optimizedCall, NoResult, valueGPR, baseGPR,
             identifier(identifierNumber));
     }
-    m_jit.addPropertyAccess(PropertyAccessRecord(codeOrigin, structureToCompare, structureCheck, JITCompiler::DataLabelCompact(storeWithPatch.label()), slowPath.get(), doneLabel, safeCast<int8_t>(baseGPR), safeCast<int8_t>(valueGPR), safeCast<int8_t>(scratchGPR)));
+    m_jit.addPropertyAccess(
+        PropertyAccessRecord(
+            codeOrigin, structureToCompare, structureCheck, propertyStorageLoad,
+            JITCompiler::DataLabelCompact(storeWithPatch.label()), slowPath.get(), doneLabel,
+            safeCast<int8_t>(baseGPR), safeCast<int8_t>(valueGPR), safeCast<int8_t>(scratchGPR)));
     addSlowPathGenerator(slowPath.release());
 }
 
@@ -1047,7 +1056,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
             m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
             ASSERT(isInt32Constant(nodeIndex));
             m_jit.move(MacroAssembler::Imm32(valueOfInt32Constant(nodeIndex)), gpr);
-            info.fillInteger(gpr);
+            info.fillInteger(*m_stream, gpr);
             returnFormat = DataFormatInteger;
             return gpr;
         }
@@ -1062,7 +1071,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
             // If we know this was spilled as an integer we can fill without checking.
             if (strict) {
                 m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
-                info.fillInteger(gpr);
+                info.fillInteger(*m_stream, gpr);
                 returnFormat = DataFormatInteger;
                 return gpr;
             }
@@ -1071,14 +1080,14 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
                 m_jit.orPtr(GPRInfo::tagTypeNumberRegister, gpr);
             } else
                 m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
-            info.fillJSValue(gpr, DataFormatJSInteger);
+            info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);
             returnFormat = DataFormatJSInteger;
             return gpr;
         }
         m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
 
         // Fill as JSValue, and fall through.
-        info.fillJSValue(gpr, DataFormatJSInteger);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);
         m_gprs.unlock(gpr);
     }
 
@@ -1088,7 +1097,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
         m_gprs.lock(gpr);
         if (!isInt32Speculation(type))
             speculationCheck(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchPtr(MacroAssembler::Below, gpr, GPRInfo::tagTypeNumberRegister));
-        info.fillJSValue(gpr, DataFormatJSInteger);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSInteger);
         // If !strict we're done, return.
         if (!strict) {
             returnFormat = DataFormatJSInteger;
@@ -1109,7 +1118,7 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
                 result = allocate();
             else {
                 m_gprs.lock(gpr);
-                info.fillInteger(gpr);
+                info.fillInteger(*m_stream, gpr);
                 result = gpr;
             }
             m_jit.zeroExtend32ToPtr(gpr, result);
@@ -1151,10 +1160,11 @@ GPRReg SpeculativeJIT::fillSpeculateIntInternal(NodeIndex nodeIndex, DataFormat&
 
     case DataFormatStorage:
         ASSERT_NOT_REACHED();
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
     }
-
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
 }
 
 GPRReg SpeculativeJIT::fillSpeculateInt(NodeIndex nodeIndex, DataFormat& returnFormat)
@@ -1191,7 +1201,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
                 unlock(gpr);
 
                 m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             }
             if (isNumberConstant(nodeIndex)) {
@@ -1201,7 +1211,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
                 unlock(gpr);
 
                 m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-                info.fillDouble(fpr);
+                info.fillDouble(*m_stream, fpr);
                 return fpr;
             }
             terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -1214,7 +1224,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
             FPRReg fpr = fprAllocate();
             m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
             m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-            info.fillDouble(fpr);
+            info.fillDouble(*m_stream, fpr);
             return fpr;
         }
             
@@ -1223,7 +1233,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
             
             m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
             m_jit.load32(JITCompiler::addressFor(virtualRegister), gpr);
-            info.fillInteger(gpr);
+            info.fillInteger(*m_stream, gpr);
             unlock(gpr);
             break;
         }
@@ -1234,7 +1244,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
             ASSERT(spillFormat & DataFormatJS);
             m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
             m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
-            info.fillJSValue(gpr, spillFormat);
+            info.fillJSValue(*m_stream, gpr, spillFormat);
             unlock(gpr);
             break;
         }
@@ -1277,7 +1287,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
         m_gprs.unlock(jsValueGpr);
         m_gprs.unlock(tempGpr);
         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
-        info.fillDouble(fpr);
+        info.fillDouble(*m_stream, fpr);
         info.killSpilled();
         return fpr;
     }
@@ -1308,7 +1318,7 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
         m_gprs.release(gpr);
         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
 
-        info.fillDouble(fpr);
+        info.fillDouble(*m_stream, fpr);
         return fpr;
     }
 
@@ -1317,10 +1327,11 @@ FPRReg SpeculativeJIT::fillSpeculateDouble(NodeIndex nodeIndex)
         m_fprs.lock(fpr);
         return fpr;
     }
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidFPRReg;
     }
-
-    ASSERT_NOT_REACHED();
-    return InvalidFPRReg;
 }
 
 GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
@@ -1347,7 +1358,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
             if (jsValue.isCell()) {
                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
                 m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
-                info.fillJSValue(gpr, DataFormatJSCell);
+                info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
                 return gpr;
             }
             terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -1357,10 +1368,10 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
         m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
 
-        info.fillJSValue(gpr, DataFormatJS);
+        info.fillJSValue(*m_stream, gpr, DataFormatJS);
         if (!isCellSpeculation(type))
             speculationCheck(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister));
-        info.fillJSValue(gpr, DataFormatJSCell);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
         return gpr;
     }
 
@@ -1376,7 +1387,7 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
         m_gprs.lock(gpr);
         if (!isCellSpeculation(type))
             speculationCheck(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, GPRInfo::tagMaskRegister));
-        info.fillJSValue(gpr, DataFormatJSCell);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
         return gpr;
     }
 
@@ -1392,10 +1403,11 @@ GPRReg SpeculativeJIT::fillSpeculateCell(NodeIndex nodeIndex)
 
     case DataFormatStorage:
         ASSERT_NOT_REACHED();
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
     }
-
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
 }
 
 GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
@@ -1422,7 +1434,7 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
             if (jsValue.isBoolean()) {
                 m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
                 m_jit.move(MacroAssembler::TrustedImmPtr(JSValue::encode(jsValue)), gpr);
-                info.fillJSValue(gpr, DataFormatJSBoolean);
+                info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
                 return gpr;
             }
             terminateSpeculativeExecution(Uncountable, JSValueRegs(), NoNode);
@@ -1432,13 +1444,13 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
         m_jit.loadPtr(JITCompiler::addressFor(virtualRegister), gpr);
 
-        info.fillJSValue(gpr, DataFormatJS);
+        info.fillJSValue(*m_stream, gpr, DataFormatJS);
         if (!isBooleanSpeculation(type)) {
             m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);
             speculationCheck(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg));
             m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);
         }
-        info.fillJSValue(gpr, DataFormatJSBoolean);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
         return gpr;
     }
 
@@ -1457,7 +1469,7 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
             speculationCheck(BadType, JSValueRegs(gpr), nodeIndex, m_jit.branchTestPtr(MacroAssembler::NonZero, gpr, TrustedImm32(static_cast<int32_t>(~1))), SpeculationRecovery(BooleanSpeculationCheck, gpr, InvalidGPRReg));
             m_jit.xorPtr(TrustedImm32(static_cast<int32_t>(ValueFalse)), gpr);
         }
-        info.fillJSValue(gpr, DataFormatJSBoolean);
+        info.fillJSValue(*m_stream, gpr, DataFormatJSBoolean);
         return gpr;
     }
 
@@ -1473,10 +1485,11 @@ GPRReg SpeculativeJIT::fillSpeculateBoolean(NodeIndex nodeIndex)
         
     case DataFormatStorage:
         ASSERT_NOT_REACHED();
+        
+    default:
+        ASSERT_NOT_REACHED();
+        return InvalidGPRReg;
     }
-
-    ASSERT_NOT_REACHED();
-    return InvalidGPRReg;
 }
 
 JITCompiler::Jump SpeculativeJIT::convertToDouble(GPRReg value, FPRReg result, GPRReg tmp)
@@ -2055,7 +2068,7 @@ void SpeculativeJIT::compile(Node& node)
                 // Indicate that it's no longer necessary to retrieve the value of
                 // this bytecode variable from registers or other locations in the register file,
                 // but that it is stored as a double.
-                valueSourceReferenceForOperand(node.local()) = ValueSource(DoubleInRegisterFile);
+                recordSetLocal(node.local(), ValueSource(DoubleInRegisterFile));
                 break;
             }
         
@@ -2064,7 +2077,7 @@ void SpeculativeJIT::compile(Node& node)
                 SpeculateIntegerOperand value(this, node.child1());
                 m_jit.store32(value.gpr(), JITCompiler::payloadFor(node.local()));
                 noResult(m_compileIndex);
-                valueSourceReferenceForOperand(node.local()) = ValueSource(Int32InRegisterFile);
+                recordSetLocal(node.local(), ValueSource(Int32InRegisterFile));
                 break;
             }
             if (isArraySpeculation(predictedType)) {
@@ -2074,14 +2087,14 @@ void SpeculativeJIT::compile(Node& node)
                     speculationCheck(BadType, JSValueRegs(cellGPR), node.child1(), m_jit.branchPtr(MacroAssembler::NotEqual, MacroAssembler::Address(cellGPR, JSCell::classInfoOffset()), MacroAssembler::TrustedImmPtr(&JSArray::s_info)));
                 m_jit.storePtr(cellGPR, JITCompiler::addressFor(node.local()));
                 noResult(m_compileIndex);
-                valueSourceReferenceForOperand(node.local()) = ValueSource(CellInRegisterFile);
+                recordSetLocal(node.local(), ValueSource(CellInRegisterFile));
                 break;
             }
             if (isBooleanSpeculation(predictedType)) {
                 SpeculateBooleanOperand boolean(this, node.child1());
                 m_jit.storePtr(boolean.gpr(), JITCompiler::addressFor(node.local()));
                 noResult(m_compileIndex);
-                valueSourceReferenceForOperand(node.local()) = ValueSource(BooleanInRegisterFile);
+                recordSetLocal(node.local(), ValueSource(BooleanInRegisterFile));
                 break;
             }
         }
@@ -2090,7 +2103,7 @@ void SpeculativeJIT::compile(Node& node)
         m_jit.storePtr(value.gpr(), JITCompiler::addressFor(node.local()));
         noResult(m_compileIndex);
 
-        valueSourceReferenceForOperand(node.local()) = ValueSource(ValueInRegisterFile);
+        recordSetLocal(node.local(), ValueSource(ValueInRegisterFile));
         break;
     }
 
@@ -3567,7 +3580,7 @@ void SpeculativeJIT::compile(Node& node)
         GPRReg baseGPR = base.gpr();
         GPRReg resultGPR = result.gpr();
         
-        m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfPropertyStorage()), resultGPR);
+        m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::offsetOfOutOfLineStorage()), resultGPR);
         
         storageResult(resultGPR, m_compileIndex);
         break;
@@ -3883,9 +3896,14 @@ void SpeculativeJIT::compile(Node& node)
         JITCompiler::Jump structuresDontMatch = m_jit.branchPtr(JITCompiler::NotEqual, resultGPR, JITCompiler::Address(globalObjectGPR, JSCell::structureOffset()));
 
         // Fast case
-        m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::offsetOfPropertyStorage()), resultGPR);
         m_jit.load32(JITCompiler::Address(resolveInfoGPR, OBJECT_OFFSETOF(GlobalResolveInfo, offset)), resolveInfoGPR);
-        m_jit.loadPtr(JITCompiler::BaseIndex(resultGPR, resolveInfoGPR, JITCompiler::ScalePtr), resultGPR);
+#if DFG_ENABLE(JIT_ASSERT)
+        JITCompiler::Jump isOutOfLine = m_jit.branch32(JITCompiler::GreaterThanOrEqual, resolveInfoGPR, TrustedImm32(inlineStorageCapacity));
+        m_jit.breakpoint();
+        isOutOfLine.link(&m_jit);
+#endif
+        m_jit.loadPtr(JITCompiler::Address(globalObjectGPR, JSObject::offsetOfOutOfLineStorage()), resultGPR);
+        m_jit.loadPtr(JITCompiler::BaseIndex(resultGPR, resolveInfoGPR, JITCompiler::ScalePtr, -inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), resultGPR);
         
         addSlowPathGenerator(
             slowPathCall(
diff --git a/Source/JavaScriptCore/dfg/DFGValueRecoveryOverride.h b/Source/JavaScriptCore/dfg/DFGValueRecoveryOverride.h
new file mode 100644
index 000000000..317111aec
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGValueRecoveryOverride.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGValueRecoveryOverride_h
+#define DFGValueRecoveryOverride_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "ValueRecovery.h"
+#include <wtf/RefCounted.h>
+
+namespace JSC { namespace DFG {
+
+class ValueRecoveryOverride : public RefCounted<ValueRecoveryOverride> {
+public:
+    ValueRecoveryOverride() { }
+    
+    ValueRecoveryOverride(int operand, const ValueRecovery& recovery)
+        : operand(operand)
+        , recovery(recovery)
+    {
+    }
+    
+    int operand;
+    ValueRecovery recovery;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGValueRecoveryOverride_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGValueSource.cpp b/Source/JavaScriptCore/dfg/DFGValueSource.cpp
new file mode 100644
index 000000000..25d43ee6b
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGValueSource.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGValueSource.h"
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+void ValueSource::dump(FILE* out) const
+{
+    switch (kind()) {
+    case SourceNotSet:
+        fprintf(out, "NotSet");
+        break;
+    case SourceIsDead:
+        fprintf(out, "IsDead");
+        break;
+    case ValueInRegisterFile:
+        fprintf(out, "InRegFile");
+        break;
+    case Int32InRegisterFile:
+        fprintf(out, "Int32");
+        break;
+    case CellInRegisterFile:
+        fprintf(out, "Cell");
+        break;
+    case BooleanInRegisterFile:
+        fprintf(out, "Bool");
+        break;
+    case DoubleInRegisterFile:
+        fprintf(out, "Double");
+        break;
+    case ArgumentsSource:
+        fprintf(out, "Arguments");
+        break;
+    case HaveNode:
+        fprintf(out, "Node(%d)", m_nodeIndex);
+        break;
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGValueSource.h b/Source/JavaScriptCore/dfg/DFGValueSource.h
new file mode 100644
index 000000000..be4a6e081
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGValueSource.h
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGValueSource_h
+#define DFGValueSource_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DataFormat.h"
+#include "SpeculatedType.h"
+#include "ValueRecovery.h"
+
+namespace JSC { namespace DFG {
+
+enum ValueSourceKind {
+    SourceNotSet,
+    ValueInRegisterFile,
+    Int32InRegisterFile,
+    CellInRegisterFile,
+    BooleanInRegisterFile,
+    DoubleInRegisterFile,
+    ArgumentsSource,
+    SourceIsDead,
+    HaveNode
+};
+
+static inline ValueSourceKind dataFormatToValueSourceKind(DataFormat dataFormat)
+{
+    switch (dataFormat) {
+    case DataFormatInteger:
+        return Int32InRegisterFile;
+    case DataFormatDouble:
+        return DoubleInRegisterFile;
+    case DataFormatBoolean:
+        return BooleanInRegisterFile;
+    case DataFormatCell:
+        return CellInRegisterFile;
+    case DataFormatDead:
+        return SourceIsDead;
+    case DataFormatArguments:
+        return ArgumentsSource;
+    default:
+        ASSERT(dataFormat & DataFormatJS);
+        return ValueInRegisterFile;
+    }
+}
+
+static inline DataFormat valueSourceKindToDataFormat(ValueSourceKind kind)
+{
+    switch (kind) {
+    case ValueInRegisterFile:
+        return DataFormatJS;
+    case Int32InRegisterFile:
+        return DataFormatInteger;
+    case CellInRegisterFile:
+        return DataFormatCell;
+    case BooleanInRegisterFile:
+        return DataFormatBoolean;
+    case DoubleInRegisterFile:
+        return DataFormatDouble;
+    case ArgumentsSource:
+        return DataFormatArguments;
+    case SourceIsDead:
+        return DataFormatDead;
+    default:
+        return DataFormatNone;
+    }
+}
+
+static inline bool isInRegisterFile(ValueSourceKind kind)
+{
+    DataFormat format = valueSourceKindToDataFormat(kind);
+    return format != DataFormatNone && format < DataFormatOSRMarker;
+}
+
+// Can this value be recovered without having to look at register allocation state or
+// DFG node liveness?
+static inline bool isTriviallyRecoverable(ValueSourceKind kind)
+{
+    return valueSourceKindToDataFormat(kind) != DataFormatNone;
+}
+
+class ValueSource {
+public:
+    ValueSource()
+        : m_nodeIndex(nodeIndexFromKind(SourceNotSet))
+    {
+    }
+    
+    explicit ValueSource(ValueSourceKind valueSourceKind)
+        : m_nodeIndex(nodeIndexFromKind(valueSourceKind))
+    {
+        ASSERT(kind() != SourceNotSet);
+        ASSERT(kind() != HaveNode);
+    }
+    
+    explicit ValueSource(NodeIndex nodeIndex)
+        : m_nodeIndex(nodeIndex)
+    {
+        ASSERT(nodeIndex != NoNode);
+        ASSERT(kind() == HaveNode);
+    }
+    
+    static ValueSource forSpeculation(SpeculatedType prediction)
+    {
+        if (isInt32Speculation(prediction))
+            return ValueSource(Int32InRegisterFile);
+        if (isArraySpeculation(prediction))
+            return ValueSource(CellInRegisterFile);
+        if (isBooleanSpeculation(prediction))
+            return ValueSource(BooleanInRegisterFile);
+        return ValueSource(ValueInRegisterFile);
+    }
+    
+    static ValueSource forDataFormat(DataFormat dataFormat)
+    {
+        return ValueSource(dataFormatToValueSourceKind(dataFormat));
+    }
+    
+    bool isSet() const
+    {
+        return kindFromNodeIndex(m_nodeIndex) != SourceNotSet;
+    }
+    
+    ValueSourceKind kind() const
+    {
+        return kindFromNodeIndex(m_nodeIndex);
+    }
+    
+    bool isInRegisterFile() const { return JSC::DFG::isInRegisterFile(kind()); }
+    bool isTriviallyRecoverable() const { return JSC::DFG::isTriviallyRecoverable(kind()); }
+    
+    DataFormat dataFormat() const
+    {
+        return valueSourceKindToDataFormat(kind());
+    }
+    
+    ValueRecovery valueRecovery() const
+    {
+        ASSERT(isTriviallyRecoverable());
+        switch (kind()) {
+        case ValueInRegisterFile:
+            return ValueRecovery::alreadyInRegisterFile();
+            
+        case Int32InRegisterFile:
+            return ValueRecovery::alreadyInRegisterFileAsUnboxedInt32();
+            
+        case CellInRegisterFile:
+            return ValueRecovery::alreadyInRegisterFileAsUnboxedCell();
+            
+        case BooleanInRegisterFile:
+            return ValueRecovery::alreadyInRegisterFileAsUnboxedBoolean();
+            
+        case DoubleInRegisterFile:
+            return ValueRecovery::alreadyInRegisterFileAsUnboxedDouble();
+            
+        case SourceIsDead:
+            return ValueRecovery::constant(jsUndefined());
+            
+        case ArgumentsSource:
+            return ValueRecovery::argumentsThatWereNotCreated();
+            
+        default:
+            ASSERT_NOT_REACHED();
+            return ValueRecovery();
+        }
+    }
+    
+    NodeIndex nodeIndex() const
+    {
+        ASSERT(kind() == HaveNode);
+        return m_nodeIndex;
+    }
+    
+    void dump(FILE* out) const;
+    
+private:
+    static NodeIndex nodeIndexFromKind(ValueSourceKind kind)
+    {
+        ASSERT(kind >= SourceNotSet && kind < HaveNode);
+        return NoNode - kind;
+    }
+    
+    static ValueSourceKind kindFromNodeIndex(NodeIndex nodeIndex)
+    {
+        unsigned kind = static_cast<unsigned>(NoNode - nodeIndex);
+        if (kind >= static_cast<unsigned>(HaveNode))
+            return HaveNode;
+        return static_cast<ValueSourceKind>(kind);
+    }
+    
+    NodeIndex m_nodeIndex;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGValueSource_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGVariableAccessData.h b/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
index 382907d27..e734e6387 100644
--- a/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
+++ b/Source/JavaScriptCore/dfg/DFGVariableAccessData.h
@@ -176,7 +176,7 @@ public:
         
         // If the variable has been voted to become a double, then make it a
         // double.
-        if (doubleVoteRatio() >= Options::doubleVoteRatioForDoubleFormat)
+        if (doubleVoteRatio() >= Options::doubleVoteRatioForDoubleFormat())
             return true;
         
         return false;
diff --git a/Source/JavaScriptCore/dfg/DFGVariableEvent.cpp b/Source/JavaScriptCore/dfg/DFGVariableEvent.cpp
new file mode 100644
index 000000000..3e84a6ba1
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGVariableEvent.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVariableEvent.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGFPRInfo.h"
+#include "DFGGPRInfo.h"
+
+namespace JSC { namespace DFG {
+
+void VariableEvent::dump(FILE* out) const
+{
+    switch (kind()) {
+    case Reset:
+        fprintf(out, "Reset");
+        break;
+    case BirthToFill:
+        dumpFillInfo("BirthToFill", out);
+        break;
+    case BirthToSpill:
+        dumpSpillInfo("BirthToSpill", out);
+        break;
+    case Fill:
+        dumpFillInfo("Fill", out);
+        break;
+    case Spill:
+        dumpSpillInfo("Spill", out);
+        break;
+    case Death:
+        fprintf(out, "Death(@%u)", nodeIndex());
+        break;
+    case MovHint:
+        fprintf(out, "MovHint(@%u, r%d)", nodeIndex(), operand());
+        break;
+    case SetLocalEvent:
+        fprintf(out, "SetLocal(r%d, %s)", operand(), dataFormatToString(dataFormat()));
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+void VariableEvent::dumpFillInfo(const char* name, FILE* out) const
+{
+    fprintf(out, "%s(@%u, ", name, nodeIndex());
+    if (dataFormat() == DataFormatDouble)
+        fprintf(out, "%s", FPRInfo::debugName(fpr()));
+#if USE(JSVALUE32_64)
+    else if (dataFormat() & DataFormatJS)
+        fprintf(out, "%s:%s", GPRInfo::debugName(tagGPR()), GPRInfo::debugName(payloadGPR()));
+#endif
+    else
+        fprintf(out, "%s", GPRInfo::debugName(gpr()));
+    fprintf(out, ", %s)", dataFormatToString(dataFormat()));
+}
+
+void VariableEvent::dumpSpillInfo(const char* name, FILE* out) const
+{
+    fprintf(out, "%s(@%u, r%d, %s)", name, nodeIndex(), virtualRegister(), dataFormatToString(dataFormat()));
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGVariableEvent.h b/Source/JavaScriptCore/dfg/DFGVariableEvent.h
new file mode 100644
index 000000000..a491a3ebf
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGVariableEvent.h
@@ -0,0 +1,270 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGVariableEvent_h
+#define DFGVariableEvent_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DataFormat.h"
+#include "MacroAssembler.h"
+#include <stdio.h>
+
+namespace JSC { namespace DFG {
+
+enum VariableEventKind {
+    // Marks the beginning of a checkpoint. If you interpret the variable
+    // events starting at a Reset point then you'll get everything you need.
+    Reset,
+    
+    // Node births. Points in the code where a node becomes relevant for OSR.
+    // It may be the point where it is actually born (i.e. assigned) or it may
+    // be a later point, if it's only later in the sequence of instructions
+    // that we start to care about this node.
+    BirthToFill,
+    BirthToSpill,
+    
+    // Events related to how a node is represented.
+    Fill,
+    Spill,
+    
+    // Death of a node - after this we no longer care about this node.
+    Death,
+    
+    // A MovHint means that a node is being associated with a bytecode operand,
+    // but that it has not been stored into that operand.
+    MovHint,
+    
+    // A SetLocalEvent means that a node's value has actually been stored into the
+    // bytecode operand that it's associated with.
+    SetLocalEvent,
+    
+    // Used to indicate an uninitialized VariableEvent. Don't use for other
+    // purposes.
+    InvalidEventKind
+};
+
+union VariableRepresentation {
+    MacroAssembler::RegisterID gpr;
+    MacroAssembler::FPRegisterID fpr;
+#if USE(JSVALUE32_64)
+    struct {
+        MacroAssembler::RegisterID tagGPR;
+        MacroAssembler::RegisterID payloadGPR;
+    } pair;
+#endif
+    int32_t virtualReg;
+};
+
+class VariableEvent {
+public:
+    VariableEvent()
+        : m_kind(InvalidEventKind)
+    {
+    }
+    
+    static VariableEvent reset()
+    {
+        VariableEvent event;
+        event.m_kind = Reset;
+        return event;
+    }
+    
+    static VariableEvent fillGPR(VariableEventKind kind, NodeIndex nodeIndex, MacroAssembler::RegisterID gpr, DataFormat dataFormat)
+    {
+        ASSERT(kind == BirthToFill || kind == Fill);
+        ASSERT(dataFormat != DataFormatDouble);
+#if USE(JSVALUE32_64)
+        ASSERT(!(dataFormat & DataFormatJS));
+#endif
+        VariableEvent event;
+        event.m_index = nodeIndex;
+        event.u.gpr = gpr;
+        event.m_kind = kind;
+        event.m_dataFormat = dataFormat;
+        return event;
+    }
+    
+#if USE(JSVALUE32_64)
+    static VariableEvent fillPair(VariableEventKind kind, NodeIndex nodeIndex, MacroAssembler::RegisterID tagGPR, MacroAssembler::RegisterID payloadGPR)
+    {
+        ASSERT(kind == BirthToFill || kind == Fill);
+        VariableEvent event;
+        event.m_index = nodeIndex;
+        event.u.pair.tagGPR = tagGPR;
+        event.u.pair.payloadGPR = payloadGPR;
+        event.m_kind = kind;
+        event.m_dataFormat = DataFormatJS;
+        return event;
+    }
+#endif // USE(JSVALUE32_64)
+    
+    static VariableEvent fillFPR(VariableEventKind kind, NodeIndex nodeIndex, MacroAssembler::FPRegisterID fpr)
+    {
+        ASSERT(kind == BirthToFill || kind == Fill);
+        VariableEvent event;
+        event.m_index = nodeIndex;
+        event.u.fpr = fpr;
+        event.m_kind = kind;
+        event.m_dataFormat = DataFormatDouble;
+        return event;
+    }
+    
+    static VariableEvent spill(VariableEventKind kind, NodeIndex nodeIndex, VirtualRegister virtualRegister, DataFormat format)
+    {
+        ASSERT(kind == BirthToSpill || kind == Spill);
+        VariableEvent event;
+        event.m_index = nodeIndex;
+        event.u.virtualReg = virtualRegister;
+        event.m_kind = kind;
+        event.m_dataFormat = format;
+        return event;
+    }
+    
+    static VariableEvent death(NodeIndex nodeIndex)
+    {
+        VariableEvent event;
+        event.m_index = nodeIndex;
+        event.m_kind = Death;
+        return event;
+    }
+    
+    static VariableEvent setLocal(int operand, DataFormat format)
+    {
+        VariableEvent event;
+        event.u.virtualReg = operand;
+        event.m_kind = SetLocalEvent;
+        event.m_dataFormat = format;
+        return event;
+    }
+    
+    static VariableEvent movHint(NodeIndex nodeIndex, int operand)
+    {
+        VariableEvent event;
+        event.m_index = nodeIndex;
+        event.u.virtualReg = operand;
+        event.m_kind = MovHint;
+        return event;
+    }
+    
+    VariableEventKind kind() const
+    {
+        return static_cast<VariableEventKind>(m_kind);
+    }
+    
+    NodeIndex nodeIndex() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill
+               || m_kind == BirthToSpill || m_kind == Spill
+               || m_kind == Death || m_kind == MovHint);
+        return m_index;
+    }
+    
+    DataFormat dataFormat() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill
+               || m_kind == BirthToSpill || m_kind == Spill
+               || m_kind == SetLocalEvent);
+        return static_cast<DataFormat>(m_dataFormat);
+    }
+    
+    MacroAssembler::RegisterID gpr() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat);
+        ASSERT(m_dataFormat != DataFormatDouble);
+#if USE(JSVALUE32_64)
+        ASSERT(!(m_dataFormat & DataFormatJS));
+#endif
+        return u.gpr;
+    }
+    
+#if USE(JSVALUE32_64)
+    MacroAssembler::RegisterID tagGPR() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat & DataFormatJS);
+        return u.pair.tagGPR;
+    }
+    MacroAssembler::RegisterID payloadGPR() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat & DataFormatJS);
+        return u.pair.payloadGPR;
+    }
+#endif // USE(JSVALUE32_64)
+    
+    MacroAssembler::FPRegisterID fpr() const
+    {
+        ASSERT(m_kind == BirthToFill || m_kind == Fill);
+        ASSERT(m_dataFormat == DataFormatDouble);
+        return u.fpr;
+    }
+    
+    VirtualRegister virtualRegister() const
+    {
+        ASSERT(m_kind == BirthToSpill || m_kind == Spill);
+        return static_cast<VirtualRegister>(u.virtualReg);
+    }
+    
+    int operand() const
+    {
+        ASSERT(m_kind == SetLocalEvent || m_kind == MovHint);
+        return u.virtualReg;
+    }
+    
+    const VariableRepresentation& variableRepresentation() const { return u; }
+    
+    void dump(FILE*) const;
+    
+private:
+    void dumpFillInfo(const char* name, FILE*) const;
+    void dumpSpillInfo(const char* name, FILE*) const;
+    
+    NodeIndex m_index;
+    
+    // For BirthToFill, Fill:
+    //   - The GPR or FPR, or a GPR pair.
+    // For BirthToSpill, Spill:
+    //   - The virtual register.
+    // For MovHint, SetLocalEvent:
+    //   - The bytecode operand.
+    // For Death:
+    //   - Unused.
+    VariableRepresentation u;
+    
+    int8_t m_kind;
+    int8_t m_dataFormat;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGVariableEvent_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp b/Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp
new file mode 100644
index 000000000..5d548a755
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp
@@ -0,0 +1,286 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DFGVariableEventStream.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "CodeBlock.h"
+#include "DFGValueSource.h"
+#include <wtf/DataLog.h>
+
+namespace JSC { namespace DFG {
+
+void VariableEventStream::logEvent(const VariableEvent& event)
+{
+    dataLog("seq#%u:", static_cast<unsigned>(size()));
+    event.dump(WTF::dataFile());
+    dataLog(" ");
+}
+
+struct MinifiedGenerationInfo {
+    bool filled; // true -> in gpr/fpr/pair, false -> spilled
+    VariableRepresentation u;
+    DataFormat format;
+    
+    MinifiedGenerationInfo()
+        : format(DataFormatNone)
+    {
+    }
+    
+    void update(const VariableEvent& event)
+    {
+        switch (event.kind()) {
+        case BirthToFill:
+        case Fill:
+            filled = true;
+            break;
+        case BirthToSpill:
+        case Spill:
+            filled = false;
+            break;
+        case Death:
+            format = DataFormatNone;
+            return;
+        default:
+            return;
+        }
+        
+        u = event.variableRepresentation();
+        format = event.dataFormat();
+    }
+};
+
+void VariableEventStream::reconstruct(
+    CodeBlock* codeBlock, CodeOrigin codeOrigin, MinifiedGraph& graph,
+    unsigned index, Operands<ValueRecovery>& valueRecoveries) const
+{
+    ASSERT(codeBlock->getJITType() == JITCode::DFGJIT);
+    CodeBlock* baselineCodeBlock = codeBlock->baselineVersion();
+    
+    unsigned numVariables;
+    if (codeOrigin.inlineCallFrame)
+        numVariables = baselineCodeBlockForInlineCallFrame(codeOrigin.inlineCallFrame)->m_numCalleeRegisters + codeOrigin.inlineCallFrame->stackOffset;
+    else
+        numVariables = baselineCodeBlock->m_numCalleeRegisters;
+    
+    // Crazy special case: if we're at index == 0 then this must be an argument check
+    // failure, in which case all variables are already set up. The recoveries should
+    // reflect this.
+    if (!index) {
+        valueRecoveries = Operands<ValueRecovery>(codeBlock->numParameters(), numVariables);
+        for (size_t i = 0; i < valueRecoveries.size(); ++i)
+            valueRecoveries[i] = ValueRecovery::alreadyInRegisterFile();
+        return;
+    }
+    
+    // Step 1: Find the last checkpoint, and figure out the number of virtual registers as we go.
+    unsigned startIndex = index - 1;
+    while (at(startIndex).kind() != Reset)
+        startIndex--;
+    
+    // Step 2: Create a mock-up of the DFG's state and execute the events.
+    Operands<ValueSource> operandSources(codeBlock->numParameters(), numVariables);
+    Vector<MinifiedGenerationInfo, 32> generationInfos(graph.originalGraphSize());
+    for (unsigned i = startIndex; i < index; ++i) {
+        const VariableEvent& event = at(i);
+        switch (event.kind()) {
+        case Reset:
+            // nothing to do.
+            break;
+        case BirthToFill:
+        case BirthToSpill:
+        case Fill:
+        case Spill:
+        case Death:
+            generationInfos[event.nodeIndex()].update(event);
+            break;
+        case MovHint:
+            if (operandSources.hasOperand(event.operand()))
+                operandSources.setOperand(event.operand(), ValueSource(event.nodeIndex()));
+            break;
+        case SetLocalEvent:
+            if (operandSources.hasOperand(event.operand()))
+                operandSources.setOperand(event.operand(), ValueSource::forDataFormat(event.dataFormat()));
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+    }
+    
+    // Step 3: Record the things that are live, so we can get to them more quickly.
+    Vector<unsigned, 16> indicesOfLiveThings;
+    for (unsigned i = 0; i < generationInfos.size(); ++i) {
+        if (generationInfos[i].format != DataFormatNone)
+            indicesOfLiveThings.append(i);
+    }
+    
+    // Step 4: Compute value recoveries!
+    valueRecoveries = Operands<ValueRecovery>(codeBlock->numParameters(), numVariables);
+    for (unsigned i = 0; i < operandSources.size(); ++i) {
+        ValueSource& source = operandSources[i];
+        if (source.isTriviallyRecoverable()) {
+            valueRecoveries[i] = source.valueRecovery();
+            continue;
+        }
+        
+        ASSERT(source.kind() == HaveNode);
+        MinifiedNode* node = graph.at(source.nodeIndex());
+        if (node) {
+            if (node->hasConstantNumber()) {
+                valueRecoveries[i] = ValueRecovery::constant(
+                    codeBlock->constantRegister(
+                        FirstConstantRegisterIndex + node->constantNumber()).get());
+                continue;
+            }
+            if (node->hasWeakConstant()) {
+                valueRecoveries[i] = ValueRecovery::constant(node->weakConstant());
+                continue;
+            }
+            if (node->op() == PhantomArguments) {
+                valueRecoveries[i] = ValueRecovery::argumentsThatWereNotCreated();
+                continue;
+            }
+        }
+        
+        MinifiedGenerationInfo* info = &generationInfos[source.nodeIndex()];
+        if (info->format == DataFormatNone) {
+            // Try to see if there is an alternate node that would contain the value we want.
+            // There are four possibilities:
+            //
+            // Int32ToDouble: We can use this in place of the original node, but
+            //    we'd rather not; so we use it only if it is the only remaining
+            //    live version.
+            //
+            // ValueToInt32: If the only remaining live version of the value is
+            //    ValueToInt32, then we can use it.
+            //
+            // UInt32ToNumber: If the only live version of the value is a UInt32ToNumber
+            //    then the only remaining uses are ones that want a properly formed number
+            //    rather than a UInt32 intermediate.
+            //
+            // DoubleAsInt32: Same as UInt32ToNumber.
+            //
+            // The reverse of the above: This node could be a UInt32ToNumber, but its
+            //    alternative is still alive. This means that the only remaining uses of
+            //    the number would be fine with a UInt32 intermediate.
+            
+            bool found = false;
+            
+            if (node && node->op() == UInt32ToNumber) {
+                NodeIndex nodeIndex = node->child1();
+                node = graph.at(nodeIndex);
+                info = &generationInfos[nodeIndex];
+                if (info->format != DataFormatNone)
+                    found = true;
+            }
+            
+            if (!found) {
+                NodeIndex int32ToDoubleIndex = NoNode;
+                NodeIndex valueToInt32Index = NoNode;
+                NodeIndex uint32ToNumberIndex = NoNode;
+                NodeIndex doubleAsInt32Index = NoNode;
+                
+                for (unsigned i = 0; i < indicesOfLiveThings.size(); ++i) {
+                    NodeIndex nodeIndex = indicesOfLiveThings[i];
+                    node = graph.at(nodeIndex);
+                    if (!node)
+                        continue;
+                    if (!node->hasChild1())
+                        continue;
+                    if (node->child1() != source.nodeIndex())
+                        continue;
+                    ASSERT(generationInfos[nodeIndex].format != DataFormatNone);
+                    switch (node->op()) {
+                    case Int32ToDouble:
+                        int32ToDoubleIndex = nodeIndex;
+                        break;
+                    case ValueToInt32:
+                        valueToInt32Index = nodeIndex;
+                        break;
+                    case UInt32ToNumber:
+                        uint32ToNumberIndex = nodeIndex;
+                        break;
+                    case DoubleAsInt32:
+                        doubleAsInt32Index = nodeIndex;
+                        break;
+                    default:
+                        break;
+                    }
+                }
+                
+                NodeIndex nodeIndexToUse;
+                if (doubleAsInt32Index != NoNode)
+                    nodeIndexToUse = doubleAsInt32Index;
+                else if (int32ToDoubleIndex != NoNode)
+                    nodeIndexToUse = int32ToDoubleIndex;
+                else if (valueToInt32Index != NoNode)
+                    nodeIndexToUse = valueToInt32Index;
+                else if (uint32ToNumberIndex != NoNode)
+                    nodeIndexToUse = uint32ToNumberIndex;
+                else
+                    nodeIndexToUse = NoNode;
+                
+                if (nodeIndexToUse != NoNode) {
+                    info = &generationInfos[nodeIndexToUse];
+                    ASSERT(info->format != DataFormatNone);
+                    found = true;
+                }
+            }
+            
+            if (!found) {
+                valueRecoveries[i] = ValueRecovery::constant(jsUndefined());
+                continue;
+            }
+        }
+        
+        ASSERT(info->format != DataFormatNone);
+        
+        if (info->filled) {
+            if (info->format == DataFormatDouble) {
+                valueRecoveries[i] = ValueRecovery::inFPR(info->u.fpr);
+                continue;
+            }
+#if USE(JSVALUE32_64)
+            if (info->format & DataFormatJS) {
+                valueRecoveries[i] = ValueRecovery::inPair(info->u.pair.tagGPR, info->u.pair.payloadGPR);
+                continue;
+            }
+#endif
+            valueRecoveries[i] = ValueRecovery::inGPR(info->u.gpr, info->format);
+            continue;
+        }
+        
+        valueRecoveries[i] =
+            ValueRecovery::displacedInRegisterFile(static_cast<VirtualRegister>(info->u.virtualReg), info->format);
+    }
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
diff --git a/Source/JavaScriptCore/dfg/DFGVariableEventStream.h b/Source/JavaScriptCore/dfg/DFGVariableEventStream.h
new file mode 100644
index 000000000..0d10eb048
--- /dev/null
+++ b/Source/JavaScriptCore/dfg/DFGVariableEventStream.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGVariableEventStream_h
+#define DFGVariableEventStream_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGCommon.h"
+#include "DFGMinifiedGraph.h"
+#include "DFGVariableEvent.h"
+#include "Operands.h"
+#include <wtf/Vector.h>
+
+namespace JSC { namespace DFG {
+
+class VariableEventStream : public Vector<VariableEvent> {
+public:
+    void appendAndLog(const VariableEvent& event)
+    {
+#if DFG_ENABLE(DEBUG_VERBOSE)
+        logEvent(event);
+#endif
+        append(event);
+    }
+    
+    void reconstruct(
+        CodeBlock*, CodeOrigin, MinifiedGraph&,
+        unsigned index, Operands<ValueRecovery>&) const;
+
+private:
+    void logEvent(const VariableEvent&);
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGVariableEventStream_h
+
diff --git a/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
index 2d7ce33c9..86b33835d 100644
--- a/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGVirtualRegisterAllocationPhase.cpp
@@ -132,6 +132,7 @@ public:
 
 bool performVirtualRegisterAllocation(Graph& graph)
 {
+    SamplingRegion samplingRegion("DFG Virtual Register Allocation Phase");
     return runPhase<VirtualRegisterAllocationPhase>(graph);
 }
 
diff --git a/Source/JavaScriptCore/disassembler/udis86/udis86_syn-att.c b/Source/JavaScriptCore/disassembler/udis86/udis86_syn-att.c
index 132d6ff84..155a34ca2 100644
--- a/Source/JavaScriptCore/disassembler/udis86/udis86_syn-att.c
+++ b/Source/JavaScriptCore/disassembler/udis86/udis86_syn-att.c
@@ -109,7 +109,7 @@ gen_operand(struct ud* u, struct ud_operand* op)
         }
         if ( sext_size < 64 )
             sext_mask = ( 1ull << sext_size ) - 1;
-        mkasm( u, "0x" FMT64 "x", imm & sext_mask ); 
+        mkasm( u, "$0x" FMT64 "x", imm & sext_mask ); 
 
 		break;
     }
diff --git a/Source/JavaScriptCore/gyp/generate-derived-sources.sh b/Source/JavaScriptCore/gyp/generate-derived-sources.sh
deleted file mode 100755
index a03af7d9f..000000000
--- a/Source/JavaScriptCore/gyp/generate-derived-sources.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-
-mkdir -p "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs"
-cd "${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore"
-
-/bin/ln -sfh "${SRCROOT}/.." JavaScriptCore
-export JavaScriptCore="JavaScriptCore"
-
-make --no-builtin-rules -f "JavaScriptCore/DerivedSources.make" -j `/usr/sbin/sysctl -n hw.ncpu`
diff --git a/Source/JavaScriptCore/gyp/generate-dtrace-header.sh b/Source/JavaScriptCore/gyp/generate-dtrace-header.sh
deleted file mode 100755
index a3c31dd70..000000000
--- a/Source/JavaScriptCore/gyp/generate-dtrace-header.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-
-TRACING_D="$1/runtime/Tracing.d";
-TRACING_H="$BUILT_PRODUCTS_DIR/DerivedSources/JavaScriptCore/TracingDtrace.h";
-
-if [[ "${HAVE_DTRACE}" = "1" && "${TRACING_D}" -nt "${TRACING_H}" ]]; then
-    dtrace -h -o "${TRACING_H}" -s "${TRACING_D}";
-fi;
-
diff --git a/Source/JavaScriptCore/gyp/run-if-exists.sh b/Source/JavaScriptCore/gyp/run-if-exists.sh
deleted file mode 100755
index 242ffc81b..000000000
--- a/Source/JavaScriptCore/gyp/run-if-exists.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/sh
-
-if [ -f $1 ]; then
-    $1 || exit $?;
-fi
diff --git a/Source/JavaScriptCore/gyp/update-info-plist.sh b/Source/JavaScriptCore/gyp/update-info-plist.sh
deleted file mode 100755
index d02ecce45..000000000
--- a/Source/JavaScriptCore/gyp/update-info-plist.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-# Touch Info.plist to let Xcode know it needs to copy it into the built product
-if [[ "${CONFIGURATION}" != "Production" ]]; then
-    touch "$1";
-fi
diff --git a/Source/JavaScriptCore/heap/ConservativeRoots.cpp b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
index d63faebf3..6b9cbef45 100644
--- a/Source/JavaScriptCore/heap/ConservativeRoots.cpp
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.cpp
@@ -62,11 +62,6 @@ void ConservativeRoots::grow()
     m_roots = newRoots;
 }
 
-class DummyMarkHook {
-public:
-    void mark(void*) { }
-};
-
 template<typename MarkHook>
 inline void ConservativeRoots::genericAddPointer(void* p, TinyBloomFilter filter, MarkHook& markHook)
 {
@@ -110,15 +105,48 @@ void ConservativeRoots::genericAddSpan(void* begin, void* end, MarkHook& markHoo
         genericAddPointer(*it, filter, markHook);
 }
 
+class DummyMarkHook {
+public:
+    void mark(void*) { }
+};
+
 void ConservativeRoots::add(void* begin, void* end)
 {
-    DummyMarkHook hook;
-    genericAddSpan(begin, end, hook);
+    DummyMarkHook dummy;
+    genericAddSpan(begin, end, dummy);
 }
 
-void ConservativeRoots::add(void* begin, void* end, DFGCodeBlocks& dfgCodeBlocks)
+void ConservativeRoots::add(void* begin, void* end, JITStubRoutineSet& jitStubRoutines)
+{
+    genericAddSpan(begin, end, jitStubRoutines);
+}
+
+template<typename T, typename U>
+class CompositeMarkHook {
+public:
+    CompositeMarkHook(T& first, U& second)
+        : m_first(first)
+        , m_second(second)
+    {
+    }
+    
+    void mark(void* address)
+    {
+        m_first.mark(address);
+        m_second.mark(address);
+    }
+
+private:
+    T& m_first;
+    U& m_second;
+};
+
+void ConservativeRoots::add(
+    void* begin, void* end, JITStubRoutineSet& jitStubRoutines, DFGCodeBlocks& dfgCodeBlocks)
 {
-    genericAddSpan(begin, end, dfgCodeBlocks);
+    CompositeMarkHook<JITStubRoutineSet, DFGCodeBlocks> markHook(
+        jitStubRoutines, dfgCodeBlocks);
+    genericAddSpan(begin, end, markHook);
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/ConservativeRoots.h b/Source/JavaScriptCore/heap/ConservativeRoots.h
index 9d9e9ba0c..219bdcc8e 100644
--- a/Source/JavaScriptCore/heap/ConservativeRoots.h
+++ b/Source/JavaScriptCore/heap/ConservativeRoots.h
@@ -32,9 +32,10 @@
 
 namespace JSC {
 
-class JSCell;
 class DFGCodeBlocks;
 class Heap;
+class JITStubRoutineSet;
+class JSCell;
 
 class ConservativeRoots {
 public:
@@ -42,7 +43,8 @@ public:
     ~ConservativeRoots();
 
     void add(void* begin, void* end);
-    void add(void* begin, void* end, DFGCodeBlocks&);
+    void add(void* begin, void* end, JITStubRoutineSet&);
+    void add(void* begin, void* end, JITStubRoutineSet&, DFGCodeBlocks&);
     
     size_t size();
     JSCell** roots();
diff --git a/Source/JavaScriptCore/heap/CopiedSpace.cpp b/Source/JavaScriptCore/heap/CopiedSpace.cpp
index 631e829ec..9eb70a556 100644
--- a/Source/JavaScriptCore/heap/CopiedSpace.cpp
+++ b/Source/JavaScriptCore/heap/CopiedSpace.cpp
@@ -66,6 +66,7 @@ CheckedBoolean CopiedSpace::tryAllocateSlowCase(size_t bytes, void** outPtr)
     if (isOversize(bytes))
         return tryAllocateOversize(bytes, outPtr);
     
+    ASSERT(m_heap->globalData()->apiLock().currentThreadIsHoldingLock());
     m_heap->didAllocate(m_allocator.currentCapacity());
 
     allocateBlock();
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index ef062c9ce..377132765 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -160,15 +160,9 @@ static inline size_t proportionalHeapSize(size_t heapSize, size_t ramSize)
     return 1.25 * heapSize;
 }
 
-static inline bool isValidSharedInstanceThreadState()
+static inline bool isValidSharedInstanceThreadState(JSGlobalData* globalData)
 {
-    if (!JSLock::lockCount())
-        return false;
-
-    if (!JSLock::currentThreadIsHoldingLock())
-        return false;
-
-    return true;
+    return globalData->apiLock().currentThreadIsHoldingLock();
 }
 
 static inline bool isValidThreadState(JSGlobalData* globalData)
@@ -176,7 +170,7 @@ static inline bool isValidThreadState(JSGlobalData* globalData)
     if (globalData->identifierTable != wtfThreadData().currentIdentifierTable())
         return false;
 
-    if (globalData->isSharedInstance() && !isValidSharedInstanceThreadState())
+    if (globalData->isSharedInstance() && !isValidSharedInstanceThreadState(globalData))
         return false;
 
     return true;
@@ -275,10 +269,6 @@ void Heap::lastChanceToFinalize()
     ASSERT(!m_globalData->dynamicGlobalObject);
     ASSERT(m_operationInProgress == NoOperation);
 
-    // FIXME: Make this a release-mode crash once we're sure no one's doing this.
-    if (size_t size = m_protectedValues.size())
-        WTFLogAlways("ERROR: JavaScriptCore heap deallocated while %ld values were still protected", static_cast<unsigned long>(size));
-
     m_objectSpace.lastChanceToFinalize();
 
 #if ENABLE(SIMPLE_HEAP_PROFILING)
@@ -327,7 +317,7 @@ void Heap::didAbandon(size_t bytes)
 void Heap::protect(JSValue k)
 {
     ASSERT(k);
-    ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance());
+    ASSERT(m_globalData->apiLock().currentThreadIsHoldingLock());
 
     if (!k.isCell())
         return;
@@ -338,7 +328,7 @@ void Heap::protect(JSValue k)
 bool Heap::unprotect(JSValue k)
 {
     ASSERT(k);
-    ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance());
+    ASSERT(m_globalData->apiLock().currentThreadIsHoldingLock());
 
     if (!k.isCell())
         return false;
@@ -430,6 +420,7 @@ void Heap::markRoots(bool fullGC)
     // We gather conservative roots before clearing mark bits because conservative
     // gathering uses the mark bits to determine whether a reference is valid.
     ConservativeRoots machineThreadRoots(&m_objectSpace.blocks(), &m_storageSpace);
+    m_jitStubRoutines.clearMarks();
     {
         GCPHASE(GatherConservativeRoots);
         m_machineThreads.gatherConservativeRoots(machineThreadRoots, &dummy);
@@ -439,7 +430,8 @@ void Heap::markRoots(bool fullGC)
     m_dfgCodeBlocks.clearMarks();
     {
         GCPHASE(GatherRegisterFileRoots);
-        registerFile().gatherConservativeRoots(registerFileRoots, m_dfgCodeBlocks);
+        registerFile().gatherConservativeRoots(
+            registerFileRoots, m_jitStubRoutines, m_dfgCodeBlocks);
     }
 
 #if ENABLE(DFG_JIT)
@@ -464,6 +456,7 @@ void Heap::markRoots(bool fullGC)
 
     m_storageSpace.startedCopying();
     SlotVisitor& visitor = m_slotVisitor;
+    visitor.setup();
     HeapRootVisitor heapRootVisitor(visitor);
 
     {
@@ -549,9 +542,10 @@ void Heap::markRoots(bool fullGC)
         }
     
         {
-            GCPHASE(TraceCodeBlocks);
-            MARK_LOG_ROOT(visitor, "Trace Code Blocks");
+            GCPHASE(TraceCodeBlocksAndJITStubRoutines);
+            MARK_LOG_ROOT(visitor, "Trace Code Blocks and JIT Stub Routines");
             m_dfgCodeBlocks.traceMarkedCodeBlocks(visitor);
+            m_jitStubRoutines.traceMarkedStubRoutines(visitor);
             visitor.donateAndDrain();
         }
     
@@ -595,12 +589,11 @@ void Heap::markRoots(bool fullGC)
 #endif
 
     visitor.reset();
-    m_sharedData.reset();
 #if ENABLE(PARALLEL_GC)
     m_sharedData.resetChildren();
 #endif
+    m_sharedData.reset();
     m_storageSpace.doneCopying();
-
 }
 
 size_t Heap::objectCount()
@@ -675,6 +668,7 @@ void Heap::deleteUnmarkedCompiledCode()
     }
 
     m_dfgCodeBlocks.deleteUnmarkedJettisonedCodeBlocks();
+    m_jitStubRoutines.deleteUnmarkedJettisonedStubRoutines();
 }
 
 void Heap::collectAllGarbage()
@@ -692,6 +686,7 @@ void Heap::collect(SweepToggle sweepToggle)
     SamplingRegion samplingRegion("Garbage Collection");
     
     GCPHASE(Collect);
+    ASSERT(globalData()->apiLock().currentThreadIsHoldingLock());
     ASSERT(globalData()->identifierTable == wtfThreadData().currentIdentifierTable());
     ASSERT(m_isSafeToCollect);
     JAVASCRIPTCORE_GC_BEGIN();
@@ -777,19 +772,19 @@ void Heap::collect(SweepToggle sweepToggle)
     JAVASCRIPTCORE_GC_END();
 }
 
-void Heap::setActivityCallback(PassOwnPtr<GCActivityCallback> activityCallback)
+void Heap::setActivityCallback(GCActivityCallback* activityCallback)
 {
     m_activityCallback = activityCallback;
 }
 
 GCActivityCallback* Heap::activityCallback()
 {
-    return m_activityCallback.get();
+    return m_activityCallback;
 }
 
 IncrementalSweeper* Heap::sweeper()
 {
-    return m_sweeper.get();
+    return m_sweeper;
 }
 
 void Heap::setGarbageCollectionTimerEnabled(bool enable)
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index 91c3aa58f..a43be3df0 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -26,6 +26,7 @@
 #include "DFGCodeBlocks.h"
 #include "HandleSet.h"
 #include "HandleStack.h"
+#include "JITStubRoutineSet.h"
 #include "MarkedAllocator.h"
 #include "MarkedBlock.h"
 #include "MarkedBlockSet.h"
@@ -44,10 +45,12 @@ namespace JSC {
     class CodeBlock;
     class ExecutableBase;
     class GCActivityCallback;
+    class GCAwareJITStubRoutine;
     class GlobalCodeBlock;
     class Heap;
     class HeapRootVisitor;
     class IncrementalSweeper;
+    class JITStubRoutine;
     class JSCell;
     class JSGlobalData;
     class JSValue;
@@ -99,10 +102,10 @@ namespace JSC {
         MachineThreads& machineThreads() { return m_machineThreads; }
 
         JS_EXPORT_PRIVATE GCActivityCallback* activityCallback();
-        JS_EXPORT_PRIVATE void setActivityCallback(PassOwnPtr<GCActivityCallback>);
+        JS_EXPORT_PRIVATE void setActivityCallback(GCActivityCallback*);
         JS_EXPORT_PRIVATE void setGarbageCollectionTimerEnabled(bool);
 
-        IncrementalSweeper* sweeper();
+        JS_EXPORT_PRIVATE IncrementalSweeper* sweeper();
 
         // true if an allocation or collection is in progress
         inline bool isBusy();
@@ -168,6 +171,8 @@ namespace JSC {
 
     private:
         friend class CodeBlock;
+        friend class GCAwareJITStubRoutine;
+        friend class JITStubRoutine;
         friend class LLIntOffsetsExtractor;
         friend class MarkedSpace;
         friend class MarkedAllocator;
@@ -229,6 +234,7 @@ namespace JSC {
         HandleSet m_handleSet;
         HandleStack m_handleStack;
         DFGCodeBlocks m_dfgCodeBlocks;
+        JITStubRoutineSet m_jitStubRoutines;
         FinalizerOwner m_finalizerOwner;
         
         bool m_isSafeToCollect;
@@ -237,10 +243,10 @@ namespace JSC {
         double m_lastGCLength;
         double m_lastCodeDiscardTime;
 
-        OwnPtr<GCActivityCallback> m_activityCallback;
-        OwnPtr<IncrementalSweeper> m_sweeper;
-        
         DoublyLinkedList<ExecutableBase> m_compiledCode;
+        
+        GCActivityCallback* m_activityCallback;
+        IncrementalSweeper* m_sweeper;
     };
 
     inline bool Heap::shouldCollect()
diff --git a/Source/JavaScriptCore/heap/HeapTimer.cpp b/Source/JavaScriptCore/heap/HeapTimer.cpp
index b4d928a34..ae66f9e26 100644
--- a/Source/JavaScriptCore/heap/HeapTimer.cpp
+++ b/Source/JavaScriptCore/heap/HeapTimer.cpp
@@ -26,6 +26,10 @@
 #include "config.h"
 #include "HeapTimer.h"
 
+#include "APIShims.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "ScopeChain.h"
 #include <wtf/Threading.h>
 
 namespace JSC {
@@ -46,7 +50,8 @@ HeapTimer::HeapTimer(JSGlobalData* globalData, CFRunLoopRef runLoop)
 
 HeapTimer::~HeapTimer()
 {
-    invalidate();
+    CFRunLoopRemoveTimer(m_runLoop.get(), m_timer.get(), kCFRunLoopCommonModes);
+    CFRunLoopTimerInvalidate(m_timer.get());
 }
 
 void HeapTimer::synchronize()
@@ -60,14 +65,37 @@ void HeapTimer::synchronize()
 
 void HeapTimer::invalidate()
 {
-    CFRunLoopRemoveTimer(m_runLoop.get(), m_timer.get(), kCFRunLoopCommonModes);
-    CFRunLoopTimerInvalidate(m_timer.get());
+    m_globalData = 0;
+    CFRunLoopTimerSetNextFireDate(m_timer.get(), CFAbsoluteTimeGetCurrent() - s_decade);
+}
+
+void HeapTimer::didStartVMShutdown()
+{
+    if (CFRunLoopGetCurrent() == m_runLoop.get()) {
+        invalidate();
+        delete this;
+        return;
+    }
+    ASSERT(!m_globalData->apiLock().currentThreadIsHoldingLock());
+    MutexLocker locker(m_shutdownMutex);
+    invalidate();
 }
 
 void HeapTimer::timerDidFire(CFRunLoopTimerRef, void* info)
 {
     HeapTimer* agent = static_cast<HeapTimer*>(info);
-    agent->doWork();
+    agent->m_shutdownMutex.lock();
+    if (!agent->m_globalData) {
+        agent->m_shutdownMutex.unlock();
+        delete agent;
+        return;
+    }
+    {
+        // We don't ref here to prevent us from resurrecting the ref count of a "dead" JSGlobalData.
+        APIEntryShim shim(agent->m_globalData, APIEntryShimWithoutLock::DontRefGlobalData);
+        agent->doWork();
+    }
+    agent->m_shutdownMutex.unlock();
 }
 
 #else
@@ -81,6 +109,11 @@ HeapTimer::~HeapTimer()
 {
 }
 
+void HeapTimer::didStartVMShutdown()
+{
+    delete this;
+}
+
 void HeapTimer::synchronize()
 {
 }
@@ -89,7 +122,6 @@ void HeapTimer::invalidate()
 {
 }
 
-
 #endif
     
 
diff --git a/Source/JavaScriptCore/heap/HeapTimer.h b/Source/JavaScriptCore/heap/HeapTimer.h
index fea013975..9255e0648 100644
--- a/Source/JavaScriptCore/heap/HeapTimer.h
+++ b/Source/JavaScriptCore/heap/HeapTimer.h
@@ -27,6 +27,7 @@
 #define HeapTimer_h
 
 #include <wtf/RetainPtr.h>
+#include <wtf/Threading.h>
 
 #if USE(CF)
 #include <CoreFoundation/CoreFoundation.h>
@@ -46,7 +47,8 @@ public:
 #endif
     
     virtual ~HeapTimer();
-    
+
+    void didStartVMShutdown();
     virtual void synchronize();
     virtual void doWork() = 0;
     
@@ -59,6 +61,8 @@ protected:
     RetainPtr<CFRunLoopTimerRef> m_timer;
     RetainPtr<CFRunLoopRef> m_runLoop;
     CFRunLoopTimerContext m_context;
+
+    Mutex m_shutdownMutex;
 #endif
     
 private:
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
index 848377346..49222c545 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.cpp
@@ -45,7 +45,6 @@ static const CFTimeInterval sweepTimeMultiplier = 1.0 / sweepTimeTotal;
 
 void IncrementalSweeper::doWork()
 {
-    APIEntryShim shim(m_globalData);
     doSweep(WTF::monotonicallyIncreasingTime());
 }
     
@@ -55,9 +54,9 @@ IncrementalSweeper::IncrementalSweeper(Heap* heap, CFRunLoopRef runLoop)
 {
 }
 
-PassOwnPtr<IncrementalSweeper> IncrementalSweeper::create(Heap* heap)
+IncrementalSweeper* IncrementalSweeper::create(Heap* heap)
 {
-    return adoptPtr(new IncrementalSweeper(heap, CFRunLoopGetCurrent()));
+    return new IncrementalSweeper(heap, CFRunLoopGetCurrent());
 }
 
 void IncrementalSweeper::scheduleTimer()
@@ -110,9 +109,9 @@ void IncrementalSweeper::doWork()
 {
 }
 
-PassOwnPtr<IncrementalSweeper> IncrementalSweeper::create(Heap* heap)
+IncrementalSweeper* IncrementalSweeper::create(Heap* heap)
 {
-    return adoptPtr(new IncrementalSweeper(heap->globalData()));
+    return new IncrementalSweeper(heap->globalData());
 }
 
 void IncrementalSweeper::startSweeping(const HashSet<MarkedBlock*>&)
diff --git a/Source/JavaScriptCore/heap/IncrementalSweeper.h b/Source/JavaScriptCore/heap/IncrementalSweeper.h
index 20f4e3ca8..eedfa7f6f 100644
--- a/Source/JavaScriptCore/heap/IncrementalSweeper.h
+++ b/Source/JavaScriptCore/heap/IncrementalSweeper.h
@@ -39,7 +39,7 @@ class Heap;
     
 class IncrementalSweeper : public HeapTimer {
 public:
-    static PassOwnPtr<IncrementalSweeper> create(Heap*);
+    static IncrementalSweeper* create(Heap*);
     void startSweeping(const HashSet<MarkedBlock*>& blockSnapshot);
     virtual void doWork();
 
diff --git a/Source/JavaScriptCore/heap/JITStubRoutineSet.cpp b/Source/JavaScriptCore/heap/JITStubRoutineSet.cpp
new file mode 100644
index 000000000..054bf06dd
--- /dev/null
+++ b/Source/JavaScriptCore/heap/JITStubRoutineSet.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITStubRoutineSet.h"
+
+#if ENABLE(JIT)
+
+#include "GCAwareJITStubRoutine.h"
+#include "ScopeChain.h"
+#include "SlotVisitor.h"
+
+namespace JSC {
+
+JITStubRoutineSet::JITStubRoutineSet() { }
+JITStubRoutineSet::~JITStubRoutineSet()
+{
+    for (size_t i = m_listOfRoutines.size(); i--;) {
+        GCAwareJITStubRoutine* routine = m_listOfRoutines[i];
+        
+        routine->m_mayBeExecuting = false;
+        
+        if (!routine->m_isJettisoned) {
+            // Inform the deref() routine that it should delete this guy as soon
+            // as the ref count reaches zero.
+            routine->m_isJettisoned = true;
+            continue;
+        }
+        
+        routine->deleteFromGC();
+    }
+}
+
+void JITStubRoutineSet::add(GCAwareJITStubRoutine* routine)
+{
+    ASSERT(!routine->m_isJettisoned);
+    
+    m_listOfRoutines.append(routine);
+    
+    uintptr_t start = routine->startAddress();
+    uintptr_t end = routine->endAddress();
+    uintptr_t step = JITStubRoutine::addressStep();
+    for (uintptr_t iter = start; iter < end; iter += step) {
+        ASSERT(m_addressToRoutineMap.find(iter) == m_addressToRoutineMap.end());
+        m_addressToRoutineMap.add(iter, routine);
+    }
+}
+
+void JITStubRoutineSet::clearMarks()
+{
+    for (size_t i = m_listOfRoutines.size(); i--;)
+        m_listOfRoutines[i]->m_mayBeExecuting = false;
+}
+
+void JITStubRoutineSet::markSlow(uintptr_t address)
+{
+    HashMap<uintptr_t, GCAwareJITStubRoutine*>::iterator iter =
+        m_addressToRoutineMap.find(address & ~(JITStubRoutine::addressStep() - 1));
+    
+    if (iter == m_addressToRoutineMap.end())
+        return;
+    
+    iter->second->m_mayBeExecuting = true;
+}
+
+void JITStubRoutineSet::deleteUnmarkedJettisonedStubRoutines()
+{
+    for (size_t i = 0; i < m_listOfRoutines.size(); i++) {
+        GCAwareJITStubRoutine* routine = m_listOfRoutines[i];
+        if (!routine->m_isJettisoned || routine->m_mayBeExecuting)
+            continue;
+        
+        uintptr_t start = routine->startAddress();
+        uintptr_t end = routine->endAddress();
+        uintptr_t step = JITStubRoutine::addressStep();
+        for (uintptr_t iter = start; iter < end; iter += step) {
+            ASSERT(m_addressToRoutineMap.find(iter) != m_addressToRoutineMap.end());
+            ASSERT(m_addressToRoutineMap.find(iter)->second == routine);
+            m_addressToRoutineMap.remove(iter);
+        }
+        
+        routine->deleteFromGC();
+        
+        m_listOfRoutines[i] = m_listOfRoutines.last();
+        m_listOfRoutines.removeLast();
+        i--;
+    }
+}
+
+void JITStubRoutineSet::traceMarkedStubRoutines(SlotVisitor& visitor)
+{
+    for (size_t i = m_listOfRoutines.size(); i--;) {
+        GCAwareJITStubRoutine* routine = m_listOfRoutines[i];
+        if (!routine->m_mayBeExecuting)
+            continue;
+        
+        routine->markRequiredObjects(visitor);
+    }
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/Source/JavaScriptCore/heap/JITStubRoutineSet.h b/Source/JavaScriptCore/heap/JITStubRoutineSet.h
new file mode 100644
index 000000000..ea120132e
--- /dev/null
+++ b/Source/JavaScriptCore/heap/JITStubRoutineSet.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITStubRoutineSet_h
+#define JITStubRoutineSet_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+#include "JITStubRoutine.h"
+#include <wtf/FastAllocBase.h>
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class GCAwareJITStubRoutine;
+class SlotVisitor;
+
+class JITStubRoutineSet {
+    WTF_MAKE_NONCOPYABLE(JITStubRoutineSet);
+    WTF_MAKE_FAST_ALLOCATED;
+    
+public:
+    JITStubRoutineSet();
+    ~JITStubRoutineSet();
+    
+    void add(GCAwareJITStubRoutine*);
+
+    void clearMarks();
+    
+    void mark(void* candidateAddress)
+    {
+        uintptr_t address = reinterpret_cast<uintptr_t>(candidateAddress);
+        if (!JITStubRoutine::passesFilter(address))
+            return;
+        
+        markSlow(address);
+    }
+    
+    void deleteUnmarkedJettisonedStubRoutines();
+    
+    void traceMarkedStubRoutines(SlotVisitor&);
+    
+private:
+    void markSlow(uintptr_t address);
+    
+    HashMap<uintptr_t, GCAwareJITStubRoutine*> m_addressToRoutineMap;
+    Vector<GCAwareJITStubRoutine*> m_listOfRoutines;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // JITStubRoutineSet_h
+
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.cpp b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
index 8e0c57b6a..7eb57479b 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.cpp
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.cpp
@@ -141,8 +141,10 @@ MachineThreads::MachineThreads(Heap* heap)
 
 MachineThreads::~MachineThreads()
 {
-    if (m_threadSpecific)
-        ThreadSpecificKeyDelete(m_threadSpecific);
+    if (m_threadSpecific) {
+        int error = pthread_key_delete(m_threadSpecific);
+        ASSERT_UNUSED(error, !error);
+    }
 
     MutexLocker registeredThreadsLock(m_registeredThreadsMutex);
     for (Thread* t = m_registeredThreads; t;) {
@@ -179,17 +181,19 @@ void MachineThreads::makeUsableFromMultipleThreads()
     if (m_threadSpecific)
         return;
 
-    ThreadSpecificKeyCreate(&m_threadSpecific, removeThread);
+    int error = pthread_key_create(&m_threadSpecific, removeThread);
+    if (error)
+        CRASH();
 }
 
 void MachineThreads::addCurrentThread()
 {
     ASSERT(!m_heap->globalData()->exclusiveThread || m_heap->globalData()->exclusiveThread == currentThread());
 
-    if (!m_threadSpecific || ThreadSpecificGet(m_threadSpecific))
+    if (!m_threadSpecific || pthread_getspecific(m_threadSpecific))
         return;
 
-    ThreadSpecificSet(m_threadSpecific, this);
+    pthread_setspecific(m_threadSpecific, this);
     Thread* thread = new Thread(getCurrentPlatformThread(), wtfThreadData().stack().origin());
 
     MutexLocker lock(m_registeredThreadsMutex);
diff --git a/Source/JavaScriptCore/heap/MachineStackMarker.h b/Source/JavaScriptCore/heap/MachineStackMarker.h
index 2209f97e9..5c7705fcf 100644
--- a/Source/JavaScriptCore/heap/MachineStackMarker.h
+++ b/Source/JavaScriptCore/heap/MachineStackMarker.h
@@ -22,14 +22,14 @@
 #ifndef MachineThreads_h
 #define MachineThreads_h
 
+#include <pthread.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/ThreadSpecific.h>
 #include <wtf/ThreadingPrimitives.h>
 
 namespace JSC {
 
-    class Heap;
     class ConservativeRoots;
+    class Heap;
 
     class MachineThreads {
         WTF_MAKE_NONCOPYABLE(MachineThreads);
@@ -55,7 +55,7 @@ namespace JSC {
         Heap* m_heap;
         Mutex m_registeredThreadsMutex;
         Thread* m_registeredThreads;
-        WTF::ThreadSpecificKey m_threadSpecific;
+        pthread_key_t m_threadSpecific;
     };
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/MarkStack.cpp b/Source/JavaScriptCore/heap/MarkStack.cpp
index 3eb02c4e8..9d9130026 100644
--- a/Source/JavaScriptCore/heap/MarkStack.cpp
+++ b/Source/JavaScriptCore/heap/MarkStack.cpp
@@ -38,6 +38,7 @@
 #include "Structure.h"
 #include "UString.h"
 #include "WriteBarrier.h"
+#include <wtf/Atomics.h>
 #include <wtf/DataLog.h>
 #include <wtf/MainThread.h>
 
@@ -65,7 +66,7 @@ MarkStackSegment* MarkStackSegmentAllocator::allocate()
         }
     }
 
-    return static_cast<MarkStackSegment*>(OSAllocator::reserveAndCommit(Options::gcMarkStackSegmentSize));
+    return static_cast<MarkStackSegment*>(OSAllocator::reserveAndCommit(Options::gcMarkStackSegmentSize()));
 }
 
 void MarkStackSegmentAllocator::release(MarkStackSegment* segment)
@@ -86,13 +87,13 @@ void MarkStackSegmentAllocator::shrinkReserve()
     while (segments) {
         MarkStackSegment* toFree = segments;
         segments = segments->m_previous;
-        OSAllocator::decommitAndRelease(toFree, Options::gcMarkStackSegmentSize);
+        OSAllocator::decommitAndRelease(toFree, Options::gcMarkStackSegmentSize());
     }
 }
 
 MarkStackArray::MarkStackArray(MarkStackSegmentAllocator& allocator)
     : m_allocator(allocator)
-    , m_segmentCapacity(MarkStackSegment::capacityFromSize(Options::gcMarkStackSegmentSize))
+    , m_segmentCapacity(MarkStackSegment::capacityFromSize(Options::gcMarkStackSegmentSize()))
     , m_top(0)
     , m_numberOfPreviousSegments(0)
 {
@@ -225,8 +226,8 @@ void MarkStackArray::stealSomeCellsFrom(MarkStackArray& other, size_t idleThread
 void MarkStackThreadSharedData::resetChildren()
 {
     for (unsigned i = 0; i < m_markingThreadsMarkStack.size(); ++i)
-       m_markingThreadsMarkStack[i]->reset();
-}   
+        m_markingThreadsMarkStack[i]->reset();
+}
 
 size_t MarkStackThreadSharedData::childVisitCount()
 {       
@@ -257,12 +258,13 @@ void MarkStackThreadSharedData::markingThreadStartFunc(void* myVisitor)
 MarkStackThreadSharedData::MarkStackThreadSharedData(JSGlobalData* globalData)
     : m_globalData(globalData)
     , m_copiedSpace(&globalData->heap.m_storageSpace)
+    , m_shouldHashConst(false)
     , m_sharedMarkStack(m_segmentAllocator)
     , m_numberOfActiveParallelMarkers(0)
     , m_parallelMarkersShouldExit(false)
 {
 #if ENABLE(PARALLEL_GC)
-    for (unsigned i = 1; i < Options::numberOfGCMarkers; ++i) {
+    for (unsigned i = 1; i < Options::numberOfGCMarkers(); ++i) {
         SlotVisitor* slotVisitor = new SlotVisitor(*this);
         m_markingThreadsMarkStack.append(slotVisitor);
         m_markingThreads.append(createThread(markingThreadStartFunc, slotVisitor, "JavaScriptCore::Marking"));
@@ -298,6 +300,21 @@ void MarkStackThreadSharedData::reset()
     ASSERT(m_opaqueRoots.isEmpty());
 #endif
     m_weakReferenceHarvesters.removeAll();
+
+    if (m_shouldHashConst) {
+        m_globalData->resetNewStringsSinceLastHashConst();
+        m_shouldHashConst = false;
+    }
+}
+
+void MarkStack::setup()
+{
+    m_shared.m_shouldHashConst = m_shared.m_globalData->haveEnoughNewStringsToHashConst();
+    m_shouldHashConst = m_shared.m_shouldHashConst;
+#if ENABLE(PARALLEL_GC)
+    for (unsigned i = 0; i < m_shared.m_markingThreadsMarkStack.size(); ++i)
+        m_shared.m_markingThreadsMarkStack[i]->m_shouldHashConst = m_shared.m_shouldHashConst;
+#endif
 }
 
 void MarkStack::reset()
@@ -309,6 +326,10 @@ void MarkStack::reset()
 #else
     m_opaqueRoots.clear();
 #endif
+    if (m_shouldHashConst) {
+        m_uniqueStrings.clear();
+        m_shouldHashConst = false;
+    }
 }
 
 void MarkStack::append(ConservativeRoots& conservativeRoots)
@@ -333,7 +354,7 @@ ALWAYS_INLINE static void visitChildren(SlotVisitor& visitor, const JSCell* cell
     }
 
     if (isJSFinalObject(cell)) {
-        JSObject::visitChildren(const_cast<JSCell*>(cell), visitor);
+        JSFinalObject::visitChildren(const_cast<JSCell*>(cell), visitor);
         return;
     }
 
@@ -368,7 +389,7 @@ void SlotVisitor::donateKnownParallel()
     // Otherwise, assume that a thread will go idle soon, and donate.
     m_stack.donateSomeCellsTo(m_shared.m_sharedMarkStack);
 
-    if (m_shared.m_numberOfActiveParallelMarkers < Options::numberOfGCMarkers)
+    if (m_shared.m_numberOfActiveParallelMarkers < Options::numberOfGCMarkers())
         m_shared.m_markingCondition.broadcast();
 }
 
@@ -377,10 +398,10 @@ void SlotVisitor::drain()
     ASSERT(m_isInParallelMode);
    
 #if ENABLE(PARALLEL_GC)
-    if (Options::numberOfGCMarkers > 1) {
+    if (Options::numberOfGCMarkers() > 1) {
         while (!m_stack.isEmpty()) {
             m_stack.refill();
-            for (unsigned countdown = Options::minimumNumberOfScansBetweenRebalance; m_stack.canRemoveLast() && countdown--;)
+            for (unsigned countdown = Options::minimumNumberOfScansBetweenRebalance(); m_stack.canRemoveLast() && countdown--;)
                 visitChildren(*this, m_stack.removeLast());
             donateKnownParallel();
         }
@@ -401,14 +422,14 @@ void SlotVisitor::drainFromShared(SharedDrainMode sharedDrainMode)
 {
     ASSERT(m_isInParallelMode);
     
-    ASSERT(Options::numberOfGCMarkers);
+    ASSERT(Options::numberOfGCMarkers());
     
     bool shouldBeParallel;
 
 #if ENABLE(PARALLEL_GC)
-    shouldBeParallel = Options::numberOfGCMarkers > 1;
+    shouldBeParallel = Options::numberOfGCMarkers() > 1;
 #else
-    ASSERT(Options::numberOfGCMarkers == 1);
+    ASSERT(Options::numberOfGCMarkers() == 1);
     shouldBeParallel = false;
 #endif
     
@@ -469,7 +490,7 @@ void SlotVisitor::drainFromShared(SharedDrainMode sharedDrainMode)
                 }
             }
            
-            size_t idleThreadCount = Options::numberOfGCMarkers - m_shared.m_numberOfActiveParallelMarkers;
+            size_t idleThreadCount = Options::numberOfGCMarkers() - m_shared.m_numberOfActiveParallelMarkers;
             m_stack.stealSomeCellsFrom(m_shared.m_sharedMarkStack, idleThreadCount);
             m_shared.m_numberOfActiveParallelMarkers++;
         }
@@ -521,6 +542,79 @@ void* SlotVisitor::allocateNewSpace(void* ptr, size_t bytes)
     return CopiedSpace::allocateFromBlock(m_copyBlock, bytes);
 }
 
+ALWAYS_INLINE bool JSString::tryHashConstLock()
+{
+#if ENABLE(PARALLEL_GC)
+    unsigned currentFlags = m_flags;
+
+    if (currentFlags & HashConstLock)
+        return false;
+
+    unsigned newFlags = currentFlags | HashConstLock;
+
+    if (!WTF::weakCompareAndSwap(&m_flags, currentFlags, newFlags))
+        return false;
+
+    WTF::memoryBarrierAfterLock();
+    return true;
+#else
+    if (isHashConstSingleton())
+        return false;
+
+    m_flags |= HashConstLock;
+
+    return true;
+#endif
+}
+
+ALWAYS_INLINE void JSString::releaseHashConstLock()
+{
+#if ENABLE(PARALLEL_GC)
+    WTF::memoryBarrierBeforeUnlock();
+#endif
+    m_flags &= ~HashConstLock;
+}
+
+ALWAYS_INLINE bool JSString::shouldTryHashConst()
+{
+    return ((length() > 1) && !isRope() && !isHashConstSingleton());
+}
+
+ALWAYS_INLINE void MarkStack::internalAppend(JSValue* slot)
+{
+    // This internalAppend is only intended for visits to object and array backing stores.
+    // as it can change the JSValue pointed to be the argument when the original JSValue
+    // is a string that contains the same contents as another string.
+
+    ASSERT(slot);
+    JSValue value = *slot;
+    ASSERT(value);
+    if (!value.isCell())
+        return;
+
+    JSCell* cell = value.asCell();
+
+    if (m_shouldHashConst && cell->isString()) {
+        JSString* string = jsCast<JSString*>(cell);
+        if (string->shouldTryHashConst() && string->tryHashConstLock()) {
+            UniqueStringMap::AddResult addResult = m_uniqueStrings.add(string->string().impl(), value);
+            if (addResult.isNewEntry)
+                string->setHashConstSingleton();
+            else {
+                JSValue existingJSValue = addResult.iterator->second;
+                if (value != existingJSValue)
+                    jsCast<JSString*>(existingJSValue.asCell())->clearHashConstSingleton();
+                *slot = existingJSValue;
+                string->releaseHashConstLock();
+                return;
+            }
+            string->releaseHashConstLock();
+        }
+    }
+
+    internalAppend(cell);
+}
+
 void SlotVisitor::copyAndAppend(void** ptr, size_t bytes, JSValue* values, unsigned length)
 {
     void* oldPtr = *ptr;
@@ -534,7 +628,7 @@ void SlotVisitor::copyAndAppend(void** ptr, size_t bytes, JSValue* values, unsig
             newValues[i] = value;
             if (!value)
                 continue;
-            internalAppend(value);
+            internalAppend(&newValues[i]);
         }
 
         memcpy(newPtr, oldPtr, jsValuesOffset);
diff --git a/Source/JavaScriptCore/heap/MarkStack.h b/Source/JavaScriptCore/heap/MarkStack.h
index c3065e7d6..ff25531a4 100644
--- a/Source/JavaScriptCore/heap/MarkStack.h
+++ b/Source/JavaScriptCore/heap/MarkStack.h
@@ -219,6 +219,8 @@ namespace JSC {
         
         MarkStackSegmentAllocator m_segmentAllocator;
         
+        bool m_shouldHashConst;
+
         Vector<ThreadIdentifier> m_markingThreads;
         Vector<MarkStack*> m_markingThreadsMarkStack;
         
@@ -259,6 +261,7 @@ namespace JSC {
         MarkStackThreadSharedData& sharedData() { return m_shared; }
         bool isEmpty() { return m_stack.isEmpty(); }
 
+        void setup();
         void reset();
 
         size_t visitCount() const { return m_visitCount; }
@@ -292,6 +295,7 @@ namespace JSC {
 
         void internalAppend(JSCell*);
         void internalAppend(JSValue);
+        void internalAppend(JSValue*);
         
         JS_EXPORT_PRIVATE void mergeOpaqueRoots();
         
@@ -304,7 +308,7 @@ namespace JSC {
         
         void mergeOpaqueRootsIfProfitable()
         {
-            if (static_cast<unsigned>(m_opaqueRoots.size()) < Options::opaqueRootMergeThreshold)
+            if (static_cast<unsigned>(m_opaqueRoots.size()) < Options::opaqueRootMergeThreshold())
                 return;
             mergeOpaqueRoots();
         }
@@ -325,6 +329,10 @@ namespace JSC {
         
         MarkStackThreadSharedData& m_shared;
 
+        bool m_shouldHashConst; // Local per-thread copy of shared flag for performance reasons
+        typedef HashMap<StringImpl*, JSValue> UniqueStringMap;
+        UniqueStringMap m_uniqueStrings;
+
 #if ENABLE(OBJECT_MARK_LOGGING)
         unsigned m_logChildCount;
 #endif
@@ -339,6 +347,7 @@ namespace JSC {
         , m_visitCount(0)
         , m_isInParallelMode(false)
         , m_shared(shared)
+        , m_shouldHashConst(false)
     {
     }
 
@@ -350,7 +359,7 @@ namespace JSC {
     inline void MarkStack::addOpaqueRoot(void* root)
     {
 #if ENABLE(PARALLEL_GC)
-        if (Options::numberOfGCMarkers == 1) {
+        if (Options::numberOfGCMarkers() == 1) {
             // Put directly into the shared HashSet.
             m_shared.m_opaqueRoots.add(root);
             return;
diff --git a/Source/JavaScriptCore/heap/MarkedAllocator.cpp b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
index 9cac906a1..972728637 100644
--- a/Source/JavaScriptCore/heap/MarkedAllocator.cpp
+++ b/Source/JavaScriptCore/heap/MarkedAllocator.cpp
@@ -3,6 +3,7 @@
 
 #include "GCActivityCallback.h"
 #include "Heap.h"
+#include "JSGlobalData.h"
 #include <wtf/CurrentTime.h>
 
 namespace JSC {
@@ -56,6 +57,7 @@ inline void* MarkedAllocator::tryAllocate()
     
 void* MarkedAllocator::allocateSlowCase()
 {
+    ASSERT(m_heap->globalData()->apiLock().currentThreadIsHoldingLock());
 #if COLLECT_ON_EVERY_ALLOCATION
     m_heap->collectAllGarbage();
     ASSERT(m_heap->m_operationInProgress == NoOperation);
diff --git a/Source/JavaScriptCore/heap/SlotVisitor.h b/Source/JavaScriptCore/heap/SlotVisitor.h
index 715e2008c..70d68bb04 100644
--- a/Source/JavaScriptCore/heap/SlotVisitor.h
+++ b/Source/JavaScriptCore/heap/SlotVisitor.h
@@ -41,7 +41,7 @@ public:
     void donate()
     {
         ASSERT(m_isInParallelMode);
-        if (Options::numberOfGCMarkers == 1)
+        if (Options::numberOfGCMarkers() == 1)
             return;
         
         donateKnownParallel();
diff --git a/Source/JavaScriptCore/heap/WeakBlock.cpp b/Source/JavaScriptCore/heap/WeakBlock.cpp
index 8900e73df..05a44ea7e 100644
--- a/Source/JavaScriptCore/heap/WeakBlock.cpp
+++ b/Source/JavaScriptCore/heap/WeakBlock.cpp
@@ -127,8 +127,10 @@ void WeakBlock::reap()
         if (weakImpl->state() > WeakImpl::Dead)
             continue;
 
-        if (Heap::isMarked(weakImpl->jsValue().asCell()))
+        if (Heap::isMarked(weakImpl->jsValue().asCell())) {
+            ASSERT(weakImpl->state() == WeakImpl::Live);
             continue;
+        }
 
         weakImpl->setState(WeakImpl::Dead);
     }
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.cpp b/Source/JavaScriptCore/interpreter/Interpreter.cpp
index b8610e7bf..b6072a5d6 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/Source/JavaScriptCore/interpreter/Interpreter.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1822,7 +1822,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         ASSERT(slot.slotBase().isObject());
 
         JSObject* baseObject = asObject(slot.slotBase());
-        size_t offset = slot.cachedOffset();
+        PropertyOffset offset = slot.cachedOffset();
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
@@ -1851,7 +1851,7 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    size_t offset = slot.cachedOffset();
+    PropertyOffset offset = slot.cachedOffset();
     size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         vPC[0] = getOpcode(op_get_by_id_generic);
@@ -3045,6 +3045,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_resolve_with_this);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_get_by_id_out_of_line)
     DEFINE_OPCODE(op_get_by_id) {
         /* get_by_id dst(r) base(r) property(id) structure(sID) nop(n) nop(n) nop(n)
 
@@ -3527,6 +3528,7 @@ skip_id_custom_self:
     skip_get_string_length:
     goto *(&&skip_put_by_id);
 #endif
+    DEFINE_OPCODE(op_put_by_id_out_of_line)
     DEFINE_OPCODE(op_put_by_id) {
         /* put_by_id base(r) property(id) value(r) nop(n) nop(n) nop(n) nop(n) direct(b)
 
@@ -3565,6 +3567,8 @@ skip_id_custom_self:
 #endif
     DEFINE_OPCODE(op_put_by_id_transition_direct)
     DEFINE_OPCODE(op_put_by_id_transition_normal)
+    DEFINE_OPCODE(op_put_by_id_transition_direct_out_of_line)
+    DEFINE_OPCODE(op_put_by_id_transition_normal_out_of_line)
     DEFINE_OPCODE(op_put_by_id_transition) {
         /* op_put_by_id_transition base(r) property(id) value(r) oldStructure(sID) newStructure(sID) structureChain(chain) offset(n) direct(b)
          
@@ -3602,10 +3606,10 @@ skip_id_custom_self:
                         proto = asObject(proto)->structure()->prototypeForLookup(callFrame);
                     }
                 }
-                baseObject->transitionTo(*globalData, newStructure);
+                baseObject->setStructureAndReallocateStorageIfNecessary(*globalData, newStructure);
 
                 int value = vPC[3].u.operand;
-                unsigned offset = vPC[7].u.operand;
+                int offset = vPC[7].u.operand;
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(*globalData, codeBlock->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
 
@@ -3639,7 +3643,7 @@ skip_id_custom_self:
                 ASSERT(baseCell->isObject());
                 JSObject* baseObject = asObject(baseCell);
                 int value = vPC[3].u.operand;
-                unsigned offset = vPC[5].u.operand;
+                int offset = vPC[5].u.operand;
                 
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(*globalData, codeBlock->identifier(vPC[2].u.operand))) == offset);
                 baseObject->putDirectOffset(callFrame->globalData(), offset, callFrame->r(value).jsValue());
@@ -3717,7 +3721,7 @@ skip_id_custom_self:
         JSValue expectedSubscript = callFrame->r(expected).jsValue();
         int index = callFrame->r(i).i() - 1;
         JSValue result;
-        int offset = 0;
+        PropertyOffset offset = 0;
         if (subscript == expectedSubscript && baseValue.isCell() && (baseValue.asCell()->structure() == it->cachedStructure()) && it->getOffset(index, offset)) {
             callFrame->uncheckedR(dst) = JSValue(asObject(baseValue)->getDirectOffset(offset));
             vPC += OPCODE_LENGTH(op_get_by_pname);
diff --git a/Source/JavaScriptCore/interpreter/Interpreter.h b/Source/JavaScriptCore/interpreter/Interpreter.h
index adb23f237..ba2f4fac4 100644
--- a/Source/JavaScriptCore/interpreter/Interpreter.h
+++ b/Source/JavaScriptCore/interpreter/Interpreter.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,6 +40,7 @@
 #include "RegisterFile.h"
 
 #include <wtf/HashMap.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace JSC {
 
@@ -80,45 +82,63 @@ namespace JSC {
         UString sourceURL;
         UString toString(CallFrame* callFrame) const
         {
-            bool hasSourceURLInfo = !sourceURL.isNull() && !sourceURL.isEmpty();
-            bool hasLineInfo = line > -1;
+            StringBuilder traceBuild;
+            String functionName = friendlyFunctionName(callFrame);
+            String sourceURL = friendlySourceURL();
+            traceBuild.append(functionName);
+            if (!sourceURL.isEmpty()) {
+                if (!functionName.isEmpty())
+                    traceBuild.append('@');
+                traceBuild.append(sourceURL);
+                if (line > -1) {
+                    traceBuild.append(':');
+                    traceBuild.append(String::number(line));
+                }
+            }
+            return traceBuild.toString().impl();
+        }
+        String friendlySourceURL() const
+        {
             String traceLine;
-            JSObject* stackFrameCallee = callee.get();
 
             switch (codeType) {
             case StackFrameEvalCode:
-                if (hasSourceURLInfo) {
-                    traceLine = hasLineInfo ? String::format("eval code@%s:%d", sourceURL.ascii().data(), line) 
-                                            : String::format("eval code@%s", sourceURL.ascii().data());
-                } else
-                    traceLine = String::format("eval code");
+            case StackFrameFunctionCode:
+            case StackFrameGlobalCode:
+                if (!sourceURL.isEmpty())
+                    traceLine = sourceURL.impl();
                 break;
-            case StackFrameNativeCode: {
-                if (callee) {
-                    UString functionName = getCalculatedDisplayName(callFrame, stackFrameCallee);
-                    traceLine = String::format("%s@[native code]", functionName.ascii().data());
-                } else
-                    traceLine = "[native code]";
+            case StackFrameNativeCode:
+                traceLine = "[native code]";
                 break;
             }
-            case StackFrameFunctionCode: {
-                UString functionName = getCalculatedDisplayName(callFrame, stackFrameCallee);
-                if (hasSourceURLInfo) {
-                    traceLine = hasLineInfo ? String::format("%s@%s:%d", functionName.ascii().data(), sourceURL.ascii().data(), line)
-                                            : String::format("%s@%s", functionName.ascii().data(), sourceURL.ascii().data());
-                } else
-                    traceLine = String::format("%s\n", functionName.ascii().data());
+            return traceLine.isNull() ? emptyString() : traceLine;
+        }
+        String friendlyFunctionName(CallFrame* callFrame) const
+        {
+            String traceLine;
+            JSObject* stackFrameCallee = callee.get();
+
+            switch (codeType) {
+            case StackFrameEvalCode:
+                traceLine = "eval code";
+                break;
+            case StackFrameNativeCode:
+                if (callee)
+                    traceLine = getCalculatedDisplayName(callFrame, stackFrameCallee).impl();
+                break;
+            case StackFrameFunctionCode:
+                traceLine = getCalculatedDisplayName(callFrame, stackFrameCallee).impl();
                 break;
-            }
             case StackFrameGlobalCode:
-                if (hasSourceURLInfo) {
-                    traceLine = hasLineInfo ? String::format("global code@%s:%d", sourceURL.ascii().data(), line)
-                                            : String::format("global code@%s", sourceURL.ascii().data());
-                } else
-                    traceLine = String::format("global code");
-                    
+                traceLine = "global code";
+                break;
             }
-            return traceLine.impl();
+            return traceLine.isNull() ? emptyString() : traceLine;
+        }
+        unsigned friendlyLineNumber() const
+        {
+            return line > -1 ? line : 0;
         }
     };
 
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.cpp b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
index b72352781..dacb53872 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -73,9 +73,9 @@ void RegisterFile::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
     conservativeRoots.add(begin(), end());
 }
 
-void RegisterFile::gatherConservativeRoots(ConservativeRoots& conservativeRoots, DFGCodeBlocks& dfgCodeBlocks)
+void RegisterFile::gatherConservativeRoots(ConservativeRoots& conservativeRoots, JITStubRoutineSet& jitStubRoutines, DFGCodeBlocks& dfgCodeBlocks)
 {
-    conservativeRoots.add(begin(), end(), dfgCodeBlocks);
+    conservativeRoots.add(begin(), end(), jitStubRoutines, dfgCodeBlocks);
 }
 
 void RegisterFile::releaseExcessCapacity()
diff --git a/Source/JavaScriptCore/interpreter/RegisterFile.h b/Source/JavaScriptCore/interpreter/RegisterFile.h
index 21ad7fbae..8fff8208c 100644
--- a/Source/JavaScriptCore/interpreter/RegisterFile.h
+++ b/Source/JavaScriptCore/interpreter/RegisterFile.h
@@ -39,6 +39,7 @@ namespace JSC {
 
     class ConservativeRoots;
     class DFGCodeBlocks;
+    class JITStubRoutineSet;
     class LLIntOffsetsExtractor;
 
     class RegisterFile {
@@ -64,7 +65,7 @@ namespace JSC {
         ~RegisterFile();
         
         void gatherConservativeRoots(ConservativeRoots&);
-        void gatherConservativeRoots(ConservativeRoots&, DFGCodeBlocks&);
+        void gatherConservativeRoots(ConservativeRoots&, JITStubRoutineSet&, DFGCodeBlocks&);
 
         Register* begin() const { return static_cast<Register*>(m_reservation.base()); }
         Register* end() const { return m_end; }
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
index 79399196e..e9bb66ce7 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.cpp
@@ -55,7 +55,7 @@ namespace JSC {
 class DemandExecutableAllocator : public MetaAllocator {
 public:
     DemandExecutableAllocator()
-        : MetaAllocator(32) // round up all allocations to 32 bytes
+        : MetaAllocator(jitAllocationGranule)
     {
         MutexLocker lock(allocatorsMutex());
         allocators().add(this);
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocator.h b/Source/JavaScriptCore/jit/ExecutableAllocator.h
index 8cd5cba07..85779e6a8 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/Source/JavaScriptCore/jit/ExecutableAllocator.h
@@ -77,6 +77,8 @@ namespace JSC {
 class JSGlobalData;
 void releaseExecutableMemory(JSGlobalData&);
 
+static const unsigned jitAllocationGranule = 32;
+
 inline size_t roundUpAllocationSize(size_t request, size_t granularity)
 {
     if ((std::numeric_limits<size_t>::max() - granularity) <= request)
@@ -101,6 +103,18 @@ typedef WTF::MetaAllocatorHandle ExecutableMemoryHandle;
 class DemandExecutableAllocator;
 #endif
 
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+#if CPU(ARM)
+static const size_t fixedExecutableMemoryPoolSize = 16 * 1024 * 1024;
+#elif CPU(X86_64)
+static const size_t fixedExecutableMemoryPoolSize = 1024 * 1024 * 1024;
+#else
+static const size_t fixedExecutableMemoryPoolSize = 32 * 1024 * 1024;
+#endif
+
+extern uintptr_t startOfFixedExecutableMemoryPool;
+#endif
+
 class ExecutableAllocator {
     enum ProtectionSetting { Writable, Executable };
 
diff --git a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
index 2e08f1205..ad3343d11 100644
--- a/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
+++ b/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -45,27 +45,23 @@ using namespace WTF;
 
 namespace JSC {
     
-#if CPU(ARM)
-static const size_t fixedPoolSize = 16 * 1024 * 1024;
-#elif CPU(X86_64)
-static const size_t fixedPoolSize = 1024 * 1024 * 1024;
-#else
-static const size_t fixedPoolSize = 32 * 1024 * 1024;
-#endif
+uintptr_t startOfFixedExecutableMemoryPool;
 
 class FixedVMPoolExecutableAllocator : public MetaAllocator {
 public:
     FixedVMPoolExecutableAllocator()
-        : MetaAllocator(32) // round up all allocations to 32 bytes
+        : MetaAllocator(jitAllocationGranule) // round up all allocations to 32 bytes
     {
-        m_reservation = PageReservation::reserveWithGuardPages(fixedPoolSize, OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
+        m_reservation = PageReservation::reserveWithGuardPages(fixedExecutableMemoryPoolSize, OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
 #if !(ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
         if (!m_reservation)
             CRASH();
 #endif
         if (m_reservation) {
-            ASSERT(m_reservation.size() == fixedPoolSize);
+            ASSERT(m_reservation.size() == fixedExecutableMemoryPoolSize);
             addFreshFreeSpace(m_reservation.base(), m_reservation.size());
+            
+            startOfFixedExecutableMemoryPool = reinterpret_cast<uintptr_t>(m_reservation.base());
         }
     }
     
diff --git a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
new file mode 100644
index 000000000..7ea61178c
--- /dev/null
+++ b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "GCAwareJITStubRoutine.h"
+
+#if ENABLE(JIT)
+
+#include "Heap.h"
+#include "JSGlobalData.h"
+#include "ScopeChain.h"
+#include "SlotVisitor.h"
+#include "Structure.h"
+
+namespace JSC {
+
+GCAwareJITStubRoutine::GCAwareJITStubRoutine(
+    const MacroAssemblerCodeRef& code, JSGlobalData& globalData)
+    : JITStubRoutine(code)
+    , m_mayBeExecuting(false)
+    , m_isJettisoned(false)
+{
+    globalData.heap.m_jitStubRoutines.add(this);
+}
+    
+GCAwareJITStubRoutine::~GCAwareJITStubRoutine() { }
+
+void GCAwareJITStubRoutine::observeZeroRefCount()
+{
+    if (m_isJettisoned) {
+        // This case is needed for when the system shuts down. It may be that
+        // the JIT stub routine set gets deleted before we get around to deleting
+        // this guy. In that case the GC informs us that we're jettisoned already
+        // and that we should delete ourselves as soon as the ref count reaches
+        // zero.
+        delete this;
+        return;
+    }
+    
+    ASSERT(!m_refCount);
+
+    m_isJettisoned = true;
+}
+
+void GCAwareJITStubRoutine::deleteFromGC()
+{
+    ASSERT(m_isJettisoned);
+    ASSERT(!m_refCount);
+    ASSERT(!m_mayBeExecuting);
+    
+    delete this;
+}
+
+void GCAwareJITStubRoutine::markRequiredObjectsInternal(SlotVisitor&)
+{
+}
+
+MarkingGCAwareJITStubRoutineWithOneObject::MarkingGCAwareJITStubRoutineWithOneObject(
+    const MacroAssemblerCodeRef& code, JSGlobalData& globalData, const JSCell* owner,
+    JSCell* object)
+    : GCAwareJITStubRoutine(code, globalData)
+    , m_object(globalData, owner, object)
+{
+}
+
+MarkingGCAwareJITStubRoutineWithOneObject::~MarkingGCAwareJITStubRoutineWithOneObject()
+{
+}
+
+void MarkingGCAwareJITStubRoutineWithOneObject::markRequiredObjectsInternal(SlotVisitor& visitor)
+{
+    visitor.append(&m_object);
+}
+
+PassRefPtr<JITStubRoutine> createJITStubRoutine(
+    const MacroAssemblerCodeRef& code,
+    JSGlobalData& globalData,
+    const JSCell*,
+    bool makesCalls)
+{
+    if (!makesCalls)
+        return adoptRef(new JITStubRoutine(code));
+
+    return static_pointer_cast<JITStubRoutine>(
+        adoptRef(new GCAwareJITStubRoutine(code, globalData)));
+}
+
+PassRefPtr<JITStubRoutine> createJITStubRoutine(
+    const MacroAssemblerCodeRef& code,
+    JSGlobalData& globalData,
+    const JSCell* owner,
+    bool makesCalls,
+    JSCell* object)
+{
+    if (!makesCalls)
+        return adoptRef(new JITStubRoutine(code));
+    
+    return static_pointer_cast<JITStubRoutine>(
+        adoptRef(new MarkingGCAwareJITStubRoutineWithOneObject(code, globalData, owner, object)));
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h
new file mode 100644
index 000000000..59bc76beb
--- /dev/null
+++ b/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GCAwareJITStubRoutine_h
+#define GCAwareJITStubRoutine_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+#include "JITStubRoutine.h"
+#include "JSObject.h"
+#include "JSString.h"
+#include "WriteBarrier.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JITStubRoutineSet;
+
+// Use this stub routine if you know that your code might be on stack when
+// either GC or other kinds of stub deletion happen. Basicaly, if your stub
+// routine makes calls (either to JS code or to C++ code) then you should
+// assume that it's possible for that JS or C++ code to do something that
+// causes the system to try to delete your routine. Using this routine type
+// ensures that the actual deletion is delayed until the GC proves that the
+// routine is no longer running. You can also subclass this routine if you
+// want to mark additional objects during GC in those cases where the
+// routine is known to be executing, or if you want to force this routine to
+// keep other routines alive (for example due to the use of a slow-path
+// list which does not get reclaimed all at once).
+class GCAwareJITStubRoutine : public JITStubRoutine {
+public:
+    GCAwareJITStubRoutine(const MacroAssemblerCodeRef&, JSGlobalData&);
+    virtual ~GCAwareJITStubRoutine();
+    
+    void markRequiredObjects(SlotVisitor& visitor)
+    {
+        markRequiredObjectsInternal(visitor);
+    }
+    
+    void deleteFromGC();
+    
+protected:
+    virtual void observeZeroRefCount();
+    
+    virtual void markRequiredObjectsInternal(SlotVisitor&);
+
+private:
+    friend class JITStubRoutineSet;
+
+    bool m_mayBeExecuting;
+    bool m_isJettisoned;
+};
+
+// Use this if you want to mark one additional object during GC if your stub
+// routine is known to be executing.
+class MarkingGCAwareJITStubRoutineWithOneObject : public GCAwareJITStubRoutine {
+public:
+    MarkingGCAwareJITStubRoutineWithOneObject(
+        const MacroAssemblerCodeRef&, JSGlobalData&, const JSCell* owner, JSCell*);
+    virtual ~MarkingGCAwareJITStubRoutineWithOneObject();
+    
+protected:
+    virtual void markRequiredObjectsInternal(SlotVisitor&);
+
+private:
+    WriteBarrier<JSCell> m_object;
+};
+
+// Helper for easily creating a GC-aware JIT stub routine. For the varargs,
+// pass zero or more JSCell*'s. This will either create a JITStubRoutine, a
+// GCAwareJITStubRoutine, or an ObjectMarkingGCAwareJITStubRoutine as
+// appropriate. Generally you only need to pass pointers that will be used
+// after the first call to C++ or JS.
+// 
+// PassRefPtr<JITStubRoutine> createJITStubRoutine(
+//    const MacroAssemblerCodeRef& code,
+//    JSGlobalData& globalData,
+//    const JSCell* owner,
+//    bool makesCalls,
+//    ...);
+//
+// Note that we don't actually use C-style varargs because that leads to
+// strange type-related problems. For example it would preclude us from using
+// our custom of passing '0' as NULL pointer. Besides, when I did try to write
+// this function using varargs, I ended up with more code than this simple
+// way.
+
+PassRefPtr<JITStubRoutine> createJITStubRoutine(
+    const MacroAssemblerCodeRef&, JSGlobalData&, const JSCell* owner, bool makesCalls);
+PassRefPtr<JITStubRoutine> createJITStubRoutine(
+    const MacroAssemblerCodeRef&, JSGlobalData&, const JSCell* owner, bool makesCalls,
+    JSCell*);
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // GCAwareJITStubRoutine_h
+
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index e1e034b19..285355f1b 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -99,7 +99,7 @@ void JIT::emitOptimizationCheck(OptimizationCheckKind kind)
     if (!canBeOptimized())
         return;
     
-    Jump skipOptimize = branchAdd32(Signed, TrustedImm32(kind == LoopOptimizationCheck ? Options::executionCounterIncrementForLoop : Options::executionCounterIncrementForReturn), AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter()));
+    Jump skipOptimize = branchAdd32(Signed, TrustedImm32(kind == LoopOptimizationCheck ? Options::executionCounterIncrementForLoop() : Options::executionCounterIncrementForReturn()), AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter()));
     JITStubCall stubCall(this, cti_optimize);
     stubCall.addArgument(TrustedImm32(m_bytecodeOffset));
     if (kind == EnterOptimizationCheck)
@@ -255,6 +255,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_create_activation)
         DEFINE_OP(op_eq)
         DEFINE_OP(op_eq_null)
+        case op_get_by_id_out_of_line:
         DEFINE_OP(op_get_by_id)
         DEFINE_OP(op_get_arguments_length)
         DEFINE_OP(op_get_by_val)
@@ -319,8 +320,11 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_profile_will_call)
         DEFINE_OP(op_push_new_scope)
         DEFINE_OP(op_push_scope)
+        case op_put_by_id_out_of_line:
         case op_put_by_id_transition_direct:
         case op_put_by_id_transition_normal:
+        case op_put_by_id_transition_direct_out_of_line:
+        case op_put_by_id_transition_normal_out_of_line:
         DEFINE_OP(op_put_by_id)
         DEFINE_OP(op_put_by_index)
         DEFINE_OP(op_put_by_val)
@@ -441,6 +445,7 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_create_this)
         DEFINE_SLOWCASE_OP(op_div)
         DEFINE_SLOWCASE_OP(op_eq)
+        case op_get_by_id_out_of_line:
         DEFINE_SLOWCASE_OP(op_get_by_id)
         DEFINE_SLOWCASE_OP(op_get_arguments_length)
         DEFINE_SLOWCASE_OP(op_get_by_val)
@@ -472,16 +477,17 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_neq)
         DEFINE_SLOWCASE_OP(op_new_array)
         DEFINE_SLOWCASE_OP(op_new_object)
-        DEFINE_SLOWCASE_OP(op_new_func)
-        DEFINE_SLOWCASE_OP(op_new_func_exp)
         DEFINE_SLOWCASE_OP(op_not)
         DEFINE_SLOWCASE_OP(op_nstricteq)
         DEFINE_SLOWCASE_OP(op_post_dec)
         DEFINE_SLOWCASE_OP(op_post_inc)
         DEFINE_SLOWCASE_OP(op_pre_dec)
         DEFINE_SLOWCASE_OP(op_pre_inc)
+        case op_put_by_id_out_of_line:
         case op_put_by_id_transition_direct:
         case op_put_by_id_transition_normal:
+        case op_put_by_id_transition_direct_out_of_line:
+        case op_put_by_id_transition_normal_out_of_line:
         DEFINE_SLOWCASE_OP(op_put_by_id)
         DEFINE_SLOWCASE_OP(op_put_by_val)
         DEFINE_SLOWCASE_OP(op_put_global_var_check);
@@ -539,6 +545,7 @@ ALWAYS_INLINE void PropertyStubCompilationInfo::copyToStubInfo(StructureStubInfo
         CodeLocationLabel hotPathBeginLocation = linkBuffer.locationOf(hotPathBegin);
         info.patch.baseline.u.get.structureToCompare = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(getStructureToCompare));
         info.patch.baseline.u.get.structureCheck = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(getStructureCheck));
+        info.patch.baseline.u.get.propertyStorageLoad = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(propertyStorageLoad));
 #if USE(JSVALUE64)
         info.patch.baseline.u.get.displacementLabel = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(getDisplacementLabel));
 #else
@@ -552,6 +559,7 @@ ALWAYS_INLINE void PropertyStubCompilationInfo::copyToStubInfo(StructureStubInfo
     case PutById:
         CodeLocationLabel hotPathBeginLocation = linkBuffer.locationOf(hotPathBegin);
         info.patch.baseline.u.put.structureToCompare = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(putStructureToCompare));
+        info.patch.baseline.u.put.propertyStorageLoad = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(propertyStorageLoad));
 #if USE(JSVALUE64)
         info.patch.baseline.u.put.displacementLabel = MacroAssembler::differenceBetweenCodePtr(hotPathBeginLocation, linkBuffer.locationOf(putDisplacementLabel));
 #else
@@ -763,7 +771,9 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck, JITCompilationEffo
         *functionEntryArityCheck = patchBuffer.locationOf(arityCheck);
     
     CodeRef result = FINALIZE_CODE(
-        patchBuffer, ("Baseline JIT code for CodeBlock %p", m_codeBlock));
+        patchBuffer,
+        ("Baseline JIT code for CodeBlock %p, instruction count = %u",
+         m_codeBlock, m_codeBlock->instructionCount()));
     
     m_globalData->machineCodeBytesPerBytecodeWordForBaselineJIT.add(
         static_cast<double>(result.size()) /
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index 6d4c578c0..987c4a163 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -157,6 +157,7 @@ namespace JSC {
         MacroAssembler::Label hotPathBegin;
         MacroAssembler::DataLabelPtr getStructureToCompare;
         MacroAssembler::PatchableJump getStructureCheck;
+        MacroAssembler::ConvertibleLoadLabel propertyStorageLoad;
 #if USE(JSVALUE64)
         MacroAssembler::DataLabelCompact getDisplacementLabel;
 #else
@@ -185,17 +186,24 @@ namespace JSC {
 #endif
 
 
-        PropertyStubCompilationInfo(PropertyStubGetById_T, unsigned bytecodeIndex, MacroAssembler::Label hotPathBegin,
+        PropertyStubCompilationInfo(
+            PropertyStubGetById_T, unsigned bytecodeIndex, MacroAssembler::Label hotPathBegin,
+            MacroAssembler::DataLabelPtr structureToCompare,
+            MacroAssembler::PatchableJump structureCheck,
+            MacroAssembler::ConvertibleLoadLabel propertyStorageLoad,
 #if USE(JSVALUE64)
-            MacroAssembler::DataLabelPtr structureToCompare, MacroAssembler::PatchableJump structureCheck, MacroAssembler::DataLabelCompact displacementLabel, MacroAssembler::Label putResult)
+            MacroAssembler::DataLabelCompact displacementLabel,
 #else
-            MacroAssembler::DataLabelPtr structureToCompare, MacroAssembler::PatchableJump structureCheck, MacroAssembler::DataLabelCompact displacementLabel1, MacroAssembler::DataLabelCompact displacementLabel2, MacroAssembler::Label putResult)
+            MacroAssembler::DataLabelCompact displacementLabel1,
+            MacroAssembler::DataLabelCompact displacementLabel2,
 #endif
+            MacroAssembler::Label putResult)
             : m_type(GetById)
             , bytecodeIndex(bytecodeIndex)
             , hotPathBegin(hotPathBegin)
             , getStructureToCompare(structureToCompare)
             , getStructureCheck(structureCheck)
+            , propertyStorageLoad(propertyStorageLoad)
 #if USE(JSVALUE64)
             , getDisplacementLabel(displacementLabel)
 #else
@@ -206,15 +214,21 @@ namespace JSC {
         {
         }
 
-        PropertyStubCompilationInfo(PropertyStubPutById_T, unsigned bytecodeIndex, MacroAssembler::Label hotPathBegin,
+        PropertyStubCompilationInfo(
+            PropertyStubPutById_T, unsigned bytecodeIndex, MacroAssembler::Label hotPathBegin,
+            MacroAssembler::DataLabelPtr structureToCompare,
+            MacroAssembler::ConvertibleLoadLabel propertyStorageLoad,
 #if USE(JSVALUE64)
-            MacroAssembler::DataLabelPtr structureToCompare, MacroAssembler::DataLabel32 displacementLabel)
+            MacroAssembler::DataLabel32 displacementLabel
 #else
-            MacroAssembler::DataLabelPtr structureToCompare, MacroAssembler::DataLabel32 displacementLabel1, MacroAssembler::DataLabel32 displacementLabel2)
+            MacroAssembler::DataLabel32 displacementLabel1,
+            MacroAssembler::DataLabel32 displacementLabel2
 #endif
+            )
             : m_type(PutById)
             , bytecodeIndex(bytecodeIndex)
             , hotPathBegin(hotPathBegin)
+            , propertyStorageLoad(propertyStorageLoad)
             , putStructureToCompare(structureToCompare)
 #if USE(JSVALUE64)
             , putDisplacementLabel(displacementLabel)
@@ -295,40 +309,40 @@ namespace JSC {
             return JIT(globalData, codeBlock).privateCompile(functionEntryArityCheck, effort);
         }
 
-        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.m_bytecodeOffset = stubInfo->bytecodeIndex;
             jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, ident, slot, cachedOffset, returnAddress, callFrame);
         }
 
-        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+        static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset)
         {
             JIT jit(globalData, codeBlock);
             jit.m_bytecodeOffset = stubInfo->bytecodeIndex;
             jit.privateCompileGetByIdSelfList(stubInfo, polymorphicStructures, currentIndex, structure, ident, slot, cachedOffset);
         }
-        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+        static void compileGetByIdProtoList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset)
         {
             JIT jit(globalData, codeBlock);
             jit.m_bytecodeOffset = stubInfo->bytecodeIndex;
             jit.privateCompileGetByIdProtoList(stubInfo, prototypeStructureList, currentIndex, structure, prototypeStructure, ident, slot, cachedOffset, callFrame);
         }
-        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+        static void compileGetByIdChainList(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructureList, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset)
         {
             JIT jit(globalData, codeBlock);
             jit.m_bytecodeOffset = stubInfo->bytecodeIndex;
             jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, ident, slot, cachedOffset, callFrame);
         }
 
-        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress)
+        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.m_bytecodeOffset = stubInfo->bytecodeIndex;
             jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, ident, slot, cachedOffset, returnAddress, callFrame);
         }
         
-        static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
+        static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, PropertyOffset cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
         {
             JIT jit(globalData, codeBlock);
             jit.m_bytecodeOffset = stubInfo->bytecodeIndex;
@@ -358,9 +372,9 @@ namespace JSC {
 
         static void resetPatchGetById(RepatchBuffer&, StructureStubInfo*);
         static void resetPatchPutById(RepatchBuffer&, StructureStubInfo*);
-        static void patchGetByIdSelf(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
-        static void patchPutByIdReplace(CodeBlock* codeblock, StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress, bool direct);
-        static void patchMethodCallProto(JSGlobalData&, CodeBlock* codeblock, MethodCallLinkInfo&, StructureStubInfo&, JSObject*, Structure*, JSObject*, ReturnAddressPtr);
+        static void patchGetByIdSelf(CodeBlock*, StructureStubInfo*, Structure*, PropertyOffset cachedOffset, ReturnAddressPtr);
+        static void patchPutByIdReplace(CodeBlock*, StructureStubInfo*, Structure*, PropertyOffset cachedOffset, ReturnAddressPtr, bool direct);
+        static void patchMethodCallProto(JSGlobalData&, CodeBlock*, MethodCallLinkInfo&, StructureStubInfo&, JSObject*, Structure*, JSObject*, ReturnAddressPtr);
 
         static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
@@ -377,12 +391,12 @@ namespace JSC {
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         JITCode privateCompile(CodePtr* functionEntryArityCheck, JITCompilationEffort);
-        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
-        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, const Identifier&, const PropertySlot&, size_t cachedOffset);
-        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, CallFrame* callFrame);
-        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, const Identifier&, const PropertySlot&, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
-        void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ReturnAddressPtr returnAddress, bool direct);
+        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset, ReturnAddressPtr, CallFrame*);
+        void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset);
+        void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset, CallFrame*);
+        void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain*, size_t count, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset, CallFrame*);
+        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, const Identifier&, const PropertySlot&, PropertyOffset cachedOffset, ReturnAddressPtr, CallFrame*);
+        void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, PropertyOffset cachedOffset, StructureChain*, ReturnAddressPtr, bool direct);
 
         PassRefPtr<ExecutableMemoryHandle> privateCompileCTIMachineTrampolines(JSGlobalData*, TrampolineStructure*);
         Label privateCompileCTINativeCall(JSGlobalData*, bool isConstruct = false);
@@ -423,7 +437,6 @@ namespace JSC {
         template<typename ClassType, bool destructor, typename StructureType> void emitAllocateBasicJSObject(StructureType, RegisterID result, RegisterID storagePtr);
         void emitAllocateBasicStorage(size_t, RegisterID result, RegisterID storagePtr);
         template<typename T> void emitAllocateJSFinalObject(T structure, RegisterID result, RegisterID storagePtr);
-        void emitAllocateJSFunction(FunctionExecutable*, RegisterID scopeChain, RegisterID result, RegisterID storagePtr);
         void emitAllocateJSArray(unsigned valuesRegister, unsigned length, RegisterID cellResult, RegisterID storageResult, RegisterID storagePtr);
         
 #if ENABLE(VALUE_PROFILER)
@@ -437,6 +450,8 @@ namespace JSC {
         void emitValueProfilingSite() { }
 #endif
 
+        enum FinalObjectMode { MayBeFinal, KnownNotFinal };
+
 #if USE(JSVALUE32_64)
         bool getOperandConstantImmediateInt(unsigned op1, unsigned op2, unsigned& op, int32_t& constant);
 
@@ -469,10 +484,10 @@ namespace JSC {
 
         void compileGetByIdHotPath();
         void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
-        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset);
-        void compileGetDirectOffset(JSObject* base, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset);
-        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID offset);
-        void compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, PropertyOffset cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID resultTag, RegisterID resultPayload, PropertyOffset cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID offset, FinalObjectMode = MayBeFinal);
+        void compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, PropertyOffset cachedOffset);
 
         // Arithmetic opcode helpers
         void emitAdd32Constant(unsigned dst, unsigned op, int32_t constant, ResultType opType);
@@ -548,10 +563,10 @@ namespace JSC {
 
         void compileGetByIdHotPath(int baseVReg, Identifier*);
         void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, bool isMethodCheck = false);
-        void compileGetDirectOffset(RegisterID base, RegisterID result, size_t cachedOffset);
-        void compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset);
-        void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID offset, RegisterID scratch);
-        void compilePutDirectOffset(RegisterID base, RegisterID value, size_t cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID result, PropertyOffset cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID result, PropertyOffset cachedOffset);
+        void compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID offset, RegisterID scratch, FinalObjectMode = MayBeFinal);
+        void compilePutDirectOffset(RegisterID base, RegisterID value, PropertyOffset cachedOffset);
 
 #endif // USE(JSVALUE32_64)
 
@@ -750,8 +765,6 @@ namespace JSC {
         void emitSlow_op_to_jsnumber(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_to_primitive(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_urshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_new_func(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void emitSlow_op_new_func_exp(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_new_array(Instruction*, Vector<SlowCaseEntry>::iterator&);
         
         void emitRightShift(Instruction*, bool isUnsigned);
diff --git a/Source/JavaScriptCore/jit/JITInlineMethods.h b/Source/JavaScriptCore/jit/JITInlineMethods.h
index 40985ac90..d1cee7ef7 100644
--- a/Source/JavaScriptCore/jit/JITInlineMethods.h
+++ b/Source/JavaScriptCore/jit/JITInlineMethods.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -429,8 +429,7 @@ template <typename ClassType, bool destructor, typename StructureType> inline vo
     storePtr(TrustedImmPtr(0), Address(result, JSObject::offsetOfInheritorID()));
 
     // initialize the object's property storage pointer
-    addPtr(TrustedImm32(sizeof(JSObject)), result, storagePtr);
-    storePtr(storagePtr, Address(result, ClassType::offsetOfPropertyStorage()));
+    storePtr(TrustedImmPtr(0), Address(result, ClassType::offsetOfOutOfLineStorage()));
 }
 
 template <typename T> inline void JIT::emitAllocateJSFinalObject(T structure, RegisterID result, RegisterID scratch)
@@ -438,28 +437,6 @@ template <typename T> inline void JIT::emitAllocateJSFinalObject(T structure, Re
     emitAllocateBasicJSObject<JSFinalObject, false, T>(structure, result, scratch);
 }
 
-inline void JIT::emitAllocateJSFunction(FunctionExecutable* executable, RegisterID scopeChain, RegisterID result, RegisterID storagePtr)
-{
-    emitAllocateBasicJSObject<JSFunction, true>(TrustedImmPtr(m_codeBlock->globalObject()->namedFunctionStructure()), result, storagePtr);
-
-    // store the function's scope chain
-    storePtr(scopeChain, Address(result, JSFunction::offsetOfScopeChain()));
-
-    // store the function's executable member
-    storePtr(TrustedImmPtr(executable), Address(result, JSFunction::offsetOfExecutable()));
-
-    // clear the function's inheritorID
-    storePtr(TrustedImmPtr(0), Address(result, JSFunction::offsetOfCachedInheritorID()));
-
-    // store the function's name
-    ASSERT(executable->nameValue());
-    int functionNameOffset = sizeof(JSValue) * m_codeBlock->globalObject()->functionNameOffset();
-    storePtr(TrustedImmPtr(executable->nameValue()), Address(regT1, functionNameOffset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));
-#if USE(JSVALUE32_64)
-    store32(TrustedImm32(JSValue::CellTag), Address(regT1, functionNameOffset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));
-#endif
-}
-
 inline void JIT::emitAllocateBasicStorage(size_t size, RegisterID result, RegisterID storagePtr)
 {
     CopiedAllocator* allocator = &m_globalData->heap.storageAllocator();
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index 2e448dd52..c0af6f9e9 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -701,9 +701,8 @@ void JIT::emit_op_resolve_global(Instruction* currentInstruction, bool)
 
     // Load cached property
     // Assume that the global object always uses external storage.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_propertyStorage)), regT0);
     load32(Address(regT2, OBJECT_OFFSETOF(GlobalResolveInfo, offset)), regT1);
-    loadPtr(BaseIndex(regT0, regT1, ScalePtr), regT0);
+    compileGetDirectOffset(regT0, regT0, regT1, regT0, KnownNotFinal);
     emitValueProfilingSite();
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
@@ -1618,11 +1617,9 @@ void JIT::emit_op_new_func(Instruction* currentInstruction)
 #endif
     }
 
-    FunctionExecutable* executable = m_codeBlock->functionDecl(currentInstruction[2].u.operand);
-    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT2);
-    emitAllocateJSFunction(executable, regT2, regT0, regT1);
-
-    emitStoreCell(dst, regT0);
+    JITStubCall stubCall(this, cti_op_new_func);
+    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
+    stubCall.call(dst);
 
     if (currentInstruction[3].u.operand) {
 #if USE(JSVALUE32_64)        
@@ -1634,44 +1631,13 @@ void JIT::emit_op_new_func(Instruction* currentInstruction)
     }
 }
 
-void JIT::emitSlow_op_new_func(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    linkSlowCase(iter);
-    JITStubCall stubCall(this, cti_op_new_func);
-    stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));
-    stubCall.call(currentInstruction[1].u.operand);
-}
-
 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
 {
-    FunctionExecutable* executable = m_codeBlock->functionExpr(currentInstruction[2].u.operand);
-
-    // We only inline the allocation of a anonymous function expressions
-    // If we want to be able to allocate a named function expression, we would
-    // need to be able to do inline allocation of a JSStaticScopeObject.
-    if (executable->name().isNull()) {
-        emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT2);
-        emitAllocateJSFunction(executable, regT2, regT0, regT1);
-        emitStoreCell(currentInstruction[1].u.operand, regT0);
-        return;
-    }
-
     JITStubCall stubCall(this, cti_op_new_func_exp);
     stubCall.addArgument(TrustedImmPtr(m_codeBlock->functionExpr(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
 
-void JIT::emitSlow_op_new_func_exp(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    FunctionExecutable* executable = m_codeBlock->functionExpr(currentInstruction[2].u.operand);
-    if (!executable->name().isNull())
-        return;
-    linkSlowCase(iter);
-    JITStubCall stubCall(this, cti_op_new_func_exp);
-    stubCall.addArgument(TrustedImmPtr(executable));
-    stubCall.call(currentInstruction[1].u.operand);
-}
-
 void JIT::emit_op_new_array(Instruction* currentInstruction)
 {
     int length = currentInstruction[3].u.operand;
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 4f8589557..095ea57d3 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -794,16 +794,14 @@ void JIT::emit_op_resolve_global(Instruction* currentInstruction, bool dynamic)
 
 
     // Verify structure.
-    move(TrustedImmPtr(globalObject), regT0);
+    move(TrustedImmPtr(globalObject), regT2);
     move(TrustedImmPtr(resolveInfoAddress), regT3);
     loadPtr(Address(regT3, OBJECT_OFFSETOF(GlobalResolveInfo, structure)), regT1);
-    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0, JSCell::structureOffset())));
+    addSlowCase(branchPtr(NotEqual, regT1, Address(regT2, JSCell::structureOffset())));
 
     // Load property.
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_propertyStorage)), regT2);
     load32(Address(regT3, OBJECT_OFFSETOF(GlobalResolveInfo, offset)), regT3);
-    load32(BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
-    load32(BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
+    compileGetDirectOffset(regT2, regT1, regT0, regT3, KnownNotFinal);
     emitValueProfilingSite();
     emitStore(dst, regT1, regT0);
     map(m_bytecodeOffset + (dynamic ? OPCODE_LENGTH(op_resolve_global_dynamic) : OPCODE_LENGTH(op_resolve_global)), dst, regT1, regT0);
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
index 7478f9184..466cff7db 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -29,6 +29,7 @@
 #include "JIT.h"
 
 #include "CodeBlock.h"
+#include "GCAwareJITStubRoutine.h"
 #include "GetterSetter.h"
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
@@ -151,10 +152,26 @@ void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCas
     emitValueProfilingSite();
 }
 
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID offset, RegisterID scratch)
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, RegisterID offset, RegisterID scratch, FinalObjectMode finalObjectMode)
 {
-    loadPtr(Address(base, JSObject::offsetOfPropertyStorage()), scratch);
-    loadPtr(BaseIndex(scratch, offset, ScalePtr, 0), result);
+    ASSERT(sizeof(JSValue) == 8);
+    
+    if (finalObjectMode == MayBeFinal) {
+        Jump isInline = branch32(LessThan, offset, TrustedImm32(inlineStorageCapacity));
+        loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), scratch);
+        Jump done = jump();
+        isInline.link(this);
+        addPtr(TrustedImm32(JSObject::offsetOfInlineStorage() + inlineStorageCapacity * sizeof(EncodedJSValue)), base, scratch);
+        done.link(this);
+    } else {
+#if !ASSERT_DISABLED
+        Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(inlineStorageCapacity));
+        breakpoint();
+        isOutOfLine.link(this);
+#endif
+        loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), scratch);
+    }
+    loadPtr(BaseIndex(scratch, offset, ScalePtr, -inlineStorageCapacity * static_cast<ptrdiff_t>(sizeof(JSValue))), result);
 }
 
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
@@ -177,6 +194,7 @@ void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
     load32(addressFor(i), regT3);
     sub32(TrustedImm32(1), regT3);
     addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    add32(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_offsetBase)), regT3);
     compileGetDirectOffset(regT0, regT0, regT3, regT1);
 
     emitPutVirtualRegister(dst, regT0);
@@ -283,7 +301,8 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
 void JIT::emit_op_method_check(Instruction* currentInstruction)
 {
     // Assert that the following instruction is a get_by_id.
-    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id
+        || m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id_out_of_line);
 
     currentInstruction += OPCODE_LENGTH(op_method_check);
     unsigned resultVReg = currentInstruction[1].u.operand;
@@ -373,14 +392,14 @@ void JIT::compileGetByIdHotPath(int baseVReg, Identifier*)
     PatchableJump structureCheck = patchableBranchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
 
-    loadPtr(Address(regT0, JSObject::offsetOfPropertyStorage()), regT0);
+    ConvertibleLoadLabel propertyStorageLoad = convertibleLoadPtr(Address(regT0, JSObject::offsetOfOutOfLineStorage()), regT0);
     DataLabelCompact displacementLabel = loadPtrWithCompactAddressOffsetPatch(Address(regT0, patchGetByIdDefaultOffset), regT0);
 
     Label putResult(this);
 
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
 
-    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubGetById, m_bytecodeOffset, hotPathBegin, structureToCompare, structureCheck, displacementLabel, putResult));
+    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubGetById, m_bytecodeOffset, hotPathBegin, structureToCompare, structureCheck, propertyStorageLoad, displacementLabel, putResult));
 }
 
 void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -440,14 +459,14 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     DataLabelPtr structureToCompare;
     addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
 
-    loadPtr(Address(regT0, JSObject::offsetOfPropertyStorage()), regT2);
+    ConvertibleLoadLabel propertyStorageLoad = convertibleLoadPtr(Address(regT0, JSObject::offsetOfOutOfLineStorage()), regT2);
     DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT2, patchPutByIdDefaultOffset));
 
     END_UNINTERRUPTED_SEQUENCE(sequencePutById);
 
     emitWriteBarrier(regT0, regT1, regT2, regT3, ShouldFilterImmediates, WriteBarrierForPropertyAccess);
 
-    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubPutById, m_bytecodeOffset, hotPathBegin, structureToCompare, displacementLabel));
+    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubPutById, m_bytecodeOffset, hotPathBegin, structureToCompare, propertyStorageLoad, displacementLabel));
 }
 
 void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -471,28 +490,41 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
 
 // Compile a store into an object's property storage.  May overwrite the
 // value in objectReg.
-void JIT::compilePutDirectOffset(RegisterID base, RegisterID value, size_t cachedOffset)
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID value, PropertyOffset cachedOffset)
 {
-    int offset = cachedOffset * sizeof(JSValue);
-    loadPtr(Address(base, JSObject::offsetOfPropertyStorage()), base);
-    storePtr(value, Address(base, offset));
+    if (isInlineOffset(cachedOffset)) {
+        storePtr(value, Address(base, JSObject::offsetOfInlineStorage() + sizeof(JSValue) * offsetInInlineStorage(cachedOffset)));
+        return;
+    }
+    
+    loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), base);
+    storePtr(value, Address(base, sizeof(JSValue) * offsetInOutOfLineStorage(cachedOffset)));
 }
 
 // Compile a load from an object's property storage.  May overwrite base.
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, size_t cachedOffset)
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, PropertyOffset cachedOffset)
 {
-    int offset = cachedOffset * sizeof(JSValue);
-    loadPtr(Address(base, JSObject::offsetOfPropertyStorage()), result);
-    loadPtr(Address(result, offset), result);
+    if (isInlineOffset(cachedOffset)) {
+        loadPtr(Address(base, JSObject::offsetOfInlineStorage() + sizeof(JSValue) * offsetInInlineStorage(cachedOffset)), result);
+        return;
+    }
+    
+    loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), result);
+    loadPtr(Address(result, sizeof(JSValue) * offsetInOutOfLineStorage(cachedOffset)), result);
 }
 
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID result, size_t cachedOffset)
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID result, PropertyOffset cachedOffset)
 {
-    loadPtr(base->addressOfPropertyStorage(), result);
-    loadPtr(Address(result, cachedOffset * sizeof(WriteBarrier<Unknown>)), result);
+    if (isInlineOffset(cachedOffset)) {
+        loadPtr(base->locationForOffset(cachedOffset), result);
+        return;
+    }
+    
+    loadPtr(base->addressOfOutOfLineStorage(), result);
+    loadPtr(Address(result, offsetInOutOfLineStorage(cachedOffset) * sizeof(WriteBarrier<Unknown>)), result);
 }
 
-void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, PropertyOffset cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
 {
     JumpList failureCases;
     // Check eax is an object of the right Structure.
@@ -522,7 +554,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
 #endif
     
     // emit a call only if storage realloc is needed
-    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    bool willNeedStorageRealloc = oldStructure->outOfLineCapacity() != newStructure->outOfLineCapacity();
     if (willNeedStorageRealloc) {
         // This trampoline was called to like a JIT stub; before we can can call again we need to
         // remove the return address from the stack, to prevent the stack from becoming misaligned.
@@ -532,7 +564,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         stubCall.skipArgument(); // base
         stubCall.skipArgument(); // ident
         stubCall.skipArgument(); // value
-        stubCall.addArgument(TrustedImm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(oldStructure->outOfLineCapacity()));
         stubCall.addArgument(TrustedImmPtr(newStructure));
         stubCall.call(regT0);
         emitGetJITStubArg(2, regT1);
@@ -564,15 +596,20 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
     }
     
-    stubInfo->stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline put_by_id transition for CodeBlock %p, return point %p",
-         m_codeBlock, returnAddress.value()));
+    stubInfo->stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline put_by_id transition for CodeBlock %p, return point %p",
+             m_codeBlock, returnAddress.value())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        willNeedStorageRealloc,
+        newStructure);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relinkCallerToTrampoline(returnAddress, CodeLocationLabel(stubInfo->stubRoutine.code()));
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, CodeLocationLabel(stubInfo->stubRoutine->code().code()));
 }
 
-void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress)
 {
     RepatchBuffer repatchBuffer(codeBlock);
 
@@ -580,14 +617,13 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
     // Should probably go to cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
 
-    int offset = sizeof(JSValue) * cachedOffset;
-
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(stubInfo->patch.baseline.u.get.structureToCompare), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.get.displacementLabel), offset);
+    repatchBuffer.setLoadInstructionIsActive(stubInfo->hotPathBegin.convertibleLoadAtOffset(stubInfo->patch.baseline.u.get.propertyStorageLoad), isOutOfLineOffset(cachedOffset));
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.get.displacementLabel), offsetRelativeToPatchedStorage(cachedOffset));
 }
 
-void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress, bool direct)
+void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress, bool direct)
 {
     RepatchBuffer repatchBuffer(codeBlock);
 
@@ -595,11 +631,10 @@ void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo,
     // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(direct ? cti_op_put_by_id_direct_generic : cti_op_put_by_id_generic));
 
-    int offset = sizeof(JSValue) * cachedOffset;
-
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(stubInfo->patch.baseline.u.put.structureToCompare), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel), offset);
+    repatchBuffer.setLoadInstructionIsActive(stubInfo->hotPathBegin.convertibleLoadAtOffset(stubInfo->patch.baseline.u.put.propertyStorageLoad), isOutOfLineOffset(cachedOffset));
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel), offsetRelativeToPatchedStorage(cachedOffset));
 }
 
 void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
@@ -628,7 +663,7 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = FINALIZE_CODE(
+    stubInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
         patchBuffer,
         ("Basline JIT get_by_id array length stub for CodeBlock %p, return point %p",
          m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
@@ -637,13 +672,13 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine->code().code()));
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
 }
 
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -695,22 +730,26 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
         }
     }
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline JIT get_by_id proto stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    stubInfo->stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline JIT get_by_id proto stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine->code().code()));
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset)
 {
     Jump failureCase = checkStructure(regT0, structure);
     bool needsStubLink = false;
@@ -747,7 +786,7 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     }
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructures->list[currentIndex - 1].stubRoutine.code());
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(polymorphicStructures->list[currentIndex - 1].stubRoutine));
     if (!lastProtoBegin)
         lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-stubInfo->patch.baseline.u.get.coldPathBegin);
 
@@ -756,21 +795,25 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
 
-    MacroAssemblerCodeRef stubCode = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline JIT get_by_id list stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubCode = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline JIT get_by_id list stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
 
     polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), stubCode, structure, isDirect);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubCode.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubCode->code().code()));
 }
 
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, CallFrame* callFrame)
 {
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
@@ -819,27 +862,31 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     }
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(prototypeStructures->list[currentIndex - 1].stubRoutine));
     patchBuffer.link(failureCases1, lastProtoBegin);
     patchBuffer.link(failureCases2, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
 
-    MacroAssemblerCodeRef stubCode = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline JIT get_by_id proto list stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubCode = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline JIT get_by_id proto list stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
     prototypeStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), stubCode, structure, prototypeStructure, isDirect);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubCode.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubCode->code().code()));
 }
 
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, CallFrame* callFrame)
 {
     ASSERT(count);
     JumpList bucketsOfFail;
@@ -892,18 +939,22 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     }
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(prototypeStructures->list[currentIndex - 1].stubRoutine));
 
     patchBuffer.link(bucketsOfFail, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
 
-    CodeRef stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline JIT get_by_id chain list stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline JIT get_by_id chain list stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
 
     // Track the stub we have created so that it will be deleted later.
     prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), stubRoutine, structure, chain, isDirect);
@@ -911,10 +962,10 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
 }
 
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     ASSERT(count);
 
@@ -970,17 +1021,21 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
 
     // Track the stub we have created so that it will be deleted later.
-    CodeRef stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline JIT get_by_id chain stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline JIT get_by_id chain stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
     stubInfo->stubRoutine = stubRoutine;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
index a44c576c5..84996d9f0 100644
--- a/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
@@ -30,6 +30,7 @@
 #include "JIT.h"
 
 #include "CodeBlock.h"
+#include "GCAwareJITStubRoutine.h"
 #include "Interpreter.h"
 #include "JITInlineMethods.h"
 #include "JITStubCall.h"
@@ -93,7 +94,8 @@ void JIT::emit_op_del_by_id(Instruction* currentInstruction)
 void JIT::emit_op_method_check(Instruction* currentInstruction)
 {
     // Assert that the following instruction is a get_by_id.
-    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id
+        || m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id_out_of_line);
     
     currentInstruction += OPCODE_LENGTH(op_method_check);
     
@@ -333,7 +335,7 @@ void JIT::compileGetByIdHotPath()
     PatchableJump structureCheck = patchableBranchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
     
-    loadPtr(Address(regT0, JSObject::offsetOfPropertyStorage()), regT2);
+    ConvertibleLoadLabel propertyStorageLoad = convertibleLoadPtr(Address(regT0, JSObject::offsetOfOutOfLineStorage()), regT2);
     DataLabelCompact displacementLabel1 = loadPtrWithCompactAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT0); // payload
     DataLabelCompact displacementLabel2 = loadPtrWithCompactAddressOffsetPatch(Address(regT2, patchGetByIdDefaultOffset), regT1); // tag
     
@@ -341,7 +343,7 @@ void JIT::compileGetByIdHotPath()
     
     END_UNINTERRUPTED_SEQUENCE(sequenceGetByIdHotPath);
 
-    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubGetById, m_bytecodeOffset, hotPathBegin, structureToCompare, structureCheck, displacementLabel1, displacementLabel2, putResult));
+    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubGetById, m_bytecodeOffset, hotPathBegin, structureToCompare, structureCheck, propertyStorageLoad, displacementLabel1, displacementLabel2, putResult));
 }
 
 void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -399,7 +401,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
     DataLabelPtr structureToCompare;
     addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, JSCell::structureOffset()), structureToCompare, TrustedImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
     
-    loadPtr(Address(regT0, JSObject::offsetOfPropertyStorage()), regT1);
+    ConvertibleLoadLabel propertyStorageLoad = convertibleLoadPtr(Address(regT0, JSObject::offsetOfOutOfLineStorage()), regT1);
     DataLabel32 displacementLabel1 = storePtrWithAddressOffsetPatch(regT2, Address(regT1, patchPutByIdDefaultOffset)); // payload
     DataLabel32 displacementLabel2 = storePtrWithAddressOffsetPatch(regT3, Address(regT1, patchPutByIdDefaultOffset)); // tag
     
@@ -407,7 +409,7 @@ void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 
     emitWriteBarrier(regT0, regT2, regT1, regT2, ShouldFilterImmediates, WriteBarrierForPropertyAccess);
 
-    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubPutById, m_bytecodeOffset, hotPathBegin, structureToCompare, displacementLabel1, displacementLabel2));
+    m_propertyAccessCompilationInfo.append(PropertyStubCompilationInfo(PropertyStubPutById, m_bytecodeOffset, hotPathBegin, structureToCompare, propertyStorageLoad, displacementLabel1, displacementLabel2));
 }
 
 void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
@@ -430,30 +432,41 @@ void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCase
 }
 
 // Compile a store into an object's property storage.  May overwrite base.
-void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, size_t cachedOffset)
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID valueTag, RegisterID valuePayload, PropertyOffset cachedOffset)
 {
-    int offset = cachedOffset;
-    loadPtr(Address(base, JSObject::offsetOfPropertyStorage()), base);
-    emitStore(offset, valueTag, valuePayload, base);
+    if (isOutOfLineOffset(cachedOffset))
+        loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), base);
+    emitStore(indexRelativeToBase(cachedOffset), valueTag, valuePayload, base);
 }
 
 // Compile a load from an object's property storage.  May overwrite base.
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, PropertyOffset cachedOffset)
 {
-    int offset = cachedOffset;
+    if (isInlineOffset(cachedOffset)) {
+        emitLoad(indexRelativeToBase(cachedOffset), resultTag, resultPayload, base);
+        return;
+    }
+    
     RegisterID temp = resultPayload;
-    loadPtr(Address(base, JSObject::offsetOfPropertyStorage()), temp);
-    emitLoad(offset, resultTag, resultPayload, temp);
+    loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), temp);
+    emitLoad(indexRelativeToBase(cachedOffset), resultTag, resultPayload, temp);
 }
 
-void JIT::compileGetDirectOffset(JSObject* base, RegisterID resultTag, RegisterID resultPayload, size_t cachedOffset)
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID resultTag, RegisterID resultPayload, PropertyOffset cachedOffset)
 {
-    loadPtr(base->addressOfPropertyStorage(), resultTag);
-    load32(Address(resultTag, cachedOffset * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    load32(Address(resultTag, cachedOffset * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    if (isInlineOffset(cachedOffset)) {
+        move(TrustedImmPtr(base->locationForOffset(cachedOffset)), resultTag);
+        load32(Address(resultTag, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+        load32(Address(resultTag, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+        return;
+    }
+    
+    loadPtr(base->addressOfOutOfLineStorage(), resultTag);
+    load32(Address(resultTag, offsetInOutOfLineStorage(cachedOffset) * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
+    load32(Address(resultTag, offsetInOutOfLineStorage(cachedOffset) * sizeof(WriteBarrier<Unknown>) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
 }
 
-void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, PropertyOffset cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress, bool direct)
 {
     // The code below assumes that regT0 contains the basePayload and regT1 contains the baseTag. Restore them from the stack.
 #if CPU(MIPS) || CPU(SH4) || CPU(ARM)
@@ -489,7 +502,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
     
     // Reallocate property storage if needed.
     Call callTarget;
-    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    bool willNeedStorageRealloc = oldStructure->outOfLineCapacity() != newStructure->outOfLineCapacity();
     if (willNeedStorageRealloc) {
         // This trampoline was called to like a JIT stub; before we can can call again we need to
         // remove the return address from the stack, to prevent the stack from becoming misaligned.
@@ -499,7 +512,7 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         stubCall.skipArgument(); // base
         stubCall.skipArgument(); // ident
         stubCall.skipArgument(); // value
-        stubCall.addArgument(TrustedImm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(TrustedImm32(oldStructure->outOfLineCapacity()));
         stubCall.addArgument(TrustedImmPtr(newStructure));
         stubCall.call(regT0);
 
@@ -545,15 +558,20 @@ void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure
         patchBuffer.link(m_calls[0].from, FunctionPtr(cti_op_put_by_id_transition_realloc));
     }
     
-    stubInfo->stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline put_by_id transition stub for CodeBlock %p, return point %p",
-         m_codeBlock, returnAddress.value()));
+    stubInfo->stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline put_by_id transition stub for CodeBlock %p, return point %p",
+             m_codeBlock, returnAddress.value())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        willNeedStorageRealloc,
+        newStructure);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relinkCallerToTrampoline(returnAddress, CodeLocationLabel(stubInfo->stubRoutine.code()));
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, CodeLocationLabel(stubInfo->stubRoutine->code().code()));
 }
 
-void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
+void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress)
 {
     RepatchBuffer repatchBuffer(codeBlock);
     
@@ -561,15 +579,14 @@ void JIT::patchGetByIdSelf(CodeBlock* codeBlock, StructureStubInfo* stubInfo, St
     // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_self_fail));
     
-    int offset = sizeof(JSValue) * cachedOffset;
-
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(stubInfo->patch.baseline.u.get.structureToCompare), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.get.displacementLabel1), offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.get.displacementLabel2), offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
+    repatchBuffer.setLoadInstructionIsActive(stubInfo->hotPathBegin.convertibleLoadAtOffset(stubInfo->patch.baseline.u.get.propertyStorageLoad), isOutOfLineOffset(cachedOffset));
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.get.displacementLabel1), offsetRelativeToPatchedStorage(cachedOffset) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelCompactAtOffset(stubInfo->patch.baseline.u.get.displacementLabel2), offsetRelativeToPatchedStorage(cachedOffset) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
 }
 
-void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress, bool direct)
+void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress, bool direct)
 {
     RepatchBuffer repatchBuffer(codeBlock);
     
@@ -577,12 +594,11 @@ void JIT::patchPutByIdReplace(CodeBlock* codeBlock, StructureStubInfo* stubInfo,
     // Should probably go to cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(direct ? cti_op_put_by_id_direct_generic : cti_op_put_by_id_generic));
     
-    int offset = sizeof(JSValue) * cachedOffset;
-
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(stubInfo->patch.baseline.u.put.structureToCompare), structure);
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel1), offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
-    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel2), offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
+    repatchBuffer.setLoadInstructionIsActive(stubInfo->hotPathBegin.convertibleLoadAtOffset(stubInfo->patch.baseline.u.put.propertyStorageLoad), isOutOfLineOffset(cachedOffset));
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel1), offsetRelativeToPatchedStorage(cachedOffset) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(stubInfo->patch.baseline.u.put.displacementLabel2), offsetRelativeToPatchedStorage(cachedOffset) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
 }
 
 void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
@@ -614,7 +630,7 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
     
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = FINALIZE_CODE(
+    stubInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
         patchBuffer,
         ("Baseline get_by_id array length stub for CodeBlock %p, return point %p",
          m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
@@ -623,13 +639,13 @@ void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine->code().code()));
     
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_array_fail));
 }
 
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     // regT0 holds a JSCell*
     
@@ -684,23 +700,27 @@ void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* str
     }
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline get_by_id proto stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    stubInfo->stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline get_by_id proto stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine->code().code()));
     
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
 
-void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset)
+void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset)
 {
     // regT0 holds a JSCell*
     Jump failureCase = checkStructure(regT0, structure);
@@ -737,7 +757,7 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
         }
     }    
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructures->list[currentIndex - 1].stubRoutine.code());
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(polymorphicStructures->list[currentIndex - 1].stubRoutine));
     if (!lastProtoBegin)
         lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-stubInfo->patch.baseline.u.get.coldPathBegin);
     
@@ -746,21 +766,25 @@ void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, Polymorphic
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
 
-    MacroAssemblerCodeRef stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline get_by_id self list stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline get_by_id self list stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
 
     polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), stubRoutine, structure, isDirect);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
 }
 
-void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, CallFrame* callFrame)
 {
     // regT0 holds a JSCell*
     
@@ -808,28 +832,32 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
         }
     }
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(prototypeStructures->list[currentIndex - 1].stubRoutine));
     patchBuffer.link(failureCases1, lastProtoBegin);
     patchBuffer.link(failureCases2, lastProtoBegin);
     
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
     
-    MacroAssemblerCodeRef stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline get_by_id proto list stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline get_by_id proto list stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
 
     prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), stubRoutine, structure, prototypeStructure, isDirect);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
 }
 
-void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, CallFrame* callFrame)
 {
     // regT0 holds a JSCell*
     ASSERT(count);
@@ -882,18 +910,22 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
         }
     }
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(JITStubRoutine::asCodePtr(prototypeStructures->list[currentIndex - 1].stubRoutine));
     
     patchBuffer.link(bucketsOfFail, lastProtoBegin);
     
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
     
-    MacroAssemblerCodeRef stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline get_by_id chain list stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline get_by_id chain list stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
     
     // Track the stub we have created so that it will be deleted later.
     prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), stubRoutine, structure, chain, isDirect);
@@ -901,10 +933,10 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
 }
 
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, const Identifier& ident, const PropertySlot& slot, PropertyOffset cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
     // regT0 holds a JSCell*
     ASSERT(count);
@@ -959,29 +991,47 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(stubInfo->patch.baseline.u.get.putResult));
     
     // Track the stub we have created so that it will be deleted later.
-    MacroAssemblerCodeRef stubRoutine = FINALIZE_CODE(
-        patchBuffer,
-        ("Baseline get_by_id chain stub for CodeBlock %p, return point %p",
-         m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
-             stubInfo->patch.baseline.u.get.putResult).executableAddress()));
+    RefPtr<JITStubRoutine> stubRoutine = createJITStubRoutine(
+        FINALIZE_CODE(
+            patchBuffer,
+            ("Baseline get_by_id chain stub for CodeBlock %p, return point %p",
+             m_codeBlock, stubInfo->hotPathBegin.labelAtOffset(
+                 stubInfo->patch.baseline.u.get.putResult).executableAddress())),
+        *m_globalData,
+        m_codeBlock->ownerExecutable(),
+        needsStubLink);
     stubInfo->stubRoutine = stubRoutine;
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(stubInfo->patch.baseline.u.get.structureCheck);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine->code().code()));
     
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
     repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(cti_op_get_by_id_proto_list));
 }
 
-void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID offset)
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID resultTag, RegisterID resultPayload, RegisterID offset, FinalObjectMode finalObjectMode)
 {
     ASSERT(sizeof(JSValue) == 8);
     
-    loadPtr(Address(base, JSObject::offsetOfPropertyStorage()), base);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
-    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
+    if (finalObjectMode == MayBeFinal) {
+        Jump isInline = branch32(LessThan, offset, TrustedImm32(inlineStorageCapacity));
+        loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), base);
+        Jump done = jump();
+        isInline.link(this);
+        addPtr(TrustedImmPtr(JSObject::offsetOfInlineStorage() + inlineStorageCapacity * sizeof(EncodedJSValue)), base);
+        done.link(this);
+    } else {
+#if !ASSERT_DISABLED
+        Jump isOutOfLine = branch32(GreaterThanOrEqual, offset, TrustedImm32(inlineStorageCapacity));
+        breakpoint();
+        isOutOfLine.link(this);
+#endif
+        loadPtr(Address(base, JSObject::offsetOfOutOfLineStorage()), base);
+    }
+    load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload) - inlineStorageCapacity * sizeof(EncodedJSValue)), resultPayload);
+    load32(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag) - inlineStorageCapacity * sizeof(EncodedJSValue)), resultTag);
 }
 
 void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
@@ -1006,6 +1056,7 @@ void JIT::emit_op_get_by_pname(Instruction* currentInstruction)
     load32(addressFor(i), regT3);
     sub32(TrustedImm32(1), regT3);
     addSlowCase(branch32(AboveOrEqual, regT3, Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_numCacheableSlots))));
+    add32(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_offsetBase)), regT3);
     compileGetDirectOffset(regT2, regT1, regT0, regT3);    
     
     emitStore(dst, regT1, regT0);
diff --git a/Source/JavaScriptCore/jit/JITStubRoutine.cpp b/Source/JavaScriptCore/jit/JITStubRoutine.cpp
new file mode 100644
index 000000000..951665318
--- /dev/null
+++ b/Source/JavaScriptCore/jit/JITStubRoutine.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JITStubRoutine.h"
+
+#if ENABLE(JIT)
+
+#include "JSObject.h"
+#include "ScopeChain.h"
+#include "SlotVisitor.h"
+
+namespace JSC {
+
+JITStubRoutine::~JITStubRoutine() { }
+
+void JITStubRoutine::observeZeroRefCount()
+{
+    ASSERT(!m_refCount);
+    delete this;
+}
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
diff --git a/Source/JavaScriptCore/jit/JITStubRoutine.h b/Source/JavaScriptCore/jit/JITStubRoutine.h
new file mode 100644
index 000000000..4400589ff
--- /dev/null
+++ b/Source/JavaScriptCore/jit/JITStubRoutine.h
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITStubRoutine_h
+#define JITStubRoutine_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+#include "ExecutableAllocator.h"
+#include "MacroAssemblerCodeRef.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JITStubRoutineSet;
+
+// This is a base-class for JIT stub routines, and also the class you want
+// to instantiate directly if you have a routine that does not need any
+// help from the GC. If in doubt, use one of the other stub routines. But
+// if you know for sure that the stub routine cannot be on the stack while
+// someone triggers a stub routine reset, then using this will speed up
+// memory reclamation. One case where a stub routine satisfies this
+// condition is if it doesn't make any calls, to either C++ or JS code. In
+// such a routine you know that it cannot be on the stack when anything
+// interesting happens.
+// See GCAwareJITStubRoutine.h for the other stub routines.
+class JITStubRoutine {
+    WTF_MAKE_NONCOPYABLE(JITStubRoutine);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    JITStubRoutine(const MacroAssemblerCodeRef& code)
+        : m_code(code)
+        , m_refCount(1)
+    {
+    }
+    
+    // Use this if you want to pass a CodePtr to someone who insists on taking
+    // a RefPtr<JITStubRoutine>.
+    static PassRefPtr<JITStubRoutine> createSelfManagedRoutine(
+        MacroAssemblerCodePtr rawCodePointer)
+    {
+        return adoptRef(new JITStubRoutine(MacroAssemblerCodeRef::createSelfManagedCodeRef(rawCodePointer)));
+    }
+    
+    virtual ~JITStubRoutine();
+    
+    // MacroAssemblerCodeRef is copyable, but at the cost of reference
+    // counting churn. Returning a reference is a good way of reducing
+    // the churn.
+    const MacroAssemblerCodeRef& code() const { return m_code; }
+    
+    static MacroAssemblerCodePtr asCodePtr(PassRefPtr<JITStubRoutine> stubRoutine)
+    {
+        if (!stubRoutine)
+            return MacroAssemblerCodePtr();
+        
+        MacroAssemblerCodePtr result = stubRoutine->code().code();
+        ASSERT(!!result);
+        return result;
+    }
+    
+    void ref()
+    {
+        m_refCount++;
+    }
+    
+    void deref()
+    {
+        if (--m_refCount)
+            return;
+        observeZeroRefCount();
+    }
+    
+    // Helpers for the GC to determine how to deal with marking JIT stub
+    // routines.
+    uintptr_t startAddress() const { return m_code.executableMemory()->startAsInteger(); }
+    uintptr_t endAddress() const { return m_code.executableMemory()->endAsInteger(); }
+    static uintptr_t addressStep() { return jitAllocationGranule; }
+    
+    static bool canPerformRangeFilter()
+    {
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+        return true;
+#else
+        return false;
+#endif
+    }
+    static uintptr_t filteringStartAddress()
+    {
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+        return startOfFixedExecutableMemoryPool;
+#else
+        UNREACHABLE_FOR_PLATFORM();
+        return 0;
+#endif
+    }
+    static size_t filteringExtentSize()
+    {
+#if ENABLE(EXECUTABLE_ALLOCATOR_FIXED)
+        return fixedExecutableMemoryPoolSize;
+#else
+        UNREACHABLE_FOR_PLATFORM();
+        return 0;
+#endif
+    }
+    static bool passesFilter(uintptr_t address)
+    {
+        if (!canPerformRangeFilter()) {
+            // Just check that the address doesn't use any special values that would make
+            // our hashtables upset.
+            return address >= jitAllocationGranule && address != std::numeric_limits<uintptr_t>::max();
+        }
+        
+        if (address - filteringStartAddress() >= filteringExtentSize())
+            return false;
+        
+        return true;
+    }
+
+protected:
+    virtual void observeZeroRefCount();
+
+    MacroAssemblerCodeRef m_code;
+    unsigned m_refCount;
+};
+
+// Helper for the creation of simple stub routines that need no help from the GC.
+#define FINALIZE_CODE_FOR_STUB(patchBuffer, dataLogArguments) \
+    (adoptRef(new JITStubRoutine(FINALIZE_CODE((patchBuffer), dataLogArguments))))
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // JITStubRoutine_h
+
diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp
index 6b8082886..2273f0f38 100644
--- a/Source/JavaScriptCore/jit/JITStubs.cpp
+++ b/Source/JavaScriptCore/jit/JITStubs.cpp
@@ -622,38 +622,46 @@ SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
 #elif COMPILER(GCC) && CPU(ARM_TRADITIONAL)
 
 asm (
+".text" "\n"
 ".globl " SYMBOL_STRING(ctiTrampoline) "\n"
 HIDE_SYMBOL(ctiTrampoline) "\n"
+INLINE_ARM_FUNCTION(ctiTrampoline)
 SYMBOL_STRING(ctiTrampoline) ":" "\n"
     "stmdb sp!, {r1-r3}" "\n"
-    "stmdb sp!, {r4-r8, lr}" "\n"
+    "stmdb sp!, {r4-r6, r8-r11, lr}" "\n"
     "sub sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
-    "mov r4, r2" "\n"
-    "mov r5, #512" "\n"
+    "mov r5, r2" "\n"
+    "mov r6, #512" "\n"
     // r0 contains the code
-    "mov lr, pc" "\n"
-    "mov pc, r0" "\n"
+    "blx r0" "\n"
     "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
+    "ldmia sp!, {r4-r6, r8-r11, lr}" "\n"
     "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
+    "bx lr" "\n"
+".globl " SYMBOL_STRING(ctiTrampolineEnd) "\n"
+HIDE_SYMBOL(ctiTrampolineEnd) "\n"
+SYMBOL_STRING(ctiTrampolineEnd) ":" "\n"
 );
 
 asm (
+".text" "\n"
 ".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
 HIDE_SYMBOL(ctiVMThrowTrampoline) "\n"
+INLINE_ARM_FUNCTION(ctiVMThrowTrampoline)
 SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
     "mov r0, sp" "\n"
     "bl " SYMBOL_STRING(cti_vm_throw) "\n"
 
 // Both has the same return sequence
+".text" "\n"
 ".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
 HIDE_SYMBOL(ctiOpThrowNotCaught) "\n"
+INLINE_ARM_FUNCTION(ctiOpThrowNotCaught)
 SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
     "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n"
-    "ldmia sp!, {r4-r8, lr}" "\n"
+    "ldmia sp!, {r4-r6, r8-r11, lr}" "\n"
     "add sp, sp, #12" "\n"
-    "mov pc, lr" "\n"
+    "bx lr" "\n"
 );
 
 #elif COMPILER(RVCT) && CPU(ARM_THUMB2)
@@ -954,7 +962,7 @@ NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* co
         return;
     }
 
-    size_t offset = slot.cachedOffset();
+    PropertyOffset offset = slot.cachedOffset();
     size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset);
     if (!count) {
         stubInfo->accessType = access_get_by_id_generic;
@@ -1156,11 +1164,12 @@ template<typename T> static T throwExceptionFromOpCall(JITStackFrame& jitStackFr
     }; \
     asm ( \
         ".globl " SYMBOL_STRING(cti_##op) "\n" \
+        INLINE_ARM_FUNCTION(cti_##op) \
         SYMBOL_STRING(cti_##op) ":" "\n" \
         "str lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
         "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
         "ldr lr, [sp, #" STRINGIZE_VALUE_OF(THUNK_RETURN_ADDRESS_OFFSET) "]" "\n" \
-        "mov pc, lr" "\n" \
+        "bx lr" "\n" \
         ); \
     rtype JITStubThunked_##op(STUB_ARGS_DECLARATION)
 
@@ -1486,13 +1495,16 @@ DEFINE_STUB_FUNCTION(JSObject*, op_put_by_id_transition_realloc)
     JSValue baseValue = stackFrame.args[0].jsValue();
     int32_t oldSize = stackFrame.args[3].int32();
     Structure* newStructure = stackFrame.args[4].structure();
-    int32_t newSize = newStructure->propertyStorageCapacity();
+    int32_t newSize = newStructure->outOfLineCapacity();
+    
+    ASSERT(oldSize >= 0);
+    ASSERT(newSize > oldSize);
 
     ASSERT(baseValue.isObject());
     JSObject* base = asObject(baseValue);
     JSGlobalData& globalData = *stackFrame.globalData;
-    PropertyStorage newStorage = base->growPropertyStorage(globalData, oldSize, newSize);
-    base->setPropertyStorage(globalData, newStorage, newStructure);
+    PropertyStorage newStorage = base->growOutOfLineStorage(globalData, oldSize, newSize);
+    base->setOutOfLineStorage(globalData, newStorage, newStructure);
 
     return base;
 }
@@ -1710,7 +1722,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
 
         if (stubInfo->accessType == access_get_by_id_self) {
             ASSERT(!stubInfo->stubRoutine);
-            polymorphicStructureList = new PolymorphicAccessStructureList(callFrame->globalData(), codeBlock->ownerExecutable(), MacroAssemblerCodeRef(), stubInfo->u.getByIdSelf.baseObjectStructure.get(), true);
+            polymorphicStructureList = new PolymorphicAccessStructureList(callFrame->globalData(), codeBlock->ownerExecutable(), 0, stubInfo->u.getByIdSelf.baseObjectStructure.get(), true);
             stubInfo->initGetByIdSelfList(polymorphicStructureList, 1);
         } else {
             polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
@@ -1736,12 +1748,12 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(JSG
     switch (stubInfo->accessType) {
     case access_get_by_id_proto:
         prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure.get(), stubInfo->u.getByIdProto.prototypeStructure.get(), true);
-        stubInfo->stubRoutine = MacroAssemblerCodeRef();
+        stubInfo->stubRoutine.clear();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
     case access_get_by_id_chain:
         prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure.get(), stubInfo->u.getByIdChain.chain.get(), true);
-        stubInfo->stubRoutine = MacroAssemblerCodeRef();
+        stubInfo->stubRoutine.clear();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
     case access_get_by_id_proto_list:
@@ -1814,7 +1826,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
     ASSERT(slot.slotBase().isObject());
     JSObject* slotBaseObject = asObject(slot.slotBase());
     
-    size_t offset = slot.cachedOffset();
+    PropertyOffset offset = slot.cachedOffset();
 
     if (slot.slotBase() == baseValue)
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
@@ -1928,7 +1940,12 @@ DEFINE_STUB_FUNCTION(void, optimize)
     unsigned bytecodeIndex = stackFrame.args[0].int32();
 
 #if ENABLE(JIT_VERBOSE_OSR)
-    dataLog("%p: Entered optimize with bytecodeIndex = %u, executeCounter = %s, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u\n", codeBlock, bytecodeIndex, codeBlock->jitExecuteCounter().status(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
+    dataLog("%p: Entered optimize with bytecodeIndex = %u, executeCounter = %s, reoptimizationRetryCounter = %u, optimizationDelayCounter = %u, exitCounter = ", codeBlock, bytecodeIndex, codeBlock->jitExecuteCounter().status(), codeBlock->reoptimizationRetryCounter(), codeBlock->optimizationDelayCounter());
+    if (codeBlock->hasOptimizedReplacement())
+        dataLog("%u", codeBlock->replacement()->osrExitCounter());
+    else
+        dataLog("N/A");
+    dataLog("\n");
 #endif
 
     if (!codeBlock->checkIfOptimizationThresholdReached()) {
@@ -1938,8 +1955,21 @@ DEFINE_STUB_FUNCTION(void, optimize)
 
     if (codeBlock->hasOptimizedReplacement()) {
 #if ENABLE(JIT_VERBOSE_OSR)
-        dataLog("Considering OSR into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
+        dataLog("Considering OSR into %p(%p).\n", codeBlock, codeBlock->replacement());
 #endif
+        // If we have an optimized replacement, then it must be the case that we entered
+        // cti_optimize from a loop. That's because is there's an optimized replacement,
+        // then all calls to this function will be relinked to the replacement and so
+        // the prologue OSR will never fire.
+        
+        // This is an interesting threshold check. Consider that a function OSR exits
+        // in the middle of a loop, while having a relatively low exit count. The exit
+        // will reset the execution counter to some target threshold, meaning that this
+        // code won't be reached until that loop heats up for >=1000 executions. But then
+        // we do a second check here, to see if we should either reoptimize, or just
+        // attempt OSR entry. Hence it might even be correct for
+        // shouldReoptimizeFromLoopNow() to always return true. But we make it do some
+        // additional checking anyway, to reduce the amount of recompilation thrashing.
         if (codeBlock->replacement()->shouldReoptimizeFromLoopNow()) {
 #if ENABLE(JIT_VERBOSE_OSR)
             dataLog("Triggering reoptimization of %p(%p) (in loop).\n", codeBlock, codeBlock->replacement());
@@ -1985,7 +2015,6 @@ DEFINE_STUB_FUNCTION(void, optimize)
 #endif
 
         codeBlock->optimizeSoon();
-        optimizedCodeBlock->countSpeculationSuccess();
         STUB_SET_RETURN_ADDRESS(address);
         return;
     }
@@ -1996,10 +2025,10 @@ DEFINE_STUB_FUNCTION(void, optimize)
 
     // Count the OSR failure as a speculation failure. If this happens a lot, then
     // reoptimize.
-    optimizedCodeBlock->countSpeculationFailure();
+    optimizedCodeBlock->countOSRExit();
     
 #if ENABLE(JIT_VERBOSE_OSR)
-    dataLog("Encountered OSR failure into %p(%p) with success/fail %u/%u.\n", codeBlock, codeBlock->replacement(), codeBlock->replacement()->speculativeSuccessCounter(), codeBlock->replacement()->speculativeFailCounter());
+    dataLog("Encountered OSR failure into %p(%p).\n", codeBlock, codeBlock->replacement());
 #endif
 
     // We are a lot more conservative about triggering reoptimization after OSR failure than
diff --git a/Source/JavaScriptCore/jit/JITStubs.h b/Source/JavaScriptCore/jit/JITStubs.h
index d2bc15e64..22a1dd773 100644
--- a/Source/JavaScriptCore/jit/JITStubs.h
+++ b/Source/JavaScriptCore/jit/JITStubs.h
@@ -190,8 +190,10 @@ namespace JSC {
         void* preservedR4;
         void* preservedR5;
         void* preservedR6;
-        void* preservedR7;
         void* preservedR8;
+        void* preservedR9;
+        void* preservedR10;
+        void* preservedR11;
         void* preservedLink;
 
         RegisterFile* registerFile;
diff --git a/Source/JavaScriptCore/jit/JSInterfaceJIT.h b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
index 05d1ce5ad..6b7dd2184 100644
--- a/Source/JavaScriptCore/jit/JSInterfaceJIT.h
+++ b/Source/JavaScriptCore/jit/JSInterfaceJIT.h
@@ -94,7 +94,7 @@ namespace JSC {
         static const FPRegisterID fpRegT1 = X86Registers::xmm1;
         static const FPRegisterID fpRegT2 = X86Registers::xmm2;
         static const FPRegisterID fpRegT3 = X86Registers::xmm3;
-#elif CPU(ARM_THUMB2)
+#elif CPU(ARM)
         static const RegisterID returnValueRegister = ARMRegisters::r0;
         static const RegisterID cachedResultRegister = ARMRegisters::r0;
         static const RegisterID firstArgumentRegister = ARMRegisters::r0;
@@ -107,35 +107,11 @@ namespace JSC {
         static const RegisterID regT1 = ARMRegisters::r1;
         static const RegisterID regT2 = ARMRegisters::r2;
         static const RegisterID regT3 = ARMRegisters::r4;
-        
+
+        // Update ctiTrampoline in JITStubs.cpp if these values are changed!
         static const RegisterID callFrameRegister = ARMRegisters::r5;
         static const RegisterID timeoutCheckRegister = ARMRegisters::r6;
-        
-        static const FPRegisterID fpRegT0 = ARMRegisters::d0;
-        static const FPRegisterID fpRegT1 = ARMRegisters::d1;
-        static const FPRegisterID fpRegT2 = ARMRegisters::d2;
-        static const FPRegisterID fpRegT3 = ARMRegisters::d3;
-#elif CPU(ARM_TRADITIONAL)
-        static const RegisterID returnValueRegister = ARMRegisters::r0;
-        static const RegisterID cachedResultRegister = ARMRegisters::r0;
-        static const RegisterID firstArgumentRegister = ARMRegisters::r0;
-        
-        static const RegisterID timeoutCheckRegister = ARMRegisters::r5;
-        static const RegisterID callFrameRegister = ARMRegisters::r4;
-        
-        static const RegisterID regT0 = ARMRegisters::r0;
-        static const RegisterID regT1 = ARMRegisters::r1;
-        static const RegisterID regT2 = ARMRegisters::r2;
-        // Callee preserved
-        static const RegisterID regT3 = ARMRegisters::r7;
-        
-        static const RegisterID regS0 = ARMRegisters::S0;
-        // Callee preserved
-        static const RegisterID regS1 = ARMRegisters::S1;
-        
-        static const RegisterID regStackPtr = ARMRegisters::sp;
-        static const RegisterID regLink = ARMRegisters::lr;
-        
+
         static const FPRegisterID fpRegT0 = ARMRegisters::d0;
         static const FPRegisterID fpRegT1 = ARMRegisters::d1;
         static const FPRegisterID fpRegT2 = ARMRegisters::d2;
diff --git a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
index c98e57d12..e17b45d94 100644
--- a/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
+++ b/Source/JavaScriptCore/jit/SpecializedThunkJIT.h
@@ -37,9 +37,7 @@ namespace JSC {
     class SpecializedThunkJIT : public JSInterfaceJIT {
     public:
         static const int ThisArgument = -1;
-        SpecializedThunkJIT(int expectedArgCount, JSGlobalData* globalData)
-            : m_expectedArgCount(expectedArgCount)
-            , m_globalData(globalData)
+        SpecializedThunkJIT(int expectedArgCount)
         {
             // Check that we have the expected number of arguments
             m_failures.append(branch32(NotEqual, payloadFor(RegisterFile::ArgumentCount), TrustedImm32(expectedArgCount + 1)));
@@ -166,8 +164,6 @@ namespace JSC {
 #endif
         }
         
-        int m_expectedArgCount;
-        JSGlobalData* m_globalData;
         MacroAssembler::JumpList m_failures;
         Vector<std::pair<Call, FunctionPtr> > m_calls;
     };
diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
index c440b5157..c6431c22d 100644
--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -75,7 +75,7 @@ static void charToString(SpecializedThunkJIT& jit, JSGlobalData* globalData, Mac
 
 MacroAssemblerCodeRef charCodeAtThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     stringCharLoad(jit);
     jit.returnInt32(SpecializedThunkJIT::regT0);
     return jit.finalize(*globalData, globalData->jitStubs->ctiNativeCall(), "charCodeAt");
@@ -83,7 +83,7 @@ MacroAssemblerCodeRef charCodeAtThunkGenerator(JSGlobalData* globalData)
 
 MacroAssemblerCodeRef charAtThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     stringCharLoad(jit);
     charToString(jit, globalData, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1);
     jit.returnJSCell(SpecializedThunkJIT::regT0);
@@ -92,7 +92,7 @@ MacroAssemblerCodeRef charAtThunkGenerator(JSGlobalData* globalData)
 
 MacroAssemblerCodeRef fromCharCodeThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     // load char code
     jit.loadInt32Argument(0, SpecializedThunkJIT::regT0);
     charToString(jit, globalData, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1);
@@ -102,7 +102,7 @@ MacroAssemblerCodeRef fromCharCodeThunkGenerator(JSGlobalData* globalData)
 
 MacroAssemblerCodeRef sqrtThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     if (!jit.supportsFloatingPointSqrt())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
 
@@ -182,7 +182,7 @@ static const double halfConstant = 0.5;
     
 MacroAssemblerCodeRef floorThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     MacroAssembler::Jump nonIntJump;
     if (!UnaryDoubleOpWrapper(floor) || !jit.supportsFloatingPoint())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
@@ -214,7 +214,7 @@ MacroAssemblerCodeRef floorThunkGenerator(JSGlobalData* globalData)
 
 MacroAssemblerCodeRef ceilThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     if (!UnaryDoubleOpWrapper(ceil) || !jit.supportsFloatingPoint())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     MacroAssembler::Jump nonIntJump;
@@ -233,7 +233,7 @@ MacroAssemblerCodeRef ceilThunkGenerator(JSGlobalData* globalData)
 
 MacroAssemblerCodeRef roundThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     if (!UnaryDoubleOpWrapper(jsRound) || !jit.supportsFloatingPoint())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     MacroAssembler::Jump nonIntJump;
@@ -269,7 +269,7 @@ MacroAssemblerCodeRef expThunkGenerator(JSGlobalData* globalData)
 {
     if (!UnaryDoubleOpWrapper(exp))
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     if (!jit.supportsFloatingPoint())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
@@ -282,7 +282,7 @@ MacroAssemblerCodeRef logThunkGenerator(JSGlobalData* globalData)
 {
     if (!UnaryDoubleOpWrapper(log))
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     if (!jit.supportsFloatingPoint())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
@@ -293,7 +293,7 @@ MacroAssemblerCodeRef logThunkGenerator(JSGlobalData* globalData)
 
 MacroAssemblerCodeRef absThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(1, globalData);
+    SpecializedThunkJIT jit(1);
     if (!jit.supportsFloatingPointAbs())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     MacroAssembler::Jump nonIntJump;
@@ -313,7 +313,7 @@ MacroAssemblerCodeRef absThunkGenerator(JSGlobalData* globalData)
 
 MacroAssemblerCodeRef powThunkGenerator(JSGlobalData* globalData)
 {
-    SpecializedThunkJIT jit(2, globalData);
+    SpecializedThunkJIT jit(2);
     if (!jit.supportsFloatingPoint())
         return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
 
diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
index f796333ca..43337e4ee 100644
--- a/Source/JavaScriptCore/jsc.cpp
+++ b/Source/JavaScriptCore/jsc.cpp
@@ -117,11 +117,13 @@ struct CommandLine {
     CommandLine()
         : interactive(false)
         , dump(false)
+        , exitCode(false)
     {
     }
 
     bool interactive;
     bool dump;
+    bool exitCode;
     Vector<Script> scripts;
     Vector<UString> arguments;
 };
@@ -299,7 +301,7 @@ EncodedJSValue JSC_HOST_CALL functionJSCStack(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL functionGC(ExecState* exec)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     exec->heap()->collectAllGarbage();
     return JSValue::encode(jsUndefined());
 }
@@ -307,7 +309,7 @@ EncodedJSValue JSC_HOST_CALL functionGC(ExecState* exec)
 #ifndef NDEBUG
 EncodedJSValue JSC_HOST_CALL functionReleaseExecutableMemory(ExecState* exec)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     exec->globalData().releaseExecutableMemory();
     return JSValue::encode(jsUndefined());
 }
@@ -611,6 +613,12 @@ static NO_RETURN void printUsageStatement(bool help = false)
 #if HAVE(SIGNAL_H)
     fprintf(stderr, "  -s         Installs signal handlers that exit on a crash (Unix platforms only)\n");
 #endif
+    fprintf(stderr, "  -x         Output exit code before terminating\n");
+    fprintf(stderr, "\n");
+    fprintf(stderr, "  --options                  Dumps all JSC VM options and exits\n");
+    fprintf(stderr, "  --dumpOptions              Dumps all JSC VM options before continuing\n");
+    fprintf(stderr, "  --<jsc VM option>=<value>  Sets the specified JSC VM option\n");
+    fprintf(stderr, "\n");
 
     exit(help ? EXIT_SUCCESS : EXIT_FAILURE);
 }
@@ -618,6 +626,9 @@ static NO_RETURN void printUsageStatement(bool help = false)
 static void parseArguments(int argc, char** argv, CommandLine& options)
 {
     int i = 1;
+    bool needToDumpOptions = false;
+    bool needToExit = false;
+
     for (; i < argc; ++i) {
         const char* arg = argv[i];
         if (!strcmp(arg, "-f")) {
@@ -649,12 +660,36 @@ static void parseArguments(int argc, char** argv, CommandLine& options)
 #endif
             continue;
         }
+        if (!strcmp(arg, "-x")) {
+            options.exitCode = true;
+            continue;
+        }
         if (!strcmp(arg, "--")) {
             ++i;
             break;
         }
         if (!strcmp(arg, "-h") || !strcmp(arg, "--help"))
             printUsageStatement(true);
+
+        if (!strcmp(arg, "--options")) {
+            needToDumpOptions = true;
+            needToExit = true;
+            continue;
+        }
+        if (!strcmp(arg, "--dumpOptions")) {
+            needToDumpOptions = true;
+            continue;
+        }
+
+        // See if the -- option is a JSC VM option.
+        // NOTE: At this point, we know that the arg starts with "--". Skip it.
+        if (JSC::Options::setOption(&arg[2])) {
+            // The arg was recognized as a VM option and has been parsed.
+            continue; // Just continue with the next arg. 
+        }
+
+        // This arg is not recognized by the VM nor by jsc. Pass it on to the
+        // script.
         options.scripts.append(Script(true, argv[i]));
     }
 
@@ -663,13 +698,18 @@ static void parseArguments(int argc, char** argv, CommandLine& options)
 
     for (; i < argc; ++i)
         options.arguments.append(argv[i]);
+
+    if (needToDumpOptions)
+        JSC::Options::dumpAllOptions(stderr);
+    if (needToExit)
+        exit(EXIT_SUCCESS);
 }
 
 int jscmain(int argc, char** argv)
 {
-    JSLock lock(SilenceAssertionsOnly);
-
     RefPtr<JSGlobalData> globalData = JSGlobalData::create(ThreadStackTypeLarge, LargeHeap);
+    JSLockHolder lock(globalData.get());
+    int result;
 
     CommandLine options;
     parseArguments(argc, argv, options);
@@ -679,7 +719,12 @@ int jscmain(int argc, char** argv)
     if (options.interactive && success)
         runInteractive(globalObject);
 
-    return success ? 0 : 3;
+    result = success ? 0 : 3;
+
+    if (options.exitCode)
+        printf("jsc exiting %d\n", result);
+
+    return result;
 }
 
 static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>& buffer)
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index a7698be37..fbc0146b8 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -895,7 +895,13 @@ LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
             && !structure->typeInfo().prohibitsPropertyCaching()) {
             pc[4].u.structure.set(
                 globalData, codeBlock->ownerExecutable(), structure);
-            pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
+            if (isInlineOffset(slot.cachedOffset())) {
+                pc[0].u.opcode = bitwise_cast<void*>(&llint_op_get_by_id);
+                pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
+            } else {
+                pc[0].u.opcode = bitwise_cast<void*>(&llint_op_get_by_id_out_of_line);
+                pc[5].u.operand = offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue);
+            }
         }
     }
 
@@ -940,7 +946,7 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
             && baseCell == slot.base()) {
             
             if (slot.type() == PutPropertySlot::NewProperty) {
-                if (!structure->isDictionary() && structure->previousID()->propertyStorageCapacity() == structure->propertyStorageCapacity()) {
+                if (!structure->isDictionary() && structure->previousID()->outOfLineCapacity() == structure->outOfLineCapacity()) {
                     ASSERT(structure->previousID()->transitionWatchpointSetHasBeenInvalidated());
                     
                     // This is needed because some of the methods we call
@@ -952,7 +958,10 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
                     ASSERT(structure->previousID()->isObject());
                     pc[4].u.structure.set(
                         globalData, codeBlock->ownerExecutable(), structure->previousID());
-                    pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
+                    if (isInlineOffset(slot.cachedOffset()))
+                        pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
+                    else
+                        pc[5].u.operand = offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue);
                     pc[6].u.structure.set(
                         globalData, codeBlock->ownerExecutable(), structure);
                     StructureChain* chain = structure->prototypeChain(exec);
@@ -960,16 +969,28 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
                     pc[7].u.structureChain.set(
                         globalData, codeBlock->ownerExecutable(), chain);
                     
-                    if (pc[8].u.operand)
-                        pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_direct);
-                    else
-                        pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_normal);
+                    if (pc[8].u.operand) {
+                        if (isInlineOffset(slot.cachedOffset()))
+                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_direct);
+                        else
+                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_direct_out_of_line);
+                    } else {
+                        if (isInlineOffset(slot.cachedOffset()))
+                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_normal);
+                        else
+                            pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_transition_normal_out_of_line);
+                    }
                 }
             } else {
-                pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
                 pc[4].u.structure.set(
                     globalData, codeBlock->ownerExecutable(), structure);
-                pc[5].u.operand = slot.cachedOffset() * sizeof(JSValue);
+                if (isInlineOffset(slot.cachedOffset())) {
+                    pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id);
+                    pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
+                } else {
+                    pc[0].u.opcode = bitwise_cast<void*>(&llint_op_put_by_id_out_of_line);
+                    pc[5].u.operand = offsetInOutOfLineStorage(slot.cachedOffset()) * sizeof(JSValue);
+                }
             }
         }
     }
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index e59ddeba4..492535bb2 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -84,6 +84,13 @@ const LLIntReturnPC = ArgumentCount + TagOffset
 # String flags.
 const HashFlags8BitBuffer = 64
 
+# Property storage constants
+if JSVALUE64
+    const InlineStorageCapacity = 4
+else
+    const InlineStorageCapacity = 6
+end
+
 # Allocation constants
 if JSVALUE64
     const JSFinalObjectSizeClassIndex = 1
@@ -312,8 +319,7 @@ macro allocateBasicJSObject(sizeClassIndex, classInfoOffset, structure, result,
         storep scratch2, [result]
         storep structure, JSCell::m_structure[result]
         storep 0, JSObject::m_inheritorID[result]
-        addp sizeof JSObject, result, scratch1
-        storep scratch1, JSObject::m_propertyStorage[result]
+        storep 0, JSObject::m_outOfLineStorage[result]
     end
 end
 
@@ -481,6 +487,21 @@ _llint_op_resolve_with_this:
     dispatch(5)
 
 
+macro withInlineStorage(object, propertyStorage, continuation)
+    # Indicate that the object is the property storage, and that the
+    # property storage register is unused.
+    continuation(object, propertyStorage)
+end
+
+macro withOutOfLineStorage(object, propertyStorage, continuation)
+    loadp JSObject::m_outOfLineStorage[object], propertyStorage
+    # Indicate that the propertyStorage register now points to the
+    # property storage, and that the object register may be reused
+    # if the object pointer is not needed anymore.
+    continuation(propertyStorage, object)
+end
+
+
 _llint_op_del_by_id:
     traceExecution()
     callSlowPath(_llint_slow_path_del_by_id)
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index d27fd8229..9d6304de7 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -919,6 +919,24 @@ _llint_op_is_string:
     dispatch(3)
 
 
+macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffset, objectAndStorage, tag, payload)
+    assert(macro (ok) bigteq propertyOffset, InlineStorageCapacity, ok end)
+    loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    loadi TagOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], payload
+end
+
+macro loadPropertyAtVariableOffset(propertyOffset, objectAndStorage, tag, payload)
+    bilt propertyOffset, InlineStorageCapacity, .isInline
+    loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    jmp .ready
+.isInline:
+    addp JSFinalObject::m_inlineStorage + InlineStorageCapacity * 8, objectAndStorage
+.ready:
+    loadi TagOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], tag
+    loadi PayloadOffset - 8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], payload
+end
+
 macro resolveGlobal(size, slow)
     # Operands are as follows:
     # 4[PC]   Destination for the load.
@@ -930,9 +948,7 @@ macro resolveGlobal(size, slow)
     loadp JSCell::m_structure[t0], t1
     bpneq t1, 12[PC], slow
     loadi 16[PC], t1
-    loadp JSObject::m_propertyStorage[t0], t0
-    loadi TagOffset[t0, t1, 8], t2
-    loadi PayloadOffset[t0, t1, 8], t3
+    loadPropertyAtVariableOffsetKnownNotFinal(t1, t0, t2, t3)
     loadi 4[PC], t0
     storei t2, TagOffset[cfr, t0, 8]
     storei t3, PayloadOffset[cfr, t0, 8]
@@ -1087,31 +1103,44 @@ _llint_op_put_global_var_check:
     dispatch(5)
 
 
-_llint_op_get_by_id:
+# We only do monomorphic get_by_id caching for now, and we do not modify the
+# opcode. We do, however, allow for the cache to change anytime if fails, since
+# ping-ponging is free. At best we get lucky and the get_by_id will continue
+# to take fast path on the new cache. At worst we take slow path, which is what
+# we would have been doing anyway.
+
+macro getById(getPropertyStorage)
     traceExecution()
-    # We only do monomorphic get_by_id caching for now, and we do not modify the
-    # opcode. We do, however, allow for the cache to change anytime if fails, since
-    # ping-ponging is free. At best we get lucky and the get_by_id will continue
-    # to take fast path on the new cache. At worst we take slow path, which is what
-    # we would have been doing anyway.
     loadi 8[PC], t0
     loadi 16[PC], t1
     loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdSlow)
     loadi 20[PC], t2
-    loadp JSObject::m_propertyStorage[t3], t0
-    bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
-    loadi 4[PC], t1
-    loadi TagOffset[t0, t2], t3
-    loadi PayloadOffset[t0, t2], t2
-    storei t3, TagOffset[cfr, t1, 8]
-    storei t2, PayloadOffset[cfr, t1, 8]
-    loadi 32[PC], t1
-    valueProfile(t3, t2, t1)
-    dispatch(9)
+    getPropertyStorage(
+        t3,
+        t0,
+        macro (propertyStorage, scratch)
+            bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
+            loadi 4[PC], t1
+            loadi TagOffset[propertyStorage, t2], scratch
+            loadi PayloadOffset[propertyStorage, t2], t2
+            storei scratch, TagOffset[cfr, t1, 8]
+            storei t2, PayloadOffset[cfr, t1, 8]
+            loadi 32[PC], t1
+            valueProfile(scratch, t2, t1)
+            dispatch(9)
+        end)
+
+    .opGetByIdSlow:
+        callSlowPath(_llint_slow_path_get_by_id)
+        dispatch(9)
+end
+
+_llint_op_get_by_id:
+    getById(withInlineStorage)
 
-.opGetByIdSlow:
-    callSlowPath(_llint_slow_path_get_by_id)
-    dispatch(9)
+
+_llint_op_get_by_id_out_of_line:
+    getById(withOutOfLineStorage)
 
 
 _llint_op_get_arguments_length:
@@ -1130,68 +1159,96 @@ _llint_op_get_arguments_length:
     dispatch(4)
 
 
-_llint_op_put_by_id:
+macro putById(getPropertyStorage)
     traceExecution()
     loadi 4[PC], t3
     loadi 16[PC], t1
     loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
     loadi 12[PC], t2
-    loadp JSObject::m_propertyStorage[t0], t3
-    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
-    loadi 20[PC], t1
-    loadConstantOrVariable2Reg(t2, t0, t2)
-    writeBarrier(t0, t2)
-    storei t0, TagOffset[t3, t1]
-    storei t2, PayloadOffset[t3, t1]
-    dispatch(9)
+    getPropertyStorage(
+        t0,
+        t3,
+        macro (propertyStorage, scratch)
+            bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+            loadi 20[PC], t1
+            loadConstantOrVariable2Reg(t2, scratch, t2)
+            writeBarrier(scratch, t2)
+            storei scratch, TagOffset[propertyStorage, t1]
+            storei t2, PayloadOffset[propertyStorage, t1]
+            dispatch(9)
+        end)
+end
+
+_llint_op_put_by_id:
+    putById(withInlineStorage)
 
 .opPutByIdSlow:
     callSlowPath(_llint_slow_path_put_by_id)
     dispatch(9)
 
 
-macro putByIdTransition(additionalChecks)
+_llint_op_put_by_id_out_of_line:
+    putById(withOutOfLineStorage)
+
+
+macro putByIdTransition(additionalChecks, getPropertyStorage)
     traceExecution()
     loadi 4[PC], t3
     loadi 16[PC], t1
     loadConstantOrVariablePayload(t3, CellTag, t0, .opPutByIdSlow)
     loadi 12[PC], t2
     bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
-    additionalChecks(t1, t3, .opPutByIdSlow)
+    additionalChecks(t1, t3)
     loadi 20[PC], t1
-    loadp JSObject::m_propertyStorage[t0], t3
-    addp t1, t3
-    loadConstantOrVariable2Reg(t2, t1, t2)
-    writeBarrier(t1, t2)
-    storei t1, TagOffset[t3]
-    loadi 24[PC], t1
-    storei t2, PayloadOffset[t3]
-    storep t1, JSCell::m_structure[t0]
-    dispatch(9)
+    getPropertyStorage(
+        t0,
+        t3,
+        macro (propertyStorage, scratch)
+            addp t1, propertyStorage, t3
+            loadConstantOrVariable2Reg(t2, t1, t2)
+            writeBarrier(t1, t2)
+            storei t1, TagOffset[t3]
+            loadi 24[PC], t1
+            storei t2, PayloadOffset[t3]
+            storep t1, JSCell::m_structure[t0]
+            dispatch(9)
+        end)
+end
+
+macro noAdditionalChecks(oldStructure, scratch)
+end
+
+macro structureChainChecks(oldStructure, scratch)
+    const protoCell = oldStructure   # Reusing the oldStructure register for the proto
+
+    loadp 28[PC], scratch
+    assert(macro (ok) btpnz scratch, ok end)
+    loadp StructureChain::m_vector[scratch], scratch
+    assert(macro (ok) btpnz scratch, ok end)
+    bieq Structure::m_prototype + TagOffset[oldStructure], NullTag, .done
+.loop:
+    loadi Structure::m_prototype + PayloadOffset[oldStructure], protoCell
+    loadp JSCell::m_structure[protoCell], oldStructure
+    bpneq oldStructure, [scratch], .opPutByIdSlow
+    addp 4, scratch
+    bineq Structure::m_prototype + TagOffset[oldStructure], NullTag, .loop
+.done:
 end
 
 _llint_op_put_by_id_transition_direct:
-    putByIdTransition(macro (oldStructure, scratch, slow) end)
+    putByIdTransition(noAdditionalChecks, withInlineStorage)
+
+
+_llint_op_put_by_id_transition_direct_out_of_line:
+    putByIdTransition(noAdditionalChecks, withOutOfLineStorage)
 
 
 _llint_op_put_by_id_transition_normal:
-    putByIdTransition(
-        macro (oldStructure, scratch, slow)
-            const protoCell = oldStructure   # Reusing the oldStructure register for the proto
-        
-            loadp 28[PC], scratch
-            assert(macro (ok) btpnz scratch, ok end)
-            loadp StructureChain::m_vector[scratch], scratch
-            assert(macro (ok) btpnz scratch, ok end)
-            bieq Structure::m_prototype + TagOffset[oldStructure], NullTag, .done
-        .loop:
-            loadi Structure::m_prototype + PayloadOffset[oldStructure], protoCell
-            loadp JSCell::m_structure[protoCell], oldStructure
-            bpneq oldStructure, [scratch], slow
-            addp 4, scratch
-            bineq Structure::m_prototype + TagOffset[oldStructure], NullTag, .loop
-        .done:
-        end)
+    putByIdTransition(structureChainChecks, withInlineStorage)
+
+
+_llint_op_put_by_id_transition_normal_out_of_line:
+    putByIdTransition(structureChainChecks, withOutOfLineStorage)
 
 
 _llint_op_get_by_val:
@@ -1261,9 +1318,8 @@ _llint_op_get_by_pname:
     loadi [cfr, t0, 8], t0
     subi 1, t0
     biaeq t0, JSPropertyNameIterator::m_numCacheableSlots[t3], .opGetByPnameSlow
-    loadp JSObject::m_propertyStorage[t2], t2
-    loadi TagOffset[t2, t0, 8], t1
-    loadi PayloadOffset[t2, t0, 8], t3
+    addi JSPropertyNameIterator::m_offsetBase[t3], t0
+    loadPropertyAtVariableOffset(t0, t2, t1, t3)
     loadi 4[PC], t0
     storei t1, TagOffset[cfr, t0, 8]
     storei t3, PayloadOffset[cfr, t0, 8]
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index a153586f4..a7a2ce88f 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -778,6 +778,22 @@ _llint_op_is_string:
     dispatch(3)
 
 
+macro loadPropertyAtVariableOffsetKnownNotFinal(propertyOffset, objectAndStorage, value)
+    assert(macro (ok) bigteq propertyOffset, InlineStorageCapacity, ok end)
+    loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    loadp -8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], value
+end
+
+macro loadPropertyAtVariableOffset(propertyOffset, objectAndStorage, value)
+    bilt propertyOffset, InlineStorageCapacity, .isInline
+    loadp JSObject::m_outOfLineStorage[objectAndStorage], objectAndStorage
+    jmp .ready
+.isInline:
+    addp JSFinalObject::m_inlineStorage + InlineStorageCapacity * 8, objectAndStorage
+.ready:
+    loadp -8 * InlineStorageCapacity[objectAndStorage, propertyOffset, 8], value
+end
+
 macro resolveGlobal(size, slow)
     # Operands are as follows:
     # 8[PB, PC, 8]   Destination for the load.
@@ -789,8 +805,7 @@ macro resolveGlobal(size, slow)
     loadp JSCell::m_structure[t0], t1
     bpneq t1, 24[PB, PC, 8], slow
     loadis 32[PB, PC, 8], t1
-    loadp JSObject::m_propertyStorage[t0], t0
-    loadp [t0, t1, 8], t2
+    loadPropertyAtVariableOffset(t1, t0, t2)
     loadis 8[PB, PC, 8], t0
     storep t2, [cfr, t0, 8]
     loadp (size - 1) * 8[PB, PC, 8], t0
@@ -937,7 +952,7 @@ _llint_op_put_global_var_check:
     dispatch(5)
 
 
-_llint_op_get_by_id:
+macro getById(getPropertyStorage)
     traceExecution()
     # We only do monomorphic get_by_id caching for now, and we do not modify the
     # opcode. We do, however, allow for the cache to change anytime if fails, since
@@ -948,18 +963,30 @@ _llint_op_get_by_id:
     loadp 32[PB, PC, 8], t1
     loadConstantOrVariableCell(t0, t3, .opGetByIdSlow)
     loadis 40[PB, PC, 8], t2
-    loadp JSObject::m_propertyStorage[t3], t0
-    bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
-    loadis 8[PB, PC, 8], t1
-    loadp [t0, t2], t3
-    storep t3, [cfr, t1, 8]
-    loadp 64[PB, PC, 8], t1
-    valueProfile(t3, t1)
-    dispatch(9)
+    getPropertyStorage(
+        t3,
+        t0,
+        macro (propertyStorage, scratch)
+            bpneq JSCell::m_structure[t3], t1, .opGetByIdSlow
+            loadis 8[PB, PC, 8], t1
+            loadp [propertyStorage, t2], scratch
+            storep scratch, [cfr, t1, 8]
+            loadp 64[PB, PC, 8], t1
+            valueProfile(scratch, t1)
+            dispatch(9)
+        end)
+            
+    .opGetByIdSlow:
+        callSlowPath(_llint_slow_path_get_by_id)
+        dispatch(9)
+end
+
+_llint_op_get_by_id:
+    getById(withInlineStorage)
 
-.opGetByIdSlow:
-    callSlowPath(_llint_slow_path_get_by_id)
-    dispatch(9)
+
+_llint_op_get_by_id_out_of_line:
+    getById(withOutOfLineStorage)
 
 
 _llint_op_get_arguments_length:
@@ -978,65 +1005,93 @@ _llint_op_get_arguments_length:
     dispatch(4)
 
 
-_llint_op_put_by_id:
+macro putById(getPropertyStorage)
     traceExecution()
     loadis 8[PB, PC, 8], t3
     loadp 32[PB, PC, 8], t1
     loadConstantOrVariableCell(t3, t0, .opPutByIdSlow)
     loadis 24[PB, PC, 8], t2
-    loadp JSObject::m_propertyStorage[t0], t3
-    bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
-    loadis 40[PB, PC, 8], t1
-    loadConstantOrVariable(t2, t0)
-    writeBarrier(t0)
-    storep t0, [t3, t1]
-    dispatch(9)
+    getPropertyStorage(
+        t0,
+        t3,
+        macro (propertyStorage, scratch)
+            bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
+            loadis 40[PB, PC, 8], t1
+            loadConstantOrVariable(t2, scratch)
+            writeBarrier(t0)
+            storep scratch, [propertyStorage, t1]
+            dispatch(9)
+        end)
+end
+
+_llint_op_put_by_id:
+    putById(withInlineStorage)
 
 .opPutByIdSlow:
     callSlowPath(_llint_slow_path_put_by_id)
     dispatch(9)
 
 
-macro putByIdTransition(additionalChecks)
+_llint_op_put_by_id_out_of_line:
+    putById(withOutOfLineStorage)
+
+
+macro putByIdTransition(additionalChecks, getPropertyStorage)
     traceExecution()
     loadis 8[PB, PC, 8], t3
     loadp 32[PB, PC, 8], t1
     loadConstantOrVariableCell(t3, t0, .opPutByIdSlow)
     loadis 24[PB, PC, 8], t2
     bpneq JSCell::m_structure[t0], t1, .opPutByIdSlow
-    additionalChecks(t1, t3, .opPutByIdSlow)
+    additionalChecks(t1, t3)
     loadis 40[PB, PC, 8], t1
-    loadp JSObject::m_propertyStorage[t0], t3
-    addp t1, t3
-    loadConstantOrVariable(t2, t1)
-    writeBarrier(t1)
-    storep t1, [t3]
-    loadp 48[PB, PC, 8], t1
-    storep t1, JSCell::m_structure[t0]
-    dispatch(9)
+    getPropertyStorage(
+        t0,
+        t3,
+        macro (propertyStorage, scratch)
+            addp t1, propertyStorage, t3
+            loadConstantOrVariable(t2, t1)
+            writeBarrier(t1)
+            storep t1, [t3]
+            loadp 48[PB, PC, 8], t1
+            storep t1, JSCell::m_structure[t0]
+            dispatch(9)
+        end)
+end
+
+macro noAdditionalChecks(oldStructure, scratch)
+end
+
+macro structureChainChecks(oldStructure, scratch)
+    const protoCell = oldStructure    # Reusing the oldStructure register for the proto
+    loadp 56[PB, PC, 8], scratch
+    assert(macro (ok) btpnz scratch, ok end)
+    loadp StructureChain::m_vector[scratch], scratch
+    assert(macro (ok) btpnz scratch, ok end)
+    bpeq Structure::m_prototype[oldStructure], ValueNull, .done
+.loop:
+    loadp Structure::m_prototype[oldStructure], protoCell
+    loadp JSCell::m_structure[protoCell], oldStructure
+    bpneq oldStructure, [scratch], .opPutByIdSlow
+    addp 8, scratch
+    bpneq Structure::m_prototype[oldStructure], ValueNull, .loop
+.done:
 end
 
 _llint_op_put_by_id_transition_direct:
-    putByIdTransition(macro (oldStructure, scratch, slow) end)
+    putByIdTransition(noAdditionalChecks, withInlineStorage)
+
+
+_llint_op_put_by_id_transition_direct_out_of_line:
+    putByIdTransition(noAdditionalChecks, withOutOfLineStorage)
 
 
 _llint_op_put_by_id_transition_normal:
-    putByIdTransition(
-        macro (oldStructure, scratch, slow)
-            const protoCell = oldStructure    # Reusing the oldStructure register for the proto
-            loadp 56[PB, PC, 8], scratch
-            assert(macro (ok) btpnz scratch, ok end)
-            loadp StructureChain::m_vector[scratch], scratch
-            assert(macro (ok) btpnz scratch, ok end)
-            bpeq Structure::m_prototype[oldStructure], ValueNull, .done
-        .loop:
-            loadp Structure::m_prototype[oldStructure], protoCell
-            loadp JSCell::m_structure[protoCell], oldStructure
-            bpneq oldStructure, [scratch], slow
-            addp 8, scratch
-            bpneq Structure::m_prototype[oldStructure], ValueNull, .loop
-        .done:
-        end)
+    putByIdTransition(structureChainChecks, withInlineStorage)
+
+
+_llint_op_put_by_id_transition_normal_out_of_line:
+    putByIdTransition(structureChainChecks, withOutOfLineStorage)
 
 
 _llint_op_get_by_val:
@@ -1106,8 +1161,8 @@ _llint_op_get_by_pname:
     loadi PayloadOffset[cfr, t3, 8], t3
     subi 1, t3
     biaeq t3, JSPropertyNameIterator::m_numCacheableSlots[t1], .opGetByPnameSlow
-    loadp JSObject::m_propertyStorage[t0], t0
-    loadp [t0, t3, 8], t0
+    addi JSPropertyNameIterator::m_offsetBase[t1], t3
+    loadPropertyAtVariableOffset(t3, t0, t0)
     loadis 8[PB, PC, 8], t1
     storep t0, [cfr, t1, 8]
     dispatch(7)
diff --git a/Source/JavaScriptCore/offlineasm/x86.rb b/Source/JavaScriptCore/offlineasm/x86.rb
index e6a5c92ca..383526b25 100644
--- a/Source/JavaScriptCore/offlineasm/x86.rb
+++ b/Source/JavaScriptCore/offlineasm/x86.rb
@@ -555,7 +555,11 @@ class Instruction
     end
     
     def handleX86Add(kind)
-        if operands.size == 3 and operands[0].is_a? Immediate
+        if operands.size == 3 and operands[1] == operands[2]
+            unless Immediate.new(nil, 0) == operands[0]
+                $asm.puts "add#{x86Suffix(kind)} #{operands[0].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
+            end
+        elsif operands.size == 3 and operands[0].is_a? Immediate
             raise unless operands[1].is_a? RegisterID
             raise unless operands[2].is_a? RegisterID
             if operands[0].value == 0
@@ -568,7 +572,11 @@ class Instruction
         elsif operands.size == 3 and operands[0].is_a? RegisterID
             raise unless operands[1].is_a? RegisterID
             raise unless operands[2].is_a? RegisterID
-            $asm.puts "lea#{x86Suffix(kind)} (#{operands[0].x86Operand(kind)}, #{operands[1].x86Operand(kind)}), #{operands[2].x86Operand(kind)}"
+            if operands[0] == operands[2]
+                $asm.puts "add#{x86Suffix(kind)} #{operands[1].x86Operand(kind)}, #{operands[2].x86Operand(kind)}"
+            else
+                $asm.puts "lea#{x86Suffix(kind)} (#{operands[0].x86Operand(kind)}, #{operands[1].x86Operand(kind)}), #{operands[2].x86Operand(kind)}"
+            end
         else
             unless Immediate.new(nil, 0) == operands[0]
                 $asm.puts "add#{x86Suffix(kind)} #{x86Operands(kind, kind)}"
diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
index 0eb60cf89..d4c170617 100644
--- a/Source/JavaScriptCore/parser/ASTBuilder.h
+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
@@ -247,11 +247,11 @@ public:
         return new (m_globalData) ConditionalNode(lineNumber, condition, lhs, rhs);
     }
 
-    ExpressionNode* createAssignResolve(int lineNumber, const Identifier& ident, ExpressionNode* rhs, bool rhsHasAssignment, int start, int divot, int end)
+    ExpressionNode* createAssignResolve(int lineNumber, const Identifier& ident, ExpressionNode* rhs, int start, int divot, int end)
     {
         if (rhs->isFuncExprNode())
             static_cast<FuncExprNode*>(rhs)->body()->setInferredName(ident);
-        AssignResolveNode* node = new (m_globalData) AssignResolveNode(lineNumber, ident, rhs, rhsHasAssignment);
+        AssignResolveNode* node = new (m_globalData) AssignResolveNode(lineNumber, ident, rhs);
         setExceptionLocation(node, start, divot, end);
         return node;
     }
@@ -347,9 +347,9 @@ public:
         return result;
     }
 
-    StatementNode* createForLoop(int lineNumber, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, bool b, int start, int end)
+    StatementNode* createForLoop(int lineNumber, ExpressionNode* initializer, ExpressionNode* condition, ExpressionNode* iter, StatementNode* statements, int start, int end)
     {
-        ForNode* result = new (m_globalData) ForNode(lineNumber, initializer, condition, iter, statements, b);
+        ForNode* result = new (m_globalData) ForNode(lineNumber, initializer, condition, iter, statements);
         result->setLoc(start, end);
         return result;
     }
@@ -364,7 +364,7 @@ public:
 
     StatementNode* createForInLoop(int lineNumber, ExpressionNode* lhs, ExpressionNode* iter, StatementNode* statements, int eStart, int eDivot, int eEnd, int start, int end)
     {
-        ForInNode* result = new (m_globalData) ForInNode(m_globalData, lineNumber, lhs, iter, statements);
+        ForInNode* result = new (m_globalData) ForInNode(lineNumber, lhs, iter, statements);
         result->setLoc(start, end);
         setExceptionLocation(result, eStart, eDivot, eEnd);
         return result;
@@ -907,14 +907,14 @@ ExpressionNode* ASTBuilder::makeBinaryNode(int lineNumber, int token, pair<Expre
 ExpressionNode* ASTBuilder::makeAssignNode(int lineNumber, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new (m_globalData) AssignErrorNode(lineNumber, loc, op, expr, divot, divot - start, end - divot);
+        return new (m_globalData) AssignErrorNode(lineNumber, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
             if (expr->isFuncExprNode())
                 static_cast<FuncExprNode*>(expr)->body()->setInferredName(resolve->identifier());
-            AssignResolveNode* node = new (m_globalData) AssignResolveNode(lineNumber, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (m_globalData) AssignResolveNode(lineNumber, resolve->identifier(), expr);
             setExceptionLocation(node, start, divot, end);
             return node;
         }
@@ -944,7 +944,7 @@ ExpressionNode* ASTBuilder::makeAssignNode(int lineNumber, ExpressionNode* loc,
 ExpressionNode* ASTBuilder::makePrefixNode(int lineNumber, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (m_globalData) PrefixErrorNode(lineNumber, expr, op, divot, divot - start, end - divot);
+        return new (m_globalData) PrefixErrorNode(lineNumber, op, divot, divot - start, end - divot);
 
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
@@ -966,7 +966,7 @@ ExpressionNode* ASTBuilder::makePrefixNode(int lineNumber, ExpressionNode* expr,
 ExpressionNode* ASTBuilder::makePostfixNode(int lineNumber, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new (m_globalData) PostfixErrorNode(lineNumber, expr, op, divot, divot - start, end - divot);
+        return new (m_globalData) PostfixErrorNode(lineNumber, op, divot, divot - start, end - divot);
 
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
index e496d2342..be50eeafe 100644
--- a/Source/JavaScriptCore/parser/NodeConstructors.h
+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
@@ -317,10 +317,9 @@ namespace JSC {
     {
     }
 
-    inline PostfixErrorNode::PostfixErrorNode(int lineNumber, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+    inline PostfixErrorNode::PostfixErrorNode(int lineNumber, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
         : ExpressionNode(lineNumber)
         , ThrowableSubExpressionData(divot, startOffset, endOffset)
-        , m_expr(expr)
         , m_operator(oper)
     {
     }
@@ -396,10 +395,9 @@ namespace JSC {
     {
     }
 
-    inline PrefixErrorNode::PrefixErrorNode(int lineNumber, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+    inline PrefixErrorNode::PrefixErrorNode(int lineNumber, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
         : ExpressionNode(lineNumber)
         , ThrowableExpressionData(divot, startOffset, endOffset)
-        , m_expr(expr)
         , m_operator(oper)
     {
     }
@@ -592,11 +590,10 @@ namespace JSC {
     {
     }
 
-    inline AssignResolveNode::AssignResolveNode(int lineNumber, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments)
+    inline AssignResolveNode::AssignResolveNode(int lineNumber, const Identifier& ident, ExpressionNode* right)
         : ExpressionNode(lineNumber)
         , m_ident(ident)
         , m_right(right)
-        , m_rightHasAssignments(rightHasAssignments)
     {
     }
 
@@ -644,12 +641,9 @@ namespace JSC {
     {
     }
 
-    inline AssignErrorNode::AssignErrorNode(int lineNumber, ExpressionNode* left, Operator oper, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset)
+    inline AssignErrorNode::AssignErrorNode(int lineNumber, unsigned divot, unsigned startOffset, unsigned endOffset)
         : ExpressionNode(lineNumber)
         , ThrowableExpressionData(divot, startOffset, endOffset)
-        , m_left(left)
-        , m_operator(oper)
-        , m_right(right)
     {
     }
 
@@ -719,13 +713,12 @@ namespace JSC {
     {
     }
 
-    inline ForNode::ForNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl)
+    inline ForNode::ForNode(int lineNumber, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement)
         : StatementNode(lineNumber)
         , m_expr1(expr1)
         , m_expr2(expr2)
         , m_expr3(expr3)
         , m_statement(statement)
-        , m_expr1WasVarDecl(expr1 && expr1WasVarDecl)
     {
         ASSERT(statement);
     }
@@ -865,9 +858,8 @@ namespace JSC {
     {
     }
 
-    inline ForInNode::ForInNode(JSGlobalData* globalData, int lineNumber, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
+    inline ForInNode::ForInNode(int lineNumber, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
         : StatementNode(lineNumber)
-        , m_ident(globalData->propertyNames->nullIdentifier)
         , m_init(0)
         , m_lexpr(l)
         , m_expr(expr)
@@ -878,7 +870,6 @@ namespace JSC {
 
     inline ForInNode::ForInNode(JSGlobalData* globalData, int lineNumber, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
         : StatementNode(lineNumber)
-        , m_ident(ident)
         , m_init(0)
         , m_lexpr(new (globalData) ResolveNode(lineNumber, ident, divot - startOffset))
         , m_expr(expr)
@@ -886,7 +877,7 @@ namespace JSC {
         , m_identIsVarDecl(true)
     {
         if (in) {
-            AssignResolveNode* node = new (globalData) AssignResolveNode(lineNumber, ident, in, true);
+            AssignResolveNode* node = new (globalData) AssignResolveNode(lineNumber, ident, in);
             node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
             m_init = node;
         }
diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
index 5c90bb9fe..5b15be44c 100644
--- a/Source/JavaScriptCore/parser/Nodes.h
+++ b/Source/JavaScriptCore/parser/Nodes.h
@@ -546,8 +546,6 @@ namespace JSC {
 
         const Identifier& m_ident;
         ArgumentsNode* m_args;
-        size_t m_index; // Used by LocalVarFunctionCallNode.
-        size_t m_scopeDepth; // Used by ScopedVarFunctionCallNode and NonLocalVarFunctionCallNode
     };
     
     class FunctionCallBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
@@ -635,12 +633,11 @@ namespace JSC {
 
     class PostfixErrorNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixErrorNode(int, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PostfixErrorNode(int, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
@@ -754,12 +751,11 @@ namespace JSC {
 
     class PrefixErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrefixErrorNode(int, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
+        PrefixErrorNode(int, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
@@ -1004,22 +1000,19 @@ namespace JSC {
 
         const Identifier& m_ident;
         ExpressionNode* m_right;
-        size_t m_index; // Used by ReadModifyLocalVarNode.
         Operator m_operator;
         bool m_rightHasAssignments;
     };
 
     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignResolveNode(int, const Identifier&, ExpressionNode* right, bool rightHasAssignments);
+        AssignResolveNode(int, const Identifier&, ExpressionNode* right);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
         const Identifier& m_ident;
         ExpressionNode* m_right;
-        size_t m_index; // Used by ReadModifyLocalVarNode.
-        bool m_rightHasAssignments;
     };
 
     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
@@ -1080,14 +1073,10 @@ namespace JSC {
 
     class AssignErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignErrorNode(int, ExpressionNode* left, Operator, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset);
+        AssignErrorNode(int, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
-
-        ExpressionNode* m_left;
-        Operator m_operator;
-        ExpressionNode* m_right;
     };
     
     typedef Vector<ExpressionNode*, 8> ExpressionVector;
@@ -1254,7 +1243,7 @@ namespace JSC {
 
     class ForNode : public StatementNode {
     public:
-        ForNode(int, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*, bool expr1WasVarDecl);
+        ForNode(int, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode*);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
@@ -1263,18 +1252,16 @@ namespace JSC {
         ExpressionNode* m_expr2;
         ExpressionNode* m_expr3;
         StatementNode* m_statement;
-        bool m_expr1WasVarDecl;
     };
 
     class ForInNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ForInNode(JSGlobalData*, int, ExpressionNode*, ExpressionNode*, StatementNode*);
+        ForInNode(int, ExpressionNode*, ExpressionNode*, StatementNode*);
         ForInNode(JSGlobalData*, int, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset);
 
     private:
         virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        const Identifier& m_ident;
         ExpressionNode* m_init;
         ExpressionNode* m_lexpr;
         ExpressionNode* m_expr;
diff --git a/Source/JavaScriptCore/parser/Parser.cpp b/Source/JavaScriptCore/parser/Parser.cpp
index d88a9a8b7..558f50e5f 100644
--- a/Source/JavaScriptCore/parser/Parser.cpp
+++ b/Source/JavaScriptCore/parser/Parser.cpp
@@ -260,13 +260,12 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVarDeclarati
             int varDivot = tokenStart() + 1;
             initStart = tokenStart();
             next(TreeBuilder::DontBuildStrings); // consume '='
-            int initialAssignments = m_assignmentCount;
             TreeExpression initializer = parseAssignmentExpression(context);
             initEnd = lastTokenEnd();
             lastInitializer = initializer;
             failIfFalse(initializer);
             
-            TreeExpression node = context.createAssignResolve(m_lexer->lastLineNumber(), *name, initializer, initialAssignments != m_assignmentCount, varStart, varDivot, lastTokenEnd());
+            TreeExpression node = context.createAssignResolve(m_lexer->lastLineNumber(), *name, initializer, varStart, varDivot, lastTokenEnd());
             if (!varDecls)
                 varDecls = node;
             else
@@ -314,14 +313,12 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseForStatement(
     int declsStart = 0;
     int declsEnd = 0;
     TreeExpression decls = 0;
-    bool hasDeclaration = false;
     if (match(VAR)) {
         /*
          for (var IDENT in expression) statement
          for (var IDENT = expression in expression) statement
          for (var varDeclarationList; expressionOpt; expressionOpt)
          */
-        hasDeclaration = true;
         const Identifier* forInTarget = 0;
         TreeExpression forInInitializer = 0;
         m_allowsIn = false;
@@ -391,7 +388,7 @@ template <class TreeBuilder> TreeStatement Parser<LexerType>::parseForStatement(
         TreeStatement statement = parseStatement(context, unused);
         endLoop();
         failIfFalse(statement);
-        return context.createForLoop(m_lexer->lastLineNumber(), decls, condition, increment, statement, hasDeclaration, startLine, endLine);
+        return context.createForLoop(m_lexer->lastLineNumber(), decls, condition, increment, statement, startLine, endLine);
     }
     
     // For-in loop
diff --git a/Source/JavaScriptCore/parser/SyntaxChecker.h b/Source/JavaScriptCore/parser/SyntaxChecker.h
index c2c93756d..fe3ce714f 100644
--- a/Source/JavaScriptCore/parser/SyntaxChecker.h
+++ b/Source/JavaScriptCore/parser/SyntaxChecker.h
@@ -148,7 +148,7 @@ public:
     ExpressionType createNewExpr(int, ExpressionType, int, int, int, int) { return NewExpr; }
     ExpressionType createNewExpr(int, ExpressionType, int, int) { return NewExpr; }
     ExpressionType createConditionalExpr(int, ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
-    ExpressionType createAssignResolve(int, const Identifier&, ExpressionType, bool, int, int, int) { return AssignmentExpr; }
+    ExpressionType createAssignResolve(int, const Identifier&, ExpressionType, int, int, int) { return AssignmentExpr; }
     ExpressionType createFunctionExpr(int, const Identifier*, int, int, int, int, int, int) { return FunctionExpr; }
     int createFunctionBody(int, bool) { return 1; }
     int createArguments() { return 1; }
@@ -183,7 +183,7 @@ public:
     int createExprStatement(int, int, int, int) { return 1; }
     int createIfStatement(int, int, int, int, int) { return 1; }
     int createIfStatement(int, int, int, int, int, int) { return 1; }
-    int createForLoop(int, int, int, int, int, bool, int, int) { return 1; }
+    int createForLoop(int, int, int, int, int, int, int) { return 1; }
     int createForInLoop(int, const Identifier*, int, int, int, int, int, int, int, int, int, int) { return 1; }
     int createForInLoop(int, int, int, int, int, int, int, int, int) { return 1; }
     int createEmptyStatement(int) { return 1; }
diff --git a/Source/JavaScriptCore/runtime/Completion.cpp b/Source/JavaScriptCore/runtime/Completion.cpp
index 311d660a0..1c35b9626 100644
--- a/Source/JavaScriptCore/runtime/Completion.cpp
+++ b/Source/JavaScriptCore/runtime/Completion.cpp
@@ -37,7 +37,7 @@ namespace JSC {
 
 bool checkSyntax(ExecState* exec, const SourceCode& source, JSValue* returnedException)
 {
-    JSLock lock(exec);
+    JSLockHolder lock(exec);
     ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
 
     ProgramExecutable* program = ProgramExecutable::create(exec, source);
@@ -53,7 +53,7 @@ bool checkSyntax(ExecState* exec, const SourceCode& source, JSValue* returnedExc
 
 JSValue evaluate(ExecState* exec, ScopeChainNode* scopeChain, const SourceCode& source, JSValue thisValue, JSValue* returnedException)
 {
-    JSLock lock(exec);
+    JSLockHolder lock(exec);
     ASSERT(exec->globalData().identifierTable == wtfThreadData().currentIdentifierTable());
     if (exec->globalData().isCollectorBusy())
         CRASH();
diff --git a/Source/JavaScriptCore/runtime/GCActivityCallback.h b/Source/JavaScriptCore/runtime/GCActivityCallback.h
index 18bbd31e0..67ee17420 100644
--- a/Source/JavaScriptCore/runtime/GCActivityCallback.h
+++ b/Source/JavaScriptCore/runtime/GCActivityCallback.h
@@ -69,7 +69,7 @@ protected:
 
 class DefaultGCActivityCallback : public GCActivityCallback {
 public:
-    static PassOwnPtr<DefaultGCActivityCallback> create(Heap*);
+    static DefaultGCActivityCallback* create(Heap*);
 
     DefaultGCActivityCallback(Heap*);
 
@@ -91,9 +91,9 @@ private:
 #endif
 };
 
-inline PassOwnPtr<DefaultGCActivityCallback> DefaultGCActivityCallback::create(Heap* heap)
+inline DefaultGCActivityCallback* DefaultGCActivityCallback::create(Heap* heap)
 {
-    return adoptPtr(new DefaultGCActivityCallback(heap));
+    return new DefaultGCActivityCallback(heap);
 }
 
 }
diff --git a/Source/JavaScriptCore/runtime/InitializeThreading.cpp b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
index 4c0e123a4..c7fbd332e 100644
--- a/Source/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/Source/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -53,7 +53,7 @@ static void initializeThreadingOnce()
 {
     WTF::double_conversion::initialize();
     WTF::initializeThreading();
-    Options::initializeOptions();
+    Options::initialize();
 #if ENABLE(WRITE_BARRIER_PROFILING)
     WriteBarrierCounters::initialize();
 #endif
diff --git a/Source/JavaScriptCore/runtime/JSArray.cpp b/Source/JavaScriptCore/runtime/JSArray.cpp
index 96cc44780..7218604d1 100644
--- a/Source/JavaScriptCore/runtime/JSArray.cpp
+++ b/Source/JavaScriptCore/runtime/JSArray.cpp
@@ -1258,7 +1258,10 @@ JSValue JSArray::pop(ExecState* exec)
     if (exec->hadException())
         return jsUndefined();
     // Call the [[Delete]] internal method of O with arguments indx and true.
-    deletePropertyByIndex(this, exec, index);
+    if (!deletePropertyByIndex(this, exec, index)) {
+        throwTypeError(exec, "Unable to delete property.");
+        return jsUndefined();
+    }
     // Call the [[Put]] internal method of O with arguments "length", indx, and true.
     setLength(exec, index, true);
     // Return element.
diff --git a/Source/JavaScriptCore/runtime/JSFunction.cpp b/Source/JavaScriptCore/runtime/JSFunction.cpp
index f2d9c81e2..0a65deee2 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -103,13 +103,16 @@ void JSFunction::finishCreation(ExecState* exec, NativeExecutable* executable, i
 
 void JSFunction::finishCreation(ExecState* exec, FunctionExecutable* executable, ScopeChainNode* scopeChainNode)
 {
-    Base::finishCreation(exec->globalData());
+    JSGlobalData& globalData = exec->globalData();
+    Base::finishCreation(globalData);
     ASSERT(inherits(&s_info));
 
     // Switching the structure here is only safe if we currently have the function structure!
     ASSERT(structure() == scopeChainNode->globalObject->functionStructure());
-    setStructure(exec->globalData(), scopeChainNode->globalObject->namedFunctionStructure());
-    putDirectOffset(exec->globalData(), scopeChainNode->globalObject->functionNameOffset(), executable->nameValue());
+    setStructureAndReallocateStorageIfNecessary(
+        globalData,
+        scopeChainNode->globalObject->namedFunctionStructure());
+    putDirectOffset(globalData, scopeChainNode->globalObject->functionNameOffset(), executable->nameValue());
 }
 
 Structure* JSFunction::cacheInheritorID(ExecState* exec)
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.cpp b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
index 1fb90df40..dd05005c7 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -34,8 +34,10 @@
 #include "CommonIdentifiers.h"
 #include "DebuggerActivation.h"
 #include "FunctionConstructor.h"
+#include "GCActivityCallback.h"
 #include "GetterSetter.h"
 #include "HostCallReturnValue.h"
+#include "IncrementalSweeper.h"
 #include "Interpreter.h"
 #include "JSActivation.h"
 #include "JSAPIValueWrapper.h"
@@ -97,7 +99,7 @@ extern const HashTable stringConstructorTable;
 #if ENABLE(ASSEMBLER) && (ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
 static bool enableAssembler(ExecutableAllocator& executableAllocator)
 {
-    if (!executableAllocator.isValid() || !Options::useJIT)
+    if (!executableAllocator.isValid() || !Options::useJIT())
         return false;
 
 #if USE(CF)
@@ -168,6 +170,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 #if CPU(X86) && ENABLE(JIT)
     , m_timeoutCount(512)
 #endif
+    , m_newStringsSinceLastHashConst(0)
 #if ENABLE(ASSEMBLER) && (ENABLE(CLASSIC_INTERPRETER) || ENABLE(LLINT))
     , m_canUseAssembler(enableAssembler(executableAllocator))
 #endif
@@ -178,12 +181,9 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 {
     interpreter = new Interpreter;
 
-    if (isSharedInstance())
-        turnOffVerifier();
-
     // Need to be careful to keep everything consistent here
+    JSLockHolder lock(this);
     IdentifierTable* existingEntryIdentifierTable = wtfThreadData().setCurrentIdentifierTable(identifierTable);
-    JSLock lock(SilenceAssertionsOnly);
     structureStructure.set(*this, Structure::createStructure(*this));
     debuggerActivationStructure.set(*this, DebuggerActivation::createStructure(*this, 0, jsNull()));
     activationStructure.set(*this, JSActivation::createStructure(*this, 0, jsNull()));
@@ -222,6 +222,9 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
 
 JSGlobalData::~JSGlobalData()
 {
+    ASSERT(!m_apiLock.currentThreadIsHoldingLock());
+    heap.activityCallback()->didStartVMShutdown();
+    heap.sweeper()->didStartVMShutdown();
     heap.lastChanceToFinalize();
 
     delete interpreter;
@@ -311,6 +314,7 @@ bool JSGlobalData::sharedInstanceExists()
 
 JSGlobalData& JSGlobalData::sharedInstance()
 {
+    GlobalJSLock globalLock;
     JSGlobalData*& instance = sharedInstanceInternal();
     if (!instance) {
         instance = adoptRef(new JSGlobalData(APIShared, ThreadStackTypeSmall, SmallHeap)).leakRef();
@@ -321,7 +325,6 @@ JSGlobalData& JSGlobalData::sharedInstance()
 
 JSGlobalData*& JSGlobalData::sharedInstanceInternal()
 {
-    ASSERT(JSLock::currentThreadIsHoldingLock());
     static JSGlobalData* sharedInstance;
     return sharedInstance;
 }
diff --git a/Source/JavaScriptCore/runtime/JSGlobalData.h b/Source/JavaScriptCore/runtime/JSGlobalData.h
index f8833104a..90925778b 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalData.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalData.h
@@ -35,6 +35,7 @@
 #include "Heap.h"
 #include "Intrinsic.h"
 #include "JITStubs.h"
+#include "JSLock.h"
 #include "JSValue.h"
 #include "LLIntData.h"
 #include "NumericStrings.h"
@@ -46,8 +47,8 @@
 #include <wtf/BumpPointerAllocator.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
 #include <wtf/SimpleStats.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/ThreadSpecific.h>
 #include <wtf/WTFThreadData.h>
 #if ENABLE(REGEXP_TRACING)
@@ -152,7 +153,7 @@ namespace JSC {
     };
 #endif
 
-    class JSGlobalData : public RefCounted<JSGlobalData> {
+    class JSGlobalData : public ThreadSafeRefCounted<JSGlobalData> {
     public:
         // WebCore has a one-to-one mapping of threads to JSGlobalDatas;
         // either create() or createLeaked() should only be called once
@@ -180,6 +181,10 @@ namespace JSC {
 
         void makeUsableFromMultipleThreads() { heap.machineThreads().makeUsableFromMultipleThreads(); }
 
+    private:
+        JSLock m_apiLock;
+
+    public:
         Heap heap; // The heap is our first data member to ensure that it's destructed after all the objects that reference it.
 
         GlobalDataType globalDataType;
@@ -390,6 +395,13 @@ namespace JSC {
         unsigned m_timeoutCount;
 #endif
 
+        unsigned m_newStringsSinceLastHashConst;
+
+        static const unsigned s_minNumberOfNewStringsToHashConst = 100;
+
+        bool haveEnoughNewStringsToHashConst() { return m_newStringsSinceLastHashConst > s_minNumberOfNewStringsToHashConst; }
+        void resetNewStringsSinceLastHashConst() { m_newStringsSinceLastHashConst = 0; }
+
 #define registerTypedArrayFunction(type, capitalizedType) \
         void registerTypedArrayDescriptor(const capitalizedType##Array*, const TypedArrayDescriptor& descriptor) \
         { \
@@ -409,6 +421,8 @@ namespace JSC {
         registerTypedArrayFunction(float64, Float64);
 #undef registerTypedArrayFunction
 
+        JSLock& apiLock() { return m_apiLock; }
+
     private:
         friend class LLIntOffsetsExtractor;
         
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index d19db4fd8..0edc0a8a9 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -115,7 +115,7 @@ template <typename T> static inline void visitIfNeeded(SlotVisitor& visitor, Wri
 JSGlobalObject::JSGlobalObject(JSGlobalData& globalData, Structure* structure, const GlobalObjectMethodTable* globalObjectMethodTable)
     : JSSegmentedVariableObject(globalData, structure, &m_symbolTable)
     , m_globalScopeChain()
-    , m_weakRandom(Options::forceWeakRandomSeed ? Options::forcedWeakRandomSeed : static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
+    , m_weakRandom(Options::forceWeakRandomSeed() ? Options::forcedWeakRandomSeed() : static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
     , m_evalEnabled(true)
     , m_globalObjectMethodTable(globalObjectMethodTable ? globalObjectMethodTable : &s_globalObjectMethodTable)
 {
@@ -123,8 +123,6 @@ JSGlobalObject::JSGlobalObject(JSGlobalData& globalData, Structure* structure, c
 
 JSGlobalObject::~JSGlobalObject()
 {
-    ASSERT(JSLock::currentThreadIsHoldingLock());
-
     if (m_debugger)
         m_debugger->detach(this);
 
@@ -139,7 +137,7 @@ void JSGlobalObject::destroy(JSCell* cell)
 
 void JSGlobalObject::init(JSObject* thisValue)
 {
-    ASSERT(JSLock::currentThreadIsHoldingLock());
+    ASSERT(globalData().apiLock().currentThreadIsHoldingLock());
     
     m_globalScopeChain.set(globalData(), this, ScopeChainNode::create(0, this, &globalData(), this, thisValue));
 
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 1dcfc63cc..af03f32e6 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -132,7 +132,7 @@ namespace JSC {
         WriteBarrier<Structure> m_functionStructure;
         WriteBarrier<Structure> m_boundFunctionStructure;
         WriteBarrier<Structure> m_namedFunctionStructure;
-        size_t m_functionNameOffset;
+        PropertyOffset m_functionNameOffset;
         WriteBarrier<Structure> m_numberObjectStructure;
         WriteBarrier<Structure> m_privateNameStructure;
         WriteBarrier<Structure> m_regExpMatchesArrayStructure;
@@ -262,7 +262,7 @@ namespace JSC {
         Structure* functionStructure() const { return m_functionStructure.get(); }
         Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(); }
         Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(); }
-        size_t functionNameOffset() const { return m_functionNameOffset; }
+        PropertyOffset functionNameOffset() const { return m_functionNameOffset; }
         Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
         Structure* privateNameStructure() const { return m_privateNameStructure.get(); }
         Structure* internalFunctionStructure() const { return m_internalFunctionStructure.get(); }
diff --git a/Source/JavaScriptCore/runtime/JSLock.cpp b/Source/JavaScriptCore/runtime/JSLock.cpp
index 90e2f5d2a..be30c0c9c 100644
--- a/Source/JavaScriptCore/runtime/JSLock.cpp
+++ b/Source/JavaScriptCore/runtime/JSLock.cpp
@@ -23,6 +23,7 @@
 
 #include "Heap.h"
 #include "CallFrame.h"
+#include "JSGlobalObject.h"
 #include "JSObject.h"
 #include "ScopeChain.h"
 
@@ -37,95 +38,96 @@ namespace JSC {
 // So it's safe to disable it on non-mac platforms where we don't have native pthreads.
 #if (OS(DARWIN) || USE(PTHREADS))
 
-// Acquire this mutex before accessing lock-related data.
-static pthread_mutex_t JSMutex = PTHREAD_MUTEX_INITIALIZER;
+static pthread_mutex_t sharedInstanceLock = PTHREAD_MUTEX_INITIALIZER;
 
-// Thread-specific key that tells whether a thread holds the JSMutex, and how many times it was taken recursively.
-pthread_key_t JSLockCount;
+GlobalJSLock::GlobalJSLock()
+{
+    pthread_mutex_lock(&sharedInstanceLock);
+}
 
-static void createJSLockCount()
+GlobalJSLock::~GlobalJSLock()
 {
-    pthread_key_create(&JSLockCount, 0);
+    pthread_mutex_unlock(&sharedInstanceLock);
 }
 
-pthread_once_t createJSLockCountOnce = PTHREAD_ONCE_INIT;
+JSLockHolder::JSLockHolder(ExecState* exec)
+    : m_globalData(&exec->globalData())
+{
+    m_globalData->apiLock().lock();
+}
 
-// Lock nesting count.
-intptr_t JSLock::lockCount()
+JSLockHolder::JSLockHolder(JSGlobalData* globalData)
+    : m_globalData(globalData)
 {
-    pthread_once(&createJSLockCountOnce, createJSLockCount);
+    m_globalData->apiLock().lock();
+}
 
-    return reinterpret_cast<intptr_t>(pthread_getspecific(JSLockCount));
+JSLockHolder::JSLockHolder(JSGlobalData& globalData)
+    : m_globalData(&globalData)
+{
+    m_globalData->apiLock().lock();
 }
 
-static void setLockCount(intptr_t count)
+JSLockHolder::~JSLockHolder()
 {
-    ASSERT(count >= 0);
-    pthread_setspecific(JSLockCount, reinterpret_cast<void*>(count));
+    m_globalData->apiLock().unlock();
 }
 
-JSLock::JSLock(ExecState* exec)
-    : m_lockBehavior(exec->globalData().isSharedInstance() ? LockForReal : SilenceAssertionsOnly)
+JSLock::JSLock()
+    : m_lockCount(0)
 {
-    lock(m_lockBehavior);
+    m_spinLock.Init();
 }
 
-JSLock::JSLock(JSGlobalData* globalData)
-    : m_lockBehavior(globalData->isSharedInstance() ? LockForReal : SilenceAssertionsOnly)
+JSLock::~JSLock()
 {
-    lock(m_lockBehavior);
 }
 
-void JSLock::lock(JSLockBehavior lockBehavior)
+void JSLock::lock()
 {
-#ifdef NDEBUG
-    // Locking "not for real" is a debug-only feature.
-    if (lockBehavior == SilenceAssertionsOnly)
-        return;
-#endif
+    ThreadIdentifier currentThread = WTF::currentThread();
+    {
+        SpinLockHolder holder(&m_spinLock);
+        if (m_ownerThread == currentThread && m_lockCount) {
+            m_lockCount++;
+            return;
+        }
+    }
 
-    pthread_once(&createJSLockCountOnce, createJSLockCount);
+    m_lock.lock();
 
-    intptr_t currentLockCount = lockCount();
-    if (!currentLockCount && lockBehavior == LockForReal) {
-        int result = pthread_mutex_lock(&JSMutex);
-        ASSERT_UNUSED(result, !result);
+    {
+        SpinLockHolder holder(&m_spinLock);
+        m_ownerThread = currentThread;
+        ASSERT(!m_lockCount);
+        m_lockCount = 1;
     }
-    setLockCount(currentLockCount + 1);
 }
 
-void JSLock::unlock(JSLockBehavior lockBehavior)
+void JSLock::unlock()
 {
-    ASSERT(lockCount());
+    ASSERT(currentThreadIsHoldingLock());
 
-#ifdef NDEBUG
-    // Locking "not for real" is a debug-only feature.
-    if (lockBehavior == SilenceAssertionsOnly)
-        return;
-#endif
+    SpinLockHolder holder(&m_spinLock);
+    m_lockCount--;
 
-    intptr_t newLockCount = lockCount() - 1;
-    setLockCount(newLockCount);
-    if (!newLockCount && lockBehavior == LockForReal) {
-        int result = pthread_mutex_unlock(&JSMutex);
-        ASSERT_UNUSED(result, !result);
-    }
+    if (!m_lockCount)
+        m_lock.unlock();
 }
 
 void JSLock::lock(ExecState* exec)
 {
-    lock(exec->globalData().isSharedInstance() ? LockForReal : SilenceAssertionsOnly);
+    exec->globalData().apiLock().lock();
 }
 
 void JSLock::unlock(ExecState* exec)
 {
-    unlock(exec->globalData().isSharedInstance() ? LockForReal : SilenceAssertionsOnly);
+    exec->globalData().apiLock().unlock();
 }
 
 bool JSLock::currentThreadIsHoldingLock()
 {
-    pthread_once(&createJSLockCountOnce, createJSLockCount);
-    return !!pthread_getspecific(JSLockCount);
+    return m_lockCount && m_ownerThread == WTF::currentThread();
 }
 
 // This is fairly nasty.  We allow multiple threads to run on the same
@@ -149,7 +151,7 @@ bool JSLock::currentThreadIsHoldingLock()
 // this to happen, and were its stack to grow further, then it may potentially
 // write over the second thread's call frames.
 //
-// In avoid JS stack corruption we enforce a policy of only ever allowing two
+// To avoid JS stack corruption we enforce a policy of only ever allowing two
 // threads to use a JS context concurrently, and only allowing the second of
 // these threads to execute until it has completed and fully returned from its
 // outermost call into JSC.  We enforce this policy using 'lockDropDepth'.  The
@@ -158,7 +160,7 @@ bool JSLock::currentThreadIsHoldingLock()
 // same thread again, enter JSC (through evaluate script or call function), and exit
 // again through a callback, then the locks will not be dropped when DropAllLocks
 // is called (since lockDropDepth is non-zero).  Since this thread is still holding
-// the locks, only it will re able to re-enter JSC (either be returning from the
+// the locks, only it will be able to re-enter JSC (either be returning from the
 // callback, or by re-entering through another call to evaulate script or call
 // function).
 //
@@ -168,61 +170,84 @@ bool JSLock::currentThreadIsHoldingLock()
 // order in which they were made - though implementing the less restrictive policy
 // would likely increase complexity and overhead.
 //
-static unsigned lockDropDepth = 0;
 
-JSLock::DropAllLocks::DropAllLocks(ExecState* exec)
-    : m_lockBehavior(exec->globalData().isSharedInstance() ? LockForReal : SilenceAssertionsOnly)
+// This function returns the number of locks that were dropped.
+unsigned JSLock::dropAllLocks()
 {
-    pthread_once(&createJSLockCountOnce, createJSLockCount);
+    if (m_lockDropDepth++)
+        return 0;
 
-    if (lockDropDepth++) {
-        m_lockCount = 0;
-        return;
-    }
+    return dropAllLocksUnconditionally();
+}
+
+unsigned JSLock::dropAllLocksUnconditionally()
+{
+    unsigned lockCount = m_lockCount;
+    for (unsigned i = 0; i < lockCount; i++)
+        unlock();
 
-    m_lockCount = JSLock::lockCount();
-    for (intptr_t i = 0; i < m_lockCount; i++)
-        JSLock::unlock(m_lockBehavior);
+    return lockCount;
 }
 
-JSLock::DropAllLocks::DropAllLocks(JSLockBehavior JSLockBehavior)
-    : m_lockBehavior(JSLockBehavior)
+void JSLock::grabAllLocks(unsigned lockCount)
 {
-    pthread_once(&createJSLockCountOnce, createJSLockCount);
+    for (unsigned i = 0; i < lockCount; i++)
+        lock();
 
-    if (lockDropDepth++) {
-        m_lockCount = 0;
-        return;
-    }
+    m_lockDropDepth--;
+}
 
-    // It is necessary to drop even "unreal" locks, because having a non-zero lock count
-    // will prevent a real lock from being taken.
+JSLock::DropAllLocks::DropAllLocks(ExecState* exec)
+    : m_lockCount(0)
+    , m_globalData(&exec->globalData())
+{
+    m_lockCount = m_globalData->apiLock().dropAllLocks();
+}
 
-    m_lockCount = JSLock::lockCount();
-    for (intptr_t i = 0; i < m_lockCount; i++)
-        JSLock::unlock(m_lockBehavior);
+JSLock::DropAllLocks::DropAllLocks(JSGlobalData* globalData)
+    : m_lockCount(0)
+    , m_globalData(globalData)
+{
+    m_lockCount = m_globalData->apiLock().dropAllLocks();
 }
 
 JSLock::DropAllLocks::~DropAllLocks()
 {
-    for (intptr_t i = 0; i < m_lockCount; i++)
-        JSLock::lock(m_lockBehavior);
-
-    --lockDropDepth;
+    m_globalData->apiLock().grabAllLocks(m_lockCount);
 }
 
 #else // (OS(DARWIN) || USE(PTHREADS))
 
-JSLock::JSLock(ExecState*)
-    : m_lockBehavior(SilenceAssertionsOnly)
+GlobalJSLock::GlobalJSLock()
+{
+}
+
+GlobalJSLock::~GlobalJSLock()
+{
+}
+
+JSLockHolder::JSLockHolder(JSGlobalData*)
 {
 }
 
-// If threading support is off, set the lock count to a constant value of 1 so ssertions
-// that the lock is held don't fail
-intptr_t JSLock::lockCount()
+JSLockHolder::JSLockHolder(JSGlobalData&)
+{
+}
+
+JSLockHolder::JSLockHolder(ExecState*)
+{
+}
+
+JSLockHolder::~JSLockHolder()
+{
+}
+
+JSLock::JSLock()
+{
+}
+
+JSLock::~JSLock()
 {
-    return 1;
 }
 
 bool JSLock::currentThreadIsHoldingLock()
@@ -230,11 +255,11 @@ bool JSLock::currentThreadIsHoldingLock()
     return true;
 }
 
-void JSLock::lock(JSLockBehavior)
+void JSLock::lock()
 {
 }
 
-void JSLock::unlock(JSLockBehavior)
+void JSLock::unlock()
 {
 }
 
@@ -246,11 +271,33 @@ void JSLock::unlock(ExecState*)
 {
 }
 
+void JSLock::lock(JSGlobalData&)
+{
+}
+
+void JSLock::unlock(JSGlobalData&)
+{
+}
+
+unsigned JSLock::dropAllLocks()
+{
+    return 0;
+}
+
+unsigned JSLock::dropAllLocksUnconditionally()
+{
+    return 0;
+}
+
+void JSLock::grabAllLocks(unsigned)
+{
+}
+
 JSLock::DropAllLocks::DropAllLocks(ExecState*)
 {
 }
 
-JSLock::DropAllLocks::DropAllLocks(JSLockBehavior)
+JSLock::DropAllLocks::DropAllLocks(JSGlobalData*)
 {
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSLock.h b/Source/JavaScriptCore/runtime/JSLock.h
index a0eb96975..94108d013 100644
--- a/Source/JavaScriptCore/runtime/JSLock.h
+++ b/Source/JavaScriptCore/runtime/JSLock.h
@@ -23,6 +23,9 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/RefPtr.h>
+#include <wtf/TCSpinLock.h>
+#include <wtf/Threading.h>
 
 namespace JSC {
 
@@ -30,8 +33,9 @@ namespace JSC {
     // important to lock before doing anything that allocates a
     // JavaScript data structure or that interacts with shared state
     // such as the protect count hash table. The simplest way to lock
-    // is to create a local JSLock object in the scope where the lock 
-    // must be held. The lock is recursive so nesting is ok. The JSLock 
+    // is to create a local JSLockHolder object in the scope where the lock 
+    // must be held and pass it the context that requires protection. 
+    // The lock is recursive so nesting is ok. The JSLock 
     // object also acts as a convenience short-hand for running important
     // initialization routines.
 
@@ -44,62 +48,65 @@ namespace JSC {
     // DropAllLocks object takes care to release the JSLock only if your
     // thread acquired it to begin with.
 
-    // For contexts other than the single shared one, implicit locking is not done,
-    // but we still need to perform all the counting in order to keep debug
-    // assertions working, so that clients that use the shared context don't break.
-
     class ExecState;
     class JSGlobalData;
 
-    enum JSLockBehavior { SilenceAssertionsOnly, LockForReal };
+    // This class is used to protect the initialization of the legacy single 
+    // shared JSGlobalData.
+    class GlobalJSLock {
+        WTF_MAKE_NONCOPYABLE(GlobalJSLock);
+    public:
+        JS_EXPORT_PRIVATE GlobalJSLock();
+        JS_EXPORT_PRIVATE ~GlobalJSLock();
+    };
+
+    class JSLockHolder {
+    public:
+        JS_EXPORT_PRIVATE JSLockHolder(JSGlobalData*);
+        JS_EXPORT_PRIVATE JSLockHolder(JSGlobalData&);
+        JS_EXPORT_PRIVATE JSLockHolder(ExecState*);
+
+        JS_EXPORT_PRIVATE ~JSLockHolder();
+    private:
+        RefPtr<JSGlobalData> m_globalData;
+    };
 
     class JSLock {
         WTF_MAKE_NONCOPYABLE(JSLock);
     public:
-        JS_EXPORT_PRIVATE JSLock(ExecState*);
-        JSLock(JSGlobalData*);
-
-        JSLock(JSLockBehavior lockBehavior)
-            : m_lockBehavior(lockBehavior)
-        {
-#ifdef NDEBUG
-            // Locking "not for real" is a debug-only feature.
-            if (lockBehavior == SilenceAssertionsOnly)
-                return;
-#endif
-            lock(lockBehavior);
-        }
-
-        ~JSLock()
-        { 
-#ifdef NDEBUG
-            // Locking "not for real" is a debug-only feature.
-            if (m_lockBehavior == SilenceAssertionsOnly)
-                return;
-#endif
-            unlock(m_lockBehavior); 
-        }
-        
-        JS_EXPORT_PRIVATE static void lock(JSLockBehavior);
-        JS_EXPORT_PRIVATE static void unlock(JSLockBehavior);
+        JSLock();
+        JS_EXPORT_PRIVATE ~JSLock();
+
+        JS_EXPORT_PRIVATE void lock();
+        JS_EXPORT_PRIVATE void unlock();
+
         static void lock(ExecState*);
         static void unlock(ExecState*);
+        static void lock(JSGlobalData&);
+        static void unlock(JSGlobalData&);
+
+        JS_EXPORT_PRIVATE bool currentThreadIsHoldingLock();
 
-        JS_EXPORT_PRIVATE static intptr_t lockCount();
-        JS_EXPORT_PRIVATE static bool currentThreadIsHoldingLock();
+        unsigned dropAllLocks();
+        unsigned dropAllLocksUnconditionally();
+        void grabAllLocks(unsigned lockCount);
 
-        JSLockBehavior m_lockBehavior;
+        SpinLock m_spinLock;
+        Mutex m_lock;
+        ThreadIdentifier m_ownerThread;
+        intptr_t m_lockCount;
+        unsigned m_lockDropDepth;
 
         class DropAllLocks {
             WTF_MAKE_NONCOPYABLE(DropAllLocks);
         public:
             JS_EXPORT_PRIVATE DropAllLocks(ExecState* exec);
-            JS_EXPORT_PRIVATE DropAllLocks(JSLockBehavior);
+            JS_EXPORT_PRIVATE DropAllLocks(JSGlobalData*);
             JS_EXPORT_PRIVATE ~DropAllLocks();
             
         private:
             intptr_t m_lockCount;
-            JSLockBehavior m_lockBehavior;
+            RefPtr<JSGlobalData> m_globalData;
         };
     };
 
diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index 66cc89809..ccc49fd5c 100644
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -93,24 +93,54 @@ void JSObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
     bool wasCheckingForDefaultMarkViolation = visitor.m_isCheckingForDefaultMarkViolation;
     visitor.m_isCheckingForDefaultMarkViolation = false;
 #endif
+    
+    JSCell::visitChildren(thisObject, visitor);
+
+    PropertyStorage storage = thisObject->outOfLineStorage();
+    if (storage) {
+        size_t storageSize = thisObject->structure()->outOfLineSizeForKnownNonFinalObject();
+        // We have this extra temp here to slake GCC's thirst for the blood of those who dereference type-punned pointers.
+        void* temp = storage;
+        visitor.copyAndAppend(&temp, thisObject->structure()->outOfLineCapacity() * sizeof(WriteBarrierBase<Unknown>), storage->slot(), storageSize);
+        storage = static_cast<PropertyStorage>(temp);
+        thisObject->m_outOfLineStorage.set(storage, StorageBarrier::Unchecked);
+    }
+
+    if (thisObject->m_inheritorID)
+        visitor.append(&thisObject->m_inheritorID);
+
+#if !ASSERT_DISABLED
+    visitor.m_isCheckingForDefaultMarkViolation = wasCheckingForDefaultMarkViolation;
+#endif
+}
 
+void JSFinalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSFinalObject* thisObject = jsCast<JSFinalObject*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
+#if !ASSERT_DISABLED
+    bool wasCheckingForDefaultMarkViolation = visitor.m_isCheckingForDefaultMarkViolation;
+    visitor.m_isCheckingForDefaultMarkViolation = false;
+#endif
+    
     JSCell::visitChildren(thisObject, visitor);
 
-    PropertyStorage storage = thisObject->propertyStorage();
-    size_t storageSize = thisObject->structure()->propertyStorageSize();
-    if (thisObject->isUsingInlineStorage())
-        visitor.appendValues(storage, storageSize);
-    else {
+    PropertyStorage storage = thisObject->outOfLineStorage();
+    if (storage) {
+        size_t storageSize = thisObject->structure()->outOfLineSizeForKnownFinalObject();
         // We have this extra temp here to slake GCC's thirst for the blood of those who dereference type-punned pointers.
         void* temp = storage;
-        visitor.copyAndAppend(&temp, thisObject->structure()->propertyStorageCapacity() * sizeof(WriteBarrierBase<Unknown>), storage->slot(), storageSize);
+        visitor.copyAndAppend(&temp, thisObject->structure()->outOfLineCapacity() * sizeof(WriteBarrierBase<Unknown>), storage->slot(), storageSize);
         storage = static_cast<PropertyStorage>(temp);
-        thisObject->m_propertyStorage.set(storage, StorageBarrier::Unchecked);
+        thisObject->m_outOfLineStorage.set(storage, StorageBarrier::Unchecked);
     }
 
     if (thisObject->m_inheritorID)
         visitor.append(&thisObject->m_inheritorID);
 
+    size_t storageSize = thisObject->structure()->inlineSizeForKnownFinalObject();
+    visitor.appendValues(thisObject->inlineStorage(), storageSize);
+
 #if !ASSERT_DISABLED
     visitor.m_isCheckingForDefaultMarkViolation = wasCheckingForDefaultMarkViolation;
 #endif
@@ -153,8 +183,8 @@ void JSObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSV
     for (JSObject* obj = thisObject; ; obj = asObject(prototype)) {
         unsigned attributes;
         JSCell* specificValue;
-        size_t offset = obj->structure()->get(globalData, propertyName, attributes, specificValue);
-        if (offset != WTF::notFound) {
+        PropertyOffset offset = obj->structure()->get(globalData, propertyName, attributes, specificValue);
+        if (offset != invalidOffset) {
             if (attributes & ReadOnly) {
                 if (slot.isStrictMode())
                     throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
@@ -272,7 +302,7 @@ bool JSObject::deleteProperty(JSCell* cell, ExecState* exec, PropertyName proper
 
     unsigned attributes;
     JSCell* specificValue;
-    if (thisObject->structure()->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound) {
+    if (isValidOffset(thisObject->structure()->get(exec->globalData(), propertyName, attributes, specificValue))) {
         if (attributes & DontDelete && !exec->globalData().isInDefineOwnProperty())
             return false;
         thisObject->removeDirect(exec->globalData(), propertyName);
@@ -394,7 +424,7 @@ bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyN
 bool JSObject::getPropertySpecificValue(ExecState* exec, PropertyName propertyName, JSCell*& specificValue) const
 {
     unsigned attributes;
-    if (structure()->get(exec->globalData(), propertyName, attributes, specificValue) != WTF::notFound)
+    if (isValidOffset(structure()->get(exec->globalData(), propertyName, attributes, specificValue)))
         return true;
 
     // This could be a function within the static table? - should probably
@@ -516,20 +546,20 @@ void JSObject::reifyStaticFunctionsForDelete(ExecState* exec)
 
 bool JSObject::removeDirect(JSGlobalData& globalData, PropertyName propertyName)
 {
-    if (structure()->get(globalData, propertyName) == WTF::notFound)
+    if (!isValidOffset(structure()->get(globalData, propertyName)))
         return false;
 
-    size_t offset;
+    PropertyOffset offset;
     if (structure()->isUncacheableDictionary()) {
         offset = structure()->removePropertyWithoutTransition(globalData, propertyName);
-        if (offset == WTF::notFound)
+        if (offset == invalidOffset)
             return false;
         putUndefinedAtDirectOffset(offset);
         return true;
     }
 
     setStructure(globalData, Structure::removePropertyTransition(globalData, structure(), propertyName, offset));
-    if (offset == WTF::notFound)
+    if (offset == invalidOffset)
         return false;
     putUndefinedAtDirectOffset(offset);
     return true;
@@ -559,25 +589,22 @@ Structure* JSObject::createInheritorID(JSGlobalData& globalData)
     return m_inheritorID.get();
 }
 
-PropertyStorage JSObject::growPropertyStorage(JSGlobalData& globalData, size_t oldSize, size_t newSize)
+PropertyStorage JSObject::growOutOfLineStorage(JSGlobalData& globalData, size_t oldSize, size_t newSize)
 {
     ASSERT(newSize > oldSize);
 
     // It's important that this function not rely on structure(), since
     // we might be in the middle of a transition.
 
-    PropertyStorage oldPropertyStorage = m_propertyStorage.get();
+    PropertyStorage oldPropertyStorage = m_outOfLineStorage.get();
     PropertyStorage newPropertyStorage = 0;
 
-    if (isUsingInlineStorage()) {
+    if (!oldPropertyStorage) {
         // We have this extra temp here to slake GCC's thirst for the blood of those who dereference type-punned pointers.
         void* temp = newPropertyStorage;
         if (!globalData.heap.tryAllocateStorage(sizeof(WriteBarrierBase<Unknown>) * newSize, &temp))
             CRASH();
         newPropertyStorage = static_cast<PropertyStorage>(temp);
-
-        for (unsigned i = 0; i < oldSize; ++i)
-            newPropertyStorage[i] = oldPropertyStorage[i];
     } else {
         // We have this extra temp here to slake GCC's thirst for the blood of those who dereference type-punned pointers.
         void* temp = oldPropertyStorage;
@@ -594,8 +621,8 @@ bool JSObject::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, Prope
 {
     unsigned attributes = 0;
     JSCell* cell = 0;
-    size_t offset = object->structure()->get(exec->globalData(), propertyName, attributes, cell);
-    if (offset == WTF::notFound)
+    PropertyOffset offset = object->structure()->get(exec->globalData(), propertyName, attributes, cell);
+    if (offset == invalidOffset)
         return false;
     descriptor.setDescriptor(object->getDirectOffset(offset), attributes);
     return true;
diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
index fdb708dd9..9972d6077 100644
--- a/Source/JavaScriptCore/runtime/JSObject.h
+++ b/Source/JavaScriptCore/runtime/JSObject.h
@@ -79,10 +79,13 @@ namespace JSC {
         Accessor     = 1 << 5,  // property is a getter/setter
     };
 
+    class JSFinalObject;
+
     class JSObject : public JSCell {
         friend class BatchedTransitionOptimizer;
         friend class JIT;
         friend class JSCell;
+        friend class JSFinalObject;
         friend class MarkedBlock;
         JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(ExecState*, const HashEntry*, JSObject*, PropertyName, PropertySlot&);
 
@@ -161,26 +164,72 @@ namespace JSC {
         // This get function only looks at the property map.
         JSValue getDirect(JSGlobalData& globalData, PropertyName propertyName) const
         {
-            size_t offset = structure()->get(globalData, propertyName);
-            return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
+            PropertyOffset offset = structure()->get(globalData, propertyName);
+            checkOffset(offset, structure()->typeInfo().type());
+            return offset != invalidOffset ? getDirectOffset(offset) : JSValue();
         }
 
         WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, PropertyName propertyName)
         {
-            size_t offset = structure()->get(globalData, propertyName);
-            return offset != WTF::notFound ? locationForOffset(offset) : 0;
+            PropertyOffset offset = structure()->get(globalData, propertyName);
+            checkOffset(offset, structure()->typeInfo().type());
+            return offset != invalidOffset ? locationForOffset(offset) : 0;
         }
 
         WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, PropertyName propertyName, unsigned& attributes)
         {
             JSCell* specificFunction;
-            size_t offset = structure()->get(globalData, propertyName, attributes, specificFunction);
-            return offset != WTF::notFound ? locationForOffset(offset) : 0;
+            PropertyOffset offset = structure()->get(globalData, propertyName, attributes, specificFunction);
+            return offset != invalidOffset ? locationForOffset(offset) : 0;
         }
 
-        size_t offsetForLocation(WriteBarrierBase<Unknown>* location) const
+        bool hasInlineStorage() const { return structure()->hasInlineStorage(); }
+        ConstPropertyStorage inlineStorageUnsafe() const
+        {
+            return bitwise_cast<ConstPropertyStorage>(this + 1);
+        }
+        PropertyStorage inlineStorageUnsafe()
+        {
+            return bitwise_cast<PropertyStorage>(this + 1);
+        }
+        ConstPropertyStorage inlineStorage() const
+        {
+            ASSERT(hasInlineStorage());
+            return inlineStorageUnsafe();
+        }
+        PropertyStorage inlineStorage()
         {
-            return location - propertyStorage();
+            ASSERT(hasInlineStorage());
+            return inlineStorageUnsafe();
+        }
+        
+        ConstPropertyStorage outOfLineStorage() const { return m_outOfLineStorage.get(); }
+        PropertyStorage outOfLineStorage() { return m_outOfLineStorage.get(); }
+
+        const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const
+        {
+            if (isInlineOffset(offset))
+                return &inlineStorage()[offsetInInlineStorage(offset)];
+            return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
+        }
+
+        WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset)
+        {
+            if (isInlineOffset(offset))
+                return &inlineStorage()[offsetInInlineStorage(offset)];
+            return &outOfLineStorage()[offsetInOutOfLineStorage(offset)];
+        }
+
+        PropertyOffset offsetForLocation(WriteBarrierBase<Unknown>* location) const
+        {
+            PropertyOffset result;
+            size_t offsetInInlineStorage = location - inlineStorageUnsafe();
+            if (offsetInInlineStorage < static_cast<size_t>(inlineStorageCapacity))
+                result = offsetInInlineStorage;
+            else
+                result = location - outOfLineStorage() + firstOutOfLineOffset;
+            validateOffset(result, structure()->typeInfo().type());
+            return result;
         }
 
         void transitionTo(JSGlobalData&, Structure*);
@@ -197,9 +246,9 @@ namespace JSC {
         bool putOwnDataProperty(JSGlobalData&, PropertyName, JSValue, PutPropertySlot&);
 
         // Fast access to known property offsets.
-        JSValue getDirectOffset(size_t offset) const { return propertyStorage()[offset].get(); }
-        void putDirectOffset(JSGlobalData& globalData, size_t offset, JSValue value) { propertyStorage()[offset].set(globalData, this, value); }
-        void putUndefinedAtDirectOffset(size_t offset) { propertyStorage()[offset].setUndefined(); }
+        JSValue getDirectOffset(PropertyOffset offset) const { return locationForOffset(offset)->get(); }
+        void putDirectOffset(JSGlobalData& globalData, PropertyOffset offset, JSValue value) { locationForOffset(offset)->set(globalData, this, value); }
+        void putUndefinedAtDirectOffset(PropertyOffset offset) { locationForOffset(offset)->setUndefined(); }
 
         JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, PropertyDescriptor&, bool shouldThrow);
 
@@ -220,17 +269,18 @@ namespace JSC {
         bool staticFunctionsReified() { return structure()->staticFunctionsReified(); }
         void reifyStaticFunctionsForDelete(ExecState* exec);
 
-        JS_EXPORT_PRIVATE PropertyStorage growPropertyStorage(JSGlobalData&, size_t oldSize, size_t newSize);
-        bool isUsingInlineStorage() const { return static_cast<const void*>(m_propertyStorage.get()) == static_cast<const void*>(this + 1); }
-        void setPropertyStorage(JSGlobalData&, PropertyStorage, Structure*);
+        JS_EXPORT_PRIVATE PropertyStorage growOutOfLineStorage(JSGlobalData&, size_t oldSize, size_t newSize);
+        void setOutOfLineStorage(JSGlobalData&, PropertyStorage, Structure*);
+        
+        bool reallocateStorageIfNecessary(JSGlobalData&, unsigned oldCapacity, Structure*);
+        void setStructureAndReallocateStorageIfNecessary(JSGlobalData&, unsigned oldCapacity, Structure*);
+        void setStructureAndReallocateStorageIfNecessary(JSGlobalData&, Structure*);
 
-        void* addressOfPropertyStorage()
+        void* addressOfOutOfLineStorage()
         {
-            return &m_propertyStorage;
+            return &m_outOfLineStorage;
         }
 
-        static const unsigned baseExternalStorageCapacity = 16;
-
         void flattenDictionaryObject(JSGlobalData& globalData)
         {
             structure()->flattenDictionaryStructure(globalData, this);
@@ -244,20 +294,19 @@ namespace JSC {
         }
         
         static size_t offsetOfInlineStorage();
-        static size_t offsetOfPropertyStorage();
+        static size_t offsetOfOutOfLineStorage();
         static size_t offsetOfInheritorID();
 
         static JS_EXPORTDATA const ClassInfo s_info;
 
     protected:
-        void finishCreation(JSGlobalData& globalData, PropertyStorage inlineStorage)
+        void finishCreation(JSGlobalData& globalData)
         {
             Base::finishCreation(globalData);
             ASSERT(inherits(&s_info));
-            ASSERT(structure()->propertyStorageCapacity() < baseExternalStorageCapacity);
+            ASSERT(!structure()->outOfLineCapacity());
             ASSERT(structure()->isEmpty());
             ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
-            ASSERT_UNUSED(inlineStorage, static_cast<void*>(inlineStorage) == static_cast<void*>(this + 1));
             ASSERT(structure()->isObject());
             ASSERT(classInfo());
         }
@@ -271,7 +320,7 @@ namespace JSC {
 
         // To instantiate objects you likely want JSFinalObject, below.
         // To create derived types you likely want JSNonFinalObject, below.
-        JSObject(JSGlobalData&, Structure*, PropertyStorage inlineStorage);
+        JSObject(JSGlobalData&, Structure*);
         
         void resetInheritorID()
         {
@@ -289,19 +338,6 @@ namespace JSC {
         void isObject();
         void isString();
         
-        ConstPropertyStorage propertyStorage() const { return m_propertyStorage.get(); }
-        PropertyStorage propertyStorage() { return m_propertyStorage.get(); }
-
-        const WriteBarrierBase<Unknown>* locationForOffset(size_t offset) const
-        {
-            return &propertyStorage()[offset];
-        }
-
-        WriteBarrierBase<Unknown>* locationForOffset(size_t offset)
-        {
-            return &propertyStorage()[offset];
-        }
-
         template<PutMode>
         bool putDirectInternal(JSGlobalData&, PropertyName, JSValue, unsigned attr, PutPropertySlot&, JSCell*);
 
@@ -311,21 +347,11 @@ namespace JSC {
         const HashEntry* findPropertyHashEntry(ExecState*, PropertyName) const;
         Structure* createInheritorID(JSGlobalData&);
 
-        StorageBarrier m_propertyStorage;
+        StorageBarrier m_outOfLineStorage;
         WriteBarrier<Structure> m_inheritorID;
     };
 
 
-#if USE(JSVALUE32_64)
-#define JSNonFinalObject_inlineStorageCapacity 4
-#define JSFinalObject_inlineStorageCapacity 6
-#else
-#define JSNonFinalObject_inlineStorageCapacity 2
-#define JSFinalObject_inlineStorageCapacity 4
-#endif
-
-COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineStorageCapacity), final_storage_is_at_least_as_large_as_non_final);
-
     // JSNonFinalObject is a type of JSObject that has some internal storage,
     // but also preserves some space in the collector cell for additional
     // data members in derived types.
@@ -340,22 +366,23 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
             return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
         }
 
+        static bool hasInlineStorage()
+        {
+            return false;
+        }
+
     protected:
         explicit JSNonFinalObject(JSGlobalData& globalData, Structure* structure)
-            : JSObject(globalData, structure, m_inlineStorage)
+            : JSObject(globalData, structure)
         {
         }
 
         void finishCreation(JSGlobalData& globalData)
         {
-            Base::finishCreation(globalData, m_inlineStorage);
-            ASSERT(!(OBJECT_OFFSETOF(JSNonFinalObject, m_inlineStorage) % sizeof(double)));
-            ASSERT(this->structure()->propertyStorageCapacity() == JSNonFinalObject_inlineStorageCapacity);
+            Base::finishCreation(globalData);
+            ASSERT(!this->structure()->totalStorageCapacity());
             ASSERT(classInfo());
         }
-
-    private:
-        WriteBarrier<Unknown> m_inlineStorage[JSNonFinalObject_inlineStorageCapacity];
     };
 
     class JSFinalObject;
@@ -374,14 +401,23 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
             return Structure::create(globalData, globalObject, prototype, TypeInfo(FinalObjectType, StructureFlags), &s_info);
         }
 
+        JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
+
         static JS_EXPORTDATA const ClassInfo s_info;
 
+        static bool hasInlineStorage()
+        {
+            return true;
+        }
     protected:
+        void visitChildrenCommon(SlotVisitor&);
+        
         void finishCreation(JSGlobalData& globalData)
         {
-            Base::finishCreation(globalData, m_inlineStorage);
+            Base::finishCreation(globalData);
             ASSERT(!(OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage) % sizeof(double)));
-            ASSERT(this->structure()->propertyStorageCapacity() == JSFinalObject_inlineStorageCapacity);
+            ASSERT(this->structure()->inlineCapacity() == static_cast<unsigned>(inlineStorageCapacity));
+            ASSERT(this->structure()->totalStorageCapacity() == static_cast<unsigned>(inlineStorageCapacity));
             ASSERT(classInfo());
         }
 
@@ -389,13 +425,13 @@ COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineSt
         friend class LLIntOffsetsExtractor;
         
         explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
-            : JSObject(globalData, structure, m_inlineStorage)
+            : JSObject(globalData, structure)
         {
         }
 
         static const unsigned StructureFlags = JSObject::StructureFlags;
 
-        WriteBarrierBase<Unknown> m_inlineStorage[JSFinalObject_inlineStorageCapacity];
+        WriteBarrierBase<Unknown> m_inlineStorage[INLINE_STORAGE_CAPACITY];
     };
 
 inline JSFinalObject* JSFinalObject::create(ExecState* exec, Structure* structure)
@@ -417,13 +453,12 @@ inline bool isJSFinalObject(JSValue value)
 
 inline size_t JSObject::offsetOfInlineStorage()
 {
-    ASSERT(OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage) == OBJECT_OFFSETOF(JSNonFinalObject, m_inlineStorage));
     return OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage);
 }
 
-inline size_t JSObject::offsetOfPropertyStorage()
+inline size_t JSObject::offsetOfOutOfLineStorage()
 {
-    return OBJECT_OFFSETOF(JSObject, m_propertyStorage);
+    return OBJECT_OFFSETOF(JSObject, m_outOfLineStorage);
 }
 
 inline size_t JSObject::offsetOfInheritorID()
@@ -461,12 +496,18 @@ inline bool JSObject::isGlobalThis() const
     return structure()->typeInfo().type() == GlobalThisType;
 }
 
-inline void JSObject::setPropertyStorage(JSGlobalData& globalData, PropertyStorage storage, Structure* structure)
+inline void JSObject::setOutOfLineStorage(JSGlobalData& globalData, PropertyStorage storage, Structure* structure)
 {
-    ASSERT(storage);
     ASSERT(structure);
+    if (!storage) {
+        ASSERT(!structure->outOfLineCapacity());
+        ASSERT(!structure->outOfLineSize());
+    } else {
+        ASSERT(structure->outOfLineCapacity());
+        ASSERT(structure->outOfLineSize());
+    }
     setStructure(globalData, structure);
-    m_propertyStorage.set(globalData, this, storage);
+    m_outOfLineStorage.set(globalData, this, storage);
 }
 
 inline JSObject* constructEmptyObject(ExecState* exec, Structure* structure)
@@ -504,9 +545,9 @@ inline JSObject* asObject(JSValue value)
     return asObject(value.asCell());
 }
 
-inline JSObject::JSObject(JSGlobalData& globalData, Structure* structure, PropertyStorage inlineStorage)
+inline JSObject::JSObject(JSGlobalData& globalData, Structure* structure)
     : JSCell(globalData, structure)
-    , m_propertyStorage(globalData, this, inlineStorage)
+    , m_outOfLineStorage(globalData, this, 0)
 {
 }
 
@@ -530,11 +571,6 @@ inline Structure* JSObject::inheritorID(JSGlobalData& globalData)
     return createInheritorID(globalData);
 }
 
-inline bool Structure::isUsingInlineStorage() const
-{
-    return propertyStorageCapacity() < JSObject::baseExternalStorageCapacity;
-}
-
 inline bool JSCell::inherits(const ClassInfo* info) const
 {
     return classInfo()->isSubClassOf(info);
@@ -591,10 +627,10 @@ ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, PropertyName
 ALWAYS_INLINE JSValue JSCell::fastGetOwnProperty(ExecState* exec, const UString& name)
 {
     if (!structure()->typeInfo().overridesGetOwnPropertySlot() && !structure()->hasGetterSetterProperties()) {
-        size_t offset = name.impl()->hasHash()
+        PropertyOffset offset = name.impl()->hasHash()
             ? structure()->get(exec->globalData(), Identifier(exec, name))
             : structure()->get(exec->globalData(), name);
-        if (offset != WTF::notFound)
+        if (offset != invalidOffset)
             return asObject(this)->locationForOffset(offset)->get();
     }
     return JSValue();
@@ -656,8 +692,8 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, PropertyName p
     if (structure()->isDictionary()) {
         unsigned currentAttributes;
         JSCell* currentSpecificFunction;
-        size_t offset = structure()->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
-        if (offset != WTF::notFound) {
+        PropertyOffset offset = structure()->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
+        if (offset != invalidOffset) {
             // If there is currently a specific function, and there now either isn't,
             // or the new value is different, then despecify.
             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
@@ -680,13 +716,14 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, PropertyName p
         if ((mode == PutModePut) && !isExtensible())
             return false;
 
-        PropertyStorage newStorage = propertyStorage();
-        if (structure()->shouldGrowPropertyStorage())
-            newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), structure()->suggestedNewPropertyStorageSize());
+        PropertyStorage newStorage = outOfLineStorage();
+        if (structure()->putWillGrowOutOfLineStorage())
+            newStorage = growOutOfLineStorage(globalData, structure()->outOfLineCapacity(), structure()->suggestedNewOutOfLineStorageCapacity());
         offset = structure()->addPropertyWithoutTransition(globalData, propertyName, attributes, specificFunction);
-        setPropertyStorage(globalData, newStorage, structure());
+        setOutOfLineStorage(globalData, newStorage, structure());
 
-        ASSERT(offset < structure()->propertyStorageCapacity());
+        validateOffset(offset);
+        ASSERT(structure()->isValidOffset(offset));
         putDirectOffset(globalData, offset, value);
         // See comment on setNewProperty call below.
         if (!specificFunction)
@@ -694,15 +731,16 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, PropertyName p
         return true;
     }
 
-    size_t offset;
-    size_t currentCapacity = structure()->propertyStorageCapacity();
+    PropertyOffset offset;
+    size_t currentCapacity = structure()->outOfLineCapacity();
     if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(this->structure(), propertyName, attributes, specificFunction, offset)) {
-        PropertyStorage newStorage = propertyStorage(); 
-        if (currentCapacity != structure->propertyStorageCapacity())
-            newStorage = growPropertyStorage(globalData, currentCapacity, structure->propertyStorageCapacity());
+        PropertyStorage newStorage = outOfLineStorage(); 
+        if (currentCapacity != structure->outOfLineCapacity())
+            newStorage = growOutOfLineStorage(globalData, currentCapacity, structure->outOfLineCapacity());
 
-        ASSERT(offset < structure->propertyStorageCapacity());
-        setPropertyStorage(globalData, newStorage, structure);
+        validateOffset(offset);
+        ASSERT(structure->isValidOffset(offset));
+        setOutOfLineStorage(globalData, newStorage, structure);
         putDirectOffset(globalData, offset, value);
         // This is a new property; transitions with specific values are not currently cachable,
         // so leave the slot in an uncachable state.
@@ -714,7 +752,7 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, PropertyName p
     unsigned currentAttributes;
     JSCell* currentSpecificFunction;
     offset = structure()->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
-    if (offset != WTF::notFound) {
+    if (offset != invalidOffset) {
         if ((mode == PutModePut) && currentAttributes & ReadOnly)
             return false;
 
@@ -746,14 +784,12 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, PropertyName p
     if ((mode == PutModePut) && !isExtensible())
         return false;
 
-    PropertyStorage newStorage = propertyStorage();
-    if (structure()->shouldGrowPropertyStorage())
-        newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), structure()->suggestedNewPropertyStorageSize());
-
     Structure* structure = Structure::addPropertyTransition(globalData, this->structure(), propertyName, attributes, specificFunction, offset);
+    
+    validateOffset(offset);
+    ASSERT(structure->isValidOffset(offset));
+    setStructureAndReallocateStorageIfNecessary(globalData, structure);
 
-    ASSERT(offset < structure->propertyStorageCapacity());
-    setPropertyStorage(globalData, newStorage, structure);
     putDirectOffset(globalData, offset, value);
     // This is a new property; transitions with specific values are not currently cachable,
     // so leave the slot in an uncachable state.
@@ -762,6 +798,26 @@ inline bool JSObject::putDirectInternal(JSGlobalData& globalData, PropertyName p
     return true;
 }
 
+inline void JSObject::setStructureAndReallocateStorageIfNecessary(JSGlobalData& globalData, unsigned oldCapacity, Structure* newStructure)
+{
+    ASSERT(oldCapacity <= newStructure->outOfLineCapacity());
+    
+    if (oldCapacity == newStructure->outOfLineCapacity()) {
+        setStructure(globalData, newStructure);
+        return;
+    }
+    
+    PropertyStorage newStorage = growOutOfLineStorage(
+        globalData, oldCapacity, newStructure->outOfLineCapacity());
+    setOutOfLineStorage(globalData, newStorage, newStructure);
+}
+
+inline void JSObject::setStructureAndReallocateStorageIfNecessary(JSGlobalData& globalData, Structure* newStructure)
+{
+    setStructureAndReallocateStorageIfNecessary(
+        globalData, structure()->outOfLineCapacity(), newStructure);
+}
+
 inline bool JSObject::putOwnDataProperty(JSGlobalData& globalData, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(value);
@@ -787,22 +843,14 @@ inline void JSObject::putDirect(JSGlobalData& globalData, PropertyName propertyN
 inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, PropertyName propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
-    PropertyStorage newStorage = propertyStorage();
-    if (structure()->shouldGrowPropertyStorage())
-        newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), structure()->suggestedNewPropertyStorageSize());
-    size_t offset = structure()->addPropertyWithoutTransition(globalData, propertyName, attributes, getCallableObject(value));
-    setPropertyStorage(globalData, newStorage, structure());
+    PropertyStorage newStorage = outOfLineStorage();
+    if (structure()->putWillGrowOutOfLineStorage())
+        newStorage = growOutOfLineStorage(globalData, structure()->outOfLineCapacity(), structure()->suggestedNewOutOfLineStorageCapacity());
+    PropertyOffset offset = structure()->addPropertyWithoutTransition(globalData, propertyName, attributes, getCallableObject(value));
+    setOutOfLineStorage(globalData, newStorage, structure());
     putDirectOffset(globalData, offset, value);
 }
 
-inline void JSObject::transitionTo(JSGlobalData& globalData, Structure* newStructure)
-{
-    PropertyStorage newStorage = propertyStorage();
-    if (structure()->propertyStorageCapacity() != newStructure->propertyStorageCapacity())
-        newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), newStructure->propertyStorageCapacity());
-    setPropertyStorage(globalData, newStorage, newStructure);
-}
-
 inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
 {
     return methodTable()->defaultValue(this, exec, preferredType);
@@ -877,8 +925,6 @@ inline void JSValue::putByIndex(ExecState* exec, unsigned propertyName, JSValue
     asCell()->methodTable()->putByIndex(asCell(), exec, propertyName, value, shouldThrow);
 }
 
-// --- JSValue inlines ----------------------------
-
 ALWAYS_INLINE JSObject* Register::function() const
 {
     if (!jsValue())
@@ -893,6 +939,32 @@ ALWAYS_INLINE Register Register::withCallee(JSObject* callee)
     return r;
 }
 
+// This is a helper for patching code where you want to emit a load or store and
+// the base is:
+// For inline offsets: a pointer to the out-of-line storage pointer.
+// For out-of-line offsets: the base of the out-of-line storage.
+inline size_t offsetRelativeToPatchedStorage(PropertyOffset offset)
+{
+    if (isOutOfLineOffset(offset))
+        return sizeof(EncodedJSValue) * offsetInOutOfLineStorage(offset);
+    return JSObject::offsetOfInlineStorage() - JSObject::offsetOfOutOfLineStorage() + sizeof(EncodedJSValue) * offsetInInlineStorage(offset);
+}
+
+inline int indexRelativeToBase(PropertyOffset offset)
+{
+    if (isOutOfLineOffset(offset))
+        return offsetInOutOfLineStorage(offset);
+    ASSERT(!(JSObject::offsetOfInlineStorage() % sizeof(EncodedJSValue)));
+    return JSObject::offsetOfInlineStorage() / sizeof(EncodedJSValue) + offsetInInlineStorage(offset);
+}
+
+inline int offsetRelativeToBase(PropertyOffset offset)
+{
+    if (isOutOfLineOffset(offset))
+        return offsetInOutOfLineStorage(offset) * sizeof(EncodedJSValue);
+    return JSObject::offsetOfInlineStorage() + offsetInInlineStorage(offset) * sizeof(EncodedJSValue);
+}
+
 } // namespace JSC
 
 #endif // JSObject_h
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index 6ceb3c411..aaf946d3d 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -56,10 +56,10 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
     size_t numCacheableSlots = 0;
     if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasGetterSetterProperties()
         && !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
-        numCacheableSlots = o->structure()->propertyStorageSize();
+        numCacheableSlots = o->structure()->totalStorageSize();
     
     JSPropertyNameIterator* jsPropertyNameIterator = new (NotNull, allocateCell<JSPropertyNameIterator>(*exec->heap())) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
-    jsPropertyNameIterator->finishCreation(exec, propertyNames.data());
+    jsPropertyNameIterator->finishCreation(exec, propertyNames.data(), o);
 
     if (o->structure()->isDictionary())
         return jsPropertyNameIterator;
diff --git a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
index 5b65e59f2..653ee0463 100644
--- a/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -47,12 +47,6 @@ namespace JSC {
         typedef JSCell Base;
 
         static JSPropertyNameIterator* create(ExecState*, JSObject*);
-        static JSPropertyNameIterator* create(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot)
-        {
-            JSPropertyNameIterator* iterator = new (NotNull, allocateCell<JSPropertyNameIterator>(*exec->heap())) JSPropertyNameIterator(exec, propertyNameArrayData, numCacheableSlot);
-            iterator->finishCreation(exec, propertyNameArrayData);
-            return iterator;
-        }
 
         static void destroy(JSCell*);
        
@@ -63,11 +57,11 @@ namespace JSC {
 
         static void visitChildren(JSCell*, SlotVisitor&);
 
-        bool getOffset(size_t i, int& offset)
+        bool getOffset(size_t i, PropertyOffset& offset)
         {
             if (i >= m_numCacheableSlots)
                 return false;
-            offset = i;
+            offset = i + m_offsetBase;
             return true;
         }
 
@@ -88,12 +82,13 @@ namespace JSC {
         static const ClassInfo s_info;
 
     protected:
-        void finishCreation(ExecState* exec, PropertyNameArrayData* propertyNameArrayData)
+        void finishCreation(ExecState* exec, PropertyNameArrayData* propertyNameArrayData, JSObject* object)
         {
             Base::finishCreation(exec->globalData());
             PropertyNameArrayData::PropertyNameVector& propertyNameVector = propertyNameArrayData->propertyNameVector();
             for (size_t i = 0; i < m_jsStringsSize; ++i)
                 m_jsStrings[i].set(exec->globalData(), this, jsOwnedString(exec, propertyNameVector[i].ustring()));
+            m_offsetBase = object->structure()->firstValidOffset();
         }
 
     private:
@@ -105,6 +100,7 @@ namespace JSC {
         WriteBarrier<StructureChain> m_cachedPrototypeChain;
         uint32_t m_numCacheableSlots;
         uint32_t m_jsStringsSize;
+        PropertyOffset m_offsetBase;
         OwnArrayPtr<WriteBarrier<Unknown> > m_jsStrings;
     };
 
diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
index 4fb157c8b..d6fc4c2a1 100644
--- a/Source/JavaScriptCore/runtime/JSString.h
+++ b/Source/JavaScriptCore/runtime/JSString.h
@@ -67,6 +67,7 @@ namespace JSC {
         friend class JSGlobalData;
         friend class SpecializedThunkJIT;
         friend class JSRopeString;
+        friend class MarkStack;
         friend class SlotVisitor;
         friend struct ThunkHelpers;
 
@@ -77,12 +78,14 @@ namespace JSC {
     private:
         JSString(JSGlobalData& globalData, PassRefPtr<StringImpl> value)
             : JSCell(globalData, globalData.stringStructure.get())
+            , m_flags(0)
             , m_value(value)
         {
         }
 
         JSString(JSGlobalData& globalData)
             : JSCell(globalData, globalData.stringStructure.get())
+            , m_flags(0)
         {
         }
 
@@ -91,7 +94,8 @@ namespace JSC {
             ASSERT(!m_value.isNull());
             Base::finishCreation(globalData);
             m_length = length;
-            m_is8Bit = m_value.impl()->is8Bit();
+            setIs8Bit(m_value.impl()->is8Bit());
+            globalData.m_newStringsSinceLastHashConst++;
         }
 
         void finishCreation(JSGlobalData& globalData, size_t length, size_t cost)
@@ -99,8 +103,9 @@ namespace JSC {
             ASSERT(!m_value.isNull());
             Base::finishCreation(globalData);
             m_length = length;
-            m_is8Bit = m_value.impl()->is8Bit();
+            setIs8Bit(m_value.impl()->is8Bit());
             Heap::heap(this)->reportExtraMemoryCost(cost);
+            globalData.m_newStringsSinceLastHashConst++;
         }
 
     protected:
@@ -108,7 +113,8 @@ namespace JSC {
         {
             Base::finishCreation(globalData);
             m_length = 0;
-            m_is8Bit = true;
+            setIs8Bit(true);
+            globalData.m_newStringsSinceLastHashConst++;
         }
         
     public:
@@ -161,10 +167,30 @@ namespace JSC {
 
     protected:
         bool isRope() const { return m_value.isNull(); }
-        bool is8Bit() const { return m_is8Bit; }
+        bool is8Bit() const { return m_flags & Is8Bit; }
+        void setIs8Bit(bool flag)
+        {
+            if (flag)
+                m_flags |= Is8Bit;
+            else
+                m_flags &= ~Is8Bit;
+        }
+        bool shouldTryHashConst();
+        bool isHashConstSingleton() const { return m_flags & IsHashConstSingleton; }
+        void clearHashConstSingleton() { m_flags &= ~IsHashConstSingleton; }
+        void setHashConstSingleton() { m_flags |= IsHashConstSingleton; }
+        bool tryHashConstLock();
+        void releaseHashConstLock();
+
+        unsigned m_flags;
+        
+        enum {
+            HashConstLock = 1u << 2,
+            IsHashConstSingleton = 1u << 1,
+            Is8Bit = 1u
+        };
 
         // A string is represented either by a UString or a rope of fibers.
-        bool m_is8Bit : 1;
         unsigned m_length;
         mutable UString m_value;
 
@@ -231,7 +257,7 @@ namespace JSC {
         {
             Base::finishCreation(globalData);
             m_length = s1->length() + s2->length();
-            m_is8Bit = (s1->is8Bit() && s2->is8Bit());
+            setIs8Bit(s1->is8Bit() && s2->is8Bit());
             m_fibers[0].set(globalData, this, s1);
             m_fibers[1].set(globalData, this, s2);
         }
@@ -240,7 +266,7 @@ namespace JSC {
         {
             Base::finishCreation(globalData);
             m_length = s1->length() + s2->length() + s3->length();
-            m_is8Bit = (s1->is8Bit() && s2->is8Bit() &&  s3->is8Bit());
+            setIs8Bit(s1->is8Bit() && s2->is8Bit() &&  s3->is8Bit());
             m_fibers[0].set(globalData, this, s1);
             m_fibers[1].set(globalData, this, s2);
             m_fibers[2].set(globalData, this, s3);
@@ -255,7 +281,7 @@ namespace JSC {
         {
             m_fibers[index].set(globalData, this, jsString);
             m_length += jsString->m_length;
-            m_is8Bit = m_is8Bit && jsString->m_is8Bit;
+            setIs8Bit(is8Bit() && jsString->is8Bit());
         }
 
         static JSRopeString* createNull(JSGlobalData& globalData)
diff --git a/Source/JavaScriptCore/runtime/JSValue.cpp b/Source/JavaScriptCore/runtime/JSValue.cpp
index e10867176..c34431178 100644
--- a/Source/JavaScriptCore/runtime/JSValue.cpp
+++ b/Source/JavaScriptCore/runtime/JSValue.cpp
@@ -130,8 +130,8 @@ void JSValue::putToPrimitive(ExecState* exec, PropertyName propertyName, JSValue
     for (; ; obj = asObject(prototype)) {
         unsigned attributes;
         JSCell* specificValue;
-        size_t offset = obj->structure()->get(globalData, propertyName, attributes, specificValue);
-        if (offset != WTF::notFound) {
+        PropertyOffset offset = obj->structure()->get(globalData, propertyName, attributes, specificValue);
+        if (offset != invalidOffset) {
             if (attributes & ReadOnly) {
                 if (slot.isStrictMode())
                     throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
diff --git a/Source/JavaScriptCore/runtime/Operations.h b/Source/JavaScriptCore/runtime/Operations.h
index b2081f3dd..497b19d82 100644
--- a/Source/JavaScriptCore/runtime/Operations.h
+++ b/Source/JavaScriptCore/runtime/Operations.h
@@ -297,7 +297,7 @@ namespace JSC {
         return jsAddSlowCase(callFrame, v1, v2);
     }
 
-    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, size_t& slotOffset)
+    inline size_t normalizePrototypeChain(CallFrame* callFrame, JSValue base, JSValue slotBase, const Identifier& propertyName, PropertyOffset& slotOffset)
     {
         JSCell* cell = base.asCell();
         size_t count = 0;
diff --git a/Source/JavaScriptCore/runtime/Options.cpp b/Source/JavaScriptCore/runtime/Options.cpp
index 894ca8cc0..b5ce39c0d 100644
--- a/Source/JavaScriptCore/runtime/Options.cpp
+++ b/Source/JavaScriptCore/runtime/Options.cpp
@@ -26,9 +26,15 @@
 #include "config.h"
 #include "Options.h"
 
+#include <algorithm>
 #include <limits>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
 #include <wtf/NumberOfCores.h>
 #include <wtf/PageBlock.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/StringExtras.h>
 
 #if OS(DARWIN) && ENABLE(PARALLEL_GC)
 #include <sys/sysctl.h>
@@ -37,71 +43,9 @@
 // Set to 1 to control the heuristics using environment variables.
 #define ENABLE_RUN_TIME_HEURISTICS 0
 
-#if ENABLE(RUN_TIME_HEURISTICS)
-#include <stdio.h>
-#include <stdlib.h>
-#include <wtf/StdLibExtras.h>
-#endif
-
-namespace JSC { namespace Options {
-
-bool useJIT;
-
-bool showDisassembly;
-bool showDFGDisassembly;
-
-unsigned maximumOptimizationCandidateInstructionCount;
-
-unsigned maximumFunctionForCallInlineCandidateInstructionCount;
-unsigned maximumFunctionForConstructInlineCandidateInstructionCount;
-
-unsigned maximumInliningDepth;
-
-int32_t thresholdForJITAfterWarmUp;
-int32_t thresholdForJITSoon;
-
-int32_t thresholdForOptimizeAfterWarmUp;
-int32_t thresholdForOptimizeAfterLongWarmUp;
-int32_t thresholdForOptimizeSoon;
 
-int32_t executionCounterIncrementForLoop;
-int32_t executionCounterIncrementForReturn;
+namespace JSC {
 
-bool randomizeExecutionCountsBetweenCheckpoints;
-int32_t maximumExecutionCountsBetweenCheckpoints;
-
-unsigned desiredSpeculativeSuccessFailRatio;
-
-double likelyToTakeSlowCaseThreshold;
-double couldTakeSlowCaseThreshold;
-unsigned likelyToTakeSlowCaseMinimumCount;
-unsigned couldTakeSlowCaseMinimumCount;
-
-double osrExitProminenceForFrequentExitSite;
-
-unsigned largeFailCountThresholdBase;
-unsigned largeFailCountThresholdBaseForLoop;
-unsigned forcedOSRExitCountForReoptimization;
-
-unsigned reoptimizationRetryCounterMax;
-unsigned reoptimizationRetryCounterStep;
-
-unsigned minimumOptimizationDelay;
-unsigned maximumOptimizationDelay;
-double desiredProfileLivenessRate;
-double desiredProfileFullnessRate;
-
-double doubleVoteRatioForDoubleFormat;
-
-unsigned minimumNumberOfScansBetweenRebalance;
-unsigned gcMarkStackSegmentSize;
-unsigned numberOfGCMarkers;
-unsigned opaqueRootMergeThreshold;
-
-bool forceWeakRandomSeed;
-unsigned forcedWeakRandomSeed;
-
-#if ENABLE(RUN_TIME_HEURISTICS)
 static bool parse(const char* string, bool& value)
 {
     if (!strcasecmp(string, "true") || !strcasecmp(string, "yes") || !strcmp(string, "1")) {
@@ -130,27 +74,22 @@ static bool parse(const char* string, double& value)
     return sscanf(string, "%lf", &value) == 1;
 }
 
-template<typename T, typename U>
-void setHeuristic(T& variable, const char* name, U value)
+#if ENABLE(RUN_TIME_HEURISTICS)
+template<typename T>
+void overrideOptionWithHeuristic(T& variable, const char* name)
 {
     const char* stringValue = getenv(name);
-    if (!stringValue) {
-        variable = safeCast<T>(value);
+    if (!stringValue)
         return;
-    }
     
     if (parse(stringValue, variable))
         return;
     
     fprintf(stderr, "WARNING: failed to parse %s=%s\n", name, stringValue);
-    variable = safeCast<T>(value);
 }
-
-#define SET(variable, value) setHeuristic(variable, "JSC_" #variable, value)
-#else
-#define SET(variable, value) variable = value
 #endif
 
+
 static unsigned computeNumberOfGCMarkers(int maxNumberOfGCMarkers)
 {
     int cpusToUse = 1;
@@ -167,80 +106,116 @@ static unsigned computeNumberOfGCMarkers(int maxNumberOfGCMarkers)
     return cpusToUse;
 }
 
-void initializeOptions()
-{
-    SET(useJIT, true);
-    
-    SET(showDisassembly, false);
-    SET(showDFGDisassembly, false);
-    
-    SET(maximumOptimizationCandidateInstructionCount, 10000);
-    
-    SET(maximumFunctionForCallInlineCandidateInstructionCount, 180);
-    SET(maximumFunctionForConstructInlineCandidateInstructionCount, 100);
-    
-    SET(maximumInliningDepth, 5);
+Options::Entry Options::s_options[Options::numberOfOptions];
 
-    SET(thresholdForJITAfterWarmUp,     100);
-    SET(thresholdForJITSoon,            100);
+// Realize the names for each of the options:
+const Options::EntryInfo Options::s_optionsInfo[Options::numberOfOptions] = {
+#define FOR_EACH_OPTION(type_, name_, defaultValue_) \
+    { #name_, Options::type_##Type },
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+};
 
-    SET(thresholdForOptimizeAfterWarmUp,     1000);
-    SET(thresholdForOptimizeAfterLongWarmUp, 5000);
-    SET(thresholdForOptimizeSoon,            1000);
-
-    SET(executionCounterIncrementForLoop,   1);
-    SET(executionCounterIncrementForReturn, 15);
-    
-    SET(randomizeExecutionCountsBetweenCheckpoints, false);
-    SET(maximumExecutionCountsBetweenCheckpoints, 1000);
-
-    SET(desiredSpeculativeSuccessFailRatio, 6);
-    
-    SET(likelyToTakeSlowCaseThreshold,    0.15);
-    SET(couldTakeSlowCaseThreshold,       0.05); // Shouldn't be zero because some ops will spuriously take slow case, for example for linking or caching.
-    SET(likelyToTakeSlowCaseMinimumCount, 100);
-    SET(couldTakeSlowCaseMinimumCount,    10);
+void Options::initialize()
+{
+    // Initialize each of the options with their default values:
+#define FOR_EACH_OPTION(type_, name_, defaultValue_) \
+    name_() = defaultValue_;
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+        
+    // Allow environment vars to override options if applicable.
+    // The evn var should be the name of the option prefixed with
+    // "JSC_".
+#if ENABLE(RUN_TIME_HEURISTICS)
+#define FOR_EACH_OPTION(type_, name_, defaultValue_) \
+    overrideOptionWithHeuristic(name_(), "JSC_" #name_);
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+#endif // RUN_TIME_HEURISTICS
+
+#if 0
+    ; // Deconfuse editors that do auto indentation
+#endif
     
-    SET(osrExitProminenceForFrequentExitSite, 0.3);
-
-    SET(largeFailCountThresholdBase,         20);
-    SET(largeFailCountThresholdBaseForLoop,  1);
-    SET(forcedOSRExitCountForReoptimization, 250);
+    // Do range checks where needed and make corrections to the options:
+    ASSERT(thresholdForOptimizeAfterLongWarmUp() >= thresholdForOptimizeAfterWarmUp());
+    ASSERT(thresholdForOptimizeAfterWarmUp() >= thresholdForOptimizeSoon());
+    ASSERT(thresholdForOptimizeAfterWarmUp() >= 0);
 
-    SET(reoptimizationRetryCounterStep, 1);
-
-    SET(minimumOptimizationDelay,   1);
-    SET(maximumOptimizationDelay,   5);
-    SET(desiredProfileLivenessRate, 0.75);
-    SET(desiredProfileFullnessRate, 0.35);
-    
-    SET(doubleVoteRatioForDoubleFormat, 2);
-    
-    SET(minimumNumberOfScansBetweenRebalance, 100);
-    SET(gcMarkStackSegmentSize,               pageSize());
-    SET(opaqueRootMergeThreshold,             1000);
-    SET(numberOfGCMarkers, computeNumberOfGCMarkers(7)); // We don't scale so well beyond 7.
-
-    ASSERT(thresholdForOptimizeAfterLongWarmUp >= thresholdForOptimizeAfterWarmUp);
-    ASSERT(thresholdForOptimizeAfterWarmUp >= thresholdForOptimizeSoon);
-    ASSERT(thresholdForOptimizeAfterWarmUp >= 0);
-    
     // Compute the maximum value of the reoptimization retry counter. This is simply
     // the largest value at which we don't overflow the execute counter, when using it
     // to left-shift the execution counter by this amount. Currently the value ends
     // up being 18, so this loop is not so terrible; it probably takes up ~100 cycles
     // total on a 32-bit processor.
-    reoptimizationRetryCounterMax = 0;
-    while ((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp) << (reoptimizationRetryCounterMax + 1)) <= static_cast<int64_t>(std::numeric_limits<int32_t>::max()))
-        reoptimizationRetryCounterMax++;
-    
-    ASSERT((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp) << reoptimizationRetryCounterMax) > 0);
-    ASSERT((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp) << reoptimizationRetryCounterMax) <= static_cast<int64_t>(std::numeric_limits<int32_t>::max()));
-    
-    SET(forceWeakRandomSeed, false);
-    SET(forcedWeakRandomSeed, 0);
+    reoptimizationRetryCounterMax() = 0;
+    while ((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp()) << (reoptimizationRetryCounterMax() + 1)) <= static_cast<int64_t>(std::numeric_limits<int32>::max()))
+        reoptimizationRetryCounterMax()++;
+
+    ASSERT((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp()) << reoptimizationRetryCounterMax()) > 0);
+    ASSERT((static_cast<int64_t>(thresholdForOptimizeAfterLongWarmUp()) << reoptimizationRetryCounterMax()) <= static_cast<int64_t>(std::numeric_limits<int32>::max()));
 }
 
-} } // namespace JSC::Options
+// Parses a single command line option in the format "<optionName>=<value>"
+// (no spaces allowed) and set the specified option if appropriate.
+bool Options::setOption(const char* arg)
+{
+    // arg should look like this:
+    //   <jscOptionName>=<appropriate value>
+    const char* equalStr = strchr(arg, '=');
+    if (!equalStr)
+        return false;
+
+    const char* valueStr = equalStr + 1;
+
+    // For each option, check if the specify arg is a match. If so, set the arg
+    // if the value makes sense. Otherwise, move on to checking the next option.
+#define FOR_EACH_OPTION(type_, name_, defaultValue_)    \
+    if (!strncmp(arg, #name_, equalStr - arg)) {        \
+        type_ value;                                    \
+        bool success = parse(valueStr, value);          \
+        if (success) {                                  \
+            name_() = value;                            \
+            return true;                                \
+        }                                               \
+        return false;                                   \
+    }
+
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+        return false; // No option matched.
+}
+
+void Options::dumpAllOptions(FILE* stream)
+{
+    fprintf(stream, "JSC runtime options:\n");
+    for (int id = 0; id < numberOfOptions; id++)
+        dumpOption(static_cast<OptionID>(id), stream, "   ", "\n");
+}
+
+void Options::dumpOption(OptionID id, FILE* stream, const char* header, const char* footer)
+{
+    if (id >= numberOfOptions)
+        return; // Illegal option.
+
+    fprintf(stream, "%s%s: ", header, s_optionsInfo[id].name);
+    switch (s_optionsInfo[id].type) {
+    case boolType:
+        fprintf(stream, "%s", s_options[id].u.boolVal?"true":"false");
+        break;
+    case unsignedType:
+        fprintf(stream, "%u", s_options[id].u.unsignedVal);
+        break;
+    case doubleType:
+        fprintf(stream, "%lf", s_options[id].u.doubleVal);
+        break;
+    case int32Type:
+        fprintf(stream, "%d", s_options[id].u.int32Val);
+        break;
+    }
+    fprintf(stream, "%s", footer);
+}
 
+} // namespace JSC
 
diff --git a/Source/JavaScriptCore/runtime/Options.h b/Source/JavaScriptCore/runtime/Options.h
index 1bce5b944..0a55bda6b 100644
--- a/Source/JavaScriptCore/runtime/Options.h
+++ b/Source/JavaScriptCore/runtime/Options.h
@@ -26,70 +26,167 @@
 #ifndef Options_h
 #define Options_h
 
+#include "JSExportMacros.h"
 #include <stdint.h>
-
-namespace JSC { namespace Options {
-
-extern bool useJIT;
-
-extern bool showDisassembly;
-extern bool showDFGDisassembly; // showDisassembly implies showDFGDisassembly.
-
-extern unsigned maximumOptimizationCandidateInstructionCount;
-
-extern unsigned maximumFunctionForCallInlineCandidateInstructionCount;
-extern unsigned maximumFunctionForConstructInlineCandidateInstructionCount;
-
-extern unsigned maximumInliningDepth; // Depth of inline stack, so 1 = no inlining, 2 = one level, etc.
-
-extern int32_t thresholdForJITAfterWarmUp;
-extern int32_t thresholdForJITSoon;
-
-extern int32_t thresholdForOptimizeAfterWarmUp;
-extern int32_t thresholdForOptimizeAfterLongWarmUp;
-extern int32_t thresholdForOptimizeSoon;
-extern int32_t thresholdForOptimizeNextInvocation;
-
-extern int32_t executionCounterIncrementForLoop;
-extern int32_t executionCounterIncrementForReturn;
-
-extern bool randomizeExecutionCountsBetweenCheckpoints;
-extern int32_t maximumExecutionCountsBetweenCheckpoints;
-
-extern unsigned desiredSpeculativeSuccessFailRatio;
-
-extern double likelyToTakeSlowCaseThreshold;
-extern double couldTakeSlowCaseThreshold;
-extern unsigned likelyToTakeSlowCaseMinimumCount;
-extern unsigned couldTakeSlowCaseMinimumCount;
-
-extern double osrExitProminenceForFrequentExitSite;
-
-extern unsigned largeFailCountThresholdBase;
-extern unsigned largeFailCountThresholdBaseForLoop;
-extern unsigned forcedOSRExitCountForReoptimization;
-
-extern unsigned reoptimizationRetryCounterMax;
-extern unsigned reoptimizationRetryCounterStep;
-
-extern unsigned minimumOptimizationDelay;
-extern unsigned maximumOptimizationDelay;
-extern double desiredProfileLivenessRate;
-extern double desiredProfileFullnessRate;
-
-extern double doubleVoteRatioForDoubleFormat;
-
-extern unsigned minimumNumberOfScansBetweenRebalance;
-extern unsigned gcMarkStackSegmentSize;
-JS_EXPORTDATA extern unsigned numberOfGCMarkers;
-JS_EXPORTDATA extern unsigned opaqueRootMergeThreshold;
-
-extern bool forceWeakRandomSeed;
-extern unsigned forcedWeakRandomSeed;
-
-void initializeOptions();
-
-} } // namespace JSC::Options
+#include <stdio.h>
+
+namespace JSC {
+
+// How do JSC VM options work?
+// ===========================
+// The JSC_OPTIONS() macro below defines a list of all JSC options in use,
+// along with their types and default values. The options values are actually
+// realized as an array of Options::Entry elements.
+//
+//     Options::initialize() will initialize the array of options values with
+// the defaults specified in JSC_OPTIONS() below. After that, the values can
+// be programmatically read and written to using an accessor method with the
+// same name as the option. For example, the option "useJIT" can be read and
+// set like so:
+//
+//     bool jitIsOn = Options::useJIT();  // Get the option value.
+//     Options::useJIT() = false;         // Sets the option value.
+//
+//     If you want to tweak any of these values programmatically for testing
+// purposes, you can do so in Options::initialize() after the default values
+// are set.
+//
+//     Alternatively, you can enable RUN_TIME_HEURISTICS which will allow you
+// to override the default values by specifying environment variables of the
+// form: JSC_<name of JSC option>.
+//
+// Note: Options::initialize() tries to ensure some sanity on the option values
+// which are set by doing some range checks, and value corrections. These
+// checks are done after the option values are set. If you alter the option
+// values after the sanity checks (for your own testing), then you're liable to
+// ensure that the new values set are sane and reasonable for your own run.
+
+
+#define JSC_OPTIONS(v) \
+    v(bool, useJIT,    true) \
+    v(bool, useDFGJIT, true) \
+    \
+    /* showDisassembly implies showDFGDisassembly. */ \
+    v(bool, showDisassembly, false) \
+    v(bool, showDFGDisassembly, false) \
+    \
+    v(unsigned, maximumOptimizationCandidateInstructionCount, 10000) \
+    \
+    v(unsigned, maximumFunctionForCallInlineCandidateInstructionCount, 180) \
+    v(unsigned, maximumFunctionForConstructInlineCandidateInstructionCount, 100) \
+    \
+    /* Depth of inline stack, so 1 = no inlining, 2 = one level, etc. */ \
+    v(unsigned, maximumInliningDepth, 5) \
+    \
+    v(int32, thresholdForJITAfterWarmUp, 100) \
+    v(int32, thresholdForJITSoon, 100) \
+    \
+    v(int32, thresholdForOptimizeAfterWarmUp, 1000) \
+    v(int32, thresholdForOptimizeAfterLongWarmUp, 5000) \
+    v(int32, thresholdForOptimizeSoon, 1000) \
+    \
+    v(int32, executionCounterIncrementForLoop, 1) \
+    v(int32, executionCounterIncrementForReturn, 15) \
+    \
+    v(bool, randomizeExecutionCountsBetweenCheckpoints, false) \
+    v(int32, maximumExecutionCountsBetweenCheckpoints, 1000) \
+    \
+    v(double, likelyToTakeSlowCaseThreshold, 0.15) \
+    v(double, couldTakeSlowCaseThreshold, 0.05) \
+    v(unsigned, likelyToTakeSlowCaseMinimumCount, 100) \
+    v(unsigned, couldTakeSlowCaseMinimumCount, 10) \
+    \
+    v(double, osrExitProminenceForFrequentExitSite, 0.3) \
+    v(unsigned, osrExitCountForReoptimization, 100) \
+    v(unsigned, osrExitCountForReoptimizationFromLoop, 5) \
+    \
+    v(unsigned, reoptimizationRetryCounterMax, 0)  \
+    v(unsigned, reoptimizationRetryCounterStep, 1) \
+    \
+    v(unsigned, minimumOptimizationDelay, 1) \
+    v(unsigned, maximumOptimizationDelay, 5) \
+    v(double, desiredProfileLivenessRate, 0.75) \
+    v(double, desiredProfileFullnessRate, 0.35) \
+    \
+    v(double, doubleVoteRatioForDoubleFormat, 2) \
+    \
+    v(unsigned, minimumNumberOfScansBetweenRebalance, 100) \
+    v(unsigned, gcMarkStackSegmentSize, pageSize()) \
+    v(unsigned, numberOfGCMarkers, computeNumberOfGCMarkers(7)) \
+    v(unsigned, opaqueRootMergeThreshold, 1000) \
+    \
+    v(bool, forceWeakRandomSeed, false) \
+    v(unsigned, forcedWeakRandomSeed, 0)
+
+
+class Options {
+public:
+    // This typedef is to allow us to eliminate the '_' in the field name in
+    // union inside Entry. This is needed to keep the style checker happy.
+    typedef int32_t int32;
+
+    // Declare the option IDs:
+    enum OptionID {
+#define FOR_EACH_OPTION(type_, name_, defaultValue_) \
+        OPT_##name_,
+        JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+        numberOfOptions
+    };
+
+
+    static void initialize();
+
+    // Parses a single command line option in the format "<optionName>=<value>"
+    // (no spaces allowed) and set the specified option if appropriate.
+    JS_EXPORT_PRIVATE static bool setOption(const char* arg);
+    JS_EXPORT_PRIVATE static void dumpAllOptions(FILE* stream = stdout);
+    static void dumpOption(OptionID id, FILE* stream = stdout, const char* header = "", const char* footer = "");
+
+    // Declare accessors for each option:
+#define FOR_EACH_OPTION(type_, name_, defaultValue_) \
+    ALWAYS_INLINE static type_& name_() { return s_options[OPT_##name_].u.type_##Val; }
+
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+private:
+    enum EntryType {
+        boolType,
+        unsignedType,
+        doubleType,
+        int32Type
+    };
+
+    // For storing for an option value:
+    struct Entry {
+        union {
+            bool boolVal;
+            unsigned unsignedVal;
+            double doubleVal;
+            int32 int32Val;
+        } u;
+    };
+
+    // For storing constant meta data about each option:
+    struct EntryInfo {
+        const char* name;
+        EntryType type;
+    };
+
+    Options();
+
+    // Declare the options:
+#define FOR_EACH_OPTION(type_, name_, defaultValue_) \
+    type_ m_##name_;
+    JSC_OPTIONS(FOR_EACH_OPTION)
+#undef FOR_EACH_OPTION
+
+    // Declare the singleton instance of the options store:
+    JS_EXPORTDATA static Entry s_options[numberOfOptions];
+    static const EntryInfo s_optionsInfo[numberOfOptions];
+};
+
+} // namespace JSC
 
 #endif // Options_h
-
diff --git a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
index c47f3476a..5953f5e87 100644
--- a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -21,6 +21,7 @@
 #ifndef PropertyMapHashTable_h
 #define PropertyMapHashTable_h
 
+#include "PropertyOffset.h"
 #include "UString.h"
 #include "WriteBarrier.h"
 #include <wtf/HashTable.h>
@@ -72,11 +73,11 @@ inline unsigned nextPowerOf2(unsigned v)
 
 struct PropertyMapEntry {
     StringImpl* key;
-    unsigned offset;
+    PropertyOffset offset;
     unsigned attributes;
     WriteBarrier<JSCell> specificValue;
 
-    PropertyMapEntry(JSGlobalData& globalData, JSCell* owner, StringImpl* key, unsigned offset, unsigned attributes, JSCell* specificValue)
+    PropertyMapEntry(JSGlobalData& globalData, JSCell* owner, StringImpl* key, PropertyOffset offset, unsigned attributes, JSCell* specificValue)
         : key(key)
         , offset(offset)
         , attributes(attributes)
@@ -174,8 +175,10 @@ public:
     // Used to maintain a list of unused entries in the property storage.
     void clearDeletedOffsets();
     bool hasDeletedOffset();
-    unsigned getDeletedOffset();
-    void addDeletedOffset(unsigned offset);
+    PropertyOffset getDeletedOffset();
+    void addDeletedOffset(PropertyOffset);
+    
+    PropertyOffset nextOffset(JSType);
 
     // Copy this PropertyTable, ensuring the copy has at least the capacity provided.
     PassOwnPtr<PropertyTable> copy(JSGlobalData&, JSCell* owner, unsigned newCapacity);
@@ -230,7 +233,7 @@ private:
     unsigned* m_index;
     unsigned m_keyCount;
     unsigned m_deletedCount;
-    OwnPtr< Vector<unsigned> > m_deletedOffsets;
+    OwnPtr< Vector<PropertyOffset> > m_deletedOffsets;
 
     static const unsigned MinimumTableSize = 16;
     static const unsigned EmptyEntryIndex = 0;
@@ -264,9 +267,9 @@ inline PropertyTable::PropertyTable(JSGlobalData&, JSCell* owner, const Property
     }
 
     // Copy the m_deletedOffsets vector.
-    Vector<unsigned>* otherDeletedOffsets = other.m_deletedOffsets.get();
+    Vector<PropertyOffset>* otherDeletedOffsets = other.m_deletedOffsets.get();
     if (otherDeletedOffsets)
-        m_deletedOffsets = adoptPtr(new Vector<unsigned>(*otherDeletedOffsets));
+        m_deletedOffsets = adoptPtr(new Vector<PropertyOffset>(*otherDeletedOffsets));
 }
 
 inline PropertyTable::PropertyTable(JSGlobalData&, JSCell* owner, unsigned initialCapacity, const PropertyTable& other)
@@ -288,9 +291,9 @@ inline PropertyTable::PropertyTable(JSGlobalData&, JSCell* owner, unsigned initi
     }
 
     // Copy the m_deletedOffsets vector.
-    Vector<unsigned>* otherDeletedOffsets = other.m_deletedOffsets.get();
+    Vector<PropertyOffset>* otherDeletedOffsets = other.m_deletedOffsets.get();
     if (otherDeletedOffsets)
-        m_deletedOffsets = adoptPtr(new Vector<unsigned>(*otherDeletedOffsets));
+        m_deletedOffsets = adoptPtr(new Vector<PropertyOffset>(*otherDeletedOffsets));
 }
 
 inline PropertyTable::~PropertyTable()
@@ -469,20 +472,31 @@ inline bool PropertyTable::hasDeletedOffset()
     return m_deletedOffsets && !m_deletedOffsets->isEmpty();
 }
 
-inline unsigned PropertyTable::getDeletedOffset()
+inline PropertyOffset PropertyTable::getDeletedOffset()
 {
-    unsigned offset = m_deletedOffsets->last();
+    PropertyOffset offset = m_deletedOffsets->last();
     m_deletedOffsets->removeLast();
     return offset;
 }
 
-inline void PropertyTable::addDeletedOffset(unsigned offset)
+inline void PropertyTable::addDeletedOffset(PropertyOffset offset)
 {
     if (!m_deletedOffsets)
-        m_deletedOffsets = adoptPtr(new Vector<unsigned>);
+        m_deletedOffsets = adoptPtr(new Vector<PropertyOffset>);
     m_deletedOffsets->append(offset);
 }
 
+inline PropertyOffset PropertyTable::nextOffset(JSType type)
+{
+    if (hasDeletedOffset())
+        return getDeletedOffset();
+    
+    if (type == FinalObjectType)
+        return size();
+    
+    return size() + firstOutOfLineOffset;
+}
+
 inline PassOwnPtr<PropertyTable> PropertyTable::copy(JSGlobalData& globalData, JSCell* owner, unsigned newCapacity)
 {
     ASSERT(newCapacity >= m_keyCount);
@@ -499,7 +513,7 @@ inline size_t PropertyTable::sizeInMemory()
 {
     size_t result = sizeof(PropertyTable) + dataSize();
     if (m_deletedOffsets)
-        result += (m_deletedOffsets->capacity() * sizeof(unsigned));
+        result += (m_deletedOffsets->capacity() * sizeof(PropertyOffset));
     return result;
 }
 #endif
diff --git a/Source/JavaScriptCore/runtime/PropertyOffset.h b/Source/JavaScriptCore/runtime/PropertyOffset.h
new file mode 100644
index 000000000..c0d1316c4
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/PropertyOffset.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PropertyOffset_h
+#define PropertyOffset_h
+
+#include "JSType.h"
+#include <wtf/Platform.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+namespace JSC {
+
+#if USE(JSVALUE32_64)
+#define INLINE_STORAGE_CAPACITY 6
+#else
+#define INLINE_STORAGE_CAPACITY 4
+#endif
+
+typedef int PropertyOffset;
+
+static const PropertyOffset invalidOffset = -1;
+static const PropertyOffset inlineStorageCapacity = INLINE_STORAGE_CAPACITY;
+static const PropertyOffset firstOutOfLineOffset = inlineStorageCapacity;
+
+// Declare all of the functions because they tend to do forward calls.
+inline void checkOffset(PropertyOffset);
+inline void checkOffset(PropertyOffset, JSType);
+inline void validateOffset(PropertyOffset);
+inline void validateOffset(PropertyOffset, JSType);
+inline bool isValidOffset(PropertyOffset);
+inline bool isInlineOffset(PropertyOffset);
+inline bool isOutOfLineOffset(PropertyOffset);
+inline size_t offsetInInlineStorage(PropertyOffset);
+inline size_t offsetInOutOfLineStorage(PropertyOffset);
+inline size_t offsetInRespectiveStorage(PropertyOffset);
+inline size_t numberOfOutOfLineSlotsForLastOffset(PropertyOffset);
+inline size_t numberOfSlotsForLastOffset(PropertyOffset, JSType);
+inline PropertyOffset nextPropertyOffsetFor(PropertyOffset, JSType);
+inline PropertyOffset firstPropertyOffsetFor(JSType);
+
+inline void checkOffset(PropertyOffset offset)
+{
+    UNUSED_PARAM(offset);
+    ASSERT(offset >= invalidOffset);
+}
+
+inline void checkOffset(PropertyOffset offset, JSType type)
+{
+    UNUSED_PARAM(offset);
+    UNUSED_PARAM(type);
+    ASSERT(offset >= invalidOffset);
+    ASSERT(offset == invalidOffset
+           || type == FinalObjectType
+           || isOutOfLineOffset(offset));
+}
+
+inline void validateOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    ASSERT(isValidOffset(offset));
+}
+
+inline void validateOffset(PropertyOffset offset, JSType type)
+{
+    checkOffset(offset, type);
+    ASSERT(isValidOffset(offset));
+}
+
+inline bool isValidOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    return offset != invalidOffset;
+}
+
+inline bool isInlineOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    return offset < inlineStorageCapacity;
+}
+
+inline bool isOutOfLineOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    return !isInlineOffset(offset);
+}
+
+inline size_t offsetInInlineStorage(PropertyOffset offset)
+{
+    validateOffset(offset);
+    ASSERT(isInlineOffset(offset));
+    return offset;
+}
+
+inline size_t offsetInOutOfLineStorage(PropertyOffset offset)
+{
+    validateOffset(offset);
+    ASSERT(isOutOfLineOffset(offset));
+    return offset - firstOutOfLineOffset;
+}
+
+inline size_t offsetInRespectiveStorage(PropertyOffset offset)
+{
+    if (isInlineOffset(offset))
+        return offsetInInlineStorage(offset);
+    return offsetInOutOfLineStorage(offset);
+}
+
+inline size_t numberOfOutOfLineSlotsForLastOffset(PropertyOffset offset)
+{
+    checkOffset(offset);
+    if (offset < firstOutOfLineOffset)
+        return 0;
+    return offset - firstOutOfLineOffset + 1;
+}
+
+inline size_t numberOfSlotsForLastOffset(PropertyOffset offset, JSType type)
+{
+    checkOffset(offset, type);
+    if (type == FinalObjectType)
+        return offset + 1;
+    return numberOfOutOfLineSlotsForLastOffset(offset);
+}
+
+inline PropertyOffset nextPropertyOffsetFor(PropertyOffset offset, JSType type)
+{
+    checkOffset(offset, type);
+    if (type != FinalObjectType && offset == invalidOffset)
+        return firstOutOfLineOffset;
+    return offset + 1;
+}
+
+inline PropertyOffset firstPropertyOffsetFor(JSType type)
+{
+    return nextPropertyOffsetFor(invalidOffset, type);
+}
+
+} // namespace JSC
+
+#endif // PropertyOffset_h
+
diff --git a/Source/JavaScriptCore/runtime/PropertySlot.h b/Source/JavaScriptCore/runtime/PropertySlot.h
index 131cf7a92..c673eaa50 100644
--- a/Source/JavaScriptCore/runtime/PropertySlot.h
+++ b/Source/JavaScriptCore/runtime/PropertySlot.h
@@ -23,6 +23,7 @@
 
 #include "JSValue.h"
 #include "PropertyName.h"
+#include "PropertyOffset.h"
 #include "Register.h"
 #include <wtf/Assertions.h>
 #include <wtf/NotFound.h>
@@ -89,7 +90,7 @@ namespace JSC {
         CachedPropertyType cachedPropertyType() const { return m_cachedPropertyType; }
         bool isCacheable() const { return m_cachedPropertyType != Uncacheable; }
         bool isCacheableValue() const { return m_cachedPropertyType == Value; }
-        size_t cachedOffset() const
+        PropertyOffset cachedOffset() const
         {
             ASSERT(isCacheable());
             return m_offset;
@@ -104,7 +105,7 @@ namespace JSC {
             m_value = value;
         }
         
-        void setValue(JSValue slotBase, JSValue value, size_t offset)
+        void setValue(JSValue slotBase, JSValue value, PropertyOffset offset)
         {
             ASSERT(value);
             m_getValue = JSC_VALUE_MARKER;
@@ -160,7 +161,7 @@ namespace JSC {
             m_data.getterFunc = getterFunc;
         }
 
-        void setCacheableGetterSlot(JSValue slotBase, JSObject* getterFunc, unsigned offset)
+        void setCacheableGetterSlot(JSValue slotBase, JSObject* getterFunc, PropertyOffset offset)
         {
             ASSERT(getterFunc);
             m_getValue = GETTER_FUNCTION_MARKER;
@@ -206,7 +207,7 @@ namespace JSC {
         {
             // Clear offset even in release builds, in case this PropertySlot has been used before.
             // (For other data members, we don't need to clear anything because reuse would meaningfully overwrite them.)
-            m_offset = 0;
+            m_offset = invalidOffset;
             m_cachedPropertyType = Uncacheable;
         }
 
@@ -232,7 +233,7 @@ namespace JSC {
         JSValue m_value;
         JSValue m_thisValue;
 
-        size_t m_offset;
+        PropertyOffset m_offset;
         CachedPropertyType m_cachedPropertyType;
     };
 
diff --git a/Source/JavaScriptCore/runtime/PutPropertySlot.h b/Source/JavaScriptCore/runtime/PutPropertySlot.h
index 69d1f8bd2..0f694e33b 100644
--- a/Source/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/Source/JavaScriptCore/runtime/PutPropertySlot.h
@@ -45,14 +45,14 @@ namespace JSC {
         {
         }
 
-        void setExistingProperty(JSObject* base, size_t offset)
+        void setExistingProperty(JSObject* base, PropertyOffset offset)
         {
             m_type = ExistingProperty;
             m_base = base;
             m_offset = offset;
         }
 
-        void setNewProperty(JSObject* base, size_t offset)
+        void setNewProperty(JSObject* base, PropertyOffset offset)
         {
             m_type = NewProperty;
             m_base = base;
@@ -64,7 +64,8 @@ namespace JSC {
 
         bool isStrictMode() const { return m_isStrictMode; }
         bool isCacheable() const { return m_type != Uncachable; }
-        size_t cachedOffset() const {
+        PropertyOffset cachedOffset() const
+        {
             ASSERT(isCacheable());
             return m_offset;
         }
@@ -72,7 +73,7 @@ namespace JSC {
     private:
         Type m_type;
         JSObject* m_base;
-        size_t m_offset;
+        PropertyOffset m_offset;
         bool m_isStrictMode;
     };
 
diff --git a/Source/JavaScriptCore/runtime/Structure.cpp b/Source/JavaScriptCore/runtime/Structure.cpp
index 569126147..509ff3d45 100644
--- a/Source/JavaScriptCore/runtime/Structure.cpp
+++ b/Source/JavaScriptCore/runtime/Structure.cpp
@@ -156,8 +156,8 @@ Structure::Structure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSV
     , m_prototype(globalData, this, prototype)
     , m_classInfo(classInfo)
     , m_transitionWatchpointSet(InitializedWatching)
-    , m_propertyStorageCapacity(typeInfo.isFinalObject() ? JSFinalObject_inlineStorageCapacity : JSNonFinalObject_inlineStorageCapacity)
-    , m_offset(noOffset)
+    , m_outOfLineCapacity(0)
+    , m_offset(invalidOffset)
     , m_dictionaryKind(NoneDictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
@@ -179,8 +179,8 @@ Structure::Structure(JSGlobalData& globalData)
     , m_prototype(globalData, this, jsNull())
     , m_classInfo(&s_info)
     , m_transitionWatchpointSet(InitializedWatching)
-    , m_propertyStorageCapacity(0)
-    , m_offset(noOffset)
+    , m_outOfLineCapacity(0)
+    , m_offset(invalidOffset)
     , m_dictionaryKind(NoneDictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(false)
@@ -200,8 +200,8 @@ Structure::Structure(JSGlobalData& globalData, const Structure* previous)
     , m_prototype(globalData, this, previous->storedPrototype())
     , m_classInfo(previous->m_classInfo)
     , m_transitionWatchpointSet(InitializedWatching)
-    , m_propertyStorageCapacity(previous->m_propertyStorageCapacity)
-    , m_offset(noOffset)
+    , m_outOfLineCapacity(previous->m_outOfLineCapacity)
+    , m_offset(invalidOffset)
     , m_dictionaryKind(previous->m_dictionaryKind)
     , m_isPinnedPropertyTable(false)
     , m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
@@ -239,7 +239,7 @@ void Structure::materializePropertyMap(JSGlobalData& globalData)
             ASSERT(structure->m_propertyTable);
             ASSERT(!structure->m_previous);
 
-            m_propertyTable = structure->m_propertyTable->copy(globalData, 0, m_offset + 1);
+            m_propertyTable = structure->m_propertyTable->copy(globalData, 0, numberOfSlotsForLastOffset(m_offset, m_typeInfo.type()));
             break;
         }
 
@@ -247,7 +247,7 @@ void Structure::materializePropertyMap(JSGlobalData& globalData)
     }
 
     if (!m_propertyTable)
-        createPropertyMap(m_offset + 1);
+        createPropertyMap(numberOfSlotsForLastOffset(m_offset, m_typeInfo.type()));
 
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
@@ -256,19 +256,21 @@ void Structure::materializePropertyMap(JSGlobalData& globalData)
     }
 }
 
-void Structure::growPropertyStorageCapacity()
+inline size_t nextOutOfLineStorageCapacity(size_t currentCapacity)
 {
-    if (isUsingInlineStorage())
-        m_propertyStorageCapacity = JSObject::baseExternalStorageCapacity;
-    else
-        m_propertyStorageCapacity *= 2;
+    if (!currentCapacity)
+        return 4;
+    return currentCapacity * 2;
 }
 
-size_t Structure::suggestedNewPropertyStorageSize()
+void Structure::growOutOfLineCapacity()
 {
-    if (isUsingInlineStorage())
-        return JSObject::baseExternalStorageCapacity;
-    return m_propertyStorageCapacity * 2;
+    m_outOfLineCapacity = nextOutOfLineStorageCapacity(m_outOfLineCapacity);
+}
+
+size_t Structure::suggestedNewOutOfLineStorageCapacity()
+{
+    return nextOutOfLineStorageCapacity(m_outOfLineCapacity);
 }
  
 void Structure::despecifyDictionaryFunction(JSGlobalData& globalData, PropertyName propertyName)
@@ -285,7 +287,7 @@ void Structure::despecifyDictionaryFunction(JSGlobalData& globalData, PropertyNa
     entry->specificValue.clear();
 }
 
-Structure* Structure::addPropertyTransitionToExistingStructure(Structure* structure, PropertyName propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
+Structure* Structure::addPropertyTransitionToExistingStructure(Structure* structure, PropertyName propertyName, unsigned attributes, JSCell* specificValue, PropertyOffset& offset)
 {
     ASSERT(!structure->isDictionary());
     ASSERT(structure->isObject());
@@ -294,7 +296,7 @@ Structure* Structure::addPropertyTransitionToExistingStructure(Structure* struct
         JSCell* specificValueInPrevious = existingTransition->m_specificValueInPrevious.get();
         if (specificValueInPrevious && specificValueInPrevious != specificValue)
             return 0;
-        ASSERT(existingTransition->m_offset != noOffset);
+        validateOffset(existingTransition->m_offset, structure->m_typeInfo.type());
         offset = existingTransition->m_offset;
         return existingTransition;
     }
@@ -302,7 +304,7 @@ Structure* Structure::addPropertyTransitionToExistingStructure(Structure* struct
     return 0;
 }
 
-Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure* structure, PropertyName propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
+Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure* structure, PropertyName propertyName, unsigned attributes, JSCell* specificValue, PropertyOffset& offset)
 {
     // If we have a specific function, we may have got to this point if there is
     // already a transition with the correct property name and attributes, but
@@ -325,8 +327,8 @@ Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure*
         Structure* transition = toCacheableDictionaryTransition(globalData, structure);
         ASSERT(structure != transition);
         offset = transition->putSpecificValue(globalData, propertyName, attributes, specificValue);
-        if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
-            transition->growPropertyStorageCapacity();
+        if (transition->outOfLineSize() > transition->outOfLineCapacity())
+            transition->growOutOfLineCapacity();
         return transition;
     }
     
@@ -351,15 +353,15 @@ Structure* Structure::addPropertyTransition(JSGlobalData& globalData, Structure*
     }
 
     offset = transition->putSpecificValue(globalData, propertyName, attributes, specificValue);
-    if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
-        transition->growPropertyStorageCapacity();
+    if (transition->outOfLineSize() > transition->outOfLineCapacity())
+        transition->growOutOfLineCapacity();
 
     transition->m_offset = offset;
     structure->m_transitionTable.add(globalData, transition);
     return transition;
 }
 
-Structure* Structure::removePropertyTransition(JSGlobalData& globalData, Structure* structure, PropertyName propertyName, size_t& offset)
+Structure* Structure::removePropertyTransition(JSGlobalData& globalData, Structure* structure, PropertyName propertyName, PropertyOffset& offset)
 {
     ASSERT(!structure->isUncacheableDictionary());
 
@@ -546,18 +548,19 @@ Structure* Structure::flattenDictionaryStructure(JSGlobalData& globalData, JSObj
 
         size_t propertyCount = m_propertyTable->size();
         Vector<JSValue> values(propertyCount);
-
+        
         unsigned i = 0;
+        PropertyOffset firstOffset = firstPropertyOffsetFor(m_typeInfo.type());
         PropertyTable::iterator end = m_propertyTable->end();
         for (PropertyTable::iterator iter = m_propertyTable->begin(); iter != end; ++iter, ++i) {
             values[i] = object->getDirectOffset(iter->offset);
             // Update property table to have the new property offsets
-            iter->offset = i;
+            iter->offset = i + firstOffset;
         }
         
         // Copy the original property values into their final locations
         for (unsigned i = 0; i < propertyCount; i++)
-            object->putDirectOffset(globalData, i, values[i]);
+            object->putDirectOffset(globalData, firstOffset + i, values[i]);
 
         m_propertyTable->clearDeletedOffsets();
     }
@@ -566,7 +569,7 @@ Structure* Structure::flattenDictionaryStructure(JSGlobalData& globalData, JSObj
     return this;
 }
 
-size_t Structure::addPropertyWithoutTransition(JSGlobalData& globalData, PropertyName propertyName, unsigned attributes, JSCell* specificValue)
+PropertyOffset Structure::addPropertyWithoutTransition(JSGlobalData& globalData, PropertyName propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_enumerationCache);
 
@@ -577,13 +580,13 @@ size_t Structure::addPropertyWithoutTransition(JSGlobalData& globalData, Propert
     
     pin();
 
-    size_t offset = putSpecificValue(globalData, propertyName, attributes, specificValue);
-    if (propertyStorageSize() > propertyStorageCapacity())
-        growPropertyStorageCapacity();
+    PropertyOffset offset = putSpecificValue(globalData, propertyName, attributes, specificValue);
+    if (outOfLineSize() > outOfLineCapacity())
+        growOutOfLineCapacity();
     return offset;
 }
 
-size_t Structure::removePropertyWithoutTransition(JSGlobalData& globalData, PropertyName propertyName)
+PropertyOffset Structure::removePropertyWithoutTransition(JSGlobalData& globalData, PropertyName propertyName)
 {
     ASSERT(isUncacheableDictionary());
     ASSERT(!m_enumerationCache);
@@ -591,8 +594,7 @@ size_t Structure::removePropertyWithoutTransition(JSGlobalData& globalData, Prop
     materializePropertyMapIfNecessaryForPinning(globalData);
 
     pin();
-    size_t offset = remove(propertyName);
-    return offset;
+    return remove(propertyName);
 }
 
 void Structure::pin()
@@ -637,20 +639,20 @@ PassOwnPtr<PropertyTable> Structure::copyPropertyTable(JSGlobalData& globalData,
 
 PassOwnPtr<PropertyTable> Structure::copyPropertyTableForPinning(JSGlobalData& globalData, Structure* owner)
 {
-    return adoptPtr(m_propertyTable ? new PropertyTable(globalData, owner, *m_propertyTable) : new PropertyTable(m_offset == noOffset ? 0 : m_offset));
+    return adoptPtr(m_propertyTable ? new PropertyTable(globalData, owner, *m_propertyTable) : new PropertyTable(numberOfSlotsForLastOffset(m_offset, m_typeInfo.type())));
 }
 
-size_t Structure::get(JSGlobalData& globalData, PropertyName propertyName, unsigned& attributes, JSCell*& specificValue)
+PropertyOffset Structure::get(JSGlobalData& globalData, PropertyName propertyName, unsigned& attributes, JSCell*& specificValue)
 {
     ASSERT(structure()->classInfo() == &s_info);
 
     materializePropertyMapIfNecessary(globalData);
     if (!m_propertyTable)
-        return WTF::notFound;
+        return invalidOffset;
 
     PropertyMapEntry* entry = m_propertyTable->find(propertyName.uid()).first;
     if (!entry)
-        return WTF::notFound;
+        return invalidOffset;
 
     attributes = entry->attributes;
     specificValue = entry->specificValue.get();
@@ -683,9 +685,9 @@ void Structure::despecifyAllFunctions(JSGlobalData& globalData)
         iter->specificValue.clear();
 }
 
-size_t Structure::putSpecificValue(JSGlobalData& globalData, PropertyName propertyName, unsigned attributes, JSCell* specificValue)
+PropertyOffset Structure::putSpecificValue(JSGlobalData& globalData, PropertyName propertyName, unsigned attributes, JSCell* specificValue)
 {
-    ASSERT(get(globalData, propertyName) == notFound);
+    ASSERT(!JSC::isValidOffset(get(globalData, propertyName)));
 
     checkConsistency();
     if (attributes & DontEnum)
@@ -696,12 +698,7 @@ size_t Structure::putSpecificValue(JSGlobalData& globalData, PropertyName proper
     if (!m_propertyTable)
         createPropertyMap();
 
-    unsigned newOffset;
-
-    if (m_propertyTable->hasDeletedOffset())
-        newOffset = m_propertyTable->getDeletedOffset();
-    else
-        newOffset = m_propertyTable->size();
+    PropertyOffset newOffset = m_propertyTable->nextOffset(m_typeInfo.type());
 
     m_propertyTable->add(PropertyMapEntry(globalData, this, rep, newOffset, attributes, specificValue));
 
@@ -709,20 +706,20 @@ size_t Structure::putSpecificValue(JSGlobalData& globalData, PropertyName proper
     return newOffset;
 }
 
-size_t Structure::remove(PropertyName propertyName)
+PropertyOffset Structure::remove(PropertyName propertyName)
 {
     checkConsistency();
 
     StringImpl* rep = propertyName.uid();
 
     if (!m_propertyTable)
-        return notFound;
+        return invalidOffset;
 
     PropertyTable::find_iterator position = m_propertyTable->find(rep);
     if (!position.first)
-        return notFound;
+        return invalidOffset;
 
-    size_t offset = position.first->offset;
+    PropertyOffset offset = position.first->offset;
 
     m_propertyTable->remove(position);
     m_propertyTable->addDeletedOffset(offset);
diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
index 448a81c27..d2d025b98 100644
--- a/Source/JavaScriptCore/runtime/Structure.h
+++ b/Source/JavaScriptCore/runtime/Structure.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -87,9 +87,9 @@ namespace JSC {
     public:
         static void dumpStatistics();
 
-        JS_EXPORT_PRIVATE static Structure* addPropertyTransition(JSGlobalData&, Structure*, PropertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        JS_EXPORT_PRIVATE static Structure* addPropertyTransitionToExistingStructure(Structure*, PropertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
-        static Structure* removePropertyTransition(JSGlobalData&, Structure*, PropertyName, size_t& offset);
+        JS_EXPORT_PRIVATE static Structure* addPropertyTransition(JSGlobalData&, Structure*, PropertyName, unsigned attributes, JSCell* specificValue, PropertyOffset&);
+        JS_EXPORT_PRIVATE static Structure* addPropertyTransitionToExistingStructure(Structure*, PropertyName, unsigned attributes, JSCell* specificValue, PropertyOffset&);
+        static Structure* removePropertyTransition(JSGlobalData&, Structure*, PropertyName, PropertyOffset&);
         JS_EXPORT_PRIVATE static Structure* changePrototypeTransition(JSGlobalData&, Structure*, JSValue prototype);
         JS_EXPORT_PRIVATE static Structure* despecifyFunctionTransition(JSGlobalData&, Structure*, PropertyName);
         static Structure* attributeChangeTransition(JSGlobalData&, Structure*, PropertyName, unsigned attributes);
@@ -103,16 +103,32 @@ namespace JSC {
         bool isFrozen(JSGlobalData&);
         bool isExtensible() const { return !m_preventExtensions; }
         bool didTransition() const { return m_didTransition; }
-        bool shouldGrowPropertyStorage() { return propertyStorageCapacity() == propertyStorageSize(); }
-        JS_EXPORT_PRIVATE size_t suggestedNewPropertyStorageSize(); 
+        bool putWillGrowOutOfLineStorage()
+        {
+            ASSERT(outOfLineCapacity() >= outOfLineSize());
+            
+            if (!m_propertyTable) {
+                unsigned currentSize = numberOfOutOfLineSlotsForLastOffset(m_offset);
+                ASSERT(outOfLineCapacity() >= currentSize);
+                return currentSize == outOfLineCapacity();
+            }
+            
+            ASSERT(totalStorageCapacity() >= m_propertyTable->propertyStorageSize());
+            if (m_propertyTable->hasDeletedOffset())
+                return false;
+            
+            ASSERT(totalStorageCapacity() >= m_propertyTable->size());
+            return m_propertyTable->size() == totalStorageCapacity();
+        }
+        JS_EXPORT_PRIVATE size_t suggestedNewOutOfLineStorageCapacity(); 
 
         Structure* flattenDictionaryStructure(JSGlobalData&, JSObject*);
 
         static void destroy(JSCell*);
 
         // These should be used with caution.  
-        JS_EXPORT_PRIVATE size_t addPropertyWithoutTransition(JSGlobalData&, PropertyName, unsigned attributes, JSCell* specificValue);
-        size_t removePropertyWithoutTransition(JSGlobalData&, PropertyName);
+        JS_EXPORT_PRIVATE PropertyOffset addPropertyWithoutTransition(JSGlobalData&, PropertyName, unsigned attributes, JSCell* specificValue);
+        PropertyOffset removePropertyWithoutTransition(JSGlobalData&, PropertyName);
         void setPrototypeWithoutTransition(JSGlobalData& globalData, JSValue prototype) { m_prototype.set(globalData, this, prototype); }
         
         bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
@@ -133,17 +149,114 @@ namespace JSC {
         StructureChain* prototypeChain(ExecState*) const;
         static void visitChildren(JSCell*, SlotVisitor&);
 
-        Structure* previousID() const { ASSERT(structure()->classInfo() == &s_info); return m_previous.get(); }
+        Structure* previousID() const
+        {
+            ASSERT(structure()->classInfo() == &s_info);
+            return m_previous.get();
+        }
         bool transitivelyTransitionedFrom(Structure* structureToFind);
 
-        void growPropertyStorageCapacity();
-        unsigned propertyStorageCapacity() const { ASSERT(structure()->classInfo() == &s_info); return m_propertyStorageCapacity; }
-        unsigned propertyStorageSize() const { ASSERT(structure()->classInfo() == &s_info); return (m_propertyTable ? m_propertyTable->propertyStorageSize() : static_cast<unsigned>(m_offset + 1)); }
-        bool isUsingInlineStorage() const;
+        void growOutOfLineCapacity();
+        unsigned outOfLineCapacity() const
+        {
+            ASSERT(structure()->classInfo() == &s_info);
+            return m_outOfLineCapacity;
+        }
+        unsigned outOfLineSizeForKnownFinalObject() const
+        {
+            ASSERT(m_typeInfo.type() == FinalObjectType);
+            if (m_propertyTable) {
+                unsigned totalSize = m_propertyTable->propertyStorageSize();
+                if (totalSize < static_cast<unsigned>(inlineStorageCapacity))
+                    return 0;
+                return totalSize - inlineStorageCapacity;
+            }
+            return numberOfOutOfLineSlotsForLastOffset(m_offset);
+        }
+        unsigned outOfLineSizeForKnownNonFinalObject() const
+        {
+            ASSERT(m_typeInfo.type() != FinalObjectType);
+            if (m_propertyTable)
+                return m_propertyTable->propertyStorageSize();
+            return numberOfOutOfLineSlotsForLastOffset(m_offset);
+        }
+        unsigned outOfLineSize() const
+        {
+            ASSERT(structure()->classInfo() == &s_info);
+            if (m_propertyTable) {
+                unsigned totalSize = m_propertyTable->propertyStorageSize();
+                unsigned inlineCapacity = this->inlineCapacity();
+                if (totalSize < inlineCapacity)
+                    return 0;
+                return totalSize - inlineCapacity;
+            }
+            return numberOfOutOfLineSlotsForLastOffset(m_offset);
+        }
+        bool hasInlineStorage() const
+        {
+            return m_typeInfo.type() == FinalObjectType;
+        }
+        unsigned inlineCapacity() const
+        {
+            if (hasInlineStorage())
+                return inlineStorageCapacity;
+            return 0;
+        }
+        unsigned inlineSizeForKnownFinalObject() const
+        {
+            ASSERT(m_typeInfo.type() == FinalObjectType);
+            unsigned result;
+            if (m_propertyTable)
+                result = m_propertyTable->propertyStorageSize();
+            else
+                result = m_offset + 1;
+            if (result > static_cast<unsigned>(inlineStorageCapacity))
+                return inlineStorageCapacity;
+            return result;
+        }
+        unsigned inlineSize() const
+        {
+            if (!hasInlineStorage())
+                return 0;
+            return inlineSizeForKnownFinalObject();
+        }
+        unsigned totalStorageSize() const
+        {
+            if (m_propertyTable)
+                return m_propertyTable->propertyStorageSize();
+            return numberOfSlotsForLastOffset(m_offset, m_typeInfo.type());
+        }
+        unsigned totalStorageCapacity() const
+        {
+            ASSERT(structure()->classInfo() == &s_info);
+            return m_outOfLineCapacity + inlineCapacity();
+        }
+
+        PropertyOffset firstValidOffset() const
+        {
+            if (hasInlineStorage())
+                return 0;
+            return inlineStorageCapacity;
+        }
+        PropertyOffset lastValidOffset() const
+        {
+            if (m_propertyTable) {
+                PropertyOffset size = m_propertyTable->propertyStorageSize();
+                if (!hasInlineStorage())
+                    size += inlineStorageCapacity;
+                return size - 1;
+            }
+            return m_offset;
+        }
+        bool isValidOffset(PropertyOffset offset) const
+        {
+            return offset >= firstValidOffset()
+                && offset <= lastValidOffset();
+        }
 
-        size_t get(JSGlobalData&, PropertyName);
-        size_t get(JSGlobalData&, const UString& name);
-        JS_EXPORT_PRIVATE size_t get(JSGlobalData&, PropertyName, unsigned& attributes, JSCell*& specificValue);
+        PropertyOffset get(JSGlobalData&, PropertyName);
+        PropertyOffset get(JSGlobalData&, const UString& name);
+        JS_EXPORT_PRIVATE PropertyOffset get(JSGlobalData&, PropertyName, unsigned& attributes, JSCell*& specificValue);
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
         bool hasReadOnlyOrGetterSetterPropertiesExcludingProto() const { return m_hasReadOnlyOrGetterSetterPropertiesExcludingProto; }
@@ -160,7 +273,12 @@ namespace JSC {
 
         bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
         
-        bool isEmpty() const { return m_propertyTable ? m_propertyTable->isEmpty() : m_offset == noOffset; }
+        bool isEmpty() const
+        {
+            if (m_propertyTable)
+                return m_propertyTable->isEmpty();
+            return !JSC::isValidOffset(m_offset);
+        }
 
         JS_EXPORT_PRIVATE void despecifyDictionaryFunction(JSGlobalData&, PropertyName);
         void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
@@ -256,8 +374,8 @@ namespace JSC {
         } DictionaryKind;
         static Structure* toDictionaryTransition(JSGlobalData&, Structure*, DictionaryKind);
 
-        size_t putSpecificValue(JSGlobalData&, PropertyName, unsigned attributes, JSCell* specificValue);
-        size_t remove(PropertyName);
+        PropertyOffset putSpecificValue(JSGlobalData&, PropertyName, unsigned attributes, JSCell* specificValue);
+        PropertyOffset remove(PropertyName);
 
         void createPropertyMap(unsigned keyCount = 0);
         void checkConsistency();
@@ -284,7 +402,7 @@ namespace JSC {
         int transitionCount() const
         {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
-            return m_offset == noOffset ? 0 : m_offset + 1;
+            return numberOfSlotsForLastOffset(m_offset, m_typeInfo.type());
         }
 
         bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
@@ -293,8 +411,6 @@ namespace JSC {
 
         static const int s_maxTransitionLength = 64;
 
-        static const int noOffset = -1;
-
         static const unsigned maxSpecificFunctionThrashCount = 3;
 
         TypeInfo m_typeInfo;
@@ -319,10 +435,10 @@ namespace JSC {
         
         mutable InlineWatchpointSet m_transitionWatchpointSet;
 
-        uint32_t m_propertyStorageCapacity;
+        uint32_t m_outOfLineCapacity;
 
         // m_offset does not account for anonymous slots
-        int m_offset;
+        PropertyOffset m_offset;
 
         unsigned m_dictionaryKind : 2;
         bool m_isPinnedPropertyTable : 1;
@@ -336,26 +452,26 @@ namespace JSC {
         unsigned m_staticFunctionReified;
     };
 
-    inline size_t Structure::get(JSGlobalData& globalData, PropertyName propertyName)
+    inline PropertyOffset Structure::get(JSGlobalData& globalData, PropertyName propertyName)
     {
         ASSERT(structure()->classInfo() == &s_info);
         materializePropertyMapIfNecessary(globalData);
         if (!m_propertyTable)
-            return notFound;
+            return invalidOffset;
 
         PropertyMapEntry* entry = m_propertyTable->find(propertyName.uid()).first;
-        return entry ? entry->offset : notFound;
+        return entry ? entry->offset : invalidOffset;
     }
 
-    inline size_t Structure::get(JSGlobalData& globalData, const UString& name)
+    inline PropertyOffset Structure::get(JSGlobalData& globalData, const UString& name)
     {
         ASSERT(structure()->classInfo() == &s_info);
         materializePropertyMapIfNecessary(globalData);
         if (!m_propertyTable)
-            return notFound;
+            return invalidOffset;
 
         PropertyMapEntry* entry = m_propertyTable->findWithString(name.impl()).first;
-        return entry ? entry->offset : notFound;
+        return entry ? entry->offset : invalidOffset;
     }
     
     inline JSValue JSValue::structureOrUndefined() const
diff --git a/Source/JavaScriptCore/runtime/WeakGCMap.h b/Source/JavaScriptCore/runtime/WeakGCMap.h
index 9e8db4d60..6926165a7 100644
--- a/Source/JavaScriptCore/runtime/WeakGCMap.h
+++ b/Source/JavaScriptCore/runtime/WeakGCMap.h
@@ -75,8 +75,9 @@ public:
         return HandleTypes<MappedType>::getFromSlot(const_cast<JSValue*>(&impl->jsValue()));
     }
 
-    void set(JSGlobalData&, const KeyType& key, ExternalType value)
+    void set(JSGlobalData& globalData, const KeyType& key, ExternalType value)
     {
+        ASSERT_UNUSED(globalData, globalData.apiLock().currentThreadIsHoldingLock());
         typename MapType::AddResult result = m_map.add(key, 0);
         if (!result.isNewEntry)
             WeakSet::deallocate(result.iterator->second);
diff --git a/Source/JavaScriptCore/testRegExp.cpp b/Source/JavaScriptCore/testRegExp.cpp
index 6899ac284..61c21c31b 100644
--- a/Source/JavaScriptCore/testRegExp.cpp
+++ b/Source/JavaScriptCore/testRegExp.cpp
@@ -495,9 +495,8 @@ static void parseArguments(int argc, char** argv, CommandLine& options)
 
 int realMain(int argc, char** argv)
 {
-    JSLock lock(SilenceAssertionsOnly);
-
     RefPtr<JSGlobalData> globalData = JSGlobalData::create(ThreadStackTypeLarge, LargeHeap);
+    JSLockHolder lock(globalData.get());
 
     CommandLine options;
     parseArguments(argc, argv, options);
diff --git a/Source/JavaScriptCore/tests/mozilla/jsDriver.pl b/Source/JavaScriptCore/tests/mozilla/jsDriver.pl
index d1c18ce66..4a774cefd 100644
--- a/Source/JavaScriptCore/tests/mozilla/jsDriver.pl
+++ b/Source/JavaScriptCore/tests/mozilla/jsDriver.pl
@@ -164,6 +164,7 @@ sub execute_tests {
         my $failure_lines;
         my $bug_number;
         my $status_lines;
+        my @jsc_exit_code;
         
 # user selected [Q]uit from ^C handler.
         if ($user_exit) {
@@ -177,7 +178,20 @@ sub execute_tests {
             $shell_command = $opt_arch . " ";
             
             $shell_command .= &xp_path($engine_command)  . " -s ";
-            
+
+# FIXME: <https://bugs.webkit.org/show_bug.cgi?id=90119>
+# Sporadically on Windows, the exit code returned after close() in $?
+# is 126 (after the appropraite shifting, even though jsc exits with
+# 0 or 3). To work around this, a -x option was added to jsc that will
+# output the exit value right before exiting.  We parse that value and
+# remove it from the output stream before comparing the actual and expected
+# outputs. When that bug is found and fixed, the code for processing of
+# "jsc exiting [\d]" and use of @jsc_exit_code can be removed along with
+# the -x option in jsc.cpp
+            if ($os_type eq "WIN") {
+                $shell_command .= " -x ";
+            }
+
             $path = &xp_path($opt_suite_path . $suite . "/shell.js");
             if (-f $path) {
                 $shell_command .= $file_param . $path;
@@ -202,10 +216,19 @@ sub execute_tests {
               $redirect_command . " |");
         @output = <OUTPUT>;
         close (OUTPUT);
-        
-        @output = grep (!/js\>/, @output);
-        
-        if ($opt_exit_munge == 1) {
+
+        @jsc_exit_code = grep (/jsc exiting [\d]/, @output);
+        @output = grep (!/js\>|jsc exiting [\d]/, @output);
+
+        if (($#jsc_exit_code == 0) && ($jsc_exit_code[0] =~ /jsc exiting ([\d])\W*/)) {
+# return value from jsc output to work around windows bug
+            $got_exit = $1;
+            if ($opt_exit_munge == 1) {
+                $exit_signal = ($? & 255);
+            } else {
+                $exit_signal = 0;
+            }
+        } elsif ($opt_exit_munge == 1) {
 # signal information in the lower 8 bits, exit code above that
             $got_exit = ($? >> 8);
             $exit_signal = ($? & 255);
diff --git a/Source/JavaScriptCore/wscript b/Source/JavaScriptCore/wscript
index 58696d9c5..4afb4d26a 100644
--- a/Source/JavaScriptCore/wscript
+++ b/Source/JavaScriptCore/wscript
@@ -66,7 +66,7 @@ def build(bld):
         features = 'cc cxx cshlib',
         includes = '. .. assembler ../WTF ' + ' '.join(includes),
         source = sources,
-        defines = ['BUILDING_JavaScriptCore', 'STATICALLY_LINKED_WITH_WTF'],
+        defines = ['BUILDING_JavaScriptCore'],
         target = 'jscore',
         uselib = 'WX ICU ' + get_config(),
         uselib_local = '',
diff --git a/Source/Platform/ChangeLog b/Source/Platform/ChangeLog
index 4c2dcd40f..28bcd5662 100644
--- a/Source/Platform/ChangeLog
+++ b/Source/Platform/ChangeLog
@@ -1,3 +1,190 @@
+2012-07-05  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Create a WebKit::Web* wrapper for the cc animation classes
+        https://bugs.webkit.org/show_bug.cgi?id=90303
+
+        Reviewed by James Robinson.
+
+        * Platform.gypi:
+        * chromium/public/WebAnimation.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebAnimation):
+        (WebKit::WebAnimation::WebAnimation):
+        (WebKit::WebAnimation::~WebAnimation):
+        * chromium/public/WebAnimationCurve.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebAnimationCurve):
+        (WebKit::WebAnimationCurve::~WebAnimationCurve):
+        (WebKit::WebAnimationCurve::WebAnimationCurve):
+        * chromium/public/WebFloatAnimationCurve.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebFloatAnimationCurve):
+        (WebKit::WebFloatAnimationCurve::WebFloatAnimationCurve):
+        (WebKit::WebFloatAnimationCurve::~WebFloatAnimationCurve):
+        * chromium/public/WebFloatKeyframe.h: Added.
+        (WebKit):
+        (WebKit::WebFloatKeyframe::WebFloatKeyframe):
+        (WebFloatKeyframe):
+        * chromium/public/WebTransformAnimationCurve.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebTransformAnimationCurve):
+        (WebKit::WebTransformAnimationCurve::WebTransformAnimationCurve):
+        (WebKit::WebTransformAnimationCurve::~WebTransformAnimationCurve):
+        * chromium/public/WebTransformKeyframe.h: Added.
+        (WebKit):
+        (WebKit::WebTransformKeyframe::WebTransformKeyframe):
+        (WebTransformKeyframe):
+
+2012-07-03  Alex Sakhartchouk  <alexst@chromium.org>
+
+        [chromium] Avoid calling getUniformLocation??() in the compositor startup
+        https://bugs.webkit.org/show_bug.cgi?id=90217
+
+        Reviewed by Adrienne Walker.
+
+        Adding an entry point for bindUniformLocationCHROMIUM.
+
+        * chromium/public/WebGraphicsContext3D.h:
+        (WebGraphicsContext3D):
+        (WebKit::WebGraphicsContext3D::bindUniformLocationCHROMIUM):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * Platform.gyp/.gitignore:
+
+2012-07-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Update MediaStreamTrackList to match the specification
+        https://bugs.webkit.org/show_bug.cgi?id=90171
+
+        Reviewed by Adam Barth.
+
+        The latest update to the specification added add and remove methods with corresponding callbacks.
+        The callbacks can be triggered both from JS and from the platform layer.
+
+        * chromium/public/WebMediaStreamCenterClient.h:
+        (WebKit):
+        (WebMediaStreamCenterClient):
+
+2012-07-01  Keishi Hattori  <keishi@webkit.org>
+
+        Unreviewed, rolling out r121650.
+        http://trac.webkit.org/changeset/121650
+        https://bugs.webkit.org/show_bug.cgi?id=90303
+
+        runhooks is failing for chromium win bots and
+        WebAnimationTest.DefaultSettings is crashing
+
+        * Platform.gypi:
+        * chromium/public/WebAnimation.h: Removed.
+        * chromium/public/WebAnimationCurve.h: Removed.
+        * chromium/public/WebFloatAnimationCurve.h: Removed.
+        * chromium/public/WebFloatKeyframe.h: Removed.
+        * chromium/public/WebTransformAnimationCurve.h: Removed.
+        * chromium/public/WebTransformKeyframe.h: Removed.
+
+2012-07-01  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Create a WebKit::Web* wrapper for the cc animation classes
+        https://bugs.webkit.org/show_bug.cgi?id=90303
+
+        Reviewed by James Robinson.
+
+        * Platform.gypi:
+        * chromium/public/WebAnimation.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebAnimation):
+        (WebKit::WebAnimation::WebAnimation):
+        (WebKit::WebAnimation::~WebAnimation):
+        * chromium/public/WebAnimationCurve.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebAnimationCurve):
+        (WebKit::WebAnimationCurve::~WebAnimationCurve):
+        (WebKit::WebAnimationCurve::WebAnimationCurve):
+        * chromium/public/WebFloatAnimationCurve.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebFloatAnimationCurve):
+        (WebKit::WebFloatAnimationCurve::WebFloatAnimationCurve):
+        (WebKit::WebFloatAnimationCurve::~WebFloatAnimationCurve):
+        * chromium/public/WebFloatKeyframe.h: Added.
+        (WebKit):
+        (WebKit::WebFloatKeyframe::WebFloatKeyframe):
+        (WebFloatKeyframe):
+        * chromium/public/WebTransformAnimationCurve.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebTransformAnimationCurve):
+        (WebKit::WebTransformAnimationCurve::WebTransformAnimationCurve):
+        (WebKit::WebTransformAnimationCurve::~WebTransformAnimationCurve):
+        * chromium/public/WebTransformKeyframe.h: Added.
+        (WebKit):
+        (WebKit::WebTransformKeyframe::WebTransformKeyframe):
+        (WebTransformKeyframe):
+
+2012-06-30  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] CanvasLayerTextureUpdater needs to convert opaque rects back to content space.
+        https://bugs.webkit.org/show_bug.cgi?id=90092
+
+        The CanvasLayerTextureUpdater currently receives its opaque rects in
+        layer space, but is expected to return them in content space and does
+        not convert them. This patch adds this conversion. To avoid numerical
+        errors, this patch also switches to using float rects to store opaque
+        rects where appropriate.
+
+        Reviewed by Adrienne Walker.
+
+        * chromium/public/WebContentLayerClient.h:
+        (WebKit):
+        (WebContentLayerClient):
+
+2012-06-29  Tony Payne  <tpayne@chromium.org>
+
+        Remove type from screenColorProfile API
+        https://bugs.webkit.org/show_bug.cgi?id=90299
+
+        Reviewed by Adam Barth.
+
+        * chromium/public/Platform.h:
+        (WebKit::Platform::screenColorProfile): Removed type from chromium
+        public API's version of screenColorProfile().
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove mapRect and mapQuad from WebTransformationMatrix
+        https://bugs.webkit.org/show_bug.cgi?id=90230
+
+        Reviewed by Adrienne Walker.
+
+        Removes clipping-unaware mapRect, mapQuad and projectPoint functions from the WebTransformationMatrix interface.
+
+        * chromium/public/WebTransformationMatrix.h:
+        (WebTransformationMatrix):
+
+2012-06-28  Adrienne Walker  <enne@google.com>
+
+        [chromium] Split WebScrollbar into WebPluginScrollbar and WebScrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=90117
+
+        Reviewed by James Robinson.
+
+        Move WebScrollbar from client API to Platform.
+
+        * Platform.gypi:
+        * chromium/public/WebScrollbar.h: Copied from Source/WebKit/chromium/public/WebPluginScrollbarClient.h.
+        (WebKit):
+        (WebScrollbar):
+        (WebKit::WebScrollbar::~WebScrollbar):
+
 2012-06-26  James Robinson  <jamesr@chromium.org>
 
         [chromium] Remove WebView::graphicsContext3D getter
diff --git a/Source/Platform/Platform.gyp/.gitignore b/Source/Platform/Platform.gyp/.gitignore
index 72f70a29c..2ca14bf1e 100644
--- a/Source/Platform/Platform.gyp/.gitignore
+++ b/Source/Platform/Platform.gyp/.gitignore
@@ -2,4 +2,5 @@
 *.mk
 *.sln
 *.vcproj*
+*.vcxproj*
 *.xcodeproj*
diff --git a/Source/Platform/Platform.gypi b/Source/Platform/Platform.gypi
index 75ad972fb..a6b35fd93 100644
--- a/Source/Platform/Platform.gypi
+++ b/Source/Platform/Platform.gypi
@@ -32,6 +32,8 @@
     'variables': {
         'platform_files': [
             'chromium/public/Platform.h',
+            'chromium/public/WebAnimation.h',
+            'chromium/public/WebAnimationCurve.h',
             'chromium/public/WebAudioBus.h',
             'chromium/public/WebAudioDevice.h',
             'chromium/public/WebBlobData.h',
@@ -54,6 +56,8 @@
             'chromium/public/WebFileUtilities.h',
             'chromium/public/WebFilterOperation.h',
             'chromium/public/WebFilterOperations.h',
+            'chromium/public/WebFloatAnimationCurve.h',
+            'chromium/public/WebFloatKeyframe.h',
             'chromium/public/WebFloatPoint.h',
             'chromium/public/WebFloatQuad.h',
             'chromium/public/WebFloatRect.h',
@@ -95,6 +99,7 @@
             'chromium/public/WebRect.h',
             'chromium/public/WebReferrerPolicy.h',
             'chromium/public/WebRenderingStats.h',
+            'chromium/public/WebScrollbar.h',
             'chromium/public/WebSessionDescriptionDescriptor.h',
             'chromium/public/WebSize.h',
             'chromium/public/WebSocketStreamError.h',
@@ -107,6 +112,8 @@
             'chromium/public/WebThread.h',
             'chromium/public/WebThreadSafeData.h',
             'chromium/public/WebTransformationMatrix.h',
+            'chromium/public/WebTransformAnimationCurve.h',
+            'chromium/public/WebTransformKeyframe.h',
             'chromium/public/WebTransformOperations.h',
             'chromium/public/WebPrerender.h',
             'chromium/public/WebURL.h',
diff --git a/Source/Platform/chromium/public/Platform.h b/Source/Platform/chromium/public/Platform.h
index 4424df5ae..4b745ab11 100644
--- a/Source/Platform/chromium/public/Platform.h
+++ b/Source/Platform/chromium/public/Platform.h
@@ -243,7 +243,7 @@ public:
     // Screen -------------------------------------------------------------
 
     // Supplies the system monitor color profile ("monitor") or a named ICC profile.
-    virtual void screenColorProfile(const WebString& type, WebVector<char>* profile) { }
+    virtual void screenColorProfile(WebVector<char>* profile) { }
 
 
     // Sudden Termination --------------------------------------------------
diff --git a/Source/Platform/chromium/public/WebAnimation.h b/Source/Platform/chromium/public/WebAnimation.h
new file mode 100644
index 000000000..b715e050f
--- /dev/null
+++ b/Source/Platform/chromium/public/WebAnimation.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebAnimation_h
+#define WebAnimation_h
+
+#include "WebCommon.h"
+#include "WebNonCopyable.h"
+#include "WebPrivateOwnPtr.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/Forward.h>
+#endif
+
+namespace WebCore {
+class CCActiveAnimation;
+}
+
+namespace WebKit {
+
+class WebAnimationCurve;
+
+// A compositor driven animation.
+class WebAnimation : public WebNonCopyable {
+public:
+    enum TargetProperty {
+        WebAnimationTransform = 1,
+        WebAnimationOpacity
+    };
+
+    WebAnimation(const WebAnimationCurve& curve, TargetProperty targetProperty)
+    {
+        initialize(curve, targetProperty);
+    }
+
+    ~WebAnimation()
+    {
+        destroy();
+    }
+
+    // This is the number of times that the animation will play. If this
+    // value is zero the animation will not play. If it is negative, then
+    // the animation will loop indefinitely.
+    WEBKIT_EXPORT int iterations() const;
+    WEBKIT_EXPORT void setIterations(int);
+
+    WEBKIT_EXPORT double startTime() const;
+    WEBKIT_EXPORT void setStartTime(double monotonicTime);
+    WEBKIT_EXPORT bool hasSetStartTime() const;
+
+    WEBKIT_EXPORT double timeOffset() const;
+    WEBKIT_EXPORT void setTimeOffset(double monotonicTime);
+
+    // If alternatesDirection is true, on odd numbered iterations we reverse the curve.
+    WEBKIT_EXPORT bool alternatesDirection() const;
+    WEBKIT_EXPORT void setAlternatesDirection(bool);
+
+#if WEBKIT_IMPLEMENTATION
+    operator PassOwnPtr<WebCore::CCActiveAnimation>() const;
+#endif
+
+private:
+    WEBKIT_EXPORT void initialize(const WebAnimationCurve&, TargetProperty);
+    WEBKIT_EXPORT void initialize(const WebAnimation&);
+    WEBKIT_EXPORT void destroy();
+
+    WebPrivateOwnPtr<WebCore::CCActiveAnimation> m_private;
+};
+
+} // namespace WebKit
+
+#endif // WebAnimation_h
diff --git a/Source/Platform/chromium/public/WebAnimationCurve.h b/Source/Platform/chromium/public/WebAnimationCurve.h
new file mode 100644
index 000000000..e9ecc1eda
--- /dev/null
+++ b/Source/Platform/chromium/public/WebAnimationCurve.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebAnimationCurve_h
+#define WebAnimationCurve_h
+
+#include "WebCommon.h"
+#include "WebNonCopyable.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/Forward.h>
+#endif
+
+namespace WebCore {
+class CCAnimationCurve;
+}
+
+namespace WebKit {
+
+class WebAnimationCurve : public WebNonCopyable {
+public:
+    virtual ~WebAnimationCurve() { }
+
+    enum TimingFunctionType {
+        TimingFunctionTypeEase,
+        TimingFunctionTypeEaseIn,
+        TimingFunctionTypeEaseOut,
+        TimingFunctionTypeEaseInOut,
+        TimingFunctionTypeLinear
+    };
+
+#if WEBKIT_IMPLEMENTATION
+    virtual operator PassOwnPtr<WebCore::CCAnimationCurve>() const = 0;
+#endif
+
+protected:
+    WebAnimationCurve() { }
+};
+
+} // namespace WebKit
+
+#endif // WebAnimationCurve_h
+
diff --git a/Source/Platform/chromium/public/WebContentLayerClient.h b/Source/Platform/chromium/public/WebContentLayerClient.h
index 53f5c0a82..5469bd28c 100644
--- a/Source/Platform/chromium/public/WebContentLayerClient.h
+++ b/Source/Platform/chromium/public/WebContentLayerClient.h
@@ -30,6 +30,7 @@
 
 namespace WebKit {
 struct WebRect;
+struct WebFloatRect;
 
 class WebContentLayerClient {
 public:
@@ -41,7 +42,8 @@ public:
     // the implementation knows are opaque. This information can be used for various
     // optimizations.
 #define WEBCONTENTLAYERCLIENT_HAS_OPAQUE 1
-    virtual void paintContents(WebCanvas*, const WebRect& clip, WebRect& opaque) = 0;
+#define WEBCONTENTLAYERCLIENT_FLOAT_OPAQUE_RECT 1
+    virtual void paintContents(WebCanvas*, const WebRect& clip, WebFloatRect& opaque) = 0;
 
 protected:
     virtual ~WebContentLayerClient() { }
diff --git a/Source/Platform/chromium/public/WebFloatAnimationCurve.h b/Source/Platform/chromium/public/WebFloatAnimationCurve.h
new file mode 100644
index 000000000..65a7f2438
--- /dev/null
+++ b/Source/Platform/chromium/public/WebFloatAnimationCurve.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFloatAnimationCurve_h
+#define WebFloatAnimationCurve_h
+
+#include "WebAnimationCurve.h"
+
+#include "WebCommon.h"
+#include "WebFloatKeyframe.h"
+#include "WebPrivateOwnPtr.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/Forward.h>
+#endif
+
+namespace WebCore {
+class CCAnimationCurve;
+class CCKeyframedFloatAnimationCurve;
+}
+
+namespace WebKit {
+
+// A keyframed float animation curve.
+class WebFloatAnimationCurve : public WebAnimationCurve {
+public:
+    WebFloatAnimationCurve() { initialize(); }
+    virtual ~WebFloatAnimationCurve() { destroy(); }
+
+    // Adds the keyframe with the default timing function (ease).
+    WEBKIT_EXPORT void add(const WebFloatKeyframe&);
+    WEBKIT_EXPORT void add(const WebFloatKeyframe&, TimingFunctionType);
+    // Adds the keyframe with a custom, bezier timing function. Note, it is
+    // assumed that x0 = y0 = 0, and x3 = y3 = 1.
+    WEBKIT_EXPORT void add(const WebFloatKeyframe&, double x1, double y1, double x2, double y2);
+
+    WEBKIT_EXPORT float getValue(double time) const;
+
+#if WEBKIT_IMPLEMENTATION
+    virtual operator PassOwnPtr<WebCore::CCAnimationCurve>() const;
+#endif
+
+private:
+    WEBKIT_EXPORT void initialize();
+    WEBKIT_EXPORT void destroy();
+
+    WebPrivateOwnPtr<WebCore::CCKeyframedFloatAnimationCurve> m_private;
+};
+
+} // namespace WebKit
+
+#endif // WebFloatAnimationCurve_h
diff --git a/Source/Platform/chromium/public/WebFloatKeyframe.h b/Source/Platform/chromium/public/WebFloatKeyframe.h
new file mode 100644
index 000000000..d276418ff
--- /dev/null
+++ b/Source/Platform/chromium/public/WebFloatKeyframe.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebFloatKeyframe_h
+#define WebFloatKeyframe_h
+
+namespace WebKit {
+
+struct WebFloatKeyframe {
+    WebFloatKeyframe(double time, float value)
+        : time(time)
+        , value(value)
+    {
+    }
+
+    double time;
+    float value;
+};
+
+} // namespace WebKit
+
+#endif // WebFloatKeyframe_h
diff --git a/Source/Platform/chromium/public/WebGraphicsContext3D.h b/Source/Platform/chromium/public/WebGraphicsContext3D.h
index 577d70289..44c206719 100644
--- a/Source/Platform/chromium/public/WebGraphicsContext3D.h
+++ b/Source/Platform/chromium/public/WebGraphicsContext3D.h
@@ -414,6 +414,9 @@ public:
     virtual void getQueryivEXT(WGC3Denum target, WGC3Denum pname, WGC3Dint* params) { }
     virtual void getQueryObjectuivEXT(WebGLId query, WGC3Denum pname, WGC3Duint* params) { }
 
+    // GL_CHROMIUM_bind_uniform_location
+    virtual void bindUniformLocationCHROMIUM(WebGLId program, WGC3Dint location, const WGC3Dchar* uniform) { }
+
     // GL_CHROMIUM_copy_texture
     virtual void copyTextureCHROMIUM(WGC3Denum target, WGC3Duint sourceId,
                                      WGC3Duint destId, WGC3Dint level, WGC3Denum internalFormat) { }
diff --git a/Source/Platform/chromium/public/WebMediaStreamCenterClient.h b/Source/Platform/chromium/public/WebMediaStreamCenterClient.h
index 8a0825f90..c6685b0fe 100644
--- a/Source/Platform/chromium/public/WebMediaStreamCenterClient.h
+++ b/Source/Platform/chromium/public/WebMediaStreamCenterClient.h
@@ -33,6 +33,7 @@
 
 namespace WebKit {
 
+class WebMediaStreamComponent;
 class WebMediaStreamDescriptor;
 
 class WebMediaStreamCenterClient {
@@ -40,6 +41,8 @@ public:
     virtual ~WebMediaStreamCenterClient() { }
 
     virtual void stopLocalMediaStream(const WebMediaStreamDescriptor&) = 0;
+    virtual void addMediaStreamTrack(const WebMediaStreamDescriptor&, const WebMediaStreamComponent&) = 0;
+    virtual void removeMediaStreamTrack(const WebMediaStreamDescriptor&, const WebMediaStreamComponent&) = 0;
 };
 
 } // namespace WebKit
diff --git a/Source/Platform/chromium/public/WebScrollbar.h b/Source/Platform/chromium/public/WebScrollbar.h
new file mode 100644
index 000000000..879556552
--- /dev/null
+++ b/Source/Platform/chromium/public/WebScrollbar.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebScrollbar_h
+#define WebScrollbar_h
+
+namespace WebKit {
+
+class WebScrollbar {
+public:
+    enum Orientation {
+        Horizontal,
+        Vertical
+    };
+
+    enum ScrollDirection {
+        ScrollBackward,
+        ScrollForward
+    };
+
+    enum ScrollGranularity {
+        ScrollByLine,
+        ScrollByPage,
+        ScrollByDocument,
+        ScrollByPixel
+    };
+
+    virtual ~WebScrollbar() { }
+
+    // Return true if this is an overlay scrollbar.
+    virtual bool isOverlay() const = 0;
+
+    // Gets the current value (i.e. position inside the region).
+    virtual int value() const = 0;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/Platform/chromium/public/WebTransformAnimationCurve.h b/Source/Platform/chromium/public/WebTransformAnimationCurve.h
new file mode 100644
index 000000000..99cb67055
--- /dev/null
+++ b/Source/Platform/chromium/public/WebTransformAnimationCurve.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTransformAnimationCurve_h
+#define WebTransformAnimationCurve_h
+
+#include "WebAnimationCurve.h"
+
+#include "WebCommon.h"
+#include "WebPrivateOwnPtr.h"
+#include "WebTransformKeyframe.h"
+#include "WebTransformationMatrix.h"
+
+#if WEBKIT_IMPLEMENTATION
+#include <wtf/Forward.h>
+#endif
+
+namespace WebCore {
+class CCAnimationCurve;
+class CCKeyframedTransformAnimationCurve;
+}
+
+namespace WebKit {
+
+// A keyframed transform animation curve.
+class WebTransformAnimationCurve : public WebAnimationCurve {
+public:
+    WebTransformAnimationCurve() { initialize(); }
+    virtual ~WebTransformAnimationCurve() { destroy(); }
+
+    // Adds the keyframe with the default timing function (ease).
+    WEBKIT_EXPORT void add(const WebTransformKeyframe&);
+    WEBKIT_EXPORT void add(const WebTransformKeyframe&, TimingFunctionType);
+    // Adds the keyframe with a custom, bezier timing function. Note, it is
+    // assumed that x0 = y0 = 0, and x3 = y3 = 1.
+    WEBKIT_EXPORT void add(const WebTransformKeyframe&, double x1, double y1, double x2, double y2);
+
+    WEBKIT_EXPORT WebTransformationMatrix getValue(double time) const;
+
+#if WEBKIT_IMPLEMENTATION
+    virtual operator PassOwnPtr<WebCore::CCAnimationCurve>() const;
+#endif
+
+protected:
+    WEBKIT_EXPORT void initialize();
+    WEBKIT_EXPORT void destroy();
+
+    WebPrivateOwnPtr<WebCore::CCKeyframedTransformAnimationCurve> m_private;
+};
+
+} // namespace WebKit
+
+#endif // WebTransformAnimationCurve_h
diff --git a/Source/Platform/chromium/public/WebTransformKeyframe.h b/Source/Platform/chromium/public/WebTransformKeyframe.h
new file mode 100644
index 000000000..c99ef5587
--- /dev/null
+++ b/Source/Platform/chromium/public/WebTransformKeyframe.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebTransformKeyframe_h
+#define WebTransformKeyframe_h
+
+#include "WebTransformOperations.h"
+
+namespace WebKit {
+
+struct WebTransformKeyframe {
+    WebTransformKeyframe(double time, const WebTransformOperations& value)
+        : time(time)
+        , value(value)
+    {
+    }
+
+    double time;
+    WebTransformOperations value;
+};
+
+} // namespace WebKit
+
+#endif // WebTransformKeyframe_h
diff --git a/Source/Platform/chromium/public/WebTransformationMatrix.h b/Source/Platform/chromium/public/WebTransformationMatrix.h
index 3135b4e68..0ffe0c405 100644
--- a/Source/Platform/chromium/public/WebTransformationMatrix.h
+++ b/Source/Platform/chromium/public/WebTransformationMatrix.h
@@ -141,13 +141,9 @@ public:
     // FIXME: these map functions should not exist, should be using CCMathUtil
     // instead. Eventually CCMathUtil functions could be merged here, but its
     // not yet the right time for that.
-    WebCore::FloatRect mapRect(const WebCore::FloatRect&) const;
-    WebCore::IntRect mapRect(const WebCore::IntRect&) const;
     WebCore::FloatPoint3D mapPoint(const WebCore::FloatPoint3D&) const;
     WebCore::FloatPoint mapPoint(const WebCore::FloatPoint&) const;
     WebCore::IntPoint mapPoint(const WebCore::IntPoint&) const;
-    WebCore::FloatQuad mapQuad(const WebCore::FloatQuad&) const;
-    WebCore::FloatPoint projectPoint(const WebCore::FloatPoint&, bool* clamped = 0) const;
 #endif
 
 protected:
diff --git a/Source/QtWebKit.pro b/Source/QtWebKit.pro
index 9d63fb83a..1cc44a8ba 100644
--- a/Source/QtWebKit.pro
+++ b/Source/QtWebKit.pro
@@ -4,8 +4,6 @@
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
-load(features)
-
 TEMPLATE = subdirs
 CONFIG += ordered
 
diff --git a/Source/ThirdParty/ChangeLog b/Source/ThirdParty/ChangeLog
index d830ad966..9dff5fac4 100644
--- a/Source/ThirdParty/ChangeLog
+++ b/Source/ThirdParty/ChangeLog
@@ -1,3 +1,20 @@
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * glu/.gitignore:
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix gcc build after r121302
+        https://bugs.webkit.org/show_bug.cgi?id=90055
+
+        Reviewed by Mark Rowe.
+
+        Assume RTTI is disabled so that gtest builds under XCode 3.2.6.
+
+        * gtest/xcode/Config/General.xcconfig:
+
 2012-04-30  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         Unreviewed. Fix make distcheck.
diff --git a/Source/ThirdParty/glu/.gitignore b/Source/ThirdParty/glu/.gitignore
index ce486c66b..2ee4f8c07 100644
--- a/Source/ThirdParty/glu/.gitignore
+++ b/Source/ThirdParty/glu/.gitignore
@@ -2,4 +2,5 @@
 *.mk
 *.sln
 *.vcproj
+*.vcxproj*
 glu.xcodeproj
diff --git a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
index 5a085ede9..1718ac9d7 100644
--- a/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
+++ b/Source/ThirdParty/gtest/xcode/Config/General.xcconfig
@@ -36,7 +36,7 @@ ALWAYS_SEARCH_USER_PATHS = NO
 // Turn on position dependent code for most cases (overridden where appropriate)
 GCC_DYNAMIC_NO_PIC = YES
 
-GCC_PREPROCESSOR_DEFINITIONS = $(GCC_PREPROCESSOR_DEFINITIONS) GTEST_HAS_TR1_TUPLE=0;
+GCC_PREPROCESSOR_DEFINITIONS = $(GCC_PREPROCESSOR_DEFINITIONS) GTEST_HAS_TR1_TUPLE=0 GTEST_HAS_RTTI=0;
 
 CLANG_CXX_LIBRARY = $(CLANG_CXX_LIBRARY_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 CLANG_CXX_LIBRARY_1060 = libstdc++;
@@ -71,6 +71,5 @@ SDKROOT_1080_1070 = macosx10.7;
 SDKROOT_1090_1070 = macosx10.7;
 SDKROOT_1090_1080 = macosx10.8;
 
-
 // VERSIONING BUILD SETTINGS (used in Info.plist)
 GTEST_VERSIONINFO_ABOUT =  © 2008 Google Inc.
diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
index fd18bf1ac..066f975d9 100644
--- a/Source/WTF/ChangeLog
+++ b/Source/WTF/ChangeLog
@@ -1,9 +1,174 @@
-2012-06-19  Joel Dillon <joel.dillon@codethink.co.uk>  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2012-07-10  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Re-enable __declspec(dl{import,export}) for MinGW when using EXPORT_MACROS
+        https://bugs.webkit.org/show_bug.cgi?id=90612
+
+        Reviewed by Csaba Osztrogonác.
+
+        MinGW was switched to use auto import/export of symbols on r44184.
+        From my understanding of the documentation, MinGW will not auto-export symbols
+        unless there are no explicit __declspec(dlexport) in the DLL already.
+
+        The issues that originally made us rely on the auto-import feature of MinGW
+        should now be resolved with the EXPORT_MACROS work. This patch re-enables them.
+
+        It also removes the GCC check for internal symbols hiding as the visibility should
+        already be hidden by default for both MSVC and GCC on Windows anyway.
+
+        * wtf/ExportMacros.h:
+
+2012-07-09  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Shared code that is guarded with ENABLE(WEBGL) should be guarded with USE()
+        https://bugs.webkit.org/show_bug.cgi?id=90506
+
+        Reviewed by Martin Robinson.
+
+        Made USE(3D_GRAPHICS) default to true when ENABLE(WEBGL) is true.
+        Also updated the Qt default to always use TEXTURE_MAPPER, and to use TEXTURE_MAPPER_GL when
+        3D_GRAPHICS is used.
+
+        * wtf/Platform.h:
+
+2012-07-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Introduce a build flag for low quality JPEG images
+        https://bugs.webkit.org/show_bug.cgi?id=90748
+
+        Reviewed by Adam Barth.
+
+        Turn on the newly introduced flags for android.
+
+        * wtf/Platform.h:
+
+2012-07-05  Filip Pizlo  <fpizlo@apple.com>
+
+        INLINE_ARM_FUNCTION(thingy) should make thingy be thumb2 if we're using thumb2
+        https://bugs.webkit.org/show_bug.cgi?id=90644
+
+        Reviewed by Mark Hahnenberg.
+        
+        Fix breakage introduced in http://trac.webkit.org/changeset/121885
+
+        * wtf/InlineASM.h:
+
+2012-07-05  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Port DFG JIT to traditional ARM
+        https://bugs.webkit.org/show_bug.cgi?id=90198
+
+        Reviewed by Filip Pizlo.
+
+        Enabling DFG JIT on ARM systems with 32 bit instruction set.
+
+        * wtf/InlineASM.h:
+        * wtf/Platform.h:
+
+2012-07-04  Andy Wingo  <wingo@igalia.com>
+
+        [GTK] Enable parallel GC
+        https://bugs.webkit.org/show_bug.cgi?id=90568
+
+        Reviewed by Martin Robinson.
+
+        * wtf/Platform.h: Add GTK to the ENABLE_PARALLEL_GC party.
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Get rid of un-needed QT += declarative for Qt 5
+
+        The declarative module has been renamed to quick1 in Qt 5, and the
+        engine-only module for Qt 5 is named 'qml'. For many of the instances
+        we could just remove 'declarative', since the project file was only
+        used for Qt5/WebKit2 builds. In the other cases the module was wrapped
+        in a haveQt(4) scope.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * WTF.pri:
+
+2012-07-03  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] Turn on DFGJIT in Platform.h
+        https://bugs.webkit.org/show_bug.cgi?id=90482
+
+        Set ENABLE_DFG_JIT for PLATFORM(BLACKBERRY).
+
+        Reviewed by Rob Buis.
+
+        * wtf/Platform.h:
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * WTF.gyp/.gitignore:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WTF.pri:
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121766.
+        http://trac.webkit.org/changeset/121766
+        https://bugs.webkit.org/show_bug.cgi?id=90465
+
+        It caused flakey build errors on the bots (Requested by Ossy
+        on #webkit).
+
+        * WTF.pri:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WTF.pri:
+
+2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
 
         [Qt][Win] Fix broken QtWebKit5.lib linking
         https://bugs.webkit.org/show_bug.cgi?id=88321
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Kenneth Rohde Christiansen.
 
         Instead of letting a module's headers know which other modules depend on them,
         have depending modules define explicitely that they want its symbols exported too.
@@ -13,6 +178,92 @@
 
         * wtf/ExportMacros.h:
 
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121572.
+        http://trac.webkit.org/changeset/121572
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Breaks Mac build since it depends on r121547, which was rolled
+        out
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeCurrentThreadInternal):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove BUILDING_ON_LEOPARD now that no ports build on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Reviewed by Ryosuke Niwa.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeCurrentThreadInternal):
+
+2012-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121529.
+        http://trac.webkit.org/changeset/121529
+        https://bugs.webkit.org/show_bug.cgi?id=90260
+
+        Failed to compile on Chromium WebKitMacBuilder (Requested by
+        keishi on #webkit).
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD branches now that no port builds on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90252
+
+        Reviewed by Ryosuke Niwa.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_ThreadCache::CreateCacheIfNecessary):
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::Collator::userDefault):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD usage in PLATFORM(MAC) code
+        https://bugs.webkit.org/show_bug.cgi?id=85846
+
+        Reviewed by Adam Barth.
+
+        PLATFORM(MAC) has not supported Leopard for several months now.
+        This change removes about 1/3 of the remaining BUILDING_ON_LEOPARD
+        uses in the PLATFORM(MAC) codepaths.  PLATFORM(CHROMIUM) still
+        supports BUILDING_ON_LEOPARD for now.
+
+        * wtf/Platform.h:
+
+2012-06-28  Kalev Lember  <kalevlember@gmail.com>
+
+        ThreadingWin: Silence GCC compiler warnings
+        https://bugs.webkit.org/show_bug.cgi?id=89491
+
+        Reviewed by Adam Roben.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::createThreadInternal):
+        (WTF::PlatformCondition::timedWait):
+        (WTF::PlatformCondition::signal): Fix unused-but-set-variable
+        warnings.
+
+2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Add missing heades to HEADERS
+
+        For JavaScriptCore there aren't any Qt specific files, so we include all
+        headers for easy editing in Qt Creator.
+
+        Reviewed by Simon Hausmann.
+
+        * WTF.pro:
+
 2012-06-25  Kent Tamura  <tkent@chromium.org>
 
         Unreviewed, rolling out r121145.
diff --git a/Source/WTF/WTF.gyp/.gitignore b/Source/WTF/WTF.gyp/.gitignore
index 37f58cd86..06641986f 100644
--- a/Source/WTF/WTF.gyp/.gitignore
+++ b/Source/WTF/WTF.gyp/.gitignore
@@ -2,4 +2,5 @@
 *.mk
 *.sln
 *.vcproj*
+*.vcxproj*
 WTF.xcodeproj
diff --git a/Source/WTF/WTF.pri b/Source/WTF/WTF.pri
index 0f99ec02d..306a18012 100644
--- a/Source/WTF/WTF.pri
+++ b/Source/WTF/WTF.pri
@@ -5,8 +5,6 @@
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
-load(features)
-
 # All external modules should include WTF headers by prefixing with "wtf" (#include <wtf/some/thing.h>).
 INCLUDEPATH += $$PWD
 
@@ -30,7 +28,7 @@ v8 {
     !haveQt(5): error("To build QtWebKit+V8 you need to use Qt 5")
     DEFINES *= WTF_USE_V8=1
     INCLUDEPATH += $${ROOT_WEBKIT_DIR}/Source/WebKit/qt/v8/ForwardingHeaders
-    QT += v8-private declarative
+    QT += v8-private
 }
 
 linux-*:contains(DEFINES, WTF_USE_GSTREAMER=1) {
diff --git a/Source/WTF/WTF.pro b/Source/WTF/WTF.pro
index 0fb57a283..0962ef0b5 100644
--- a/Source/WTF/WTF.pro
+++ b/Source/WTF/WTF.pro
@@ -52,6 +52,7 @@ HEADERS += \
     dtoa/utils.h \
     DynamicAnnotations.h \
     Encoder.h \
+    ExportMacros.h \
     FastAllocBase.h \
     FastMalloc.h \
     FixedArray.h \
diff --git a/Source/WTF/wtf/ExportMacros.h b/Source/WTF/wtf/ExportMacros.h
index d50d6d117..20732b2a6 100644
--- a/Source/WTF/wtf/ExportMacros.h
+++ b/Source/WTF/wtf/ExportMacros.h
@@ -38,7 +38,7 @@
 // being local to the target being generated, and thus not subject to (e.g.) ELF
 // symbol interposition rules.
 
-#if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !COMPILER(GCC)
+#if !PLATFORM(CHROMIUM) && OS(WINDOWS)
 #define HAVE_INTERNAL_VISIBILITY 1
 #define WTF_INTERNAL
 #elif defined(__GNUC__) && !defined(__CC_ARM) && !defined(__ARMCC__)
@@ -51,7 +51,7 @@
 // See note in wtf/Platform.h for more info on EXPORT_MACROS.
 #if USE(EXPORT_MACROS)
 
-#if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !COMPILER(GCC)
+#if !PLATFORM(CHROMIUM) && OS(WINDOWS)
 #define WTF_EXPORT __declspec(dllexport)
 #define WTF_IMPORT __declspec(dllimport)
 #define WTF_HIDDEN
@@ -65,14 +65,9 @@
 #define WTF_HIDDEN
 #endif
 
-// Currently WTF is embedded statically in JSCore, which exports 
-// WTF symbols in the JSCore shared library.
-// Because of this, we need to make sure that we use WTF_EXPORT
-// when building JavaScriptCore as well as WTF.
-
 // FIXME: When all ports are using the export macros, we should replace
 // WTF_EXPORTDATA with WTF_EXPORT_PRIVATE macros.
-#if defined(BUILDING_WTF) || defined(STATICALLY_LINKED_WITH_WTF)
+#if defined(BUILDING_WTF) || defined(STATICALLY_LINKED_WITH_WTF) || (PLATFORM(WX) && defined(BUILDING_JavaScriptCore))
 #define WTF_EXPORTDATA WTF_EXPORT
 #else
 #define WTF_EXPORTDATA WTF_IMPORT
@@ -98,7 +93,7 @@
 
 #endif // USE(EXPORT_MACROS)
 
-#if defined(BUILDING_WTF) || defined(STATICALLY_LINKED_WITH_WTF)
+#if defined(BUILDING_WTF) || defined(STATICALLY_LINKED_WITH_WTF) || (PLATFORM(WX) && defined(BUILDING_JavaScriptCore))
 #define WTF_EXPORT_PRIVATE WTF_EXPORT
 #else
 #define WTF_EXPORT_PRIVATE WTF_IMPORT
diff --git a/Source/WTF/wtf/InlineASM.h b/Source/WTF/wtf/InlineASM.h
index 10cd1cc25..9d7541623 100644
--- a/Source/WTF/wtf/InlineASM.h
+++ b/Source/WTF/wtf/InlineASM.h
@@ -83,4 +83,10 @@
 #define LOCAL_LABEL_STRING(name) ".L" #name
 #endif
 
+#if (CPU(ARM_TRADITIONAL) && (defined(thumb2) || defined(__thumb2__) || defined(__thumb) || defined(__thumb__))) || CPU(ARM_THUMB2)
+#define INLINE_ARM_FUNCTION(name) ".thumb" "\n" ".thumb_func " THUMB_FUNC_PARAM(name) "\n"
+#else
+#define INLINE_ARM_FUNCTION(name)
+#endif
+
 #endif // InlineASM_h
diff --git a/Source/WTF/wtf/MetaAllocatorHandle.h b/Source/WTF/wtf/MetaAllocatorHandle.h
index c43f491f3..242e0b82b 100644
--- a/Source/WTF/wtf/MetaAllocatorHandle.h
+++ b/Source/WTF/wtf/MetaAllocatorHandle.h
@@ -45,17 +45,27 @@ private:
 public:
     WTF_EXPORT_PRIVATE ~MetaAllocatorHandle();
     
-    void* start()
+    void* start() const
     {
         return m_start;
     }
     
-    void* end()
+    void* end() const
     {
-        return reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(m_start) + m_sizeInBytes);
+        return reinterpret_cast<void*>(endAsInteger());
+    }
+    
+    uintptr_t startAsInteger() const
+    {
+        return reinterpret_cast<uintptr_t>(m_start);
+    }
+    
+    uintptr_t endAsInteger() const
+    {
+        return startAsInteger() + m_sizeInBytes;
     }
         
-    size_t sizeInBytes()
+    size_t sizeInBytes() const
     {
         return m_sizeInBytes;
     }
diff --git a/Source/WTF/wtf/Platform.h b/Source/WTF/wtf/Platform.h
index 72e66f094..919f872bc 100644
--- a/Source/WTF/wtf/Platform.h
+++ b/Source/WTF/wtf/Platform.h
@@ -475,6 +475,8 @@
 #elif OS(ANDROID)
 #define WTF_USE_SKIA 1
 #define WTF_USE_LOW_QUALITY_IMAGE_INTERPOLATION 1
+#define WTF_USE_LOW_QUALITY_IMAGE_NO_JPEG_DITHERING 1
+#define WTF_USE_LOW_QUALITY_IMAGE_NO_JPEG_FANCY_UPSAMPLING 1
 #else
 #define WTF_USE_SKIA 1
 #define WTF_USE_ICCJPEG 1
@@ -528,10 +530,10 @@
 #endif
 
 #if PLATFORM(MAC) && !PLATFORM(IOS)
-#if !defined(BUILDING_ON_LEOPARD) && CPU(X86_64)
+#if CPU(X86_64)
 #define WTF_USE_PLUGIN_HOST_PROCESS 1
 #endif
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
 #define ENABLE_GESTURE_EVENTS 1
 #define ENABLE_RUBBER_BANDING 1
 #define WTF_USE_SCROLLBAR_PAINTER 1
@@ -554,7 +556,7 @@
 #if defined(ENABLE_VIDEO)
 #define ENABLE_VIDEO_TRACK 1
 #endif
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
 #define HAVE_LAYER_HOSTING_IN_WINDOW_SERVER 1
 #endif
 #define WTF_USE_APPKIT 1
@@ -903,7 +905,11 @@
 #define ENABLE_DFG_JIT 1
 #endif
 /* Enable the DFG JIT on ARMv7.  Only tested on iOS. */
-#if CPU(ARM_THUMB2) && PLATFORM(IOS)
+#if CPU(ARM_THUMB2) && (PLATFORM(IOS) || PLATFORM(BLACKBERRY))
+#define ENABLE_DFG_JIT 1
+#endif
+/* Enable the DFG JIT on ARM. */
+#if CPU(ARM_TRADITIONAL)
 #define ENABLE_DFG_JIT 1
 #endif
 #endif
@@ -995,13 +1001,8 @@
 
 #if PLATFORM(MAC)
 /* Complex text framework */
-#ifndef BUILDING_ON_LEOPARD
 #define WTF_USE_ATSUI 0
 #define WTF_USE_CORE_TEXT 1
-#else
-#define WTF_USE_ATSUI 1
-#define WTF_USE_CORE_TEXT 0
-#endif
 #endif
 
 /* Accelerated compositing */
@@ -1013,12 +1014,25 @@
 #define ENABLE_CSS_IMAGE_SET 1
 #endif
 
+
+/* Qt always uses Texture Mapper */
+#if PLATFORM(QT)
+#define WTF_USE_TEXTURE_MAPPER 1
+#if USE(3D_GRAPHICS)
+#define WTF_USE_TEXTURE_MAPPER_GL 1
+#endif
+#endif
+
+#if ENABLE(WEBGL) && !defined(WTF_USE_3D_GRAPHICS)
+#define WTF_USE_3D_GRAPHICS 1
+#endif
+
 /* Compositing on the UI-process in WebKit2 */
 #if PLATFORM(QT)
 #define WTF_USE_UI_SIDE_COMPOSITING 1
 #endif
 
-#if (PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)) || PLATFORM(IOS)
+#if PLATFORM(MAC) || PLATFORM(IOS)
 #define WTF_USE_PROTECTION_SPACE_AUTH_CALLBACK 1
 #endif
 
@@ -1026,7 +1040,7 @@
 #define ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH 1
 #endif
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
 #define ENABLE_THREADED_SCROLLING 1
 #endif
 
@@ -1080,7 +1094,7 @@
 
 #define ENABLE_OBJECT_MARK_LOGGING 0
 
-#if !defined(ENABLE_PARALLEL_GC) && !ENABLE(OBJECT_MARK_LOGGING) && (PLATFORM(MAC) || PLATFORM(IOS) || PLATFORM(QT) || PLATFORM(BLACKBERRY)) && ENABLE(COMPARE_AND_SWAP)
+#if !defined(ENABLE_PARALLEL_GC) && !ENABLE(OBJECT_MARK_LOGGING) && (PLATFORM(MAC) || PLATFORM(IOS) || PLATFORM(QT) || PLATFORM(BLACKBERRY) || PLATFORM(GTK)) && ENABLE(COMPARE_AND_SWAP)
 #define ENABLE_PARALLEL_GC 1
 #endif
 
@@ -1088,11 +1102,11 @@
 #define ENABLE_GC_VALIDATION 1
 #endif
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
 #define WTF_USE_AVFOUNDATION 1
 #endif
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
 #define WTF_USE_COREMEDIA 1
 #endif
 
@@ -1104,7 +1118,7 @@
 #define WTF_USE_REQUEST_ANIMATION_FRAME_DISPLAY_MONITOR 1
 #endif
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
 #define HAVE_INVERTED_WHEEL_EVENTS 1
 #endif
 
diff --git a/Source/WTF/wtf/ThreadSpecific.h b/Source/WTF/wtf/ThreadSpecific.h
index 60c9907bd..f51ab4cf2 100644
--- a/Source/WTF/wtf/ThreadSpecific.h
+++ b/Source/WTF/wtf/ThreadSpecific.h
@@ -1,7 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Jian Li <jianli@chromium.org>
- * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -103,33 +102,6 @@ private:
 };
 
 #if USE(PTHREADS)
-
-typedef pthread_key_t ThreadSpecificKey;
-
-inline void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
-{
-    int error = pthread_key_create(key, destructor);
-    if (error)
-        CRASH();
-}
-
-inline void ThreadSpecificKeyDelete(ThreadSpecificKey key)
-{
-    int error = pthread_key_delete(key);
-    if (error)
-        CRASH();
-}
-
-inline void ThreadSpecificSet(ThreadSpecificKey key, void* value)
-{
-    pthread_setspecific(key, value);
-}
-
-inline void* ThreadSpecificGet(ThreadSpecificKey key)
-{
-    return pthread_getspecific(key);
-}
-
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
 {
@@ -167,14 +139,6 @@ const int kMaxTlsKeySize = 256;
 WTF_EXPORT_PRIVATE long& tlsKeyCount();
 WTF_EXPORT_PRIVATE DWORD* tlsKeys();
 
-class ThreadSpecificKeyValue;
-typedef ThreadSpecificKeyValue* ThreadSpecificKey;
-
-void ThreadSpecificKeyCreate(ThreadSpecificKey*, void (*)(void *));
-void ThreadSpecificKeyDelete(ThreadSpecificKey);
-void ThreadSpecificSet(ThreadSpecificKey, void*);
-void* ThreadSpecificGet(ThreadSpecificKey);
-
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
     : m_index(-1)
diff --git a/Source/WTF/wtf/ThreadSpecificWin.cpp b/Source/WTF/wtf/ThreadSpecificWin.cpp
index 61a594251..d72996a7a 100644
--- a/Source/WTF/wtf/ThreadSpecificWin.cpp
+++ b/Source/WTF/wtf/ThreadSpecificWin.cpp
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2009 Jian Li <jianli@chromium.org>
- * Copyright (C) 2012 Patrick Gansterer <paroga@paroga.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,72 +19,15 @@
  */
 
 #include "config.h"
-#include "ThreadSpecific.h"
 
-#include "StdLibExtras.h"
-#include "ThreadingPrimitives.h"
+#include "ThreadSpecific.h"
 
-#if !USE(PTHREADS)
+#if USE(PTHREADS)
+#error This file should not be compiled by ports that do not use Windows native ThreadSpecific implementation.
+#endif
 
 namespace WTF {
 
-static Mutex& destructorsMutex()
-{
-    DEFINE_STATIC_LOCAL(Mutex, staticMutex, ());
-    return staticMutex;
-}
-
-class ThreadSpecificKeyValue {
-public:
-    ThreadSpecificKeyValue(void (*destructor)(void *))
-        : m_destructor(destructor)
-    {
-        m_tlsKey = TlsAlloc();
-        if (m_tlsKey == TLS_OUT_OF_INDEXES)
-            CRASH();
-
-        MutexLocker locker(destructorsMutex());
-        m_next = m_first;
-        m_first = this;
-    }
-
-    ~ThreadSpecificKeyValue()
-    {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue** next = &m_first;
-        while (*next != this) {
-            ASSERT(*next);
-            next = &(*next)->m_next;
-        }
-        *next = (*next)->m_next;
-
-        TlsFree(m_tlsKey);
-    }
-
-    void setValue(void* data) { TlsSetValue(m_tlsKey, data); }
-    void* value() { return TlsGetValue(m_tlsKey); }
-
-    static void callDestructors()
-    {
-        MutexLocker locker(destructorsMutex());
-        ThreadSpecificKeyValue* next = m_first;
-        while (next) {
-            if (void* data = next->value())
-                next->m_destructor(data);
-            next = next->m_next;
-        }
-    }
-
-private:
-    void (*m_destructor)(void *);
-    DWORD m_tlsKey;
-    ThreadSpecificKeyValue* m_next;
-
-    static ThreadSpecificKeyValue* m_first;
-};
-
-ThreadSpecificKeyValue* ThreadSpecificKeyValue::m_first = 0;
-
 long& tlsKeyCount()
 {
     static long count;
@@ -98,26 +40,6 @@ DWORD* tlsKeys()
     return keys;
 }
 
-void ThreadSpecificKeyCreate(ThreadSpecificKey* key, void (*destructor)(void *))
-{
-    *key = new ThreadSpecificKeyValue(destructor);
-}
-
-void ThreadSpecificKeyDelete(ThreadSpecificKey key)
-{
-    delete key;
-}
-
-void ThreadSpecificSet(ThreadSpecificKey key, void* data)
-{
-    key->setValue(data);
-}
-
-void* ThreadSpecificGet(ThreadSpecificKey key)
-{
-    return key->value();
-}
-
 void ThreadSpecificThreadExit()
 {
     for (long i = 0; i < tlsKeyCount(); i++) {
@@ -126,10 +48,6 @@ void ThreadSpecificThreadExit()
         if (data)
             data->destructor(data);
     }
-
-    ThreadSpecificKeyValue::callDestructors();
 }
 
 } // namespace WTF
-
-#endif // !USE(PTHREADS)
diff --git a/Source/WTF/wtf/ThreadingWin.cpp b/Source/WTF/wtf/ThreadingWin.cpp
index 4444827d3..d33973daf 100644
--- a/Source/WTF/wtf/ThreadingWin.cpp
+++ b/Source/WTF/wtf/ThreadingWin.cpp
@@ -244,7 +244,8 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     }
 
     // The thread will take ownership of invocation.
-    invocation.leakPtr();
+    ThreadFunctionInvocation* leakedInvocation = invocation.leakPtr();
+    UNUSED_PARAM(leakedInvocation);
 
     threadID = static_cast<ThreadIdentifier>(threadIdentifier);
     storeThreadHandleByIdentifier(threadIdentifier, threadHandle);
@@ -344,10 +345,10 @@ bool PlatformCondition::timedWait(PlatformMutex& mutex, DWORD durationMillisecon
 {
     // Enter the wait state.
     DWORD res = WaitForSingleObject(m_blockLock, INFINITE);
-    ASSERT(res == WAIT_OBJECT_0);
+    ASSERT_UNUSED(res, res == WAIT_OBJECT_0);
     ++m_waitersBlocked;
     res = ReleaseSemaphore(m_blockLock, 1, 0);
-    ASSERT(res);
+    ASSERT_UNUSED(res, res);
 
     --mutex.m_recursionCount;
     LeaveCriticalSection(&mutex.m_internalMutex);
@@ -356,7 +357,7 @@ bool PlatformCondition::timedWait(PlatformMutex& mutex, DWORD durationMillisecon
     bool timedOut = (WaitForSingleObject(m_blockQueue, durationMilliseconds) == WAIT_TIMEOUT);
 
     res = WaitForSingleObject(m_unblockLock, INFINITE);
-    ASSERT(res == WAIT_OBJECT_0);
+    ASSERT_UNUSED(res, res == WAIT_OBJECT_0);
 
     int signalsLeft = m_waitersToUnblock;
 
@@ -367,19 +368,19 @@ bool PlatformCondition::timedWait(PlatformMutex& mutex, DWORD durationMillisecon
         // this may occur if many calls to wait with a timeout are made and
         // no call to notify_* is made
         res = WaitForSingleObject(m_blockLock, INFINITE);
-        ASSERT(res == WAIT_OBJECT_0);
+        ASSERT_UNUSED(res, res == WAIT_OBJECT_0);
         m_waitersBlocked -= m_waitersGone;
         res = ReleaseSemaphore(m_blockLock, 1, 0);
-        ASSERT(res);
+        ASSERT_UNUSED(res, res);
         m_waitersGone = 0;
     }
 
     res = ReleaseMutex(m_unblockLock);
-    ASSERT(res);
+    ASSERT_UNUSED(res, res);
 
     if (signalsLeft == 1) {
         res = ReleaseSemaphore(m_blockLock, 1, 0); // Open the gate.
-        ASSERT(res);
+        ASSERT_UNUSED(res, res);
     }
 
     EnterCriticalSection (&mutex.m_internalMutex);
@@ -393,12 +394,12 @@ void PlatformCondition::signal(bool unblockAll)
     unsigned signalsToIssue = 0;
 
     DWORD res = WaitForSingleObject(m_unblockLock, INFINITE);
-    ASSERT(res == WAIT_OBJECT_0);
+    ASSERT_UNUSED(res, res == WAIT_OBJECT_0);
 
     if (m_waitersToUnblock) { // the gate is already closed
         if (!m_waitersBlocked) { // no-op
             res = ReleaseMutex(m_unblockLock);
-            ASSERT(res);
+            ASSERT_UNUSED(res, res);
             return;
         }
 
@@ -413,7 +414,7 @@ void PlatformCondition::signal(bool unblockAll)
         }
     } else if (m_waitersBlocked > m_waitersGone) {
         res = WaitForSingleObject(m_blockLock, INFINITE); // Close the gate.
-        ASSERT(res == WAIT_OBJECT_0);
+        ASSERT_UNUSED(res, res == WAIT_OBJECT_0);
         if (m_waitersGone != 0) {
             m_waitersBlocked -= m_waitersGone;
             m_waitersGone = 0;
@@ -429,16 +430,16 @@ void PlatformCondition::signal(bool unblockAll)
         }
     } else { // No-op.
         res = ReleaseMutex(m_unblockLock);
-        ASSERT(res);
+        ASSERT_UNUSED(res, res);
         return;
     }
 
     res = ReleaseMutex(m_unblockLock);
-    ASSERT(res);
+    ASSERT_UNUSED(res, res);
 
     if (signalsToIssue) {
         res = ReleaseSemaphore(m_blockQueue, signalsToIssue, 0);
-        ASSERT(res);
+        ASSERT_UNUSED(res, res);
     }
 }
 
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 6d3da7f8c..e0737d8fd 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -4,6 +4,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/Modules/geolocation"
     "${WEBCORE_DIR}/Modules/indexeddb"
     "${WEBCORE_DIR}/Modules/intents"
+    "${WEBCORE_DIR}/Modules/notifications"
     "${WEBCORE_DIR}/Modules/quota"
     "${WEBCORE_DIR}/Modules/webaudio"
     "${WEBCORE_DIR}/Modules/webdatabase"
@@ -32,7 +33,6 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/loader/cache"
     "${WEBCORE_DIR}/loader/icon"
     "${WEBCORE_DIR}/mathml"
-    "${WEBCORE_DIR}/notifications"
     "${WEBCORE_DIR}/page"
     "${WEBCORE_DIR}/page/animation"
     "${WEBCORE_DIR}/page/scrolling"
@@ -96,6 +96,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
 
 SET(WebCore_IDL_INCLUDES
     Modules/filesystem
+    Modules/gamepad
     Modules/geolocation
     Modules/indexeddb
     Modules/quota
@@ -222,6 +223,7 @@ SET(WebCore_IDL_FILES
     dom/MouseEvent.idl
     dom/MutationCallback.idl
     dom/MutationEvent.idl
+    dom/MutationObserver.idl
     dom/MutationRecord.idl
     dom/NamedNodeMap.idl
     dom/NodeFilter.idl
@@ -245,7 +247,6 @@ SET(WebCore_IDL_FILES
     dom/TreeWalker.idl
     dom/UIEvent.idl
     dom/WebKitAnimationEvent.idl
-    dom/WebKitMutationObserver.idl
     dom/WebKitNamedFlow.idl
     dom/WebKitTransitionEvent.idl
     dom/WheelEvent.idl
@@ -277,6 +278,7 @@ SET(WebCore_IDL_FILES
     html/HTMLCollection.idl
     html/HTMLDataListElement.idl
     html/HTMLDetailsElement.idl
+    html/HTMLDialogElement.idl
     html/HTMLDirectoryElement.idl
     html/HTMLDivElement.idl
     html/HTMLDListElement.idl
@@ -539,6 +541,7 @@ SET(WebCore_SOURCES
     css/WebKitCSSKeyframesRule.cpp
     css/WebKitCSSMatrix.cpp
     css/WebKitCSSRegionRule.cpp
+    css/WebKitCSSSVGDocumentValue.cpp
     css/WebKitCSSTransformValue.cpp
 
     dom/ActiveDOMObject.cpp
@@ -612,6 +615,7 @@ SET(WebCore_SOURCES
     dom/MouseEvent.cpp
     dom/MouseRelatedEvent.cpp
     dom/MutationEvent.cpp
+    dom/MutationObserver.cpp
     dom/MutationObserverInterestGroup.cpp
     dom/MutationObserverRegistration.cpp
     dom/MutationRecord.cpp
@@ -665,7 +669,6 @@ SET(WebCore_SOURCES
     dom/UserTypingGestureIndicator.cpp
     dom/ViewportArguments.cpp
     dom/WebKitAnimationEvent.cpp
-    dom/WebKitMutationObserver.cpp
     dom/WebKitNamedFlow.cpp
     dom/WebKitTransitionEvent.cpp
     dom/WheelEvent.cpp
@@ -784,6 +787,7 @@ SET(WebCore_SOURCES
     html/HTMLDListElement.cpp
     html/HTMLDataListElement.cpp
     html/HTMLDetailsElement.cpp
+    html/HTMLDialogElement.cpp
     html/HTMLDirectoryElement.cpp
     html/HTMLDivElement.cpp
     html/HTMLDocument.cpp
@@ -1237,8 +1241,8 @@ SET(WebCore_SOURCES
     platform/graphics/filters/SourceAlpha.cpp
     platform/graphics/filters/SourceGraphic.cpp
 
+    platform/graphics/filters/arm/NEONHelpers.h
     platform/graphics/filters/arm/FECompositeArithmeticNEON.h
-    platform/graphics/filters/arm/FEGaussianBlurNEON.cpp
     platform/graphics/filters/arm/FEGaussianBlurNEON.h
     platform/graphics/filters/arm/FELightingNEON.cpp
     platform/graphics/filters/arm/FELightingNEON.h
@@ -1295,6 +1299,7 @@ SET(WebCore_SOURCES
 
     platform/text/Base64.cpp
     platform/text/BidiContext.cpp
+    platform/text/DateTimeFormat.cpp
     platform/text/Hyphenation.cpp
     platform/text/LineEnding.cpp
     platform/text/LocaleToScriptMappingDefault.cpp
@@ -1713,19 +1718,19 @@ ENDIF ()
 
 IF (ENABLE_NOTIFICATIONS)
     LIST(APPEND WebCore_SOURCES
-        notifications/DOMWindowNotifications.cpp
-        notifications/NotificationCenter.cpp
-        notifications/NotificationController.cpp
-        notifications/Notification.cpp
-        notifications/WorkerContextNotifications.cpp
+        Modules/notifications/DOMWindowNotifications.cpp
+        Modules/notifications/NotificationCenter.cpp
+        Modules/notifications/NotificationController.cpp
+        Modules/notifications/Notification.cpp
+        Modules/notifications/WorkerContextNotifications.cpp
     )
 
     LIST(APPEND WebCore_IDL_FILES
-        notifications/DOMWindowNotifications.idl
-        notifications/Notification.idl
-        notifications/NotificationCenter.idl
-        notifications/NotificationPermissionCallback.idl
-        notifications/WorkerContextNotifications.idl
+        Modules/notifications/DOMWindowNotifications.idl
+        Modules/notifications/Notification.idl
+        Modules/notifications/NotificationCenter.idl
+        Modules/notifications/NotificationPermissionCallback.idl
+        Modules/notifications/WorkerContextNotifications.idl
     )
 ENDIF ()
 
@@ -2473,6 +2478,22 @@ IF (ENABLE_BATTERY_STATUS)
     )
 ENDIF ()
 
+IF (ENABLE_GAMEPAD)
+    LIST(APPEND WebCore_INCLUDE_DIRECTORIES
+        "${WEBCORE_DIR}/Modules/gamepad"
+    )
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/gamepad/Gamepad.idl
+        Modules/gamepad/GamepadList.idl
+        Modules/gamepad/NavigatorGamepad.idl
+    )
+    LIST(APPEND WebCore_SOURCES
+        Modules/gamepad/Gamepad.cpp
+        Modules/gamepad/GamepadList.cpp
+        Modules/gamepad/NavigatorGamepad.cpp
+    )
+ENDIF ()
+
 IF (ENABLE_MEDIA_STREAM)
     LIST(APPEND WebCore_INCLUDE_DIRECTORIES
         ${WEBCORE_DIR}/Modules/mediastream
@@ -2488,6 +2509,7 @@ IF (ENABLE_MEDIA_STREAM)
         Modules/mediastream/MediaStreamEvent.idl
         Modules/mediastream/MediaStreamList.idl
         Modules/mediastream/MediaStreamTrack.idl
+        Modules/mediastream/MediaStreamTrackEvent.idl
         Modules/mediastream/MediaStreamTrackList.idl
         Modules/mediastream/NavigatorMediaStream.idl
         Modules/mediastream/NavigatorUserMediaError.idl
@@ -2506,6 +2528,7 @@ IF (ENABLE_MEDIA_STREAM)
         Modules/mediastream/MediaStreamList.cpp
         Modules/mediastream/MediaStreamRegistry.cpp
         Modules/mediastream/MediaStreamTrack.cpp
+        Modules/mediastream/MediaStreamTrackEvent.cpp
         Modules/mediastream/MediaStreamTrackList.cpp
         Modules/mediastream/NavigatorMediaStream.cpp
         Modules/mediastream/PeerConnection00.cpp
@@ -2568,6 +2591,7 @@ IF (ENABLE_WEB_AUDIO)
         platform/audio/AudioBus.cpp
         platform/audio/AudioChannel.cpp
         platform/audio/AudioDSPKernelProcessor.cpp
+        platform/audio/AudioFIFO.cpp
         platform/audio/AudioPullFIFO.cpp
         platform/audio/AudioResampler.cpp
         platform/audio/AudioResamplerKernel.cpp
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 0f06797ff..96dd7aad2 100755..100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,12 +1,10958 @@
-2012-06-19  Joel Dillon <joel.dillon@codethink.co.uk>  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2012-07-11  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Mac] Expose time format related functions
+        https://bugs.webkit.org/show_bug.cgi?id=90956
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces localizedTimeFormatText, localizedShortTimeFormatText
+        and timeAMPMLabels for Mac within feature flag ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.
+
+        See also:
+          ICU version: https://bugs.webkit.org/show_bug.cgi?id=89965
+          Win version: https://bugs.webkit.org/show_bug.cgi?id=90236
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/text/mac/LocalizedDateMac.cpp:
+        (WebCore::localizedTimeFormatText): Added.
+        (WebCore::localizedShortTimeFormatText): Added.
+        (WebCore::timeAMPMLabels): Added.
+
+2012-07-11  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Adding HarfBuzz-ng for Linux
+        https://bugs.webkit.org/show_bug.cgi?id=90362
+
+        Reviewed by Tony Chang.
+
+        This patch adds harfbuzz-ng support for Chromium Linux port as a part of
+        transition from old harfbuzz. HarfBuzzFaceSkia.cpp implements harfbuzz-ng
+        callbacks by using Skia APIs. For now, the feature is enabled only when
+        WTF_USE_HARFBUZZ_NG is defined.
+
+        No new tests. No change in behavior now.
+
+        * WebCore.gyp/WebCore.gyp: Added use_harfbuzz_ng variable and related files.
+        * WebCore.gypi: Added HarfBuzzFaceSkia.cpp
+        * platform/graphics/harfbuzz/FontHarfBuzz.cpp: Added USE(HARFBUZZ_NG).
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp: Ditto.
+        (WebCore):
+        (WebCore::FontPlatformData::harfbuzzFace):
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h: Ditto.
+        (FontPlatformData):
+        * platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp: Added.
+        (WebCore):
+        (WebCore::SkiaScalarToHarfbuzzPosition):
+        (WebCore::SkiaGetGlyphWidthAndExtents):
+        (WebCore::harfbuzzGetGlyph):
+        (WebCore::harfbuzzGetGlyphHorizontalAdvance):
+        (WebCore::harfbuzzGetGlyphHorizontalOrigin):
+        (WebCore::harfbuzzGetGlyphExtents):
+        (WebCore::harfbuzzSkiaGetFontFuncs):
+        (WebCore::harfbuzzSkiaGetTable):
+        (WebCore::destroyPaint):
+        (WebCore::HarfBuzzFace::createFace):
+        (WebCore::HarfBuzzFace::createFont):
+        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
+        * platform/graphics/skia/GlyphPageTreeNodeSkia.cpp: Added USE(HARFBUZZ_NG).
+        (WebCore::substituteWithVerticalGlyphs):
+
+2012-07-11  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Clean up FileSystem related code
+        https://bugs.webkit.org/show_bug.cgi?id=90592
+
+        Reviewed by Vsevolod Vlasov.
+
+        Clean up FileSystem related code in Inspector as follows:
+        - Clean up layout tests and add test case for error case,
+        - Fix error handling on request,
+        - s/GetFileSystemRootTask/FileSystemRootRequest/g
+        - s/ReadDirectoryTask/DirectoryContentRequest/g
+        - s/ReadFileTask/FileContentRequest/g
+
+        Tests: http/tests/inspector/filesystem/request-directory-content.html
+               http/tests/inspector/filesystem/request-file-content.html
+               http/tests/inspector/filesystem/request-filesystem-root.html
+               http/tests/inspector/filesystem/request-metadata.html
+
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::requestFileSystemRoot): Add early error handling.
+        (WebCore::InspectorFileSystemAgent::requestDirectoryContent): Add early error handling.
+        (WebCore::InspectorFileSystemAgent::requestMetadata): Add early error handling.
+        (WebCore::InspectorFileSystemAgent::requestFileContent): Add early error handling.
+        * inspector/InspectorFileSystemAgent.h: Remove unused forward declaration and unused header.
+        (WebCore):
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileSystemRoot): Add early error handling.
+        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestDirectoryContent): Add early error handling.
+        (WebInspector.FileSystemRequestManager.prototype.requestMetadata.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestMetadata): Add early error handling.
+        (WebInspector.FileSystemRequestManager.prototype.requestFileContent.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileContent): Add early error handling.
+
+2012-07-09  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Forward message loop instrumentation data to frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=89584
+
+        Reviewed by Yury Semikhatsky.
+
+        Transmit collected message loop tasks to inspector frontend.
+        Now "Program" should be a top-level event on browsers that
+        support message loop instrumentation.
+        Frontend was changed so that user will not see any changes.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        Added new event type - "Program"
+        (WebCore::InspectorTimelineAgent::willProcessTask):
+        Begin "Program" event.
+        (WebCore::InspectorTimelineAgent::didProcessTask):
+        Finish "Program" event.
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        Do not add counters to "Program" events.
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::innerSetHeapSizeStatistic):
+        Renamed from "setHeapSizeStatistic"
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
+        Unwraps "Program" events.
+        (WebInspector.MemoryStatistics.prototype._innerRecordAdded):
+        Renamed from "_onRecordAdded"
+        * inspector/front-end/TimelineFrameController.js:
+        (WebInspector.TimelineFrameController.prototype._addRecord):
+        Unwraps "Program" events.
+        (WebInspector.TimelineFrameController.prototype._innerAddRecord):
+        Renamed from "_addRecord"
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
+        Filter out "Program" category.
+        (WebInspector.TimelineCategoryStrips.prototype.update):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        Filter out "Program" category.
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        Unwraps "Program" events.
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.categories):
+        Added "Program" category.
+        (WebInspector.TimelinePresentationModel.recordStyle):
+        Ditto.
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        Unwraps "Program" events.
+        (WebInspector.TimelinePresentationModel.prototype._addRecord):
+        Renamed from "addRecord"
+
+2012-07-11  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Adding HarfBuzz-ng for Linux
+        https://bugs.webkit.org/show_bug.cgi?id=90362
+
+        Reviewed by Tony Chang.
+
+        This patch adds harfbuzz-ng support for Chromium Linux port as a part of
+        transition from old harfbuzz. HarfBuzzFaceSkia.cpp implements harfbuzz-ng
+        callbacks by using Skia APIs. For now, the feature is enabled only when
+        WTF_USE_HARFBUZZ_NG is defined.
+
+        No new tests. No change in behavior now.
+
+        * WebCore.gyp/WebCore.gyp: Added use_harfbuzz_ng variable and related files.
+        * WebCore.gypi: Added HarfBuzzFaceSkia.cpp
+        * platform/graphics/harfbuzz/FontHarfBuzz.cpp: Added USE(HARFBUZZ_NG).
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp: Ditto.
+        (WebCore):
+        (WebCore::FontPlatformData::harfbuzzFace):
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h: Ditto.
+        (FontPlatformData):
+        * platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp: Added.
+        (WebCore):
+        (WebCore::SkiaScalarToHarfbuzzPosition):
+        (WebCore::SkiaGetGlyphWidthAndExtents):
+        (WebCore::harfbuzzGetGlyph):
+        (WebCore::harfbuzzGetGlyphHorizontalAdvance):
+        (WebCore::harfbuzzGetGlyphHorizontalOrigin):
+        (WebCore::harfbuzzGetGlyphExtents):
+        (WebCore::harfbuzzSkiaGetFontFuncs):
+        (WebCore::harfbuzzSkiaGetTable):
+        (WebCore::destroyPaint):
+        (WebCore::HarfBuzzFace::createFace):
+        (WebCore::HarfBuzzFace::createFont):
+        (WebCore::HarfBuzzShaper::createGlyphBufferAdvance):
+        * platform/graphics/skia/GlyphPageTreeNodeSkia.cpp: Added USE(HARFBUZZ_NG).
+        (WebCore::substituteWithVerticalGlyphs):
+
+2012-07-11  Kenneth Russell  <kbr@google.com>
+
+        compositing/webgl/webgl-nonpremultiplied-blend.html is flaky on Lion
+        https://bugs.webkit.org/show_bug.cgi?id=82412
+
+        Reviewed by Adrienne Walker.
+
+        When compositing premultipliedAlpha=false WebGL canvases, use a separate
+        blend function for the alpha channel to avoid writing alpha < 1. This
+        makes the behavior more consistent with all other compositing results
+        and avoids situations where the alpha channel is preserved on some
+        platforms and discarded on others.
+
+        Covered by existing tests.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawTextureQuad):
+            Use separate alpha blend function when compositing premultipliedAlpha=false WebGL canvases.
+
+2012-07-10  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium-Windows] Implement functions for localized time format information
+        https://bugs.webkit.org/show_bug.cgi?id=90236
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces following localized time format related
+        functions:
+            - localizedTimeFormatText
+            - localizeShortTimeFormatText()
+            - timeAMPMLabels
+        for Windows in feature flag: ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.
+
+        See also:
+          ICU version: https://bugs.webkit.org/show_bug.cgi?id=89965
+          Mac version: https://bugs.webkit.org/show_bug.cgi?id=90237
+
+        Tests: WebKit/chromium/tests/LocalWinTest.cpp
+
+        * platform/text/LocaleWin.cpp:
+        (WebCore::mapCharacterToDateTimeFieldType): Added.
+        (WebCore::convertWindowsTimeFormatToLDML): Added.
+        (WebCore::LocaleWin::timeFormatText): Added.
+        (WebCore::LocaleWin::shortTimeFormatText): Added.
+        (WebCore::LocaleWin::timeAMPMLabels): Added.
+        * platform/text/LocaleWin.h:
+        (LocaleWin): Added time format related functions and variables.
+        * platform/text/LocalizedDateWin.cpp:
+        (WebCore::localizedTimeFormatText): Added.
+        (WebCore::localizedShortTimeFormatText):  Added.
+        (WebCore::timeAMPMLabels):  Added.
+
+2012-07-10  Douglas Stockwell  <dstockwell@chromium.org>
+
+        Style not updated for element with display:none becoming first/last-child
+        https://bugs.webkit.org/show_bug.cgi?id=90356
+
+        Reviewed by Kent Tamura.
+
+        Always trigger style recalc when an element without a renderer becomes the first/last-child.
+
+        Tests: fast/css/first-child-display-change.html
+               fast/css/last-child-display-change.html
+
+        * dom/Element.cpp:
+        (WebCore::checkForSiblingStyleChanges):
+
+2012-07-10  Shinya Kawanaka  <shinyak@chromium.org>
+
+        ShadowRoot should know its type in debug build.
+        https://bugs.webkit.org/show_bug.cgi?id=90933
+
+        Reviewed by Hajime Morita.
+
+        For assertion, ShadowRoot should know its type is UserAgentShadowRoot or AuthorShadowRoot.
+
+        This patch also renames ShadowRootCreationPurpose to ShadowRootType, since it is suitable
+        name for ShadowRoot to have.
+
+        No new tests, since it is used only for assertion.
+
+        * dom/Element.cpp:
+        (WebCore::Element::ensureShadowRoot):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::ShadowRoot::type):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::createShadowSubtree):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::createShadowSubtree):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        * html/HTMLMeterElement.cpp:
+        (WebCore::HTMLMeterElement::createShadowSubtree):
+        * html/HTMLProgressElement.cpp:
+        (WebCore::HTMLProgressElement::createShadowSubtree):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::createShadowSubtree):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::createShadowSubtree):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree): Asserts that ShadowRoot type is UserAgentShadowRoot.
+        * html/shadow/TextFieldDecorationElement.cpp:
+        (WebCore::getDecorationRootAndDecoratedRoot):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::createShadowSubtree):
+
+2012-07-10  George Staikos  <staikos@webkit.org>
+
+        Add missing binding type String for IndexedDB.
+        https://bugs.webkit.org/show_bug.cgi?id=90351
+
+        Reviewed by Nikolas Zimmermann.
+
+        No new tests because it's already covered by IDB tests.
+
+        * bindings/js/JSIDBAnyCustom.cpp:
+        (WebCore::toJS):
+
+2012-07-10  Brian Anderson  <brianderson@chromium.org>
+
+        [chromium] Make full texture updates explicit
+        https://bugs.webkit.org/show_bug.cgi?id=90507
+
+        Reviewed by Adrienne Walker.
+
+        Covered by existing tests.
+
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateTiles):
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+        (WebCore::CCTextureUpdater::appendFullUpdate):
+        (WebCore::CCTextureUpdater::hasMoreUpdates):
+        (WebCore::CCTextureUpdater::update):
+        (WebCore::CCTextureUpdater::clear):
+        * platform/graphics/chromium/cc/CCTextureUpdater.h:
+        (CCTextureUpdater):
+
+2012-07-10  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Crash in nextLinePosition() due to accessing a removed root line box.
+        https://bugs.webkit.org/show_bug.cgi?id=90484
+
+        Reviewed by Abhishek Arya.
+
+        When <object> element is reattached, the 'content' style is compared to the old style.
+        If it is not the same, a flag to recalc style is enabled. Because of this, the recalc style flag
+        is not cleared in updateLayoutIgnorePendingStyleSheets() in nextLinePosition(), and it causes
+        the second layout in isEditablePosition(p). Then 'RootInlineBox root' is invalidated, but
+        it's used after that.
+
+        When the content of the same <object> elements are compared, they should be the same.
+        However, operator== for ContentData is not implemented correctly (it compares a pointer instead of
+        content). So operator== does not hold for the content of the same <object> elements.
+
+        Test: editing/execCommand/crash-extend-selection-forward.html
+
+        * rendering/style/ContentData.cpp:
+        (WebCore::operator==): Compares the instance of data instead of pointer.
+
+2012-07-10  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Ensure transaction abort events are deterministic in multiprocess ports
+        https://bugs.webkit.org/show_bug.cgi?id=90412
+
+        Reviewed by Tony Chang.
+
+        In multi-process ports (e.g. Chromium), transaction aborts triggered on the front-end could 
+        be initiated while a "success" event was in-flight from the back end. This would lead to 
+        apparently flaky behavior when requests would sometimes report success and sometimes report
+        an error. Address this by having front-end triggered aborts do the abort steps immediately,
+        then send the async abort request to the back end.
+
+        No new tests - behavior in single process ports (and DRT) covered by existing
+        tests. Will enable currently disabled Chromium tests to be enabled (crbug.com/83226).
+
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest): Initialize a new m_requestAborted flag, used to prevent
+        dispatching if an in-flight request comes in after the abort.
+        (WebCore::IDBRequest::abort): Set flag to prevent double dispatching.
+        (WebCore::IDBRequest::onError): Handle aborted-then-received-event case.
+        (WebCore::IDBRequest::onSuccess): Ditto.
+        (WebCore::IDBRequest::onSuccessWithContinuation): Ditto.
+        (WebCore::IDBRequest::dispatchEvent): On uncaught error, trigger abort on transaction front-end.
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::abort): Do abort steps locally first, then notify back-end.
+        (WebCore::IDBTransaction::onAbort): If abort wasn't triggered locally, clean up is still necessary.
+
+2012-07-10  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        REGRESSION(r112113): absolutely positioned INPUT boxes with a table cell containing block have a 0px height
+        https://bugs.webkit.org/show_bug.cgi?id=89209
+
+        Reviewed by Ojan Vafai.
+
+        Test: fast/forms/input-in-table-cell-no-value.html
+
+        The issue comes from the layout code not properly resetting the overriden heigth between layouts.
+
+        The test case relies on a table cell as it requires a 2 pass layout. Between the 2 passes, different
+        code paths would be taken, leading to previous values being used to over-constrain the inner content.
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout):
+        Ensure consistent layout by resetting any overriden conditional height.
+
+2012-07-10  Kevin Ellis  <kevers@chromium.org>
+
+        Input elements with type=range do not have default touch handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=88807
+
+        Reviewed by Antonio Gomes.
+
+        This patch adds support for touch event handling on input elements
+        and dragging a slider with touch start and move events.  Previously,
+        manipulating a slider on a touch screen required generation of
+        synthetic mouse events.
+
+        Tests: fast/events/touch/touch-slider-no-js-touch-listener.html
+               fast/events/touch/touch-slider.html
+
+        * dom/Event.cpp:
+        (WebCore::Event::isTouchEvent):
+        (WebCore):
+        * dom/Event.h:
+        (Event):
+        * dom/Touch.cpp:
+        (WebCore::Touch::Touch):
+        * dom/Touch.h:
+        (WebCore::Touch::absoluteLocation):
+        (Touch):
+        * dom/TouchEvent.cpp:
+        (WebCore::TouchEvent::isTouchEvent):
+        (WebCore):
+        * dom/TouchEvent.h:
+        (TouchEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::~HTMLInputElement):
+        (WebCore::HTMLInputElement::updateType):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLInputElement.h:
+        (HTMLInputElement):
+        * html/InputType.cpp:
+        (WebCore):
+        (WebCore::InputType::handleTouchEvent):
+        (WebCore::InputType::hasTouchEventHandler):
+        * html/InputType.h:
+        (WebCore):
+        (ClickHandlingState):
+        (InputType):
+        * html/RangeInputType.cpp:
+        (WebCore):
+        (WebCore::RangeInputType::handleTouchEvent):
+        (WebCore::RangeInputType::hasTouchEventHandler):
+        * html/RangeInputType.h:
+        (RangeInputType):
+        * html/shadow/SliderThumbElement.h:
+        (SliderThumbElement):
+
+2012-07-10  Pravin D  <pravind.2k4@gmail.com>
+
+        Re-factoring recalcColumn in AutoTableLayout.cpp for readability
+        https://bugs.webkit.org/show_bug.cgi?id=89636
+
+        Reviewed by Julien Chaffraix.
+
+        No test case required. Code re-factoring.
+
+        * rendering/AutoTableLayout.cpp:
+        Added a const integer place holder for 32760.
+
+        (WebCore::AutoTableLayout::recalcColumn):
+         Changes :
+         1) Moved the continue statement above the bool cellHasContent for an early return.
+         2) Replaced the constant 32760 by a placeholder.
+         3) Initialization of columnLayout max and min logical widths is made common for both cells having col span == 1 and span > 1.
+         4) Removed redundant check for cell logical width type. 
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        We've already removed the code that implements Hixie76 WebSockets. This
+        patch just removes the WebCore::Setting that used to control which
+        WebSocket protocol version we'd use.
+
+        I've left the WebKit-layer APIs in place, but they now don't do
+        anything.  I'll remove all the Chromium callers shortly.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (Settings):
+
+2012-07-10  Philip Rogers  <pdr@google.com>
+
+        Crash due to SVG animation element not removed from target (before reset)
+        https://bugs.webkit.org/show_bug.cgi?id=90750
+
+        Reviewed by Abhishek Arya.
+
+        Previously we were not removing an animation element from
+        SVGDocumentExtensions::m_animatedElements which led to a crash.
+        This change properly removes animation elements in resetTargetElement
+        which both fixes this bug and will prevent others from hitting it in
+        the future.
+
+        Test: svg/animations/dynamic-modify-attributename-crash2.svg
+
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::removeAllAnimationElementsFromTarget):
+
+        removeAllAnimationElementsFromTarget now adds all the animation elements
+        to a vector and iterates over it because the changes to resetTargetElement
+        would have caused us to modify the underlying hashset as we iterated. Note that
+        before we deleted animationElementsForTarget in removeAllAnimationElementsFromTarget
+        but that logic is now handled in removeAnimationElementFromTarget which is called
+        during resetTargetElement.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::removedFrom):
+
+        Because of the changes in resetTargetElement, removedFrom was able to be
+        refactored. This patch changes removedFrom to call resetTargetElement rather
+        than have duplicated logic. There is a very small change in logic here:
+        animationAttributeChanged() is now called in removedFrom().
+
+        (WebCore::SVGSMILElement::resetTargetElement):
+
+        resetTargetElement now fully resets the target, including removing it from
+        m_animatedElements. This will prevent future instances of this bug.
+
+2012-07-10  Helder Correia  <helder.correia@nokia.com>
+
+        [Qt] Repaint counter for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=90116
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests, just introducing a debug feature.
+
+        For this feature to be enabled, the environment variable
+        QT_WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS must be set to 1. Once enabled,
+        both repaint counters and tile borders will be painted.
+
+        Important notes:
+        - Only WebKit2 is targetted for now.
+        - There is no integration with Preferences. That aproach was
+        taken initially but revealed complex and overkill for such a
+        debugging-only functionality. Thus, to disable it simply restart with
+        the environment variable unset or set to some other value.
+
+        A Qt-specific drawRepaintCounter() function was added to
+        TextureMapperGL. A QImage is used as scratch buffer to paint borders and
+        counters. It is then uploaded to a BitmapTexture acquired from the pool
+        and finally draw by TextureMapper. The actual compositing happens inside
+        LayerBackingStore::paintToTextureMapper(). Each LayerBackingStoreTile
+        now has a repaint counter which gets incremented in
+        LayerBackingStore::updateTile().
+
+        * platform/graphics/texmap/TextureMapper.h:
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore):
+        (WebCore::TextureMapperGL::drawRepaintCounter):
+        * platform/graphics/texmap/TextureMapperGL.h:
+        * platform/graphics/texmap/TextureMapperImageBuffer.h:
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Replace use of ManagedTexture with CCScopedTexture for impl thread and remove implTextureManager from LayerRendererChromium
+        https://bugs.webkit.org/show_bug.cgi?id=90841
+
+        Reviewed by Adrienne Walker.
+
+        Remove the TextureManager from LayerRendererChromium, which was the last
+        instance of the class in the compositor. Instead of using ManagedTexture
+        objects for RenderPass textures, use instances of CCScopedTexture, which
+        manage the lifetime of the allocated texture ids. TextureManager will be
+        removed entirely once all callers of memoryUseBytes() have been removed.
+
+        No new tests. No change in behaviour.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::releaseRenderPassTextures):
+        (WebCore):
+        (WebCore::LayerRendererChromium::renderPassTextureSize):
+        (WebCore::LayerRendererChromium::renderPassTextureFormat):
+        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
+        (WebCore::LayerRendererChromium::haveCachedResourcesForRenderPassId):
+        (WebCore::LayerRendererChromium::drawQuad):
+        (WebCore::applyFilters):
+        (WebCore::LayerRendererChromium::drawBackgroundFilters):
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        (WebCore::LayerRendererChromium::drawHeadsUpDisplay):
+        (WebCore::LayerRendererChromium::getFramebufferTexture):
+        (WebCore::LayerRendererChromium::isCurrentRenderPass):
+        (WebCore::LayerRendererChromium::useRenderPass):
+        (WebCore::LayerRendererChromium::useScopedTexture):
+        (WebCore::LayerRendererChromium::bindFramebufferToTexture):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore):
+        (LayerRendererChromium):
+        * platform/graphics/chromium/TrackingTextureAllocator.cpp:
+        (WebCore::TrackingTextureAllocator::TrackingTextureAllocator):
+        (WebCore::TrackingTextureAllocator::createTexture):
+        * platform/graphics/chromium/TrackingTextureAllocator.h:
+        (WebCore::TrackingTextureAllocator::create):
+        (TrackingTextureAllocator):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+        (WebCore):
+        (CCHeadsUpDisplay):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (WebCore):
+        (CCRenderer):
+
+2012-07-10  Dean Jackson  <dino@apple.com>
+
+        REGRESSION (r109610): Order of values in shorthand animation makes a difference
+        https://bugs.webkit.org/show_bug.cgi?id=84533
+        <rdar://problem/11831924>
+        <rdar://problem/11815787>
+
+        Reviewed by Simon Fraser.
+
+        A previous revision (r109610) updated the parsing of the animation shorthand
+        to make sure that animation-name wouldn't clobber other styles. The side effect
+        of this was that we'd no longer find animation-name if it wasn't first in the
+        list. This commit reverts the change and fixes it in a different way, by always
+        parsing animation-name as the last property in the shorthand. This means that
+        keywords for timing functions, fill modes and iteration will match before
+        animation name. In other words, if you want an animation called "forwards"
+        you should use the longhand property, because the shorthand will first match
+        that against animation-fill-mode.
+
+        Test: animations/animation-shorthand-name-order.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationShorthand): make a new array of longhand
+        properties to check for, with name as the last entry rather than the first.
+        Use this array to test the properties in the shorthand.
+
+2012-07-10  Huang Dongsung  <luxtella@company100.net>
+
+        Fix a potential bug of BitmapImage::frameCount().
+        https://bugs.webkit.org/show_bug.cgi?id=90756
+
+        Reviewed by Simon Fraser.
+
+        If an ImageDecoder is not yet initialized, m_source.frameCount() returns 0. This
+        does not mean that the frame count is actually 0. So we must set
+        m_haveFrameCount to true only when m_frameCount is not 0.
+
+        The current code is okay because BitmapImage::frameCount() is never called
+        before the decoder is initialized. However, this no longer holds true once we
+        introduce parallel image decoders.
+
+        No new tests, no behavior change.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::frameCount):
+
+2012-07-10  Ojan Vafai  <ojan@chromium.org>
+
+        Build fix. Removing unused variable from http://trac.webkit.org/changeset/122264.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeContentLogicalHeightUsing):
+
+2012-07-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        HTMLPropertiesCollection should share more code with HTMLCollection
+        https://bugs.webkit.org/show_bug.cgi?id=90842
+
+        Reviewed by Anders Carlsson.
+
+        Got rid of HTMLPropertiesCollection::m_cache, and added m_itemRefElements, m_propertyNames, m_propertyCache,
+        m_hasPropertyNameCache, and m_hasItemRefElements to HTMLPropertiesCollection itself. These are caches specific
+        to HTMLPropertiesCollection. Note that hasNameCache has been renamed to m_hasPropertyNameCache and itemRefElementPosition
+        has been replaced by cachedElementsArrayOffset() in HTMLCollectionCacheBase (also used in HTMLFormCollection).
+
+        Also deleted all methods on m_cache except updatePropertyCache since caches can be accessed directly from
+        HTMLPropertiesCollection.
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::invalidateCacheIfNeeded):
+        (WebCore::HTMLCollection::invalidateCache):
+        * html/HTMLCollection.h:
+        (HTMLCollection):
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
+        (WebCore):
+        (WebCore::HTMLPropertiesCollection::updateRefElements):
+        (WebCore::HTMLPropertiesCollection::itemAfter):
+        (WebCore::HTMLPropertiesCollection::calcLength):
+        (WebCore::HTMLPropertiesCollection::cacheFirstItem):
+        (WebCore::HTMLPropertiesCollection::item):
+        (WebCore::HTMLPropertiesCollection::findProperties):
+        (WebCore::HTMLPropertiesCollection::updateNameCache):
+        (WebCore::HTMLPropertiesCollection::names):
+        (WebCore::HTMLPropertiesCollection::namedItem):
+        (WebCore::HTMLPropertiesCollection::hasNamedItem):
+        * html/HTMLPropertiesCollection.h:
+        (HTMLPropertiesCollection):
+        (WebCore::HTMLPropertiesCollection::clearCache):
+        (WebCore::HTMLPropertiesCollection::updatePropertyCache):
+
+2012-07-10  Ojan Vafai  <ojan@chromium.org>
+
+        Add support for min-height:auto and min-width:auto
+        https://bugs.webkit.org/show_bug.cgi?id=88437
+
+        Reviewed by Tony Chang.
+
+        Right now auto does the same thing as min-height/min-width:0.
+        For flex-items it should be the same as min-content (followup patch).
+        http://dev.w3.org/csswg/css3-flexbox/#min-size-auto
+
+        Tests: fast/css/auto-min-size.html
+               fast/css/deprecated-flexbox-auto-min-size.html
+
+        * WebCore.order:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Return 0px for the computed value of auto.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validWidth):
+        (WebCore):
+        (WebCore::CSSParser::validHeight):
+        (WebCore::CSSParser::parseValue):
+        * css/CSSParser.h:
+        (CSSParser):
+        Restructure width/height parsing to reduce code duplication and make it easier
+        to add auto as a valid min value.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::adjustSizeConstraints):
+        This code was unnecessarily checking intrinsicOrAuto since auto was previously
+        not an allowed value for minWidth/minHeight.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
+        (WebCore::RenderBox::sizesLogicalWidthToFitContent):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::computeLogicalHeightUsing):
+        (WebCore::RenderBox::computeContentLogicalHeightUsing):
+        (WebCore::RenderBox::computeReplacedLogicalWidth):
+        (WebCore::RenderBox::computeReplacedLogicalWidthRespectingMinMaxWidth):
+        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
+        (WebCore::RenderBox::computeReplacedLogicalHeight):
+        (WebCore::RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        (WebCore::RenderBox::computePositionedLogicalWidth):
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
+        (WebCore::RenderBox::computePositionedLogicalHeight):
+        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
+        Need to pass a SizeType to all these methods so that we know if the Length
+        we're working with is a min length since auto has a different meaning now
+        for min lengths.
+
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::allowedChildFlex):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::computePreferredLogicalWidths):
+        (WebCore::RenderFlexibleBox::computeAvailableFreeSpace):
+        (WebCore::RenderFlexibleBox::lineBreakLength):
+        (WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computeReplacedLogicalWidth):
+        (WebCore::RenderReplaced::computeReplacedLogicalHeight):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::calcScrollbarThicknessUsing):
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        * rendering/style/RenderStyle.h:
+        Default minHeight/minWidth to auto instead of 0px.
+
+2012-07-10  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Use default font rendering styles in FontPlatformData::querySystemForRenderStyle()
+        https://bugs.webkit.org/show_bug.cgi?id=90826
+
+        Reviewed by Adam Barth.
+
+        No new tests. The change to this file is refactoring only.
+
+        * platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp:
+        (WebCore::FontPlatformData::querySystemForRenderStyle): Moved the "NoPreference" initialization into PlatformSupport::PlatformSupport::getRenderStyleForStrike().
+
+2012-07-10  Raymond Toy  <rtoy@google.com>
+
+        AudioFIFO not correctly wrapping the write index on push
+        https://bugs.webkit.org/show_bug.cgi?id=90901
+
+        Reviewed by Chris Rogers.
+
+        No new tests
+
+        * platform/audio/AudioFIFO.cpp:
+        (WebCore::AudioFIFO::push): Wrap the write index, not read index!
+
+2012-07-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Avoid allocating render pass textures that have no content
+        https://bugs.webkit.org/show_bug.cgi?id=90702
+
+        Reviewed by Adrienne Walker.
+
+        When OOM conditions are hit, textures are not allocated for some layers
+        which can prevent any quads from being present for a render surface.
+        This is used as a signal to prevent the RenderPass from allocating a
+        texture.
+
+        Replace the CCLayerTreeHostImpl::removePassesWithCachedTextures() method
+        with a general removeRenderPasses() which takes a culling control object
+        and will remove passes based on the inputs from the control object.
+
+        This new method is used for the old purpose of removing passes with cached
+        textures, as well as to remove passes that do not have any quad inputs.
+
+        Test: CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::shouldRemoveRenderPass):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::shouldRemoveRenderPass):
+        (WebCore::CCLayerTreeHostImpl::removeRenderPasses):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore):
+        (CullRenderPassesWithCachedTextures):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::renderPassListBegin):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::renderPassListEnd):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::renderPassListNext):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::CullRenderPassesWithCachedTextures):
+        (CCLayerTreeHostImpl):
+        (CullRenderPassesWithNoQuads):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::renderPassListBegin):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::renderPassListEnd):
+        (WebCore::CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::renderPassListNext):
+
+2012-07-10  Joshua Netterfield  <jnetterfield@rim.com>
+        Make GC3D and E3D more maintainable for GLES platforms
+        https://bugs.webkit.org/show_bug.cgi?id=90567
+
+        Reviewed by Rob Buis.
+
+        This patch cleans up code for WebGL on OpenGLES platforms which use 
+        GraphicsContext3DOpenGL* and Extensions3DOpenGL*. Although
+        GraphicsContext3DOpenGL was already split into GraphicsContext3DOpenGL,
+        GraphicsContext3DOpenGLCommon, and  GraphicsContext3DOpenGLES, this patch
+        is an attempt to refactor this code in a way that will help BlackBerry and
+        other teams support WebGL on mobile platforms with as little use of
+        "#IF USE(OPENGL_ES_2)" in common code as possible. Also included is the
+        separation of Extensions3DOpenGL into Extensions3DOpenGLCommon,
+        Extensions3DOpenGL, and Extensions3DOpenGLES as well as the introduction
+        of OpenGLESShims.
+
+        This patch is created in large part by Jonathan Feldstein.
+
+        No new tests: no new behaviour.
+
+        * PlatformBlackBerry.cmake: Recognize BlackBerry as OPENGL ES, add new files to build
+        * Target.pri: Add new Extensions3DOpenGL* to WebGL builds
+        * platform/graphics/GraphicsContext3D.h: Add validateDepthStencil, make systemAllowsMultisamplingOnATICards a a member function.
+        (WebCore):
+        * platform/graphics/OpenGLESShims.h: Added.
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp: Move code to Extensions3DOpenGLCommon where possible
+        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL): Reflect that it is now inherits Extensions3DCommon
+        (WebCore::Extensions3DOpenGL::supportsExtension): Contains OpenGL specific code from supports
+        (WebCore):
+        (WebCore::Extensions3DOpenGL::getExtensions): Returns a list of extensions
+        * platform/graphics/opengl/Extensions3DOpenGL.h: Remove functions now in Extensions3DOpenGLCommon
+        (WebCore):
+        (Extensions3DOpenGL):
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp: Added.
+        (WebCore):
+        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon):
+        (WebCore::Extensions3DOpenGLCommon::~Extensions3DOpenGLCommon):
+        (WebCore::Extensions3DOpenGLCommon::supports):
+        (WebCore::Extensions3DOpenGLCommon::ensureEnabled):
+        (WebCore::Extensions3DOpenGLCommon::isEnabled):
+        (WebCore::Extensions3DOpenGLCommon::getGraphicsResetStatusARB):
+        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE): Existed before, but did nothing. Now does what is says it does.
+        (WebCore::Extensions3DOpenGLCommon::initializeAvailableExtensions): Moved from Extensions3DOpenGL::supports
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
+        (WebCore):
+        (Extensions3DOpenGLCommon):
+        * platform/graphics/opengl/Extensions3DOpenGLES.cpp: Added.
+        (WebCore):
+        (WebCore::Extensions3DOpenGLES::Extensions3DOpenGLES):
+        (WebCore::Extensions3DOpenGLES::~Extensions3DOpenGLES):
+        (WebCore::Extensions3DOpenGLES::framebufferTexture2DMultisampleIMG):
+        (WebCore::Extensions3DOpenGLES::renderbufferStorageMultisampleIMG):
+        (WebCore::Extensions3DOpenGLES::createVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::deleteVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::isVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::bindVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::supportsExtension): Contains OpenGLES specific code from supports
+        (WebCore::Extensions3DOpenGLES::getExtensions):
+        * platform/graphics/opengl/Extensions3DOpenGLES.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
+        (WebCore):
+        (Extensions3DOpenGLES):
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore):
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
+        (WebCore::GraphicsContext3D::getExtensions):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::validateDepthStencil):
+        (WebCore::GraphicsContext3D::clear):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore):
+        (WebCore::GraphicsContext3D::lineWidth):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::polygonOffset):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore):
+        (WebCore::GraphicsContext3D::getExtensions):
+        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+
+2012-07-06  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=90646
+        <rdar://problem/11648478> 3-pass pagination slows down pagination
+
+        Improve the logical top estimate function for margin collapsing to be more accurate. In particular
+        make the basic case of <body><p> or <body><h1> no longer be wrong. This estimate being incorrect
+        is not a big deal most of the time, but when paginating it is a very big deal, since you have to
+        relayout everything whenever your vertical placement is wrong.
+
+        Improving the estimation exposed a bug in an existing layout test. I had to clean up the buggy
+        code written for negative margin-related float detection and fix an invalid layout test to
+        actually be correct.
+
+        Reviewed by Simon Fraser.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::marginBeforeEstimateForChild):
+        (WebCore):
+        (WebCore::RenderBlock::estimateLogicalTopPosition):
+        (WebCore::RenderBlock::marginValuesForChild):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
+
+2012-07-10  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Count inspector memory used to traverse DOM in native memory snapshots.
+        https://bugs.webkit.org/show_bug.cgi?id=90456
+
+        Inspector may take significant amount of memory when traversing DOM structure.
+        Take it into account and report under inspector memory.
+
+        Reviewed by Pavel Feldman.
+
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore::MemoryInstrumentation::calculateContainerSize):
+        (WebCore::MemoryInstrumentation::reportHashMap):
+        (WebCore::MemoryInstrumentation::reportHashSet):
+        (WebCore::MemoryInstrumentation::reportVector):
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::domTreeInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+
+2012-07-10  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [GTK] Fix memory leaks by adopting allocation of GdkPixbuf
+        https://bugs.webkit.org/show_bug.cgi?id=90790
+
+        Reviewed by Carlos Garcia Campos.
+
+        Fixed a memory leak in paintGdkPixbuf by adopting an allocation
+        of GdkPixbuf.
+
+        No new tests. No change in behavior.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintGdkPixbuf):
+
+2012-07-10  Konrad Piascik  <kpiascik@rim.com>
+
+        Web Inspector: Geolocation override
+        https://bugs.webkit.org/show_bug.cgi?id=89365
+
+        Reviewed by Yong Li.
+
+        Added a way to override the geoloation of a client using Web
+        Inspector.
+
+        New tests added.
+        * LayoutTests/inspector/geolocation-success.html:
+        * LayoutTests/inspector/getlocation-error.html:
+
+        * Modules/geolocation/GeolocationController.cpp:
+        (WebCore::GeolocationController::GeolocationController): Now store and
+        save the Page in m_page.
+        (WebCore::GeolocationController::positionChanged): Check if position
+        is overriden in Web Inspector.
+        * Modules/geolocation/GeolocationController.h:
+        (GeolocationController): Add member variable m_page for Page*.
+        * inspector/Inspector.json: Add new methods for setting and clearing
+        the GeoloationPosition and GeolocationError objects in InspectorPageAgent.
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::checkGeolocationPositionOrErrorImpl):
+        Add methods to check whether GeolocationPosition or GeolocationError
+        are set in InspectorPageAgent.
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::checkGeolocationPositionOrError):
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::InspectorPageAgent): Initialize new
+        member variables of GeolocationPosition and GeolocationError.
+        (WebCore::InspectorPageAgent::setGeolocationData): Set Position and
+        Error data and call appropriate GeolocaitonController methods.
+        (WebCore):
+        (WebCore::InspectorPageAgent::clearGeolocationData):
+        (WebCore::InspectorPageAgent::sendGeolocationError):
+        * inspector/InspectorPageAgent.h:
+        (WebCore::InspectorPageAgent::geolocationPosition): Getter for
+        GeolocationPosition.
+        (InspectorPageAgent):
+        * inspector/front-end/Settings.js: Added new settings for
+        GeolocationPosition and GeolocationError
+        * inspector/front-end/SettingsScreen.js: Added new control for
+        Geolocaiton.
+        (WebInspector.UserAgentSettingsTab):
+        (WebInspector.UserAgentSettingsTab.prototype._createDeviceMetricsElement):
+        (WebInspector.UserAgentSettingsTab.prototype._onGeolocationOverrideCheckboxClicked):
+        (WebInspector.UserAgentSettingsTab.prototype._applyGeolocationUserInput):
+        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition.set if):
+        (WebInspector.UserAgentSettingsTab.prototype._setGeolocationPosition):
+        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement.createInput):
+        (WebInspector.UserAgentSettingsTab.prototype._createGeolocationOverrideElement):
+        * inspector/front-end/UserAgentSupport.js: New GeolocationPosition
+        Object added along with setting helper methods.  Added new setting
+        changed handlers for Position and Error.
+        (WebInspector.UserAgentSupport.GeolocationPosition):
+        (WebInspector.UserAgentSupport.GeolocationPosition.prototype.toSetting):
+        (WebInspector.UserAgentSupport.GeolocationPosition.parseSetting):
+        (WebInspector.UserAgentSupport.GeolocationPosition.parseUserInput):
+        (WebInspector.UserAgentSupport.prototype.get _onGeolocationErrorChanged):
+
+2012-07-10  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Refactor resource revisions before moving to UISourceCode.
+        https://bugs.webkit.org/show_bug.cgi?id=90855
+
+        Reviewed by Pavel Feldman.
+
+        Revisions are now persisted based on mainFrame.loaderId, not resource.loaderId which makes filtering out stale persisted revisions easier.
+        Restoring revisions from local storage is separated from filtering out stale persisted revisions.
+        Resource._clearRevisionHistory and Resource._restoreRevisions are not static anymore.
+        Renamed localStorage field for persisting revisions: "resource-history" -> "revision-history"
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.addRevision):
+        (WebInspector.Resource.prototype._restoreRevisionHistory):
+        (WebInspector.Resource.prototype._clearRevisionHistory):
+        (WebInspector.Resource.prototype.revertAndClearHistory.clearHistory):
+        (WebInspector.Resource.prototype.revertAndClearHistory):
+        (WebInspector.Revision):
+        (WebInspector.Revision._revisionHistoryRegistry):
+        (WebInspector.Revision._ensureStaleRevisionsFileteredOut.persist):
+        (WebInspector.Revision._ensureStaleRevisionsFileteredOut):
+        (WebInspector.Revision.prototype._persist):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype._processCachedResources):
+        (WebInspector.ResourceTreeModel.prototype._addFramesRecursively):
+        * inspector/front-end/RevisionHistoryView.js:
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype._revisionAdded):
+
+2012-07-10  Alice Cheng  <alice_cheng@apple.com>
+
+        Editing: Reproducible crasher when pasting a 0x0 image into Mail
+        https://bugs.webkit.org/show_bug.cgi?id=90640
+        <rdar://problem/11141920>
+
+        Reviewed by Brady Eidson.
+
+        0x0 images don't get a resource representation in the WebArchive, so we need a null check
+
+        Test: TestWebKitAPI/Tests/mac/0.png
+              TestWebKitAPI/Tests/mac/WebViewCanPasteZeroPng.mm
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::documentFragmentWithImageResource):
+
+2012-07-10  Nikita Vasilyev  <me@elv1s.ru>
+
+        Web Inspector: Make the Tab character 4 spaces width
+        https://bugs.webkit.org/show_bug.cgi?id=90172
+
+        Reviewed by Pavel Feldman.
+
+        Do it to match most code editors' behavior.
+
+        * inspector/front-end/inspectorCommon.css:
+        (body):
+
+2012-07-10  Eric Seidel  <eric@webkit.org>
+
+        REGRESSION (r122168): Layout Test http/tests/misc/script-defer.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=90845
+
+        Reviewed by Alexey Proskuryakov.
+
+        I was a bit overzealous in removing bool returns. This one still makes sense.
+        This just reverts the wrong part of my previous change.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd):
+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::executeScriptsWaitingForParsing):
+        * html/parser/HTMLScriptRunner.h:
+        (HTMLScriptRunner):
+
+2012-07-10  Kevin Ellis  <kevers@chromium.org>
+
+        Input type=range issue with events not being raised when value set in js
+        https://bugs.webkit.org/show_bug.cgi?id=84674
+
+        Fix dispatching of change and click events for the input slider.
+        Prior to the fix, change events were not fired if the new value
+        matched the value at last change notification based on expected
+        behavior for text fields.  Clicks were not fired if the thumb
+        element was repositioned under the cursor on mouse down.
+
+        Reviewed by Kent Tamura.
+
+        Tests: fast/events/click-range-slider.html
+               fast/events/onchange-range-slider.html
+
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::setPositionFromPoint):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+
+2012-07-10  Huang Dongsung  <luxtella@company100.net>
+
+        Don't destroy the decoded data of an image if WebKit is about to render the image.
+        https://bugs.webkit.org/show_bug.cgi?id=90721
+
+        Reviewed by Antti Koivisto.
+
+        When the cache capacity of the MemoryCache is exceeded, the decoded data of all
+        the CachedImages are destroyed. Even the images inside the viewport are
+        destroyed.  However, if the images need to be rendered again due to scoll events
+        or animation, they must be decoded again. As an extreme case, if there is an
+        animation with an image when MemoryCache is almost full, the image must be
+        decoded every frame. This slows down animation and needlessly consumes CPU
+        cycles.
+
+        Therefore, it is better to not destory the decoded data of an image if the image
+        is inside the viewport because there is high chance that the image needs to be
+        rendered again soon. This patch reduces the unnecessary repetition of image decoding
+        on low memory, and also relieves the memory fragmentation because it avoids reallocation
+        of image frames.
+
+        In addition, there is another positive side effect. Currently,
+        CachedImageClient::willRenderImage() is used only to determine if GIF animation needs
+        to be paused or not in CachedImage::shouldPauseAnimation(). This patch makes
+        GIF animation outside the viewort be paused.
+
+        This is also a prerequisite for parallel image decoders. Because parallel image
+        decoders decode an image asynchronously, clients cannot render the image at the time
+        when the request is made. Clients can draw the image later after receiving image
+        decoding complete notification. However, there is a problem because MemoryCache can
+        destroy the decoded data before clients actually render the image. So parallel image decoders
+        must prevent the decoded data from being destroyed if the image will be rendered
+        soon.
+
+        This patch may consume a little more memory, but furtunately the peak memory usage
+        is almost the same.
+
+        No new tests - no new testable functionality.
+
+        * loader/cache/CachedImage.cpp:
+        (WebCore::CachedImage::likelyToBeUsedSoon):
+        (WebCore):
+        (WebCore::CachedImage::shouldPauseAnimation):
+        * loader/cache/CachedImage.h:
+        (CachedImage):
+        * loader/cache/CachedResource.h:
+        (CachedResource):
+        (WebCore::CachedResource::likelyToBeUsedSoon):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::pruneLiveResourcesToSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willRenderImage):
+
+2012-07-10  Kent Tamura  <tkent@chromium.org>
+
+        RTL calendar picker for <input type=date> is too narrow and clipped
+        https://bugs.webkit.org/show_bug.cgi?id=90864
+
+        Reviewed by Kentaro Hara.
+
+        Tests: ManualTests/forms/calendar-picker.html
+
+        * Resources/calendarPicker.js:
+        (fixWindowSize):
+        Checks the left edge of elemenets in RTL.
+        (layout): Add dir=ltr for the manual test, which re-uses the document.
+
+2012-07-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122178.
+        http://trac.webkit.org/changeset/122178
+        https://bugs.webkit.org/show_bug.cgi?id=90857
+
+        browser tests, PrerenderBrowserTest.PrerenderFavicon and other
+        tests, started to fail (Requested by hayato on #webkit).
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::iconURLs):
+        (WebCore::Document::addIconURL):
+        (WebCore::Document::setUseSecureKeyboardEntryWhenActive):
+        * dom/Document.h:
+        (Document):
+        * html/HTMLLinkElement.cpp:
+        * html/HTMLLinkElement.h:
+        (HTMLLinkElement):
+        * testing/Internals.cpp:
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        LayoutTestController.dumpConfigurationForViewport should move to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=45652
+
+        Reviewed by Eric Seidel.
+
+        This patch replaces LayoutTestController.dumpConfigurationForViewport
+        with Internals.configurationForViewport. The old
+        dumpConfigurationForViewport function just ended up calling WebCore
+        functions anyway, so there's no benefit in implementing the API in the
+        LayoutTestController.
+
+        As a result, these tests can now run on every port.
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::configurationForViewport):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-07-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix GTK+ build after r122175.
+
+        * platform/graphics/texmap/TextureMapperLayer.cpp: Include
+        CString.h when using cairo.
+
+2012-07-10  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium-Mac] Form related layout tests cause timeout
+        https://bugs.webkit.org/show_bug.cgi?id=90851
+
+        Reviewed by Kent Tamura.
+
+        This patch changed to pass a valid argument to LocaleMac
+        constructor.
+
+        No new tests. No more timeout in tests listed in the bug.
+
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::LocaleMac::currentLocale): Changed to pass local identifier string
+        instead of NSLocale object.
+
+2012-07-10  Yuta Kitamura  <yutak@chromium.org>
+
+        WebSocket: Remove hixie76 protocol implementation
+        https://bugs.webkit.org/show_bug.cgi?id=88620
+
+        Reviewed by Adam Barth.
+
+        This change removes code that implements the old hixie-76 WebSocket protocol which
+        isn't used anymore.
+
+        No new tests are added, because the code using the current protocol should not be
+        affected. Tests for hixie-76 protocol are skipped (these tests will be removed
+        eventually).
+
+        * Modules/websockets/ThreadableWebSocketChannel.h:
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::didCreateWebSocketChannel):
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::WebSocket):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::protocol):
+        (WebCore::WebSocket::extensions):
+        (WebCore::WebSocket::binaryType):
+        (WebCore::WebSocket::setBinaryType):
+        (WebCore::WebSocket::didReceiveMessageError):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::getFramingOverhead):
+        * Modules/websockets/WebSocket.h:
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::WebSocketChannel):
+        (WebCore::WebSocketChannel::connect):
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::fail):
+        (WebCore::WebSocketChannel::didCloseSocketStream):
+        (WebCore::WebSocketChannel::processBuffer):
+        (WebCore::WebSocketChannel::startClosingHandshake):
+        (WebCore::WebSocketChannel::enqueueTextFrame):
+        (WebCore::WebSocketChannel::enqueueRawFrame):
+        (WebCore::WebSocketChannel::enqueueBlobFrame):
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
+        (WebCore::WebSocketChannel::abortOutgoingFrameQueue):
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        * Modules/websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::WebSocketHandshake):
+        (WebCore::WebSocketHandshake::clientHandshakeMessage):
+        (WebCore::WebSocketHandshake::clientHandshakeRequest):
+        (WebCore::WebSocketHandshake::readServerHandshake):
+        (WebCore::WebSocketHandshake::checkResponseHeaders):
+        * Modules/websockets/WebSocketHandshake.h:
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask::create):
+        (WebCore::WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask::WorkerContextDidInitializeTask):
+        (WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel):
+        (Peer):
+        (Bridge):
+
+2012-07-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Threadsafety issues in WebScriptObject
+        https://bugs.webkit.org/show_bug.cgi?id=90849
+
+        Reviewed by Filip Pizlo.
+
+        WebScriptObject maintains a NSMap of wrapper objects. A race condition exists
+        between a wrapper being retrieved from the map, and being released - if the
+        final release on an object is called between a call to getJSWrapper and the
+        subsequent retain, we may end up with a stale object reference.
+
+        We can make this safe by hoisting the removal from the map from delloc up into
+        release (if the retainCount is 1), and locking release against retrieval from
+        the map. Since release may be called from another thread, and NSMap is not
+        threadsafe, we'd better lock around all access to the map (this fix already
+        necessitates get & remove to be locked, so this just adds 'add', too).
+
+        * bindings/objc/WebScriptObject.mm:
+        (WebCore::createJSWrapper):
+            - lock around getJSWrapper, retain.
+        (-[WebScriptObject _setImp:originRootObject:rootObject:]):
+            - lock around addJSWrapper.
+        (-[WebScriptObject release]):
+            - Added; removeJSWrapper for last release, lock & synchronized vs. getJSWrapper.
+        (-[WebScriptObject dealloc]):
+            - removeJSWrapper call hoisted into release.
+
+2012-07-09  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Battery status code needs refactoring to be reused in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=90760
+
+        Reviewed by Hajime Morita.
+
+        Rename BatteryClientEfl to BatteryProviderEfl and remove dependency
+        on BatteryController by introducing the BatteryProviderEflClient
+        interface. This will allow reusing the BatteryProviderEfl class
+        in WebKit2.
+
+        No new tests. Already tested by batterystatus/*.
+
+        * PlatformEfl.cmake:
+        * platform/efl/BatteryProviderEfl.cpp: Renamed from Source/WebCore/platform/efl/BatteryClientEfl.cpp.
+        (WebCore):
+        (WebCore::BatteryProviderEfl::BatteryProviderEfl):
+        (WebCore::BatteryProviderEfl::batteryStatus):
+        (WebCore::BatteryProviderEfl::startUpdating):
+        (WebCore::BatteryProviderEfl::stopUpdating):
+        (WebCore::BatteryProviderEfl::setBatteryStatus):
+        (WebCore::BatteryProviderEfl::timerFired):
+        (WebCore::BatteryProviderEfl::getBatteryStatus):
+        (WebCore::BatteryProviderEfl::setBatteryClient):
+        * platform/efl/BatteryProviderEfl.h: Copied from Source/WebCore/platform/efl/BatteryClientEfl.h.
+        (WebCore):
+        (BatteryProviderEfl):
+        (WebCore::BatteryProviderEfl::~BatteryProviderEfl):
+        * platform/efl/BatteryProviderEflClient.h: Added.
+        (WebCore):
+        (BatteryProviderEflClient):
+
+2012-07-09  Hayato Ito  <hayato@chromium.org>
+
+        Unreviewed gardening.
+        Fix a wrong fix of r122194.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        This adds the ENABLE_DIALOG_ELEMENT feature flag and dummy implementation files for <dialog>. In addition, a runtime feature flag is added.
+        The feature is diabled by default.
+
+        No new tests, as there is no behavior change.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h: Added a runtime feature flag for dialog.
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::dialogElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::setDialogElementEnabled):
+        * dom/ContextFeatures.cpp:
+        (WebCore::ContextFeatures::dialogElementEnabled):
+        (WebCore):
+        * dom/ContextFeatures.h: Added a per-context flag for dialog so that dialog can be disabled in HTMLTagNames.in and DOMWindow.idl when the dialog runtime feature flag is off.
+        * html/HTMLDialogElement.cpp: Added.
+        (WebCore):
+        (WebCore::HTMLDialogElement::HTMLDialogElement):
+        (WebCore::HTMLDialogElement::create):
+        (WebCore::HTMLDialogElement::close):
+        (WebCore::HTMLDialogElement::show):
+        * html/HTMLDialogElement.h: Added.
+        (WebCore):
+        (HTMLDialogElement):
+        * html/HTMLDialogElement.idl: Added.
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+
+2012-07-09  Hayato Ito  <hayato@chromium.org>
+
+        Unreviewed gardening.
+        Remove an assertion starting to fail on interactive_ui_tests on Chromium OS.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
+
+2012-07-09  Hayato Ito  <hayato@chromium.org>
+
+        Unreviewed gardening.
+        Build fix after r122175
+
+        * WebCore.gypi: Remove Source/WebCore/platform/graphics/qt/Extensions3DQt.{cpp,h}
+
+2012-07-09  Kiran Muppala  <cmuppala@apple.com>
+
+        Improve performance of RenderInline::absoluteQuads for deeply nested inlines.
+        https://bugs.webkit.org/show_bug.cgi?id=90715
+
+        Reviewed by Maciej Stachowiak.
+
+        No new tests: functionality unchanged.
+
+        * rendering/RenderInline.cpp: Cache transformation from local to absolute coordinates using a
+        RenderGeometryMap and use it for subsequent mappings.
+        (WebCore::(anonymous namespace)::AbsoluteQuadsGeneratorContext::AbsoluteQuadsGeneratorContext):
+        (WebCore::(anonymous namespace)::AbsoluteQuadsGeneratorContext::operator()):
+
+2012-07-09  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium-Mac] Implement functions for localized time format information
+        https://bugs.webkit.org/show_bug.cgi?id=90237
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces following localized time format related
+        functions:
+          - localizeTimeFormatText()
+          - localizeShortTimeFormatText()
+          - timeAMPMLabels
+        for Mac OSX in feature flag: ENABLE_INPUT_TYPE_TIME_MULTIPLE_FIELDS.
+
+        These function will be used by input type "time" with multiple input
+        fields UI.
+
+        Note: ICU version of localized time format functions are implemented
+        in https://bugs.webkit.org/show_bug.cgi?id=89965
+
+        Tests: WebKit/chromium/tests/LocaleMacTest.cpp
+
+        * platform/text/mac/LocaleMac.h:
+        (LocaleMac): Added time format related functions and variables.
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::createDateTimeFormatter): Added. A helper function for creating date time formatter.
+        (WebCore::LocaleMac::createShortDateFormatter): Changed to use createDateTimeFormatter.
+        (WebCore::LocaleMac::createTimeFormatter): Added.
+        (WebCore::LocaleMac::createShortTimeFormatter): Added.
+        (WebCore::LocaleMac::timeFormatText): Added.
+        (WebCore::LocaleMac::shortTimeFormatText): Added.
+        (WebCore::LocaleMac::timeAMPMLabels): Added.
+
+2012-07-09  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Shaders] The FECustomFilter is not making the GL context active
+        https://bugs.webkit.org/show_bug.cgi?id=90840
+
+        Reviewed by Dean Jackson.
+
+        I've added a couple of makeContextCurrent() in the FECustomFilter related classes.
+        Also, removed the assumption that GraphicsContext3D::create() never returns 0.
+
+        No new tests, this was crashing on existing tests.
+
+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
+        (WebCore::CustomFilterCompiledProgram::CustomFilterCompiledProgram):
+        (WebCore::CustomFilterCompiledProgram::~CustomFilterCompiledProgram):
+        * platform/graphics/filters/CustomFilterGlobalContext.cpp:
+        (WebCore::CustomFilterGlobalContext::prepareContextIfNeeded):
+        * platform/graphics/filters/CustomFilterMesh.cpp:
+        (WebCore::CustomFilterMesh::CustomFilterMesh):
+        (WebCore::CustomFilterMesh::~CustomFilterMesh):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::deleteRenderBuffers):
+        (WebCore::FECustomFilter::platformApplySoftware):
+        (WebCore::FECustomFilter::initializeContext):
+        * platform/graphics/filters/FECustomFilter.h:
+        (FECustomFilter):
+
+2012-07-09  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r114862-r114886): Fix a crash by switching the input type to hidden.
+        https://bugs.webkit.org/show_bug.cgi?id=90774
+
+        Reviewed by Andreas Kling.
+
+        Test: fast/forms/hidden/change-type-to-hidden-after-updating-value.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeInternal):
+        Pass a copy of the existing Attribute object.
+
+2012-07-07  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] cache video dimensions
+        https://bugs.webkit.org/show_bug.cgi?id=90733
+
+        Reviewed by Martin Robinson.
+
+        Invalidate the cached video dimensions whenever the video-sink sink pad caps
+        change and let ::naturalSize() lazily recalculate them.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
+        (WebCore::MediaPlayerPrivateGStreamer::notifyPlayerOfVideo):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+
+2012-07-09  Eric Penner  <epenner@google.com>
+
+        [chromium] Merge updates and idle updates into one pass
+        https://bugs.webkit.org/show_bug.cgi?id=90324
+
+        Reviewed by Adrienne Walker.
+
+        We no longer need to do painting is passes in order
+        to allocate memory in the right order. So this merges
+        updates and idle updates into one pass.
+
+        Covered by existing unit tests (some of which are
+        updated with this patch).
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::needMoreUpdates):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (ContentLayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::needMoreUpdates):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateTiles):
+        (WebCore::TiledLayerChromium::updateLayerRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::compositeAndReadback):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::paintMasksForRenderSurface):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+
+2012-07-09  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Introduce LocaleMac class
+        https://bugs.webkit.org/show_bug.cgi?id=90248
+
+        Reviewed by Kent Tamura.
+
+        This patch moves implementation of localized date format related
+        functions into LocaleMac class as of LocaleWin class for ease of
+        maintain and using specific locale in testing rather than system
+        default locale.
+
+        Tests: WebKit/chromium/tests/LocaleMacTest.cpp
+
+        * WebCore.gyp/WebCore.gyp: Include LocaleMac.mm
+        * WebCore.gypi:
+        * platform/text/mac/LocaleMac.h: Replace LocaleWin to LocaleMac.
+        * platform/text/mac/LocaleMac.mm:
+        (WebCore::LocaleMac::LocaleMac):
+        (WebCore::LocaleMac::~LocaleMac):
+        (WebCore::LocaleMac::create):
+        (WebCore::LocaleMac::currentLocale):
+        (WebCore::LocaleMac::createShortDateFormatter):
+        (WebCore::LocaleMac::parseDate):
+        (WebCore::LocaleMac::formatDate):
+        (WebCore::LocaleMac::dateFormatText):
+        (WebCore::LocaleMac::monthLabels):
+        (WebCore::LocaleMac::weekDayShortLabels):
+        (WebCore::LocaleMac::firstDayOfWeek):
+        * platform/text/mac/LocalizedDateMac.cpp:
+        (WebCore::parseLocalizedDate):
+        (WebCore::formatLocalizedDate):
+        (WebCore::localizedDateFormatText):
+        (WebCore::monthLabels):
+        (WebCore::weekDayShortLabels):
+        (WebCore::firstDayOfWeek):
+        * platform/text/mac/LocalizedDateMac.mm: Removed.
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Create CCScopedTexture class for creating/freeing textures
+        https://bugs.webkit.org/show_bug.cgi?id=89485
+
+        Reviewed by Adrienne Walker.
+
+        This class provides a standard way to create texture ids in a way that
+        ensures they will be freed later.
+
+        Also includes a CCTexture base class that holds textureId, size, and
+        format together in a struct that can be used in place of storing an
+        unsigned textureId in other classes.
+
+        Unit tests: CCScopedTexureTest.NewScopedTexture
+                    CCScopedTexureTest.CreateScopedTexture
+                    CCScopedTexureTest.ScopedTextureIsDeleted
+                    CCScopedTexureTest.LoseScopedTexture
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCScopedTexture.cpp: Added.
+        (WebCore):
+        (WebCore::CCScopedTexture::CCScopedTexture):
+        (WebCore::CCScopedTexture::~CCScopedTexture):
+        (WebCore::CCScopedTexture::allocate):
+        (WebCore::CCScopedTexture::free):
+        (WebCore::CCScopedTexture::leak):
+        * platform/graphics/chromium/cc/CCScopedTexture.h: Added.
+        (WebCore):
+        (CCScopedTexture):
+        (WebCore::CCScopedTexture::create):
+        * platform/graphics/chromium/cc/CCTexture.cpp: Added.
+        (WebCore):
+        (WebCore::CCTexture::setDimensions):
+        (WebCore::CCTexture::bytes):
+        (WebCore::CCTexture::memorySizeBytes):
+        * platform/graphics/chromium/cc/CCTexture.h: Added.
+        (WebCore):
+        (CCTexture):
+        (WebCore::CCTexture::CCTexture):
+        (WebCore::CCTexture::id):
+        (WebCore::CCTexture::size):
+        (WebCore::CCTexture::format):
+        (WebCore::CCTexture::setId):
+
+2012-07-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: deleteDatabase fails if transaction running in other database
+        https://bugs.webkit.org/show_bug.cgi?id=90822
+
+        Reviewed by Tony Chang.
+
+        The IDBLevelDBBackingStore was preventing a deleteDatabase() from running
+        if any other database was running a transaction. Fix by just creating a scratch
+        LevelDBTransaction for the delete steps.
+
+        Test: storage/indexeddb/deletedatabase-transaction.html
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::deleteDatabase): Use a LevelDBTransaction
+        directly.
+
+2012-07-09  Pete Williamson  <petewil@google.com>
+
+        Changed the behavior of iconURLs to always recalculate the list.
+        https://bugs.webkit.org/show_bug.cgi?id=88665
+
+        Reviewed by Kent Tamura..
+
+        As it turns out, it can contain stale URLs in the case that some script
+        manipulates the DOM, which breaks scripts trying to reset the favicon
+        URL. Also added a method in Internals to allow tests to get the list of
+        icon
+
+        Tests: fast/dom/icon-url-change.html
+               fast/dom/icon-url-list.html
+
+        * WebCore.exp.in: export Document::iconURLs on the mac for the Internals class
+        * dom/Document.cpp:
+        (WebCore::Document::iconURLs): Changed the method to recalculate the iconURL list every time
+        (WebCore::Document::addIconURL): we no longer need to add to the internal list since we recalculate it
+        (WebCore::Document::setUseSecureKeyboardEntryWhenActive): removed extra whitespace
+        * dom/Document.h:
+        (Document): removed the addIconURL method which is no longer used
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::iconType): exposed the icon type with an accessor
+        (WebCore):
+        (WebCore::HTMLLinkElement::iconSizes): exposed the icon sizes with an accessor
+        * html/HTMLLinkElement.h:
+        (HTMLLinkElement): declared the icon type and size accessors
+        * testing/Internals.cpp:
+        (WebCore::Internals::iconURLs): made a method to be used by unit tests for inspecting the icon URL list
+        (WebCore):
+        * testing/Internals.h:
+        (Internals): declared the method for unit testing the icon URL list
+        * testing/Internals.idl: exported the Document::iconURLs function
+
+2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Gcc build fix after r122174.
+
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::decrementAccessCount):
+
+2012-07-09  Alice Cheng  <alice_cheng@apple.com>
+
+        Editing: Autocorrection in blockquotes causes text to break out of quote
+        https://bugs.webkit.org/show_bug.cgi?id=90487
+        <rdar://problem/11769020> 
+
+        Reviewed by Enrica Casucci.
+
+        Test: platform/mac/editing/spelling/autocorrection-blockquote-crash.html
+
+        SpellingCorrectionCommand uses ReplaceSelectionCommand to replace the misspelled word with the auto-corrected word. Specifically, ReplaceSelectionCommand does a smart copy, where it breaks out of blockquotes. Thus, the fix is to substitute ReplaceSelectionCommand with InserTextCommand.
+
+        * editing/SpellingCorrectionCommand.cpp:
+        (WebCore::SpellingCorrectionCommand::doApply):
+
+2012-07-09  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Shared code that is guarded with ENABLE(WEBGL) should be guarded with USE()
+        https://bugs.webkit.org/show_bug.cgi?id=90506
+
+        Reviewed by Martin Robinson.
+
+        GraphicsContext3D, ANGLEWebKitBridge and Extensions3D are now guarded with USE(3D_GRAPHICS)
+        instead of ENABLE(WEBGL).
+
+        No new tests, build changes only.
+
+        * Target.pri:
+            Removed references to unused files.
+
+        * WebCore.pri:
+            Updated the Qt build so that the basic 3D-graphics sources can be compiled even when
+            WebGL is disabled.
+
+        * platform/graphics/ANGLEWebKitBridge.cpp:
+        * platform/graphics/GraphicsContext3D.cpp:
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        * platform/qt/QWebPageClient.h:
+        * platform/graphics/OpenGLShims.cpp:
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp:
+        * platform/graphics/cairo/DrawingBufferCairo.cpp:
+        * platform/graphics/cairo/GLContext.h:
+        (GLContext):
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        * platform/graphics/cairo/GraphicsContext3DPrivate.cpp:
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        * platform/graphics/clutter/DrawingBufferClutter.cpp:
+        * platform/graphics/clutter/GraphicsContext3DClutter.cpp:
+        * platform/graphics/clutter/GraphicsContext3DPrivate.cpp:
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        * platform/graphics/filters/CustomFilterCompiledProgram.cpp:
+        * platform/graphics/filters/CustomFilterCompiledProgram.h:
+        * platform/graphics/filters/CustomFilterGlobalContext.cpp:
+        * platform/graphics/filters/CustomFilterGlobalContext.h:
+        * platform/graphics/filters/CustomFilterMesh.cpp:
+        * platform/graphics/filters/CustomFilterMesh.h:
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        (WebCore):
+        * platform/graphics/filters/CustomFilterProgram.h:
+        * platform/graphics/filters/FECustomFilter.cpp:
+        * platform/graphics/filters/FECustomFilter.h:
+        * platform/graphics/glx/GLContextGLX.cpp:
+        (WebCore):
+        * platform/graphics/glx/GLContextGLX.h:
+        (GLContextGLX):
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        * platform/graphics/gpu/mac/DrawingBufferMac.mm:
+        * platform/graphics/gpu/qt/DrawingBufferQt.cpp:
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        * platform/graphics/qt/Extensions3DQt.cpp: Removed.
+        * platform/graphics/qt/Extensions3DQt.h: Removed.
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+            Chaned ENABLE(WEBGL) to USE(3D_GRAPHICS)
+
+2012-07-09  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Consider closing unused localStorage database after a timeout.
+        https://bugs.webkit.org/show_bug.cgi?id=90713
+
+        For a localStorage, if there is no active document referencing to it for certain amount of time (300 seconds),
+        we can close the underlying sqlite database.
+
+        Reviewed by Brady Eidson.
+
+        Test: storage/domstorage/storage-close-database-on-idle.html
+
+        * storage/Storage.cpp:
+        (WebCore::Storage::Storage): increment storageArea access count when a DOMWindow is referencing it.
+        (WebCore::Storage::~Storage): decrement storageArea access count when DOMWindow is done with it.
+        * storage/StorageArea.h:
+        (StorageArea):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::incrementAccessCount):
+        (WebCore):
+        (WebCore::StorageAreaImpl::decrementAccessCount): schedule closeDatabaseTimer if there is no active document
+            referencing to this storageArea.
+        (WebCore::StorageAreaImpl::closeDatabaseTimerFired): close the underlying sqlite database.
+        * storage/StorageAreaImpl.h:
+        (StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::sync): if m_syncCloseDatabase flag is set and the database is not opened, bail out.
+        * storage/StorageTracker.cpp:
+        (WebCore):
+        (WebCore::StorageTracker::StorageTracker):
+        * storage/StorageTracker.h:
+        (WebCore::StorageTracker::storageDatabaseIdleInterval):
+        (WebCore::StorageTracker::setStorageDatabaseIdleInterval):  set the timeout value that we will wait before closing the
+            database.  This is currently used by DumpRenderTree only.
+        (StorageTracker):
+
+2012-07-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: A null or undefined storeNames argument to IDBDatabase::transaction() should be coerced to string
+        https://bugs.webkit.org/show_bug.cgi?id=90474
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/transaction-basics.html
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::transaction):
+        * Modules/indexeddb/IDBDatabase.idl:
+
+2012-07-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove obsolete accessor plumbing
+        https://bugs.webkit.org/show_bug.cgi?id=90812
+
+        Reviewed by Tony Chang.
+
+        No new tests - just deleting code.
+
+        * Modules/indexeddb/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::IDBTransaction): Since backend mode() is disconnected, can no
+        longer assert that front-end/back-end modes match; not worth it to keeping the plumbing.
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove HashMap workaround for layers with id=0 in CCDamageTracker
+        https://bugs.webkit.org/show_bug.cgi?id=90825
+
+        Reviewed by Adrienne Walker.
+
+        Layer ids are no longer allowed to be 0, and the behaviour is guarded
+        with asserts, so this workaround is not needed any longer.
+
+        * platform/graphics/chromium/cc/CCDamageTracker.h:
+        (CCDamageTracker):
+
+2012-07-09  Vincent Scheib  <scheib@chromium.org>
+
+        Pointer Lock requestPointerLock rejects locking an element not in a document.
+        https://bugs.webkit.org/show_bug.cgi?id=90821
+
+        Reviewed by Adrienne Walker.
+
+        Test: pointer-lock/lock-element-not-in-dom.html
+
+        * page/PointerLockController.cpp:
+        (WebCore::PointerLockController::requestPointerLock):
+
+2012-07-09  Eric Seidel  <eric@webkit.org>
+
+        document.write of scripts that also document.write sometimes writes async
+        https://bugs.webkit.org/show_bug.cgi?id=89102
+
+        Reviewed by Adam Barth.
+
+        When a script tag is first encountered, the TreeBuilder holds the element and returns
+        out to the outer HTMLDocumentParser parse loop.  The HTMLDocumentParser then takes
+        the script element and passes it to the HTMLScriptRunner for execution. However, if the
+        script is an "external script" the HTMLScriptRunner may have to wait for that parser
+        blocking script to load, and may store the script in its own m_parserBlockingScript member.
+
+        While the HTMLScriptRunner has this not-yet-loaded-script the parser is also blocked.
+        Because the "paused" state of the parser was held as a separate bool on the TreeBuilder
+        we'd have to be careful to update it to reflect the current state of this pending script
+        on the HTMLScriptRunner.
+
+        This patch removes this separate "paused" bool and makes the HTMLDocumentParser responsible
+        for the "paused" state of the parser through the isWaitingForScripts() function which
+        knows how to check both the TreeBuilder and the ScriptRunner for possible parser-blocking scripts.
+
+        I suspect this change may actually fix a bunch of edge cases where we were not
+        checking for the HTMLScriptRunner's parser blocking script and thus incorrectly ending
+        the parser, or not starting the pre-load scanner, etc.
+
+        As part of this change I also renamed m_haveParsingBlockingScript in HTMLScriptRunner to match
+        the naming style used elsewhere in the parser, as well as removed all the "bool" return values
+        for these parse/execute functions as they are no longer useful (or correct). The correct way
+        is always to check HTMLDocumentParser::isWaitingForScripts().
+
+        Test: fast/parser/cached-script-document-write.html
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizerIfPossible):
+        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder):
+        (WebCore::HTMLDocumentParser::canTakeNextToken):
+        (WebCore::HTMLDocumentParser::isWaitingForScripts):
+        (WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution):
+        (WebCore::HTMLDocumentParser::notifyFinished):
+        (WebCore::HTMLDocumentParser::executeScriptsWaitingForStylesheets):
+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::~HTMLScriptRunner):
+        (WebCore::HTMLScriptRunner::executeParsingBlockingScript):
+        (WebCore::HTMLScriptRunner::execute):
+        (WebCore::HTMLScriptRunner::hasParserBlockingScript):
+        (WebCore::HTMLScriptRunner::executeParsingBlockingScripts):
+        (WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad):
+        (WebCore::HTMLScriptRunner::executeScriptsWaitingForParsing):
+        (WebCore::HTMLScriptRunner::requestParsingBlockingScript):
+        (WebCore::HTMLScriptRunner::runScript):
+        * html/parser/HTMLScriptRunner.h:
+        (HTMLScriptRunner):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::takeScriptToProcess):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processTokenInForeignContent):
+        * html/parser/HTMLTreeBuilder.h:
+        (HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::hasParserBlockingScript):
+
+2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Microdata tests are flaky
+        https://bugs.webkit.org/show_bug.cgi?id=90830
+
+        Reviewed by Antti Koivisto.
+
+        The bug was caused by SpaceSplitString's not copying on write properly.
+        Even if there was exactly one owner of the SpaceSplitString, we should still not modify
+        m_data since m_data is associated with a particular m_keyString in sharedDataMap().
+
+        The only situation in which we can safely modify m_data is when m_data's m_keyString is null
+        meaning that it had been unique'ed. Furthermore, this optimization had not been used for
+        class lists because class list's refCount is always zero as its ref and deref are forwarded
+        to the associated Element's ref and deref. This fix re-enables the optimization for class lists.
+
+        This behavior change is tested by existing microdata API tests. Without this patch,
+        some tests such as properties-collection-add-remove-property.html fail on the first run
+        when several tests were ran in the same WebKit instance.
+
+        * dom/SpaceSplitString.h:
+        (WebCore::SpaceSplitStringData::isUnique):
+        (WebCore::SpaceSplitString::ensureUnique):
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Decouple RenderPass drawing from CCRenderSurface
+        https://bugs.webkit.org/show_bug.cgi?id=90573
+
+        Reviewed by Adrienne Walker.
+
+        Removes the managed textures from CCRenderSurface and stores them in a
+        HashMap in LayerRendererChromium.
+
+        At the start of a frame, all textures for the frame are reserved, and
+        unneeded textures are deleted. After each quad is drawn, evicted textures
+        (ie temporary textures used for background filters) are deleted to keep
+        within memory limits. At the end of the frame, all surface contents
+        textures are kept reserved and thus not deleted.
+
+        We add a numeric identifier to CCRenderPass which can be used to
+        identify the pass across serialization in the future, and is used
+        in the interface to LayerRendererChromium. Also we add to the
+        CCRenderPass a contentsChangedSinceLastFrame() flag so that the
+        value does not need to be retrieved from the CCRenderSurface.
+
+        The pointer from CCRenderPass to CCRenderSurface remains for some
+        code in the CCLayerTreeHostImpl, and will be addressed in the future, but
+        the pointer is no longer used at all while drawing a frame inside
+        LayerRendererChromium.
+
+        Covered by existing tests, no intended change in behaviour.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::releaseRenderPassTextures):
+        (WebCore::LayerRendererChromium::decideRenderPassAllocationsForFrame):
+        (WebCore):
+        (WebCore::LayerRendererChromium::haveCachedResourcesForRenderPassId):
+        (WebCore::LayerRendererChromium::drawQuad):
+        (WebCore::LayerRendererChromium::drawBackgroundFilters):
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        (WebCore::LayerRendererChromium::finishDrawingFrame):
+        (WebCore::LayerRendererChromium::useRenderPass):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::removePassesWithCachedTextures):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::create):
+        (WebCore::CCRenderPass::CCRenderPass):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (CCRenderPass):
+        (WebCore::CCRenderPass::id):
+        (WebCore::CCRenderPass::setFramebufferOutputRect):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp:
+        (WebCore::CCRenderPassDrawQuad::create):
+        (WebCore::CCRenderPassDrawQuad::CCRenderPassDrawQuad):
+        * platform/graphics/chromium/cc/CCRenderPassDrawQuad.h:
+        (CCRenderPassDrawQuad):
+        (WebCore::CCRenderPassDrawQuad::renderPassId):
+        (WebCore::CCRenderPassDrawQuad::contentsChangedSinceLastFrame):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::appendQuads):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore):
+        (CCRenderSurface):
+        * platform/graphics/chromium/cc/CCRenderer.h:
+        (CCRenderer):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::CCTiledLayerImpl::pushTileProperties):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (CCTiledLayerImpl):
+
+2012-07-09  Adam Klein  <adamk@chromium.org>
+
+        Rename WebCore::WebKitMutationObserver to WebCore::MutationObserver
+        https://bugs.webkit.org/show_bug.cgi?id=90810
+
+        Reviewed by Ojan Vafai.
+
+        This is in preparation for removing the vendor prefix from the
+        MutationObserver constructor on Window (currently it's called
+        WebKitMutationObserver). Doing the WebCore-internal rename first
+        makes that change a much smaller one, which is especially useful
+        because there's ongoing discussion of when the prefix should be
+        removed from the web-facing API.
+
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSMainThreadExecState.cpp:
+        (WebCore::JSMainThreadExecState::didLeaveScriptContext):
+        * bindings/js/JSMutationCallbackCustom.cpp:
+        (WebCore::JSMutationCallback::handleEvent):
+        * bindings/js/JSMutationObserverCustom.cpp: Renamed from Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp.
+        (WebCore):
+        (WebCore::JSMutationObserverConstructor::constructJSMutationObserver):
+        * bindings/v8/V8RecursionScope.cpp:
+        (WebCore::V8RecursionScope::didLeaveScriptContext):
+        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
+        (WebCore::V8MutationCallback::handleEvent):
+        * bindings/v8/custom/V8MutationObserverCustom.cpp: Renamed from Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp.
+        (WebCore):
+        (WebCore::V8MutationObserver::constructorCallback):
+        * dom/CharacterData.cpp:
+        * dom/ChildListMutationScope.h:
+        (WebCore::ChildListMutationScope::ChildListMutationScope):
+        * dom/DOMAllInOne.cpp:
+        * dom/Document.h:
+        (WebCore::Document::hasMutationObserversOfType):
+        * dom/Element.cpp:
+        * dom/MutationCallback.h:
+        (WebCore):
+        (MutationCallback):
+        * dom/MutationCallback.idl:
+        * dom/MutationObserver.cpp: Renamed from Source/WebCore/dom/WebKitMutationObserver.cpp.
+        (WebCore):
+        (WebCore::MutationObserver::ObserverLessThan::operator()):
+        (WebCore::MutationObserver::create):
+        (WebCore::MutationObserver::MutationObserver):
+        (WebCore::MutationObserver::~MutationObserver):
+        (WebCore::MutationObserver::validateOptions):
+        (WebCore::MutationObserver::observe):
+        (WebCore::MutationObserver::takeRecords):
+        (WebCore::MutationObserver::disconnect):
+        (WebCore::MutationObserver::observationStarted):
+        (WebCore::MutationObserver::observationEnded):
+        (WebCore::activeMutationObservers):
+        (WebCore::MutationObserver::enqueueMutationRecord):
+        (WebCore::MutationObserver::setHasTransientRegistration):
+        (WebCore::MutationObserver::deliver):
+        (WebCore::MutationObserver::deliverAllMutations):
+        * dom/MutationObserver.h: Renamed from Source/WebCore/dom/WebKitMutationObserver.h.
+        (WebCore):
+        (MutationObserver):
+        * dom/MutationObserver.idl: Renamed from Source/WebCore/dom/WebKitMutationObserver.idl.
+        * dom/MutationObserverInterestGroup.cpp:
+        (WebCore::MutationObserverInterestGroup::createIfNeeded):
+        (WebCore::MutationObserverInterestGroup::MutationObserverInterestGroup):
+        (WebCore::MutationObserverInterestGroup::isOldValueRequested):
+        (WebCore::MutationObserverInterestGroup::enqueueMutationRecord):
+        * dom/MutationObserverInterestGroup.h:
+        (WebCore::MutationObserverInterestGroup::createForChildListMutation):
+        (WebCore::MutationObserverInterestGroup::createForCharacterDataMutation):
+        (WebCore::MutationObserverInterestGroup::createForAttributesMutation):
+        (MutationObserverInterestGroup):
+        * dom/MutationObserverRegistration.cpp:
+        (WebCore::MutationObserverRegistration::create):
+        (WebCore::MutationObserverRegistration::MutationObserverRegistration):
+        (WebCore::MutationObserverRegistration::shouldReceiveMutationFrom):
+        * dom/MutationObserverRegistration.h:
+        (MutationObserverRegistration):
+        (WebCore::MutationObserverRegistration::isSubtree):
+        (WebCore::MutationObserverRegistration::observer):
+        (WebCore::MutationObserverRegistration::deliveryOptions):
+        (WebCore::MutationObserverRegistration::mutationTypes):
+        * dom/Node.cpp:
+        (WebCore::Node::collectMatchingObserversForMutation):
+        (WebCore::Node::getRegisteredMutationObserversOfType):
+        (WebCore::Node::registerMutationObserver):
+        * dom/Node.h:
+        (Node):
+        * dom/NodeRareData.h:
+        * page/DOMWindow.idl:
+
+2012-07-09  Filip Pizlo  <fpizlo@apple.com>
+
+        Unreviewed, rolling out http://trac.webkit.org/changeset/122116 and http://trac.webkit.org/changeset/122119
+
+        * GNUmakefile.list.am:
+        * PlatformBlackBerry.cmake:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore):
+        * platform/graphics/OpenGLESShims.h:
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp:
+        (WebCore):
+        * platform/graphics/clutter/GraphicsContext3DClutter.cpp:
+        (WebCore):
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        (WebCore):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL):
+        (WebCore::Extensions3DOpenGL::supports):
+        (WebCore):
+        (WebCore::Extensions3DOpenGL::ensureEnabled):
+        (WebCore::Extensions3DOpenGL::isEnabled):
+        (WebCore::Extensions3DOpenGL::getGraphicsResetStatusARB):
+        (WebCore::Extensions3DOpenGL::getTranslatedShaderSourceANGLE):
+        (WebCore::Extensions3DOpenGL::copyTextureCHROMIUM):
+        * platform/graphics/opengl/Extensions3DOpenGL.h:
+        (Extensions3DOpenGL):
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
+        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
+        * platform/graphics/opengl/Extensions3DOpenGLES.h:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::systemAllowsMultisamplingOnATICards):
+        (WebCore):
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::getExtensions):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
+        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
+        (WebCore::GraphicsContext3D::reshapeFBOs):
+        (WebCore):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore):
+
+2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Build fix after r122115 and some cleanups.
+
+        * html/HTMLCollection.h:
+        (HTMLCollection):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::properties):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::HTMLPropertiesCollection):
+        * html/HTMLPropertiesCollection.h:
+        (HTMLPropertiesCollection):
+
+2012-07-09  Dean Jackson  <dino@apple.com>
+
+        Tiled drawing means some elements can disappear behind the page
+        https://bugs.webkit.org/show_bug.cgi?id=88906
+
+        Reviewed by Simon Fraser.
+
+        The compositing layers in the tile cache could become siblings
+        of the compositing layers for page elements. This meant that in
+        some 3d transforms, the elements could disappear behind the
+        page background (which is rendered into the tile cache) or intersect
+        with the tile cache tiles.
+
+        Fix this by inserting a flattening layer between the tile cache
+        and the page, ensuring that the cache will always be rendered
+        first. I was able to reuse the clipping layer for this, because
+        the tile cache is attached to the RenderView, so there should never
+        be a case where we have both a clipping layer and tiles.
+
+        The unfortunate part of this code is the temporary state variable
+        that wraps the call to GraphicsLayer::create. Because that method
+        calls back into the object, we need to make sure we don't create
+        another tile cache.
+
+        Also added some obvious names to the tile cache layers to
+        help with debugging.
+
+        Test: compositing/tile-cache-must-flatten.html
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::TileCache): give the tile host layer a name.
+        (WebCore::TileCache::createTileLayer):
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (WebCore): give each tile layer a name.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore):
+        (WebCore::RenderLayerBacking::shouldUseTileCache): check if we're in the middle
+        of creating the primary graphics layer before answering.
+        (WebCore::RenderLayerBacking::createPrimaryGraphicsLayer): wrap our call to
+        createGraphicsLayer with a message to indicate we are making the layer that should
+        get a tile cache.
+        (WebCore::RenderLayerBacking::destroyGraphicsLayers):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration): needs to make
+        sure the flattening layer is in the tree.
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::backingStoreMemoryEstimate):
+        * rendering/RenderLayerBacking.h: rename m_clippingLayer to m_containmentLayer
+        because it can now either be the clip or the tile cache flattener. Also
+        a new state property used when creating the main graphics layer.
+        (WebCore::RenderLayerBacking::hasClippingLayer):
+        (WebCore::RenderLayerBacking::clippingLayer):
+        (WebCore::RenderLayerBacking::parentForSublayers):
+        (WebCore::RenderLayerBacking::hasTileCacheFlatteningLayer):
+        (WebCore::RenderLayerBacking::tileCacheFlatteningLayer):
+        (RenderLayerBacking):
+
+2012-07-09  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Log significant Gamepad API-related events
+        https://bugs.webkit.org/show_bug.cgi?id=90595
+
+        Reviewed by Antonio Gomes.
+
+        Log significant Gamepad API-related events in
+        GamepadsEfl.
+
+        No new tests, no behavior change.
+
+        * platform/efl/GamepadsEfl.cpp:
+        (WebCore::GamepadDeviceEfl::deviceFile):
+        (GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::readCallback):
+        (WebCore::GamepadsEfl::registerDevice):
+        (WebCore::GamepadsEfl::unregisterDevice):
+
+2012-07-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reduce the amount of flashing when falling into tiled layers
+        https://bugs.webkit.org/show_bug.cgi?id=90808
+
+        Reviewed by Dean Jackson.
+
+        Implement +prefetchedTiles so that CATiledLayer renders more
+        tiles at a time, reducing the appearance of flashing.
+
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (+[WebTiledLayer prefetchedTiles]):
+
+2012-07-09  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        SurroundingText should not advance character iterators if they are at end.
+        https://bugs.webkit.org/show_bug.cgi?id=90560
+
+        Reviewed by Ryosuke Niwa.
+
+        CharacterIterator and BackwardsCharacterIterator try to advance their
+        internal TextIterator without checking if they already are at end.
+        This can cause crashes in TextIterator::advance.
+
+        Test: platform/chromium/editing/surrounding-text/surrounding-text.html
+
+        * editing/SurroundingText.cpp:
+        (WebCore::SurroundingText::SurroundingText):
+        (WebCore::SurroundingText::rangeFromContentOffsets):
+
+2012-07-09  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] [WK2] Ecore errors from ecore_evas_screen_geometry_get()
+        https://bugs.webkit.org/show_bug.cgi?id=90609
+
+        Reviewed by Daniel Bates.
+
+        Do not call ecore_evas_screen_geometry_get() if ecoreEvas is null.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/efl/PlatformScreenEfl.cpp:
+        (WebCore::screenRect): Early return if Evas is null.
+
+2012-07-09  Alexandru Chiculita  <achicu@adobe.com>
+
+        [CSS Filters] Blur filter is not repainted correctly when applied on a parent of a fixed element
+        https://bugs.webkit.org/show_bug.cgi?id=90087
+
+        Reviewed by Simon Fraser.
+
+        Added a new method, RenderLayer::hasAncestorWithFilterOutsets, to check that there's no filter with outsets (ie. blur) 
+        applied on top level fixed positioned elements, nor any of its parent layers. In the event of a blur filter we need to
+        disable the fast scrolling optimization, otherwise the outsets of the filter will be carried around the page and 
+        repainting will not work correctly.
+
+        Tests: css3/filters/blur-filter-page-scroll-parents.html
+               css3/filters/blur-filter-page-scroll-self.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+        * rendering/RenderLayer.cpp:
+        (WebCore):
+        (WebCore::RenderLayer::hasAncestorWithFilterOutsets):
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+
+2012-07-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Empty arrays shouldn't be valid key paths
+        https://bugs.webkit.org/show_bug.cgi?id=90798
+
+        Reviewed by Tony Chang.
+
+        Other IDB implementations already enforce this although it is not yet in 
+        the spec (see https://www.w3.org/Bugs/Public/show_bug.cgi?id=17657). If an
+        empty array is passed as the key path arg to IDBDatabase.createObjectStore()
+        or IDBObjectStore.createIndex(), a SYNTAX_ERR DOMException is now thrown.
+
+        Test: storage/indexeddb/keypath-arrays.html
+              storage/indexeddb/keypath-basics.html
+
+        * Modules/indexeddb/IDBKeyPath.cpp:
+        (WebCore::IDBKeyPath::isValid): Test for empty array.
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Create render surfaces on main thread only for the current frame
+        https://bugs.webkit.org/show_bug.cgi?id=89793
+
+        Reviewed by Adrienne Walker.
+
+        Previously we would create render surfaces for animating layers
+        in the main thread since these layers might have a surface on impl,
+        in order to assist culling. This makes it very difficult to estimate
+        how much texture memory is needed for RenderSurfaces on the main
+        thread, in order to keep contents+surface memory below our limit.
+
+        Here we stop doing this, and create RenderSurfaces on both threads
+        under the same conditions, so main thread has surfaces only if the
+        layers in its current frame demand them. While this may reduce
+        paint culling within an animating subtree, this seems like an edge
+        case and knowing the amount of surface memory needed for the frame
+        is important.
+
+        Animation tests in CCLayerTreeHostCommonTest used to verify that these
+        layers got surfaces, so now no longer do. Creation of surfaces under
+        other conditions is covered by other CCLayerTreeHostCommonTests.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore::subtreeShouldRenderToSeparateSurface):
+
+2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix after r122116.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+
+2012-07-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        EFL build fix after r122115.
+
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::create):
+
+2012-07-09  Joshua Netterfield  <jnetterfield@rim.com>
+        Make GC3D and E3D more maintainable for GLES platforms
+        https://bugs.webkit.org/show_bug.cgi?id=90567
+
+        Reviewed by Rob Buis.
+
+        This patch cleans up code for WebGL on OpenGLES platforms which use 
+        GraphicsContext3DOpenGL* and Extensions3DOpenGL*. Although
+        GraphicsContext3DOpenGL was already split into GraphicsContext3DOpenGL,
+        GraphicsContext3DOpenGLCommon, and  GraphicsContext3DOpenGLES, this patch
+        is an attempt to refactor this code in a way that will help BlackBerry and
+        other teams support WebGL on mobile platforms with as little use of
+        "#IF USE(OPENGL_ES_2)" in common code as possible. Also included is the
+        separation of Extensions3DOpenGL into Extensions3DOpenGLCommon,
+        Extensions3DOpenGL, and Extensions3DOpenGLES as well as the introduction
+        of OpenGLESShims.
+
+        This patch is created in large part by Jonathan Feldstein.
+
+        No new tests: no new behaviour.
+
+        * PlatformBlackBerry.cmake: Recognize BlackBerry as OPENGL ES, add new files to build
+        * Target.pri: Add new Extensions3DOpenGL* to WebGL builds
+        * platform/graphics/GraphicsContext3D.h: Add validateDepthStencil, make systemAllowsMultisamplingOnATICards a a member function.
+        (WebCore):
+        * platform/graphics/OpenGLESShims.h: Added.
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp: Move code to Extensions3DOpenGLCommon where possible
+        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL): Reflect that it is now inherits Extensions3DCommon
+        (WebCore::Extensions3DOpenGL::supportsExtension): Contains OpenGL specific code from supports
+        (WebCore):
+        (WebCore::Extensions3DOpenGL::getExtensions): Returns a list of extensions
+        * platform/graphics/opengl/Extensions3DOpenGL.h: Remove functions now in Extensions3DOpenGLCommon
+        (WebCore):
+        (Extensions3DOpenGL):
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp: Added.
+        (WebCore):
+        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon):
+        (WebCore::Extensions3DOpenGLCommon::~Extensions3DOpenGLCommon):
+        (WebCore::Extensions3DOpenGLCommon::supports):
+        (WebCore::Extensions3DOpenGLCommon::ensureEnabled):
+        (WebCore::Extensions3DOpenGLCommon::isEnabled):
+        (WebCore::Extensions3DOpenGLCommon::getGraphicsResetStatusARB):
+        (WebCore::Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE): Existed before, but did nothing. Now does what is says it does.
+        (WebCore::Extensions3DOpenGLCommon::initializeAvailableExtensions): Moved from Extensions3DOpenGL::supports
+        * platform/graphics/opengl/Extensions3DOpenGLCommon.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
+        (WebCore):
+        (Extensions3DOpenGLCommon):
+        * platform/graphics/opengl/Extensions3DOpenGLES.cpp: Added.
+        (WebCore):
+        (WebCore::Extensions3DOpenGLES::Extensions3DOpenGLES):
+        (WebCore::Extensions3DOpenGLES::~Extensions3DOpenGLES):
+        (WebCore::Extensions3DOpenGLES::framebufferTexture2DMultisampleIMG):
+        (WebCore::Extensions3DOpenGLES::renderbufferStorageMultisampleIMG):
+        (WebCore::Extensions3DOpenGLES::createVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::deleteVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::isVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::bindVertexArrayOES):
+        (WebCore::Extensions3DOpenGLES::supportsExtension): Contains OpenGLES specific code from supports
+        (WebCore::Extensions3DOpenGLES::getExtensions):
+        * platform/graphics/opengl/Extensions3DOpenGLES.h: Copied from Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h.
+        (WebCore):
+        (Extensions3DOpenGLES):
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore):
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
+        (WebCore::GraphicsContext3D::getExtensions):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::validateDepthStencil):
+        (WebCore::GraphicsContext3D::clear):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore):
+        (WebCore::GraphicsContext3D::lineWidth):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::polygonOffset):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary):
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore):
+        (WebCore::GraphicsContext3D::getExtensions):
+        (WebCore::GraphicsContext3D::systemAllowsMultisamplingOnATICards): Now a member function.
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+
+2012-07-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Make HTMLCollection RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=90414
+
+        Reviewed by Sam Weinig.
+
+        Make HTMLCollection ref counted and stop forwarding ref and deref to its owner (m_base)
+        so as to align its life time management to that of DynamicNodeList.
+
+        After this patch, each HTMLCollection is owned by JSC/V8 and m_cachedCollections in ElementRareData
+        and m_collection in Document merely hold raw pointers for the caching purpose. These raw pointers
+        are cleared when each HTMLCollection is destructed via corresponding removeCachedHTMLCollection's.
+
+        In the destructor of HTMLCollection, we use the CollectionType to decide whether base() is an element
+        or an document, and call the appropriate removeCachedHTMLCollection except for WindowNamedItems and
+        DocumentNamedItems. For those two types, we need to know the atomic string name associated with
+        the collection just like many DynamicNodeList to remove the cache, so we let HTMLNameCollection
+        directly call removeWindowNamedItemCache and removeDocumentNamedItemCache. We'll cleanup this mess in
+        a follow up patch using a nice class hierarchy and virtual destructors.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::namedItemGetter):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::openSearchDescriptionURL):
+        (WebCore):
+        (WebCore::Document::cachedCollection):
+        (WebCore::Document::removeCachedHTMLCollection):
+        (WebCore::Document::images):
+        (WebCore::Document::applets):
+        (WebCore::Document::embeds):
+        (WebCore::Document::plugins):
+        (WebCore::Document::objects):
+        (WebCore::Document::scripts):
+        (WebCore::Document::links):
+        (WebCore::Document::forms):
+        (WebCore::Document::anchors):
+        (WebCore::Document::all):
+        (WebCore::Document::windowNamedItems):
+        (WebCore::Document::documentNamedItems):
+        (WebCore::Document::removeWindowNamedItemCache):
+        (WebCore::Document::removeDocumentNamedItemCache):
+        * dom/Document.h:
+        (Document):
+        * dom/Element.cpp:
+        (WebCore::Element::ensureCachedHTMLCollection):
+        (WebCore::ElementRareData::ensureCachedHTMLCollection):
+        (WebCore::Element::removeCachedHTMLCollection):
+        (WebCore):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        (WebCore::ElementRareData::cachedHTMLCollection):
+        (WebCore::ElementRareData::removeCachedHTMLCollection):
+        * html/CollectionType.h:
+        (WebCore): Since WindowNamedItems is not a part of UnnamedDocumentCachedType, we shouldn't addd 1.
+        (WebCore::isUnnamedDocumentCachedType):
+        (WebCore::isNodeCollectionType):
+        * html/HTMLAllCollection.cpp:
+        (WebCore::HTMLAllCollection::create):
+        * html/HTMLAllCollection.h:
+        (HTMLAllCollection):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::create):
+        (WebCore::HTMLCollection::~HTMLCollection):
+        (WebCore::HTMLCollection::itemAfter):
+        * html/HTMLCollection.h:
+        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
+        (HTMLCollection):
+        (WebCore::HTMLCollection::base):
+        * html/HTMLDataListElement.cpp:
+        (WebCore::HTMLDataListElement::options):
+        * html/HTMLDataListElement.h:
+        (HTMLDataListElement):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::children):
+        (WebCore::HTMLElement::properties):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::elements):
+        * html/HTMLFieldSetElement.h:
+        (HTMLFieldSetElement):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::create):
+        * html/HTMLFormCollection.h:
+        (HTMLFormCollection):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::elements):
+        * html/HTMLFormElement.h:
+        (HTMLFormElement):
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::imageElement):
+        (WebCore::HTMLMapElement::areas):
+        * html/HTMLMapElement.h:
+        (HTMLMapElement):
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::HTMLNameCollection):
+        (WebCore::HTMLNameCollection::~HTMLNameCollection):
+        (WebCore):
+        * html/HTMLNameCollection.h:
+        (WebCore::HTMLNameCollection::create):
+        (HTMLNameCollection):
+        * html/HTMLOptionsCollection.cpp:
+        (WebCore::HTMLOptionsCollection::create):
+        * html/HTMLOptionsCollection.h:
+        (HTMLOptionsCollection):
+        * html/HTMLPropertiesCollection.h:
+        (HTMLPropertiesCollection):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedOptions):
+        (WebCore::HTMLSelectElement::options):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::rows):
+        (WebCore::HTMLTableElement::tBodies):
+        * html/HTMLTableElement.h:
+        (HTMLTableElement):
+        * html/HTMLTableRowElement.cpp:
+        (WebCore::HTMLTableRowElement::insertCell):
+        (WebCore::HTMLTableRowElement::deleteCell):
+        (WebCore::HTMLTableRowElement::cells):
+        * html/HTMLTableRowElement.h:
+        (HTMLTableRowElement):
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::create):
+        * html/HTMLTableRowsCollection.h:
+        (HTMLTableRowsCollection):
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::insertRow):
+        (WebCore::HTMLTableSectionElement::deleteRow):
+        (WebCore::HTMLTableSectionElement::rows):
+        * html/HTMLTableSectionElement.h:
+        (HTMLTableSectionElement):
+
+2012-07-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: unindent line ending block upon { hit.
+        https://bugs.webkit.org/show_bug.cgi?id=90795
+
+        Reviewed by Vsevolod Vlasov.
+
+        Added block-start / block-end markup into the highlighter.
+
+        * inspector/front-end/SourceCSSTokenizer.js:
+        (WebInspector.SourceCSSTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceCSSTokenizer.re2js:
+        * inspector/front-end/SourceJavaScriptTokenizer.js:
+        (WebInspector.SourceJavaScriptTokenizer.prototype.nextToken):
+        * inspector/front-end/SourceJavaScriptTokenizer.re2js:
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditorMainPanel.prototype._applyDomUpdates):
+        (WebInspector.TextEditorMainPanel.prototype._unindentAfterBlock):
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        * dom/ContextFeatures.cpp:
+        * dom/ContextFeatures.h:
+        * html/HTMLDialogElement.cpp: Removed.
+        * html/HTMLDialogElement.h: Removed.
+        * html/HTMLDialogElement.idl: Removed.
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+
+2012-07-09  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions] Rename NamedFlow::getRegionsByContentNode to NamedFlow::getRegionsByContent
+        https://bugs.webkit.org/show_bug.cgi?id=90759
+
+        Reviewed by Andreas Kling.
+
+        Renamed NamedFlow::getRegionsByContentNode to NamedFlow::getRegionsByContent as per CSS Regions spec:
+        http://www.w3.org/TR/css3-regions/#dom-named-flow
+
+        Tests: fast/regions/get-regions-by-content-horiz-bt.html
+               fast/regions/get-regions-by-content-horiz-tb.html
+               fast/regions/get-regions-by-content-vert-lr.html
+               fast/regions/get-regions-by-content-vert-rl.html
+               fast/regions/get-regions-by-content.html
+               fast/regions/get-regions-by-content2.html
+
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::getRegionsByContent):
+        * dom/WebKitNamedFlow.h:
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        This adds the ENABLE_DIALOG_ELEMENT feature flag and dummy implementation files for <dialog>. In addition, a runtime feature flag is added.
+        The feature is diabled by default.
+
+        No new tests, as there is no behavior change.
+
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h: Added a runtime feature flag for dialog.
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::dialogElementEnabled):
+        (WebCore::RuntimeEnabledFeatures::setDialogElementEnabled):
+        * dom/ContextFeatures.cpp:
+        (WebCore::ContextFeatures::dialogElementEnabled):
+        (WebCore):
+        * dom/ContextFeatures.h: Added a per-context flag for dialog so that dialog can be disabled in HTMLTagNames.in and DOMWindow.idl when the dialog runtime feature flag is off.
+        * html/HTMLDialogElement.cpp: Added.
+        (WebCore):
+        (WebCore::HTMLDialogElement::HTMLDialogElement):
+        (WebCore::HTMLDialogElement::create):
+        (WebCore::HTMLDialogElement::close):
+        (WebCore::HTMLDialogElement::show):
+        * html/HTMLDialogElement.h: Added.
+        (WebCore):
+        (HTMLDialogElement):
+        * html/HTMLDialogElement.idl: Added.
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
+        * page/DOMWindow.idl:
+
+2012-07-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: inspector does not reflect newly created text nodes from contenteditable
+        https://bugs.webkit.org/show_bug.cgi?id=90779
+
+        Reviewed by Vsevolod Vlasov.
+
+        We need to report first text node as inserted, otherwise we fail to report character data modified on it.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::characterDataModified):
+
+2012-07-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        REGRESSION(r121980) Layout Test inspector/timeline/timeline-frames.html started to crash.
+        https://bugs.webkit.org/show_bug.cgi?id=90747
+
+        Reviewed by Pavel Feldman.
+
+        - consider didCancelFrame() call normal if there is no pending frame, remove assertion;
+        - always set empty data object for frame records;
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCancelFrame):
+        (WebCore::InspectorTimelineAgent::commitFrameRecord):
+
+2012-07-09  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add FileContentView for FileSystemView
+        https://bugs.webkit.org/show_bug.cgi?id=90529
+
+        Adding FileContentView to Inspector.
+        This class provides preview of text files in FileSystem.
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/FileContentView.js: Added.
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView.prototype.get visibleView):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.onselect):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.refresh):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-07-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [SOUP] Use soup_cookie_jar_is_persistent() to set whether cookie is a session one or not
+        https://bugs.webkit.org/show_bug.cgi?id=90769
+
+        Reviewed by Gustavo Noronha Silva.
+
+        It's currently set to false, because there were no API to know
+        whether cookies were persistent or not. Now that we bumped libsoup
+        requirements, we can use soup_cookie_jar_is_persistent().
+
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+
+2012-07-09  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add text file support for FileSystemAgent::requestFileContent
+        https://bugs.webkit.org/show_bug.cgi?id=90439
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::requestFileContent):
+        * inspector/InspectorFileSystemAgent.h:
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype.requestFileContent):
+        (WebInspector.FileSystemModel.File.prototype.requestFileContent):
+        (WebInspector.FileSystemRequestManager.prototype._fileContentReceived):
+        (WebInspector.FileSystemDispatcher.prototype.fileContentReceived):
+
+2012-07-09  MORITA Hajime  <morrita@google.com>
+
+        [Chromium] ContextFeaturesClient::isEnabled is slow
+        https://bugs.webkit.org/show_bug.cgi?id=90367
+
+        Reviewed by Kent Tamura.
+
+        * dom/ContextFeatures.h:
+        (WebCore::ContextFeaturesClient::urlDidChange): Added.
+        (WebCore::ContextFeatures::urlDidChange): Added.
+        (WebCore):
+        * dom/Document.cpp:
+        (WebCore::Document::setURL): Added an urlDidChange() call.
+
+2012-07-09  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions] Implement NamedFlow::firstEmptyRegionIndex attribute
+        https://bugs.webkit.org/show_bug.cgi?id=90608
+
+        Reviewed by Andreas Kling.
+
+        Implemented NamedFlow::firstEmptyRegionIndex as per spec: http://www.w3.org/TR/css3-regions/#dom-named-flow
+
+        Test: fast/regions/webkit-named-flow-first-empty-region-index.html
+
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::firstEmptyRegionIndex):
+        (WebCore):
+        * dom/WebKitNamedFlow.h:
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+
+2012-07-08  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform-Mac] Derive LocaleMac.{cpp,h} and LocalizedDateMac.cpp from LocaleWin
+        https://bugs.webkit.org/show_bug.cgi?id=90752
+
+        Reviewed by Kent Tamura.
+
+        This patch is preparation of introducing LocaleMac class for localize date form.
+        This patch copies LocaleWin and LocalizedDateWin.cpp as below:
+         - LocaleMac.h from LocaleWin.h
+         - LocaleMac.mm from LocaliedDateMac.mm
+         - LocaliedDateMac.cpp from LocalizedDateWin.cpp
+
+        Due by git, diffs are appeared as new thing. I'll do svn copy at landing time.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/text/mac/LocaleMac.h: Copied from platform/text/LocaleWin.h
+        * platform/text/mac/LocaleMac.mm: Copied from platform/text/mac/LocalizedDateMac.mm
+        * platform/text/mac/LocalizedDateMac.cpp: Copied from platform/text/LocalizedDateWin.cpp
+
+2012-07-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Introduce a build flag for low quality JPEG images
+        https://bugs.webkit.org/show_bug.cgi?id=90748
+
+        Reviewed by Adam Barth.
+
+        Introduce build options for no JPEG dithering (USE(LOW_QUALITY_IMAGE_NO_JPEG_DITHERING))
+        and no JPEG fancy upsampling (USE(LOW_QUALITY_IMAGE_NO_JPEG_FANCY_UPSAMPLING)).
+
+        No new tests as there is no change in functionality.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (ditherMode):
+        (doFancyUpsampling):
+
+2012-07-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121968.
+        http://trac.webkit.org/changeset/121968
+        https://bugs.webkit.org/show_bug.cgi?id=90749
+
+        Caused a link error on chromium Win dbg. (Requested by hayato
+        on #webkit).
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        * platform/MemoryUsageSupport.cpp:
+        * platform/MemoryUsageSupport.h:
+        (MemoryUsageSupport):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+
+2012-07-08  Mary Wu  <mary.wu@torchmobile.com.cn>
+
+        [BlackBerry] Make setForceDownload a setter method.
+        https://bugs.webkit.org/show_bug.cgi?id=90591
+
+        Reviewed by Rob Buis.
+
+        * platform/network/blackberry/ResourceRequest.h:
+        (WebCore::ResourceRequest::setForceDownload):
+
+2012-07-05  MORITA Hajime  <morrita@google.com>
+
+        Heap-use-after-free in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers
+        https://bugs.webkit.org/show_bug.cgi?id=90480
+
+        Reviewed by Kent Tamura.
+
+        If <select> has any insertion point, the attachment phase
+        unpextedly creates a renderer for distributed node and added to
+        the renderer of the <select>, which breaks an assumption and
+        results the crash.
+
+        This change tighten the childShouldCreateRenderer() to forbid
+        child renderers even from distributed nodes.
+
+        There is an exception as always: ValidationMessage can create a
+        ShadowRoot to <select>, which generates usually-forbidden child
+        renderers.  This change introduces HTMLFormControlElement::validationMessageContains()
+        to let these renderers in.
+
+        Test: fast/dom/shadow/insertion-point-list-menu-crash.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::validationMessageContains):
+        (WebCore):
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::childShouldCreateRenderer):
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::contains):
+        (WebCore):
+        * html/ValidationMessage.h:
+        (WebCore):
+        (ValidationMessage):
+
+2012-07-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Remove unnecessary member HTMLTreeBuilder::m_lastScriptElementStartPosition
+        https://bugs.webkit.org/show_bug.cgi?id=90726
+
+        Reviewed by Adam Barth.
+
+        HTMLTreeBuilder::m_lastScriptElementStartPosition is of no use. Currently,
+        m_lastScriptElementStartPosition is used to store the text position in
+        "script" start tag, and then the stored position is passed to m_scriptToProcessStartPosition
+        later in "script" end tag. Because HTMLTreeBuilder handles one script tag at
+        a time, we can store the text position directly to m_scriptToProcessStartPosition
+        in "script" start tag.
+
+        No behavior change, so no new tests.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        * html/parser/HTMLTreeBuilder.h:
+        (HTMLTreeBuilder):
+
+2012-07-08  Philip Rogers  <pdr@google.com>
+
+        Refactor RenderSVGShape to not contain fallback code
+        https://bugs.webkit.org/show_bug.cgi?id=90514
+
+        Reviewed by Nikolas Zimmermann.
+
+        The interaction between RenderSVGShape and {RenderSVGEllipse, RenderSVGRect}
+        was too coupled and it was not clear when a path existed or who controlled
+        falling back to path codepaths in RenderSVGShape.
+
+        This patch cleans up RenderSVGShape so that it does not track fallback state
+        and does not have special handling for creating a shape in strokeContains. Because
+        some functions of RenderSVGShape can be called without a path existing, each
+        of these functions has switched to using the path() function which asserts that
+        a path exists.
+
+        There is only one remaining use of hasPath() in RenderSVGShape which I plan
+        to remove in a followup patch.
+
+        This patch also cleans up RenderSVGRect and RenderSVGEllipse. These classes
+        now handle fallback tracking themselves and choose when to use their optimized
+        strokeContains codepaths.
+
+        No new tests as this is just a refactoring.
+
+        * rendering/svg/RenderSVGEllipse.cpp:
+        (WebCore::RenderSVGEllipse::RenderSVGEllipse):
+        (WebCore::RenderSVGEllipse::createShape):
+        (WebCore::RenderSVGEllipse::objectBoundingBox):
+        (WebCore::RenderSVGEllipse::strokeBoundingBox):
+        (WebCore::RenderSVGEllipse::fillShape):
+        (WebCore::RenderSVGEllipse::strokeShape):
+        (WebCore::RenderSVGEllipse::shapeDependentStrokeContains):
+        (WebCore::RenderSVGEllipse::shapeDependentFillContains):
+        * rendering/svg/RenderSVGEllipse.h:
+        (WebCore::RenderSVGEllipse::isEmpty):
+        (RenderSVGEllipse):
+        * rendering/svg/RenderSVGRect.cpp:
+        (WebCore::RenderSVGRect::RenderSVGRect):
+        (WebCore::RenderSVGRect::createShape):
+        (WebCore::RenderSVGRect::objectBoundingBox):
+        (WebCore::RenderSVGRect::strokeBoundingBox):
+        (WebCore::RenderSVGRect::fillShape):
+        (WebCore::RenderSVGRect::strokeShape):
+        (WebCore::RenderSVGRect::shapeDependentStrokeContains):
+        (WebCore::RenderSVGRect::shapeDependentFillContains):
+        * rendering/svg/RenderSVGRect.h:
+        (WebCore::RenderSVGRect::isEmpty):
+        (RenderSVGRect):
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::RenderSVGShape):
+        (WebCore::RenderSVGShape::createShape):
+        (WebCore::RenderSVGShape::isEmpty):
+        (WebCore::RenderSVGShape::objectBoundingBox):
+        (WebCore::RenderSVGShape::shapeDependentStrokeContains):
+        (WebCore::RenderSVGShape::shapeDependentFillContains):
+        (WebCore::RenderSVGShape::strokeContains):
+        (WebCore::RenderSVGShape::layout):
+        (WebCore::RenderSVGShape::hasSmoothStroke):
+        (WebCore):
+        * rendering/svg/RenderSVGShape.h:
+        (RenderSVGShape):
+
+2012-07-08  Kinuko Yasuda  <kinuko@chromium.org>
+
+        XHR.send should support ArrayBufferView
+        https://bugs.webkit.org/show_bug.cgi?id=90536
+
+        XHR.send should support ArrayBufferView according to the latest draft
+        and also eventually deprecate ArrayBuffer.
+        Spec: http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#dom-xmlhttprequest-send
+
+        Reviewed by Kenneth Russell.
+
+        Test: http/tests/xmlhttprequest/send-array-buffer.html
+              http/tests/xmlhttprequest/send-data-view.html
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore):
+        (WebCore::XMLHttpRequest::send):
+        * xml/XMLHttpRequest.h:
+        (XMLHttpRequest):
+        * xml/XMLHttpRequest.idl:
+
+2012-07-08  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: CodeGeneratorInspector.py should not generate statements with no effect
+        https://bugs.webkit.org/show_bug.cgi?id=90697
+
+        Reviewed by Vsevolod Vlasov.
+
+        Fix to remove the statements with no effect. The check for errors is added only when some valid
+        statements exist.
+
+        No new tests as generator related patch.
+
+        * inspector/CodeGeneratorInspector.py:
+        (Generator.process_command):
+
+2012-07-06  Lauro Neto  <lauro.neto@openbossa.org>
+
+        [Qt] Avoid deep copy of QImage in GraphicsContext3D::getImageData()
+        https://bugs.webkit.org/show_bug.cgi?id=90705
+
+        Reviewed by Noam Rosenthal.
+
+        Use QImage.constBits() as argument to packPixels instead of bits() to avoid
+        deep copying it.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2012-07-06  Andy Estes  <aestes@apple.com>
+
+        Fix errors reported by generate-bindings.pl after r121882.
+
+        * DerivedSources.make: Specify the correct path for notifications idl
+        files now that notifications/ lives in WebCore/Modules/.
+
+2012-07-06  Justin Novosad  <junov@chromium.org>
+
+        Drawing to accelerated 2D canvas causes compositor to recompute layer tree
+        https://bugs.webkit.org/show_bug.cgi?id=90630
+
+        Reviewed by Simon Fraser.
+
+        No new tests: covered by existing canvas/compositing layout tests
+
+        Before this change, there was no distinction between canvas changes
+        that require recomputing the compositor tree and canvas changes that
+        only require re-display. The new CanvasPixelsChanged member of enum
+        ContentChangeType requests re-display without re-layout.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::didDraw):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentChanged):
+
+2012-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: get rid of this._lastMarkedRange in TextEditor.
+        https://bugs.webkit.org/show_bug.cgi?id=90691
+
+        Reviewed by Vsevolod Vlasov.
+
+        We don't need it, should use setSelection instead.
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.markAndRevealRange):
+        (WebInspector.TextEditor.prototype._handleSelectionChange):
+        (WebInspector.TextEditor.prototype.setSelection):
+        (WebInspector.TextEditor.prototype._handleFocused):
+
+2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Snippet renaming behavior is not correct.
+        https://bugs.webkit.org/show_bug.cgi?id=90689
+
+        Reviewed by Pavel Feldman.
+
+        Navigator overlay is now not closed when editing is canceled.
+        Esc handler in NavigatorOverlayController is not installed as a shortcut anymore since
+        it should not be called until all underlying DOM elements handled the key down event.
+
+        * inspector/front-end/NavigatorOverlayController.js:
+        (WebInspector.NavigatorOverlayController.prototype.set showNavigatorOverlay):
+        (WebInspector.NavigatorOverlayController.prototype._keyDown):
+        (WebInspector.NavigatorOverlayController.prototype._innerHideNavigatorOverlay):
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype.rename.commitHandler):
+        (WebInspector.NavigatorView.prototype.rename.cancelHandler):
+        (WebInspector.NavigatorView.prototype.rename.afterEditing):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator):
+        (WebInspector.ScriptsNavigator.prototype._itemRenamingRequested):
+        (WebInspector.SnippetsNavigatorView.prototype._handleRenameSnippet):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._itemRenamingRequested.callback):
+        (WebInspector.ScriptsPanel.prototype._itemRenamingRequested):
+
+2012-07-06  Andreas Kling  <kling@webkit.org>
+
+        Separate mutating CSSStyleDeclaration operations.
+        <http://webkit.org/b/89945>
+
+        Reviewed by Antti Koivisto.
+
+        Use separate paths for mutating the StylePropertySet wrapped by a CSSStyleDeclaration.
+        PropertySetCSSStyleDeclaration now has:
+
+            - propertySet() const
+            - ensureMutablePropertySet()
+
+        This is prep work for supporting immutable ElementAttributeData objects, the idea being
+        that calling ensureMutablePropertySet() may cause the element to convert its internal
+        attribute storage (which also holds the inline StylePropertySet.)
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::length):
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        (WebCore::PropertySetCSSStyleDeclaration::cssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::copy):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::InlineCSSStyleDeclaration::didMutate):
+        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
+        * css/PropertySetCSSStyleDeclaration.h:
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::propertySet):
+        (WebCore::PropertySetCSSStyleDeclaration::ensureMutablePropertySet):
+
+2012-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: text editor scrolls 2px horizontally as one navigates the source code.
+        https://bugs.webkit.org/show_bug.cgi?id=90682
+
+        Reviewed by Vsevolod Vlasov.
+
+        Removing the hack that is glueing the scroller to the left.
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype._updatePanelOffsets):
+        (WebInspector.TextEditorChunkedPanel.prototype._scroll):
+        * inspector/front-end/textEditor.css:
+
+2012-07-06  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: get rid of cancellable records in Timeline, manage frame records explicitly
+        https://bugs.webkit.org/show_bug.cgi?id=90684
+
+        Reviewed by Pavel Feldman.
+
+        - drop handling of "cancelable" records;
+        - keep frame record until other records come (or frame is canceled)
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didBeginFrame):
+        (WebCore::InspectorTimelineAgent::didCancelFrame):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        (WebCore::InspectorTimelineAgent::commitFrameRecord):
+        (WebCore::InspectorTimelineAgent::clearRecordStack):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
+        (TimelineRecordEntry):
+        (InspectorTimelineAgent):
+
+2012-07-06  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: Add native memory used by GlyphCache to the snapshot
+        https://bugs.webkit.org/show_bug.cgi?id=90615
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::addPlatformComponentsInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+        * platform/MemoryUsageSupport.cpp:
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+        (WebCore):
+        * platform/MemoryUsageSupport.h:
+        (MemoryUsageSupport):
+        (ComponentInfo):
+        (WebCore::MemoryUsageSupport::ComponentInfo::ComponentInfo):
+        * platform/chromium/MemoryUsageSupportChromium.cpp:
+        (WebCore::glyphCacheVisitor):
+        (WebCore):
+        (WebCore::MemoryUsageSupport::memoryUsageByComponents):
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Switch to new-style Qt 5 configure tests
+
+        Use explicit project file action instead of syncqt magic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebCore.pri:
+
+2012-07-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: start searching from the cursor position in the Sources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=90677
+
+        Reviewed by Vsevolod Vlasov.
+
+        Web Inspector: start searching from the cursor position in the Sources panel.
+        Drive-by: select whole match upon search cancel.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.performSearch.finishedCallback):
+        (WebInspector.ScriptsPanel.prototype.performSearch):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.performSearch.doFindSearchMatches):
+        (WebInspector.SourceFrame.prototype.performSearch):
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.lastSelection):
+        (WebInspector.TextEditor.prototype._handleFocused):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextRange.prototype.serializeToObject):
+        (WebInspector.TextRange.prototype.compareTo):
+
+2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Snippets should be correctly (re)loaded when inspector is open and on navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=90672
+
+        Reviewed by Pavel Feldman.
+
+        Snippets are now reloaded from the storage on ScriptSnippetMapping reset.
+        Fixed snippets storage.
+
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel):
+        (WebInspector.ScriptSnippetModel.prototype._loadSnippets):
+        (WebInspector.ScriptSnippetModel.prototype._reset):
+        * inspector/front-end/SnippetStorage.js:
+        (WebInspector.Snippet.fromObject):
+
+2012-07-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Implement snippets removing.
+        https://bugs.webkit.org/show_bug.cgi?id=90674
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/NavigatorView.js:
+        (WebInspector.NavigatorView.prototype.rename.afterEditing):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.ScriptsNavigator.prototype.removeUISourceCode):
+        (WebInspector.SnippetsNavigatorView.prototype._handleRemoveSnippet):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeRemoved):
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        * inspector/front-end/TabbedEditorContainer.js:
+
+2012-07-06  'Pavel Feldman'  <pfeldman@chromium.org>
+
+        Not reviewed: fix inspector front-end compilation.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/SearchController.js:
+
+2012-07-06  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add memory reporting routine to Document
+        https://bugs.webkit.org/show_bug.cgi?id=90668
+
+        Reviewed by Pavel Feldman.
+
+        Added methods for reporting HashSet, ListHashSet and Vector memory
+        footprint. Made Document report its size along with its internal
+        collections sizes.
+
+        * dom/Document.cpp:
+        (WebCore::Document::reportMemoryUsage):
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (MemoryObjectInfo):
+        (WebCore::MemoryObjectInfo::reportHashMap):
+        (WebCore::MemoryObjectInfo::reportHashSet):
+        (WebCore::MemoryObjectInfo::reportListHashSet):
+        (WebCore::MemoryObjectInfo::reportVector):
+        (WebCore::MemoryObjectInfo::memoryInstrumentation):
+        (WebCore::MemoryInstrumentation::reportHashMap):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::reportHashSet):
+        (WebCore::MemoryInstrumentation::reportListHashSet):
+        (WebCore::MemoryInstrumentation::reportVector):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-06  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        Fixing defines for NEON intrinsics.
+        https://bugs.webkit.org/show_bug.cgi?id=90666
+
+        Reviewed by Zoltan Herczeg.
+
+        Existing tests cover this issue.
+
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::platformApplyGeneric):
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
+        * platform/graphics/filters/arm/NEONHelpers.h:
+
+2012-07-05  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Workspace should dispatch WorkspaceReset event on navigation.
+        https://bugs.webkit.org/show_bug.cgi?id=90616
+
+        Reviewed by Pavel Feldman.
+
+        Workspace UISourceCodeProviders are now reset on navigation.
+        UISourceCodeRemoved event is not dispatched from UISourceCodeProviders on reset (page navigation) anymore.
+
+        * inspector/front-end/CompilerScriptMapping.js:
+        (WebInspector.CompilerScriptMapping.prototype.reset):
+        * inspector/front-end/DebuggerScriptMapping.js:
+        (WebInspector.DebuggerScriptMapping):
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._loadUISourceCodes):
+        (WebInspector.ScriptsPanel.prototype._reset):
+        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSource):
+        (WebInspector.ScriptsPanel.prototype.showGoToSourceDialog):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StylesUISourceCodeProvider):
+        (WebInspector.StylesUISourceCodeProvider.prototype.reset):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodeProviders):
+        (WebInspector.Workspace):
+        (WebInspector.Workspace.prototype.registerUISourceCodeProvider):
+        (WebInspector.Workspace.prototype._reset):
+
+2012-07-05  Arnaud Renevier  <arno@renevier.net>
+
+        [GTK] Showing the context menu in the Web Inspector can crash the browser
+        https://bugs.webkit.org/show_bug.cgi?id=88800
+
+        Reviewed by Carlos Garcia Campos.
+
+        Remove ContextMenuItem from its parent before appending it again to a
+        new parent
+
+        No new tests, behavior is unchanged.
+
+        * platform/gtk/ContextMenuGtk.cpp:
+        (WebCore::ContextMenu::appendItem):
+
+2012-07-05  Dongwoo Im  <dw.im@samsung.com>
+
+        [EFL] Unreviewed, Fix build break when WEB_AUDIO is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=90653
+
+        Unreviewed build fix.
+
+        A new file, AudioFIFO.cpp, is added for the Web Audio fearure.
+        This file should be included into the CMakeLists.txt file.
+
+        * CMakeLists.txt: Add the newly created file into the CMakeLists.txt
+
+2012-07-05  Mike West  <mkwst@chromium.org>
+
+        Multiple Content Security Policy headers are correctly processed as separate headers.
+        https://bugs.webkit.org/show_bug.cgi?id=90629
+
+        Headers of the same name are normalized into a single, comma-separated
+        string as per RFC2616, section 4.2. We didn't correctly account for this
+        in ContentSecurityPolicy::didReceiveHeader. Now we do by walking through
+        the header string, looking for commas and processing each block in turn.
+
+        This oversight bit Firefox as well, and was patched in February:
+        https://bugzilla.mozilla.org/show_bug.cgi?id=717511
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/contentSecurityPolicy/directive-parsing-multiple-headers.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+
+2012-07-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121921.
+        http://trac.webkit.org/changeset/121921
+        https://bugs.webkit.org/show_bug.cgi?id=90648
+
+        caused hundreds of crashes on Mac (Requested by pizlo on
+        #webkit).
+
+        * editing/SurroundingText.cpp:
+        (WebCore::SurroundingText::SurroundingText):
+        * editing/TextIterator.cpp:
+        (WebCore::CharacterIterator::advance):
+        (WebCore::BackwardsCharacterIterator::advance):
+
+2012-07-05  Anders Carlsson  <andersca@apple.com>
+
+        Type-ahead doesn't work in options inside optgroups
+        https://bugs.webkit.org/show_bug.cgi?id=90647
+        <rdar://problem/5604894>
+
+        Reviewed by Dan Bernstein.
+
+        Set the title of the menu item to a string that doesn't contain any leading or trailing whitespace.
+
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate):
+
+2012-07-05  Hayato Ito  <hayato@chromium.org>
+
+        [Crash] Click an element which will be 'display: none' on focus.
+        https://bugs.webkit.org/show_bug.cgi?id=90516
+
+        Reviewed by Hajime Morita.
+
+        EventHandler::handleMousePressEventSingleClick checks whether
+        innerNode has a renderer in the beginning of the function.  But
+        the renderer may disappear in the middle of the function since its
+        style has just become 'display:none'.  As a result, it touches null renderer
+        in EventHandler.cpp:517:
+            VisiblePosition visiblePos(innerNode->renderer()->positionForPoint(event.localPoint()));
+        In the case of 'display:none', we don't have to continue.  So call
+        updateLayoutIgnorePendingStylesheets() in the beginning so that we
+        can early exit and do not touch null renderer.
+
+        Test: fast/events/display-none-on-focus-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+
+2012-07-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Double release of resources if the load is canceled in a callback of ResourceLoader::didFinishLoading
+        https://bugs.webkit.org/show_bug.cgi?id=90431
+
+        Reviewed by Anders Carlsson.
+
+        In ResourceLoader::didFinishLoadingOnePart(), we invoke didFinishLoad() on the WebKit client. If WebKit
+        causes the current frame to cancel the load synchronously, the resources are already freed when
+        ResourceLoader::didFinishLoadingOnePart() ends.
+        When ResourceLoader::didFinishLoading() subsequently invokes releaseResources(), we are releasing the
+        resources a second time.
+
+        This patch add a second check for cancellation after invoking ResourceLoader::didFinishLoadingOnePart() to
+        avoid such issues.
+
+        The previous check at the beginning of ResourceLoader::didFinishLoading() has been removed because it is
+        redundant with ResourceLoader::didFinishLoadingOnePart().
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didFinishLoading):
+        (WebCore::ResourceLoader::didFinishLoadingOnePart):
+
+2012-07-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Add a utility method for hasOverflowClip() or hasClip()
+        https://bugs.webkit.org/show_bug.cgi?id=90635
+
+        Reviewed by Dean Jackson.
+        
+        Add RenderObject::hasClipOrOverflowClip() as a convenience method
+        since we end up calling hasOverfFlowClip() || hasClip() a lot in the layer code.
+
+        No new tests; refactoring only.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::enclosingNonStackingClippingLayer):
+        (WebCore::RenderLayerCompositor::clipsCompositingDescendants):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasClipOrOverflowClip):
+
+2012-07-05  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Code refactoring: move mimeTypeFromUTITree to a separate file.
+        https://bugs.webkit.org/show_bug.cgi?id=90619
+
+        We should move UTI handling related code to a separate file.
+
+        Reviewed by David Kilzer.
+
+        * WebCore.xcodeproj/project.pbxproj: Add UTIUtilities.h/UTIUtilities.mm to xcode project, and drive-by fix
+            that happened when editing the Xcode project file.
+        * platform/network/mac/UTIUtilities.h: Added.
+        (WebCore):
+        * platform/network/mac/UTIUtilities.mm: Added.  move mimeTypeFromUTITree to UTIUtilities.mm.
+        (WebCore):
+        (WebCore::mimeTypeFromUTITree):
+        * platform/network/mac/WebCoreURLResponse.mm: include UTIUtilities.h to use mimeTypeFromUTITree.
+        (WebCore):
+
+2012-07-05  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Character iterators should not advance if they are at end
+        https://bugs.webkit.org/show_bug.cgi?id=90560
+
+        Reviewed by Ryosuke Niwa.
+
+        CharacterIterator and BackwardsCharacterIterator try to advance their
+        internal TextIterator without checking if they already are at end.
+        This can cause crashes in TextIterator::advance.
+
+        Test: platform/chromium/editing/surrounding-text/surrounding-text.html
+
+        * editing/SurroundingText.cpp:
+        (WebCore::SurroundingText::SurroundingText):
+        * editing/TextIterator.cpp:
+        (WebCore::CharacterIterator::advance):
+        (WebCore::BackwardsCharacterIterator::advance):
+
+2012-07-05  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add basic framework
+        https://bugs.webkit.org/show_bug.cgi?id=88655
+
+        Follow-up patch tweaking method signatures.
+
+        Reviewed by Simon Fraser.
+
+        No functional change, so no new tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/TextAutosizer.cpp:
+        (WebCore::TextAutosizer::processSubtree):
+        (WebCore::TextAutosizer::processBlock):
+        (WebCore::TextAutosizer::processText):
+        (WebCore):
+        * rendering/TextAutosizer.h:
+        (TextAutosizer):
+
+2012-07-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move cursor to the current search match.
+        https://bugs.webkit.org/show_bug.cgi?id=90621
+
+        Reviewed by Vsevolod Vlasov.
+
+        After closing the search dialog, the cursor should be at the latest search match location.
+
+        * inspector/front-end/TextEditor.js:
+        (WebInspector.TextEditor.prototype.markAndRevealRange):
+        (WebInspector.TextEditor.prototype._handleFocused):
+
+2012-07-05  Behdad Esfahbod  <behdad@behdad.org>
+
+        Subpixel layout broken with spans with CSS position other than static
+        https://bugs.webkit.org/show_bug.cgi?id=90097
+
+        Reviewed by Eric Seidel.
+
+        In InlineBox, don't truncate size to integers when returning.
+
+        In RenderBlock, don't round-up width to next integer.  Round-up to
+        next LayoutUnit instead.
+
+        Test: Added fast/sub-pixel/size-of-span-with-different-positions.html
+        Adjust expected outputs affected by the rounding changes.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::fromFloatCeil):
+        (FractionalLayoutUnit):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::size):
+        * rendering/RenderBlock.cpp:
+        (WebCore::updatePreferredWidth):
+
+2012-07-05  Nate Chapin  <japhet@chromium.org>
+
+        REGRESSION (r115654): Sometimes does not replace content for multipart/x-mixed-replace
+        https://bugs.webkit.org/show_bug.cgi?id=88436
+
+        Reviewed by Brady Eidson.
+
+        Test: http/tests/multipart/multipart-replace-non-html-content.php
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::commitData): We should only send receivedFirstData() once per main resource load,
+            rather than multiple times in a multipart load. 
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType): m_gotFirstByte isn't set to true until data is
+            actually committed, and multipart data is often not committed until the part is finished. Check
+            whether the SharedBuffer is non-null instead.
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject): The JSInternals object my have already been cleared if the window shell
+            was cleared as part of creation of a new Document. Check it before using it.
+
+2012-07-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move search field to the bottom of the page.
+        https://bugs.webkit.org/show_bug.cgi?id=90610
+
+        Reviewed by Vsevolod Vlasov.
+
+        This is the first step in the Search/replace implementation. This change moves search
+        field from the inspector toolbar to the inspector view footer that is visible upon Cmd/Ctrl+F.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/InspectorView.js:
+        (WebInspector.InspectorView):
+        (WebInspector.InspectorView.prototype._pushToHistory):
+        (WebInspector.InspectorView.prototype.panelsElement):
+        (WebInspector.InspectorView.prototype.setFooterElement):
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.show):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._reset):
+        * inspector/front-end/SearchController.js:
+        (WebInspector.SearchController):
+        (WebInspector.SearchController.prototype.updateSearchLabel):
+        (WebInspector.SearchController.prototype.cancelSearch):
+        (WebInspector.SearchController.prototype._updateSearchNavigationButtonState):
+        (WebInspector.SearchController.prototype.focusSearchField):
+        (WebInspector.SearchController.prototype._onKeyDown):
+        (WebInspector.SearchController.prototype._onNextButtonSearch):
+        (WebInspector.SearchController.prototype._onPrevButtonSearch):
+        (WebInspector.SearchController.prototype._performSearch):
+        * inspector/front-end/inspector.css:
+        (#search):
+        (.toolbar-search-container):
+        (.toolbar-search-navigation):
+        (.toolbar-search-navigation:hover):
+        (.toolbar-search-navigation.toolbar-search-navigation-prev):
+        (.toolbar-search-navigation.toolbar-search-navigation-next):
+        (.toolbar-search-navigation-hidden):
+        (.status-bar):
+        (.search-drawer-header input[type="search"].search-config-search):
+        (.inspector-footer):
+        (.inspector-footer > div):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.get _setCompactMode):
+        (WebInspector.postDocumentKeyDown):
+
+2012-07-05  Sergey Rogulenko  <rogulenko@google.com>
+
+        Web Inspector: added low-level instrumentation support for TimelineAgent
+        https://bugs.webkit.org/show_bug.cgi?id=90264
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::timelineAgentForOrphanEvents):
+        (WebCore::InspectorInstrumentation::setTimelineAgentForOrphanEvents):
+        (WebCore::InspectorInstrumentation::threadSpecificTimelineAgentForOrphanEvents):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+
+2012-07-05  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add test framework and simple test.
+        https://bugs.webkit.org/show_bug.cgi?id=90561
+
+        Exposes methods allowing Layout Tests to enable Text Autosizing and
+        get the same results as if they were running on a mobile device.
+
+        Reviewed by Adam Barth.
+
+        Test: fast/text-autosizing/simple-paragraph.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore):
+        (WebCore::Settings::setTextAutosizingWindowSizeOverride):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::textAutosizingWindowSizeOverride):
+        * rendering/TextAutosizer.cpp:
+        (WebCore::TextAutosizer::boostSubtree):
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::InternalSettings):
+        (WebCore::InternalSettings::restoreTo):
+        (WebCore::InternalSettings::setTextAutosizingEnabled):
+        (WebCore):
+        (WebCore::InternalSettings::setTextAutosizingWindowSizeOverride):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-07-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: timeline events in the vicinity of event dividers some times are tricky to expand
+        https://bugs.webkit.org/show_bug.cgi?id=90572
+
+        Reviewed by Pavel Feldman.
+
+        - do not use resources-event-divider-padding;
+        - make dividers larger and use border-color to visualize them;
+        - move resources-<color>-divider to timelinePanel.css, as they're not used outside of timeline;
+
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.createEventDivider):
+        * inspector/front-end/inspectorCommon.css:
+        * inspector/front-end/timelinePanel.css:
+        (.timeline .resources-event-divider):
+        (.resources-red-divider):
+        (.resources-blue-divider):
+        (.resources-orange-divider):
+        (.resources-divider.last):
+        (.timeline .resources-event-divider.timeline-frame-divider):
+
+2012-07-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: incorrect height of main timeline pane after switching to memory mode
+        https://bugs.webkit.org/show_bug.cgi?id=90387
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._splitterDragging):
+        (WebInspector.TimelinePanel.prototype.set _setSplitterPosition):
+        (WebInspector.TimelinePanel.prototype._overviewModeChanged):
+
+2012-07-05  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: Add support for keyboard increment / decrement on numbers in attributes in Elements Panel
+        https://bugs.webkit.org/show_bug.cgi?id=89586
+
+        Reviewed by Pavel Feldman
+
+        Refactoring the key events while editing style property values. Migrated the code to UIUtils.js and referred
+        from StylesSidebarPane.js, ElementsTreeOutline.js and MetricsSidebarPane.js.
+
+        No new tests as code refactoring and UI feature added to ElementsTreeOutline.js
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditingAttribute.handleKeyDownEvents):
+        (WebInspector.ElementsTreeElement.prototype._startEditingAttribute):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown.finishHandler):
+        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown.customNumberHandler):
+        (WebInspector.MetricsSidebarPane.prototype._handleKeyDown):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._handleNameOrValueUpDown.finishHandler):
+        (WebInspector.StylesSidebarPane.prototype._handleNameOrValueUpDown):
+        * inspector/front-end/UIUtils.js:
+        (WebInspector._modifiedHexValue):
+        (WebInspector._modifiedFloatNumber):
+        (WebInspector.handleElementValueModifications):
+
+2012-07-05  Gabor Rapcsanyi  <rgabor@webkit.org>
+
+        NEON intrinsics should be used with gaussian blur filter
+        https://bugs.webkit.org/show_bug.cgi?id=90166
+
+        Reviewed by Zoltan Herczeg.
+
+        Rewrite inline assembly to NEON intrinsics for better portabilty 
+        and readibility. Remove unnecessary FEGaussianBlurNEON.cpp and add
+        NEONHelpers.h to the project which will contains the shared
+        NEON code of the filters.
+
+        Existing tests cover this issue.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::platformApplyGeneric):
+        (WebCore::FEGaussianBlur::platformApplyWorker):
+        * platform/graphics/filters/FEGaussianBlur.h:
+        (FEGaussianBlur):
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.cpp: Removed.
+        * platform/graphics/filters/arm/FEGaussianBlurNEON.h:
+        (WebCore::boxBlurNEON):
+        * platform/graphics/filters/arm/NEONHelpers.h: Added.
+        (WebCore):
+        (WebCore::loadRGBA8AsFloat):
+        (WebCore::storeFloatAsRGBA8):
+
+2012-07-05  Sam D  <dsam2912@gmail.com>
+
+        Web Inspector: Having a "Scroll into view" for nodes through web inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=89554
+
+        Added options for scrolling-into-view the  element node through web
+        inspector.
+
+        Reviewed by Pavel Feldman.
+
+        No new tests. UI change.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (.):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.callFunction):
+
+2012-07-05  Zan Dobersek  <zandobersek@gmail.com>
+
+        Add Gamepad logging channel
+        https://bugs.webkit.org/show_bug.cgi?id=90570
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add a new logging channel for logging significant
+        events that are related to Gamepad API implementation.
+
+        No new tests - no new testable functionality.
+
+        * platform/Logging.cpp:
+        (WebCore):
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        (WebCore):
+        * platform/gtk/GamepadsGtk.cpp: Log when a device is
+        registered or unregistered.
+        (WebCore::GamepadsGtk::registerDevice):
+        (WebCore::GamepadsGtk::unregisterDevice):
+
+2012-07-05  Peter Wang  <peter.wang@torchmobile.com.cn>
+
+        Web Inspector: [JSC] support JS execution in the context of an isolated world
+        https://bugs.webkit.org/show_bug.cgi?id=85709
+
+        Reviewed by Gavin Barraclough.
+
+        No new test case for this bug. 
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::collectIsolatedContexts):
+        (WebCore):
+
+2012-07-04  Huang Dongsung  <luxtella@company100.net>
+
+        Add virtual keyword to ~BitmapImage and ~StillImage because ~Image is virtual.
+        https://bugs.webkit.org/show_bug.cgi?id=90447
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/graphics/BitmapImage.h:
+        (BitmapImage):
+        * platform/graphics/qt/StillImageQt.h:
+        (StillImage):
+
+2012-07-04  Mike West  <mkwst@chromium.org>
+
+        Implement the script-nonce Content Security Policy directive.
+        https://bugs.webkit.org/show_bug.cgi?id=89577
+
+        Reviewed by Adam Barth.
+
+        This patch implements the (experimental) script-nonce Content Security
+        Policy directive from the 1.1 spec, which allows for selective
+        execution of script by specifying a "nonce" attribute for the
+        script tag. Script is only loaded and executed if it both matches the
+        nonce and matches the script-src whitelist (if present).
+
+        The implementation is gated on the ENABLE_CSP_NEXT flag, which is
+        currently disabled for all ports other than Chromium.
+
+        Spec: https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-nonce--experimental
+
+        Tests: http/tests/security/contentSecurityPolicy/1.1/scriptnonce-allowed.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-badnonce.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-blocked.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-emptynonce.html
+               http/tests/security/contentSecurityPolicy/1.1/scriptnonce-scriptsrc-blocked.html
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::requestScript):
+        (WebCore::ScriptElement::executeScript):
+            Passing the nonce attribute through to check against CSP.
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.idl:
+            Adding the `nonce` attribute to the script tag.
+        * page/ContentSecurityPolicy.cpp:
+        (CSPDirectiveList):
+        (WebCore::CSPDirectiveList::logInvalidNonce):
+        (WebCore):
+        (WebCore::CSPDirectiveList::checkNonceAndReportViolation):
+        (WebCore::CSPDirectiveList::allowJavaScriptURLs):
+        (WebCore::CSPDirectiveList::allowInlineEventHandlers):
+            If a nonce is set, deny JavaScript URLs and inline event handlers.
+        (WebCore::CSPDirectiveList::allowScriptNonce):
+        (WebCore::CSPDirectiveList::parseScriptNonce):
+        (WebCore::CSPDirectiveList::addDirective):
+        (WebCore::isAllowedByAllWithNonce):
+        (WebCore::ContentSecurityPolicy::allowScriptNonce):
+        * page/ContentSecurityPolicy.h:
+        (WebCore):
+
+2012-07-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Notifications should be in Modules/notifications
+        https://bugs.webkit.org/show_bug.cgi?id=82121
+
+        Reviewed by Adam Barth.
+
+        The notifications directory is now self-contained. This patch moves it to the Modules directory.
+
+        No new tests, covered by existing tests.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/notifications/DOMWindowNotifications.cpp: Renamed from Source/WebCore/notifications/DOMWindowNotifications.cpp.
+        (WebCore):
+        (WebCore::DOMWindowNotifications::DOMWindowNotifications):
+        (WebCore::DOMWindowNotifications::~DOMWindowNotifications):
+        (WebCore::DOMWindowNotifications::from):
+        (WebCore::DOMWindowNotifications::webkitNotifications):
+        (WebCore::DOMWindowNotifications::disconnectFrameForPageCache):
+        (WebCore::DOMWindowNotifications::reconnectFrameFromPageCache):
+        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInCachedFrame):
+        (WebCore::DOMWindowNotifications::willDestroyGlobalObjectInFrame):
+        (WebCore::DOMWindowNotifications::willDetachGlobalObjectFromFrame):
+        * Modules/notifications/DOMWindowNotifications.h: Renamed from Source/WebCore/notifications/DOMWindowNotifications.h.
+        (WebCore):
+        (DOMWindowNotifications):
+        * Modules/notifications/DOMWindowNotifications.idl: Renamed from Source/WebCore/notifications/DOMWindowNotifications.idl.
+        * Modules/notifications/Notification.cpp: Renamed from Source/WebCore/notifications/Notification.cpp.
+        (WebCore):
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::create):
+        (WebCore::getAndAddEventListener):
+        (WebCore::Notification::interfaceName):
+        (WebCore::Notification::show):
+        (WebCore::Notification::close):
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        (WebCore::Notification::contextDestroyed):
+        (WebCore::Notification::finalize):
+        (WebCore::Notification::dispatchShowEvent):
+        (WebCore::Notification::dispatchClickEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::taskTimerFired):
+        (WebCore::Notification::permissionLevel):
+        (WebCore::Notification::permissionString):
+        (WebCore::Notification::requestPermission):
+        * Modules/notifications/Notification.h: Renamed from Source/WebCore/notifications/Notification.h.
+        (WebCore):
+        (Notification):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::setHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::setURL):
+        (WebCore::Notification::iconURL):
+        (WebCore::Notification::title):
+        (WebCore::Notification::body):
+        (WebCore::Notification::dir):
+        (WebCore::Notification::setDir):
+        (WebCore::Notification::replaceId):
+        (WebCore::Notification::setReplaceId):
+        (WebCore::Notification::tag):
+        (WebCore::Notification::setTag):
+        (WebCore::Notification::direction):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::detachPresenter):
+        (WebCore::Notification::setBody):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * Modules/notifications/Notification.idl: Renamed from Source/WebCore/notifications/Notification.idl.
+        * Modules/notifications/NotificationCenter.cpp: Renamed from Source/WebCore/notifications/NotificationCenter.cpp.
+        (WebCore):
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        (WebCore::NotificationCenter::stop):
+        (WebCore::NotificationCenter::requestTimedOut):
+        (WebCore::NotificationCenter::NotificationRequestCallback::createAndStartTimer):
+        (WebCore::NotificationCenter::NotificationRequestCallback::NotificationRequestCallback):
+        (WebCore::NotificationCenter::NotificationRequestCallback::startTimer):
+        (WebCore::NotificationCenter::NotificationRequestCallback::timerFired):
+        * Modules/notifications/NotificationCenter.h: Renamed from Source/WebCore/notifications/NotificationCenter.h.
+        (WebCore):
+        (NotificationCenter):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::client):
+        (NotificationRequestCallback):
+        * Modules/notifications/NotificationCenter.idl: Renamed from Source/WebCore/notifications/NotificationCenter.idl.
+        * Modules/notifications/NotificationClient.h: Renamed from Source/WebCore/notifications/NotificationClient.h.
+        (WebCore):
+        (NotificationClient):
+        (WebCore::NotificationClient::clearNotifications):
+        (WebCore::NotificationClient::~NotificationClient):
+        * Modules/notifications/NotificationController.cpp: Renamed from Source/WebCore/notifications/NotificationController.cpp.
+        (WebCore):
+        (WebCore::NotificationController::NotificationController):
+        (WebCore::NotificationController::~NotificationController):
+        (WebCore::NotificationController::create):
+        (WebCore::NotificationController::clientFrom):
+        (WebCore::NotificationController::supplementName):
+        (WebCore::provideNotification):
+        * Modules/notifications/NotificationController.h: Renamed from Source/WebCore/notifications/NotificationController.h.
+        (WebCore):
+        (NotificationController):
+        (WebCore::NotificationController::from):
+        (WebCore::NotificationController::client):
+        * Modules/notifications/NotificationPermissionCallback.h: Renamed from Source/WebCore/notifications/NotificationPermissionCallback.h.
+        (WebCore):
+        (NotificationPermissionCallback):
+        (WebCore::NotificationPermissionCallback::~NotificationPermissionCallback):
+        * Modules/notifications/NotificationPermissionCallback.idl: Renamed from Source/WebCore/notifications/NotificationPermissionCallback.idl.
+        * Modules/notifications/WorkerContextNotifications.cpp: Renamed from Source/WebCore/notifications/WorkerContextNotifications.cpp.
+        (WebCore):
+        (WebCore::WorkerContextNotifications::WorkerContextNotifications):
+        (WebCore::WorkerContextNotifications::~WorkerContextNotifications):
+        (WebCore::WorkerContextNotifications::from):
+        (WebCore::WorkerContextNotifications::webkitNotifications):
+        * Modules/notifications/WorkerContextNotifications.h: Renamed from Source/WebCore/notifications/WorkerContextNotifications.h.
+        (WebCore):
+        (WorkerContextNotifications):
+        * Modules/notifications/WorkerContextNotifications.idl: Renamed from Source/WebCore/notifications/WorkerContextNotifications.idl.
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-07-04  Hayato Ito  <hayato@chromium.org>
+
+        Remove inline keywords from functions which can not be inlined in ComposedShadowTreeWalker
+        https://bugs.webkit.org/show_bug.cgi?id=90432
+
+        Reviewed by Hajime Morita.
+
+        No new tests - no functional changes.
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseParent):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
+
+2012-07-04  Luke Macpherson  <macpherson@chromium.org>
+
+        Inspector crashes when trying to inspect a page with CSS variables
+        https://bugs.webkit.org/show_bug.cgi?id=89818
+
+        Reviewed by Antti Koivisto.
+
+        Patch works by fixing treating handling of CSSPropertyID == CSSPropertyVariable as a special case,
+        and looking up the author-defined property name from the CSSValue.
+
+        Added test inspector/styles/variables/css-variables.html that inspects an element using CSS variables.
+        Test is skipped when variables are compiled out.
+
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::cssName):
+        (WebCore):
+        (WebCore::CSSProperty::cssText):
+        * css/CSSProperty.h:
+        (CSSProperty):
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::asText):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateAllProperties):
+
+2012-07-04  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Implemented stub for createScriptCallStack to call into
+        Interpreter and extract the current stack frames, iterate
+        through the frames and create the return result required.
+
+        No new tests, manually tested thrown exception and inspector
+        tracebacks.
+
+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStack):
+
+2012-07-04  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Respect memory needed for RenderSurfaces when reserving contents textures
+        https://bugs.webkit.org/show_bug.cgi?id=89901
+
+        Reviewed by Adrienne Walker.
+
+        Treat the memory allocation given to a tab as an allocation for its
+        contents and surfaces. Then only use up contents memory such that
+        the surface textures will still fit within the limit. Report histograms
+        for the amount of contents and surface texture memory used by each
+        frame generated by the main thread.
+
+        In the context of ubercomp, each nested compositor will use less memory
+        for contents ensuring that the root compositor has space for surfaces
+        caused by that nested compositor.
+
+        Since surface memory can no longer be taken by contents, we remove the
+        preferred memory limit from the texture manager.
+
+        Tests: TiledLayerChromiumTest.dontAllocateContentsWhenTargetSurfaceCantBeAllocated
+               CCPrioritizedTextureTest.renderSurfacesReduceMemoryAvailableOutsideRootSurface
+               CCPrioritizedTextureTest.renderSurfacesReduceMemoryAvailableForRequestLate
+               CCPrioritizedTextureTest.whenRenderSurfaceNotAvailableTexturesAlsoNotAvailable
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawBackgroundFilters):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::prioritizeTextures):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
+        (WebCore::CCOverdrawMetrics::CCOverdrawMetrics):
+        (WebCore::CCOverdrawMetrics::didUseContentsTextureMemoryBytes):
+        (WebCore):
+        (WebCore::CCOverdrawMetrics::didUseRenderSurfaceTextureMemoryBytes):
+        (WebCore::CCOverdrawMetrics::recordMetricsInternal):
+        * platform/graphics/chromium/cc/CCOverdrawMetrics.h:
+        (CCOverdrawMetrics):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
+        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
+        (WebCore::CCPrioritizedTextureManager::requestLate):
+        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
+        (WebCore::CCPrioritizedTextureManager::reduceMemory):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
+        (WebCore::CCPrioritizedTextureManager::create):
+        (WebCore::CCPrioritizedTextureManager::memoryForRenderSurfacesBytes):
+        (CCPrioritizedTextureManager):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.cpp:
+        (WebCore::CCPriorityCalculator::uiPriority):
+        (WebCore::CCPriorityCalculator::visiblePriority):
+        (WebCore):
+        (WebCore::CCPriorityCalculator::renderSurfacePriority):
+        (WebCore::CCPriorityCalculator::priorityFromDistance):
+        (WebCore::CCPriorityCalculator::priorityFromVisibility):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.h:
+        (CCPriorityCalculator):
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add basic framework
+        https://bugs.webkit.org/show_bug.cgi?id=88655
+
+        This adds a highly simplified foundation that subsequent Text Autosizing patches
+        can build upon. I've refactored this code (since the earlier combined diff
+        uploaded to http://webkit.org/b/84186) to touch as few files as possible.
+
+        Reviewed by Adam Barth.
+
+        No new tests. I plan to add a test framework as my next Text Autosizing patch.
+
+        * WebCore.gypi:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore):
+        (Document):
+        (WebCore::Document::textAutosizer):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/TextAutosizer.cpp: Added.
+        (WebCore):
+        (WebCore::TextAutosizer::TextAutosizer):
+        (WebCore::TextAutosizer::~TextAutosizer):
+        (WebCore::TextAutosizer::create):
+        (WebCore::TextAutosizer::boostSubtree):
+        (WebCore::TextAutosizer::boostBlock):
+        (WebCore::TextAutosizer::boostText):
+        (WebCore::TextAutosizer::treatAsInline):
+        (WebCore::TextAutosizer::traverseNext):
+        (WebCore::TextAutosizer::cloneRenderStyleWithState):
+        * rendering/TextAutosizer.h: Added.
+        (WebCore):
+        (TextAutosizer):
+
+2012-07-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed, rolling out r121767.
+        http://trac.webkit.org/changeset/121767
+        https://bugs.webkit.org/show_bug.cgi?id=89584
+
+        Crashes inspected page while recording timeline due to
+        conflict with BeginFrame in record stack
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::willProcessTask):
+        (WebCore::InspectorTimelineAgent::didProcessTask):
+        (WebCore::InspectorTimelineAgent::innerAddRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
+        * inspector/front-end/TimelineFrameController.js:
+        (WebInspector.TimelineFrameController.prototype._addRecord):
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
+        (WebInspector.TimelineCategoryStrips.prototype.update):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.categories):
+        (WebInspector.TimelinePresentationModel.recordStyle):
+        (WebInspector.TimelinePresentationModel.categoryForRecord):
+        (WebInspector.TimelinePresentationModel.forAllRecords):
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+
+2012-07-04  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clear RenderSurfaces still when no idle paint will be done
+        https://bugs.webkit.org/show_bug.cgi?id=90553
+
+        Reviewed by Adrienne Walker.
+
+        Currently if idle painting is disabled, updateLayers() will early-out.
+        But this prevents it from doing cleanup and clearing all RenderSurface
+        pointers, leaving the layer tree in an unexpected state.
+
+        Tests: CCLayerTreeHostTestCompositeAndReadbackCleanup
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::updateLayers):
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing and adds compile guards around the runtime setting.
+
+        Reviewed by Adam Barth.
+
+        No functionality yet, so no new tests.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * Target.pri:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setTextAutosizingEnabled):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::textAutosizingEnabled):
+
+2012-07-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Emulate pseudo styles (hover etc.) of non-selected elements
+        https://bugs.webkit.org/show_bug.cgi?id=86630
+
+        Reviewed by Pavel Feldman.
+
+        - A map of pseudo-states for all bound DOM nodes is maintained in the backend and queried whenever StyleResolver
+        calculates the effective element style.
+        - In the frontend, markers are introduced to distinguish elements that have forced pseudo styles set for them.
+        Additionally, dimmed markers are added for collapsed nodes, whose descendants have forced pseudo styles.
+        More ElementDecorator subtypes will be added for other types of markers.
+
+        Test: inspector/styles/force-pseudo-state.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::InspectorCSSAgent):
+        (WebCore::InspectorCSSAgent::clearFrontend):
+        (WebCore::InspectorCSSAgent::reset):
+        (WebCore::InspectorCSSAgent::forcePseudoState):
+        (WebCore::InspectorCSSAgent::recalcStyleForPseudoStateIfNeeded):
+        (WebCore::InspectorCSSAgent::elementForId):
+        (WebCore::InspectorCSSAgent::didRemoveDocument):
+        (WebCore::InspectorCSSAgent::didRemoveDOMNode):
+        (WebCore::InspectorCSSAgent::resetPseudoStates):
+        * inspector/InspectorCSSAgent.h:
+        (InspectorCSSAgent):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.get this):
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype._setPseudoClassForNodeId):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ElementsTreeOutline.prototype._createNodeDecorators):
+        (WebInspector.ElementsTreeOutline.prototype.updateOpenCloseTags):
+        (WebInspector.ElementsTreeOutline.ElementDecorator):
+        (WebInspector.ElementsTreeOutline.ElementDecorator.prototype.decorate):
+        (WebInspector.ElementsTreeOutline.ElementDecorator.prototype.decorateAncestor):
+        (WebInspector.ElementsTreeOutline.PseudoStateDecorator):
+        (WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype.decorate):
+        (WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype.decorateAncestor):
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        (WebInspector.ElementsTreeElement.prototype._populateForcedPseudoStateItems):
+        (WebInspector.ElementsTreeElement.prototype.updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._createDecoratorElement):
+        (WebInspector.ElementsTreeElement.prototype._updateDecorations):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane):
+        (WebInspector.StylesSidebarPane.prototype.get forcedPseudoClasses):
+        (WebInspector.StylesSidebarPane.prototype._updateForcedPseudoStateInputs):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylesSidebarPane.prototype._refreshUpdate):
+        (WebInspector.StylesSidebarPane.prototype._rebuildUpdate):
+        (WebInspector.StylesSidebarPane.prototype._toggleElementStatePane):
+        (WebInspector.StylesSidebarPane.prototype._createElementStatePane.clickListener):
+        * inspector/front-end/elementsPanel.css:
+        (#elements-content .elements-gutter-decoration):
+        (#elements-content .elements-gutter-decoration.elements-has-decorated-children):
+
+2012-07-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: fix search on the network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=90557
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkLogView.prototype._highlightNthMatchedRequest):
+
+2012-07-04  Kwang Yul Seo  <skyul@company100.net>
+
+        Stop tracking line number in tokenizer
+        https://bugs.webkit.org/show_bug.cgi?id=90544
+
+        Reviewed by Adam Barth.
+
+        Because SegmentedString knows how to track the current line and column,
+        a tokenizer does not need to keep track of the current line by itself.
+        No behavior change, so no new tests.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        (WebCore::HTMLDocumentParser::lineNumber):
+        (WebCore::HTMLDocumentParser::textPosition):
+        * html/parser/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::flushBufferedEndTag):
+        (WebCore):
+        (WebCore::HTMLTokenizer::nextToken):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        * html/track/WebVTTTokenizer.cpp:
+        (WebCore::WebVTTTokenizer::reset):
+        (WebCore::WebVTTTokenizer::nextToken):
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::advanceAndUpdateLineNumberSlowCase):
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedString::advancePastNewlineAndUpdateLineNumber):
+        (WebCore::SegmentedString::advanceAndUpdateLineNumber):
+        (SegmentedString):
+        * xml/parser/MarkupTokenizerBase.h:
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::peek):
+        (WebCore::MarkupTokenizerBase::InputStreamPreprocessor::advance):
+        (WebCore::MarkupTokenizerBase::emitAndResumeIn):
+        (WebCore::MarkupTokenizerBase::emitEndOfFile):
+        (WebCore::MarkupTokenizerBase::reset):
+        (MarkupTokenizerBase):
+        * xml/parser/MarkupTokenizerInlineMethods.h:
+        (WebCore):
+        * xml/parser/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::nextToken):
+
+2012-07-04  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [CMAKE] Add GENERATE_BINDINGS macro to share the codes which use generate-bindings.pl.
+        https://bugs.webkit.org/show_bug.cgi?id=90258
+
+        Reviewed by Rob Buis.
+
+        Use GENERATE_BINDINGS instead of using generate-bindings.pl directly.
+
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * PlatformBlackBerry.cmake:
+
+2012-07-04  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: UISourceCode should take care of adding revision after committing working copy.
+        https://bugs.webkit.org/show_bug.cgi?id=90549
+
+        Reviewed by Pavel Feldman.
+
+        Revision is now added in UISourceCode.commitWorkingCopy synchronously even if saving to JS VM or CSS model failed.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._handleOpenURL):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        (WebInspector.ExtensionServer.prototype._onSetResourceContent):
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype._callOrSetTimeout):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.commitWorkingCopy):
+        * inspector/front-end/Workspace.js:
+        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodeForURL):
+
+2012-07-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: move settings button back to the right.
+        https://bugs.webkit.org/show_bug.cgi?id=90552
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/inspector.css:
+        (button.status-bar-item:active, button.status-bar-item.emulate-active):
+        (button.settings-status-bar-item):
+
+2012-07-04  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Get rid of ResourceDomainModelBinding and DebuggerResourceBinding, make Resource.setContent private.
+        https://bugs.webkit.org/show_bug.cgi?id=90531
+
+        Reviewed by Pavel Feldman.
+
+        Resource.setContent made private. It is delegating now to UISourceCodes which take care of domain specific actions.
+        DebuggerResourceBinding was be removed and DebuggerResourceBinding.setScriptSource was moved to JavaScriptSource.
+        ResourceDomainModelBinding was removed as well.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModelResourceBinding):
+        * inspector/front-end/DebuggerResourceBinding.js: Removed.
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource.prototype.workingCopyCommitted):
+        (WebInspector.JavaScriptSource.prototype._setScriptSource.didEditScriptSource):
+        (WebInspector.JavaScriptSource.prototype._setScriptSource):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._setContent):
+        (WebInspector.Resource.prototype.revertToOriginal):
+        (WebInspector.Resource.prototype.revertAndClearHistory):
+        (WebInspector.ResourceRevision.prototype.revertToThis):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype.isEditable):
+        * inspector/front-end/UISourceCode.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/Workspace.js:
+        (WebInspector.Workspace):
+        * inspector/front-end/inspector.html:
+
+2012-07-04  'Pavel Feldman'  <pfeldman@chromium.org>
+
+        Not reviewed: follow up to r121843, reduce inspector dock timeout to 200ms.
+
+        * inspector/front-end/StatusBarButton.js:
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseDown):
+
+2012-07-04  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Correctly reject accelerated animations with certain rotations.
+        https://bugs.webkit.org/show_bug.cgi?id=89768
+
+        Reviewed by James Robinson.
+
+        UnitTests:
+          GraphicsLayerChromiumTest.createTransformAnimationWithBigRotation
+          GraphicsLayerChromiumTest.createTransformAnimationWithRotationInvolvingNegativeAngles
+          GraphicsLayerChromiumTest.createTransformAnimationWithSmallRotationInvolvingLargeAngles
+
+        * platform/graphics/chromium/AnimationTranslationUtil.cpp:
+        (WebCore::appendKeyframe):
+        (WebCore::isRotationType):
+        (WebCore):
+        (WebCore::causesRotationOfAtLeast180Degrees):
+        (WebCore::CCKeyframedTransformAnimationCurve):
+        (WebCore::createActiveAnimation):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::addAnimation):
+
+2012-07-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: "Dock to right" shouldn't be in the settings dialog
+        https://bugs.webkit.org/show_bug.cgi?id=76917
+
+        Reviewed by Vsevolod Vlasov.
+
+        Introduced 'long click-enabled' options for status bar buttons. Made dock/undock one of them.
+
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/StatusBarButton.js:
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseDown):
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled.mouseUp):
+        (WebInspector.StatusBarButton.prototype.makeLongClickEnabled):
+        (WebInspector.StatusBarButton.prototype._showOptions.mouseOver):
+        (WebInspector.StatusBarButton.prototype._showOptions.mouseOut):
+        (WebInspector.StatusBarButton.prototype._showOptions.mouseUp):
+        (WebInspector.StatusBarButton.prototype._showOptions):
+        * inspector/front-end/UIUtils.js:
+        (WebInspector.elementDragStart):
+        (WebInspector.elementDragEnd):
+        (WebInspector.GlassPane):
+        (WebInspector.GlassPane.prototype.dispose):
+        * inspector/front-end/inspector.css:
+        (.long-click-glyph):
+        (.long-click-glyph.shadow):
+        (button.status-bar-item:active:not(.emulate-inactive), button.status-bar-item.emulate-active):
+        (.alternate-status-bar-buttons-bar):
+        (.alternate-status-bar-buttons-bar .status-bar-item):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector._createDockOptions.onClick.set else):
+        (WebInspector._createDockOptions.onClick):
+
+2012-07-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121813.
+        http://trac.webkit.org/changeset/121813
+        https://bugs.webkit.org/show_bug.cgi?id=90522
+
+        Causes browser_tests failure:
+        ErrorPageTest.DNSError_GoBack2{Forward2,AndForward} on
+        Chromium {Linux,Mac,Win} (Requested by yosin on #webkit).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::commitData):
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject):
+
+2012-07-04  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        [EFL] Change format of return value of navigator.language
+        https://bugs.webkit.org/show_bug.cgi?id=89639
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Remove encoding type from return value of navigator.language.
+        For example, from en-US.UTF-8 to en-US.
+
+        Use exist test case (fast/js/navigator-language.html).
+
+        * platform/efl/LanguageEfl.cpp:
+        (WebCore::platformLanguage):
+
+2012-07-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Don't show accel labels in context menu items
+        https://bugs.webkit.org/show_bug.cgi?id=90437
+
+        Reviewed by Martin Robinson.
+
+        When a context menu item is created with a GtkMenuItem that has
+        been created from a GtkAction, if the action has an accelerator,
+        it's shown in the menu item label, like menu items in a menu
+        bar. In that case we should reset the accel closure of the menu
+        item label, like GtkUIManager does for popup menus, to make sure
+        the accelerator is not shown. This isn't needed for all other
+        ContextMenuIem constructors, because the GtkAction is created
+        without accelerator by webkit in those cases.
+
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::ContextMenuItem::ContextMenuItem):
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Move BatteryClientEfl from WebKit to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90063
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move BatteryClientEfl class from WebKit to WebCore
+        so that it can be reused in WebKit2.
+
+        No new tests, no behavior change.
+
+        * PlatformEfl.cmake:
+        * platform/efl/BatteryClientEfl.cpp: Renamed from Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.cpp.
+        (WebCore):
+        (WebCore::BatteryClientEfl::BatteryClientEfl):
+        (WebCore::BatteryClientEfl::setController):
+        (WebCore::BatteryClientEfl::startUpdating):
+        (WebCore::BatteryClientEfl::stopUpdating):
+        (WebCore::BatteryClientEfl::batteryControllerDestroyed):
+        (WebCore::BatteryClientEfl::setBatteryStatus):
+        (WebCore::BatteryClientEfl::timerFired):
+        (WebCore::BatteryClientEfl::getBatteryStatus):
+        (WebCore::BatteryClientEfl::setBatteryClient):
+        * platform/efl/BatteryClientEfl.h: Renamed from Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.h.
+        (WebCore):
+        (BatteryClientEfl):
+        (WebCore::BatteryClientEfl::~BatteryClientEfl):
+        (WebCore::BatteryClientEfl::batteryStatus):
+
+2012-07-03  Huang Dongsung  <luxtella@company100.net>
+
+        Add a comment in order to clarify why
+        BitmapImage::frameHasAlphaAtIndex returns true as default.
+        https://bugs.webkit.org/show_bug.cgi?id=90445
+
+        Reviewed by Eric Seidel.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::frameHasAlphaAtIndex):
+        (WebCore):
+
+2012-07-03  Alex Sakhartchouk  <alexst@chromium.org>
+
+        [chromium] Avoid calling getUniformLocation??() in the compositor startup
+        https://bugs.webkit.org/show_bug.cgi?id=90217
+
+        Reviewed by Adrienne Walker.
+
+        This change allows chrome compositor to bind uniform locations instead of querying 
+        them from the graphics context by using GL_CHROMIUM_bind_uniform_location.
+
+        The extention itself is tested in chromium and the change in webkit simply adds
+        plumbing to allow its usage. Existing pixel tests would be able to verify proper behaviour.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::initialize):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
+        (WebCore::LayerRendererChromium::solidColorProgram):
+        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
+        (WebCore::LayerRendererChromium::renderPassProgram):
+        (WebCore::LayerRendererChromium::renderPassProgramAA):
+        (WebCore::LayerRendererChromium::renderPassMaskProgram):
+        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
+        (WebCore::LayerRendererChromium::tileProgram):
+        (WebCore::LayerRendererChromium::tileProgramOpaque):
+        (WebCore::LayerRendererChromium::tileProgramAA):
+        (WebCore::LayerRendererChromium::tileProgramSwizzle):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
+        (WebCore::LayerRendererChromium::textureProgram):
+        (WebCore::LayerRendererChromium::textureProgramFlip):
+        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
+        (WebCore::LayerRendererChromium::videoYUVProgram):
+        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (LayerRendererChromium):
+        * platform/graphics/chromium/ProgramBinding.cpp:
+        (WebCore::ProgramBindingBase::ProgramBindingBase):
+        (WebCore::ProgramBindingBase::~ProgramBindingBase):
+        (WebCore::ProgramBindingBase::init):
+        (WebCore::ProgramBindingBase::link):
+        (WebCore):
+        (WebCore::ProgramBindingBase::cleanup):
+        (WebCore::ProgramBindingBase::createShaderProgram):
+        (WebCore::ProgramBindingBase::cleanupShaders):
+        * platform/graphics/chromium/ProgramBinding.h:
+        (ProgramBindingBase):
+        (WebCore::ProgramBinding::initialize):
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::VertexShaderPosTex::init):
+        (WebCore::VertexShaderPosTexYUVStretch::init):
+        (WebCore::VertexShaderPos::init):
+        (WebCore::VertexShaderPosTexTransform::init):
+        (WebCore::VertexShaderQuad::init):
+        (WebCore::VertexShaderTile::init):
+        (WebCore::VertexShaderVideoTransform::init):
+        (WebCore::FragmentTexAlphaBinding::init):
+        (WebCore::FragmentTexOpaqueBinding::init):
+        (WebCore::FragmentShaderOESImageExternal::init):
+        (WebCore::FragmentShaderRGBATexAlphaAA::init):
+        (WebCore::FragmentTexClampAlphaAABinding::init):
+        (WebCore::FragmentShaderRGBATexAlphaMask::init):
+        (WebCore::FragmentShaderRGBATexAlphaMaskAA::init):
+        (WebCore::FragmentShaderYUVVideo::init):
+        (WebCore::FragmentShaderColor::init):
+        (WebCore::FragmentShaderCheckerboard::init):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (VertexShaderPosTex):
+        (VertexShaderPosTexYUVStretch):
+        (VertexShaderPos):
+        (WebCore::VertexShaderPosTexIdentity::init):
+        (VertexShaderPosTexTransform):
+        (VertexShaderQuad):
+        (VertexShaderTile):
+        (VertexShaderVideoTransform):
+        (FragmentTexAlphaBinding):
+        (FragmentTexOpaqueBinding):
+        (FragmentShaderOESImageExternal):
+        (FragmentShaderRGBATexAlphaAA):
+        (FragmentTexClampAlphaAABinding):
+        (FragmentShaderRGBATexAlphaMask):
+        (FragmentShaderRGBATexAlphaMaskAA):
+        (FragmentShaderYUVVideo):
+        (FragmentShaderColor):
+        (FragmentShaderCheckerboard):
+        * platform/graphics/chromium/TextureCopier.cpp:
+        (WebCore::AcceleratedTextureCopier::AcceleratedTextureCopier):
+        (WebCore::AcceleratedTextureCopier::copyTexture):
+        * platform/graphics/chromium/TextureCopier.h:
+        (WebCore::AcceleratedTextureCopier::create):
+        (AcceleratedTextureCopier):
+
+2012-07-03  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Remove enableFasterDOMStoreAccess which is never used
+        https://bugs.webkit.org/show_bug.cgi?id=90489
+
+        Reviewed by Adam Barth.
+
+        No new tests. Dead code removal.
+
+        * bindings/v8/V8DOMMap.cpp:
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+
+2012-07-03  Joshua Bell  <jsbell@chromium.org>
+
+        Binding: IDL type DOMString[] shouldn't match null
+        https://bugs.webkit.org/show_bug.cgi?id=84217
+
+        Reviewed by Kentaro Hara.
+
+        Similar to r121714, IDL overloads with T[] (which is only minimally supported)
+        were being treated as Nullable by default during overloaded method dispatching,
+        which deviates from the WebIDL specification. Extend the previous change to
+        look for Nullable (specified by "?" type suffix in the IDL) for array types.
+
+        Also, after inspection of the spec, use a strict "is this an Array?" test in
+        the JS generator rather than an "inherits from Array.prototype?" test, to
+        match the WebIDL spec.
+
+        IDL files with affected overloads are modified to include the "?" suffix
+        so that no behavior changes are introduced by this patch - the JS and V8
+        generator results before/after the change show no diffs apart from the stricter
+        isJSArray() test.
+
+        Test: bindings/scripts/test/TestObj.idl (a non-Nullable T[] overload)
+
+        * Modules/indexeddb/IDBDatabase.idl: Tag T[] overloads with ? suffix.
+        * Modules/indexeddb/IDBObjectStore.idl: Ditto.
+        * Modules/vibration/NavigatorVibration.idl: Ditto.
+        * bindings/scripts/CodeGeneratorJS.pm: Check isNullable for T[].
+        (GenerateParametersCheckExpression):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateParametersCheckExpression):
+        * bindings/scripts/test/JS/JSTestObj.cpp: Rebaselined.
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
+        * bindings/scripts/test/TestObj.idl: Tag existing T[] with ?, add non-? T[].
+        * bindings/scripts/test/V8/V8TestObj.cpp: Rebaselined.
+        (WebCore::TestObjV8Internal::overloadedMethod9Callback):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::overloadedMethodCallback):
+
+2012-07-03  Nate Chapin  <japhet@chromium.org>
+
+        REGRESSION (r115654): Sometimes does not replace content for multipart/x-mixed-replace
+        https://bugs.webkit.org/show_bug.cgi?id=88436
+
+        Reviewed by Brady Eidson.
+
+        Test: http/tests/multipart/multipart-replace-non-html-content.php
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::commitData): We should only send receivedFirstData() once per main resource load,
+            rather than multiple times in a multipart load. 
+        (WebCore::DocumentLoader::setupForReplaceByMIMEType): m_gotFirstByte isn't set to true until data is
+            actually committed, and multipart data is often not committed until the part is finished. Check
+            whether the SharedBuffer is non-null instead.
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::resetInternalsObject): The JSInternals object my have already been cleared if the window shell
+            was cleared as part of creation of a new Document. Check it before using it.
+
+2012-07-03  Raymond Toy  <rtoy@google.com>
+
+        Add AudioFIFO class and simplify AudioPullFIFO
+        https://bugs.webkit.org/show_bug.cgi?id=90398
+
+        Reviewed by Chris Rogers.
+
+        No new tests. This code will be used in audio back-end implementation.
+
+        Add AudioFIFO class to implement main parts of FIFO.  Simplify
+        implementation of AudioPushFIFO by using AudioFIFO.
+        
+        * WebCore.gypi: Add new files.
+
+        New AudioFIFO class
+        * platform/audio/AudioFIFO.cpp: Copied from Source/WebCore/platform/audio/AudioPullFIFO.cpp.
+        (WebCore):
+        (WebCore::AudioFIFO::AudioFIFO):
+        (WebCore::AudioFIFO::consume):
+        (WebCore::AudioFIFO::push):
+        (WebCore::AudioFIFO::findWrapLengths):
+        * platform/audio/AudioFIFO.h: Copied from Source/WebCore/platform/audio/AudioPullFIFO.h.
+        (WebCore):
+        (AudioFIFO):
+        (WebCore::AudioFIFO::framesInFifo):
+        (WebCore::AudioFIFO::updateIndex):
+
+        Use AudioFIFO
+        * platform/audio/AudioPullFIFO.cpp:
+        (WebCore::AudioPullFIFO::AudioPullFIFO):
+        (WebCore::AudioPullFIFO::consume):
+        (WebCore::AudioPullFIFO::fillBuffer):
+        * platform/audio/AudioPullFIFO.h:
+        (AudioPullFIFO):
+
+2012-07-03  Nate Chapin  <japhet@chromium.org>
+
+        Protect this DocumentThreadableLoader in cancel() to handle reentrancy properly.
+        https://bugs.webkit.org/show_bug.cgi?id=90483
+
+        Reviewed by Abhishek Arya.
+
+        No new tests, covered by http/tests/xmlhttprequest/reentrant-cancel.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::cancel):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * WebCore.gyp/.gitignore:
+
+2012-07-03  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk][Gamepads] 'warning: comparison is always true due to limited range of data type [-Wtype-limits]' in GamepadsGtk.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=90477
+
+        Reviewed by Martin Robinson.
+
+        Vector::find() returns value of type size_t, springing errors when
+        assigning the value to a variable of type unsigned. Use size_t type
+        for that variable instead.
+
+        No new tests - no changed functionality.
+
+        * platform/gtk/GamepadsGtk.cpp:
+        (WebCore::GamepadsGtk::unregisterDevice):
+
+2012-07-03  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        Fix LayoutUnit usage in RenderImage::imageDimensionsChanged
+        https://bugs.webkit.org/show_bug.cgi?id=90173
+
+        Reviewed by Eric Seidel.
+
+        The appropriate type should be used for storing width() and height() into local temporary variables.
+
+        No new tests, no change in behavior.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageDimensionsChanged):
+
+2012-07-03  Sergio Villar Senin  <svillar@igalia.com>
+
+        [TextureMapper] Typo in edge-distance anti-aliasing code
+        https://bugs.webkit.org/show_bug.cgi?id=90475
+
+        Reviewed by Martin Robinson.
+
+        No new tests. This just fixes a typo.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawQuad):
+
+2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Extensions API] Resource manipulations should be based on UISourceCode thus extending Sources Panel.
+        https://bugs.webkit.org/show_bug.cgi?id=89868
+
+        Reviewed by Pavel Feldman.
+
+        Extensions API is now based on both ScriptsPanel acting as a UISourceCodeProvider and ResourceTreeModel.
+        Extensions API resource could be for any content provider now.
+        Extensions API resource.setContent implementation is now based on UISourceCode editing methods.
+        Drive-by StyleSource insremental editing timeout fix.
+
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._handleOpenURL):
+        (WebInspector.ExtensionServer.prototype._makeResource):
+        (WebInspector.ExtensionServer.prototype._onGetPageResources):
+        (WebInspector.ExtensionServer.prototype._getResourceContent):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        (WebInspector.ExtensionServer.prototype._onSetResourceContent):
+        (WebInspector.ExtensionServer.prototype._notifyResourceAdded):
+        (WebInspector.ExtensionServer.prototype._notifyResourceContentCommitted):
+        * inspector/front-end/JavaScriptSource.js:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.uiSourceCodes):
+        (WebInspector.ScriptsPanel.prototype.uiSourceCodeForURL):
+        (WebInspector.ScriptsPanel.prototype._addUISourceCode):
+        (WebInspector.ScriptsPanel.prototype._reset):
+        (WebInspector.ScriptsPanel.prototype.canShowAnchorLocation):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype.workingCopyCommitted):
+        (WebInspector.StyleSource.prototype.workingCopyChanged):
+        (WebInspector.StyleSource.prototype._callOrSetTimeout):
+        (WebInspector.StyleSource.prototype._commitIncrementalEdit):
+        (WebInspector.StyleSource.prototype._clearIncrementalUpdateTimer):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode.prototype.requestContent):
+        (WebInspector.UISourceCode.prototype.workingCopy):
+        (WebInspector.UISourceCode.prototype.setWorkingCopy):
+        (WebInspector.UISourceCode.prototype.isDirty):
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Anonymous scripts (evals) should not be added to Workspace.
+        https://bugs.webkit.org/show_bug.cgi?id=90467
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ResourceScriptMapping.js:
+        (WebInspector.ResourceScriptMapping.prototype.rawLocationToUILocation):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeAdded):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeReplaced):
+        (WebInspector.ResourceScriptMapping.prototype._uiSourceCodeRemoved):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype._createUISourceCodeForScript):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._uiSourceCodeAdded):
+
+2012-07-03  Robert Hogan  <robert@webkit.org>
+
+        CSS 2.1 failure: floats-wrap-top-below-inline-* fail
+        https://bugs.webkit.org/show_bug.cgi?id=88171
+
+        Reviewed by Eric Seidel.
+
+        When shifting a line or element left or right to avoid a float use the height
+        of the line or element to determine whether the float is inside the element or
+        if it overlaps the bottom of the element. 
+
+        Do this by passing the height of the element to the interval tree used to detect
+        the overlap with it's containing block's floats. The height is zero by default so
+        callers to logical[Left|Right]OffsetForLine will need to pass the height if they
+        want to use it to detect floats to avoid.
+
+        Tests: css2.1/20110323/floats-wrap-top-below-bfc-001l.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-001r.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-002l.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-002r.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-003l.htm
+               css2.1/20110323/floats-wrap-top-below-bfc-003r.htm
+               css2.1/20110323/floats-wrap-top-below-inline-001l.htm
+               css2.1/20110323/floats-wrap-top-below-inline-001r.htm
+               css2.1/20110323/floats-wrap-top-below-inline-002l.htm
+               css2.1/20110323/floats-wrap-top-below-inline-002r.htm
+               css2.1/20110323/floats-wrap-top-below-inline-003l.htm
+               css2.1/20110323/floats-wrap-top-below-inline-003r.htm
+               css2.1/20110323/floats-zero-height-wrap-001.htm
+               css2.1/20110323/floats-zero-height-wrap-002.htm
+               fast/block/float/floats-wrap-inside-inline-001.htm
+               fast/block/float/floats-wrap-inside-inline-002.htm
+               fast/block/float/floats-wrap-inside-inline-003.htm
+               fast/block/float/floats-wrap-inside-inline-004.htm
+               fast/block/float/floats-wrap-inside-inline-005.htm
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
+        (WebCore::::collectIfNeeded):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::getClearDelta):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::availableLogicalWidthForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::startOffsetForLine):
+        (WebCore::RenderBlock::endOffsetForLine):
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine):
+        (WebCore::RenderBlock::pixelSnappedLogicalRightOffsetForLine):
+        (RenderBlock):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::FloatIntervalSearchAdapter):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::lowValue):
+        (WebCore::RenderBlock::FloatIntervalSearchAdapter::highValue):
+        (FloatIntervalSearchAdapter):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::logicalBottomForLine):
+        (WebCore):
+        (WebCore::LineWidth::updateAvailableWidth):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Introduce Workspace make it UISourceCode provider for ScriptsPanel.
+        https://bugs.webkit.org/show_bug.cgi?id=90466
+
+        Reviewed by Pavel Feldman.
+
+        Introduced WebInspector.Workspace as a model (UISourceCode provider) behind ScriptsPanel.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/Workspace.js: Added.
+        (WebInspector.CompositeUISourceCodeProvider):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._registerUISourceCodeProvider):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeAdded):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeReplaced):
+        (WebInspector.CompositeUISourceCodeProvider.prototype._handleUISourceCodeRemoved):
+        (WebInspector.CompositeUISourceCodeProvider.prototype.uiSourceCodes):
+        (WebInspector.Workspace):
+        (WebInspector.Workspace.prototype.registerUISourceCodeProvider):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri:
+        * WebCore.pri:
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121766.
+        http://trac.webkit.org/changeset/121766
+        https://bugs.webkit.org/show_bug.cgi?id=90465
+
+        It caused flakey build errors on the bots (Requested by Ossy
+        on #webkit).
+
+        * DerivedSources.pri:
+        * WebCore.pri:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable Custom Scheme Handlers for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * page/NavigatorRegisterProtocolHandler.cpp:
+        (WebCore::initProtocolHandlerWhitelist): Disable the overrides as
+                                                 they're undesired by BlackBerry
+
+2012-07-03  Eugene Klyuchnikov  <eustas.bug@gmail.com>
+
+        Web Inspector: Forward message loop instrumentation data to frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=89584
+
+        Reviewed by Yury Semikhatsky.
+
+        Transmit collected message loop tasks to inspector frontend.
+        Now "Program" should be a top-level event on browsers that
+        support message loop instrumentation.
+        Frontend was changed so that user will not see any changes.
+
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        Added new event type - "Program"
+        (WebCore::InspectorTimelineAgent::willProcessTask):
+        Begin "Program" event.
+        (WebCore::InspectorTimelineAgent::didProcessTask):
+        Finish "Program" event.
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        Do not add counters to "Program" events.
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::innerSetHeapSizeStatistic):
+        Renamed from "setHeapSizeStatistic"
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._onRecordAdded):
+        Unwraps "Program" events.
+        (WebInspector.MemoryStatistics.prototype._innerRecordAdded):
+        Renamed from "_onRecordAdded"
+        * inspector/front-end/TimelineFrameController.js:
+        (WebInspector.TimelineFrameController.prototype._addRecord):
+        Unwraps "Program" events.
+        (WebInspector.TimelineFrameController.prototype._innerAddRecord):
+        Renamed from "_addRecord"
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineCategoryStrips.prototype.update.appendRecord):
+        Filter out "Program" category.
+        (WebInspector.TimelineCategoryStrips.prototype.update):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        Filter out "Program" category.
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        Unwraps "Program" events.
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.categories):
+        Added "Program" category.
+        (WebInspector.TimelinePresentationModel.recordStyle):
+        Ditto.
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        Unwraps "Program" events.
+        (WebInspector.TimelinePresentationModel.prototype._addRecord):
+        Renamed from "addRecord"
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri:
+        * WebCore.pri:
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        inspector/debugger/script-snippet-model.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=90385
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptSnippetModel.js:
+
+2012-07-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        [REGRESSION] Crash when copying a StyleRuleMedia with a NULL m_mediaQueries
+        https://bugs.webkit.org/show_bug.cgi?id=90459
+
+        Reviewed by Andreas Kling.
+
+        Create StyleRuleMedia with a non-NULL MediaQuerySet. The respective NULL checks for it were all over the code,
+        except the copy constructor. Added the check, just in case.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createMediaRule):
+        * css/StyleRule.cpp:
+        (WebCore::StyleRuleMedia::StyleRuleMedia):
+
+2012-07-03  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: display time intervals measured with console.time() and console.timeEnd() in Timeline
+        https://bugs.webkit.org/show_bug.cgi?id=90442
+
+        Reviewed by Pavel Feldman.
+
+        - added Time and TimeEnd record types produced by console.time() and console.timeEnd()
+        - connect Time to TimeEnd in "glue" mode to better visualize the interval;
+        - always make Time a top-level record;
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::startConsoleTimingImpl):
+        (WebCore::InspectorInstrumentation::stopConsoleTimingImpl):
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        (WebCore::InspectorTimelineAgent::didStartTiming):
+        (WebCore):
+        (WebCore::InspectorTimelineAgent::didStopTiming):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.recordStyle):
+        (WebInspector.TimelinePresentationModel.categoryForRecord):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        (WebInspector.TimelinePresentationModel.prototype._findParentRecord):
+        (WebInspector.TimelinePresentationModel.Record):
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
 
         [Qt][Win] Fix broken QtWebKit5.lib linking
         https://bugs.webkit.org/show_bug.cgi?id=88321
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Kenneth Rohde Christiansen.
 
         * platform/PlatformExportMacros.h:
 
+2012-07-03  Philip Rogers  <pdr@google.com>
+
+        Fix text positioning with non-bmp characters.
+        https://bugs.webkit.org/show_bug.cgi?id=87681
+
+        Reviewed by Nikolas Zimmermann.
+
+        Previously when constructing metrics for tspans with non-bmp characters,
+        each non-bmp character treated as a skipped character in the same way that
+        spaces are ignored.
+        This made sense because the initial SVGCharacterDataMap for <text> is
+        indexed by character index (not string length) so the high portion of a
+        non-bmp character was treated as a skipped space. Unfortunately, this
+        led to a bug because skipped spaces lead to an offset in the positioning
+        values list but non-bmp characters do not.
+
+        This change switches the code to use a new offset for non-bmp characters,
+        surrogatePairCharacters, which does not affect the positioning values list.
+
+        Tests: svg/text/non-bmp-tspans-expected.svg
+               svg/text/non-bmp-tspans.svg
+
+        * rendering/svg/SVGTextMetricsBuilder.cpp:
+        (WebCore::SVGTextMetricsBuilder::measureTextRenderer):
+
+2012-07-03  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Improve test cases for network information APIs
+        https://bugs.webkit.org/show_bug.cgi?id=90162
+
+        Reviewed by Adam Barth.
+
+        Existing implementation doesn't test port implementation in network info APIs.
+        This patch lets test cases use bandwidth and metered functions implemented by port layer.
+
+        In addition, expected results need to check return type instead of property name.
+
+        No new tests. Covered by existing tests.
+
+        * Modules/networkinfo/NetworkInfoConnection.cpp:
+        (WebCore::NetworkInfoConnection::bandwidth):
+        (WebCore::NetworkInfoConnection::metered):
+
+2012-07-03  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] [WK2] Don't call eina_iterator_free() if iterator is NULL
+        https://bugs.webkit.org/show_bug.cgi?id=90076
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add a null check to prevent calling eina_iterator_free() when
+        iterator is NULL.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/efl/FileSystemEfl.cpp:
+        (WebCore::listDirectory): Early return when iterator is NULL.
+
+2012-07-03  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Elements] Text formatting is not retained when editing <script> or <style> contents as text
+        https://bugs.webkit.org/show_bug.cgi?id=90440
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._startEditingTextNode):
+
+2012-07-03  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Save scroll selection and cursor position of SourceFrames in sources panel.
+        https://bugs.webkit.org/show_bug.cgi?id=90294
+
+        Reviewed by Yury Semikhatsky.
+
+        Scroll and selection change handling is now delegated from TextViewer to SourceFrame.
+        SourceFrame now dispatches ScrollChanged and SelectionChanged events.
+        TabbedEditorContainer now saves scroll and selection information together
+        with the url history and restores scroll and selection on resource opening.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.wasShown):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._innerHighlightLineIfNeeded):
+        (WebInspector.SourceFrame.prototype._clearLineHighlight):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._innerRevealLineIfNeeded):
+        (WebInspector.SourceFrame.prototype._clearLineToReveal):
+        (WebInspector.SourceFrame.prototype.scrollToLine):
+        (WebInspector.SourceFrame.prototype._innerScrollToLineIfNeeded):
+        (WebInspector.SourceFrame.prototype._clearLineToScrollTo):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype._innerSetSelectionIfNeeded):
+        (WebInspector.SourceFrame.prototype._wasShownOrLoaded):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.commitEditing):
+        (WebInspector.SourceFrame.prototype.selectionChanged):
+        (WebInspector.SourceFrame.prototype.scrollChanged):
+        (WebInspector.TextViewerDelegateForSourceFrame.prototype.selectionChanged):
+        (WebInspector.TextViewerDelegateForSourceFrame.prototype.scrollChanged):
+        * inspector/front-end/TabbedEditorContainer.js:
+        (WebInspector.TabbedEditorContainer):
+        (WebInspector.TabbedEditorContainer.prototype._addScrollAndSelectionListeners):
+        (WebInspector.TabbedEditorContainer.prototype._removeScrollAndSelectionListeners):
+        (WebInspector.TabbedEditorContainer.prototype._scrollChanged):
+        (WebInspector.TabbedEditorContainer.prototype._selectionChanged):
+        (WebInspector.TabbedEditorContainer.prototype._appendFileTab):
+        (WebInspector.TabbedEditorContainer.prototype._tabClosed):
+        (WebInspector.TabbedEditorContainer.HistoryItem):
+        (WebInspector.TabbedEditorContainer.HistoryItem.fromObject):
+        (WebInspector.TabbedEditorContainer.HistoryItem.prototype.serializeToObject):
+        (WebInspector.TabbedEditorContainer.History):
+        (WebInspector.TabbedEditorContainer.History.fromObject):
+        (WebInspector.TabbedEditorContainer.History.prototype.index):
+        (WebInspector.TabbedEditorContainer.History.prototype.selectionRange):
+        (WebInspector.TabbedEditorContainer.History.prototype.updateSelectionRange):
+        (WebInspector.TabbedEditorContainer.History.prototype.scrollLineNumber):
+        (WebInspector.TabbedEditorContainer.History.prototype.updateScrollLineNumber):
+        (WebInspector.TabbedEditorContainer.History.prototype.update):
+        (WebInspector.TabbedEditorContainer.History.prototype.remove):
+        (WebInspector.TabbedEditorContainer.History.prototype.save):
+        (WebInspector.TabbedEditorContainer.History.prototype.set _serializeToObject):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextRange.fromObject):
+        (WebInspector.TextRange.prototype.clone):
+        (WebInspector.TextRange.prototype.serializeToObject):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._handleScrollChanged):
+        (WebInspector.TextViewer.prototype.scrollToLine):
+        (WebInspector.TextViewer.prototype._handleSelectionChange):
+        (WebInspector.TextViewer.prototype.setSelection):
+        (WebInspector.TextViewer.prototype.wasShown):
+        (WebInspector.TextViewer.prototype._handleFocused):
+        (WebInspector.TextViewer.prototype.willHide):
+        (WebInspector.TextViewerDelegate.prototype.selectionChanged):
+        (WebInspector.TextViewerDelegate.prototype.scrollChanged):
+        (WebInspector.TextEditorChunkedPanel.prototype.scrollToLine):
+
+2012-07-03  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Make DirectoryContentView sortable
+        https://bugs.webkit.org/show_bug.cgi?id=90361
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        * inspector/front-end/DirectoryContentView.js:
+        (WebInspector.DirectoryContentView):
+        (WebInspector.DirectoryContentView.prototype.showEntries):
+        (WebInspector.DirectoryContentView.prototype._sort):
+        (WebInspector.DirectoryContentView.Node.comparator.isDirectoryCompare):
+        (WebInspector.DirectoryContentView.Node.comparator.nameCompare):
+        (WebInspector.DirectoryContentView.Node.comparator.typeCompare):
+        (WebInspector.DirectoryContentView.Node.comparator.sizeCompare):
+        (WebInspector.DirectoryContentView.Node.comparator):
+        (WebInspector.DirectoryContentView.Node.prototype._metadataReceived):
+
+2012-07-03  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: WebInspector.TextViewer should be renamed WebInspector.TextEditor
+        https://bugs.webkit.org/show_bug.cgi?id=89939
+
+        Reviewed by Vsevolod Vlasov.
+
+        Fixed LayoutTests and PerformanceTests accordingly.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/AdvancedSearchController.js:
+        (WebInspector.SearchView):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame):
+        (WebInspector.JavaScriptSourceFrame.prototype._onHidePopover):
+        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition.finishEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        (WebInspector.JavaScriptSourceFrame.prototype.clearExecutionLine):
+        (WebInspector.JavaScriptSourceFrame.prototype.onTextEditorContentLoaded):
+        (WebInspector.JavaScriptSourceFrame.prototype.toggleBreakpointOnCurrentLine):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype.wasShown):
+        (WebInspector.SourceFrame.prototype.willHide):
+        (WebInspector.SourceFrame.prototype.defaultFocusedElement):
+        (WebInspector.SourceFrame.prototype.get textEditor):
+        (WebInspector.SourceFrame.prototype.clearMessages):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._clearLineHighlight):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype.setContent):
+        (WebInspector.SourceFrame.prototype.onTextEditorContentLoaded):
+        (WebInspector.SourceFrame.prototype._setTextEditorDecorations):
+        (WebInspector.SourceFrame.prototype.searchCanceled):
+        (WebInspector.SourceFrame.prototype.jumpToSearchResult):
+        (WebInspector.SourceFrame.prototype.addMessageToSource):
+        (WebInspector.SourceFrame.prototype.removeMessageFromSource):
+        (WebInspector.SourceFrame.prototype.inheritScrollPositions):
+        (WebInspector.TextEditorDelegateForSourceFrame):
+        * inspector/front-end/TextViewer.js: Removed.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/textViewer.css: Removed.
+
+2012-07-03  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
+        https://bugs.webkit.org/show_bug.cgi?id=88338
+
+        Reviewed by David Levin.
+
+        If the indexedDB runs in main thread it can access the GroupSettings via the document;
+        otherwise, we need to pass the page GroupSettings to the worker thread so that accessible
+        to the indexedDB running in WorkerContext. 
+
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        * workers/DedicatedWorkerThread.h:
+        (DedicatedWorkerThread):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::groupSettings):
+        (WebCore):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/SharedWorkerThread.h:
+        (SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WorkerThreadStartupData):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::groupSettings):
+        (WebCore):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-07-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] fast/viewport/viewport-91.html still fails after r121555 and r121661
+        https://bugs.webkit.org/show_bug.cgi?id=90376
+
+        Reviewed by Csaba Osztrogonác.
+
+        No new tests, this is only a build alignment.
+
+        Export ViewportArguments::deprecatedTargetDPI since it is used in WebKit2.
+        * WebCore.exp.in:
+
+2012-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [TextureMapper] The TextureMapper should support edge-distance anti-antialiasing
+        https://bugs.webkit.org/show_bug.cgi?id=90308
+
+        Reviewed by Noam Rosenthal.
+
+        Add an edge-distance anti-aliasing implementation for the TextureMapper. Currently
+        this implementation is not active for tiled layers. This implementation is based
+        on the one in the Chromium compositor originally written by David Raveman.
+
+        When a layer is transformed in a way that leaves its edge dimensions across pixel
+        boundaries, edge distance anti-aliasing will do a cheaper form of anti-aliasing
+        than full-scene anti-aliasing to make the transition from the layer pixel
+        to the background pixel smoother.
+
+        No new tests. This will be covered by pixel tests for Qt and GTK+ accelerated
+        compositing and 3D transforms, when those test harnesses are capable of
+        producing pixel output (in progress).
+
+        * platform/graphics/texmap/TextureMapper.h: Add an enum which is used to tell
+        the texture mapper what edges of a texture are exposed. This will be used for
+        properly dealing with tiled layers in the future.
+        * platform/graphics/texmap/TextureMapperBackingStore.cpp: Properly pass information
+        about exposed layer edges to the TextureMapper while painting.
+        * platform/graphics/texmap/TextureMapperBackingStore.h:
+        (TextureMapperTile): Modified arguments include exposed edges.
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawQuad): Renamed from drawRect, this method can now
+        draw quads that have non unit-rect texture coordinates. This is necessary because
+        the edge distance approach draws such quad.
+        (WebCore::TextureMapperGL::drawBorder): Call drawQuad now instead of drawRect.
+        (WebCore::TextureMapperGL::drawTexture): Pass the exposedEdges argument down.
+        (WebCore::TextureMapperGL::drawTextureRectangleARB): Call drawQuad now instead of
+        drawRect.
+        (WebCore::viewportMatrix): Added this helper which can calculate the viewport
+        transform based on the current OpenGL viewport settings.
+        (WebCore::scaleLineEquationCoeffecientsToOptimizeDistanceCalculation): Added this
+        helper which optimizes the fragment shader by precalculating some constant parts
+        of the distance calculation.
+        (WebCore::getStandardEquationCoeffecientsForLine): Given two end points of line segment
+        get the coeffecients of the line in the standard form of the line equation.
+        (WebCore::quadToEdgeArray): Converts a FloatQuad to an array of four sets of pre-scaled
+        line coefficients so that they can be passed to OpenGL.
+        (WebCore::scaledVectorDifference): Helper which helps expand a quad of arbitrary
+        orientation.
+        (WebCore::inflateQuad): Inflate a quad of arbitrary orientation. The transform may
+        flip it so we have to look at neighboring points to expand the quad.
+        (WebCore::TextureMapperGL::drawTextureWithAntialiasing): Activate the anti-aliasing
+        program and set up all uniforms.
+        (WebCore::TextureMapperGL::drawTexturedQuadWithProgram): Abstract out common operations
+        from drawTexture to be used with drawTextureWithAntialiasing.
+        * platform/graphics/texmap/TextureMapperGL.h:
+        (WebCore::TextureMapperGL::DrawQuad::DrawQuad): Add this small type which stores information
+        necessary to draw a quad -- it's original destination rect and the final size mapped to
+        texture coordinates.
+        (TextureMapperGL):
+        * platform/graphics/texmap/TextureMapperImageBuffer.cpp: Add the new exposedEdges argument.
+        * platform/graphics/texmap/TextureMapperImageBuffer.h: Ditto.
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp: Add the new fragment shader for
+        doing edge-distance AA and a program which uses that shader.
+        * platform/graphics/texmap/TextureMapperShaderManager.h: Ditto.
+
+2012-07-02  Dan Bernstein  <mitz@apple.com>
+
+        Column height and count calculation ignores most overflow
+        https://bugs.webkit.org/show_bug.cgi?id=90392
+
+        Reviewed by Dean Jackson.
+
+        Test: fast/multicol/overflow-content.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::relayoutForPagination): Changed to compute the overflow from children
+        and use the layout overflow height rather the content height.
+
+2012-07-02  Chris Guan  <chris.guan@torchmobile.com.cn>
+
+        [BlackBerry] Refactor : move the implementation of getMIMETypeForExtension and getPreferredExtensionForMIMEType into BlackBerry platform
+        https://bugs.webkit.org/show_bug.cgi?id=90360
+
+        Reviewed by Antonio Gomes.
+
+        We should have one implementation for getMIMETypeForExtension
+        and getPreferredExtensionForMIMEType for both webkit and platform,
+        so I move this implementation to BlackBerry platform.
+        
+        No new test cases , because no behavior changed.
+
+        * platform/blackberry/MIMETypeRegistryBlackBerry.cpp:
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+
+2012-07-02  Emil A Eklund  <eae@chromium.org>
+
+        Position replaced elements on pixel bounds
+        https://bugs.webkit.org/show_bug.cgi?id=90354
+
+        Reviewed by Eric Seidel.
+
+        To avoid sizing and repaint issues we should layout replaced elements on
+        pixel bounds. We already ensure that replaced elements are sized in full
+        pixels and that they are painted on pixel bounds. By also ensuring that
+        they are placed on pixel bounds we avoid pixel having the size be
+        expanded by pixel snapping and repainting/invalidation rect issues when
+        scrolling.
+
+        Test: fast/repaint/repaint-during-scroll-with-zoom.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+
+2012-07-02  Nico Weber  <thakis@chromium.org>
+
+        Fix new -Wunused-private-field violations
+        https://bugs.webkit.org/show_bug.cgi?id=90417
+
+        Reviewed by Ryosuke Niwa.
+
+        No intended behavior change.
+
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp:
+        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h:
+        (CCPrioritizedTextureManager):
+
+2012-07-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Build fix for Chromimum
+
+        r121710 removed WebCore/platform/qt/GraphicsLayerQt.{cpp,h}.
+        However, that patch didn't remove them from WebCore.gypi.
+
+        * WebCore.gypi: Removed GraphicsLayerQt.{cpp,h}
+
+2012-07-02  Joshua Bell  <jsbell@chromium.org>
+
+        IDL overloads should not treat wrapper types as nullable by default
+        https://bugs.webkit.org/show_bug.cgi?id=90218
+
+        Reviewed by Kentaro Hara.
+
+        Wrapper types were being treated as Nullable by default during overloaded
+        method dispatching, which deviates from the WebIDL specification. This change
+        introduces the "?" type suffix into the parser, and treats wrapper types
+        only nullable if specified. (The behavior of array types and other non-wrapper
+        types are not changed, and only overloaded methods are checked.)
+
+        IDL files with affected overloads are modified to include the "?" suffix
+        so that no behavior changes are introduced by this patch - the JS and V8
+        generator results before/after the change show no diffs.
+
+        Test: bindings/scripts/test/TestObj.idl (a non-nullable overload)
+
+        * Modules/indexeddb/IDBDatabase.idl: Added "?" where necessary.
+        * Modules/indexeddb/IDBIndex.idl: Added "?" where necessary.
+        * Modules/indexeddb/IDBObjectStore.idl: Added "?" where necessary.
+        * Modules/webaudio/AudioContext.idl: Added "?" where necessary.
+        * Modules/webaudio/AudioNode.idl: Added "?" where necessary.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateParametersCheckExpression): Add isNullable check.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateParametersCheckExpression): Add isNullable check.
+        * bindings/scripts/IDLParser.pm: Parse/set isNullable.
+        (parseParameters):
+        * bindings/scripts/IDLStructure.pm: Add basic type suffix parsing.
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
+        (WebCore):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
+        * bindings/scripts/test/TestObj.idl: Mark previous overload params with ?, add new one without.
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjV8Internal::overloadedMethod8Callback):
+        (TestObjV8Internal):
+        (WebCore::TestObjV8Internal::overloadedMethodCallback):
+        * dom/DataTransferItemList.idl: Added "?" where necessary.
+        * fileapi/WebKitBlobBuilder.idl: Added "?" where necessary.
+        * html/DOMURL.idl: Added "?" where necessary.
+        * html/canvas/CanvasRenderingContext2D.idl: Added "?" where necessary.
+        * html/canvas/WebGLRenderingContext.idl: Added "?" where necessary.
+
+2012-07-02  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Get rid of GraphicsLayerQt
+        https://bugs.webkit.org/show_bug.cgi?id=78598
+
+        Reviewed by Luiz Agostini.
+
+        Remove GraphicsLayerQt.h/cpp, as well as references to the non-TextureMapper code paths
+        in GraphicsContext3DQt and MediaPlayerPrivateQt.
+
+        No new tests, removing unused code paths.
+
+        * Target.pri:
+        * platform/graphics/PlatformLayer.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (GraphicsContext3DPrivate):
+        (WebCore):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore):
+        * platform/graphics/qt/GraphicsLayerQt.cpp: Removed.
+        * platform/graphics/qt/GraphicsLayerQt.h: Removed.
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        (MediaPlayerPrivateQt):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::platformStart):
+
+2012-07-02  Behdad Esfahbod  <behdad@behdad.org>
+
+        LayoutUnit::epsilon() is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=90083
+
+        Reviewed by Eric Seidel.
+
+        Do division in floats, not integers.
+
+        No new tests. No code using the affected function.
+
+        * platform/FractionalLayoutUnit.h:
+        (WebCore::FractionalLayoutUnit::epsilon):
+
+2012-07-02  Tim Horton  <timothy_horton@apple.com>
+
+        Compositing layer sync should cause deferred repaints to be fired immediately
+        https://bugs.webkit.org/show_bug.cgi?id=90401
+        <rdar://problem/11792028>
+
+        Reviewed by Simon Fraser and Antti Koivisto.
+
+        If we sync compositing layers and allow the repaint to be deferred, there is time for a
+        visible flash to occur. Instead, stop the deferred repaint timer and repaint immediately.
+
+        No new tests, configuration and timing dependent.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::syncCompositingStateForThisFrame):
+        (WebCore::FrameView::checkStopDelayingDeferredRepaints):
+        (WebCore::FrameView::stopDelayingDeferredRepaints): Split off from checkStopDelayingDeferredRepaints.
+        * page/FrameView.h:
+        (FrameView): Add stopDelayingDeferredRepaints.
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        Initializating of the logging channels was taking time on startup. When logging is disabled
+        (and the LOG macro does nothing), we should aslo disable logging channels and initialization.
+
+        This patch #ifdef the Logging initialization with the macro LOG_DISABLED.
+
+        * WebCore.exp.in:
+        * make-export-file-generator: Explicitely adds Assertions.h so that LOG_DISABLED is defined.
+        * platform/Logging.cpp:
+        * platform/Logging.h:
+        * platform/blackberry/LoggingBlackBerry.cpp:
+        * platform/efl/LoggingEfl.cpp:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/mac/LoggingMac.mm:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+        * platform/qt/LoggingQt.cpp:
+        * platform/win/LoggingWin.cpp:
+        * platform/wx/LoggingWx.cpp:
+
+2012-07-02  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11787030> In vertical writing modes, child following float-clearing block has incorrect logical top
+        https://bugs.webkit.org/show_bug.cgi?id=90359
+
+        Reviewed by Anders Carlsson.
+
+        Test: fast/writing-mode/logical-height-after-clear.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloatsIfNeeded): Changed to use logicalTop() and logicalHeight()
+        instead of y() and height().
+
+2012-07-02  Arko Saha  <arko@motorola.com>
+
+        Microdata: Fix build failure after r121580.
+        https://bugs.webkit.org/show_bug.cgi?id=90378
+
+        Reviewed by Ryosuke Niwa.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::properties):
+        * html/HTMLElement.h:
+
+2012-07-02  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: Update MediaStreamTrackList to match the specification
+        https://bugs.webkit.org/show_bug.cgi?id=90171
+
+        Reviewed by Adam Barth.
+
+        The latest update to the specification added add and remove methods with corresponding callbacks.
+        The callbacks can be triggered both from JS and from the platform layer.
+
+        Test: fast/mediastream/MediaStreamTrackList.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/mediastream/MediaStream.cpp:
+        (WebCore::MediaStream::MediaStream):
+        (WebCore::MediaStream::~MediaStream):
+        (WebCore::MediaStream::streamEnded):
+        (WebCore::MediaStream::addTrack):
+        (WebCore):
+        (WebCore::MediaStream::removeTrack):
+        * Modules/mediastream/MediaStream.h:
+        (MediaStream):
+        * Modules/mediastream/MediaStreamTrackEvent.cpp: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp.
+        (WebCore):
+        (WebCore::MediaStreamTrackEvent::create):
+        (WebCore::MediaStreamTrackEvent::MediaStreamTrackEvent):
+        (WebCore::MediaStreamTrackEvent::~MediaStreamTrackEvent):
+        (WebCore::MediaStreamTrackEvent::track):
+        (WebCore::MediaStreamTrackEvent::interfaceName):
+        * Modules/mediastream/MediaStreamTrackEvent.h: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.h.
+        (WebCore):
+        (MediaStreamTrackEvent):
+        * Modules/mediastream/MediaStreamTrackEvent.idl: Copied from Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl.
+        * Modules/mediastream/MediaStreamTrackList.cpp:
+        (WebCore::MediaStreamTrackList::create):
+        (WebCore::MediaStreamTrackList::MediaStreamTrackList):
+        (WebCore::MediaStreamTrackList::detachOwner):
+        (WebCore):
+        (WebCore::MediaStreamTrackList::add):
+        (WebCore::MediaStreamTrackList::remove):
+        (WebCore::MediaStreamTrackList::stop):
+        (WebCore::MediaStreamTrackList::interfaceName):
+        (WebCore::MediaStreamTrackList::scriptExecutionContext):
+        (WebCore::MediaStreamTrackList::eventTargetData):
+        (WebCore::MediaStreamTrackList::ensureEventTargetData):
+        * Modules/mediastream/MediaStreamTrackList.h:
+        (MediaStreamTrackList):
+        * Modules/mediastream/MediaStreamTrackList.idl:
+        * WebCore.gypi:
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventNames.in:
+        * dom/EventTargetFactory.in:
+        * platform/mediastream/MediaStreamCenter.cpp:
+        (WebCore::MediaStreamCenter::addMediaStreamTrack):
+        (WebCore):
+        (WebCore::MediaStreamCenter::removeMediaStreamTrack):
+        * platform/mediastream/MediaStreamCenter.h:
+        (MediaStreamCenter):
+        * platform/mediastream/MediaStreamDescriptor.h:
+        (MediaStreamDescriptorOwner):
+        * platform/mediastream/chromium/MediaStreamCenterChromium.cpp:
+        (WebCore::MediaStreamCenterChromium::didAddMediaStreamTrack):
+        (WebCore):
+        (WebCore::MediaStreamCenterChromium::didRemoveMediaStreamTrack):
+        (WebCore::MediaStreamCenterChromium::addMediaStreamTrack):
+        (WebCore::MediaStreamCenterChromium::removeMediaStreamTrack):
+        * platform/mediastream/chromium/MediaStreamCenterChromium.h:
+        (WebKit):
+        (MediaStreamCenterChromium):
+        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp:
+        (WebCore::MediaStreamCenterGStreamer::didAddMediaStreamTrack):
+        (WebCore):
+        (WebCore::MediaStreamCenterGStreamer::didRemoveMediaStreamTrack):
+        * platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h:
+        (MediaStreamCenterGStreamer):
+
+2012-07-02  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: incorrect height of main timeline pane after switching to memory mode
+        https://bugs.webkit.org/show_bug.cgi?id=90387
+
+        Reviewed by Pavel Feldman.
+
+        - update cached container height when setting vertical splitter position.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.set _setSplitterPosition):
+
+2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [MICRODATA] Build failure in html/HTMLPropertiesCollection.h
+        https://bugs.webkit.org/show_bug.cgi?id=90379
+
+        Reviewed by Ryosuke Niwa.
+
+        Switch HTMLCollection::append() visibility from private
+        to protected so that HTMLPropertiesCollection subclass
+        can call it. This fixes build when MICRODATA flag is
+        turned on.
+
+        No new tests, build fix.
+
+        * html/HTMLCollection.h:
+        (HTMLCollectionCacheBase):
+
+2012-07-02  Kwang Yul Seo  <skyul@company100.net>
+
+        A start "body" tag in the "in body" insertion mode is a parse error
+        https://bugs.webkit.org/show_bug.cgi?id=90373
+
+        Reviewed by Eric Seidel.
+
+        According to HTML5 specification (http://www.w3.org/TR/html5/tree-construction.html#parsing-main-inbody),
+        a start "body" tag in the "in body" insertion mode is a parse error. So parseError(token) is required here.
+        No behavior change because parseError(token) is just a marker.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody):
+
+2012-07-02  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [EFL] Unreviewed build fix with ENABLE_NETSCAPE_PLUGIN_API after r121467.
+
+        * plugins/efl/PluginPackageEfl.cpp:
+        (WebCore::PluginPackage::load): Move the declaration of `err'
+        before the first `goto' statement.
+
+2012-07-02  Alexei Filippov  <alexeif@chromium.org>
+
+        Web Inspector: replace recursion with a stack in DOM nodes snapshot traversal.
+        https://bugs.webkit.org/show_bug.cgi?id=89889
+
+        Number of DOM nodes native snapshots can handle was limited
+        by the process stack size because of recursion used to traverse the nodes.
+        The patch changes the recursion to a stack based algorithm.
+
+        Reviewed by Yury Semikhatsky.
+
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (InstrumentedPointerBase):
+        (WebCore::MemoryInstrumentation::InstrumentedPointerBase::~InstrumentedPointerBase):
+        (InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::InstrumentedPointer::InstrumentedPointer):
+        (WebCore::MemoryInstrumentation::reportInstrumentedPointer):
+        (WebCore):
+        (WebCore::::process):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+
+2012-07-02  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add requestFileContent command and fileContentReceived event
+        https://bugs.webkit.org/show_bug.cgi?id=89642
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: http/tests/inspector/filesystem/read-file.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorFileSystemAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorFileSystemAgent::requestFileContent):
+        * inspector/InspectorFileSystemAgent.h:
+        (InspectorFileSystemAgent):
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.prototype.requestMetadata):
+        (WebInspector.FileSystemModel.prototype.requestFileContent):
+        (WebInspector.FileSystemModel.File.prototype.get resourceType):
+        (WebInspector.FileSystemModel.File.prototype.requestFileContent):
+        (WebInspector.FileSystemRequestManager):
+        (WebInspector.FileSystemRequestManager.prototype._metadataReceived):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileContent.requestAccepted):
+        (WebInspector.FileSystemRequestManager.prototype.requestFileContent):
+        (WebInspector.FileSystemRequestManager.prototype._fileContentReceived):
+        (WebInspector.FileSystemDispatcher.prototype.metadataReceived):
+        (WebInspector.FileSystemDispatcher.prototype.fileContentReceived):
+
+2012-07-02  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add refresh button to FileSystemView status bar
+        https://bugs.webkit.org/show_bug.cgi?id=90244
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView):
+        (WebInspector.FileSystemView.prototype.get statusBarItems):
+        (WebInspector.FileSystemView.prototype.showView):
+        (WebInspector.FileSystemView.prototype._refresh):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):
+
+2012-06-22  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Implement snippets evaluation.
+        https://bugs.webkit.org/show_bug.cgi?id=88707
+
+        Reviewed by Pavel Feldman.
+
+        Implemented snippet evaluation and adjusted breakpoints behavior when editing snippet.
+        Snippets are evaluated using separate compile and run.
+        Breakpoints are updated after compilation (once scriptId is available they can be set in debugger).
+        If separate compile and run is not supported by port or debugger is paused we fall back to evaluation in console.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.runScript.runCallback):
+        (WebInspector.ConsoleView.prototype.runScript):
+        (WebInspector.ConsoleView.prototype._printResult):
+        * inspector/front-end/JavaScriptSource.js:
+        (WebInspector.JavaScriptSource.prototype.supportsEnabledBreakpointsWhileEditing):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype.beforeTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype._didEditContent):
+        (WebInspector.JavaScriptSourceFrame.prototype._removeBreakpointsBeforeEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype._restoreBreakpointsAfterEditing):
+        (WebInspector.JavaScriptSourceFrame.prototype._addBreakpointDecoration):
+        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
+        * inspector/front-end/ScriptSnippetModel.js:
+        (WebInspector.ScriptSnippetModel.prototype.deleteScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._setScriptSnippetContent):
+        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet.compileCallback):
+        (WebInspector.ScriptSnippetModel.prototype.evaluateScriptSnippet):
+        (WebInspector.ScriptSnippetModel.prototype._rawLocationToUILocation):
+        (WebInspector.ScriptSnippetModel.prototype._removeBreakpoints):
+        (WebInspector.ScriptSnippetModel.prototype._restoreBreakpoints):
+        (WebInspector.ScriptSnippetModel.prototype._evaluationSourceURL):
+        (WebInspector.SnippetJavaScriptSource.prototype.isDivergedFromVM):
+        (WebInspector.SnippetJavaScriptSource.prototype.workingCopyCommitted):
+        (WebInspector.SnippetJavaScriptSource.prototype.workingCopyChanged):
+        (WebInspector.SnippetJavaScriptSource.prototype.evaluate):
+        (WebInspector.SnippetJavaScriptSource.prototype.supportsEnabledBreakpointsWhileEditing):
+        (WebInspector.SnippetJavaScriptSource.prototype.breakpointStorageId):
+        * inspector/front-end/ScriptsNavigator.js:
+        (WebInspector.SnippetsNavigatorView.prototype._handleEvaluateSnippet):
+
+2012-06-26  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: StyleSource should set content using CSSStyleModelResourceBinding directly.
+        https://bugs.webkit.org/show_bug.cgi?id=89891
+
+        Reviewed by Pavel Feldman.
+
+        StyleSource now calls CSS resource binding directly.
+        CSS resource binding now adds resource revision only after setStyleSheetText call returns from backend.
+        Resource.revertAndClearHistory is now clearing history asynchronously
+        since Resource.setContent adds revision that should be removed as well.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getViaInspectorResourceForRule):
+        (WebInspector.CSSStyleModel.prototype.resourceBinding):
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent.innerCallback):
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setStyleContent):
+        (WebInspector.CSSStyleModelResourceBinding.prototype.setContent):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.revertAndClearHistory):
+        (WebInspector.Resource.prototype.revertAndClearHistory.clearHistory):
+        * inspector/front-end/RevisionHistoryView.js:
+        (WebInspector.RevisionHistoryView.prototype._createResourceItem):
+        * inspector/front-end/StylesPanel.js:
+        (WebInspector.StyleSource.prototype.workingCopyCommitted):
+        (WebInspector.StyleSource.prototype.workingCopyChanged):
+
+2012-07-02  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add DirectoryContentView for FileSystemView
+        https://bugs.webkit.org/show_bug.cgi?id=89961
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/DirectoryContentView.js: Added.
+        * inspector/front-end/FileSystemView.js:
+        (WebInspector.FileSystemView):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.onattach):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype.onselect):
+        (WebInspector.FileSystemView.EntryTreeElement.prototype._directoryContentReceived):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Fix compilation error in GamepadsEfl.cpp in debug mode
+        https://bugs.webkit.org/show_bug.cgi?id=90369
+
+        Unreviewed, EFL build fix.
+
+        * platform/efl/GamepadsEfl.cpp:
+        (WebCore::GamepadsEfl::registerDevice):
+        (WebCore::GamepadsEfl::unregisterDevice):
+
+2012-07-02  Nikita Vasilyev  <me@elv1s.ru>
+
+        Web Inspector: Design WebSockets panel
+        https://bugs.webkit.org/show_bug.cgi?id=89461
+
+        Use DataGrid to display the data.
+        Put "Data" column first. Make it wider.
+        Remove "Mask" column since it appears to be always true for outgoing frames,
+        and false for incoming.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/NetworkItemView.js:
+        (WebInspector.NetworkItemView): Don't show Preview, Response, Cookies
+        and Timing tabs for succefuly established WebSocket connection.
+
+        * inspector/front-end/ResourceWebSocketFrameView.js:
+        (WebInspector.ResourceWebSocketFrameView):
+        * inspector/front-end/networkPanel.css:
+        (.resource-websocket):
+        (.resource-websocket, .resource-websocket .data-grid):
+        (.resource-websocket .data-grid .data):
+        (.resource-websocket td):
+        (.resource-websocket .data-column div):
+        (.resource-websocket-row-outcoming):
+        (.resource-websocket-row-outcoming:not(.selected) td):
+        (.resource-websocket-row-outcoming:not(.selected) td, .resource-websocket-row-outcoming:not(.selected) + tr td):
+        (.resource-websocket-row-opcode):
+        (.resource-websocket-row-opcode td):
+        (.resource-websocket-row-opcode td, .resource-websocket-row-opcode + tr td):
+        (.resource-websocket-row-error):
+
+2012-07-02  Vineet Chaudhary  <rgf748@motorola.com>
+
+        [V8Binding] Merging v8NumberArray()/v8NumberArrayToVector() to v8Array()/toNativeArray() respectively.
+        https://bugs.webkit.org/show_bug.cgi?id=90338
+
+        Reviewed by Kentaro Hara.
+
+        We can remove v8NumberArray() and v8NumberArrayToVector() implementaion
+        merging them to current v8Array() and toNativeArray() traits.
+
+        Tests: TestObj.idl
+        Shouldn't cause any behavioural changes.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Removed float[]/double[] specific binding code.
+        (IsRefPtrType):
+        (GetNativeType):
+        (JSValueToNative):
+        (NativeToJSValue):
+        * bindings/scripts/test/V8/V8TestObj.cpp: Rebased binding test.
+        (WebCore::TestObjV8Internal::floatArrayAttrGetter):
+        (WebCore::TestObjV8Internal::floatArrayAttrSetter):
+        (WebCore::TestObjV8Internal::doubleArrayAttrGetter):
+        (WebCore::TestObjV8Internal::doubleArrayAttrSetter):
+        * bindings/v8/V8Binding.h: Added templates for float and double.
+        (WebCore::v8Array):
+        (WebCore::toNativeArray):
+
+2012-07-02  Konrad Piascik  <kpiascik@rim.com>
+
+        [EFL] [GTK] [QT] fast/viewport/viewport-91.html is failing after r121555
+        https://bugs.webkit.org/show_bug.cgi?id=90286
+
+        Reviewed by Daniel Bates.
+
+        Since the deprecatedTargetDPI was an int and the deviceDPI was also an int the result
+        was truncated.  Changed deprecatedTargetDPI to a float value. Viewport test 91 now passes.
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+
+2012-06-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add v8 bindings memory info to the native memory graph
+        https://bugs.webkit.org/show_bug.cgi?id=90149
+
+        Reviewed by Pavel Feldman.
+
+        Size of V8 binding maps is now reported on the memory chart.
+
+        * bindings/js/ScriptProfiler.h:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        * bindings/v8/DOMDataStore.cpp:
+        (WebCore::DOMDataStore::reportMemoryUsage):
+        (WebCore):
+        * bindings/v8/DOMDataStore.h:
+        (WebCore):
+        (DOMDataStore):
+        * bindings/v8/IntrusiveDOMWrapperMap.h:
+        (WebCore::ChunkedTable::reportMemoryUsage):
+        (ChunkedTable):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectBindingMemoryInfo):
+        (WebCore):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::V8BindingPerIsolateData::reportMemoryUsage):
+        (WebCore):
+        (WebCore::StringCache::reportMemoryUsage):
+        * bindings/v8/V8Binding.h:
+        (WebCore):
+        (StringCache):
+        (V8BindingPerIsolateData):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore):
+        (AbstractWeakReferenceMap):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore):
+        (WebCore::MemoryInstrumentation::reportHashMap): added a method for reporting
+        size of a HashMap.
+        * inspector/InspectorMemoryAgent.cpp:
+        (MemoryBlockName):
+        (WebCore):
+        (WebCore::domTreeInfo):
+
+2012-07-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Add Gamepad support
+        https://bugs.webkit.org/show_bug.cgi?id=90170
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add support for the Gamepad feature on the EFL port.
+
+        The implementation of this class relies on the Linux
+        kernel joystick API.
+
+        Gamepad devices are recognized through the GamepadsEfl
+        class, of which implementation is based on Eeze
+        library. This way devices are properly registered on
+        connection as objects of the GamepadDeviceEfl class
+        which inherits GamepadDeviceLinux. GamepadDeviceEfl
+        reads the joystick data through an Ecore_Fd_Handler
+        and updates the device state accordingly. The
+        GamepadsEfl object is then polled for gamepads data
+        through the sampleGamepads method.
+
+        No new tests - already tested by gamepad/*
+
+        * CMakeLists.txt:
+        * PlatformEfl.cmake:
+        * platform/efl/GamepadsEfl.cpp: Added.
+        (WebCore):
+        (GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::create):
+        (WebCore::GamepadDeviceEfl::GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::~GamepadDeviceEfl):
+        (WebCore::GamepadDeviceEfl::readCallback):
+        (GamepadsEfl):
+        (WebCore::GamepadsEfl::onGamePadChange):
+        (WebCore::GamepadsEfl::GamepadsEfl):
+        (WebCore::GamepadsEfl::~GamepadsEfl):
+        (WebCore::GamepadsEfl::registerDevice):
+        (WebCore::GamepadsEfl::unregisterDevice):
+        (WebCore::GamepadsEfl::updateGamepadList):
+        (WebCore::sampleGamepads):
+
+2012-07-01  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed, rolling out r121635.
+        http://trac.webkit.org/changeset/121635
+        https://bugs.webkit.org/show_bug.cgi?id=90286
+
+        Breaks compile on clang error: in-class initializer for static
+        data member of type 'const float' is a GNU extension
+        [-Werror,-Wgnu]
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+
+2012-07-01  Timothy Hatcher  <timothy@apple.com>
+
+        Make the "Inspect Element" context menu item appear in nightly builds again.
+
+        rdar://problem/11702613
+        https://webkit.org/b/89323
+
+        Reviewed by Dan Bernstein.
+
+        * platform/ContextMenuItem.h:
+        Fix the order of the ContextMenuAction enum to be binary compatible with
+        older versions of WebKit.
+
+2012-07-01  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11785743> [mac] Non-BMP characters in vertical text appear as missing glyphs
+        https://bugs.webkit.org/show_bug.cgi?id=90349
+
+        Reviewed by Dean Jackson.
+
+        Test: platform/mac/fast/text/vertical-surrogate-pair.html
+
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::GlyphPage::fill): When calling wkGetVerticalGlyphsForCharacters or
+        CTFontGetGlyphsForCharacters with a buffer consisting of surrogate pair, account for those
+        functions’ behavior of placing glyphs at indices corresponding to the first character of
+        each pair.
+
+2012-07-01  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Arabic shaping is incorrect if ZWNJ exist
+        https://bugs.webkit.org/show_bug.cgi?id=89843
+
+        Reviewed by Dan Bernstein.
+
+        mac port treats ZWJ (zero-width-joiner) and ZWNJ (zero-width-non-joiner) as a part of combining
+        character sequence. This could cause a problem when the font doesn't have glyph mapping of ZWJ and ZWNJ.
+        Suppose the text to be rendered is "U+0645(MEEM) U+06CC(FARSI YEH) U+200C(ZWNJ)". In this case, U+0645
+        and U+06CC are rendered in isolated form if the font doesn't have a glyph for ZWNJ. They should be joined.
+
+        This patch changes handling of ZWJ and ZWNJ. Treats ZWJ and ZWNJ as base characters so that a complex text
+        run isn't separate at the point of ZWJ and ZWNJ even the font doesn't contain glyphs for them.
+        If ComplexTextController finds ZWJ, it doesn't split the current complex text run.
+
+        Test: platform/mac/fast/text/arabic-zwj-and-zwnj.html
+
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::advanceByCombiningCharacterSequence): Don't treat ZWJ and ZWNJ as a part of combining character sequence.
+        (WebCore::ComplexTextController::collectComplexTextRuns): Set fontData to nextFontData if the baseCharacter is ZWJ.
+
+2012-07-01  Konrad Piascik  <kpiascik@rim.com>
+
+        [EFL] [GTK] [QT] fast/viewport/viewport-91.html is failing after r121555
+        https://bugs.webkit.org/show_bug.cgi?id=90286
+
+        Reviewed by Daniel Bates.
+
+        Since the deprecatedTargetDPI was an int and the deviceDPI was also an int the result
+        was truncated.  Changed deprecatedTargetDPI to a float value. Viewport test 91 now passes.
+
+        * dom/ViewportArguments.h:
+        (ViewportArguments):
+
+2012-06-30  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] CanvasLayerTextureUpdater needs to convert opaque rects back to content space.
+        https://bugs.webkit.org/show_bug.cgi?id=90092
+
+        The CanvasLayerTextureUpdater currently receives its opaque rects in
+        layer space, but is expected to return them in content space and does
+        not convert them. This patch adds this conversion. To avoid numerical
+        errors, this patch also switches to using float rects to store opaque
+        rects where appropriate.
+
+        Reviewed by Adrienne Walker.
+
+        Unit test: ContentLayerTest.ContentLayerPainterWithDeviceScale
+
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        (WebCore::CanvasLayerTextureUpdater::paintContents):
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerPainter::ContentLayerPainter):
+        (WebCore::ContentLayerPainter::create):
+        (WebCore::ContentLayerPainter::paint):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (WebCore):
+        (ContentLayerDelegate):
+        (ContentLayerPainter):
+        * platform/graphics/chromium/LayerPainterChromium.h:
+        (WebCore):
+        (LayerPainterChromium):
+        * platform/graphics/chromium/LinkHighlight.cpp:
+        (WebCore::LinkHighlight::paintContents):
+        * platform/graphics/chromium/LinkHighlight.h:
+        (LinkHighlight):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp:
+        (WebCore::OpaqueRectTrackingContentLayerDelegate::paintContents):
+        * platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h:
+        (OpaqueRectTrackingContentLayerDelegate):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+
+2012-06-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Unreviewed. Remove unused declaration.
+        HTMLDocumentParser::begin() has no method definition.
+
+        * html/parser/HTMLDocumentParser.h:
+
+2012-06-29  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Unreviewed, rolling out r121569.
+        http://trac.webkit.org/changeset/121569
+        https://bugs.webkit.org/show_bug.cgi?id=90082
+
+        It broke a couple of tests in Qt Linux Release
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+
+2012-06-29  Simon Fraser  <simon.fraser@apple.com>
+
+        updateDescendantDependentFlags() is inside #if USE(ACCELERATED_COMPOSITING)
+        https://bugs.webkit.org/show_bug.cgi?id=90245
+
+        Reviewed by Dan Bernstein.
+
+        updateDescendantDependentFlags() and updateTransform() should be
+        outside the USE(ACCELERATED_COMPOSITING) #ifdef. They do work
+        that is needed even if accelerated compositing is disabled.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+
+2012-06-29  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] HTMLCollection wrappers are not retained
+        https://bugs.webkit.org/show_bug.cgi?id=90208
+
+        Reviewed by Adam Barth.
+
+        Generate visitDOMWrapper for HTMLCollection and HTMLAllCollection so that we add an implicit reference from the owner
+        to the collection.
+
+        Tests: fast/dom/htmlallcollection-reachable.html
+               fast/dom/htmlcollection-reachable.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation): Instead of hard coding to use base() for HTMLAllCollection and HTMLCollection we now
+        annotate the IDL file to use GenerateIsReachable=ImplBaseRoot.
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateVisitDOMWrapper): Generate visitDOMWrapper if GenerateIsReachable is ImplBaseRoot.
+        * bindings/scripts/IDLAttributes.txt: Added ImplBaseRoot.
+        * html/HTMLAllCollection.idl: Added annotations.
+        * html/HTMLCollection.idl: Ditto.
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        All child elements of a flex container should be turned into a flex item
+        https://bugs.webkit.org/show_bug.cgi?id=90323
+
+        Reviewed by Ojan Vafai.
+
+        We used to only convert some elements to blocks, but now we convert everything except text nodes.
+        This was recently changed here:
+        http://wiki.csswg.org/topics/css3-flexbox-flexbox-replaced-children
+
+        Tests: css3/flexbox/anonymous-block.html : Add new test case.
+               css3/flexbox/flexitem.html: Update results.
+
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Keep direction on IDBCursor to avoid calls to back end
+        https://bugs.webkit.org/show_bug.cgi?id=90114
+
+        Reviewed by Tony Chang.
+
+        Let IDBCursor handle direction() accessor locally, without a call to
+        the IDBCursorBackendImpl which (in some ports) may reside in a different
+        process. Not a heavily called function, but further reduces the surface
+        area exposed by the XXXInterface classes.
+
+        No new tests - no functional changes.
+
+        * Modules/indexeddb/IDBCursor.cpp:
+        (WebCore::IDBCursor::create): Accept direction, known at creation time.
+        (WebCore::IDBCursor::IDBCursor): Stash in member.
+        (WebCore::IDBCursor::direction): Use local copy
+        (WebCore::IDBCursor::stringToDirection): Return enum value, not int.
+        * Modules/indexeddb/IDBCursor.h:
+        (IDBCursor):
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp: Remove accessor.
+        * Modules/indexeddb/IDBCursorBackendImpl.h:
+        (IDBCursorBackendImpl):
+        * Modules/indexeddb/IDBCursorBackendInterface.h: Remove accessor.
+        * Modules/indexeddb/IDBCursorWithValue.cpp:
+        (WebCore::IDBCursorWithValue::create):
+        (WebCore::IDBCursorWithValue::IDBCursorWithValue):
+        * Modules/indexeddb/IDBCursorWithValue.h:
+        (IDBCursorWithValue):
+        * Modules/indexeddb/IDBIndex.cpp: Prep IDBRequest with cursor direction too.
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        * Modules/indexeddb/IDBObjectStore.cpp: Ditto.
+        (WebCore::IDBObjectStore::openCursor):
+        * Modules/indexeddb/IDBRequest.cpp: Stash direction for pending cursor too.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::setCursorDetails):
+        (WebCore::IDBRequest::onSuccess): Apply stashed direction to new cursor.
+        * Modules/indexeddb/IDBRequest.h:
+        (IDBRequest):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Allow align-self: stretch to cause the item size to shrink below its intrinsic size
+        https://bugs.webkit.org/show_bug.cgi?id=90304
+
+        Reviewed by Ojan Vafai.
+
+        The spec used to say that stretch could only make items grow, but now
+        it allows items to shrink.
+        http://dev.w3.org/csswg/css3-flexbox/#align-items-stretch
+
+        Tests: css3/flexbox/flex-align-stretch.html Updated expectations.
+               css3/flexbox/child-overflow.html Updated expectations.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::applyStretchAlignmentToChild):
+
+2012-06-29  James Weatherall  <wez@chromium.org>
+
+        NPObjectWrapper may not address all window script object lifetime issues
+        https://bugs.webkit.org/show_bug.cgi?id=85679
+
+        The ScriptController implementations force-deallocate the window script object to ensure that DOM objects are not leaked if an NPAPI plugin fails to release a reference to it before being destroyed. The NPObjectWrapper was added to ensure that NPAPI scripting could not touch the real window script object after it had been deallocated, by providing the plugin with a small wrapper which will leak if the plugin fails to dereference it.
+
+        This patch removes NPObjectWrapper and instead drops the window script NPObject's reference to the underlying V8Object in ScriptController::clearScriptObjects(). If a plugin fails to dereference the object then the NPV8Object wrapper will be leaked but the DOM objects it references will not.
+
+        Reviewed by Nate Chapin.
+
+        Test: plugins/npruntime/leak-window-scriptable-object.html
+
+        * WebCore.gypi:
+        * bindings/v8/NPObjectWrapper.cpp: Removed.
+        * bindings/v8/NPObjectWrapper.h: Removed.
+        * bindings/v8/NPV8Object.cpp:
+        (WebCore::disposeUnderlyingV8Object):
+        (WebCore):
+        (WebCore::freeV8NPObject):
+        (_NPN_Invoke):
+        (_NPN_InvokeDefault):
+        (_NPN_EvaluateHelper):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bindings/v8/NPV8Object.h:
+        (WebCore):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::clearScriptObjects):
+        (WebCore::ScriptController::windowScriptNPObject):
+        * bindings/v8/ScriptController.h:
+        (ScriptController):
+
+2012-06-29  Adam Barth  <abarth@webkit.org>
+
+        Update complex fonts on Android to use fonts from a newer SDK
+        https://bugs.webkit.org/show_bug.cgi?id=90296
+
+        Reviewed by Nate Chapin.
+
+        These fonts are available in the Jelly Bean SDK.
+
+        * platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
+        (WebCore::ComplexTextController::ComplexTextController):
+        (WebCore::ComplexTextController::getComplexFontPlatformData):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        HTMLCollection's caches should be owned by either ElementRareData or Document
+        https://bugs.webkit.org/show_bug.cgi?id=90322
+
+        Reviewed by Anders Carlsson.
+
+        Removed all instances of OwnPtr<HTMLCollection> except ones on ElementRareData and Document.
+        ElementRareData::ensureCachedHTMLCollection then polymorphically creates HTMLCollection or
+        its subclass as deemed necessary.
+
+        This refactoring allows us to move HTMLCollection to use the same invalidation model as
+        DynamicNodeList (invalidated during DOM mutations) in a follow up.
+
+        * dom/Document.cpp:
+        (WebCore::Document::all):
+        * dom/Document.h:
+        (Document):
+        * dom/Element.cpp:
+        (WebCore::ElementRareData::ensureCachedHTMLCollection):
+        (WebCore):
+        (WebCore::Element::cachedHTMLCollection):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+        (WebCore):
+        (ElementRareData):
+        (WebCore::ElementRareData::cachedHTMLCollection):
+        * dom/Node.cpp:
+        (WebCore):
+        * dom/Node.h:
+        (Node):
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::setItemType):
+        (NodeRareData):
+        * html/CollectionType.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::shouldIncludeChildren):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        * html/HTMLElement.cpp:
+        (WebCore):
+        (WebCore::HTMLElement::properties):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::elements):
+        * html/HTMLFieldSetElement.h:
+        (HTMLFieldSetElement):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::HTMLFormCollection):
+        (WebCore::HTMLFormCollection::create):
+        * html/HTMLFormCollection.h:
+        (HTMLFormCollection):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::elements):
+        * html/HTMLFormElement.h:
+        * html/HTMLOptionsCollection.cpp:
+        (WebCore::HTMLOptionsCollection::HTMLOptionsCollection):
+        (WebCore::HTMLOptionsCollection::create):
+        * html/HTMLOptionsCollection.h:
+        (HTMLOptionsCollection):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedOptions):
+        (WebCore::HTMLSelectElement::options):
+        (WebCore::HTMLSelectElement::invalidateSelectedItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::rows):
+        * html/HTMLTableElement.h:
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection):
+        (WebCore::HTMLTableRowsCollection::create):
+        * html/HTMLTableRowsCollection.h:
+        (HTMLTableRowsCollection):
+
+2012-06-29  Ojan Vafai  <ojan@chromium.org>
+
+        Add FIXMEs for vertical writing mode and override sizes.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overrideLogicalContentWidth):
+        (WebCore::RenderBox::overrideLogicalContentHeight):
+
+2012-06-29  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use CCThread::Task in compositor's RateLimiter instead of Timer
+        https://bugs.webkit.org/show_bug.cgi?id=90300
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/RateLimiter.cpp:
+        (RateLimiter::Task):
+        (WebCore::RateLimiter::Task::create):
+        (WebCore::RateLimiter::Task::~Task):
+        (WebCore::RateLimiter::Task::Task):
+        (WebCore):
+        (WebCore::RateLimiter::RateLimiter):
+        (WebCore::RateLimiter::start):
+        (WebCore::RateLimiter::stop):
+        (WebCore::RateLimiter::rateLimitContext):
+        * platform/graphics/chromium/RateLimiter.h:
+        (WebCore):
+        (RateLimiter):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
+
+2012-06-29  Tony Payne  <tpayne@chromium.org>
+
+        Remove type from screenColorProfile API
+        https://bugs.webkit.org/show_bug.cgi?id=90299
+
+        Reviewed by Adam Barth.
+
+        Covered by existing tests.
+
+        * platform/PlatformScreen.h:
+        (WebCore): Removed type from screenColorProfile().
+        * platform/blackberry/PlatformScreenBlackBerry.cpp:
+        (WebCore::screenColorProfile):
+        * platform/chromium/PlatformScreenChromium.cpp:
+        (WebCore::screenColorProfile):
+        * platform/efl/PlatformScreenEfl.cpp:
+        (WebCore::screenColorProfile):
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::screenColorProfile):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Updated call to
+        screenColorProfile() to not pass type param.
+        * platform/mac/PlatformScreenMac.mm:
+        (WebCore::screenColorProfile):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenColorProfile):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::screenColorProfile):
+
+2012-06-29  Emil A Eklund  <eae@chromium.org>
+
+        Allow non-borders to be adjusted to less than 1 when zoomed out
+        https://bugs.webkit.org/show_bug.cgi?id=90104
+
+        Reviewed by Eric Seidel.
+
+        Change CSSPrimitiveValue::computeLengthDouble to allow values to be
+        adjusted to less than 1.0 when zoomed out. This avoids an off by one
+        error for floats with margins when zoomed out that can cause floats to
+        wrap and break pages.
+
+        The logic that prevents the value from being adjusted to less than 1 was
+        added to ensure that borders are still painted even when zoomed out.
+        By moving the logic to ApplyPropertyComputeLength::applyValue, which is
+        used for borders and outlines, that functionality is preserved.
+
+        Test: fast/sub-pixel/float-with-margin-in-container.html
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+        * css/StyleBuilder.cpp:
+        (WebCore::ApplyPropertyComputeLength::applyValue):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Let Xcode have its own way after r121513.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-06-29  Mihai Balan  <mibalan@adobe.com>
+
+        [CSS Regions] Adding feature defines for CSS Regions for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=88645
+
+        Reviewed by Tony Chang.
+
+        Re-trying to enable CSS regions on Windows. This time only enabling
+        regions (not exclusions) because of some strange compilation/linking
+        issues.
+
+        * css/CSSPropertyNames.in: Touched file to make sure property names get properly rebuilt.
+
+2012-06-29  Hanna Ma  <Hanma@rim.com>
+
+        Web Inspector: Add data length to resource events on timeline to
+        keep track of the amount of data loaded and the total data length
+        https://bugs.webkit.org/show_bug.cgi?id=89244
+
+        Reviewed by Pavel Feldman.
+
+        Added data length to inspector timeline popup
+        content for resources to keep track of the amount of data loaded.
+        Tests: inspector/timeline/timeline-network-received-data.html
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willReceiveResourceDataImpl):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willReceiveResourceData):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::willReceiveResourceData):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createReceiveResourceData):
+        * inspector/TimelineRecordFactory.h:
+        (TimelineRecordFactory):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.Record):
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveData):
+        * inspector/timeline/timeline-network-received-data.html: Added.
+        * inspector/timeline/timeline-network-received-data-expected.txt: Added.
+        * inspector/timeline/timeline-test.js:
+
+2012-06-29  Shawn Singh  <shawnsingh@chromium.org>
+
+        Unreviewed build fix after 121580.
+
+        WebKit Linux debug bots was complaining about signed vs unsigned integer comparison.
+
+        * html/HTMLCollection.h:
+        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove mapRect and mapQuad from WebTransformationMatrix
+        https://bugs.webkit.org/show_bug.cgi?id=90230
+
+        Reviewed by Adrienne Walker.
+
+        Replaces calls to WebTransformationMatrix::mapRect/mapQuad with clipping-aware calls to CCMathUtils. In most
+        cases, we do not expect clipping to happen. For others (such as area calculations in CCOverdrawMetrics) we can
+        handle a clipped quad easily.
+
+        * platform/chromium/support/WebTransformationMatrix.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawRenderPassQuad):
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        (WebCore::RenderSurfaceChromium::drawableContentRect):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::getDrawRect):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::transformSurfaceOpaqueRegion):
+        (WebCore::addOcclusionBehindLayer):
+        * platform/graphics/chromium/cc/CCOverdrawMetrics.cpp:
+        (WebCore):
+        (WebCore::polygonArea):
+        (WebCore::areaOfMappedQuad):
+        (WebCore::CCOverdrawMetrics::didUpload):
+        (WebCore::CCOverdrawMetrics::didCullForDrawing):
+        (WebCore::CCOverdrawMetrics::didDraw):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::appendQuadsToFillScreen):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawableContentRect):
+        * platform/graphics/chromium/cc/CCSharedQuadState.cpp:
+        (WebCore::CCSharedQuadState::isLayerAxisAlignedIntRect):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix after r121575. It rolls out r121547 but didn't roll out the follow up build fix r121553.
+
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (FontCustomPlatformData):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Share the same cache in HTMLCollection and DynamicNodeLists
+        https://bugs.webkit.org/show_bug.cgi?id=90118
+
+        Reviewed by Anders Carlsson.
+
+        This patch introduces two new base classes DynamicNodeListCacheBase and HTMLCollectionCacheBase to share
+        the cache object between DynamicNodeList and HTMLCollection. HTMLCollectionCacheBase inherits from
+        DynamicNodeListCacheBase and contains extra caches and bit flags for HTMLCollection. DynamicNodeList::Cache
+        and HTMLCollection::Cache had been removed and flattened into these two classes for the easy inheritance.
+
+        In DynamicNodeList, we have a very straight forward one-to-one mapping from old Caches member variables:
+
+        m_caches.lastItem -> cachedItem()
+        m_caches.lastItemOffset -> cachedItemOffset()
+        m_caches.cachedLength -> cachedLength()
+        m_caches.isItemCacheValid -> isItemCacheValid()
+        m_caches.isLengthCacheValid -> isLengthCacheValid()
+        m_caches.type -> removed because it was never used.
+        m_caches.rootedAtDocument -> isRootedAtDocument()
+        m_caches.shouldInvalidateOnAttributeChange -> shouldInvalidateOnAttributeChange()
+
+        In HTMLCollection, there is one semantic change in the way item cache is managed. Previously, we only had
+        m_cache.current which was used as both cachedItem() and isItemCacheValid() (not valid when current is null).
+        There are some asymmetric code changes due to one-to-many relationship. Also, all method names have been updated
+        to use that of DynamicNodeList terminology. Thus we have the following correspondence:
+
+        m_cache.current -> cachedItem() / isItemCacheValid()
+        m_cache.position -> cachedItemOffset()
+        m_cache.length -> cachedLength()
+        m_cache.elementsArrayPosition -> cachedElementsArrayOffset()
+        m_cache.hasLength -> isLengthCacheValid()
+        m_cache.hasNameCache -> hasNameCache() / setHasNameCache()
+        m_cache.idCache -> idCache() / addIdCache()
+        m_cache.nameCache -> idCache() / addNameCache()
+
+        In addition, we had to rename HTMLCollection::clearCache to invalidateCache to avoid the name collision with
+        HTMLCollectionCacheBase::clearCache.
+
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::length):
+        (WebCore::ChildNodeList::item):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicSubtreeNodeList::length):
+        (WebCore::DynamicSubtreeNodeList::itemForwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::itemBackwardsFromCurrent):
+        (WebCore::DynamicSubtreeNodeList::item):
+        * dom/DynamicNodeList.h:
+        (DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::DynamicNodeListCacheBase):
+        (WebCore::DynamicNodeListCacheBase::isRootedAtDocument):
+        (WebCore::DynamicNodeListCacheBase::shouldInvalidateOnAttributeChange):
+        (WebCore::DynamicNodeListCacheBase::isItemCacheValid):
+        (WebCore::DynamicNodeListCacheBase::cachedItem):
+        (WebCore::DynamicNodeListCacheBase::cachedItemOffset):
+        (WebCore::DynamicNodeListCacheBase::isLengthCacheValid):
+        (WebCore::DynamicNodeListCacheBase::cachedLength):
+        (WebCore::DynamicNodeListCacheBase::setLengthCache):
+        (WebCore::DynamicNodeListCacheBase::setItemCache):
+        (WebCore::DynamicNodeListCacheBase::clearCache):
+        (WebCore):
+        (WebCore::DynamicNodeList::DynamicNodeList):
+        (WebCore::DynamicNodeList::invalidateCache):
+        (WebCore::DynamicNodeList::rootNode):
+        (DynamicNodeList):
+        * html/HTMLAllCollection.cpp:
+        (WebCore::HTMLAllCollection::namedItemWithIndex):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::HTMLCollection):
+        (WebCore::HTMLCollection::invalidateCacheIfNeeded):
+        (WebCore::HTMLCollection::invalidateCache):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        (WebCore::HTMLCollection::itemAfter):
+        (WebCore::HTMLCollection::length):
+        (WebCore::HTMLCollection::item):
+        (WebCore::HTMLCollection::checkForNameMatch):
+        (WebCore::HTMLCollection::namedItem):
+        (WebCore::HTMLCollection::updateNameCache):
+        (WebCore::HTMLCollection::hasNamedItem):
+        (WebCore::HTMLCollection::namedItems):
+        (WebCore::HTMLCollectionCacheBase::append):
+        * html/HTMLCollection.h:
+        (HTMLCollectionCacheBase):
+        (WebCore::HTMLCollectionCacheBase::HTMLCollectionCacheBase):
+        (WebCore::HTMLCollectionCacheBase::type):
+        (WebCore::HTMLCollectionCacheBase::clearCache):
+        (WebCore::HTMLCollectionCacheBase::setItemCache):
+        (WebCore::HTMLCollectionCacheBase::cachedElementsArrayOffset):
+        (WebCore::HTMLCollectionCacheBase::includeChildren):
+        (WebCore::HTMLCollectionCacheBase::cacheTreeVersion):
+        (WebCore::HTMLCollectionCacheBase::idCache):
+        (WebCore::HTMLCollectionCacheBase::nameCache):
+        (WebCore::HTMLCollectionCacheBase::appendIdCache):
+        (WebCore::HTMLCollectionCacheBase::appendNameCache):
+        (WebCore::HTMLCollectionCacheBase::hasNameCache):
+        (WebCore::HTMLCollectionCacheBase::setHasNameCache):
+        (WebCore):
+        (WebCore::HTMLCollection::isEmpty):
+        (WebCore::HTMLCollection::hasExactlyOneItem):
+        (WebCore::HTMLCollection::base):
+        (HTMLCollection):
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::item):
+        (WebCore::HTMLFormCollection::updateNameCache):
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::itemAfter):
+        * html/HTMLNameCollection.h:
+        (HTMLNameCollection):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::invalidateSelectedItems):
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::itemAfter):
+        * html/HTMLTableRowsCollection.h:
+        (HTMLTableRowsCollection):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121572.
+        http://trac.webkit.org/changeset/121572
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Breaks Mac build since it depends on r121547, which was rolled
+        out
+
+        * WebCore.exp.in:
+        * page/AlternativeTextClient.h:
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate):
+        * platform/graphics/cg/ImageBufferDataCG.h:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawLineForDocumentMarker):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::setClosedCaptionsVisible):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/network/Credential.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore):
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+        * platform/text/TextChecking.h:
+        (WebCore):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::containsPaintedContent):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121547.
+        http://trac.webkit.org/changeset/121547
+        https://bugs.webkit.org/show_bug.cgi?id=90256
+
+        Breaks Chromium Mac build
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::imageTitle):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setAllowsFontSmoothing):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::boundingRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore):
+        (WebCore::canSetCascadeListForCustomFont):
+        (WebCore::FontPlatformData::ctFont):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/mac/ComplexTextController.cpp:
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore):
+        (WebCore::fontCacheATSNotificationCallback):
+        (WebCore::FontCache::platformInit):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/mac/WebLayer.h:
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/DisplaySleepDisabler.cpp:
+        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
+        (WebCore):
+        (WebCore::DisplaySleepDisabler::systemActivityTimerFired):
+        * platform/mac/DisplaySleepDisabler.h:
+        (DisplaySleepDisabler):
+        * platform/mac/HTMLConverter.h:
+        * platform/mac/HTMLConverter.mm:
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate):
+        * platform/mac/ScrollElasticityController.mm:
+
+2012-06-29  Eric Penner  <epenner@google.com>
+
+        [chromium] Adding PrioritizedTexture and replacing ContentsTextureManager
+        https://bugs.webkit.org/show_bug.cgi?id=84308
+
+        Reviewed by Adrienne Walker.
+
+        PrioritizedTextures have a priority such that all texture requests can be
+        prioritized. There are three steps involved:
+            - Call setRequestPriority()
+            - Check if the request succeeded with canAcquireBackingTexture()
+            - Call acquireBackingTexture() when uploading a new texture.
+
+        Internally both the texture requests and the backing textures get sorted.
+        Requests are sorted so they can be prioritized. Backing textures are sorted
+        so that they can be recycled/evicted in the right order (lowest priority first).
+
+        Prioritizing textures doesn't assign backing textures to texture requests but
+        rather just marks which textures can have a backing texture "when needed". This
+        allows us to keep the old textures in use as long as possible.
+
+        The unit tests support all the use cases from the original texture manager
+        but also adds assumptions about priority order throughout all the tests. The
+        function assertInvariants() is added to test the validity of the manager
+        and all textures/allocations within it.
+
+        The TiledLayerChromium tests are updated to request textures first with
+        prioritizeTextures(), and update them with the updater (such that allocate
+        gets called) before pushPropertiesTo is called (when they need to be valid).
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapCanvasLayerTextureUpdater::Texture::Texture):
+        (WebCore::BitmapCanvasLayerTextureUpdater::createTexture):
+        (WebCore::BitmapCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
+        (WebCore):
+        (Texture):
+        (BitmapCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::Texture::Texture):
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::createTexture):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        (Texture):
+        (BitmapSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::setTexturePriorities):
+        (WebCore):
+        (WebCore::ContentLayerChromium::update):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (ContentLayerChromium):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::createAcceleratedCanvas):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::Texture):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::createTexture):
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
+        (Texture):
+        (FrameBufferSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerTextureUpdater::Texture::Texture):
+        (WebCore::ImageLayerTextureUpdater::createTexture):
+        (WebCore::ImageLayerTextureUpdater::updateTextureRect):
+        (WebCore::ImageLayerChromium::setTexturePriorities):
+        (WebCore):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        (ImageLayerChromium):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        (WebCore::LayerChromium::setTexturePriorities):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        (WebCore::LayerTextureUpdater::Texture::texture):
+        (WebCore::LayerTextureUpdater::Texture::swapTextureWith):
+        (WebCore::LayerTextureUpdater::Texture::Texture):
+        (Texture):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        (WebCore):
+        (WebCore::ScrollbarLayerChromium::setTexturePriorities):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::UpdatableTile::managedTexture):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore::TiledLayerChromium::textureManager):
+        (WebCore::TiledLayerChromium::createTile):
+        (WebCore::TiledLayerChromium::tileNeedsBufferedUpdate):
+        (WebCore::TiledLayerChromium::updateTiles):
+        (WebCore::TiledLayerChromium::setTexturePriorities):
+        (WebCore):
+        (WebCore::TiledLayerChromium::setTexturePrioritiesInRect):
+        (WebCore::TiledLayerChromium::resetUpdateState):
+        (WebCore::TiledLayerChromium::updateLayerRect):
+        (WebCore::TiledLayerChromium::idleUpdateLayerRect):
+        (WebCore::TiledLayerChromium::needsIdlePaint):
+        (WebCore::TiledLayerChromium::idlePaintRect):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::deleteContentsTexturesOnImplThread):
+        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::commitComplete):
+        (WebCore::CCLayerTreeHost::evictAllContentTextures):
+        (WebCore::CCLayerTreeHost::contentsTextureManager):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::prioritizeTextures):
+        (WebCore::CCLayerTreeHost::deleteTextureAfterCommit):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCPrioritizedTexture.cpp: Added.
+        (WebCore):
+        (WebCore::CCPrioritizedTexture::CCPrioritizedTexture):
+        (WebCore::CCPrioritizedTexture::~CCPrioritizedTexture):
+        (WebCore::CCPrioritizedTexture::setTextureManager):
+        (WebCore::CCPrioritizedTexture::setDimensions):
+        (WebCore::CCPrioritizedTexture::requestLate):
+        (WebCore::CCPrioritizedTexture::acquireBackingTexture):
+        (WebCore::CCPrioritizedTexture::textureId):
+        (WebCore::CCPrioritizedTexture::bindTexture):
+        (WebCore::CCPrioritizedTexture::framebufferTexture2D):
+        (WebCore::CCPrioritizedTexture::setCurrentBacking):
+        * platform/graphics/chromium/cc/CCPrioritizedTexture.h: Added.
+        (WebCore):
+        (CCPrioritizedTexture):
+        (WebCore::CCPrioritizedTexture::create):
+        (WebCore::CCPrioritizedTexture::textureManager):
+        (WebCore::CCPrioritizedTexture::format):
+        (WebCore::CCPrioritizedTexture::size):
+        (WebCore::CCPrioritizedTexture::memorySizeBytes):
+        (WebCore::CCPrioritizedTexture::setRequestPriority):
+        (WebCore::CCPrioritizedTexture::requestPriority):
+        (WebCore::CCPrioritizedTexture::canAcquireBackingTexture):
+        (WebCore::CCPrioritizedTexture::haveBackingTexture):
+        (Backing):
+        (WebCore::CCPrioritizedTexture::Backing::size):
+        (WebCore::CCPrioritizedTexture::Backing::format):
+        (WebCore::CCPrioritizedTexture::Backing::memorySizeBytes):
+        (WebCore::CCPrioritizedTexture::Backing::textureId):
+        (WebCore::CCPrioritizedTexture::Backing::currentTexture):
+        (WebCore::CCPrioritizedTexture::Backing::setCurrentTexture):
+        (WebCore::CCPrioritizedTexture::Backing::Backing):
+        (WebCore::CCPrioritizedTexture::Backing::~Backing):
+        (WebCore::CCPrioritizedTexture::isAbovePriorityCutoff):
+        (WebCore::CCPrioritizedTexture::setAbovePriorityCutoff):
+        (WebCore::CCPrioritizedTexture::setManagerInternal):
+        (WebCore::CCPrioritizedTexture::currentBacking):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp: Added.
+        (WebCore):
+        (WebCore::CCPrioritizedTextureManager::CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::~CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::setMemoryAllocationLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::prioritizeTextures):
+        (WebCore::CCPrioritizedTextureManager::clearPriorities):
+        (WebCore::CCPrioritizedTextureManager::requestLate):
+        (WebCore::CCPrioritizedTextureManager::acquireBackingTextureIfNeeded):
+        (WebCore::CCPrioritizedTextureManager::reduceMemory):
+        (WebCore::CCPrioritizedTextureManager::clearAllMemory):
+        (WebCore::CCPrioritizedTextureManager::allBackingTexturesWereDeleted):
+        (WebCore::CCPrioritizedTextureManager::unlink):
+        (WebCore::CCPrioritizedTextureManager::link):
+        (WebCore::CCPrioritizedTextureManager::registerTexture):
+        (WebCore::CCPrioritizedTextureManager::unregisterTexture):
+        (WebCore::CCPrioritizedTextureManager::returnBackingTexture):
+        (WebCore::CCPrioritizedTextureManager::createBacking):
+        (WebCore::CCPrioritizedTextureManager::destroyBacking):
+        (WebCore::CCPrioritizedTextureManager::assertInvariants):
+        * platform/graphics/chromium/cc/CCPrioritizedTextureManager.h: Added.
+        (WebCore):
+        (CCPrioritizedTextureManager):
+        (WebCore::CCPrioritizedTextureManager::create):
+        (WebCore::CCPrioritizedTextureManager::createTexture):
+        (WebCore::CCPrioritizedTextureManager::memoryUseBytes):
+        (WebCore::CCPrioritizedTextureManager::memoryAboveCutoffBytes):
+        (WebCore::CCPrioritizedTextureManager::setMaxMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::maxMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::setPreferredMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::preferredMemoryLimitBytes):
+        (WebCore::CCPrioritizedTextureManager::setMaxMemoryPriorityCutoff):
+        (WebCore::CCPrioritizedTextureManager::maxMemoryPriorityCutoff):
+        (WebCore::CCPrioritizedTextureManager::compareTextures):
+        (WebCore::CCPrioritizedTextureManager::compareBackings):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.cpp: Added.
+        (WebCore):
+        (WebCore::CCPriorityCalculator::uiPriority):
+        (WebCore::CCPriorityCalculator::visiblePriority):
+        (WebCore::CCPriorityCalculator::lingeringPriority):
+        (WebCore::CCPriorityCalculator::priorityFromDistance):
+        (WebCore::CCPriorityCalculator::priorityFromVisibility):
+        * platform/graphics/chromium/cc/CCPriorityCalculator.h: Added.
+        (WebCore):
+        (CCPriorityCalculator):
+        (WebCore::CCPriorityCalculator::highestPriority):
+        (WebCore::CCPriorityCalculator::lowestPriority):
+        (WebCore::CCPriorityCalculator::priorityIsLower):
+        (WebCore::CCPriorityCalculator::priorityIsHigher):
+        * platform/graphics/chromium/cc/CCTextureUpdater.cpp:
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove BUILDING_ON_LEOPARD now that no ports build on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Reviewed by Ryosuke Niwa.
+
+        I don't think I quite got it all yet, but this is another step towards
+        removing Leopard support in WebCore.
+
+        * WebCore.exp.in:
+        * page/AlternativeTextClient.h:
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate):
+        * platform/graphics/cg/ImageBufferDataCG.h:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawLineForDocumentMarker):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::setClosedCaptionsVisible):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/network/Credential.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore):
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+        * platform/text/TextChecking.h:
+        (WebCore):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::containsPaintedContent):
+
+2012-06-29  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed, rolling out r121562.
+        http://trac.webkit.org/changeset/121562
+        https://bugs.webkit.org/show_bug.cgi?id=89945
+
+        Broke a couple of editing/pasteboard tests.
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::length):
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        (WebCore::PropertySetCSSStyleDeclaration::cssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::copy):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::InlineCSSStyleDeclaration::didMutate):
+        (WebCore::InlineCSSStyleDeclaration::parentStyleSheet):
+        * css/PropertySetCSSStyleDeclaration.h:
+        (WebCore::PropertySetCSSStyleDeclaration::clearParentElement):
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
+        (WebCore::StylePropertySet::clearParentElement):
+        (WebCore):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::destroyInlineStyle):
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::~StyledElement):
+        (WebCore):
+        (WebCore::StyledElement::styleAttributeChanged):
+        * dom/StyledElement.h:
+        (StyledElement):
+        (WebCore::StyledElement::destroyInlineStyle):
+
+2012-06-29  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [Qt] Add missing support for tiled shadow blur on fillRect
+        https://bugs.webkit.org/show_bug.cgi?id=90082
+
+        Reviewed by Noam Rosenthal.
+
+        This overloaded fillRect implementation also supports this optimization in
+        certain situations.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+
+2012-06-29  Brady Eidson  <beidson@apple.com>
+
+        Build fix - These should not be executable!
+
+        Rubberstamped by Jessie Berlin.
+
+        * loader/cache/CachedSVGDocument.cpp: Removed property svn:executable.
+        * loader/cache/CachedSVGDocument.h: Removed property svn:executable.
+
+2012-06-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Update FIXME comment in XMLDocumentParser::wellFormed
+        https://bugs.webkit.org/show_bug.cgi?id=90223
+
+        Reviewed by Adam Barth.
+
+        XMLDocumentParser::wellFormed is still used by the XMLHttpRequest to check if the responseXML was well formed.
+        So it can't be removed.
+
+        * xml/parser/XMLDocumentParser.h:
+        (XMLDocumentParser):
+
+2012-06-29  Andreas Kling  <kling@webkit.org>
+
+        Separate mutating CSSStyleDeclaration operations.
+        <http://webkit.org/b/89945>
+
+        Reviewed by Antti Koivisto.
+
+        Use separate paths for mutating the StylePropertySet wrapped by a CSSStyleDeclaration.
+        PropertySetCSSStyleDeclaration now has:
+
+            - propertySet() const
+            - ensureMutablePropertySet()
+
+        This is prep work for supporting immutable ElementAttributeData objects, the idea being
+        that calling ensureMutablePropertySet() may cause the element to convert its internal
+        attribute storage (which also holds the inline StylePropertySet.)
+
+        To that end, also removed the weird logic that allowed you to kill the inline style object
+        by removing the 'style' attribute. We now simply clear out all the properties in that case
+        which saves us a bunch of hassle (no need for a ~StyledElement anymore.)
+        Note that InlineCSSStyleDeclaration now refs the element rather than the inline style.
+
+        There should be no web-facing behavior change from any of this.
+
+        * css/PropertySetCSSStyleDeclaration.cpp:
+        (WebCore::PropertySetCSSStyleDeclaration::length):
+        (WebCore::PropertySetCSSStyleDeclaration::item):
+        (WebCore::PropertySetCSSStyleDeclaration::cssText):
+        (WebCore::PropertySetCSSStyleDeclaration::setCssText):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyShorthand):
+        (WebCore::PropertySetCSSStyleDeclaration::isPropertyImplicit):
+        (WebCore::PropertySetCSSStyleDeclaration::setProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::setPropertyInternal):
+        (WebCore::PropertySetCSSStyleDeclaration::copy):
+        (WebCore::PropertySetCSSStyleDeclaration::makeMutable):
+        (WebCore::PropertySetCSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::InlineCSSStyleDeclaration::InlineCSSStyleDeclaration):
+        (WebCore::InlineCSSStyleDeclaration::ref):
+        (WebCore::InlineCSSStyleDeclaration::deref):
+        (WebCore::InlineCSSStyleDeclaration::didMutate):
+        (WebCore::InlineCSSStyleDeclaration::parentStyleSheet):
+        (WebCore::InlineCSSStyleDeclaration::ensureMutablePropertySet):
+        * css/PropertySetCSSStyleDeclaration.h:
+        (PropertySetCSSStyleDeclaration):
+        (WebCore::PropertySetCSSStyleDeclaration::propertySet):
+        (WebCore::PropertySetCSSStyleDeclaration::ensureMutablePropertySet):
+        (InlineCSSStyleDeclaration):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::ensureInlineCSSStyleDeclaration):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        * dom/ElementAttributeData.cpp:
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::styleAttributeChanged):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::~StyledElement):
+        (StyledElement):
+
+2012-06-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Don't call SegmentedString::toString() twice in XMLDocumentParser::append(const SegmentedString&)
+        https://bugs.webkit.org/show_bug.cgi?id=90254
+
+        Reviewed by Adam Barth.
+
+        We can reuse the local variable parseString instead of calling s.toString() again.
+        No behavior change, so no new tests.
+
+        * xml/parser/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::append):
+
+2012-06-29  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Crash when flowing a fixed positioned element into a region.
+        https://bugs.webkit.org/show_bug.cgi?id=88133
+
+        Reviewed by Julien Chaffraix and Abhishek Arya.
+
+        When a fixed positioned element is collected into a named flow, we have to make sure
+        that such element has the RenderFlowThread as containing block instead of RenderView,
+        so that the fixed positioned element is laid out properly.
+        Making the RenderFlowThread the top most containing block for named flow elements required the
+        modification of RenderLayer::convertToLayerCoords so that the fixed positioned elements inside the
+        named flow take the same code path as the absolute positioned elements inside the named flow.
+        I also added a method, checkBlockPositionedObjectsNeedLayout, in order to verify that a block
+        that is ending its layout, setNeedsLayout(false), has all the positioned children laid out.
+        This way, we will hit an assertion if an out-of-flow positioned child inside a RenderFlowThread
+        is not laid out after the RenderFlowThread is laid out.
+
+        Tests: fast/regions/absolute-pos-elem-in-named-flow.html
+               fast/regions/absolute-pos-elem-in-region.html
+               fast/regions/fixed-pos-elem-in-named-flow.html
+               fast/regions/fixed-pos-elem-in-named-flow2.html
+               fast/regions/fixed-pos-elem-in-region.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::checkPositionedObjectsNeedLayout):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::convertToLayerCoords):
+        * rendering/RenderObject.cpp:
+        (WebCore):
+        (WebCore::RenderObject::checkBlockPositionedObjectsNeedLayout):
+        (WebCore::RenderObject::containingBlock):
+        (WebCore::RenderObject::container):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        (WebCore::RenderObject::setNeedsLayout):
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        No behavioural change, current tests in fast/viewport cover all
+        functionality.
+
+        * WebCore.exp.in: Updated symbol for computeViewportAttributes.
+        * dom/ViewportArguments.cpp: Use new parameter for devicePixelRatio
+                                     and don't calculate it anymore.
+        (WebCore::computeViewportAttributes):
+        * dom/ViewportArguments.h: Change the deviceDPI parameter to
+                                   devicePixelRatio and put the onus
+                                   on the embedder to supply the
+                                   correct value.  Add temporary constant.
+        (WebCore):
+
+2012-06-29  Vineet Chaudhary  <rgf748@motorola.com>
+
+        JS binding code generator doesn't handle "attribute unsigned long[]" well.
+        https://bugs.webkit.org/show_bug.cgi?id=84540
+
+        Reviewed by Kentaro Hara.
+
+        In JS/V8 Bindings using traits instead of specialised functions.
+        Also added support for "unsigned long" in JSDOMBinding and V8Binding.
+
+        No new tests, as no behavioural changes.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::Traits::arrayJSValue):
+        (WebCore::jsArray):
+        * bindings/v8/V8Binding.h:
+        (WebCore::Traits::arrayV8Value):
+        (WebCore::v8Array):
+
+2012-06-29  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed mac build fix after r121547.
+        Remove the now-unused FontCustomPlatformData::m_atsContainer.
+
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (FontCustomPlatformData):
+
+2012-06-29  Kent Tamura  <tkent@chromium.org>
+
+        <textarea> unnecessarily saves the value in some cases
+        https://bugs.webkit.org/show_bug.cgi?id=90259
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/forms/textarea/textarea-state-restore.html
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::saveFormControlState):
+        We apply EOL normalization to value(), but don't apply it to
+        defaultValue(). Also value() can return a null string, which never
+        equals to any strings. To check m_isDirty is what we need..
+
+2012-06-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Provide source data for all known rule types in CSSParser, except "keyframe" and "region"
+        https://bugs.webkit.org/show_bug.cgi?id=88420
+
+        Reviewed by Antti Koivisto.
+
+        This change transitions the CSS source code model from a flat list of style rules to a tree of all types of CSS rules
+        (some of them lack actual source code data), which is crucial to model-based CSS stylesheet source editing
+        (add/remove CSS rule) and navigation.
+        As a side effect, the CSS parsing performance on PerformanceTests/Parser/css-parser-yui.html is improved roughly by 2%:
+        - originally: median= 282.051282051 runs/s, stdev= 1.51236798322 runs/s, min= 278.481012658 runs/s, max= 283.870967742 runs/s
+        - with patch applied: median= 287.206266319 runs/s, stdev= 1.31518320219 runs/s, min= 282.051282051 runs/s, max= 288.713910761 runs/s
+
+        No new tests, as there is no client-visible behavior change. Existing Inspector tests will be modified
+        to test the new data provided, along with the necessary Inspector plumbing.
+
+        * css/CSSGrammar.y:
+        * css/CSSMediaRule.cpp:
+        (WebCore::CSSMediaRule::reattach): Check for mediaQueries() validity before reattaching.
+        * css/CSSParser.cpp: Unless explicitly specified below, the method changes are related to the extension of the
+        source-based CSS model provided by the parser.
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::setupParser):
+        (WebCore::CSSParser::parseDeclaration): Accept a CSSRuleSourceData for filling, since it now contains
+        the related style source range.
+        (WebCore::CSSParser::createImportRule):
+        (WebCore::CSSParser::createMediaRule): Create CSSMediaRule even if media and rules are empty,
+        which is consistent with Mozilla.
+        (WebCore::CSSParser::processAndAddNewRuleToSourceTreeIfNeeded):
+        (WebCore):
+        (WebCore::CSSParser::addNewRuleToSourceTree):
+        (WebCore::CSSParser::createKeyframesRule):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createRegionRule):
+        (WebCore::CSSParser::fixUnparsedPropertyRanges):
+        (WebCore::CSSParser::markRuleHeaderStart):
+        (WebCore::CSSParser::markRuleHeaderEnd):
+        (WebCore::CSSParser::markRuleBodyStart):
+        (WebCore::CSSParser::markRuleBodyEnd):
+        (WebCore::CSSParser::markPropertyStart):
+        (WebCore::CSSParser::markPropertyEnd):
+        * css/CSSParser.h:
+        (CSSParser):
+        * css/CSSPropertySourceData.h: Extend the model to handle more types of rules and their containments.
+        (WebCore):
+        (WebCore::CSSRuleSourceData::create):
+        (WebCore::CSSRuleSourceData::createUnknown):
+        (CSSRuleSourceData):
+        (WebCore::CSSRuleSourceData::CSSRuleSourceData):
+        * inspector/InspectorStyleSheet.cpp: Follow the CSSParser API changes but retain the flat stored CSS rules structure.
+        (ParsedStyleSheet):
+        (flattenSourceData): Flatten the rule tree to retain the existing rule-handling code intact.
+        (ParsedStyleSheet::setSourceData):
+        (ParsedStyleSheet::ruleSourceDataAt):
+        (WebCore::InspectorStyle::buildObjectForStyle):
+        (WebCore::InspectorStyle::setPropertyText):
+        (WebCore::InspectorStyle::styleText):
+        (WebCore::InspectorStyleSheet::setRuleSelector):
+        (WebCore::InspectorStyleSheet::deleteRule):
+        (WebCore::InspectorStyleSheet::buildObjectForRule):
+        (WebCore::InspectorStyleSheet::buildObjectForStyle):
+        (WebCore::InspectorStyleSheet::ensureSourceData):
+        (WebCore::InspectorStyleSheet::styleSheetTextWithChangedStyle):
+        (WebCore::InspectorStyleSheetForInlineStyle::ensureParsedDataReady):
+        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
+        * inspector/InspectorStyleSheet.h:
+
+2012-06-29  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Annotate TextViewer.js
+        https://bugs.webkit.org/show_bug.cgi?id=90266
+
+        Reviewed by Yury Semikhatsky.
+
+        Annotated TextViewer.js and fixed found errors.
+        Drive-by: Fixed NativeMemorySnapshotView.js compilation.
+        Drive-by: Fixed protocol-externs.js compilation.
+        Drive-by: Removed unused platform parameter from TextViewer constructor.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::runScript):
+        * inspector/InspectorDebuggerAgent.h:
+        (InspectorDebuggerAgent):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.NativeMemoryBarChart.prototype._updateView):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._updateHighlightsForRange):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove still more BUILDING_ON_LEOPARD branches now that no port supports leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90256
+
+        Reviewed by Ryosuke Niwa.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::imageTitle):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setAllowsFontSmoothing):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::boundingRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::ctFont):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        * platform/graphics/mac/ComplexTextController.cpp:
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::fontCacheRegisteredFontsChangedNotificationCallback):
+        (WebCore::FontCache::platformInit):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/mac/WebLayer.h:
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/DisplaySleepDisabler.cpp:
+        (WebCore::DisplaySleepDisabler::DisplaySleepDisabler):
+        (WebCore::DisplaySleepDisabler::~DisplaySleepDisabler):
+        * platform/mac/DisplaySleepDisabler.h:
+        (DisplaySleepDisabler):
+        * platform/mac/HTMLConverter.h:
+        * platform/mac/HTMLConverter.mm:
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenuMac::populate):
+        * platform/mac/ScrollElasticityController.mm:
+
+2012-06-29  Zan Dobersek  <zandobersek@gmail.com>
+
+        Unreviewed attempt at a build fix for 64-bit debug build,
+        touch InsertionPoint.cpp to try to get it rebuilt.
+
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore):
+
+2012-06-29  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Don't add Qt module dependencies in features.prf
+
+        The required dependencies are already added in WebCore.pri.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebCore.pri:
+
+2012-06-29  Taiju Tsuiki  <tzik@chromium.org>
+
+        Web Inspector: Add FileSystemView
+        https://bugs.webkit.org/show_bug.cgi?id=73301
+
+        This patch introduce a split view as FileSystemView. Including directory tree as sidebar tree.
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: http/tests/inspector/filesystem/directory-tree.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.py:
+        * inspector/front-end/FileSystemModel.js:
+        (WebInspector.FileSystemModel.Entry.compare):
+        * inspector/front-end/FileSystemView.js: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.showFileSystem):
+        (WebInspector.FileSystemTreeElement.prototype.get itemURL):
+        (WebInspector.FileSystemTreeElement.prototype.onattach):
+        (WebInspector.FileSystemTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.FileSystemTreeElement.prototype._refreshFileSystem):
+        (WebInspector.FileSystemTreeElement.prototype.onselect):
+        (WebInspector.FileSystemTreeElement.prototype.clear):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-06-29  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace v8::Integer::New() with v8Integer() in custom bindings
+        https://bugs.webkit.org/show_bug.cgi?id=90242
+
+        Reviewed by Yury Semikhatsky.
+
+        v8Integer() is a fast wrapper of v8::Integer::New().
+        This patch replaces v8::Integer::New() with v8Integer() in custom bindings,
+        and pass isolates.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::V8CSSStyleDeclaration::namedPropertyEnumerator):
+        (WebCore::V8CSSStyleDeclaration::namedPropertyQuery):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::V8Clipboard::typesAccessorGetter):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::V8DOMStringMap::namedPropertyQuery):
+        (WebCore::V8DOMStringMap::namedPropertyEnumerator):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8DataViewCustom.cpp:
+        (WebCore::V8DataView::getInt8Callback):
+        (WebCore::V8DataView::getUint8Callback):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::V8HTMLInputElement::selectionStartAccessorGetter):
+        (WebCore::V8HTMLInputElement::selectionEndAccessorGetter):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::V8HTMLOptionsCollection::lengthAccessorGetter):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::functionDetailsCallback):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::V8MessageEvent::portsAccessorGetter):
+        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
+        (WebCore::V8MutationCallback::handleEvent):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::namedPropertyGetter):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::V8SQLTransaction::executeSqlCallback):
+        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
+        (WebCore::V8SQLTransactionSync::executeSqlCallback):
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::V8Storage::namedPropertyEnumerator):
+        (WebCore::V8Storage::indexedPropertyGetter):
+        (WebCore::V8Storage::namedPropertyQuery):
+        (WebCore::V8Storage::indexedPropertySetter):
+        (WebCore::V8Storage::indexedPropertyDeleter):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
+        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
+        (WebCore::V8WebGLRenderingContext::getSupportedExtensionsCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2012-06-29  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r121520.
+        http://trac.webkit.org/changeset/121520
+        https://bugs.webkit.org/show_bug.cgi?id=90246
+
+        the performance optimization needs more investigation
+
+        * dom/DatasetDOMStringMap.cpp:
+        (WebCore::convertPropertyNameToAttributeName):
+        * dom/Element.cpp:
+        (WebCore::Element::getAttributeNS):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::removeAttributeNS):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::getAttributeNode):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+
+2012-06-29  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Replace v8::Integer::New() with v8Integer() in bindings/v8/*.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=90238
+
+        Reviewed by Yury Semikhatsky.
+
+        v8Integer() is a fast wrapper of v8::Integer::New().
+        We can replace v8::Integer::New() with v8Integer()
+        in bindings/v8/*.{h,cpp}. In addition, we pass isolate
+        to v8Integer() where possible.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/Dictionary.cpp:
+        (WebCore::Dictionary::get):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_Enumerate): Changed v8::None to 0, for consistency with other code.
+        * bindings/v8/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::addListener):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::compileScript):
+        * bindings/v8/SerializedScriptValue.cpp:
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8Array):
+        (WebCore::v8ValueToWebCoreDOMStringList):
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8Array):
+        (WebCore::v8NumberArrayToVector):
+        * bindings/v8/V8Collection.h:
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::npObjectQueryProperty):
+        (WebCore::npObjectPropertyEnumerator):
+        * bindings/v8/V8NPUtils.cpp:
+        (WebCore::convertNPVariantToV8Object):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::batchConfigureConstants):
+        (WebCore::V8Proxy::compileScript):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/V8WindowErrorHandler.cpp:
+        (WebCore::V8WindowErrorHandler::callListenerFunction):
+        * bindings/v8/V8WorkerContextErrorHandler.cpp:
+        (WebCore::V8WorkerContextErrorHandler::callListenerFunction):
+        * bindings/v8/WorkerScriptDebugServer.cpp:
+        (WebCore::WorkerScriptDebugServer::addListener):
+
+2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Resource content is not loaded if Resource.requestContent method is called before network request is finished.
+        https://bugs.webkit.org/show_bug.cgi?id=90153
+
+        Reviewed by Yury Semikhatsky.
+
+        Test: http/tests/inspector/resource-tree/resource-request-content-while-loading.html
+
+        * inspector/front-end/NetworkRequest.js:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.requestContent):
+        (WebInspector.Resource.prototype._requestFinished):
+
+2012-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121529.
+        http://trac.webkit.org/changeset/121529
+        https://bugs.webkit.org/show_bug.cgi?id=90260
+
+        Failed to compile on Chromium WebKitMacBuilder (Requested by
+        keishi on #webkit).
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::platformAddPathForRoundedRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::setFont):
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore):
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/MemoryPressureHandlerMac.mm:
+        (WebCore):
+        * platform/mac/PlatformEventFactoryMac.mm:
+        (WebCore::momentumPhaseForEvent):
+        (WebCore::phaseForEvent):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/text/cf/HyphenationCF.cpp:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):
+
+2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Add toggle breakpoint shortcut.
+        https://bugs.webkit.org/show_bug.cgi?id=90188
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype._onMouseDown):
+        (WebInspector.JavaScriptSourceFrame.prototype._toggleBreakpoint):
+        (WebInspector.JavaScriptSourceFrame.prototype.toggleBreakpointOnCurrentLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._toggleBreakpoint):
+        (WebInspector.ScriptsPanel.prototype._showOutlineDialog):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.selection):
+
+2012-06-28  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Cursor should follow execution line when debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=90184
+
+        Reviewed by Yury Semikhatsky.
+
+        Added TextViewer.setSelection public method to set cursor selection in the editor.
+        Added TextRange.createFromLocation method to create TextRanges with the same start and end points.
+        Drive-by: removed unused _setCaretLocation() method in TextViewer.js
+
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        (WebInspector.ScriptsPanel.prototype._editorSelected):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.setSelection):
+        (WebInspector.SourceFrame.prototype.setContent):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextRange.createFromLocation):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.setSelection):
+        (WebInspector.TextEditorMainPanel.prototype.highlightLine):
+
+2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: IDBObjectStore.autoIncrement flag not exposed
+        https://bugs.webkit.org/show_bug.cgi?id=89701
+
+        Reviewed by Yury Semikhatsky.
+
+        Plumbed objectStore.autoIncrement to inspector front-end and added it to tooltip.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/Inspector.json:
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.prototype._loadDatabase.callback):
+        (WebInspector.IndexedDBModel.prototype._loadDatabase):
+        (WebInspector.IndexedDBModel.ObjectStore):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IDBObjectStoreTreeElement.prototype._updateTooltip):
+
+2012-06-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        Use floating keyframe rule list when parsing @-webkit-keyframes and allow abrupt rule termination
+        https://bugs.webkit.org/show_bug.cgi?id=90073
+
+        Reviewed by Antti Koivisto.
+
+        - The grammar is changed to allow abruptly terminated stylesheet in the @-webkit-keyframes (use closing_brace, not '}').
+        - A floating StyleKeyframe vector is introduced to separate the creation and filling of StyleRuleKeyframes, as other rules do.
+
+        Test: fast/css/css-keyframe-unexpected-end.html
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createFloatingKeyframeVector):
+        (WebCore):
+        (WebCore::CSSParser::sinkFloatingKeyframeVector):
+        (WebCore::CSSParser::createKeyframesRule):
+        * css/CSSParser.h:
+
+2012-06-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: add character data to the DOM section of native memory view
+        https://bugs.webkit.org/show_bug.cgi?id=89968
+
+        Reviewed by Vsevolod Vlasov.
+
+        Count strings referenced from CharacterData node and its descendants
+        as part of the DOM tree structures in the native memory view.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::reportMemoryUsage):
+        (WebCore):
+        * dom/CharacterData.h:
+        (CharacterData):
+        * dom/MemoryInstrumentation.h:
+        (MemoryInstrumentation):
+        (WebCore::MemoryObjectInfo::reportString):
+        (MemoryObjectInfo):
+        * inspector/InspectorMemoryAgent.cpp:
+        (WebCore):
+        (WebCore::domTreeInfo):
+        (WebCore::jsExternalResourcesInfo):
+        (WebCore::InspectorMemoryAgent::getProcessMemoryDistribution):
+        * inspector/front-end/NativeMemorySnapshotView.js:
+        (WebInspector.MemoryBlockViewProperties._initialize):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD branches now that no port builds on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90252
+
+        Reviewed by Ryosuke Niwa.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::platformAddPathForRoundedRect):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::setFont):
+        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore):
+        * platform/mac/CursorMac.mm:
+        (WebCore::Cursor::ensurePlatformCursor):
+        * platform/mac/MemoryPressureHandlerMac.mm:
+        (WebCore):
+        * platform/mac/PlatformEventFactoryMac.mm:
+        (WebCore::momentumPhaseForEvent):
+        (WebCore::phaseForEvent):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/text/cf/HyphenationCF.cpp:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldShowPlaceholderWhenFocused):
+
+2012-06-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: showConsole() should close previous view in drawer.
+        https://bugs.webkit.org/show_bug.cgi?id=90070
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole):
+        (WebInspector.showPanel):
+
+2012-06-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove a #include erroneously added in r120896.
+
+        * editing/VisibleSelection.h:
+
+2012-06-29  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement Date Time format parser
+        https://bugs.webkit.org/show_bug.cgi?id=89963
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces Unicode TR35 LDML date time format parser for
+        input type "time" if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS) is true.
+
+        Test: WebKit/chromium/tests/DateTimeFormatTest.cpp
+
+        * CMakeLists.txt: Added DateTimeFormat.cpp
+        * GNUmakefile.list.am: Added DateTimeFormat.{cpp,h}
+        * Target.pri: ditto
+        * WebCore.gypi: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/product.pbxproj: ditto
+        * platform/text/DateTimeFormat.cpp: Added.
+        (WebCore::mapCharacterToFieldTypeInternal):
+        (WebCore::DateTimeFormat::DateTimeFormat):
+        (WebCore::DateTimeFormat::mapCharacterToFieldType):
+        (WebCore::DateTimeFormat::parse):
+        * platform/text/DateTimeFormat.h: Added.
+        (DateTimeFormat):
+        (TokenHandler):
+        (WebCore::DateTimeFormat::TokenHandler::~TokenHandler):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD usage in PLATFORM(MAC) code
+        https://bugs.webkit.org/show_bug.cgi?id=85846
+
+        Reviewed by Adam Barth.
+
+        PLATFORM(MAC) has not supported Leopard for several months now.
+        This change removes about 1/3 of the remaining BUILDING_ON_LEOPARD
+        uses in the PLATFORM(MAC) codepaths.  PLATFORM(CHROMIUM) still
+        supports BUILDING_ON_LEOPARD for now.
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::updateRangesAfterChildrenChanged):
+        (WebCore::Document::nodeChildrenWillBeRemoved):
+        (WebCore::Document::nodeWillBeRemoved):
+        (WebCore::Document::textInserted):
+        (WebCore::Document::textRemoved):
+        (WebCore::Document::textNodesMerged):
+        (WebCore::Document::textNodeSplit):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::pasteWithPasteboard):
+        * loader/EmptyClients.h:
+        (EmptyEditorClient):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        (WebCore::ContextMenuController::createAndAppendSpellingAndGrammarSubMenu):
+        (WebCore):
+        (WebCore::ContextMenuController::populate):
+        (WebCore::ContextMenuController::checkOrEnableIfNeeded):
+        * page/EditorClient.h:
+        (EditorClient):
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagSearchWeb):
+        * platform/MemoryPressureHandler.cpp:
+        (WebCore):
+        * platform/SuddenTermination.h:
+        (WebCore):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::updateContentsImage):
+        (WebCore::GraphicsLayerCA::constrainedSize):
+        * platform/graphics/ca/PlatformCALayer.h:
+        (PlatformCALayer):
+        * platform/graphics/ca/mac/PlatformCAAnimationMac.mm:
+        (fromCAValueFunctionType):
+        (PlatformCAAnimation::valueFunction):
+        (PlatformCAAnimation::setValueFunction):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (toCAFilterType):
+        (PlatformCALayer::anchorPoint):
+        (PlatformCALayer::setAnchorPoint):
+        (PlatformCALayer::contentsTransform):
+        (PlatformCALayer::setContentsTransform):
+        (PlatformCALayer::isGeometryFlipped):
+        (PlatformCALayer::setGeometryFlipped):
+        (PlatformCALayer::acceleratesDrawing):
+        (PlatformCALayer::setAcceleratesDrawing):
+        (PlatformCALayer::setMinificationFilter):
+        (PlatformCALayer::setMagnificationFilter):
+        (PlatformCALayer::contentsScale):
+        (PlatformCALayer::setContentsScale):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setScale):
+        (WebCore::TileCache::setAcceleratesDrawing):
+        (WebCore::TileCache::createTileLayer):
+
+2012-06-29  Kwang Yul Seo  <skyul@company100.net>
+
+        Use StringBuilder in SegmentedString::toString()
+        https://bugs.webkit.org/show_bug.cgi?id=90247
+
+        Reviewed by Adam Barth.
+
+        Use a StringBuilder instead of String concatenation because StringBuilder is generally faster.
+        No new tests. Covered by existing tests.
+
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::toString):
+        * platform/text/SegmentedString.h:
+        (WebCore::SegmentedSubstring::appendTo):
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix after r121518.
+
+        * WebCore.exp.in:
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        DOMHTMLCollection::item may return a wrong element after namedItem is called
+        https://bugs.webkit.org/show_bug.cgi?id=90240
+
+        Reviewed by Antti Koivisto.
+
+        The bug was caused by namedItem updating m_cache.current without updating m_cache.position.
+        Fixed the bug by updating both. This is similar to the bug I fixed in r121478.
+
+        WebKit API Test: WebKit1.HTMLCollectionNamedItemTest
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::namedItem):
+
+2012-06-28  Kentaro Hara  <haraken@chromium.org>
+
+        Change argument types of Element::getAttribute*() from String to AtomicString
+        https://bugs.webkit.org/show_bug.cgi?id=90246
+
+        Reviewed by Ryosuke Niwa.
+
+        This is a follow-up patch for r121439. r121439 changed an argument type of
+        Element::getAttribute() from String to AtomicString, which optimized
+        performance of Dromaeo/dom-attr.html. This patch changes other argument types
+        of Element::getAttribute*() from String to AtomicString. See the ChangeLog in
+        http://trac.webkit.org/changeset/121439 for more details about why this change
+        optimizes performance.
+
+        No tests. No change in behavior.
+
+        * dom/DatasetDOMStringMap.cpp:
+        (WebCore::convertPropertyNameToAttributeName):
+        * dom/Element.cpp:
+        (WebCore::Element::getAttributeNS):
+        (WebCore::Element::removeAttribute):
+        (WebCore::Element::removeAttributeNS):
+        (WebCore::Element::getAttributeNode):
+        (WebCore::Element::getAttributeNodeNS):
+        (WebCore::Element::hasAttribute):
+        (WebCore::Element::hasAttributeNS):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::getAttributeNode):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+
+2012-06-28  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r106388): Form hidden element values being restored
+        incorrectly for dynamically generated content
+        https://bugs.webkit.org/show_bug.cgi?id=88685
+
+        Reviewed by Hajime Morita.
+
+        We should not save value attribute updated during parsing.
+
+        Test: fast/forms/state-restore-to-non-edited-controls.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        Initialize m_valueAttributeWasUpdatedAfterParsing.
+        (WebCore::HTMLInputElement::parseAttribute):
+        Set true to m_valueAttributeWasUpdatedAfterParsing if value
+        attribute is updated and it's not in parsing.
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::valueAttributeWasUpdatedAfterParsing):
+        Added for HiddenInputType.
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::saveFormControlState):
+        Save the value only if valueAttributeWasUpdatedAfterParsing() is true.
+
+2012-06-28  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] NodeRenderingContext ctor could be built on top of the ComposedShadowTreeWalker
+        https://bugs.webkit.org/show_bug.cgi?id=89732
+
+        Reviewed by Dimitri Glazkov.
+
+        The constructor of NodeRenderingContext implements almost same
+        logic as ComposedShadowTreeWalker::parent().  This change
+        eliminates the duplication by employing ComposedShadowTreeWalker in the constructor.
+
+        ComposedShadowTreeWalker has same difference from
+        NodeRenderingContext though. So this change also extends
+        ComposedShadowTreeWalker to support these missing pieces, which
+        are encapsulated in newly introduced ParentTranversalDetails
+        class where:
+
+        - not only the parent, but also the insertion point of the child is returned,
+        - resetStyleInheritance from the child-parent traversal is computed and
+        - if the starting point is out of the composition, it returns null as a parent.
+
+        This change also inlines some ComposedShadowTreeWalker methods for speed.
+
+        No new tests. Covered by existing tests.
+
+        * WebCore.exp.in:
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::shadowOfParent):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseInsertionPoint):
+        (WebCore):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseShadowRoot):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::didFindNode):
+        (WebCore::ComposedShadowTreeWalker::findParent):
+        (WebCore::ComposedShadowTreeWalker::escapeFallbackContentElement):
+        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
+        (WebCore::ComposedShadowTreeWalker::traverseParent):
+        (WebCore::ComposedShadowTreeWalker::traverseParentInCurrentTree):
+        (WebCore::ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost):
+        * dom/ComposedShadowTreeWalker.h:
+        (ParentTranversalDetails):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::ParentTranversalDetails):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::node):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::insertionPoint):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::resetStyleInheritance):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::outOfComposition):
+        (WebCore::ComposedShadowTreeWalker::ParentTranversalDetails::childWasOutOfComposition):
+        (ComposedShadowTreeWalker):
+        (WebCore::ComposedShadowTreeWalker::ComposedShadowTreeWalker):
+        (WebCore):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+        (WebCore::NodeRenderingContext::parentRenderer):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        (WebCore::NodeRenderingContext::isOnEncapsulationBoundary):
+        * dom/NodeRenderingContext.h:
+        (NodeRenderingContext):
+        (WebCore::NodeRenderingContext::parentNodeForRenderingAndStyle):
+        (WebCore::NodeRenderingContext::resetStyleInheritance):
+        (WebCore::NodeRenderingContext::insertionPoint):
+
+2012-06-28  Stephen White  <senorblanco@chromium.org>
+
+        Implement filter url() function.
+        https://bugs.webkit.org/show_bug.cgi?id=72443
+
+        url() references can be internal, in which case the DOM nodes are
+        retrieved directly from the current document, or external, in which
+        case a CachedSVGDocument request is made, and the filter node build is
+        deferred until the document is loaded.  WebKitSVGDocumentValue
+        holds the CachedSVGDocument (if any) and the URL as a CSSValue,
+        and is stored in the CSSValue chain as the argument to the reference
+        filter.
+
+        One notable difference between internal and external references is
+        that internal references will automatically update on an SVG filter node
+        attribute change, while external references will not, since they live
+        in a separate document.  This is consistent with the Mozilla
+        implementation.  In order to make this work, the RenderLayer is made a
+        client of the RenderSVGResourceContainer, and calls
+        filterNeedsRepaint() when the SVG nodes are invalidated.
+
+        Some plumbing:  The CSS StyleResolver was refactored to load all
+        all external resources (images, shaders and (now) SVG filters) in a
+        single function, loadPendingResources().  The PlatformLayer typedef
+        was moved out into its own file, in order to break a cyclic
+        dependency.  SVGFilterBuilder was modified to accept the SourceGraphic
+        and SourceAlpha FilterEffects in its constructor and factory function,
+        rather than extracting them from the parent Filter.  (This is necessary
+        so that the url() filter can correctly hook up its inputs from
+        previous CSS filters.)
+
+        Reviewed by Dean Jackson.
+
+        Tests: css3/filters/effect-reference-external.html
+               css3/filters/effect-reference-hw.html
+               css3/filters/effect-reference-ordering.html
+               css3/filters/effect-reference.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add WebKitCSSSVGDocumentValue to the various build files.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForFilter):
+        Use the reference filter's url when getting the computed style for
+        a reference filter.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFilter):
+        Create the referenceFilterValue's argument as a
+        WebKitCSSSVGDocumentValue instead of a CSS string.
+        * css/CSSValue.cpp:
+        (WebCore::CSSValue::cssText):
+        Add support for WebKitCSSSVGDocumentValue.
+        (WebCore::CSSValue::destroy):
+        Add support for WebKitCSSSVGDocumentValue.
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isWebKitCSSSVGDocumentValue):
+        Add support for WebKitCSSSVGDocumentValue.
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+        Keep track of pending SVG document references, and load them when
+        necessary.
+        * css/StyleResolver.h:
+        * css/WebKitCSSSVGDocumentValue.cpp: Added.
+        New CSSValue subclass for holding SVG document references.
+        (WebCore::WebKitCSSSVGDocumentValue::WebKitCSSSVGDocumentValue):
+        (WebCore::WebKitCSSSVGDocumentValue::~WebKitCSSSVGDocumentValue):
+        (WebCore::WebKitCSSSVGDocumentValue::load):
+        (WebCore::WebKitCSSSVGDocumentValue::customCssText):
+        * css/WebKitCSSSVGDocumentValue.h: Added.
+        (WebCore::WebKitCSSSVGDocumentValue::create):
+        (WebCore::WebKitCSSSVGDocumentValue::cachedSVGDocument):
+        (WebCore::WebKitCSSSVGDocumentValue::url):
+        (WebCore::WebKitCSSSVGDocumentValue::loadRequested):
+        * platform/graphics/GraphicsLayer.h:
+        Refactor PlatformLayer out into its own file, to avoid circular
+        includes.
+        * platform/graphics/ImageBuffer.h:
+        Include PlatformLayer.h instead of GraphicsLayer.h.
+        * platform/graphics/PlatformLayer.h: Added.
+        Refactor PlatformLayer out into its own file, to avoid circular
+        includes.
+        * platform/graphics/filters/FilterOperation.h:
+        (WebCore::ReferenceFilterOperation::create):
+        (WebCore::ReferenceFilterOperation::clone):
+        (WebCore::ReferenceFilterOperation::url):
+        (WebCore::ReferenceFilterOperation::fragment):
+        (ReferenceFilterOperation):
+        (WebCore::ReferenceFilterOperation::data):
+        (WebCore::ReferenceFilterOperation::setData):
+        (WebCore::ReferenceFilterOperation::operator==):
+        (WebCore::ReferenceFilterOperation::ReferenceFilterOperation):
+        Augment ReferenceFilterOperation to maintain a data pointer,
+        in order to preserve context while loading external SVG documents.
+        Replace "reference" with "url" and "fragment" members, in order to
+        ease retrieval of the appropriate DOM objects.
+        * platform/graphics/filters/FilterOperations.cpp:
+        (WebCore::FilterOperations::hasReferenceFilter):
+        Convenience function for finding reference filters.
+        * platform/graphics/filters/FilterOperations.h:
+        (FilterOperations):
+        * platform/mac/ScrollbarThemeMac.mm:
+        Include GraphicsLayer.h explicitly, since ImageBuffer.h no longer
+        includes it (and only includes PlatformLayer.h).
+        * rendering/FilterEffectRenderer.cpp:
+        (WebCore::FilterEffectRenderer::buildReferenceFilter):
+        Utility function to build a FilterEffect node graph for a
+        ReferenceFilterOperation.
+        (WebCore::FilterEffectRenderer::build):
+        Call the above builder function for ReferenceFilterOperations.
+        * rendering/FilterEffectRenderer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateOrRemoveFilterEffect):
+        If we have reference filters, update them along with other filters.
+        (WebCore::RenderLayer::filterNeedsRepaint):
+        * rendering/RenderLayerFilterInfo.cpp:
+        (WebCore::RenderLayerFilterInfo::~RenderLayerFilterInfo):
+        (WebCore::RenderLayerFilterInfo::notifyFinished):
+        Implement callback function when external SVGDocuments are loaded.
+        (WebCore::RenderLayerFilterInfo::updateReferenceFilterClients):
+        Add the FilterInfo as a client to be called when SVGDocuments are
+        loaded.
+        (WebCore::RenderLayerFilterInfo::removeReferenceFilterClients):
+        Remove this from the list of notified clients.
+        * rendering/RenderLayerFilterInfo.h:
+        Add new member vars for tracking internal and external SVG
+        references, so we can remove ourselves as a client when done.
+        * rendering/svg/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
+        When marking client DOM nodes for repaint, also mark any RenderLayers
+        referring to this DOM tree via filters as needing repaint.
+        (WebCore::RenderSVGResourceContainer::addClientRenderLayer):
+        (WebCore::RenderSVGResourceContainer::removeClientRenderLayer):
+        * rendering/svg/RenderSVGResourceContainer.h:
+        Maintain a list of RenderLayer clients on each SVG resource container,
+        and turn SVG DOM repaint notifications into filter repaint (CSS)
+        notifications.
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::buildPrimitives):
+        Construct a SourceGraphic and SourceAlpha node explicitly for the
+        SVG builder case.
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        * svg/graphics/filters/SVGFilterBuilder.h:
+        (WebCore::SVGFilterBuilder::create):
+        Add the SourceGraphic and SourceAlpha as parameters to the constructor
+        and create() methods, so they can be supplied by the caller.
+
+2012-06-28  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] CTFontCopyTable of MacOSX10.5 SDK doesn't work for layout tables
+        https://bugs.webkit.org/show_bug.cgi?id=90235
+
+        Reviewed by Kent Tamura.
+
+        Use CGFontCopyTableForTag instead.
+
+        No new tests. css3/font-feature-settings-rendering.html should pass. I'll rebase expectations once bots get the result.
+
+        * platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp:
+        (WebCore::harfbuzzCoreTextGetTable):
+
+2012-06-28  Philip Rogers  <pdr@google.com>
+
+        Add preventative assert in SVGTRefElement
+        https://bugs.webkit.org/show_bug.cgi?id=90203
+
+        Reviewed by Abhishek Arya.
+
+        SVGTRefElement::detachTarget() adds a pending resource via addPendingResource.
+        Due to some recent bugs in this area, an assert is being added to prevent
+        users from calling detachTarget when not in a document. Doing
+        so would create a bug such as in WK90042.
+
+        This assert will not fire currently because detachTarget is only called after
+        a DOMNodeRemovedFromDocumentEvent event fires, which only comes from
+        dispatchChildRemovalEvents when the node is in a document.
+
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::detachTarget):
+
+2012-06-28  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [Qt] Remove unnecessary AffineTransform calls
+        https://bugs.webkit.org/show_bug.cgi?id=90178
+
+        Reviewed by Noam Rosenthal.
+
+        Qt currently ignores the const AffineTransform& parameter on
+        Pattern::createPlatformPattern, so removing it from all its Qt calls and
+        changing the function signature if platform is Qt.
+
+        * platform/graphics/Pattern.h:
+        (Pattern):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::fillPenForContext):
+        (WebCore::strokePenForContext):
+        * platform/graphics/qt/FontQt4.cpp:
+        (WebCore::fillPenForContext):
+        (WebCore::strokePenForContext):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::drawRepeatPattern):
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2012-06-28  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] When uploading an opaque image to a texture for TextureMapper, unnecessary alpha operations take place
+        https://bugs.webkit.org/show_bug.cgi?id=90229
+
+        Reviewed by Luiz Agostini.
+
+        For opaque web content in WebKit2, we use the RGB32 image format. When we special-case
+        it in GraphicsContext3DQt, we can avoid any alpha operations and perform a regular copy.
+
+        Covered existing API tests, as this code path is always used when rendering.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Compile chromium compositor implementation files into separate .lib
+        https://bugs.webkit.org/show_bug.cgi?id=90233
+
+        Reviewed by Adam Barth.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-06-28  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] NodeList wrappers are not kept alive as needed
+        https://bugs.webkit.org/show_bug.cgi?id=90194
+
+        Reviewed by Ojan Vafai.
+
+        We need to add custom reachability code for DynamicNodeLists. If the owner of
+        a DynamicNodeList is reachable then the DynamicNodeList must also be reachable.
+
+        Test: fast/dom/NodeList/nodelist-reachable.html
+
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::V8NodeList::visitDOMWrapper): AddImplicitReferences from the owner wrapper.
+        (WebCore):
+        * dom/NodeList.idl:
+
+2012-06-28  Elliott Sprehn  <esprehn@gmail.com>
+
+        frameborder="no" on frameset is ignored if border attribute set
+        https://bugs.webkit.org/show_bug.cgi?id=17767
+
+        Reviewed by Tony Chang.
+
+        Fixes <frameset> frameborder and border handling. Previously we'd
+        override the frameborder=no setting if border was set. We also
+        treated frameborder="anything" the same as frameborder=0 since we
+        we just converted it to a number so frameborder=yes was incorrectly
+        treated the same as frameborder=no.
+
+        Tests: fast/frames/frameset-frameborder-boolean-values.html
+               fast/frames/frameset-frameborder-inheritance.html
+               fast/frames/frameset-frameborder-overrides-border.html
+
+        * html/HTMLFrameSetElement.cpp: Proper parsing of yes,no,1,0 values.
+        (WebCore::HTMLFrameSetElement::parseAttribute):
+        * html/HTMLFrameSetElement.h:
+        (WebCore::HTMLFrameSetElement::border): Border should be 0 if frameborder=no.
+
+2012-06-28  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Implement IDBTransaction internal active flag
+        https://bugs.webkit.org/show_bug.cgi?id=89379
+
+        Reviewed by Tony Chang.
+
+        IDB transactions should only be "active" during IDB success/error callbacks;
+        attempts to make new requests otherwise (e.g. in a setTimeout callback)
+        should fail even if the transaction has not yet finished. Implement this logic,
+        and the closely related requirement that transactions are deactivated when
+        the context they were created in returns to the event loop, and finally that
+        when so deactivated they should commit rather than abort (as previously
+        implemented) if no requests have been filed.
+
+        Tests: storage/indexeddb/transaction-active-flag.html
+               storage/indexeddb/transaction-complete-with-js-recursion-cross-frame.html
+               storage/indexeddb/transaction-complete-with-js-recursion.html
+               storage/indexeddb/transaction-complete-workers.html
+
+        * Modules/indexeddb/IDBPendingTransactionMonitor.cpp: Simplify API.
+        (WebCore::transactions):
+        (WebCore::IDBPendingTransactionMonitor::addNewTransaction):
+        (WebCore::IDBPendingTransactionMonitor::deactivateNewTransactions):
+        * Modules/indexeddb/IDBPendingTransactionMonitor.h:
+        (WebCore):
+        (IDBPendingTransactionMonitor):
+        * Modules/indexeddb/IDBRequest.cpp: Unregisters from transaction when done,
+        not on destruction. No longer responsible for working with the pending monitor.
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::~IDBRequest):
+        (WebCore::IDBRequest::markEarlyDeath):
+        (WebCore::IDBRequest::resetReadyState):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::dispatchEvent): Set active flag on transaction during callback.
+        * Modules/indexeddb/IDBTransaction.cpp: Use state enum to better track lifecycle, and
+        take ownership of relationship with pending monitor.
+        (WebCore::IDBTransaction::IDBTransaction): Special cases for version change
+        transactions.
+        (WebCore::IDBTransaction::~IDBTransaction):
+        (WebCore::IDBTransaction::error):
+        (WebCore::IDBTransaction::setError):
+        (WebCore::IDBTransaction::objectStore):
+        (WebCore::IDBTransaction::objectStoreCreated):
+        (WebCore::IDBTransaction::objectStoreDeleted):
+        (WebCore::IDBTransaction::setActive): Let IDBRequest and IDBPendingTransactionMonitor
+        toggle the active state. Needs some smarts because (1) state may move to Finishing during
+        the request's dispatch phase due to an implicit/explicit abort, and (2) a monitor call
+        will only trigger a commit if the transaction hasn't had any requests filed.
+        (WebCore):
+        (WebCore::IDBTransaction::abort):
+        (WebCore::IDBTransaction::registerRequest):
+        (WebCore::IDBTransaction::unregisterRequest):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        (WebCore::IDBTransaction::hasPendingActivity):
+        (WebCore::IDBTransaction::dispatchEvent):
+        (WebCore::IDBTransaction::canSuspend):
+        (WebCore::IDBTransaction::enqueueEvent):
+        * Modules/indexeddb/IDBTransaction.h:
+        (WebCore::IDBTransaction::isFinished):
+        (IDBTransaction):
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::commit): Allow explicit commit() calls from the front end
+        if no requests have been filed.
+        * Modules/indexeddb/IDBTransactionBackendInterface.h:
+        (IDBTransactionBackendInterface): Expose commit() method.
+        * bindings/js/JSMainThreadExecState.cpp:
+        (WebCore::JSMainThreadExecState::didLeaveScriptContext): Change target function name.
+        * bindings/v8/V8RecursionScope.cpp:
+        (WebCore::V8RecursionScope::didLeaveScriptContext): Change target function name.
+
+2012-06-28  Philip Rogers  <pdr@google.com>
+
+        Prevent crash in animate resource handling
+        https://bugs.webkit.org/show_bug.cgi?id=90042
+
+        Reviewed by Abhishek Arya.
+
+        This patch adds a check that we are in a document before registering animation
+        resources and creating a target element in SVGSMILElement. This prevents a crash where
+        we would register resources and create the target when we were not in a document
+        but fail to deregister / reset the target when we were removed from a document.
+        In failing to reset the target, we can crash when trying to deregister resources that
+        were not created after being inserted into a document and then removed.
+
+        The existence of m_targetResources and registered animation resources is now
+        tied to being in a document.
+
+        Test: svg/custom/animate-reference-crash.html
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::targetElement):
+
+2012-06-28  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBDatabase should have a close pending field.
+        https://bugs.webkit.org/show_bug.cgi?id=71129
+
+        Reviewed by Tony Chang.
+
+        Handle the IDB spec case that "versionchange" events should not be fired 
+        against connections that have the internal "closePending" flag set but 
+        are not yet closed due to running transactions.
+
+        Test: storage/indexeddb/database-closepending-flag.html
+
+        * Modules/indexeddb/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::onVersionChange):
+
+2012-06-28  Adrienne Walker  <enne@google.com>
+
+        [chromium] Split WebScrollbar into WebPluginScrollbar and WebScrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=90117
+
+        Reviewed by James Robinson.
+
+        Make WebCore also depend on Platform.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-06-28  Hayato Ito  <hayato@chromium.org>
+
+        CompositeShadowTreeWalker should use InsertionPoint::hasDistribution() instead of InsertionPoint::isActive().
+        https://bugs.webkit.org/show_bug.cgi?id=89177
+
+        Reviewed by Dimitri Glazkov.
+
+        Prevents ComposedShadowTreeWalker from escaping out of an
+        insertion point (which has distributed nodes) from a non-used
+        fallback element in the insertion point.  Such a fallback element
+        should be treated as in an orphaned subtree.
+
+        ComposedShadowTreeParentWalker will be also fixed in a follow-up patch.
+
+        Test: fast/dom/shadow/composed-shadow-tree-walker.html
+
+        * dom/ComposedShadowTreeWalker.cpp:
+        (WebCore::ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents):
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Cleanup HTMLFormCollection
+        https://bugs.webkit.org/show_bug.cgi?id=90111
+
+        Reviewed by Andreas Kling.
+
+        Got rid of getNamedItem and renamed getNamedFormItem to firstNamedItem and got rid of duplicateNumber argument since
+        it's always 0. Also made it a static local function. In addition, removed nextItem() since it's not used anywhere.
+
+        WebKit API Test: WebKit1.HTMLFormCollectionNamedItemTest
+
+        * html/HTMLFormCollection.cpp:
+        (WebCore::firstNamedItem):
+        (WebCore):
+        (WebCore::HTMLFormCollection::namedItem):
+        * html/HTMLFormCollection.h:
+        (HTMLFormCollection):
+
+2012-06-28  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Hook up render-side key ASSERTing for get()
+        https://bugs.webkit.org/show_bug.cgi?id=90001
+
+        Reviewed by Tony Chang.
+
+        Hook up the new onSuccess and add it to the interface. For now,
+        simply assert that the right value is set. Add the same assertion
+        logic in the value-construction logic when the cursor advances.
+
+        No new tests, existing tests verify this refactor is correct.
+
+        * Modules/indexeddb/IDBCallbacks.h:
+        (IDBCallbacks):
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        * Modules/indexeddb/IDBRequest.cpp:
+        (WebCore):
+        (WebCore::IDBRequest::onSuccess):
+        * Modules/indexeddb/IDBRequest.h:
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore):
+
+2012-06-28  Gregg Tavares  <gman@google.com>
+
+        Add support for DEPTH_STENCIL to WEBGL_depth_texture
+        https://bugs.webkit.org/show_bug.cgi?id=90109
+
+        Reviewed by Kenneth Russell.
+
+        * html/canvas/WebGLDepthTexture.idl:
+        * html/canvas/WebGLFramebuffer.cpp:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::validateTexFuncFormatAndType):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move chromium compositor implementation files into separate section in WebCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=90201
+
+        Reviewed by Adam Barth.
+
+        This moves the chromium compositor implementation files to a separate gyp variable to make future changes
+        easier. The files still all link into webcore_platform.lib, as before.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Use Eina_Module API instead of dlopen in PluginPackageEfl
+        https://bugs.webkit.org/show_bug.cgi?id=89972
+
+        Reviewed by Antonio Gomes.
+
+        Use convenience helpers in Eina_Module to load plugins instead
+        of POSIX dlopen().
+
+        No new tests, behavior has not changed.
+
+        * platform/FileSystem.h:
+        (WebCore):
+        * platform/efl/FileSystemEfl.cpp:
+        (WebCore::unloadModule):
+        * plugins/efl/PluginPackageEfl.cpp:
+        (WebCore::PluginPackage::load):
+
+2012-06-28  Jocelyn Turcotte  <turcotte.j@gmail.com>
+
+        [Qt] Fix TextureMapper rendering of GraphicsSurface on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=90154
+
+        Reviewed by Noam Rosenthal.
+
+        Fix a regression introduced in r120608.
+        texture2DRect takes texel coordinates, unlike texture2D which needs normalized coordinates.
+
+        Pass an additional textureSize uniform and multiply it by the normalized coordinates.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore::TextureMapperGL::drawTextureRectangleARB):
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        (WebCore::TextureMapperShaderProgram::TextureMapperShaderProgram):
+        (WebCore::TextureMapperShaderProgramRectSimple::TextureMapperShaderProgramRectSimple):
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (WebCore::TextureMapperShaderProgram::textureSizeLocation):
+        (TextureMapperShaderProgram):
+
+2012-06-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Improve compositing logging output
+        https://bugs.webkit.org/show_bug.cgi?id=90199
+
+        Reviewed by Tim Horton (w00t!).
+
+        Improve the compositing logging channel output in a few
+        useful ways:
+        1. Report memory use, rather than megapixels
+        2. Show element class names
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::backingStoreMemoryEstimate):
+        * platform/graphics/GraphicsLayer.h:
+        (GraphicsLayer):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::backingStoreMemoryEstimate):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::nameForLayer):
+        (WebCore::RenderLayerBacking::backingStoreMemoryEstimate):
+        * rendering/RenderLayerBacking.h:
+        (RenderLayerBacking):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::logLayerInfo):
+        (WebCore::RenderLayerCompositor::updateOverflowControlsLayers):
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Fix up more includes in compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=90200
+
+        Reviewed by Adrienne Walker.
+
+        Adds includes we are using and removes ones that we aren't using.
+
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        * platform/graphics/chromium/ProgramBinding.cpp:
+        * platform/graphics/chromium/RenderSurfaceChromium.cpp:
+        * platform/graphics/chromium/cc/CCGraphicsContext.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore):
+        * platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp:
+
+2012-06-28  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions]Rename NamedFlow::contentNodes to NamedFlow::getContent()
+        https://bugs.webkit.org/show_bug.cgi?id=90163
+
+        Reviewed by Andreas Kling.
+
+        Latest CSS Regions spec defines the NamedFlow interface as having a function named getContent,
+        rather than an attribute named contentNodes.
+        http://www.w3.org/TR/css3-regions/#the-namedflow-interface
+
+        Test: fast/regions/webkit-named-flow-get-content.html
+
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::getContent):
+        * dom/WebKitNamedFlow.h:
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r121232): named properties on document and window may return wrong object
+        https://bugs.webkit.org/show_bug.cgi?id=90133
+
+        Reviewed by Andreas Kling.
+
+        Fixed the bug. Also replaced hasAnyItem by isEmpty (hasAnyItem() is equivalent to !isEmpty()).
+
+        Test: fast/dom/HTMLDocument/named-item-multiple-match.html
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::namedPropertyGetter):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::V8HTMLDocument::GetNamedProperty):
+        * html/HTMLCollection.h:
+        (WebCore::HTMLCollection::isEmpty):
+        (WebCore::HTMLCollection::hasExactlyOneItem):
+
+2012-06-28  Zeev Lieber  <zlieber@chromium.org>
+
+        [Skia] Computing the resampling mode ignores scale applied to the canvas
+        https://bugs.webkit.org/show_bug.cgi?id=72073
+
+        Reviewed by Stephen White.
+
+        Re-basing earlier patch by Daniel Sievers; updated tests.
+
+        Take into account canvas scale when computing image resampling mode.
+
+        When drawing a bitmap and computing the best resampling mode based
+        on the requested scale, take into account CSS scale and page scale
+        that are applied to the canvas. This allows for single-pass scaling
+        in potentially better quality (RESAMPLE_AWESOME) and also takes
+        better advantage of the scaled image cache in that codepath.
+
+        Existing tests updated to expect different resampling method (and
+        therefore a different image) whenever canvas scaling changes.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Should schedule a commit when dropping contents textures
+        https://bugs.webkit.org/show_bug.cgi?id=90031
+
+        Reviewed by Adrienne Walker.
+
+        If we're dropping contents textures on the impl thread, we need to schedule a commit to pick up new contents at
+        the next commit opportunity. Also adds some traces to make debugging issues like this easier.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::commitComplete):
+        (WebCore::CCLayerTreeHostImpl::canDraw):
+        (WebCore::CCLayerTreeHostImpl::releaseContentsTextures):
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::processScheduledActions):
+
+2012-06-28  Antti Koivisto  <antti@apple.com>
+
+        Don't malloc RenderGeometryMap steps individually
+        https://bugs.webkit.org/show_bug.cgi?id=90074
+
+        Reviewed by Simon Fraser.
+
+        Mallocs and frees for steps under RenderGeometryMap::pus/popMappingsToAncestor can total ~2% of the profile when animating transforms.
+
+        * rendering/RenderGeometryMap.cpp:
+        (WebCore):
+        (WebCore::RenderGeometryMap::absolutePoint):
+        (WebCore::RenderGeometryMap::absoluteRect):
+        (WebCore::RenderGeometryMap::mapToAbsolute):
+        (WebCore::RenderGeometryMap::push):
+        (WebCore::RenderGeometryMap::pushView):
+        (WebCore::RenderGeometryMap::popMappingsToAncestor):
+        * rendering/RenderGeometryMap.h:
+        (WebCore):
+        (WebCore::RenderGeometryMapStep::RenderGeometryMapStep):
+        
+            Move to header.
+
+        (RenderGeometryMapStep):
+        (RenderGeometryMap):
+        
+            Make the step vector hold RenderGeometryMapSteps instead of RenderGeometryMapStep*'s.
+
+        (WTF):
+        
+            Give RenderGeometryMapSteps SimpleClassVectorTraits. This is needed for dealing with OwnPtr in the struct (and makes it faster too).
+            The type is simple enought to move by memcpy.
+
+2012-06-28  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK] Remove Windows support from plugins/gtk/
+        https://bugs.webkit.org/show_bug.cgi?id=89501
+
+        Reviewed by Martin Robinson.
+
+        The GTK+ port now uses plugins/gtk/ on Windows, which leaves
+        PluginPackageGtk.cpp and PluginViewGtk.cpp solely for XP_UNIX platforms.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::webkitgtkXError):
+        (WebCore::PluginPackage::load):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::getRootWindow):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformGetValueStatic):
+        (WebCore::PluginView::platformGetValue):
+        (WebCore::getPluginDisplay):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2012-06-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Change FrameView::scrollContentsFastPath to use m_fixedObjects
+        https://bugs.webkit.org/show_bug.cgi?id=90045
+
+        Reviewed by James Robinson.
+        
+        FrameView now has a hash set of fixed-position objects, so use
+        that instead of RenderBlock::positionedObjects(); we'll avoid traversing
+        through absolutely positioned objects, and this will work better for sticky
+        positioning in future.
+
+        No behavior change, so no new tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-06-28  Tony Chang  <tony@chromium.org>
+
+        Split flex into flex-grow/flex-shrink/flex-basis
+        https://bugs.webkit.org/show_bug.cgi?id=86525
+
+        Reviewed by Ojan Vafai.
+
+        Split flex into 3 separate properties per the spec:
+        http://dev.w3.org/csswg/css3-flexbox/#flex-components
+
+        Tests: css3/flexbox/flex-longhand-parsing.html
+               css3/flexbox/flex-property-parsing.html: Updated test results.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore): -webkit-flex is no longer enumerable.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add new css property names and use
+        getCSSPropertyValuesForShorthandProperties for WebkitFlex. Also sort flex propery names.
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue): Fix indent.
+        (WebCore::CSSParser::parseValue): Add parsing for new properties and handle -webkit-flex: none.
+        (WebCore::CSSParser::parseFlex): Switch to new names (positive -> grow, negative -> shrink,
+        preferred size -> basis) and assign to longhand properties.
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty): Add new properties.
+        * css/CSSPropertyNames.in: Add new properties.
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder): Delete special handling of applying flex and just use shorthand handlers.
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyValue): Add new shorthand.
+        (WebCore::StylePropertySet::asText):
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::webkitFlexShorthand): Add new shorthand.
+        (WebCore::shorthandForProperty):
+        * css/StylePropertyShorthand.h:
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList): Add to list of properties applied by StyleBuilder.
+        Handle initial and inherit for flex.
+
+2012-06-28  Kalev Lember  <kalevlember@gmail.com>
+
+        [GTK][Win]: Fix plugin drawing to an offscreen buffer
+        https://bugs.webkit.org/show_bug.cgi?id=89499
+
+        Reviewed by Brent Fulgham.
+
+        Take into account that the GTK+ port draws to a backing store and adjust
+        the target rectangle calculation accordingly.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::setNPWindowRect):
+
+2012-06-28  Kentaro Hara  <haraken@chromium.org>
+
+        Optimize Dromaeo/dom-attr.html by speeding up Element::getAttribute()
+        https://bugs.webkit.org/show_bug.cgi?id=90174
+
+        Reviewed by Adam Barth.
+
+        This patch improves performance of Dromaeo/dom-attr.html by 4.0%.
+        The patch improves performance of getAttribute() and JavaScript
+        property setter for DOM objects (e.g. 'div.foo = 123').
+        The performance improvement becomes larger, as the number of
+        attributes defined on the DOM object increases.
+
+        Without the patch in Chromium/Linux (runs/s)
+        7679.4, 7739.7, 7634.0, 7726.4, 7663.9
+
+        With the patch in Chromium/Linux (runs/s)
+        7977.7, 8032.2, 8112.8, 7948.1, 7924.5
+
+        This patch just changes a type of 'name' of Element::getAttribute(String& name)
+        from String& to AtomicString&.
+
+        The key observation is that AtomicString(String& x) is faster than
+        operator==(String& x, AtomicString& y). AtomicString(String& x) calculates
+        a hash of a given String and adds it to a hash table. The calculation
+        complexity is O(the length of x). On the other hand,
+        operator==(String& x, AtomicString& y) compares a String and an AtomicString by
+        StringImpl::equal(StringImpl*, StringImpl*), the calculation complexity of
+        which is O(2 * min(the length of x, the length of y)).
+        In addition, the comparison logic is more complicated than the logic
+        of calculating the hash. Consequently, AtomicString(String& x) is
+        faster than operator==(String& x, AtomicString& y).
+
+        Keeping that in mind, let's estimate the performance of
+        Element::getAttribute("class") for <div id="A" lang="B" title="C" class="D" dir="E">.
+        Here "id", "lang", "title", "class" and "dir" are stored as AtomicStrings
+        in QualifiedName::localName(). Initially, "class" in Element::getAttribute("class")
+        is a String.
+
+        If we use Element::getAttribute(String& name) (i.e. without the patch),
+        ElementAttributeData::getAttributeItemIndex() executes four
+        operator==(String&, AtomicString&) by the time it finds the "class" attribute:
+
+        (1) if ("class" == "id")       // operator==(String&, AtomicString&)
+        (2) if ("class" == "lang")     // operator==(String&, AtomicString&)
+        (3) if ("class" == "title")    // operator==(String&, AtomicString&)
+        (4) if ("class" == "class")    // operator==(String&, AtomicString&)
+
+        On the other hand, if we use Element::getAttribute(AtomicString& name)
+        (i.e. with the patch), ElementAttributeData::getAttributeItemIndex()
+        executes one AtomicString(String&) and four operator==(AtomicString&, AtomicString&)
+        by the time it finds the "class" attribute:
+
+        (1) AtomicString("class")      // AtomicString(String&)
+        (2) if ("class" == "id")       // operator==(AtomicString&, AtomicString&)
+        (3) if ("class" == "lang")     // operator==(AtomicString&, AtomicString&)
+        (4) if ("class" == "title")    // operator==(AtomicString&, AtomicString&)
+        (5) if ("class" == "class")    // operator==(AtomicString&, AtomicString&)
+
+        Considering that the overhead of operator==(AtomicString&, AtomicString&) is close
+        to 0 since it is just a pointer comparison, the latter approach is faster than
+        the former approach.
+
+        Performance improvement will be large for elements that have multiple attributes,
+        but it is faster even for elements that have only one attribute.
+        For exmaple, Dromaeo/dom-attr.html tests getAttribute() for an element that has
+        only one attribute, the result shows 4.0% improvement.
+
+        Another example optimized by this patch is 'div.foo = 123', where foo is not
+        an attribute of div. In this case, before 123 is set, JavaScript calls back
+        Element::getAttribute() to check whether 'foo' is defined on div by
+        scanning all the attributes of div.
+
+        No tests. No change in behavior.
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::getAttributeItemIndex):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::getAttributeItemIndexSlowCase):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::getAttributeItem):
+        (WebCore::ElementAttributeData::getAttributeItemIndex):
+
+2012-06-28  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: Don't dispatch end event after ActiveDOMObject::stop()
+        https://bugs.webkit.org/show_bug.cgi?id=90176
+
+        Reviewed by Adam Barth.
+
+        It is probably not safe to dispatch an event on an object that has
+        been ActiveDOMObject::stop()'ed.
+
+        This used to happen in the navigate-away.html test, which I believe
+        then caused speechgrammar-basics.html (which was typically run
+        afterwards, by the same worker), to crash flakily. See Bug 89717.
+
+        Test: speechgrammar-basics.html should no longer be flaky.
+
+        * Modules/speech/SpeechRecognition.cpp:
+        (WebCore::SpeechRecognition::didEnd):
+        (WebCore::SpeechRecognition::stop):
+        (WebCore::SpeechRecognition::SpeechRecognition):
+        * Modules/speech/SpeechRecognition.h:
+
+2012-06-28  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [GTK] [WK2] Memory leak in ResourceHandleSoup.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=90168
+
+        Reviewed by Martin Robinson.
+
+        Fixed a memory leak in WebCoreSynchronousLoader by using adoptGRef
+        instead of just getting new reference of GMainLoop.
+
+        No new tests. No change in behavior.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+
+2012-06-27  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Do not multiply bounds by contentsScale in TiledLayerChromium and CanvasLayerTextureUpdater
+        https://bugs.webkit.org/show_bug.cgi?id=90103
+
+        Reviewed by Adrienne Walker.
+
+        Non-integer scale factors can scale the bounds of a layer such that
+        different rounding is applied to the width and height in the content
+        bounds. We should never multiply bounds by contentsScale in order to
+        work correctly with non-integer scale factors. Instead, always use the
+        contentBounds/bounds ratio for width and height independently.
+
+        Tests: TiledLayerChromiumTest.nonIntegerContentsScaleIsNotDistortedDuringPaint
+               TiledLayerChromiumTest.nonIntegerContentsScaleIsNotDistortedDuringInvalidation
+
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h:
+        (BitmapCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::BitmapSkPictureCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        (BitmapSkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        (WebCore::CanvasLayerTextureUpdater::paintContents):
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.h:
+        (CanvasLayerTextureUpdater):
+        * platform/graphics/chromium/LayerTextureUpdater.h:
+        (WebCore::LayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::updatePart):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::SkPictureCanvasLayerTextureUpdater::prepareToUpdate):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
+        (SkPictureCanvasLayerTextureUpdater):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::setNeedsDisplayRect):
+        (WebCore::TiledLayerChromium::updateTiles):
+
+2012-06-28  Bruno de Oliveira Abinader  <bruno.abinader@basyskom.com>
+
+        [Qt] Make GC's fill{Rounded}Rect use optimized shadow blur code
+        https://bugs.webkit.org/show_bug.cgi?id=90082
+
+        Reviewed by Noam Rosenthal.
+
+        ShadowBlur::drawRectShadow makes use of optimized tiles-based drawPattern, which
+        is not present when using {begin/end}shadowLayer.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::pushTransparencyLayerInternal):
+
+2012-06-28  Rahul Tiwari  <rahultiwari.cse.iitr@gmail.com>
+
+        Web Inspector: Provide context menu 'Delete all watch expressions.'
+        https://bugs.webkit.org/show_bug.cgi?id=89735
+
+        Reviewed by Yury Semikhatsky.
+
+        Added context menu delete and delete all watch expressions.
+
+        No new tests required as its a minor UI related change.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype._deleteAllExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._contextMenu):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteAllButtonClicked):
+
+2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>
+
+        m_cssVariablesEnabled member is not initialized in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=90147
+
+        Reviewed by Simon Hausmann.
+
+        Properly initialize the m_cssVariablesEnabled member in Page
+        Settings.
+
+        No new tests, no behavior change.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2012-06-28  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] plugin is loaded to the web process via MainResourceLoader::substituteMIMETypeFromPluginDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=86489
+
+        Reviewed by Simon Hausmann.
+
+        Removed the substituteMIMETypeFromPluginDatabase quirk from
+        MainResourceLoader. It would be possible to fix it in a way
+        that is compatible with WebKit2, but given that it was a Qt
+        only fix, and that it's not clear that we still need it, and
+        it's not even work currently, I decided to remove it. At least
+        it is -1 platform ifdef in common code.
+
+        Just removed a non-tested quirk, no test needed.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+
+2012-06-28  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Optimize Integer::New() by caching persistent handles for small integers
+        https://bugs.webkit.org/show_bug.cgi?id=90043
+
+        Reviewed by Adam Barth.
+
+        The patch improves performance of Dromaeo/dom-query.html by 3.6%,
+        and Bindings/scroll-top.html by 17.3%.
+
+        The performance results in my Chromium/Linux:
+
+        [Dromaeo/dom-query.html]
+        796310.4 runs/s => 824745.4 runs/s (+3.6%)
+
+        [Bindings/scroll-top.html]
+        204.68 runs/s => 240.15 runs/s (+17.3%)
+
+        This patch introduces V8BindingPerIsolateData::IntegerCache (just like
+        V8BindingPerIsolateData::StringCache) to cache persistent handles
+        for small integers.
+
+        No new tests. No change in behavior.
+
+        * bindings/v8/V8Binding.h: Implemented v8Integer() and v8UnsignedInteger(),
+        which returns cached persistent handles for integers smaller than 64.
+        (WebCore):
+        (IntegerCache):
+        (WebCore::IntegerCache::IntegerCache):
+        (WebCore::IntegerCache::v8Integer):
+        (WebCore::IntegerCache::v8UnsignedInteger):
+        (WebCore::V8BindingPerIsolateData::integerCache):
+        (V8BindingPerIsolateData):
+        (WebCore::v8Integer):
+        (WebCore::v8UnsignedInteger):
+        * bindings/v8/V8Binding.cpp:
+        (WebCore):
+        (WebCore::IntegerCache::createSmallIntegers):
+        * bindings/v8/WorkerScriptController.cpp:
+        (~WorkerScriptController): ~V8BindingPerIsolateData() should be called before
+        isolate->Exit(), since ~V8BindingPerIsolateData() calls V8 APIs that requires
+        the current isolate.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Replaced Integer::New() and Integer::NewFromUnsigned()
+        with v8Integer() and v8UnsignedInteger().
+        (GenerateNormalAttrGetter):
+        (NativeToJSValue):
+
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp: Updated run-bindings-tests results.
+        (WebCore::TestActiveDOMObjectV8Internal::excitingAttrAttrGetter):
+        * bindings/scripts/test/V8/V8TestObj.cpp: Ditto.
+        (WebCore::TestObjV8Internal::readOnlyIntAttrAttrGetter):
+        (WebCore::TestObjV8Internal::shortAttrAttrGetter):
+        (WebCore::TestObjV8Internal::unsignedShortAttrAttrGetter):
+        (WebCore::TestObjV8Internal::intAttrAttrGetter):
+        (WebCore::TestObjV8Internal::reflectedIntegralAttrAttrGetter):
+        (WebCore::TestObjV8Internal::reflectedUnsignedIntegralAttrAttrGetter):
+        (WebCore::TestObjV8Internal::reflectedCustomIntegralAttrAttrGetter):
+        (WebCore::TestObjV8Internal::attrWithGetterExceptionAttrGetter):
+        (WebCore::TestObjV8Internal::attrWithSetterExceptionAttrGetter):
+        (WebCore::TestObjV8Internal::withScriptStateAttributeAttrGetter):
+        (WebCore::TestObjV8Internal::conditionalAttr1AttrGetter):
+        (WebCore::TestObjV8Internal::conditionalAttr2AttrGetter):
+        (WebCore::TestObjV8Internal::conditionalAttr3AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr1AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtRuntimeAttr2AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtContextAttr1AttrGetter):
+        (WebCore::TestObjV8Internal::enabledAtContextAttr2AttrGetter):
+        (WebCore::TestObjV8Internal::strawberryAttrGetter):
+        (WebCore::TestObjV8Internal::descriptionAttrGetter):
+        (WebCore::TestObjV8Internal::idAttrGetter):
+        (WebCore::TestObjV8Internal::intMethodCallback):
+        (WebCore::TestObjV8Internal::intMethodWithArgsCallback):
+        (WebCore::TestObjV8Internal::classMethodWithOptionalCallback):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp: Ditto.
+        (WebCore::TestSerializedScriptValueInterfaceV8Internal::portsAttrGetter):
+
+2012-06-28  Kent Tamura  <tkent@chromium.org>
+
+        Classify form control states by their owner forms
+        https://bugs.webkit.org/show_bug.cgi?id=89950
+
+        Reviewed by Hajime Morita.
+
+        To improve robustness of the form state restore feature, we classify
+        form control states by their owner forms. Owner forms are identified by
+        their action URLs and index numbers in forms with the same action URLs.
+
+        Implementation approach:
+        Extend FormElementKey class to have "formKey" string, which is a
+        combination of the action URL and an index number, or a fixed string for
+        no form owner.
+        FormKeyGenerator class is responsible to generate the "formKey" strings
+
+        Test: fast/forms/state-restore-per-form.html
+
+        * html/FormController.cpp:
+        (FormKeyGenerator):
+        (WebCore::FormKeyGenerator::create): A factory function.
+        (WebCore::FormKeyGenerator::FormKeyGenerator): A private constructor.
+        (WebCore::createKey):
+        A helper for formKey(). This makes strings like "<action URL> #<index>".
+        (WebCore::FormKeyGenerator::formKey):
+        Returns a formKey for the specified HTMLFormElement*.
+        (WebCore::FormKeyGenerator::willDeleteForm):
+        Unregister HTMLFormElement*. This function is necessary because form
+        restore feature works during parsing and a script might delete form
+        elements.
+        (WebCore::formStateSignature): Bump the version.
+        (WebCore::FormController::formElementsState):
+        Records a formKey string for each of control state.
+        (WebCore::FormController::setStateForNewFormElements):
+        Loads formKeys from stateVector, and uses them for FormElementKey.
+        (WebCore::FormController::takeStateForFormElement):
+        - Construct and destruct FormKeyGenerator if needed.
+        - Passing a formKey for the specified form control to FormElementKey.
+        (WebCore::FormController::willDeleteForm):
+        Delegate to FormKeyGenerator::willDeleteForm.
+
+        (WebCore::FormElementKey::FormElementKey): Add formKey argument and member.
+        (WebCore::FormElementKey::operator=): ditto.
+        (WebCore::FormElementKey::ref): ditto.
+        (WebCore::FormElementKey::deref): ditto.
+        * html/FormController.h:
+        (FormElementKey): Add formKey argument and member.
+        (FormController): Add a FormKeyGenerator member which is used during restoring.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::~HTMLFormElement): Notify the death to FormController.
+
+2012-06-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121395.
+        http://trac.webkit.org/changeset/121395
+        https://bugs.webkit.org/show_bug.cgi?id=90143
+
+        Patch causes crashes in fast/workers/worker-context-gc.html
+        (Requested by zdobersek on #webkit).
+
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        * workers/DedicatedWorkerThread.h:
+        (DedicatedWorkerThread):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/SharedWorkerThread.h:
+        (SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WorkerThreadStartupData):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-06-28  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement functions for localized time format information
+        https://bugs.webkit.org/show_bug.cgi?id=89965
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces three functions for time format:
+          1. localizedTimeFormatText()
+          2. localizedShortTimeFormatText()
+          2. timeAMPMLabels()
+        for input type "time" if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS) is true.
+
+        Having both localizedTimeFormat and localizedShortTimeFormat is for
+        displaying only two fields hour and minute when step >= 60. There is
+        no way to remove second field from "h:m:s" pattern string. We don't
+        know whether ":" after "m" belongs minute or second field.
+
+        Test: WebKit/chromium/tests/LocalizedDateICUTest.cpp
+
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::LocaleICU):
+        (WebCore::createFallbackAMPMLabels): Added.
+        (WebCore::LocaleICU::initializeDateTimeFormat):  Added.
+        (WebCore::LocaleICU::localizedTimeFormatText):  Added.
+        (WebCore::LocaleICU::localizedShortTimeFormatText):  Added.
+        (WebCore::LocaleICU::timeAMPMLabels):  Added.
+        * platform/text/LocaleICU.h:
+        (LocaleICU):
+        * platform/text/LocalizedDate.h:
+        * platform/text/LocalizedDateICU.cpp:
+        (WebCore::localizedTimeFormatText):  Added.
+        (WebCore::localizedShortTimeFormatText):  Added.
+        (WebCore::timeAMPMLabels):  Added.
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Performance: Optimize Dromaeo/dom-query.html by caching NodeRareData on Document
+        https://bugs.webkit.org/show_bug.cgi?id=90059
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch improves performance of document.getElementsBy*().
+        e.g. the patch makes Dromaeo/dom-query.html 5.4% faster.
+
+        Dromaeo/dom-query.html without the patch (Chromium/Linux):
+        784714 runs/s, 765947 runs/s, 803109 runs/s, 804450 runs/s
+
+        Dromaeo/dom-query.html with the patch (Chromium/Linux):
+        839245 runs/s, 829867 runs/s, 811032 runs/s, 847486 runs/s
+
+        Based on the assumption that document.getElementsByClassName(),
+        document.getElementsByTagName() and document.getElementsByName()
+        would be used frequently in the real world, this patch implements
+        a fast path for Document methods that require to access NodeRareData.
+        Specifically, this patch caches a pointer to NodeRareData on Document,
+        by which Document can access NodeRareData without looking up a HashMap.
+
+        The only performance concern is the overhead of the isDocumentNode() check
+        that this patch added to Node::ensureRareData. However, I could not
+        observe any performance regression caused by the overhead.
+
+        No tests. No change in behavior.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::setCachedRareData): I didn't inline this method,
+        since the inlining slightly regressed performance for some reason.
+        (WebCore):
+        * dom/Document.h:
+        (WebCore):
+        (WebCore::Document::cachedRareData):
+        (Document):
+        (~Document): Moved 'm_document = 0' to the tail of the destructor,
+        since isDocumentNode() has to return true in clearRareData() that is called
+        in ~Document().
+        * dom/Node.cpp:
+        (WebCore::Node::ensureRareData):
+        (~Node): Moved the assertion into clearRareData().
+
+2012-06-27  Mary Wu  <mary.wu@torchmobile.com.cn>
+
+        [BlackBerry] 0-length response with no content-type shouldn't download
+        https://bugs.webkit.org/show_bug.cgi?id=89860
+
+        Reviewed by Rob Buis.
+
+        RIM PR# 168419
+
+        For 0-length response, if we can't get its mimetype from the filename,
+        we set the mimetype to "text/plain" instead of "application/octet-stream",
+        so it won't go to download.
+
+        Reviewed internally by Charles Wei.
+
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::sendResponseIfNeeded):
+
+2012-06-27  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement localizedDecimalSeparator function
+        https://bugs.webkit.org/show_bug.cgi?id=90036
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces new function localizedDecimalSeparator() when
+        ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS). It will be used for
+        displaying millisecond for time fields UI.
+
+        Test: WebKit/chromium/tests/LocalizedNumberICUTest.cpp
+
+        * platform/text/LocaleICU.cpp:
+        (WebCore::LocaleICU::localizedDecimalSeparator): Added
+        * platform/text/LocaleICU.h:
+        (LocaleICU): Added localizedDecimalSeparator.
+        * platform/text/LocalizedNumber.h:
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::localizedDecimalSeparator): Added.
+        * platform/text/LocalizedNumberNone.cpp:
+        (WebCore::localizedDecimalSeparator): Added.
+        * platform/text/mac/LocalizedNumberMac.mm:
+        (WebCore::localizedDecimalSeparator): Added.
+
+2012-06-27  Lu Guanqun  <guanqun.lu@intel.com>
+
+        Add OVERRIDE to functions in UnthrottledTextureUploader class
+        https://bugs.webkit.org/show_bug.cgi?id=90130
+
+        Reviewed by James Robinson.
+
+        No new tests required.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+
+2012-06-27  Pablo Flouret  <pablof@motorola.com>
+
+        pattern="" should only accept the empty string
+        https://bugs.webkit.org/show_bug.cgi?id=89569
+
+        Reviewed by Kent Tamura.
+
+        An empty pattern attribute was being treated essentially as if the
+        pattern wasn't present.
+
+        No new tests. Covered by existing tests (plus a modified one).
+
+        * html/BaseTextInputType.cpp:
+        (WebCore::BaseTextInputType::patternMismatch):
+            Check if the pattern attribute is present. If it is then use the
+            pattern as is (in the particular case of this bug, an empty pattern
+            will only match an empty value).
+
+2012-06-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use SkColor in compositor internals
+        https://bugs.webkit.org/show_bug.cgi?id=90108
+
+        Reviewed by Adrienne Walker.
+
+        As the title says, cutting dependencies. If we support color spaces in the compositor we will probably need to
+        use a more sophisticated type, but for our current use SkColor is sufficient and matches our API better.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setBackgroundColor):
+        (WebCore::LayerChromium::setDebugBorderColor):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        (WebCore::LayerChromium::backgroundColor):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
+        (WebCore::LayerRendererChromium::drawSolidColorQuad):
+        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp:
+        (WebCore::CCDebugBorderDrawQuad::create):
+        (WebCore::CCDebugBorderDrawQuad::CCDebugBorderDrawQuad):
+        * platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h:
+        (CCDebugBorderDrawQuad):
+        (WebCore::CCDebugBorderDrawQuad::color):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::setBackgroundColor):
+        (WebCore::CCLayerImpl::setDebugBorderColor):
+        (WebCore::CCLayerImpl::hasDebugBorders):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::backgroundColor):
+        (WebCore::CCLayerImpl::debugBorderColor):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeHost::setBackgroundColor):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore::CCLayerTreeHostImpl::backgroundColor):
+        (WebCore::CCLayerTreeHostImpl::setBackgroundColor):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::appendQuadInternal):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::appendQuadsToFillScreen):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore):
+        (CCRenderPass):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::appendQuads):
+        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp:
+        (WebCore::CCSolidColorDrawQuad::create):
+        (WebCore::CCSolidColorDrawQuad::CCSolidColorDrawQuad):
+        * platform/graphics/chromium/cc/CCSolidColorDrawQuad.h:
+        (CCSolidColorDrawQuad):
+        (WebCore::CCSolidColorDrawQuad::color):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (WebCore::CCTiledLayerImpl::appendQuads):
+
+2012-06-27  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
+        https://bugs.webkit.org/show_bug.cgi?id=88338
+
+        Reviewed by David Levin.
+
+        If the indexedDB runs in main thread it can access the GroupSettings via the document;
+        otherwise, we need to pass the page GroupSettings to the worker thread so that accessible
+        to the indexedDB running in WorkerContext.
+
+        * Modules/indexeddb/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::create):
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        * workers/DedicatedWorkerThread.h:
+        (DedicatedWorkerThread):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::groupSettings):
+        (WebCore):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/SharedWorkerThread.h:
+        (SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WorkerThreadStartupData):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::groupSettings):
+        (WebCore):
+        * workers/WorkerThread.h:
+        (WorkerThread):
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121359.
+        http://trac.webkit.org/changeset/121359
+        https://bugs.webkit.org/show_bug.cgi?id=90115
+
+        Broke many inspector tests (Requested by jpfau on #webkit).
+
+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStack):
+
+2012-06-27  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Implement selectedOptions attribute of HTMLSelectElement.
+        https://bugs.webkit.org/show_bug.cgi?id=80631
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a new collection as a member of HTMLSelectElement which is
+        used to store the selected elements. Extend HTMLCollection to
+        support the new collection type needed by this feature. Make sure
+        that we invalidate the collection when the select state of an
+        option changes as the select state change does not trigger a dom
+        tree version change.
+
+        Reference : http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#dom-select-selectedoptions
+
+        Test: fast/dom/HTMLSelectElement/select-selectedOptions.html
+
+        * html/CollectionType.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::shouldIncludeChildren):
+        (WebCore::HTMLCollection::clearCache):
+        (WebCore):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        * html/HTMLCollection.h:
+        (HTMLCollection):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setSelectedState):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedOptions):
+        (WebCore):
+        (WebCore::HTMLSelectElement::invalidateSelectedItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        * html/HTMLSelectElement.h:
+        (WebCore):
+        (HTMLSelectElement):
+        * html/HTMLSelectElement.idl:
+
+2012-06-27  Daniel Cheng  <dcheng@chromium.org>
+
+        Fix crash in Frame::nodeImage.
+        https://bugs.webkit.org/show_bug.cgi?id=89911
+
+        Reviewed by Abhishek Arya.
+
+        We were caching a pointer to a RenderObject and then calling updateLayout(). Instead, we
+        need to get a pointer to the RenderObject again after updateLayout().
+
+        Test: fast/events/drag-display-none-element.html
+
+        * page/Frame.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::snapshotDragImage):
+        (WebCore::Frame::nodeImage):
+
+2012-06-27  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121380.
+        http://trac.webkit.org/changeset/121380
+        https://bugs.webkit.org/show_bug.cgi?id=86525
+
+        Hits an ASSERT in debug.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFlex):
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        * css/CSSPropertyNames.in:
+        * css/StyleBuilder.cpp:
+        (ApplyPropertyFlex):
+        (WebCore::ApplyPropertyFlex::applyInheritValue):
+        (WebCore::ApplyPropertyFlex::applyInitialValue):
+        (WebCore::ApplyPropertyFlex::applyValue):
+        (WebCore::ApplyPropertyFlex::createHandler):
+        (WebCore::ApplyPropertyFlex::getFlexValue):
+        (WebCore):
+        (WebCore::StyleBuilder::StyleBuilder):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyValue):
+        (WebCore::StylePropertySet::asText):
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::webkitFlexFlowShorthand):
+        (WebCore::shorthandForProperty):
+        * css/StylePropertyShorthand.h:
+        (WebCore):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-27  Rakesh KN  <rakesh.kn@motorola.com>
+
+        HTMLFieldSetElement::m_documentVersion is not initialized
+        https://bugs.webkit.org/show_bug.cgi?id=90038
+
+        Reviewed by Kent Tamura.
+
+        Initialised m_documentVersion member as HTMLFieldSetElement::elements can return an wrong collection.
+
+        Covered by existing tests.
+
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
+        Initialised m_documentVersion.
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        No new tests. Current regression tests are sufficient.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::garbageCollectSoon):
+        (WebCore::GCController::garbageCollectNow):
+        (WebCore::GCController::discardAllCompiledCode):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::nodeAsScriptValue):
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+        * bindings/js/JSInjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::evaluate):
+        * bindings/js/JSMutationCallbackCustom.cpp:
+        (WebCore::JSMutationCallback::handleEvent):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSRequestAnimationFrameCallbackCustom.cpp:
+        (WebCore::JSRequestAnimationFrameCallback::handleEvent):
+        * bindings/js/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * bindings/js/PageScriptDebugServer.cpp:
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::cacheableBindingRootObject):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::dispatchDidPause):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::eventListenerHandlerBody):
+        (WebCore::eventListenerHandlerLocation):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptCallArgumentHandler::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        (WebCore::ScriptCallback::call):
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        (WebCore::ScriptGlobalObject::get):
+        (WebCore::ScriptGlobalObject::remove):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::toInspectorValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+        (WebCore::WorkerScriptController::initScript):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::disableEval):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject hasWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithNoParam):
+        (WebCore::JSTestCallback::callbackWithClass1Param):
+        (WebCore::JSTestCallback::callbackWithClass2Param):
+        (WebCore::JSTestCallback::callbackWithStringList):
+        (WebCore::JSTestCallback::callbackWithBoolean):
+        (WebCore::JSTestCallback::callbackRequiresThisToPass):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        (_NPN_Construct):
+        * bridge/c/c_class.cpp:
+        (JSC::Bindings::CClass::~CClass):
+        (JSC::Bindings::CClass::methodsNamed):
+        (JSC::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jsc/JavaMethodJSC.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jsc/JavaStringJSC.h:
+        (JSC::Bindings::JavaString::JavaString):
+        (JSC::Bindings::JavaString::~JavaString):
+        (JSC::Bindings::JavaString::utf8):
+        (JSC::Bindings::JavaString::init):
+        * bridge/jsc/BridgeJSC.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        (JSC::Bindings::Instance::newRuntimeObject):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeObjcMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance):
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::newRuntimeObject):
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapInstance::createPixmapRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/qt/qt_runtime_qt4.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::gcProtect):
+        (JSC::Bindings::RootObject::gcUnprotect):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::npObject):
+        (WebCore::PluginView::privateBrowsingStateChanged):
+        * plugins/blackberry/PluginViewBlackBerry.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::getWindowInfo):
+        * plugins/efl/PluginViewEfl.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::dispatchNPEvent):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        * testing/js/WebCoreTestSupport.cpp:
+        (WebCoreTestSupport::injectInternalsObject):
+        (WebCoreTestSupport::resetInternalsObject):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2012-06-27  Tony Chang  <tony@chromium.org>
+
+        Split flex into flex-grow/flex-shrink/flex-basis
+        https://bugs.webkit.org/show_bug.cgi?id=86525
+
+        Reviewed by Ojan Vafai.
+
+        Split flex into 3 separate properties per the spec:
+        http://dev.w3.org/csswg/css3-flexbox/#flex-components
+
+        Tests: css3/flexbox/flex-longhand-parsing.html
+               css3/flexbox/flex-property-parsing.html: Updated test results.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore): -webkit-flex is no longer enumerable.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add new css property names and use
+        getCSSPropertyValuesForShorthandProperties for WebkitFlex. Also sort flex propery names.
+        * css/CSSParser.cpp:
+        (WebCore::isValidKeywordPropertyAndValue): Fix indent.
+        (WebCore::CSSParser::parseValue): Add parsing for new properties and handle -webkit-flex: none.
+        (WebCore::CSSParser::parseFlex): Switch to new names (positive -> grow, negative -> shrink,
+        preferred size -> basis) and assign to longhand properties.
+        * css/CSSParser.h:
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty): Add new properties.
+        * css/CSSPropertyNames.in: Add new properties.
+        * css/StyleBuilder.cpp:
+        (WebCore::StyleBuilder::StyleBuilder): Delete special handling of applying flex and just use shorthand handlers.
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::getPropertyValue): Add new shorthand.
+        (WebCore::StylePropertySet::asText):
+        * css/StylePropertyShorthand.cpp:
+        (WebCore::webkitFlexShorthand): Add new shorthand.
+        (WebCore::shorthandForProperty):
+        * css/StylePropertyShorthand.h:
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList): Add to list of properties applied by StyleBuilder.
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Make Element::elementRareData() and Element::ensureElementRareData() private
+        https://bugs.webkit.org/show_bug.cgi?id=90060
+
+        Reviewed by Andreas Kling.
+
+        This is a simple refactoring. Element::elementRareData() and
+        Element::ensureElementRareData() can be private methods.
+
+        No tests. No change in behavior.
+
+        * dom/Element.h:
+        (Element):
+
+2012-06-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Delete unused includes and forward declarations from compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=90102
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/CanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        * platform/graphics/chromium/ShaderChromium.h:
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::updateTiles):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+
+2012-06-27  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: make IDBKey immutable
+        https://bugs.webkit.org/show_bug.cgi?id=90016
+
+        Reviewed by Tony Chang.
+
+        Make all members of IDBKey const, so that this can be considered
+        an immutable, and thus safe to copy and/or stop ref-counting.
+
+        No new tests, existing tests show this works.
+
+        * Modules/indexeddb/IDBKey.cpp:
+        (WebCore::IDBKey::compare):
+        * Modules/indexeddb/IDBKey.h:
+        (WebCore::IDBKey::createInvalid):
+        (WebCore::IDBKey::createNumber):
+        (WebCore::IDBKey::createString):
+        (WebCore::IDBKey::createDate):
+        (WebCore::IDBKey::createMultiEntryArray):
+        (WebCore::IDBKey::createArray):
+        (WebCore::IDBKey::date):
+        (WebCore::IDBKey::IDBKey):
+        (IDBKey):
+
+2012-06-27  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Improve variable resolution order on window
+        https://bugs.webkit.org/show_bug.cgi?id=84247
+
+        Reviewed by Ojan Vafai.
+
+        This changes the V8 flag to turn on es52_globals and updates the layout tests to reflect the fixed behavior.
+
+        This is the second (third?) try. Last time there was a bug in the V8 code related to the split window.
+        I added a test that tests the failure that caused this to be rolled back last time.
+
+        Tests: fast/dom/Window/es52-globals.html
+               fast/dom/Window/window-property-shadowing-onclick.html
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initIsolate):
+
+2012-06-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use categorized TRACE_EVENTN() macros in compositor code
+        https://bugs.webkit.org/show_bug.cgi?id=90100
+
+        Reviewed by Adrienne Walker.
+
+        Specify the category in all traces in the compositor. Patch generated mostly by the sed command
+        's/TRACE_EVENT(\(.*\), this, 0)/TRACE_EVENT0("cc", \1)/'.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::beginDrawingFrame):
+        (WebCore::LayerRendererChromium::finish):
+        (WebCore::LayerRendererChromium::swapBuffers):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        (WebCore::LayerRendererChromium::tileCheckerboardProgram):
+        (WebCore::LayerRendererChromium::solidColorProgram):
+        (WebCore::LayerRendererChromium::headsUpDisplayProgram):
+        (WebCore::LayerRendererChromium::renderPassProgram):
+        (WebCore::LayerRendererChromium::renderPassProgramAA):
+        (WebCore::LayerRendererChromium::renderPassMaskProgram):
+        (WebCore::LayerRendererChromium::renderPassMaskProgramAA):
+        (WebCore::LayerRendererChromium::tileProgram):
+        (WebCore::LayerRendererChromium::tileProgramOpaque):
+        (WebCore::LayerRendererChromium::tileProgramAA):
+        (WebCore::LayerRendererChromium::tileProgramSwizzle):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleOpaque):
+        (WebCore::LayerRendererChromium::tileProgramSwizzleAA):
+        (WebCore::LayerRendererChromium::textureProgram):
+        (WebCore::LayerRendererChromium::textureProgramFlip):
+        (WebCore::LayerRendererChromium::textureIOSurfaceProgram):
+        (WebCore::LayerRendererChromium::videoYUVProgram):
+        (WebCore::LayerRendererChromium::videoStreamTextureProgram):
+        * platform/graphics/chromium/LayerTextureSubImage.cpp:
+        (WebCore::LayerTextureSubImage::uploadWithTexSubImage):
+        (WebCore::LayerTextureSubImage::uploadWithMapTexSubImage):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::SkPictureCanvasLayerTextureUpdater::drawPicture):
+        * platform/graphics/chromium/TextureCopier.cpp:
+        (WebCore::AcceleratedTextureCopier::copyTexture):
+        * platform/graphics/chromium/TextureManager.cpp:
+        (WebCore::TextureManager::evictTexture):
+        * platform/graphics/chromium/cc/CCFrameRateController.cpp:
+        (WebCore::CCFrameRateController::setActive):
+        (WebCore::CCFrameRateController::onTimerTick):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::initialize):
+        (WebCore::CCLayerTreeHost::~CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::beginCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::didLoseContext):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        (WebCore::CCLayerTreeHost::animateLayers):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::~CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+        (WebCore::CCSingleThreadProxy::stop):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::CCThreadProxy):
+        (WebCore::CCThreadProxy::~CCThreadProxy):
+        (WebCore::CCThreadProxy::compositeAndReadback):
+        (WebCore::CCThreadProxy::initializeContext):
+        (WebCore::CCThreadProxy::initializeLayerRenderer):
+        (WebCore::CCThreadProxy::setNeedsAnimate):
+        (WebCore::CCThreadProxy::setNeedsCommit):
+        (WebCore::CCThreadProxy::onSwapBuffersCompleteOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsCommitOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsForcedCommitOnImplThread):
+        (WebCore::CCThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore::CCThreadProxy::setNeedsRedraw):
+        (WebCore::CCThreadProxy::setNeedsRedrawOnImplThread):
+        (WebCore::CCThreadProxy::stop):
+        (WebCore::CCThreadProxy::finishAllRenderingOnImplThread):
+        (WebCore::CCThreadProxy::beginFrame):
+        (WebCore::CCThreadProxy::beginFrameCompleteOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionUpdateMoreResources):
+        (WebCore::CCThreadProxy::scheduledActionCommit):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwapInternal):
+        (WebCore::CCThreadProxy::acquireLayerTextures):
+        (WebCore::CCThreadProxy::initializeImplOnImplThread):
+        (WebCore::CCThreadProxy::initializeContextOnImplThread):
+        (WebCore::CCThreadProxy::initializeLayerRendererOnImplThread):
+        (WebCore::CCThreadProxy::layerTreeHostClosedOnImplThread):
+
+2012-06-27  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] ScrollbarLayerChromium should support painting forward-track and back-track in different styles.
+        https://bugs.webkit.org/show_bug.cgi?id=89908
+
+        Reviewed by Adrienne Walker.
+
+        Test: platform/chromium/compositing/scrollbars/custom-composited-different-track-parts.html
+
+        Adds support for accelerated drawing (impl thread) of scrollbars with different styles for the
+        forward-track and back-track parts.
+
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp:
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        (WebCore::ScrollbarBackgroundPainter::create):
+        (WebCore::ScrollbarBackgroundPainter::ScrollbarBackgroundPainter):
+        (ScrollbarBackgroundPainter):
+        (WebCore::ScrollbarLayerChromium::setLayerTreeHost):
+        (WebCore::ScrollbarLayerChromium::createTextureUpdaterIfNeeded):
+        (WebCore::ScrollbarLayerChromium::update):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h:
+        (ScrollbarLayerChromium):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp:
+        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
+        (WebCore):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h:
+        (WebCore::CCScrollbarLayerImpl::setBackTrackTextureId):
+        (WebCore::CCScrollbarLayerImpl::setForeTrackTextureId):
+        (CCScrollbarLayerImpl):
+
+2012-06-27  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Allow screen space rects and occluding rects to be visualized for debugging.
+        https://bugs.webkit.org/show_bug.cgi?id=90012
+
+        Reviewed by Adrienne Walker.
+
+        No new tests. No new functionality.
+
+        * platform/graphics/chromium/cc/CCDebugRectHistory.cpp:
+        (WebCore::CCDebugRectHistory::enabled):
+        (WebCore::CCDebugRectHistory::saveDebugRectsForCurrentFrame):
+        (WebCore::CCDebugRectHistory::saveScreenSpaceRects):
+        (WebCore):
+        (WebCore::CCDebugRectHistory::saveOccludingRects):
+        * platform/graphics/chromium/cc/CCDebugRectHistory.h:
+        (WebCore):
+        (CCDebugRectHistory):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::showDebugRects):
+        (WebCore::CCHeadsUpDisplay::draw):
+        (WebCore::CCHeadsUpDisplay::drawDebugRects):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (WebCore::CCLayerTreeSettings::CCLayerTreeSettings):
+        (CCLayerTreeSettings):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (FrameData):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::CCOcclusionTrackerBase):
+        (WebCore::addOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::setOccludingScreenSpaceRectsContainer):
+
+2012-06-27  Anthony Scian  <ascian@rim.com>
+
+        Web Inspector [JSC]: Implement ScriptCallStack::stackTrace
+        https://bugs.webkit.org/show_bug.cgi?id=40118
+
+        Reviewed by Yong Li.
+
+        Implemented stub for createScriptCallStack to call into
+        Interpreter and extract the current stack frames, iterate
+        through the frames and create the return result required.
+
+        No new tests, manually tested thrown exception and inspector
+        tracebacks.
+
+        * bindings/js/ScriptCallStackFactory.cpp:
+        (WebCore::createScriptCallStack):
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Let Xcode have its own way.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION (Safari 5?): Pasting a line into textarea inserts two newlines
+        https://bugs.webkit.org/show_bug.cgi?id=49288
+
+        Reviewed by Tony Chang.
+
+        The bug was caused by positionAvoidingPrecedingNodes getting out of a block when the insertion point is at a line break.
+        It caused the subsequent code to be misinformed of the insertion position and ended up not pruning the extra line break.
+
+        Fixed the bug by checking this special case and bailing out so that we don't crawl out of the enclosing block.
+        It's similar to checks several lines below it.
+
+        Test: editing/pasteboard/copy-paste-pre-line-content.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::positionAvoidingPrecedingNodes):
+
+2012-06-27  Andrei Onea  <onea@adobe.com>
+
+        [CSSRegions]Change display values that allow regions
+        https://bugs.webkit.org/show_bug.cgi?id=89759
+
+        Reviewed by Tony Chang.
+
+        Allow only elements with display values of block, inline-block,
+        table-cell, table-caption and list-item to become regions, as per
+        CSSRegions spec: http://dev.w3.org/csswg/css3-regions .
+        Also added test for checking whether regions are destroyed and/or created
+        when changing display value.
+
+        Test: fast/regions/region-element-display-change.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyle.h:
+
+2012-06-27  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: blending involving expressions
+        https://bugs.webkit.org/show_bug.cgi?id=86160
+
+        Reviewed by Tony Chang.
+
+        If either endpoint of a blend involves a calc expression, we create a new
+        expression to perform the blend calculation.
+
+        Test: css3/calc/transitions.html
+              css3/calc/transitions-dependent.html
+
+        * platform/Length.cpp:
+        (WebCore):
+        (WebCore::Length::blendCalculation):
+        * platform/Length.h:
+        (WebCore::Length::blend):
+        (Length):
+
+2012-06-27  Hans Muller  <hmuller@adobe.com>
+
+        Move CSSWrapShape style resolution from StyleResolver to StyleBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=89668
+
+        Reviewed by Andreas Kling.
+
+        Moved the resolution of the shapeInside and shapeOutside CSS properties
+        from the StyleResolver class to StyleBuilder. This is just refactoring
+        in preparation for fixing https://bugs.webkit.org/show_bug.cgi?id=89670.
+
+        No new tests were required.
+
+        * css/StyleBuilder.cpp:
+        (WebCore):
+        (ApplyPropertyWrapShape):
+        (WebCore::ApplyPropertyWrapShape::setValue):
+        (WebCore::ApplyPropertyWrapShape::applyValue):
+        (WebCore::ApplyPropertyWrapShape::createHandler):
+        (WebCore::StyleBuilder::StyleBuilder):
+        * css/StyleResolver.cpp:
+        (WebCore::StyleResolver::collectMatchingRulesForList):
+
+2012-06-27  Alexandru Chiculita  <achicu@adobe.com>
+
+        Blur filter causes issues when scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=89475
+
+        Reviewed by Simon Fraser.
+
+        This patch disables the fast scrolling when there is a fixed postioned element that
+        has a filter applied on its parent layer. Otherwise the scroll blitting will just
+        copy the outsets of the blur effect.
+
+        Test: css3/filters/blur-filter-page-scroll.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollContentsFastPath):
+
+2012-06-27  Andreas Kling  <kling@webkit.org>
+
+        REGRESSION(r121296): New zero-size background tests asserting on Mac.
+        <http://webkit.org/b/90071>
+
+        Reviewed by Dan Bernstein.
+
+        Remove ASSERT(patternTransform.isInvertible()) as this is now a valid scenario.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+
+2012-06-27  Shinya Kawanaka  <shinyak@chromium.org>
+
+        HTMLStyleElement::removedFrom seems incorrect.
+        https://bugs.webkit.org/show_bug.cgi?id=89986
+
+        Reviewed by Hajime Morita.
+
+        This is a follow-up patch for Bug 88495. The Same bug as Bug 88495 seems to exist on
+        HTMLStyleElement::removedFrom().
+
+        No new tests, hard to write a test case.
+
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFrom):
+
+2012-06-27  Mike Reed  <reed@google.com>
+
+        Cleanup scaling code in text-decorations for SVG InlineText. Use scale() instead of getCTM/normalizeTransform/setCTM
+        to use more standard pattern for scaling, and to allow for these operations to be recorded and played back later
+        (potentially with a different starting matrix). This effectively reverts change# 78704.
+        https://bugs.webkit.org/show_bug.cgi?id=89888
+
+        Reviewed by Nikolas Zimmermann.
+
+        No new tests. Current layouttests exercise this code path.
+
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
+        (WebCore::SVGInlineTextBox::paintTextWithShadows):
+
+2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove redundant NDEBUG definition
+
+        Already handled in default_post.prf.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebCore.pri:
+
+2012-06-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unexpected end of style sheet in @font-face rule discards it rather than closes all open constructs
+        https://bugs.webkit.org/show_bug.cgi?id=89980
+
+        Reviewed by Antti Koivisto.
+
+        Use the "closing_brace" at the end of font_face rather than the explicit "'}' maybe_space".
+
+        Test: fast/css/font-face-unexpected-end.html
+
+        * css/CSSGrammar.y:
+
+2012-06-26  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Add missing heades to HEADERS
+
+        For JavaScriptCore there aren't any Qt specific files, so we include all
+        headers for easy editing in Qt Creator.
+
+        Reviewed by Simon Hausmann.
+
+        * Target.pri:
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Rename Element::rareData() to Element::elementRareData(), and Element::ensureRareData() to Element::ensureElementRareData()
+        https://bugs.webkit.org/show_bug.cgi?id=90050
+
+        Reviewed by Ryosuke Niwa.
+
+        Element::rareData()/Element::ensureRareData() and
+        Node::rareData()/Node::ensureRareData() are confusing. They are not virtual
+        methods. For clarification, we can rename Element::rareData() to
+        Element::elementRareData(), and Element::ensureRareData() to
+        Element::ensureElementRareData().
+
+        c.f. SVGRareData uses SVGElement::rareSVGData() and SVGElement::ensureRareSVGData().
+        (We might want to rename them to SVGElement::svgRareData() and
+        SVGElement::ensureSVGRareData() in a follow-up patch.)
+
+        No tests. No change in behavior.
+
+        * dom/Element.cpp:
+        (WebCore::Element::~Element):
+        (WebCore::Element::elementRareData):
+        (WebCore::Element::ensureElementRareData):
+        (WebCore::Element::attributes):
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::shadow):
+        (WebCore::Element::ensureShadow):
+        (WebCore::Element::shadowPseudoId):
+        (WebCore::Element::setShadowPseudoId):
+        (WebCore::Element::focus):
+        (WebCore::Element::minimumSizeForResizing):
+        (WebCore::Element::setMinimumSizeForResizing):
+        (WebCore::Element::computedStyle):
+        (WebCore::Element::setStyleAffectedByEmpty):
+        (WebCore::Element::styleAffectedByEmpty):
+        (WebCore::Element::cancelFocusAppearanceUpdate):
+        (WebCore::Element::classList):
+        (WebCore::Element::optionalClassList):
+        (WebCore::Element::dataset):
+        (WebCore::Element::containsFullScreenElement):
+        (WebCore::Element::setContainsFullScreenElement):
+        (WebCore::Element::hasNamedNodeMap):
+        (WebCore::Element::ensureCachedHTMLCollection):
+        (WebCore::Element::savedLayerScrollOffset):
+        (WebCore::Element::setSavedLayerScrollOffset):
+        * dom/Element.h:
+        (Element):
+        * html/LabelableElement.cpp:
+        (WebCore::LabelableElement::labels):
+
+2012-06-26  Dominic Cooney  <dominicc@chromium.org>
+
+        [Chromium] Remove unused build scripts and empty folders for JavaScriptCore w/ gyp
+        https://bugs.webkit.org/show_bug.cgi?id=90029
+
+        * gyp: Removed empty dir.
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121271.
+        http://trac.webkit.org/changeset/121271
+        https://bugs.webkit.org/show_bug.cgi?id=90056
+
+        Broke a whole bunch of tests and also caused crashes in some
+        tests (Requested by rniwa on #webkit).
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAndReplaceFor):
+
+2012-06-27  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=87503
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add support for the Gamepad feature on the GTK port.
+
+        The support is available only on Linux, with each gamepad device being presented
+        through a GamepadDeviceLinux object. The implementation of this class relies on
+        the Linux kernel joystick API.
+
+        Gamepad devices are recognized through the GamepadsGtk class, of which implementation
+        is based on GUdev. This way devices are properly registered on connection as objects of
+        the GamepadDeviceGtk class which inherits GamepadDeviceLinux. GamepadDeviceGtk reads the
+        joystick data through GIO pollable streams and updates the device state accordingly. The
+        GamepadsGtk object is then polled for gamepads data through the sampleGamepads method.
+
+        No new tests - tests already exist but require additional testing infrastructure.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * bindings/gobject/GNUmakefile.am:
+        * bindings/js/JSDOMBinding.h: Add the jsArray method that operates on a Vector of floats.
+        (WebCore):
+        (WebCore::jsArray):
+        * platform/gtk/GamepadsGtk.cpp: Added.
+        (WebCore):
+        (GamepadDeviceGtk):
+        (WebCore::GamepadDeviceGtk::create):
+        (WebCore::GamepadDeviceGtk::GamepadDeviceGtk):
+        (WebCore::GamepadDeviceGtk::~GamepadDeviceGtk):
+        (WebCore::GamepadDeviceGtk::readCallback):
+        (GamepadsGtk):
+        (WebCore::GamepadsGtk::GamepadsGtk):
+        (WebCore::GamepadsGtk::~GamepadsGtk):
+        (WebCore::GamepadsGtk::registerDevice):
+        (WebCore::GamepadsGtk::unregisterDevice):
+        (WebCore::GamepadsGtk::updateGamepadList):
+        (WebCore::GamepadsGtk::onUEventCallback):
+        (WebCore::GamepadsGtk::isGamepadDevice):
+        (WebCore::sampleGamepads):
+        * platform/linux/GamepadDeviceLinux.cpp: Added.
+        (WebCore):
+        (WebCore::GamepadDeviceLinux::GamepadDeviceLinux):
+        (WebCore::GamepadDeviceLinux::~GamepadDeviceLinux):
+        (WebCore::GamepadDeviceLinux::updateForEvent):
+        (WebCore::GamepadDeviceLinux::normalizeAxisValue):
+        (WebCore::GamepadDeviceLinux::normalizeButtonValue):
+        * platform/linux/GamepadDeviceLinux.h: Added.
+        (WebCore):
+        (GamepadDeviceLinux):
+        (WebCore::GamepadDeviceLinux::connected):
+        (WebCore::GamepadDeviceLinux::id):
+        (WebCore::GamepadDeviceLinux::timestamp):
+        (WebCore::GamepadDeviceLinux::axesCount):
+        (WebCore::GamepadDeviceLinux::axesData):
+        (WebCore::GamepadDeviceLinux::buttonsCount):
+        (WebCore::GamepadDeviceLinux::buttonsData):
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        Rename rareSVGData() to svgRareData()
+        https://bugs.webkit.org/show_bug.cgi?id=90051
+
+        Reviewed by Nikolas Zimmermann.
+
+        Since rareSVGData() returns SVGRareData, it would make sense to
+        rename rareSVGData() to svgRareData(). Similarly, we can rename
+        ensureRareSVGData() to ensureSVGRareData(), and hasRareSVGData()
+        to hasSVGRareData().
+
+        c.f. bug 90050 is trying to introduce elementRareData() and
+        ensureElementRareData().
+
+        No tests. No change in behavior.
+
+        * WebCore.order:
+        * dom/Node.h:
+        (WebCore::Node::hasSVGRareData):
+        (WebCore::Node::setHasSVGRareData):
+        (WebCore::Node::clearHasSVGRareData):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::~SVGElement):
+        (WebCore::SVGElement::willRecalcStyle):
+        (WebCore::SVGElement::svgRareData):
+        (WebCore::SVGElement::ensureSVGRareData):
+        (WebCore::SVGElement::mapInstanceToElement):
+        (WebCore::SVGElement::removeInstanceMapping):
+        (WebCore::SVGElement::instancesForElement):
+        (WebCore::SVGElement::setCursorElement):
+        (WebCore::SVGElement::cursorElementRemoved):
+        (WebCore::SVGElement::setCursorImageValue):
+        (WebCore::SVGElement::cursorImageValueRemoved):
+        (WebCore::SVGElement::correspondingElement):
+        (WebCore::SVGElement::setCorrespondingElement):
+        (WebCore::SVGElement::animatedSMILStyleProperties):
+        (WebCore::SVGElement::ensureAnimatedSMILStyleProperties):
+        (WebCore::SVGElement::setUseOverrideComputedStyle):
+        (WebCore::SVGElement::computedStyle):
+        * svg/SVGElement.h:
+        (SVGElement):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::instanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::setInstanceUpdatesBlocked):
+        (WebCore::SVGStyledElement::hasPendingResources):
+        (WebCore::SVGStyledElement::setHasPendingResources):
+        (WebCore::SVGStyledElement::clearHasPendingResourcesIfPossible):
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        LabelableElement.cpp should include not ElementRareData.h but NodeRareData.h
+        https://bugs.webkit.org/show_bug.cgi?id=90047
+
+        Reviewed by Kent Tamura.
+
+        This is a simple refactoring. What LabelableElement uses is
+        not ElementRareData but NodeRareData.
+
+        No tests. No change in behavior.
+
+        * html/LabelableElement.cpp:
+
+2012-06-27  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Refactor V8BindingPerIsolateData::current() and V8BindingPerIsolateData::get()
+        https://bugs.webkit.org/show_bug.cgi?id=90044
+
+        Reviewed by Adam Barth.
+
+        'static_cast<V8BindingPerIsolateData*>(isolate->GetData())' is duplicated
+        in V8BindingPerIsolateData::current() and V8BindingPerIsolateData::get().
+        This patch removes the duplication.
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::V8BindingPerIsolateData::current):
+
 2012-06-26  Yoshifumi Inoue  <yosin@chromium.org>
 
         [Platform] Change implementation of LocaleICU class to support more UDateFormat.
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index b1b84966d..7f95c3018 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -52,11 +52,11 @@ ENABLE_DATALIST = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
 ENABLE_DETAILS = ENABLE_DETAILS;
 ENABLE_DEVICE_ORIENTATION = ;
+ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_FILE_SYSTEM = ;
 ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
 ENABLE_FILTERS_macosx = ENABLE_FILTERS;
-ENABLE_FONT_BOOSTING = ;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
@@ -120,6 +120,7 @@ ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
+ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_UNDO_MANAGER = ;
@@ -133,4 +134,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FONT_BOOSTING) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index 8e810b90e..7287d9cbb 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -150,6 +150,7 @@
 #include "JSHTMLContentElement.cpp"
 #include "JSHTMLDataListElement.cpp"
 #include "JSHTMLDetailsElement.cpp"
+#include "JSHTMLDialogElement.cpp"
 #include "JSHTMLDirectoryElement.cpp"
 #include "JSHTMLDivElement.cpp"
 #include "JSHTMLDListElement.cpp"
@@ -244,6 +245,7 @@
 #include "JSMouseEvent.cpp"
 #include "JSMutationCallback.cpp"
 #include "JSMutationEvent.cpp"
+#include "JSMutationObserver.cpp"
 #include "JSMutationRecord.cpp"
 #include "JSNamedNodeMap.cpp"
 #include "JSNavigator.cpp"
@@ -477,7 +479,6 @@
 #include "JSWebKitCSSTransformValue.cpp"
 #include "JSWebKitCSSMatrix.cpp"
 #include "JSWebKitCSSRegionRule.cpp"
-#include "JSWebKitMutationObserver.cpp"
 #include "JSWebKitNamedFlow.cpp"
 #include "JSWebKitPoint.cpp"
 #include "JSWebKitTransitionEvent.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 03f4004fa..767073e7d 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -31,6 +31,7 @@ VPATH = \
     $(WebCore)/Modules/filesystem \
     $(WebCore)/Modules/geolocation \
     $(WebCore)/Modules/indexeddb \
+    $(WebCore)/Modules/notifications \
     $(WebCore)/Modules/quota \
     $(WebCore)/Modules/webaudio \
     $(WebCore)/Modules/webdatabase \
@@ -48,7 +49,6 @@ VPATH = \
     $(WebCore)/html/track \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
-    $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/plugins \
     $(WebCore)/storage \
@@ -105,6 +105,11 @@ BINDING_IDLS = \
     $(WebCore)/Modules/indexeddb/IDBVersionChangeEvent.idl \
     $(WebCore)/Modules/indexeddb/IDBVersionChangeRequest.idl \
     $(WebCore)/Modules/indexeddb/WorkerContextIndexedDatabase.idl \
+    $(WebCore)/Modules/notifications/DOMWindowNotifications.idl \
+    $(WebCore)/Modules/notifications/Notification.idl \
+    $(WebCore)/Modules/notifications/NotificationCenter.idl \
+    $(WebCore)/Modules/notifications/NotificationPermissionCallback.idl \
+    $(WebCore)/Modules/notifications/WorkerContextNotifications.idl \
     $(WebCore)/Modules/quota/DOMWindowQuota.idl \
     $(WebCore)/Modules/quota/StorageInfo.idl \
     $(WebCore)/Modules/quota/StorageInfoErrorCallback.idl \
@@ -224,6 +229,7 @@ BINDING_IDLS = \
     $(WebCore)/dom/MouseEvent.idl \
     $(WebCore)/dom/MutationCallback.idl \
     $(WebCore)/dom/MutationEvent.idl \
+    $(WebCore)/dom/MutationObserver.idl \
     $(WebCore)/dom/MutationRecord.idl \
     $(WebCore)/dom/NamedNodeMap.idl \
     $(WebCore)/dom/Node.idl \
@@ -249,7 +255,6 @@ BINDING_IDLS = \
     $(WebCore)/dom/TreeWalker.idl \
     $(WebCore)/dom/UIEvent.idl \
     $(WebCore)/dom/WebKitAnimationEvent.idl \
-    $(WebCore)/dom/WebKitMutationObserver.idl \
     $(WebCore)/dom/WebKitNamedFlow.idl \
     $(WebCore)/dom/WebKitTransitionEvent.idl \
     $(WebCore)/dom/WheelEvent.idl \
@@ -281,6 +286,7 @@ BINDING_IDLS = \
     $(WebCore)/html/HTMLDListElement.idl \
     $(WebCore)/html/HTMLDataListElement.idl \
     $(WebCore)/html/HTMLDetailsElement.idl \
+    $(WebCore)/html/HTMLDialogElement.idl \
     $(WebCore)/html/HTMLDirectoryElement.idl \
     $(WebCore)/html/HTMLDivElement.idl \
     $(WebCore)/html/HTMLDocument.idl \
@@ -394,11 +400,6 @@ BINDING_IDLS = \
     $(WebCore)/inspector/ScriptProfile.idl \
     $(WebCore)/inspector/ScriptProfileNode.idl \
     $(WebCore)/loader/appcache/DOMApplicationCache.idl \
-    $(WebCore)/notifications/DOMWindowNotifications.idl \
-    $(WebCore)/notifications/Notification.idl \
-    $(WebCore)/notifications/NotificationCenter.idl \
-    $(WebCore)/notifications/NotificationPermissionCallback.idl \
-    $(WebCore)/notifications/WorkerContextNotifications.idl \
     $(WebCore)/page/AbstractView.idl \
     $(WebCore)/page/BarInfo.idl \
     $(WebCore)/page/Console.idl \
@@ -942,8 +943,8 @@ IDL_INCLUDES = \
     $(WebCore)/fileapi \
     $(WebCore)/html \
     $(WebCore)/css \
+    $(WebCore)/Modules/notifications \
     $(WebCore)/page \
-    $(WebCore)/notifications \
     $(WebCore)/xml \
     $(WebCore)/svg
 
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index 48ed8016d..2f93c4ae0 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -11,8 +11,6 @@
 sanitizedFile = $$toSanitizedPath($$_FILE_)
 equals(sanitizedFile, $$toSanitizedPath($$_PRO_FILE_)):TEMPLATE = derived
 
-load(features)
-
 mac {
     # FIXME: This runs the perl script every time. Is there a way we can run it only when deps change?
     fwheader_generator.commands = perl $${ROOT_WEBKIT_DIR}/Source/WebKit2/Scripts/generate-forwarding-headers.pl $${ROOT_WEBKIT_DIR}/Source/WebCore $${ROOT_BUILD_DIR}/Source/include mac
@@ -130,6 +128,11 @@ IDL_BINDINGS += \
     $$PWD/Modules/indexeddb/IDBRequest.idl \
     $$PWD/Modules/indexeddb/IDBTransaction.idl \
     $$PWD/Modules/indexeddb/WorkerContextIndexedDatabase.idl \
+    $$PWD/Modules/notifications/DOMWindowNotifications.idl \
+    $$PWD/Modules/notifications/Notification.idl \
+    $$PWD/Modules/notifications/NotificationCenter.idl \
+    $$PWD/Modules/notifications/NotificationPermissionCallback.idl \
+    $$PWD/Modules/notifications/WorkerContextNotifications.idl \
     $$PWD/Modules/quota/DOMWindowQuota.idl \
     $$PWD/Modules/quota/StorageInfo.idl \
     $$PWD/Modules/quota/StorageInfoErrorCallback.idl \
@@ -330,6 +333,7 @@ IDL_BINDINGS += \
     $$PWD/html/HTMLCollection.idl \
     $$PWD/html/HTMLDataListElement.idl \
     $$PWD/html/HTMLDetailsElement.idl \
+    $$PWD/html/HTMLDialogElement.idl \
     $$PWD/html/HTMLDirectoryElement.idl \
     $$PWD/html/HTMLDivElement.idl \
     $$PWD/html/HTMLDListElement.idl \
@@ -405,11 +409,6 @@ IDL_BINDINGS += \
     $$PWD/inspector/ScriptProfile.idl \
     $$PWD/inspector/ScriptProfileNode.idl \
     $$PWD/loader/appcache/DOMApplicationCache.idl \
-    $$PWD/notifications/DOMWindowNotifications.idl \
-    $$PWD/notifications/Notification.idl \
-    $$PWD/notifications/NotificationCenter.idl \
-    $$PWD/notifications/NotificationPermissionCallback.idl \
-    $$PWD/notifications/WorkerContextNotifications.idl \
     $$PWD/page/BarInfo.idl \
     $$PWD/page/Console.idl \
     $$PWD/page/Coordinates.idl \
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index fafa4ef9b..158c88c90 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
@@ -17,6 +17,8 @@ localizedStrings["%.2fs"] = "%.2fs";
 localizedStrings["%.3fms"] = "%.3fms";
 localizedStrings["%d console messages are not shown."] = "%d console messages are not shown.";
 localizedStrings["%d cookies (%s)"] = "%d cookies (%s)";
+localizedStrings["%d descendant with forced state"] = "%d descendant with forced state";
+localizedStrings["%d descendants with forced state"] = "%d descendants with forced state";
 localizedStrings["%d error"] = "%d error";
 localizedStrings["%d error, %d warning"] = "%d error, %d warning";
 localizedStrings["%d error, %d warnings"] = "%d error, %d warnings";
@@ -157,6 +159,8 @@ localizedStrings["Debugging enabled. Click to disable."] = "Debugging enabled. C
 localizedStrings["Delete Node"] = "Delete Node";
 localizedStrings["Delete node"] = "Delete node";
 localizedStrings["Delete watch expression."] = "Delete watch expression.";
+localizedStrings["Delete watch expression"] = "Delete watch expression";
+localizedStrings["Delete all watch expressions"] = "Delete all watch expressions";
 localizedStrings["Delete"] = "Delete";
 localizedStrings["Details"] = "Details";
 localizedStrings["Dimensions"] = "Dimensions";
@@ -179,6 +183,7 @@ localizedStrings["Edit Text"] = "Edit Text";
 localizedStrings["Edit text"] = "Edit text";
 localizedStrings["Edit as HTML"] = "Edit as HTML";
 localizedStrings["Edit"] = "Edit";
+localizedStrings["Element state: %s"] = "Element state: %s";
 localizedStrings["Elements Panel"] = "Elements Panel";
 localizedStrings["Elements"] = "Elements";
 localizedStrings["Emulate touch events"] = "Emulate touch events";
@@ -200,6 +205,8 @@ localizedStrings["Expected Content Length"] = "Expected Content Length";
 localizedStrings["Expires"] = "Expires";
 localizedStrings["File size"] = "File size";
 localizedStrings["Fit in window"] = "Fit in window";
+localizedStrings["Force Element State"] = "Force Element State";
+localizedStrings["Force element state"] = "Force element state";
 localizedStrings["Go to the panel to the left/right"] = "Go to the panel to the left/right";
 localizedStrings["Go back/forward in panel history"] = "Go back/forward in panel history";
 localizedStrings["Finish Loading"] = "Finish Loading";
@@ -349,6 +356,8 @@ localizedStrings["Screen resolution:"] = "Screen resolution:";
 localizedStrings["Script"] = "Script";
 localizedStrings["Scripting"] = "Scripting";
 localizedStrings["Scripts Panel"] = "Scripts Panel";
+localizedStrings["Scroll into view"] = "Scroll into view";
+localizedStrings["Scroll Into View"] = "Scroll Into View";
 localizedStrings["Source Code Panel"] = "Source Code Panel";
 localizedStrings["Scripts"] = "Scripts";
 localizedStrings["Source Code"] = "Source Code";
@@ -657,6 +666,7 @@ localizedStrings["Glue asynchronous events to causes"] = "Glue asynchronous even
 localizedStrings["undefined × %d"] = "undefined × %d";
 localizedStrings["Version"] = "Version";
 localizedStrings["Key path: "] = "Key path: ";
+localizedStrings["autoIncrement"] = "autoIncrement";
 localizedStrings["unique"] = "unique";
 localizedStrings["multiEntry"] = "multiEntry";
 localizedStrings["Show each event category as a horizontal strip in overview"] = "Show each event category as a horizontal strip in overview";
@@ -673,12 +683,15 @@ localizedStrings["Create snippet"] = "Create snippet";
 localizedStrings["Create Snippet"] = "Create Snippet";
 localizedStrings["Frame"] = "Frame";
 localizedStrings["FPS"] = "FPS";
-localizedStrings["WebSocket Frames"] = "WebSocket Frames";
+localizedStrings["Continuation Frame"] = "Continuation Frame";
+localizedStrings["Binary Frame"] = "Binary Frame";
+localizedStrings["Connection Close Frame"] = "Connection Close Frame";
+localizedStrings["Ping Frame"] = "Ping Frame";
+localizedStrings["Pong Frame"] = "Pong Frame";
 localizedStrings["Time"] = "Time";
-localizedStrings["OpCode"] = "OpCode";
-localizedStrings["Mask"] = "Mask";
 localizedStrings["Length"] = "Length";
 localizedStrings["Data"] = "Data";
+localizedStrings["%s (Opcode %d%s)"] = "%s (Opcode %d%s)";
 localizedStrings["<Left>"] = "<Left>";
 localizedStrings["<Right>"] = "<Right>";
 localizedStrings["<Up>"] = "<Up>";
@@ -703,3 +716,7 @@ localizedStrings["apply original content"] = "apply original content";
 localizedStrings["apply revision content"] = "apply revision content";
 localizedStrings["revert"] = "revert";
 localizedStrings["CPU Time"] = "CPU Time";
+localizedStrings["Encoded Data Length"] = "Encoded Data Length";
+localizedStrings["%d Bytes"] = "%d Bytes";
+localizedStrings["Time End"] = "Time End";
+localizedStrings["Search:"] = "Search:";
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index f3280772c..b825f0b7a 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -12,9 +12,11 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/ThirdParty/ANGLE/include/GLSLANG \
 	-I$(srcdir)/Source/WebCore \
 	-I$(srcdir)/Source/WebCore/Modules/filesystem \
+	-I$(srcdir)/Source/WebCore/Modules/gamepad \
 	-I$(srcdir)/Source/WebCore/Modules/geolocation \
 	-I$(srcdir)/Source/WebCore/Modules/indexeddb \
 	-I$(srcdir)/Source/WebCore/Modules/mediastream \
+	-I$(srcdir)/Source/WebCore/Modules/notifications \
 	-I$(srcdir)/Source/WebCore/Modules/webaudio \
 	-I$(srcdir)/Source/WebCore/Modules/webdatabase \
 	-I$(srcdir)/Source/WebCore/Modules/websockets \
@@ -45,7 +47,6 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/loader/cache \
 	-I$(srcdir)/Source/WebCore/loader/icon \
 	-I$(srcdir)/Source/WebCore/mathml \
-	-I$(srcdir)/Source/WebCore/notifications \
 	-I$(srcdir)/Source/WebCore/page \
 	-I$(srcdir)/Source/WebCore/page/animation \
 	-I$(srcdir)/Source/WebCore/page/scrolling \
@@ -67,6 +68,7 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/image-decoders/webp \
 	-I$(srcdir)/Source/WebCore/platform/image-decoders/png \
 	-I$(srcdir)/Source/WebCore/platform/leveldb \
+	-I$(srcdir)/Source/WebCore/platform/linux \
 	-I$(srcdir)/Source/WebCore/platform/mediastream \
 	-I$(srcdir)/Source/WebCore/platform/mediastream/gstreamer \
 	-I$(srcdir)/Source/WebCore/platform/mock \
@@ -684,12 +686,12 @@ webcore_cppflags += -DENABLE_DEVICE_ORIENTATION=1
 endif  # END ENABLE_DEVICE_ORIENTATION
 
 # ---
-# Font Boosting support
+# Text Autosizing support
 # ---
-if ENABLE_FONT_BOOSTING
-FEATURE_DEFINES += ENABLE_FONT_BOOSTING=1
-webcore_cppflags += -DENABLE_FONT_BOOSTING=1
-endif  # END ENABLE_FONT_BOOSTING
+if ENABLE_TEXT_AUTOSIZING
+FEATURE_DEFINES += ENABLE_TEXT_AUTOSIZING=1
+webcore_cppflags += -DENABLE_TEXT_AUTOSIZING=1
+endif  # END ENABLE_TEXT_AUTOSIZING
 
 # ---
 # Web Timing support
@@ -866,9 +868,11 @@ DerivedSources/ANGLE/glslang_tab.h: DerivedSources/ANGLE/glslang_tab.cpp
 
 IDL_PATH := \
     $(WebCore)/Modules/filesystem \
+    $(WebCore)/Modules/gamepad \
     $(WebCore)/Modules/geolocation \
     $(WebCore)/Modules/indexeddb \
     $(WebCore)/Modules/mediastream \
+    $(WebCore)/Modules/notifications \
     $(WebCore)/Modules/webaudio \
     $(WebCore)/Modules/webdatabase \
     $(WebCore)/Modules/websockets \
@@ -883,7 +887,6 @@ IDL_PATH := \
     $(WebCore)/html/track \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
-    $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/plugins \
     $(WebCore)/storage \
@@ -961,6 +964,7 @@ libWebCore_la_CPPFLAGS = \
 	$(CLUTTER_CFLAGS) \
 	$(COVERAGE_CFLAGS) \
 	$(ENCHANT_CFLAGS) \
+	$(GAMEPAD_CFLAGS) \
 	$(GEOCLUE_CFLAGS) \
 	$(GLIB_CFLAGS) \
 	$(GSTREAMER_CFLAGS) \
@@ -1032,9 +1036,11 @@ libWebCoreGtk_la_CPPFLAGS = \
 
 EXTRA_DIST += \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/filesystem/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/gamepad/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/geolocation/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/indexeddb/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/mediastream/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/notifications/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/webaudio/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/webdatabase/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/Modules/websockets/*.idl) \
@@ -1048,7 +1054,6 @@ EXTRA_DIST += \
 	$(shell ls $(srcdir)/Source/WebCore/html/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/inspector/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/loader/appcache/*.idl) \
-	$(shell ls $(srcdir)/Source/WebCore/notifications/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/page/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/plugins/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/storage/*.idl) \
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index 2a1431663..3781727aa 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -192,6 +192,10 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSFloat32Array.h \
 	DerivedSources/WebCore/JSFloat64Array.cpp \
 	DerivedSources/WebCore/JSFloat64Array.h \
+	DerivedSources/WebCore/JSGamepad.cpp \
+	DerivedSources/WebCore/JSGamepad.h \
+	DerivedSources/WebCore/JSGamepadList.cpp \
+	DerivedSources/WebCore/JSGamepadList.h \
 	DerivedSources/WebCore/JSGeolocation.cpp \
 	DerivedSources/WebCore/JSGeolocation.h \
 	DerivedSources/WebCore/JSGeoposition.cpp \
@@ -387,6 +391,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSMediaStreamList.h \
 	DerivedSources/WebCore/JSMediaStreamTrack.cpp \
 	DerivedSources/WebCore/JSMediaStreamTrack.h \
+	DerivedSources/WebCore/JSMediaStreamTrackEvent.cpp \
+	DerivedSources/WebCore/JSMediaStreamTrackEvent.h \
 	DerivedSources/WebCore/JSMediaStreamTrackList.cpp \
 	DerivedSources/WebCore/JSMediaStreamTrackList.h \
 	DerivedSources/WebCore/JSMediaQueryList.cpp \
@@ -405,6 +411,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSMutationCallback.h \
 	DerivedSources/WebCore/JSMutationEvent.cpp \
 	DerivedSources/WebCore/JSMutationEvent.h \
+	DerivedSources/WebCore/JSMutationObserver.cpp \
+	DerivedSources/WebCore/JSMutationObserver.h \
 	DerivedSources/WebCore/JSMutationRecord.cpp \
 	DerivedSources/WebCore/JSMutationRecord.h \
 	DerivedSources/WebCore/JSNamedNodeMap.cpp \
@@ -616,8 +624,6 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSWebKitCSSRegionRule.h \
 	DerivedSources/WebCore/JSWebKitCSSTransformValue.cpp \
 	DerivedSources/WebCore/JSWebKitCSSTransformValue.h \
-	DerivedSources/WebCore/JSWebKitMutationObserver.cpp \
-	DerivedSources/WebCore/JSWebKitMutationObserver.h \
 	DerivedSources/WebCore/JSWebKitNamedFlow.cpp \
 	DerivedSources/WebCore/JSWebKitNamedFlow.h \
 	DerivedSources/WebCore/JSWebKitPoint.cpp \
@@ -677,6 +683,9 @@ webcore_built_sources += \
 	DerivedSources/WebCore/XPathGrammar.h
 
 dom_binding_idls += \
+	$(WebCore)/Modules/gamepad/Gamepad.idl \
+	$(WebCore)/Modules/gamepad/GamepadList.idl \
+	$(WebCore)/Modules/gamepad/NavigatorGamepad.idl \
 	$(WebCore)/Modules/geolocation/Geolocation.idl \
 	$(WebCore)/Modules/geolocation/Geoposition.idl \
 	$(WebCore)/Modules/geolocation/NavigatorGeolocation.idl \
@@ -692,6 +701,7 @@ dom_binding_idls += \
 	$(WebCore)/Modules/mediastream/MediaStreamEvent.idl \
 	$(WebCore)/Modules/mediastream/MediaStreamList.idl \
 	$(WebCore)/Modules/mediastream/MediaStreamTrack.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamTrackEvent.idl \
 	$(WebCore)/Modules/mediastream/MediaStreamTrackList.idl \
 	$(WebCore)/Modules/mediastream/NavigatorMediaStream.idl \
 	$(WebCore)/Modules/mediastream/NavigatorUserMediaError.idl \
@@ -700,6 +710,9 @@ dom_binding_idls += \
 	$(WebCore)/Modules/mediastream/PeerConnection00.idl \
 	$(WebCore)/Modules/mediastream/SessionDescription.idl \
 	$(WebCore)/Modules/mediastream/SignalingCallback.idl \
+	$(WebCore)/Modules/notifications/Notification.idl \
+	$(WebCore)/Modules/notifications/NotificationCenter.idl \
+	$(WebCore)/Modules/notifications/NotificationPermissionCallback.idl \
 	$(WebCore)/Modules/webaudio/AudioContext.idl \
 	$(WebCore)/Modules/webaudio/AudioPannerNode.idl \
 	$(WebCore)/Modules/webaudio/DynamicsCompressorNode.idl \
@@ -768,6 +781,7 @@ dom_binding_idls += \
 	$(WebCore)/dom/MouseEvent.idl \
 	$(WebCore)/dom/MutationCallback.idl \
 	$(WebCore)/dom/MutationEvent.idl \
+	$(WebCore)/dom/MutationObserver.idl \
 	$(WebCore)/dom/MutationRecord.idl \
 	$(WebCore)/dom/NamedNodeMap.idl \
 	$(WebCore)/dom/Node.idl \
@@ -791,7 +805,6 @@ dom_binding_idls += \
 	$(WebCore)/dom/TreeWalker.idl \
 	$(WebCore)/dom/UIEvent.idl \
 	$(WebCore)/dom/WebKitAnimationEvent.idl \
-	$(WebCore)/dom/WebKitMutationObserver.idl \
 	$(WebCore)/dom/WebKitNamedFlow.idl \
 	$(WebCore)/dom/WebKitTransitionEvent.idl \
 	$(WebCore)/dom/WheelEvent.idl \
@@ -939,9 +952,6 @@ dom_binding_idls += \
 	$(WebCore)/inspector/ScriptProfile.idl \
 	$(WebCore)/inspector/ScriptProfileNode.idl \
 	$(WebCore)/loader/appcache/DOMApplicationCache.idl \
-	$(WebCore)/notifications/Notification.idl \
-	$(WebCore)/notifications/NotificationCenter.idl \
-	$(WebCore)/notifications/NotificationPermissionCallback.idl \
 	$(WebCore)/page/BarInfo.idl \
 	$(WebCore)/page/Console.idl \
 	$(WebCore)/page/Coordinates.idl \
@@ -1053,6 +1063,12 @@ webcore_modules_sources += \
 	Source/WebCore/Modules/filesystem/WebKitFlags.h \
 	Source/WebCore/Modules/filesystem/WorkerContextFileSystem.cpp \
 	Source/WebCore/Modules/filesystem/WorkerContextFileSystem.h \
+	Source/WebCore/Modules/gamepad/Gamepad.cpp \
+	Source/WebCore/Modules/gamepad/Gamepad.h \
+	Source/WebCore/Modules/gamepad/GamepadList.cpp \
+	Source/WebCore/Modules/gamepad/GamepadList.h \
+	Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp \
+	Source/WebCore/Modules/gamepad/NavigatorGamepad.h \
 	Source/WebCore/Modules/geolocation/Geolocation.cpp \
 	Source/WebCore/Modules/geolocation/Geolocation.h \
 	Source/WebCore/Modules/geolocation/GeolocationController.cpp \
@@ -1159,6 +1175,8 @@ webcore_modules_sources += \
 	Source/WebCore/Modules/mediastream/MediaStreamRegistry.h \
 	Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp \
 	Source/WebCore/Modules/mediastream/MediaStreamTrack.h \
+	Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.h \
 	Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp \
 	Source/WebCore/Modules/mediastream/MediaStreamTrackList.h \
 	Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp \
@@ -1176,6 +1194,18 @@ webcore_modules_sources += \
 	Source/WebCore/Modules/mediastream/UserMediaController.cpp \
 	Source/WebCore/Modules/mediastream/UserMediaRequest.cpp \
 	Source/WebCore/Modules/mediastream/UserMediaRequest.h \
+	Source/WebCore/Modules/notifications/DOMWindowNotifications.cpp \
+	Source/WebCore/Modules/notifications/DOMWindowNotifications.h \
+	Source/WebCore/Modules/notifications/NotificationCenter.cpp \
+	Source/WebCore/Modules/notifications/NotificationCenter.h \
+	Source/WebCore/Modules/notifications/NotificationClient.h \
+	Source/WebCore/Modules/notifications/NotificationController.cpp \
+	Source/WebCore/Modules/notifications/NotificationController.h \
+	Source/WebCore/Modules/notifications/Notification.cpp \
+	Source/WebCore/Modules/notifications/Notification.h \
+	Source/WebCore/Modules/notifications/NotificationPermissionCallback.h \
+	Source/WebCore/Modules/notifications/WorkerContextNotifications.cpp \
+	Source/WebCore/Modules/notifications/WorkerContextNotifications.h \
 	Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp \
 	Source/WebCore/Modules/webdatabase/AbstractDatabase.h \
 	Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.cpp \
@@ -1450,6 +1480,7 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSMessagePortCustom.cpp \
 	Source/WebCore/bindings/js/JSMessagePortCustom.h \
 	Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp \
+	Source/WebCore/bindings/js/JSMutationObserverCustom.cpp \
 	Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
 	Source/WebCore/bindings/js/JSNodeCustom.cpp \
 	Source/WebCore/bindings/js/JSNodeCustom.h \
@@ -1494,7 +1525,6 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
 	Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp \
-	Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitPointCustom.cpp \
 	Source/WebCore/bindings/js/JSWebSocketCustom.cpp \
 	Source/WebCore/bindings/js/JSWorkerContextBase.cpp \
@@ -1759,6 +1789,8 @@ webcore_sources += \
 	Source/WebCore/css/WebKitCSSMatrix.h \
 	Source/WebCore/css/WebKitCSSRegionRule.cpp \
 	Source/WebCore/css/WebKitCSSRegionRule.h \
+	Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp \
+	Source/WebCore/css/WebKitCSSSVGDocumentValue.h \
 	Source/WebCore/css/WebKitCSSShaderValue.cpp \
 	Source/WebCore/css/WebKitCSSShaderValue.h \
 	Source/WebCore/css/WebKitCSSTransformValue.cpp \
@@ -1928,6 +1960,8 @@ webcore_sources += \
 	Source/WebCore/dom/MutationCallback.h \
 	Source/WebCore/dom/MutationEvent.cpp \
 	Source/WebCore/dom/MutationEvent.h \
+	Source/WebCore/dom/MutationObserver.cpp \
+	Source/WebCore/dom/MutationObserver.h \
 	Source/WebCore/dom/MutationObserverInterestGroup.cpp \
 	Source/WebCore/dom/MutationObserverInterestGroup.h \
 	Source/WebCore/dom/MutationObserverRegistration.cpp \
@@ -2038,8 +2072,6 @@ webcore_sources += \
 	Source/WebCore/dom/ViewportArguments.h \
 	Source/WebCore/dom/WebKitAnimationEvent.cpp \
 	Source/WebCore/dom/WebKitAnimationEvent.h \
-	Source/WebCore/dom/WebKitMutationObserver.cpp \
-	Source/WebCore/dom/WebKitMutationObserver.h \
 	Source/WebCore/dom/WebKitNamedFlow.cpp \
 	Source/WebCore/dom/WebKitNamedFlow.h \
 	Source/WebCore/dom/WebKitTransitionEvent.cpp \
@@ -2929,18 +2961,6 @@ webcore_sources += \
 	Source/WebCore/mathml/MathMLMathElement.h \
 	Source/WebCore/mathml/MathMLTextElement.cpp \
 	Source/WebCore/mathml/MathMLTextElement.h \
-	Source/WebCore/notifications/DOMWindowNotifications.cpp \
-	Source/WebCore/notifications/DOMWindowNotifications.h \
-	Source/WebCore/notifications/NotificationCenter.cpp \
-	Source/WebCore/notifications/NotificationCenter.h \
-	Source/WebCore/notifications/NotificationClient.h \
-	Source/WebCore/notifications/NotificationController.cpp \
-	Source/WebCore/notifications/NotificationController.h \
-	Source/WebCore/notifications/Notification.cpp \
-	Source/WebCore/notifications/Notification.h \
-	Source/WebCore/notifications/NotificationPermissionCallback.h \
-	Source/WebCore/notifications/WorkerContextNotifications.cpp \
-	Source/WebCore/notifications/WorkerContextNotifications.h \
 	Source/WebCore/page/animation/AnimationBase.cpp \
 	Source/WebCore/page/animation/AnimationBase.h \
 	Source/WebCore/page/animation/AnimationController.cpp \
@@ -3160,6 +3180,7 @@ webcore_sources += \
 	Source/WebCore/platform/FileSystem.h \
 	Source/WebCore/platform/FloatConversion.h \
 	Source/WebCore/platform/FractionalLayoutUnit.h \
+	Source/WebCore/platform/Gamepads.h \
 	Source/WebCore/platform/HashTools.h \
 	Source/WebCore/platform/HistogramSupport.cpp \
 	Source/WebCore/platform/HistogramSupport.h \
@@ -3263,8 +3284,8 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/filters/SourceGraphic.h \
 	Source/WebCore/platform/graphics/filters/SpotLightSource.cpp \
 	Source/WebCore/platform/graphics/filters/SpotLightSource.h \
+	Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h \
 	Source/WebCore/platform/graphics/filters/arm/FECompositeArithmeticNEON.h \
-	Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp \
 	Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h \
 	Source/WebCore/platform/graphics/filters/arm/FELightingNEON.cpp \
 	Source/WebCore/platform/graphics/filters/arm/FELightingNEON.h \
@@ -3354,6 +3375,7 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/PathTraversalState.h \
 	Source/WebCore/platform/graphics/Pattern.cpp \
 	Source/WebCore/platform/graphics/Pattern.h \
+	Source/WebCore/platform/graphics/PlatformLayer.h \
 	Source/WebCore/platform/graphics/Region.cpp \
 	Source/WebCore/platform/graphics/Region.h \
 	Source/WebCore/platform/graphics/RoundedRect.cpp \
@@ -3408,6 +3430,7 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/WOFFFileFormat.h \
 	Source/WebCore/platform/gtk/ErrorsGtk.cpp \
 	Source/WebCore/platform/gtk/ErrorsGtk.h \
+	Source/WebCore/platform/gtk/GamepadsGtk.cpp \
 	Source/WebCore/platform/gtk/KURLGtk.cpp \
 	Source/WebCore/platform/gtk/LanguageGtk.cpp \
 	Source/WebCore/platform/gtk/LoggingGtk.cpp \
@@ -3468,6 +3491,8 @@ webcore_sources += \
 	Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h \
 	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
 	Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h \
+	Source/WebCore/platform/linux/GamepadDeviceLinux.cpp \
+	Source/WebCore/platform/linux/GamepadDeviceLinux.h \
 	Source/WebCore/platform/mediastream/DeprecatedPeerConnectionHandler.h \
 	Source/WebCore/platform/mediastream/DeprecatedPeerConnectionHandlerClient.h \
 	Source/WebCore/platform/mediastream/IceCandidateDescriptor.cpp \
@@ -3661,6 +3686,8 @@ webcore_sources += \
 	Source/WebCore/platform/text/BidiContext.h \
 	Source/WebCore/platform/text/BidiResolver.h \
 	Source/WebCore/platform/text/BidiRunList.h \
+	Source/WebCore/platform/text/DateTimeFormat.cpp \
+	Source/WebCore/platform/text/DateTimeFormat.h \
 	Source/WebCore/platform/text/DecodeEscapeSequences.h \
 	Source/WebCore/platform/text/Hyphenation.cpp \
 	Source/WebCore/platform/text/Hyphenation.h \
@@ -6027,6 +6054,7 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/OpenGLShims.cpp \
 	Source/WebCore/platform/graphics/OpenGLShims.h \
 	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp \
+	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp \
 	Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h \
 	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp \
 	Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
diff --git a/Source/WebCore/Modules/geolocation/GeolocationController.cpp b/Source/WebCore/Modules/geolocation/GeolocationController.cpp
index e1ace93a5..6ff08d646 100644
--- a/Source/WebCore/Modules/geolocation/GeolocationController.cpp
+++ b/Source/WebCore/Modules/geolocation/GeolocationController.cpp
@@ -30,11 +30,13 @@
 
 #include "GeolocationClient.h"
 #include "GeolocationPosition.h"
+#include "InspectorInstrumentation.h"
 
 namespace WebCore {
 
-GeolocationController::GeolocationController(Page*, GeolocationClient* client)
+GeolocationController::GeolocationController(Page* page, GeolocationClient* client)
     : m_client(client)
+    , m_page(page)
 {
 }
 
@@ -98,6 +100,9 @@ void GeolocationController::cancelPermissionRequest(Geolocation* geolocation)
 
 void GeolocationController::positionChanged(GeolocationPosition* position)
 {
+    position = InspectorInstrumentation::checkGeolocationPositionOrError(m_page, position);
+    if (!position)
+        return;
     m_lastPosition = position;
     Vector<RefPtr<Geolocation> > observersVector;
     copyToVector(m_observers, observersVector);
diff --git a/Source/WebCore/Modules/geolocation/GeolocationController.h b/Source/WebCore/Modules/geolocation/GeolocationController.h
index fc3b513b3..bc61b9e4d 100644
--- a/Source/WebCore/Modules/geolocation/GeolocationController.h
+++ b/Source/WebCore/Modules/geolocation/GeolocationController.h
@@ -68,6 +68,7 @@ private:
     GeolocationController(Page*, GeolocationClient*);
 
     GeolocationClient* m_client;
+    Page* m_page;
 
     RefPtr<GeolocationPosition> m_lastPosition;
     typedef HashSet<RefPtr<Geolocation> > ObserversSet;
diff --git a/Source/WebCore/Modules/indexeddb/IDBCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
index 7dee5500f..0b34b6886 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
@@ -34,6 +34,7 @@
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBDatabaseError.h"
 #include "IDBKey.h"
+#include "IDBKeyPath.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBTransactionBackendInterface.h"
 #include "SerializedScriptValue.h"
@@ -55,6 +56,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBKey>) = 0;
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) = 0;
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, const IDBKeyPath&) = 0;
     virtual void onSuccessWithContinuation() = 0;
     virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >& keys, const Vector<RefPtr<IDBKey> >& primaryKeys, const Vector<RefPtr<SerializedScriptValue> >& values) = 0;
     virtual void onBlocked() = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
index af1c50444..5e9025112 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
@@ -42,9 +42,9 @@
 
 namespace WebCore {
 
-PassRefPtr<IDBCursor> IDBCursor::create(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
+PassRefPtr<IDBCursor> IDBCursor::create(PassRefPtr<IDBCursorBackendInterface> backend, Direction direction, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
 {
-    return adoptRef(new IDBCursor(backend, request, source, transaction));
+    return adoptRef(new IDBCursor(backend, direction, request, source, transaction));
 }
 
 const AtomicString& IDBCursor::directionNext()
@@ -72,9 +72,10 @@ const AtomicString& IDBCursor::directionPrevUnique()
 }
 
 
-IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
+IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, Direction direction, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
     : m_backend(backend)
     , m_request(request)
+    , m_direction(direction)
     , m_source(source)
     , m_transaction(transaction)
     , m_transactionNotifier(transaction, this)
@@ -95,7 +96,7 @@ const String& IDBCursor::direction() const
 {
     IDB_TRACE("IDBCursor::direction");
     ExceptionCode ec = 0;
-    const AtomicString& direction = directionToString(m_backend->direction(), ec);
+    const AtomicString& direction = directionToString(m_direction, ec);
     ASSERT(!ec);
     return direction;
 }
@@ -266,7 +267,21 @@ void IDBCursor::setValueReady()
 {
     m_currentKey = m_backend->key();
     m_currentPrimaryKey = m_backend->primaryKey();
-    m_currentValue = IDBAny::create(m_backend->value());
+
+    RefPtr<SerializedScriptValue> value = m_backend->value();
+#ifndef NDEBUG
+    if (!isKeyCursor()) {
+        // FIXME: Actually inject the primaryKey at the keyPath.
+        RefPtr<IDBObjectStore> objectStore = effectiveObjectStore();
+        if (objectStore->autoIncrement() && !objectStore->metadata().keyPath.isNull()) {
+            const IDBKeyPath& keyPath = objectStore->metadata().keyPath;
+            RefPtr<IDBKey> expectedKey = createIDBKeyFromSerializedValueAndKeyPath(value, keyPath);
+            ASSERT(expectedKey->isEqual(m_currentPrimaryKey.get()));
+        }
+    }
+#endif
+    m_currentValue = IDBAny::create(value.release());
+
     m_gotValue = true;
     m_valueIsDirty = true;
 }
@@ -279,7 +294,7 @@ PassRefPtr<IDBObjectStore> IDBCursor::effectiveObjectStore()
     return index->objectStore();
 }
 
-unsigned short IDBCursor::stringToDirection(const String& directionString, ExceptionCode& ec)
+IDBCursor::Direction IDBCursor::stringToDirection(const String& directionString, ExceptionCode& ec)
 {
     if (directionString == IDBCursor::directionNext())
         return IDBCursor::NEXT;
@@ -291,7 +306,7 @@ unsigned short IDBCursor::stringToDirection(const String& directionString, Excep
         return IDBCursor::PREV_NO_DUPLICATE;
 
     ec = IDBDatabaseException::IDB_TYPE_ERR;
-    return 0;
+    return IDBCursor::NEXT;
 }
 
 const AtomicString& IDBCursor::directionToString(unsigned short direction, ExceptionCode& ec)
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursor.h b/Source/WebCore/Modules/indexeddb/IDBCursor.h
index 4f4564eeb..fd46cbbca 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursor.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.h
@@ -59,10 +59,10 @@ public:
     static const AtomicString& directionPrev();
     static const AtomicString& directionPrevUnique();
 
-    static unsigned short stringToDirection(const String& modeString, ExceptionCode&);
+    static IDBCursor::Direction stringToDirection(const String& modeString, ExceptionCode&);
     static const AtomicString& directionToString(unsigned short mode, ExceptionCode&);
 
-    static PassRefPtr<IDBCursor> create(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBAny* source, IDBTransaction*);
+    static PassRefPtr<IDBCursor> create(PassRefPtr<IDBCursorBackendInterface>, Direction, IDBRequest*, IDBAny* source, IDBTransaction*);
     virtual ~IDBCursor();
 
     // FIXME: Try to modify the code generator so this is unneeded.
@@ -90,7 +90,7 @@ public:
     bool valueIsDirty() { return m_valueIsDirty; }
 
 protected:
-    IDBCursor(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBAny* source, IDBTransaction*);
+    IDBCursor(PassRefPtr<IDBCursorBackendInterface>, Direction, IDBRequest*, IDBAny* source, IDBTransaction*);
     virtual bool isKeyCursor() const { return true; }
 
 private:
@@ -98,6 +98,7 @@ private:
 
     RefPtr<IDBCursorBackendInterface> m_backend;
     RefPtr<IDBRequest> m_request;
+    const Direction m_direction;
     RefPtr<IDBAny> m_source;
     RefPtr<IDBTransaction> m_transaction;
     IDBTransaction::OpenCursorNotifier m_transactionNotifier;
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
index 0a14a6f1a..fe58988e4 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
@@ -63,12 +63,6 @@ IDBCursorBackendImpl::~IDBCursorBackendImpl()
     m_objectStore.clear();
 }
 
-unsigned short IDBCursorBackendImpl::direction() const
-{
-    IDB_TRACE("IDBCursorBackendImpl::direction");
-    return m_direction;
-}
-
 PassRefPtr<IDBKey> IDBCursorBackendImpl::key() const
 {
     IDB_TRACE("IDBCursorBackendImpl::key");
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
index 89dde4f11..153016f12 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
@@ -53,7 +53,6 @@ public:
     }
     virtual ~IDBCursorBackendImpl();
 
-    virtual unsigned short direction() const;
     virtual PassRefPtr<IDBKey> key() const;
     virtual PassRefPtr<IDBKey> primaryKey() const;
     virtual PassRefPtr<SerializedScriptValue> value() const;
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h
index 971232826..48d3a1829 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h
@@ -53,7 +53,6 @@ public:
         ObjectStoreCursor
     };
 
-    virtual unsigned short direction() const = 0;
     virtual PassRefPtr<IDBKey> key() const = 0;
     virtual PassRefPtr<IDBKey> primaryKey() const = 0;
     virtual PassRefPtr<SerializedScriptValue> value() const = 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
index 30d242c98..b90ba3d9b 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
@@ -33,9 +33,9 @@
 
 namespace WebCore {
 
-PassRefPtr<IDBCursorWithValue> IDBCursorWithValue::create(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
+PassRefPtr<IDBCursorWithValue> IDBCursorWithValue::create(PassRefPtr<IDBCursorBackendInterface> backend, Direction direction, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
 {
-    return adoptRef(new IDBCursorWithValue(backend, request, source, transaction));
+    return adoptRef(new IDBCursorWithValue(backend, direction, request, source, transaction));
 }
 
 PassRefPtr<IDBCursorWithValue> IDBCursorWithValue::fromCursor(PassRefPtr<IDBCursor> prpCursor)
@@ -44,8 +44,8 @@ PassRefPtr<IDBCursorWithValue> IDBCursorWithValue::fromCursor(PassRefPtr<IDBCurs
     return cursorWithValue.release();
 }
 
-IDBCursorWithValue::IDBCursorWithValue(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
-    : IDBCursor(backend, request, source, transaction)
+IDBCursorWithValue::IDBCursorWithValue(PassRefPtr<IDBCursorBackendInterface> backend, Direction direction, IDBRequest* request, IDBAny* source, IDBTransaction* transaction)
+    : IDBCursor(backend, direction, request, source, transaction)
 {
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
index 9b396ba35..cbb850a1c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
@@ -34,7 +34,7 @@ namespace WebCore {
 
 class IDBCursorWithValue : public IDBCursor {
 public:
-    static PassRefPtr<IDBCursorWithValue> create(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBAny* source, IDBTransaction*);
+    static PassRefPtr<IDBCursorWithValue> create(PassRefPtr<IDBCursorBackendInterface>, Direction, IDBRequest*, IDBAny* source, IDBTransaction*);
     static PassRefPtr<IDBCursorWithValue> fromCursor(PassRefPtr<IDBCursor>);
     virtual ~IDBCursorWithValue();
 
@@ -45,7 +45,7 @@ protected:
     virtual bool isKeyCursor() const OVERRIDE { return false; }
 
 private:
-    IDBCursorWithValue(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBAny* source, IDBTransaction*);
+    IDBCursorWithValue(PassRefPtr<IDBCursorBackendInterface>, Direction, IDBRequest*, IDBAny* source, IDBTransaction*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
index ab123c3dc..35b5ca1f0 100644
--- a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
@@ -207,7 +207,8 @@ PassRefPtr<IDBVersionChangeRequest> IDBDatabase::setVersion(ScriptExecutionConte
 PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* context, PassRefPtr<DOMStringList> prpStoreNames, const String& modeString, ExceptionCode& ec)
 {
     RefPtr<DOMStringList> storeNames = prpStoreNames;
-    if (!storeNames || storeNames->isEmpty()) {
+    ASSERT(storeNames.get());
+    if (storeNames->isEmpty()) {
         ec = IDBDatabaseException::IDB_INVALID_ACCESS_ERR;
         return 0;
     }
@@ -297,6 +298,9 @@ void IDBDatabase::onVersionChange(const String& version)
     if (m_contextStopped || !scriptExecutionContext())
         return;
 
+    if (m_closePending)
+        return;
+
     enqueueEvent(IDBVersionChangeEvent::create(version, eventNames().versionchangeEvent));
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBFactory.cpp b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
index d3de8f6fa..8be9d1d24 100644
--- a/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
@@ -94,12 +94,14 @@ PassRefPtr<IDBRequest> IDBFactory::open(ScriptExecutionContext* context, const S
             return 0;
         Frame* frame = document->frame();
         RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), 0);
-        m_backend->open(name, request.get(), context->securityOrigin(), frame, String());
+        m_backend->open(name, request.get(), context->securityOrigin(), frame, document->page()->group().groupSettings()->indexedDBDatabasePath());
         return request;
     }
 #if ENABLE(WORKERS)
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), 0);
-    m_backend->openFromWorker(name, request.get(), context->securityOrigin(), static_cast<WorkerContext*>(context), String());
+    WorkerContext* workerContext = static_cast<WorkerContext*>(context);
+    GroupSettings* groupSettings = workerContext->thread()->groupSettings();
+    m_backend->openFromWorker(name, request.get(), context->securityOrigin(), workerContext, groupSettings ? groupSettings->indexedDBDatabasePath() : String());
     return request;
 #else
     return 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndex.cpp b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
index fd9394947..fec96804b 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
@@ -69,12 +69,12 @@ PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, Pas
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return 0;
     }
-    unsigned short direction = IDBCursor::stringToDirection(directionString, ec);
+    IDBCursor::Direction direction = IDBCursor::stringToDirection(directionString, ec);
     if (ec)
         return 0;
 
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    request->setCursorType(IDBCursorBackendInterface::IndexCursor);
+    request->setCursorDetails(IDBCursorBackendInterface::IndexCursor, direction);
     m_backend->openCursor(keyRange, direction, request, m_transaction->backend(), ec);
     if (ec) {
         request->markEarlyDeath();
@@ -152,13 +152,12 @@ PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context,
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return 0;
     }
-
-    unsigned short direction = IDBCursor::stringToDirection(directionString, ec);
+    IDBCursor::Direction direction = IDBCursor::stringToDirection(directionString, ec);
     if (ec)
         return 0;
 
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    request->setCursorType(IDBCursorBackendInterface::IndexKeyCursor);
+    request->setCursorDetails(IDBCursorBackendInterface::IndexKeyCursor, direction);
     m_backend->openKeyCursor(keyRange, direction, request, m_transaction->backend(), ec);
     if (ec) {
         request->markEarlyDeath();
diff --git a/Source/WebCore/Modules/indexeddb/IDBIndex.idl b/Source/WebCore/Modules/indexeddb/IDBIndex.idl
index ab6ceb7d8..a1708ca62 100644
--- a/Source/WebCore/Modules/indexeddb/IDBIndex.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.idl
@@ -34,36 +34,36 @@ module storage {
         readonly attribute boolean unique;
         readonly attribute boolean multiEntry;
 
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] DOMString direction)
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange? range, in [Optional] DOMString direction)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest openCursor(in IDBKey key, in [Optional] DOMString direction)
             raises (IDBDatabaseException);
         
-        [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in [Optional] IDBKeyRange range, in [Optional] DOMString  direction)
+        [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in [Optional] IDBKeyRange? range, in [Optional] DOMString  direction)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in IDBKey key, in [Optional] DOMString direction)
             raises (IDBDatabaseException);
 
         // FIXME: remove these when
         // https://bugs.webkit.org/show_bug.cgi?id=85326 is fixed.
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange? range, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest openCursor(in IDBKey key, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
+        [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in [Optional] IDBKeyRange? range, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in IDBKey key, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
         
-        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKeyRange key)
+        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKeyRange? key)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest getKey(in IDBKeyRange key)
+        [CallWith=ScriptExecutionContext] IDBRequest getKey(in IDBKeyRange? key)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest getKey(in IDBKey key)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange range)
+        [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange? range)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest count(in IDBKey key)
             raises (IDBDatabaseException);
diff --git a/Source/WebCore/Modules/indexeddb/IDBKey.cpp b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
index b76ed2cee..633c8357d 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKey.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
@@ -30,12 +30,6 @@
 
 namespace WebCore {
 
-IDBKey::IDBKey()
-    : m_type(InvalidType)
-    , m_sizeEstimate(kOverheadSize)
-{
-}
-
 IDBKey::~IDBKey()
 {
 }
@@ -75,8 +69,6 @@ int IDBKey::compare(const IDBKey* other) const
     case StringType:
         return -codePointCompare(other->m_string, m_string);
     case DateType:
-        return (m_date < other->m_date) ? -1 :
-                (m_date > other->m_date) ? 1 : 0;
     case NumberType:
         return (m_number < other->m_number) ? -1 :
                 (m_number > other-> m_number) ? 1 : 0;
diff --git a/Source/WebCore/Modules/indexeddb/IDBKey.h b/Source/WebCore/Modules/indexeddb/IDBKey.h
index cbfdf1d4f..7debf0d88 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKey.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.h
@@ -41,44 +41,29 @@ public:
 
     static PassRefPtr<IDBKey> createInvalid()
     {
-        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
-        idbKey->m_type = InvalidType;
-        return idbKey.release();
+        return adoptRef(new IDBKey());
     }
 
     static PassRefPtr<IDBKey> createNumber(double number)
     {
-        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
-        idbKey->m_type = NumberType;
-        idbKey->m_number = number;
-        idbKey->m_sizeEstimate += sizeof(double);
-        return idbKey.release();
+        return adoptRef(new IDBKey(NumberType, number));
     }
 
     static PassRefPtr<IDBKey> createString(const String& string)
     {
-        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
-        idbKey->m_type = StringType;
-        idbKey->m_string = string;
-        idbKey->m_sizeEstimate += string.length() * sizeof(UChar);
-        return idbKey.release();
+        return adoptRef(new IDBKey(string));
     }
 
     static PassRefPtr<IDBKey> createDate(double date)
     {
-        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
-        idbKey->m_type = DateType;
-        idbKey->m_date = date;
-        idbKey->m_sizeEstimate += sizeof(double);
-        return idbKey.release();
+        return adoptRef(new IDBKey(DateType, date));
     }
 
     static PassRefPtr<IDBKey> createMultiEntryArray(const KeyArray& array)
     {
-        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
-        idbKey->m_type = ArrayType;
-        KeyArray& result = idbKey->m_array;
+        KeyArray result;
 
+        size_t sizeEstimate = 0;
         for (size_t i = 0; i < array.size(); i++) {
             if (!array[i]->isValid())
                 continue;
@@ -92,23 +77,21 @@ public:
             }
             if (!skip) {
                 result.append(array[i]);
-                idbKey->m_sizeEstimate += array[i]->m_sizeEstimate;
+                sizeEstimate += array[i]->m_sizeEstimate;
             }
         }
+        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey(result, sizeEstimate));
         ASSERT(idbKey->isValid());
         return idbKey.release();
     }
 
     static PassRefPtr<IDBKey> createArray(const KeyArray& array)
     {
-        RefPtr<IDBKey> idbKey = adoptRef(new IDBKey());
-        idbKey->m_type = ArrayType;
-        idbKey->m_array = array;
-
+        size_t sizeEstimate = 0;
         for (size_t i = 0; i < array.size(); ++i)
-            idbKey->m_sizeEstimate += array[i]->m_sizeEstimate;
+            sizeEstimate += array[i]->m_sizeEstimate;
 
-        return idbKey.release();
+        return adoptRef(new IDBKey(array, sizeEstimate));
     }
 
     ~IDBKey();
@@ -141,7 +124,7 @@ public:
     double date() const
     {
         ASSERT(m_type == DateType);
-        return m_date;
+        return m_number;
     }
 
     double number() const
@@ -165,15 +148,17 @@ public:
     using ThreadSafeRefCounted<IDBKey>::deref;
 
 private:
-    IDBKey();
+    IDBKey() : m_type(InvalidType), m_number(0), m_sizeEstimate(kOverheadSize) { }
+    IDBKey(Type type, double number) : m_type(type), m_number(number), m_sizeEstimate(kOverheadSize + sizeof(double)) { }
+    explicit IDBKey(const String& value) : m_type(StringType), m_string(value), m_number(0), m_sizeEstimate(kOverheadSize + value.length() * sizeof(UChar)) { }
+    IDBKey(const KeyArray& keyArray, size_t arraySize) : m_type(ArrayType), m_array(keyArray), m_number(0), m_sizeEstimate(kOverheadSize + arraySize) { }
 
-    Type m_type;
-    KeyArray m_array;
-    String m_string;
-    double m_date;
-    double m_number;
+    const Type m_type;
+    const KeyArray m_array;
+    const String m_string;
+    const double m_number;
 
-    size_t m_sizeEstimate;
+    const size_t m_sizeEstimate;
 
     // Very rough estimate of minimum key size overhead.
     enum { kOverheadSize = 16 };
diff --git a/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
index 47a70ae81..0c35d20d6 100644
--- a/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
@@ -207,6 +207,8 @@ bool IDBKeyPath::isValid() const
         return IDBIsValidKeyPath(m_string);
 
     case ArrayType:
+        if (m_array.isEmpty())
+            return false;
         for (size_t i = 0; i < m_array.size(); ++i) {
             if (!IDBIsValidKeyPath(m_array[i]))
                 return false;
diff --git a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
index c44a4c9de..ab8293f0f 100644
--- a/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
@@ -298,11 +298,7 @@ static bool deleteRange(LevelDBTransaction* transaction, const Vector<char>& beg
 
 bool IDBLevelDBBackingStore::deleteDatabase(const String& name)
 {
-    if (m_currentTransaction)
-        return false;
-
-    RefPtr<IDBLevelDBBackingStore::Transaction> transaction = IDBLevelDBBackingStore::Transaction::create(this);
-    transaction->begin();
+    RefPtr<LevelDBTransaction> transaction = LevelDBTransaction::create(m_db.get());
 
     int64_t databaseId;
     String version;
@@ -313,13 +309,13 @@ bool IDBLevelDBBackingStore::deleteDatabase(const String& name)
 
     const Vector<char> startKey = DatabaseMetaDataKey::encode(databaseId, DatabaseMetaDataKey::kOriginName);
     const Vector<char> stopKey = DatabaseMetaDataKey::encode(databaseId + 1, DatabaseMetaDataKey::kOriginName);
-    if (!deleteRange(m_currentTransaction.get(), startKey, stopKey)) {
+    if (!deleteRange(transaction.get(), startKey, stopKey)) {
         transaction->rollback();
         return false;
     }
 
     const Vector<char> key = DatabaseNameKey::encode(m_identifier, name);
-    m_currentTransaction->remove(key);
+    transaction->remove(key);
 
     return transaction->commit();
 }
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
index 6c0641592..65f222bf8 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
@@ -375,12 +375,12 @@ PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* contex
         ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
         return 0;
     }
-    unsigned short direction = IDBCursor::stringToDirection(directionString, ec);
+    IDBCursor::Direction direction = IDBCursor::stringToDirection(directionString, ec);
     if (ec)
         return 0;
 
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    request->setCursorType(IDBCursorBackendInterface::ObjectStoreCursor);
+    request->setCursorDetails(IDBCursorBackendInterface::ObjectStoreCursor, direction);
     m_backend->openCursor(range, direction, request, m_transaction->backend(), ec);
     if (ec) {
         request->markEarlyDeath();
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
index 2b58e03f1..673e24c90 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
@@ -38,28 +38,28 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest add(in SerializedScriptValue value, in [Optional] IDBKey key)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext, ImplementedAs=deleteFunction] IDBRequest delete(in IDBKeyRange keyRange)
+        [CallWith=ScriptExecutionContext, ImplementedAs=deleteFunction] IDBRequest delete(in IDBKeyRange? keyRange)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext, ImplementedAs=deleteFunction] IDBRequest delete(in IDBKey key)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest clear()
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKeyRange key)
+        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKeyRange? key)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] DOMString direction)
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange? range, in [Optional] DOMString direction)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest openCursor(in IDBKey key, in [Optional] DOMString direction)
             raises (IDBDatabaseException);
 
         // FIXME: remove these when https://bugs.webkit.org/show_bug.cgi?id=85326 is fixed.
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange? range, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest openCursor(in IDBKey key, in [Optional] unsigned short direction)
             raises (IDBDatabaseException);
 
-        IDBIndex createIndex(in DOMString name, in DOMString[] keyPath, in [Optional] Dictionary options)
+        IDBIndex createIndex(in DOMString name, in DOMString[]? keyPath, in [Optional] Dictionary options)
             raises (IDBDatabaseException);
         IDBIndex createIndex(in DOMString name, in DOMString keyPath, in [Optional] Dictionary options)
             raises (IDBDatabaseException);
@@ -67,7 +67,7 @@ module storage {
             raises (IDBDatabaseException);
         void deleteIndex(in DOMString name)
             raises (IDBDatabaseException);
-        [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange range)
+        [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange? range)
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest count(in IDBKey key)
             raises (IDBDatabaseException);
diff --git a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
index af30ef371..474cdeb5b 100644
--- a/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
@@ -112,6 +112,11 @@ void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<
         return;
     }
 
+    if (objectStore->autoIncrement() && !objectStore->keyPath().isNull()) {
+        callbacks->onSuccess(SerializedScriptValue::createFromWire(wireData),
+                             key, objectStore->keyPath());
+        return;
+    }
     callbacks->onSuccess(SerializedScriptValue::createFromWire(wireData));
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp
index 2c5ac5a2b..553af3f21 100644
--- a/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 #include "IDBPendingTransactionMonitor.h"
-#include "IDBTransactionBackendInterface.h"
+#include "IDBTransaction.h"
 #include <wtf/ThreadSpecific.h>
 
 using WTF::ThreadSpecific;
@@ -34,36 +34,29 @@ using WTF::ThreadSpecific;
 
 namespace WebCore {
 
-static ThreadSpecific<Vector<IDBTransactionBackendInterface*> >& transactions()
+typedef Vector<RefPtr<IDBTransaction> > TransactionList;
+static ThreadSpecific<TransactionList>& transactions()
 {
     // FIXME: Move the Vector to ScriptExecutionContext to avoid dealing with
     // thread-local storage.
-    AtomicallyInitializedStatic(ThreadSpecific<Vector<IDBTransactionBackendInterface*> >*, transactions = new ThreadSpecific<Vector<IDBTransactionBackendInterface*> >);
+    AtomicallyInitializedStatic(ThreadSpecific<TransactionList>*, transactions = new ThreadSpecific<TransactionList>);
     return *transactions;
 }
 
-void IDBPendingTransactionMonitor::addPendingTransaction(IDBTransactionBackendInterface* transaction)
+void IDBPendingTransactionMonitor::addNewTransaction(PassRefPtr<IDBTransaction> transaction)
 {
     transactions()->append(transaction);
 }
 
-void IDBPendingTransactionMonitor::removePendingTransaction(IDBTransactionBackendInterface* transaction)
+void IDBPendingTransactionMonitor::deactivateNewTransactions()
 {
-    ThreadSpecific<Vector<IDBTransactionBackendInterface*> >& transactionList = transactions();
-    size_t pos = transactionList->find(transaction);
-    if (pos == notFound)
-        return;
-
-    transactionList->remove(pos);
-}
-
-void IDBPendingTransactionMonitor::abortPendingTransactions()
-{
-    ThreadSpecific<Vector<IDBTransactionBackendInterface*> >& transactionList = transactions();
-    for (size_t i = 0; i < transactions()->size(); ++i)
-        transactionList->at(i)->abort();
+    ThreadSpecific<TransactionList>& list = transactions();
+    for (size_t i = 0; i < list->size(); ++i) {
+        RefPtr<IDBTransaction> transaction = list->at(i);
+        transaction->setActive(false);
+    }
     // FIXME: Exercise this call to clear() in a layout test.
-    transactionList->clear();
+    list->clear();
 }
 
 };
diff --git a/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h
index 128b55133..fef55fe3c 100644
--- a/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h
+++ b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h
@@ -33,20 +33,18 @@
 
 namespace WebCore {
 
-class IDBTransactionBackendInterface;
+class IDBTransaction;
 
 // This class keeps track of the transactions created during the current
-// Javascript execution context. A transaction is 'pending' if no asynchronous
-// operation is currently queued for it (e.g. an IDBObjectStore::put() or similar).
-// All pending transactions are aborted as soon as execution returns from
-// the script engine.
+// Javascript execution context. Transactions have an internal |active| flag
+// which is set to true on creation, but must be set to false when control
+// returns to the event loop.
 
 class IDBPendingTransactionMonitor {
     WTF_MAKE_NONCOPYABLE(IDBPendingTransactionMonitor);
 public:
-    static void addPendingTransaction(IDBTransactionBackendInterface*);
-    static void removePendingTransaction(IDBTransactionBackendInterface*);
-    static void abortPendingTransactions();
+    static void addNewTransaction(PassRefPtr<IDBTransaction>);
+    static void deactivateNewTransactions();
 
 private:
     IDBPendingTransactionMonitor();
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
index 766215bb9..62d292340 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
@@ -35,10 +35,10 @@
 #include "EventListener.h"
 #include "EventNames.h"
 #include "EventQueue.h"
+#include "IDBBindingUtilities.h"
 #include "IDBCursorWithValue.h"
 #include "IDBDatabase.h"
 #include "IDBEventDispatcher.h"
-#include "IDBPendingTransactionMonitor.h"
 #include "IDBTracing.h"
 #include "IDBTransaction.h"
 
@@ -57,23 +57,22 @@ IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> sourc
     , m_source(source)
     , m_transaction(transaction)
     , m_readyState(PENDING)
+    , m_requestAborted(false)
     , m_requestFinished(false)
     , m_cursorFinished(false)
     , m_contextStopped(false)
     , m_cursorType(IDBCursorBackendInterface::InvalidCursorType)
+    , m_cursorDirection(IDBCursor::NEXT)
     , m_cursor(0)
 {
     if (m_transaction) {
         m_transaction->registerRequest(this);
-        IDBPendingTransactionMonitor::removePendingTransaction(m_transaction->backend());
     }
 }
 
 IDBRequest::~IDBRequest()
 {
     ASSERT(m_readyState == DONE || m_readyState == EarlyDeath || !scriptExecutionContext());
-    if (m_transaction)
-        m_transaction->unregisterRequest(this);
 }
 
 PassRefPtr<IDBAny> IDBRequest::result(ExceptionCode& ec) const
@@ -138,6 +137,8 @@ void IDBRequest::markEarlyDeath()
 {
     ASSERT(m_readyState == PENDING);
     m_readyState = EarlyDeath;
+    if (m_transaction)
+        m_transaction->unregisterRequest(this);
 }
 
 bool IDBRequest::resetReadyState(IDBTransaction* transaction)
@@ -153,8 +154,8 @@ bool IDBRequest::resetReadyState(IDBTransaction* transaction)
     m_errorCode = 0;
     m_error.clear();
     m_errorMessage = String();
-
-    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction->backend());
+    ASSERT(m_transaction);
+    m_transaction->registerRequest(this);
 
     return true;
 }
@@ -166,6 +167,7 @@ IDBAny* IDBRequest::source()
 
 void IDBRequest::abort()
 {
+    ASSERT(!m_requestAborted);
     if (m_contextStopped || !scriptExecutionContext())
         return;
 
@@ -186,12 +188,14 @@ void IDBRequest::abort()
     m_errorMessage = String();
     m_result.clear();
     onError(IDBDatabaseError::create(IDBDatabaseException::IDB_ABORT_ERR, "The transaction was aborted, so the request cannot be fulfilled."));
+    m_requestAborted = true;
 }
 
-void IDBRequest::setCursorType(IDBCursorBackendInterface::CursorType cursorType)
+void IDBRequest::setCursorDetails(IDBCursorBackendInterface::CursorType cursorType, IDBCursor::Direction direction)
 {
     ASSERT(m_cursorType == IDBCursorBackendInterface::InvalidCursorType);
     m_cursorType = cursorType;
+    m_cursorDirection = direction;
 }
 
 void IDBRequest::setCursor(PassRefPtr<IDBCursor> cursor)
@@ -209,6 +213,8 @@ void IDBRequest::finishCursor()
 
 void IDBRequest::onError(PassRefPtr<IDBDatabaseError> error)
 {
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
     m_errorCode = error->code();
     ASSERT(!m_error);
@@ -226,6 +232,8 @@ static PassRefPtr<Event> createSuccessEvent()
 void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 {
     IDB_TRACE("IDBRequest::onSuccess(DOMStringList)");
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     m_result = IDBAny::create(domStringList);
     enqueueEvent(createSuccessEvent());
@@ -234,13 +242,15 @@ void IDBRequest::onSuccess(PassRefPtr<DOMStringList> domStringList)
 void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBCursor)");
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     ASSERT(m_cursorType != IDBCursorBackendInterface::InvalidCursorType);
     RefPtr<IDBCursor> cursor;
     if (m_cursorType == IDBCursorBackendInterface::IndexKeyCursor)
-        cursor = IDBCursor::create(backend, this, m_source.get(), m_transaction.get());
+        cursor = IDBCursor::create(backend, m_cursorDirection, this, m_source.get(), m_transaction.get());
     else
-        cursor = IDBCursorWithValue::create(backend, this, m_source.get(), m_transaction.get());
+        cursor = IDBCursorWithValue::create(backend, m_cursorDirection, this, m_source.get(), m_transaction.get());
     setResultCursor(cursor, m_cursorType);
 
     enqueueEvent(createSuccessEvent());
@@ -249,6 +259,8 @@ void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBDatabase)");
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     if (m_contextStopped || !scriptExecutionContext())
         return;
@@ -263,6 +275,8 @@ void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBKey)");
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     if (idbKey && idbKey->isValid())
         m_result = IDBAny::create(idbKey);
@@ -274,6 +288,8 @@ void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend)
 {
     IDB_TRACE("IDBRequest::onSuccess(IDBTransaction)");
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     RefPtr<IDBTransactionBackendInterface> backend = prpBackend;
 
@@ -289,8 +305,6 @@ void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend
     ASSERT(m_source->type() == IDBAny::IDBDatabaseType);
     ASSERT(m_transaction->isVersionChange());
 
-    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction->backend());
-
     m_result = IDBAny::create(frontend.release());
     enqueueEvent(createSuccessEvent());
 }
@@ -298,15 +312,36 @@ void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend
 void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
     IDB_TRACE("IDBRequest::onSuccess(SerializedScriptValue)");
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     m_result = IDBAny::create(serializedScriptValue);
     m_cursor.clear();
     enqueueEvent(createSuccessEvent());
 }
 
+
+void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> prpSerializedScriptValue, PassRefPtr<IDBKey> prpPrimaryKey, const IDBKeyPath& keyPath)
+{
+    LOG_ERROR("CHECKING: onSuccess(value, key, keypath)");
+    if (m_requestAborted)
+        return;
+    RefPtr<SerializedScriptValue> serializedScriptValue = prpSerializedScriptValue;
+#ifndef NDEBUG
+    // FIXME: Assert until we can actually inject the right value.
+    RefPtr<IDBKey> primaryKey = prpPrimaryKey;
+    RefPtr<IDBKey> expectedKey =
+              createIDBKeyFromSerializedValueAndKeyPath(serializedScriptValue, keyPath);
+    ASSERT(expectedKey->isEqual(primaryKey.get()));
+#endif
+    onSuccess(serializedScriptValue.release());
+}
+
 void IDBRequest::onSuccessWithContinuation()
 {
     IDB_TRACE("IDBRequest::onSuccessWithContinuation");
+    if (m_requestAborted)
+        return;
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_error && !m_result);
     ASSERT(m_cursor);
     setResultCursor(m_cursor, m_cursorType);
@@ -388,7 +423,13 @@ bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
 
     // FIXME: When we allow custom event dispatching, this will probably need to change.
     ASSERT(event->type() == eventNames().successEvent || event->type() == eventNames().errorEvent || event->type() == eventNames().blockedEvent);
+    const bool setTransactionActive = m_transaction && (event->type() == eventNames().successEvent || (event->type() == eventNames().errorEvent && m_errorCode != IDBDatabaseException::IDB_ABORT_ERR));
+
+    if (setTransactionActive)
+        m_transaction->setActive(true);
     bool dontPreventDefault = IDBEventDispatcher::dispatch(event.get(), targets);
+    if (setTransactionActive)
+        m_transaction->setActive(false);
 
     // If the result was of type IDBCursor, or a onBlocked event, then we'll fire again.
     if (event->type() != eventNames().blockedEvent && (!cursorToNotify || m_cursorFinished))
@@ -401,10 +442,14 @@ bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
         // If an error event and the default wasn't prevented...
         if (dontPreventDefault && event->type() == eventNames().errorEvent) {
             m_transaction->setError(m_error);
-            m_transaction->backend()->abort();
+            m_transaction->abort();
         }
         m_transaction->backend()->didCompleteTaskEvents();
     }
+
+    if (m_transaction && m_readyState == DONE)
+        m_transaction->unregisterRequest(this);
+
     return dontPreventDefault;
 }
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBRequest.h b/Source/WebCore/Modules/indexeddb/IDBRequest.h
index e104d8f1e..06ca9db9a 100644
--- a/Source/WebCore/Modules/indexeddb/IDBRequest.h
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.h
@@ -40,6 +40,7 @@
 #include "EventTarget.h"
 #include "IDBAny.h"
 #include "IDBCallbacks.h"
+#include "IDBCursor.h"
 
 namespace WebCore {
 
@@ -73,7 +74,7 @@ public:
 
     void markEarlyDeath();
     bool resetReadyState(IDBTransaction*);
-    void setCursorType(IDBCursorBackendInterface::CursorType);
+    void setCursorDetails(IDBCursorBackendInterface::CursorType, IDBCursor::Direction);
     void setCursor(PassRefPtr<IDBCursor>);
     void finishCursor();
     IDBAny* source();
@@ -87,6 +88,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, const IDBKeyPath&);
     virtual void onSuccessWithContinuation();
     virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<SerializedScriptValue> >&) { ASSERT_NOT_REACHED(); } // Not implemented. Callback should not reach the renderer side.
     virtual void onBlocked();
@@ -126,6 +128,7 @@ private:
     RefPtr<IDBTransaction> m_transaction;
 
     ReadyState m_readyState;
+    bool m_requestAborted; // May be aborted by transaction then receive async onsuccess; ignore vs. assert.
     bool m_requestFinished; // Is it possible that we'll fire any more events? If not, we're finished.
     bool m_cursorFinished;
     bool m_contextStopped;
@@ -133,6 +136,7 @@ private:
 
     // Only used if the result type will be a cursor.
     IDBCursorBackendInterface::CursorType m_cursorType;
+    IDBCursor::Direction m_cursorDirection;
     RefPtr<IDBCursor> m_cursor;
 
     EventTargetData m_eventTargetData;
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
index 6ad300723..c09aa0ece 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
@@ -85,19 +85,28 @@ IDBTransaction::IDBTransaction(ScriptExecutionContext* context, PassRefPtr<IDBTr
     , m_database(db)
     , m_mode(mode)
     , m_active(true)
-    , m_transactionFinished(false)
+    , m_state(Unused)
     , m_contextStopped(false)
 {
     ASSERT(m_backend);
-    ASSERT(m_mode == m_backend->mode());
-    IDBPendingTransactionMonitor::addPendingTransaction(m_backend.get());
+
+    if (mode == VERSION_CHANGE) {
+        // Not active until the callback.
+        m_active = false;
+        // Implicitly used by the version change itself.
+        m_state = Used;
+    }
+
     // We pass a reference of this object before it can be adopted.
     relaxAdoptionRequirement();
+    if (m_active)
+        IDBPendingTransactionMonitor::addNewTransaction(this);
     m_database->transactionCreated(this);
 }
 
 IDBTransaction::~IDBTransaction()
 {
+    ASSERT(m_state == Finished);
 }
 
 IDBTransactionBackendInterface* IDBTransaction::backend() const
@@ -105,11 +114,6 @@ IDBTransactionBackendInterface* IDBTransaction::backend() const
     return m_backend.get();
 }
 
-bool IDBTransaction::isFinished() const
-{
-    return m_transactionFinished;
-}
-
 const String& IDBTransaction::mode() const
 {
     ExceptionCode ec = 0;
@@ -125,7 +129,7 @@ IDBDatabase* IDBTransaction::db() const
 
 PassRefPtr<DOMError> IDBTransaction::error(ExceptionCode& ec) const
 {
-    if (!m_transactionFinished) {
+    if (m_state != Finished) {
         ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
         return 0;
     }
@@ -134,7 +138,7 @@ PassRefPtr<DOMError> IDBTransaction::error(ExceptionCode& ec) const
 
 void IDBTransaction::setError(PassRefPtr<DOMError> error)
 {
-    ASSERT(!m_transactionFinished);
+    ASSERT(m_state != Finished);
     ASSERT(error);
 
     // The first error to be set is the true cause of the
@@ -145,7 +149,7 @@ void IDBTransaction::setError(PassRefPtr<DOMError> error)
 
 PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, ExceptionCode& ec)
 {
-    if (m_transactionFinished) {
+    if (m_state == Finished) {
         ec = IDBDatabaseException::IDB_INVALID_STATE_ERR;
         return 0;
     }
@@ -170,7 +174,7 @@ PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, Excep
 
 void IDBTransaction::objectStoreCreated(const String& name, PassRefPtr<IDBObjectStore> prpObjectStore)
 {
-    ASSERT(!m_transactionFinished);
+    ASSERT(m_state != Finished);
     RefPtr<IDBObjectStore> objectStore = prpObjectStore;
     m_objectStoreMap.set(name, objectStore);
     if (isVersionChange())
@@ -179,7 +183,7 @@ void IDBTransaction::objectStoreCreated(const String& name, PassRefPtr<IDBObject
 
 void IDBTransaction::objectStoreDeleted(const String& name)
 {
-    ASSERT(!m_transactionFinished);
+    ASSERT(m_state != Finished);
     ASSERT(isVersionChange());
     IDBObjectStoreMap::iterator it = m_objectStoreMap.find(name);
     if (it != m_objectStoreMap.end()) {
@@ -190,11 +194,32 @@ void IDBTransaction::objectStoreDeleted(const String& name)
     }
 }
 
+void IDBTransaction::setActive(bool active)
+{
+    ASSERT(m_state != Finished);
+    if (m_state == Finishing)
+        return;
+    ASSERT(m_state == Unused || m_state == Used);
+    ASSERT(active != m_active);
+    m_active = active;
+
+    if (!active && m_state == Unused)
+        m_backend->commit();
+}
+
 void IDBTransaction::abort()
 {
-    if (m_transactionFinished)
+    if (m_state == Finishing || m_state == Finished)
         return;
+    m_state = Finishing;
     m_active = false;
+
+    while (!m_requestList.isEmpty()) {
+        IDBRequest* request = *m_requestList.begin();
+        m_requestList.remove(request);
+        request->abort();
+    }
+
     RefPtr<IDBTransaction> selfRef = this;
     if (m_backend)
         m_backend->abort();
@@ -232,23 +257,33 @@ void IDBTransaction::closeOpenCursors()
 
 void IDBTransaction::registerRequest(IDBRequest* request)
 {
-    m_childRequests.add(request);
+    ASSERT(request);
+    ASSERT(m_state == Unused || m_state == Used);
+    ASSERT(m_active);
+    m_requestList.add(request);
+    m_state = Used;
 }
 
 void IDBTransaction::unregisterRequest(IDBRequest* request)
 {
+    ASSERT(request);
     // If we aborted the request, it will already have been removed.
-    m_childRequests.remove(request);
+    m_requestList.remove(request);
 }
 
 void IDBTransaction::onAbort()
 {
-    ASSERT(!m_transactionFinished);
-    m_active = false;
-    while (!m_childRequests.isEmpty()) {
-        IDBRequest* request = *m_childRequests.begin();
-        m_childRequests.remove(request);
-        request->abort();
+    ASSERT(m_state != Finished);
+
+    if (m_state != Finishing) {
+        // Abort was not triggered by front-end, so outstanding requests must
+        // be aborted now.
+        while (!m_requestList.isEmpty()) {
+            IDBRequest* request = *m_requestList.begin();
+            m_requestList.remove(request);
+            request->abort();
+        }
+        m_state = Finishing;
     }
 
     if (isVersionChange()) {
@@ -267,8 +302,8 @@ void IDBTransaction::onAbort()
 
 void IDBTransaction::onComplete()
 {
-    ASSERT(!m_transactionFinished);
-    m_active = false;
+    ASSERT(m_state != Finished);
+    m_state = Finishing;
     m_objectStoreCleanupMap.clear();
     closeOpenCursors();
     m_database->transactionFinished(this);
@@ -284,7 +319,7 @@ bool IDBTransaction::hasPendingActivity() const
     // FIXME: In an ideal world, we should return true as long as anyone has a or can
     //        get a handle to us or any child request object and any of those have
     //        event listeners. This is  in order to handle user generated events properly.
-    return !m_transactionFinished || ActiveDOMObject::hasPendingActivity();
+    return m_state != Finished || ActiveDOMObject::hasPendingActivity();
 }
 
 IDBTransaction::Mode IDBTransaction::stringToMode(const String& modeString, ExceptionCode& ec)
@@ -332,10 +367,10 @@ ScriptExecutionContext* IDBTransaction::scriptExecutionContext() const
 bool IDBTransaction::dispatchEvent(PassRefPtr<Event> event)
 {
     IDB_TRACE("IDBTransaction::dispatchEvent");
-    ASSERT(!m_transactionFinished);
+    ASSERT(m_state != Finished);
     ASSERT(scriptExecutionContext());
     ASSERT(event->target() == this);
-    m_transactionFinished = true;
+    m_state = Finished;
 
     // Break reference cycles.
     for (IDBObjectStoreMap::iterator it = m_objectStoreMap.begin(); it != m_objectStoreMap.end(); ++it)
@@ -355,7 +390,7 @@ bool IDBTransaction::canSuspend() const
 {
     // FIXME: Technically we can suspend before the first request is schedule
     //        and after the complete/abort event is enqueued.
-    return m_transactionFinished;
+    return m_state == Finished;
 }
 
 void IDBTransaction::stop()
@@ -368,7 +403,7 @@ void IDBTransaction::stop()
 
 void IDBTransaction::enqueueEvent(PassRefPtr<Event> event)
 {
-    ASSERT_WITH_MESSAGE(!m_transactionFinished, "A finished transaction tried to enqueue an event of type %s.", event->type().string().utf8().data());
+    ASSERT_WITH_MESSAGE(m_state != Finished, "A finished transaction tried to enqueue an event of type %s.", event->type().string().utf8().data());
     if (m_contextStopped || !scriptExecutionContext())
         return;
 
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransaction.h b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
index 2ce82b1cf..e5fba7cbe 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransaction.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
@@ -69,7 +69,7 @@ public:
 
     IDBTransactionBackendInterface* backend() const;
     bool isActive() const { return m_active; }
-    bool isFinished() const;
+    bool isFinished() const { return m_state == Finished; }
     bool isReadOnly() const { return m_mode == READ_ONLY; }
     bool isVersionChange() const { return m_mode == VERSION_CHANGE; }
 
@@ -95,6 +95,7 @@ public:
     void unregisterRequest(IDBRequest*);
     void objectStoreCreated(const String&, PassRefPtr<IDBObjectStore>);
     void objectStoreDeleted(const String&);
+    void setActive(bool);
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(complete);
@@ -133,15 +134,22 @@ private:
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
+    enum State {
+        Unused, // No requests have been made.
+        Used, // At least one request has been made.
+        Finishing, // In the process of aborting or completing.
+        Finished, // No more events will fire and no new requests may be filed.
+    };
+
     RefPtr<IDBTransactionBackendInterface> m_backend;
     RefPtr<IDBDatabase> m_database;
     const Mode m_mode;
     bool m_active;
-    bool m_transactionFinished; // Is it possible that we'll fire any more events or allow any new requests? If not, we're finished.
+    State m_state;
     bool m_contextStopped;
     RefPtr<DOMError> m_error;
 
-    ListHashSet<IDBRequest*> m_childRequests;
+    ListHashSet<IDBRequest*> m_requestList;
 
     typedef HashMap<String, RefPtr<IDBObjectStore> > IDBObjectStoreMap;
     IDBObjectStoreMap m_objectStoreMap;
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
index 6dff2b050..94d30dc93 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
@@ -201,12 +201,13 @@ void IDBTransactionBackendImpl::commit()
     // commit steps below. We therefore take a self reference to keep ourselves
     // alive while executing this method.
     RefPtr<IDBTransactionBackendImpl> self(this);
-    ASSERT(m_state == Running);
+    ASSERT(m_state == Unused || m_state == Running);
     ASSERT(m_taskQueue.isEmpty());
 
+    bool unused = m_state == Unused;
     m_state = Finished;
 
-    bool committed = m_transaction->commit();
+    bool committed = unused || m_transaction->commit();
 
     // Backing store resources (held via cursors) must be released before script callbacks
     // are fired, as the script callbacks may release references and allow the backing store
@@ -216,7 +217,8 @@ void IDBTransactionBackendImpl::commit()
 
     // Transactions must also be marked as completed before the front-end is notified, as
     // the transaction completion unblocks operations like closing connections.
-    m_database->transactionCoordinator()->didFinishTransaction(this);
+    if (!unused)
+        m_database->transactionCoordinator()->didFinishTransaction(this);
     m_database->transactionFinished(this);
 
     if (committed)
diff --git a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
index 003dbfdcc..d8f48ab50 100644
--- a/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
@@ -53,6 +53,7 @@ public:
     virtual unsigned short mode() const = 0;
     virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task> task, PassOwnPtr<ScriptExecutionContext::Task> abortTask = nullptr) = 0;
     virtual void didCompleteTaskEvents() = 0;
+    virtual void commit() = 0;
     virtual void abort() = 0;
     virtual void setCallbacks(IDBTransactionCallbacks*) = 0;
     virtual void registerOpenCursor(IDBCursorBackendImpl*) = 0;
diff --git a/Source/WebCore/Modules/mediastream/MediaStream.cpp b/Source/WebCore/Modules/mediastream/MediaStream.cpp
index 8a3f585cb..e4efc49b7 100644
--- a/Source/WebCore/Modules/mediastream/MediaStream.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStream.cpp
@@ -95,19 +95,21 @@ MediaStream::MediaStream(ScriptExecutionContext* context, PassRefPtr<MediaStream
     audioTrackVector.reserveCapacity(numberOfAudioTracks);
     for (size_t i = 0; i < numberOfAudioTracks; i++)
         audioTrackVector.append(MediaStreamTrack::create(m_descriptor, m_descriptor->audioComponent(i)));
-    m_audioTracks = MediaStreamTrackList::create(audioTrackVector);
+    m_audioTracks = MediaStreamTrackList::create(this, audioTrackVector);
 
     MediaStreamTrackVector videoTrackVector;
     size_t numberOfVideoTracks = m_descriptor->numberOfVideoComponents();
     videoTrackVector.reserveCapacity(numberOfVideoTracks);
     for (size_t i = 0; i < numberOfVideoTracks; i++)
         videoTrackVector.append(MediaStreamTrack::create(m_descriptor, m_descriptor->videoComponent(i)));
-    m_videoTracks = MediaStreamTrackList::create(videoTrackVector);
+    m_videoTracks = MediaStreamTrackList::create(this, videoTrackVector);
 }
 
 MediaStream::~MediaStream()
 {
     m_descriptor->setOwner(0);
+    m_audioTracks->detachOwner();
+    m_videoTracks->detachOwner();
 }
 
 MediaStream::ReadyState MediaStream::readyState() const
@@ -121,6 +123,8 @@ void MediaStream::streamEnded()
         return;
 
     m_descriptor->setEnded();
+    m_audioTracks->detachOwner();
+    m_videoTracks->detachOwner();
 
     dispatchEvent(Event::create(eventNames().endedEvent, false, false));
 }
@@ -145,6 +149,33 @@ EventTargetData* MediaStream::ensureEventTargetData()
     return &m_eventTargetData;
 }
 
+void MediaStream::addTrack(MediaStreamComponent* component)
+{
+    RefPtr<MediaStreamTrack> track = MediaStreamTrack::create(m_descriptor, component);
+    ExceptionCode ec = 0;
+    switch (component->source()->type()) {
+    case MediaStreamSource::TypeAudio:
+        m_audioTracks->add(track, ec);
+        break;
+    case MediaStreamSource::TypeVideo:
+        m_videoTracks->add(track, ec);
+        break;
+    }
+    ASSERT(!ec);
+}
+
+void MediaStream::removeTrack(MediaStreamComponent* component)
+{
+    switch (component->source()->type()) {
+    case MediaStreamSource::TypeAudio:
+        m_audioTracks->remove(component);
+        break;
+    case MediaStreamSource::TypeVideo:
+        m_videoTracks->remove(component);
+        break;
+    }
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/mediastream/MediaStream.h b/Source/WebCore/Modules/mediastream/MediaStream.h
index f6a98debd..bcdd25dc5 100644
--- a/Source/WebCore/Modules/mediastream/MediaStream.h
+++ b/Source/WebCore/Modules/mediastream/MediaStream.h
@@ -39,7 +39,6 @@ namespace WebCore {
 
 class MediaStream : public RefCounted<MediaStream>, public MediaStreamDescriptorOwner, public EventTarget, public ContextDestructionObserver {
 public:
-    // Must match the constants in the .idl file.
     enum ReadyState {
         LIVE = 1,
         ENDED = 2
@@ -57,7 +56,8 @@ public:
     MediaStreamTrackList* audioTracks() { return m_audioTracks.get(); }
     MediaStreamTrackList* videoTracks() { return m_videoTracks.get(); }
 
-    void streamEnded();
+    // MediaStreamDescriptorOwner
+    virtual void streamEnded() OVERRIDE;
 
     MediaStreamDescriptor* descriptor() const { return m_descriptor.get(); }
 
@@ -80,6 +80,10 @@ private:
     virtual void refEventTarget() OVERRIDE { ref(); }
     virtual void derefEventTarget() OVERRIDE { deref(); }
 
+    // MediaStreamDescriptorOwner
+    virtual void addTrack(MediaStreamComponent*) OVERRIDE;
+    virtual void removeTrack(MediaStreamComponent*) OVERRIDE;
+
     EventTargetData m_eventTargetData;
 
     RefPtr<MediaStreamTrackList> m_audioTracks;
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.cpp
new file mode 100644
index 000000000..f62100271
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(MEDIA_STREAM)
+
+#include "MediaStreamTrackEvent.h"
+
+#include "EventNames.h"
+#include "MediaStreamTrack.h"
+
+namespace WebCore {
+
+PassRefPtr<MediaStreamTrackEvent> MediaStreamTrackEvent::create()
+{
+    return adoptRef(new MediaStreamTrackEvent);
+}
+
+PassRefPtr<MediaStreamTrackEvent> MediaStreamTrackEvent::create(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<MediaStreamTrack> track)
+{
+    return adoptRef(new MediaStreamTrackEvent(type, canBubble, cancelable, track));
+}
+
+
+MediaStreamTrackEvent::MediaStreamTrackEvent()
+{
+}
+
+MediaStreamTrackEvent::MediaStreamTrackEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<MediaStreamTrack> track)
+    : Event(type, canBubble, cancelable)
+    , m_track(track)
+{
+}
+
+MediaStreamTrackEvent::~MediaStreamTrackEvent()
+{
+}
+
+MediaStreamTrack* MediaStreamTrackEvent::track() const
+{
+    return m_track.get();
+}
+
+const AtomicString& MediaStreamTrackEvent::interfaceName() const
+{
+    return eventNames().interfaceForMediaStreamTrackEvent;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.h b/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.h
new file mode 100644
index 000000000..6014913f8
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MediaStreamTrackEvent_h
+#define MediaStreamTrackEvent_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "Event.h"
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class MediaStreamTrack;
+
+class MediaStreamTrackEvent : public Event {
+public:
+    virtual ~MediaStreamTrackEvent();
+
+    static PassRefPtr<MediaStreamTrackEvent> create();
+    static PassRefPtr<MediaStreamTrackEvent> create(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<MediaStreamTrack>);
+
+    MediaStreamTrack* track() const;
+
+    // Event
+    virtual const AtomicString& interfaceName() const OVERRIDE;
+
+private:
+    MediaStreamTrackEvent();
+    MediaStreamTrackEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<MediaStreamTrack>);
+
+    RefPtr<MediaStreamTrack> m_track;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // MediaStreamTrackEvent_h
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.idl b/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.idl
new file mode 100644
index 000000000..320c6030e
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.idl
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module events {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+    ] MediaStreamTrackEvent : Event {
+       readonly attribute MediaStreamTrack track;
+    };
+
+}
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp
index b63bcef61..e987d010e 100644
--- a/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp
@@ -24,19 +24,29 @@
  */
 
 #include "config.h"
+#if ENABLE(MEDIA_STREAM)
+
 #include "MediaStreamTrackList.h"
 
-#if ENABLE(MEDIA_STREAM)
+#include "ExceptionCode.h"
+#include "MediaStream.h"
+#include "MediaStreamCenter.h"
+#include "MediaStreamTrackEvent.h"
 
 namespace WebCore {
 
-PassRefPtr<MediaStreamTrackList> MediaStreamTrackList::create(const MediaStreamTrackVector& trackVector)
+PassRefPtr<MediaStreamTrackList> MediaStreamTrackList::create(MediaStream* owner, const MediaStreamTrackVector& trackVector)
 {
-    return adoptRef(new MediaStreamTrackList(trackVector));
+    ASSERT(owner);
+    RefPtr<MediaStreamTrackList> trackList = adoptRef(new MediaStreamTrackList(owner, trackVector));
+    trackList->suspendIfNeeded();
+    return trackList.release();
 }
 
-MediaStreamTrackList::MediaStreamTrackList(const MediaStreamTrackVector& trackVector)
-    : m_trackVector(trackVector)
+MediaStreamTrackList::MediaStreamTrackList(MediaStream* owner, const MediaStreamTrackVector& trackVector)
+    : ActiveDOMObject(owner->scriptExecutionContext(), this)
+    , m_owner(owner)
+    , m_trackVector(trackVector)
 {
 }
 
@@ -44,6 +54,11 @@ MediaStreamTrackList::~MediaStreamTrackList()
 {
 }
 
+void MediaStreamTrackList::detachOwner()
+{
+    m_owner = 0;
+}
+
 unsigned MediaStreamTrackList::length() const
 {
     return m_trackVector.size();
@@ -56,6 +71,96 @@ MediaStreamTrack* MediaStreamTrackList::item(unsigned index) const
     return m_trackVector[index].get();
 }
 
+void MediaStreamTrackList::add(PassRefPtr<MediaStreamTrack> prpTrack, ExceptionCode& ec)
+{
+    if (!m_owner || m_owner->readyState() == MediaStream::ENDED) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    RefPtr<MediaStreamTrack> track = prpTrack;
+    if (!track) {
+        ec = TYPE_MISMATCH_ERR;
+        return;
+    }
+
+    if (m_trackVector.contains(track))
+        return;
+
+    m_trackVector.append(track);
+    MediaStreamCenter::instance().didAddMediaStreamTrack(m_owner->descriptor(), track->component());
+    dispatchEvent(MediaStreamTrackEvent::create(eventNames().addtrackEvent, false, false, track));
+}
+
+void MediaStreamTrackList::remove(PassRefPtr<MediaStreamTrack> prpTrack, ExceptionCode& ec)
+{
+    if (!m_owner || m_owner->readyState() == MediaStream::ENDED) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    RefPtr<MediaStreamTrack> track = prpTrack;
+    if (!track) {
+        ec = TYPE_MISMATCH_ERR;
+        return;
+    }
+
+    size_t index = m_trackVector.find(track);
+    if (index == notFound)
+        return;
+
+    m_trackVector.remove(index);
+    MediaStreamCenter::instance().didRemoveMediaStreamTrack(m_owner->descriptor(), track->component());
+    dispatchEvent(MediaStreamTrackEvent::create(eventNames().removetrackEvent, false, false, track));
+}
+
+void MediaStreamTrackList::remove(MediaStreamComponent* component)
+{
+    if (!m_owner || m_owner->readyState() == MediaStream::ENDED)
+        return;
+
+    size_t index = notFound;
+    for (unsigned i = 0; i < m_trackVector.size(); ++i) {
+        if (m_trackVector[i]->component() == component) {
+            index = i;
+            break;
+        }
+    }
+
+    if (index == notFound)
+        return;
+
+    RefPtr<MediaStreamTrack> track = m_trackVector[index];
+    m_trackVector.remove(index);
+    MediaStreamCenter::instance().didRemoveMediaStreamTrack(m_owner->descriptor(), component);
+    dispatchEvent(MediaStreamTrackEvent::create(eventNames().removetrackEvent, false, false, track));
+}
+
+void MediaStreamTrackList::stop()
+{
+    detachOwner();
+}
+
+const AtomicString& MediaStreamTrackList::interfaceName() const
+{
+    return eventNames().interfaceForMediaStreamTrackList;
+}
+
+ScriptExecutionContext* MediaStreamTrackList::scriptExecutionContext() const
+{
+    return ActiveDOMObject::scriptExecutionContext();
+}
+
+EventTargetData* MediaStreamTrackList::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* MediaStreamTrackList::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h
index 4d61f85e6..d5a37b61b 100644
--- a/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h
@@ -27,21 +27,53 @@
 
 #if ENABLE(MEDIA_STREAM)
 
+#include "ActiveDOMObject.h"
+#include "EventTarget.h"
 #include "MediaStreamTrack.h"
 
 namespace WebCore {
 
-class MediaStreamTrackList : public RefCounted<MediaStreamTrackList> {
+class MediaStreamTrackList : public RefCounted<MediaStreamTrackList>, public ActiveDOMObject, public EventTarget {
 public:
-    static PassRefPtr<MediaStreamTrackList> create(const MediaStreamTrackVector&);
+    static PassRefPtr<MediaStreamTrackList> create(MediaStream*, const MediaStreamTrackVector&);
     virtual ~MediaStreamTrackList();
 
+    void detachOwner();
+
     // DOM methods & attributes for MediaStreamTrackList
     unsigned length() const;
     MediaStreamTrack* item(unsigned index) const;
 
+    void add(PassRefPtr<MediaStreamTrack>, ExceptionCode&);
+    void remove(PassRefPtr<MediaStreamTrack>, ExceptionCode&);
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(addtrack);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(removetrack);
+
+    void remove(MediaStreamComponent*);
+
+    // ActiveDOMObject
+    virtual void stop() OVERRIDE;
+
+    // EventTarget
+    virtual const AtomicString& interfaceName() const OVERRIDE;
+    virtual ScriptExecutionContext* scriptExecutionContext() const OVERRIDE;
+
+    using RefCounted<MediaStreamTrackList>::ref;
+    using RefCounted<MediaStreamTrackList>::deref;
+
 private:
-    MediaStreamTrackList(const MediaStreamTrackVector&);
+    MediaStreamTrackList(MediaStream*, const MediaStreamTrackVector&);
+
+    // EventTarget
+    virtual EventTargetData* eventTargetData() OVERRIDE;
+    virtual EventTargetData* ensureEventTargetData() OVERRIDE;
+    virtual void refEventTarget() OVERRIDE { ref(); }
+    virtual void derefEventTarget() OVERRIDE { deref(); }
+    EventTargetData m_eventTargetData;
+
+    // m_owner can become zero.
+    MediaStream* m_owner;
 
     MediaStreamTrackVector m_trackVector;
 };
diff --git a/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl
index 4dd9c2972..957655d08 100644
--- a/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl
@@ -26,11 +26,29 @@ module core {
 
     interface [
         Conditional=MEDIA_STREAM,
-        IndexedGetter
+        IndexedGetter,
+        EventTarget
     ] MediaStreamTrackList {
+        readonly attribute unsigned long length;
         MediaStreamTrack item(in [IsIndex] unsigned long index);
 
-        readonly attribute unsigned long length;
+        void add(in MediaStreamTrack track)
+            raises(DOMException);
+        void remove(in MediaStreamTrack track)
+            raises(DOMException);
+
+        attribute EventListener onaddtrack;
+        attribute EventListener onremovetrack;
+
+        // EventTarget interface
+        void addEventListener(in DOMString type,
+                              in EventListener listener,
+                              in [Optional] boolean useCapture);
+        void removeEventListener(in DOMString type,
+                                 in EventListener listener,
+                                 in [Optional] boolean useCapture);
+        boolean dispatchEvent(in Event event)
+            raises(EventException);
     };
 
 }
diff --git a/Source/WebCore/Modules/networkinfo/NetworkInfoConnection.cpp b/Source/WebCore/Modules/networkinfo/NetworkInfoConnection.cpp
index 159fecc64..9a4231c0a 100644
--- a/Source/WebCore/Modules/networkinfo/NetworkInfoConnection.cpp
+++ b/Source/WebCore/Modules/networkinfo/NetworkInfoConnection.cpp
@@ -57,17 +57,11 @@ NetworkInfoConnection::~NetworkInfoConnection()
 
 double NetworkInfoConnection::bandwidth() const
 {
-    if (m_networkInfo)
-        return m_networkInfo->bandwidth();
-    
     return m_controller->client()->bandwidth();
 }
 
 bool NetworkInfoConnection::metered() const
 {
-    if (m_networkInfo)
-        return m_networkInfo->metered();
-    
     return m_controller->client()->metered();
 }
 
diff --git a/Source/WebCore/notifications/DOMWindowNotifications.cpp b/Source/WebCore/Modules/notifications/DOMWindowNotifications.cpp
index 40173ee75..40173ee75 100644
--- a/Source/WebCore/notifications/DOMWindowNotifications.cpp
+++ b/Source/WebCore/Modules/notifications/DOMWindowNotifications.cpp
diff --git a/Source/WebCore/notifications/DOMWindowNotifications.h b/Source/WebCore/Modules/notifications/DOMWindowNotifications.h
index 22e26dd60..22e26dd60 100644
--- a/Source/WebCore/notifications/DOMWindowNotifications.h
+++ b/Source/WebCore/Modules/notifications/DOMWindowNotifications.h
diff --git a/Source/WebCore/notifications/DOMWindowNotifications.idl b/Source/WebCore/Modules/notifications/DOMWindowNotifications.idl
index ea8a129c5..ea8a129c5 100644
--- a/Source/WebCore/notifications/DOMWindowNotifications.idl
+++ b/Source/WebCore/Modules/notifications/DOMWindowNotifications.idl
diff --git a/Source/WebCore/notifications/Notification.cpp b/Source/WebCore/Modules/notifications/Notification.cpp
index 348992aeb..348992aeb 100644
--- a/Source/WebCore/notifications/Notification.cpp
+++ b/Source/WebCore/Modules/notifications/Notification.cpp
diff --git a/Source/WebCore/notifications/Notification.h b/Source/WebCore/Modules/notifications/Notification.h
index 8de910073..8de910073 100644
--- a/Source/WebCore/notifications/Notification.h
+++ b/Source/WebCore/Modules/notifications/Notification.h
diff --git a/Source/WebCore/notifications/Notification.idl b/Source/WebCore/Modules/notifications/Notification.idl
index da2eb7f24..da2eb7f24 100644
--- a/Source/WebCore/notifications/Notification.idl
+++ b/Source/WebCore/Modules/notifications/Notification.idl
diff --git a/Source/WebCore/notifications/NotificationCenter.cpp b/Source/WebCore/Modules/notifications/NotificationCenter.cpp
index 0ebb54740..0ebb54740 100644
--- a/Source/WebCore/notifications/NotificationCenter.cpp
+++ b/Source/WebCore/Modules/notifications/NotificationCenter.cpp
diff --git a/Source/WebCore/notifications/NotificationCenter.h b/Source/WebCore/Modules/notifications/NotificationCenter.h
index 3f6d68902..3f6d68902 100644
--- a/Source/WebCore/notifications/NotificationCenter.h
+++ b/Source/WebCore/Modules/notifications/NotificationCenter.h
diff --git a/Source/WebCore/notifications/NotificationCenter.idl b/Source/WebCore/Modules/notifications/NotificationCenter.idl
index da99ba9ff..da99ba9ff 100644
--- a/Source/WebCore/notifications/NotificationCenter.idl
+++ b/Source/WebCore/Modules/notifications/NotificationCenter.idl
diff --git a/Source/WebCore/notifications/NotificationClient.h b/Source/WebCore/Modules/notifications/NotificationClient.h
index 9e92836e5..9e92836e5 100644
--- a/Source/WebCore/notifications/NotificationClient.h
+++ b/Source/WebCore/Modules/notifications/NotificationClient.h
diff --git a/Source/WebCore/notifications/NotificationController.cpp b/Source/WebCore/Modules/notifications/NotificationController.cpp
index 9bbd9bf3c..9bbd9bf3c 100644
--- a/Source/WebCore/notifications/NotificationController.cpp
+++ b/Source/WebCore/Modules/notifications/NotificationController.cpp
diff --git a/Source/WebCore/notifications/NotificationController.h b/Source/WebCore/Modules/notifications/NotificationController.h
index fd1968ed4..fd1968ed4 100644
--- a/Source/WebCore/notifications/NotificationController.h
+++ b/Source/WebCore/Modules/notifications/NotificationController.h
diff --git a/Source/WebCore/notifications/NotificationPermissionCallback.h b/Source/WebCore/Modules/notifications/NotificationPermissionCallback.h
index 84e732a7f..84e732a7f 100644
--- a/Source/WebCore/notifications/NotificationPermissionCallback.h
+++ b/Source/WebCore/Modules/notifications/NotificationPermissionCallback.h
diff --git a/Source/WebCore/notifications/NotificationPermissionCallback.idl b/Source/WebCore/Modules/notifications/NotificationPermissionCallback.idl
index 1f111612e..1f111612e 100644
--- a/Source/WebCore/notifications/NotificationPermissionCallback.idl
+++ b/Source/WebCore/Modules/notifications/NotificationPermissionCallback.idl
diff --git a/Source/WebCore/notifications/WorkerContextNotifications.cpp b/Source/WebCore/Modules/notifications/WorkerContextNotifications.cpp
index eeedb992c..eeedb992c 100644
--- a/Source/WebCore/notifications/WorkerContextNotifications.cpp
+++ b/Source/WebCore/Modules/notifications/WorkerContextNotifications.cpp
diff --git a/Source/WebCore/notifications/WorkerContextNotifications.h b/Source/WebCore/Modules/notifications/WorkerContextNotifications.h
index 6354fca18..6354fca18 100644
--- a/Source/WebCore/notifications/WorkerContextNotifications.h
+++ b/Source/WebCore/Modules/notifications/WorkerContextNotifications.h
diff --git a/Source/WebCore/notifications/WorkerContextNotifications.idl b/Source/WebCore/Modules/notifications/WorkerContextNotifications.idl
index 3c93bc2b3..3c93bc2b3 100644
--- a/Source/WebCore/notifications/WorkerContextNotifications.idl
+++ b/Source/WebCore/Modules/notifications/WorkerContextNotifications.idl
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.cpp b/Source/WebCore/Modules/speech/SpeechRecognition.cpp
index fca2ba764..d2b79b681 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.cpp
@@ -122,7 +122,8 @@ void SpeechRecognition::didStart()
 
 void SpeechRecognition::didEnd()
 {
-    dispatchEvent(Event::create(eventNames().endEvent, /*canBubble=*/false, /*cancelable=*/false));
+    if (!m_stoppedByActiveDOMObject)
+        dispatchEvent(Event::create(eventNames().endEvent, /*canBubble=*/false, /*cancelable=*/false));
     unsetPendingActivity(this);
 }
 
@@ -138,6 +139,7 @@ ScriptExecutionContext* SpeechRecognition::scriptExecutionContext() const
 
 void SpeechRecognition::stop()
 {
+    m_stoppedByActiveDOMObject = true;
     if (hasPendingActivity())
         abort();
 }
@@ -148,6 +150,7 @@ SpeechRecognition::SpeechRecognition(ScriptExecutionContext* context)
     , m_continuous(false)
     , m_maxAlternatives(1)
     , m_controller(0)
+    , m_stoppedByActiveDOMObject(false)
 {
     ASSERT(scriptExecutionContext()->isDocument());
     Document* document = static_cast<Document*>(scriptExecutionContext());
diff --git a/Source/WebCore/Modules/speech/SpeechRecognition.h b/Source/WebCore/Modules/speech/SpeechRecognition.h
index 1657b573d..86966f67c 100644
--- a/Source/WebCore/Modules/speech/SpeechRecognition.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognition.h
@@ -121,6 +121,7 @@ private:
     EventTargetData m_eventTargetData;
 
     SpeechRecognitionController* m_controller;
+    bool m_stoppedByActiveDOMObject;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/vibration/NavigatorVibration.idl b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
index 624845d81..164849bab 100644
--- a/Source/WebCore/Modules/vibration/NavigatorVibration.idl
+++ b/Source/WebCore/Modules/vibration/NavigatorVibration.idl
@@ -23,7 +23,7 @@ module window {
         Conditional=VIBRATION,
         Supplemental=Navigator
     ] NavigatorVibration {
-        void webkitVibrate(in unsigned long[] pattern) raises(DOMException);
+        void webkitVibrate(in unsigned long[]? pattern) raises(DOMException);
         void webkitVibrate(in unsigned long time) raises(DOMException);
     };
 
diff --git a/Source/WebCore/Modules/webaudio/AudioContext.idl b/Source/WebCore/Modules/webaudio/AudioContext.idl
index 1d0228848..204b0c7d5 100644
--- a/Source/WebCore/Modules/webaudio/AudioContext.idl
+++ b/Source/WebCore/Modules/webaudio/AudioContext.idl
@@ -49,7 +49,7 @@ module webaudio {
         
         AudioBuffer createBuffer(in unsigned long numberOfChannels, in unsigned long numberOfFrames, in float sampleRate)
             raises(DOMException);
-        AudioBuffer createBuffer(in ArrayBuffer buffer, in boolean mixToMono)
+        AudioBuffer createBuffer(in ArrayBuffer? buffer, in boolean mixToMono)
             raises(DOMException);
 
         // Asynchronous audio file data decoding.
diff --git a/Source/WebCore/Modules/webaudio/AudioNode.idl b/Source/WebCore/Modules/webaudio/AudioNode.idl
index 13bdc7562..e85c747c4 100644
--- a/Source/WebCore/Modules/webaudio/AudioNode.idl
+++ b/Source/WebCore/Modules/webaudio/AudioNode.idl
@@ -30,10 +30,10 @@ module audio {
         readonly attribute unsigned long numberOfInputs;
         readonly attribute unsigned long numberOfOutputs;
 
-        void connect(in AudioNode destination, in [Optional=DefaultIsUndefined] unsigned long output, in [Optional=DefaultIsUndefined] unsigned long input)
+        void connect(in AudioNode? destination, in [Optional=DefaultIsUndefined] unsigned long output, in [Optional=DefaultIsUndefined] unsigned long input)
             raises(DOMException);
 
-        void connect(in AudioParam destination, in [Optional=DefaultIsUndefined] unsigned long output)
+        void connect(in AudioParam? destination, in [Optional=DefaultIsUndefined] unsigned long output)
             raises(DOMException);
 
         void disconnect(in [Optional=DefaultIsUndefined] unsigned long output)
diff --git a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
index 32ea8aae1..72bdc878f 100644
--- a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
@@ -56,7 +56,6 @@ public:
         InvalidMessage
     };
 
-    virtual bool useHixie76Protocol() = 0;
     virtual void connect(const KURL&, const String& protocol) = 0;
     virtual String subprotocol() = 0; // Will be available after didConnect() callback is invoked.
     virtual String extensions() = 0; // Will be available after didConnect() callback is invoked.
diff --git a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
index c47e59100..4e14ed9f2 100644
--- a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
@@ -47,7 +47,6 @@ ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper
     , m_peer(0)
     , m_failedWebSocketChannelCreation(false)
     , m_syncMethodDone(true)
-    , m_useHixie76Protocol(true)
     , m_sendRequestResult(ThreadableWebSocketChannel::SendFail)
     , m_bufferedAmount(0)
     , m_suspended(false)
@@ -79,10 +78,9 @@ WorkerThreadableWebSocketChannel::Peer* ThreadableWebSocketChannelClientWrapper:
     return m_peer;
 }
 
-void ThreadableWebSocketChannelClientWrapper::didCreateWebSocketChannel(WorkerThreadableWebSocketChannel::Peer* peer, bool useHixie76Protocol)
+void ThreadableWebSocketChannelClientWrapper::didCreateWebSocketChannel(WorkerThreadableWebSocketChannel::Peer* peer)
 {
     m_peer = peer;
-    m_useHixie76Protocol = useHixie76Protocol;
     m_syncMethodDone = true;
 }
 
@@ -101,11 +99,6 @@ void ThreadableWebSocketChannelClientWrapper::setFailedWebSocketChannelCreation(
     m_failedWebSocketChannelCreation = true;
 }
 
-bool ThreadableWebSocketChannelClientWrapper::useHixie76Protocol() const
-{
-    return m_useHixie76Protocol;
-}
-
 String ThreadableWebSocketChannelClientWrapper::subprotocol() const
 {
     if (m_subprotocol.isEmpty())
diff --git a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
index 1d3220199..8e9dc8579 100644
--- a/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -58,17 +58,13 @@ public:
     bool syncMethodDone() const;
 
     WorkerThreadableWebSocketChannel::Peer* peer() const;
-    void didCreateWebSocketChannel(WorkerThreadableWebSocketChannel::Peer*, bool useHixie76Protocol);
+    void didCreateWebSocketChannel(WorkerThreadableWebSocketChannel::Peer*);
     void clearPeer();
 
     bool failedWebSocketChannelCreation() const;
     void setFailedWebSocketChannelCreation();
 
-    // The value of useHixie76Protocol flag is cachable; this value is saved after WebSocketChannel (on the main
-    // thread) is constructed.
-    bool useHixie76Protocol() const;
-
-    // Subprotocol and extensions are cached too. Will be available when didConnect() callback is invoked.
+    // Subprotocol and extensions will be available when didConnect() callback is invoked.
     String subprotocol() const;
     void setSubprotocol(const String&);
     String extensions() const;
@@ -112,7 +108,6 @@ private:
     WorkerThreadableWebSocketChannel::Peer* m_peer;
     bool m_failedWebSocketChannelCreation;
     bool m_syncMethodDone;
-    bool m_useHixie76Protocol;
     // ThreadSafeRefCounted must not have String member variables.
     Vector<UChar> m_subprotocol;
     Vector<UChar> m_extensions;
diff --git a/Source/WebCore/Modules/websockets/WebSocket.cpp b/Source/WebCore/Modules/websockets/WebSocket.cpp
index 3c5c59c6a..c62b655a1 100644
--- a/Source/WebCore/Modules/websockets/WebSocket.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocket.cpp
@@ -89,20 +89,6 @@ static bool isValidProtocolString(const String& protocol)
     return true;
 }
 
-static bool isValidProtocolStringHixie76(const String& protocol)
-{
-    if (protocol.isNull())
-        return true;
-    if (protocol.isEmpty())
-        return false;
-    const UChar* characters = protocol.characters();
-    for (size_t i = 0; i < protocol.length(); i++) {
-        if (characters[i] < 0x20 || characters[i] > 0x7E)
-            return false;
-    }
-    return true;
-}
-
 static String encodeProtocolString(const String& protocol)
 {
     StringBuilder builder;
@@ -158,7 +144,6 @@ WebSocket::WebSocket(ScriptExecutionContext* context)
     , m_bufferedAmount(0)
     , m_bufferedAmountAfterClose(0)
     , m_binaryType(BinaryTypeBlob)
-    , m_useHixie76Protocol(true)
     , m_subprotocol("")
     , m_extensions("")
 {
@@ -230,51 +215,37 @@ void WebSocket::connect(const String& url, const Vector<String>& protocols, Exce
     }
 
     m_channel = ThreadableWebSocketChannel::create(scriptExecutionContext(), this);
-    m_useHixie76Protocol = m_channel->useHixie76Protocol();
 
-    String protocolString;
-    if (m_useHixie76Protocol) {
-        if (!protocols.isEmpty()) {
-            // Emulate JavaScript's Array.toString() behavior.
-            protocolString = joinStrings(protocols, ",");
-        }
-        if (!isValidProtocolStringHixie76(protocolString)) {
-            scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Wrong protocol for WebSocket '" + encodeProtocolString(protocolString) + "'", scriptExecutionContext()->securityOrigin()->toString());
+    // FIXME: There is a disagreement about restriction of subprotocols between WebSocket API and hybi-10 protocol
+    // draft. The former simply says "only characters in the range U+0021 to U+007E are allowed," while the latter
+    // imposes a stricter rule: "the elements MUST be non-empty strings with characters as defined in [RFC2616],
+    // and MUST all be unique strings."
+    //
+    // Here, we throw SYNTAX_ERR if the given protocols do not meet the latter criteria. This behavior does not
+    // comply with WebSocket API specification, but it seems to be the only reasonable way to handle this conflict.
+    for (size_t i = 0; i < protocols.size(); ++i) {
+        if (!isValidProtocolString(protocols[i])) {
+            scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Wrong protocol for WebSocket '" + encodeProtocolString(protocols[i]) + "'", scriptExecutionContext()->securityOrigin()->toString());
             m_state = CLOSED;
             ec = SYNTAX_ERR;
             return;
         }
-    } else {
-        // FIXME: There is a disagreement about restriction of subprotocols between WebSocket API and hybi-10 protocol
-        // draft. The former simply says "only characters in the range U+0021 to U+007E are allowed," while the latter
-        // imposes a stricter rule: "the elements MUST be non-empty strings with characters as defined in [RFC2616],
-        // and MUST all be unique strings."
-        //
-        // Here, we throw SYNTAX_ERR if the given protocols do not meet the latter criteria. This behavior does not
-        // comply with WebSocket API specification, but it seems to be the only reasonable way to handle this conflict.
-        for (size_t i = 0; i < protocols.size(); ++i) {
-            if (!isValidProtocolString(protocols[i])) {
-                scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Wrong protocol for WebSocket '" + encodeProtocolString(protocols[i]) + "'", scriptExecutionContext()->securityOrigin()->toString());
-                m_state = CLOSED;
-                ec = SYNTAX_ERR;
-                return;
-            }
-        }
-        HashSet<String> visited;
-        for (size_t i = 0; i < protocols.size(); ++i) {
-            if (visited.contains(protocols[i])) {
-                scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "WebSocket protocols contain duplicates: '" + encodeProtocolString(protocols[i]) + "'", scriptExecutionContext()->securityOrigin()->toString());
-                m_state = CLOSED;
-                ec = SYNTAX_ERR;
-                return;
-            }
-            visited.add(protocols[i]);
+    }
+    HashSet<String> visited;
+    for (size_t i = 0; i < protocols.size(); ++i) {
+        if (visited.contains(protocols[i])) {
+            scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "WebSocket protocols contain duplicates: '" + encodeProtocolString(protocols[i]) + "'", scriptExecutionContext()->securityOrigin()->toString());
+            m_state = CLOSED;
+            ec = SYNTAX_ERR;
+            return;
         }
-
-        if (!protocols.isEmpty())
-            protocolString = joinStrings(protocols, subProtocolSeperator());
+        visited.add(protocols[i]);
     }
 
+    String protocolString;
+    if (!protocols.isEmpty())
+        protocolString = joinStrings(protocols, subProtocolSeperator());
+
     m_channel->connect(m_url, protocolString);
     ActiveDOMObject::setPendingActivity(this);
 }
@@ -307,8 +278,6 @@ bool WebSocket::send(ArrayBuffer* binaryData, ExceptionCode& ec)
 {
     LOG(Network, "WebSocket %p send arraybuffer %p", this, binaryData);
     ASSERT(binaryData);
-    if (m_useHixie76Protocol)
-        return send("[object ArrayBuffer]", ec);
     if (m_state == CONNECTING) {
         ec = INVALID_STATE_ERR;
         return false;
@@ -327,8 +296,6 @@ bool WebSocket::send(Blob* binaryData, ExceptionCode& ec)
 {
     LOG(Network, "WebSocket %p send blob %s", this, binaryData->url().string().utf8().data());
     ASSERT(binaryData);
-    if (m_useHixie76Protocol)
-        return send("[object Blob]", ec);
     if (m_state == CONNECTING) {
         ec = INVALID_STATE_ERR;
         return false;
@@ -396,22 +363,16 @@ unsigned long WebSocket::bufferedAmount() const
 
 String WebSocket::protocol() const
 {
-    if (m_useHixie76Protocol)
-        return String();
     return m_subprotocol;
 }
 
 String WebSocket::extensions() const
 {
-    if (m_useHixie76Protocol)
-        return String();
     return m_extensions;
 }
 
 String WebSocket::binaryType() const
 {
-    if (m_useHixie76Protocol)
-        return String();
     switch (m_binaryType) {
     case BinaryTypeBlob:
         return "blob";
@@ -424,8 +385,6 @@ String WebSocket::binaryType() const
 
 void WebSocket::setBinaryType(const String& binaryType, ExceptionCode& ec)
 {
-    if (m_useHixie76Protocol)
-        return;
     if (binaryType == "blob") {
         m_binaryType = BinaryTypeBlob;
         return;
@@ -531,8 +490,6 @@ void WebSocket::didReceiveBinaryData(PassOwnPtr<Vector<char> > binaryData)
 void WebSocket::didReceiveMessageError()
 {
     LOG(Network, "WebSocket %p didReceiveErrorMessage", this);
-    if (m_useHixie76Protocol && m_state != OPEN && m_state != CLOSING)
-        return;
     ASSERT(scriptExecutionContext());
     dispatchEvent(Event::create(eventNames().errorEvent, false, false));
 }
@@ -556,9 +513,7 @@ void WebSocket::didClose(unsigned long unhandledBufferedAmount, ClosingHandshake
     LOG(Network, "WebSocket %p didClose", this);
     if (!m_channel)
         return;
-    bool wasClean = m_state == CLOSING && !unhandledBufferedAmount && closingHandshakeCompletion == ClosingHandshakeComplete;
-    if (!m_useHixie76Protocol)
-        wasClean = wasClean && code != WebSocketChannel::CloseEventCodeAbnormalClosure;
+    bool wasClean = m_state == CLOSING && !unhandledBufferedAmount && closingHandshakeCompletion == ClosingHandshakeComplete && code != WebSocketChannel::CloseEventCodeAbnormalClosure;
     m_state = CLOSED;
     m_bufferedAmount = unhandledBufferedAmount;
     ASSERT(scriptExecutionContext());
@@ -584,10 +539,6 @@ EventTargetData* WebSocket::ensureEventTargetData()
 
 size_t WebSocket::getFramingOverhead(size_t payloadSize)
 {
-    static const size_t hixie76FramingOverhead = 2; // Payload is surrounded by 0x00 and 0xFF.
-    if (m_useHixie76Protocol)
-        return hixie76FramingOverhead;
-
     static const size_t hybiBaseFramingOverhead = 2; // Every frame has at least two-byte header.
     static const size_t hybiMaskingKeyLength = 4; // Every frame from client must have masking key.
     static const size_t minimumPayloadSizeWithTwoByteExtendedPayloadLength = 126;
diff --git a/Source/WebCore/Modules/websockets/WebSocket.h b/Source/WebCore/Modules/websockets/WebSocket.h
index f25c55c38..cfb61fb60 100644
--- a/Source/WebCore/Modules/websockets/WebSocket.h
+++ b/Source/WebCore/Modules/websockets/WebSocket.h
@@ -135,7 +135,6 @@ private:
     unsigned long m_bufferedAmount;
     unsigned long m_bufferedAmountAfterClose;
     BinaryType m_binaryType;
-    bool m_useHixie76Protocol;
     String m_subprotocol;
     String m_extensions;
 };
diff --git a/Source/WebCore/Modules/websockets/WebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
index c8ee9a8fd..faeafd2d5 100644
--- a/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
@@ -84,7 +84,6 @@ WebSocketChannel::WebSocketChannel(Document* document, WebSocketChannelClient* c
     , m_shouldDiscardReceivedData(false)
     , m_unhandledBufferedAmount(0)
     , m_identifier(0)
-    , m_useHixie76Protocol(true)
     , m_hasContinuousFrame(false)
     , m_closeEventCode(CloseEventCodeAbnormalClosure)
     , m_outgoingFrameQueueStatus(OutgoingFrameQueueOpen)
@@ -92,9 +91,6 @@ WebSocketChannel::WebSocketChannel(Document* document, WebSocketChannelClient* c
     , m_blobLoaderStatus(BlobLoaderNotStarted)
 #endif
 {
-    if (Settings* settings = m_document->settings())
-        m_useHixie76Protocol = settings->useHixie76WebSocketProtocol();
-
     if (Page* page = m_document->page())
         m_identifier = page->progress()->createUniqueIdentifier();
 }
@@ -104,19 +100,14 @@ WebSocketChannel::~WebSocketChannel()
     fastFree(m_buffer);
 }
 
-bool WebSocketChannel::useHixie76Protocol()
-{
-    return m_useHixie76Protocol;
-}
-
 void WebSocketChannel::connect(const KURL& url, const String& protocol)
 {
     LOG(Network, "WebSocketChannel %p connect", this);
     ASSERT(!m_handle);
     ASSERT(!m_suspended);
-    m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_document, m_useHixie76Protocol));
+    m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_document));
     m_handshake->reset();
-    if (!m_useHixie76Protocol && m_deflateFramer.canDeflate())
+    if (m_deflateFramer.canDeflate())
         m_handshake->addExtensionProcessor(m_deflateFramer.createExtensionProcessor());
     if (m_identifier)
         InspectorInstrumentation::didCreateWebSocket(m_document, m_identifier, url, m_document->url());
@@ -152,9 +143,6 @@ ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const String& mess
     CString utf8 = message.utf8(true);
     if (utf8.isNull() && message.length())
         return InvalidMessage;
-    if (m_useHixie76Protocol) {
-        return sendFrameHixie76(utf8.data(), utf8.length()) ? ThreadableWebSocketChannel::SendSuccess : ThreadableWebSocketChannel::SendFail;
-    }
     enqueueTextFrame(utf8);
     // According to WebSocket API specification, WebSocket.send() should return void instead
     // of boolean. However, our implementation still returns boolean due to compatibility
@@ -168,7 +156,6 @@ ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const String& mess
 ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const ArrayBuffer& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send arraybuffer %p", this, &binaryData);
-    ASSERT(!m_useHixie76Protocol);
     enqueueRawFrame(WebSocketFrame::OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
     return ThreadableWebSocketChannel::SendSuccess;
 }
@@ -176,7 +163,6 @@ ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const ArrayBuffer&
 ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const Blob& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send blob %s", this, binaryData.url().string().utf8().data());
-    ASSERT(!m_useHixie76Protocol);
     enqueueBlobFrame(WebSocketFrame::OpCodeBinary, binaryData);
     return ThreadableWebSocketChannel::SendSuccess;
 }
@@ -184,7 +170,6 @@ ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const Blob& binary
 bool WebSocketChannel::send(const char* data, int length)
 {
     LOG(Network, "WebSocketChannel %p send binary %p (%dB)", this, data, length);
-    ASSERT(!m_useHixie76Protocol);
     enqueueRawFrame(WebSocketFrame::OpCodeBinary, data, length);
     return true;
 }
@@ -216,19 +201,18 @@ void WebSocketChannel::fail(const String& reason)
         InspectorInstrumentation::didReceiveWebSocketFrameError(m_document, m_identifier, reason);
         m_document->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, reason, m_handshake->clientOrigin());
     }
-    if (!m_useHixie76Protocol) {
-        // Hybi-10 specification explicitly states we must not continue to handle incoming data
-        // once the WebSocket connection is failed (section 7.1.7).
-        // FIXME: Should we do this in hixie-76 too?
-        RefPtr<WebSocketChannel> protect(this); // The client can close the channel, potentially removing the last reference.
-        m_shouldDiscardReceivedData = true;
-        if (m_buffer)
-            skipBuffer(m_bufferSize); // Save memory.
-        m_deflateFramer.didFail();
-        m_hasContinuousFrame = false;
-        m_continuousFrameData.clear();
-        m_client->didReceiveMessageError();
-    }
+
+    // Hybi-10 specification explicitly states we must not continue to handle incoming data
+    // once the WebSocket connection is failed (section 7.1.7).
+    RefPtr<WebSocketChannel> protect(this); // The client can close the channel, potentially removing the last reference.
+    m_shouldDiscardReceivedData = true;
+    if (m_buffer)
+        skipBuffer(m_bufferSize); // Save memory.
+    m_deflateFramer.didFail();
+    m_hasContinuousFrame = false;
+    m_continuousFrameData.clear();
+    m_client->didReceiveMessageError();
+
     if (m_handle && !m_closed)
         m_handle->disconnect(); // Will call didClose().
 }
@@ -288,7 +272,7 @@ void WebSocketChannel::didCloseSocketStream(SocketStreamHandle* handle)
     m_closed = true;
     if (m_closingTimer.isActive())
         m_closingTimer.stop();
-    if (!m_useHixie76Protocol && m_outgoingFrameQueueStatus != OutgoingFrameQueueClosed)
+    if (m_outgoingFrameQueueStatus != OutgoingFrameQueueClosed)
         abortOutgoingFrameQueue();
     if (m_handle) {
         m_unhandledBufferedAmount = m_handle->bufferedAmount();
@@ -485,9 +469,6 @@ bool WebSocketChannel::processBuffer()
     if (m_handshake->mode() != WebSocketHandshake::Connected)
         return false;
 
-    if (m_useHixie76Protocol)
-        return processFrameHixie76();
-
     return processFrame();
 }
 
@@ -509,25 +490,17 @@ void WebSocketChannel::startClosingHandshake(int code, const String& reason)
     if (m_closing)
         return;
     ASSERT(m_handle);
-    if (m_useHixie76Protocol) {
-        Vector<char> buf;
-        buf.append('\xff');
-        buf.append('\0');
-        if (!m_handle->send(buf.data(), buf.size())) {
-            m_handle->disconnect();
-            return;
-        }
-    } else {
-        Vector<char> buf;
-        if (!m_receivedClosingHandshake && code != CloseEventCodeNotSpecified) {
-            unsigned char highByte = code >> 8;
-            unsigned char lowByte = code;
-            buf.append(static_cast<char>(highByte));
-            buf.append(static_cast<char>(lowByte));
-            buf.append(reason.utf8().data(), reason.utf8().length());
-        }
-        enqueueRawFrame(WebSocketFrame::OpCodeClose, buf.data(), buf.size());
+
+    Vector<char> buf;
+    if (!m_receivedClosingHandshake && code != CloseEventCodeNotSpecified) {
+        unsigned char highByte = code >> 8;
+        unsigned char lowByte = code;
+        buf.append(static_cast<char>(highByte));
+        buf.append(static_cast<char>(lowByte));
+        buf.append(reason.utf8().data(), reason.utf8().length());
     }
+    enqueueRawFrame(WebSocketFrame::OpCodeClose, buf.data(), buf.size());
+
     m_closing = true;
     if (m_client)
         m_client->didStartClosingHandshake();
@@ -723,98 +696,8 @@ bool WebSocketChannel::processFrame()
     return m_buffer;
 }
 
-bool WebSocketChannel::processFrameHixie76()
-{
-    const char* nextFrame = m_buffer;
-    const char* p = m_buffer;
-    const char* end = p + m_bufferSize;
-
-    unsigned char frameByte = static_cast<unsigned char>(*p++);
-    if ((frameByte & 0x80) == 0x80) {
-        size_t length = 0;
-        bool errorFrame = false;
-        bool lengthFinished = false;
-        while (p < end) {
-            if (length > numeric_limits<size_t>::max() / 128) {
-                LOG(Network, "frame length overflow %lu", static_cast<unsigned long>(length));
-                errorFrame = true;
-                break;
-            }
-            size_t newLength = length * 128;
-            unsigned char msgByte = static_cast<unsigned char>(*p);
-            unsigned int lengthMsgByte = msgByte & 0x7f;
-            if (newLength > numeric_limits<size_t>::max() - lengthMsgByte) {
-                LOG(Network, "frame length overflow %lu+%u", static_cast<unsigned long>(newLength), lengthMsgByte);
-                errorFrame = true;
-                break;
-            }
-            newLength += lengthMsgByte;
-            if (newLength < length) { // sanity check
-                LOG(Network, "frame length integer wrap %lu->%lu", static_cast<unsigned long>(length), static_cast<unsigned long>(newLength));
-                errorFrame = true;
-                break;
-            }
-            length = newLength;
-            ++p;
-            if (!(msgByte & 0x80)) {
-                lengthFinished = true;
-                break;
-            }
-        }
-        if (!errorFrame && !lengthFinished)
-            return false;
-        if (p + length < p) {
-            LOG(Network, "frame buffer pointer wrap %p+%lu->%p", p, static_cast<unsigned long>(length), p + length);
-            errorFrame = true;
-        }
-        if (errorFrame) {
-            skipBuffer(m_bufferSize); // Save memory.
-            m_shouldDiscardReceivedData = true;
-            m_client->didReceiveMessageError();
-            fail("WebSocket frame length too large");
-            return false;
-        }
-        ASSERT(p + length >= p);
-        if (p + length <= end) {
-            p += length;
-            nextFrame = p;
-            ASSERT(nextFrame > m_buffer);
-            skipBuffer(nextFrame - m_buffer);
-            if (frameByte == 0xff && !length) {
-                m_receivedClosingHandshake = true;
-                startClosingHandshake(CloseEventCodeNotSpecified, "");
-                if (m_closing)
-                    m_handle->close(); // close after sending FF 00.
-            } else
-                m_client->didReceiveMessageError();
-            return m_buffer;
-        }
-        return false;
-    }
-
-    const char* msgStart = p;
-    while (p < end && *p != '\xff')
-        ++p;
-    if (p < end && *p == '\xff') {
-        int msgLength = p - msgStart;
-        ++p;
-        nextFrame = p;
-        if (frameByte == 0x00) {
-            String msg = String::fromUTF8(msgStart, msgLength);
-            skipBuffer(nextFrame - m_buffer);
-            m_client->didReceiveMessage(msg);
-        } else {
-            skipBuffer(nextFrame - m_buffer);
-            m_client->didReceiveMessageError();
-        }
-        return m_buffer;
-    }
-    return false;
-}
-
 void WebSocketChannel::enqueueTextFrame(const CString& string)
 {
-    ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
     OwnPtr<QueuedFrame> frame = adoptPtr(new QueuedFrame);
     frame->opCode = WebSocketFrame::OpCodeText;
@@ -826,7 +709,6 @@ void WebSocketChannel::enqueueTextFrame(const CString& string)
 
 void WebSocketChannel::enqueueRawFrame(WebSocketFrame::OpCode opCode, const char* data, size_t dataLength)
 {
-    ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
     OwnPtr<QueuedFrame> frame = adoptPtr(new QueuedFrame);
     frame->opCode = opCode;
@@ -840,7 +722,6 @@ void WebSocketChannel::enqueueRawFrame(WebSocketFrame::OpCode opCode, const char
 
 void WebSocketChannel::enqueueBlobFrame(WebSocketFrame::OpCode opCode, const Blob& blob)
 {
-    ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
     OwnPtr<QueuedFrame> frame = adoptPtr(new QueuedFrame);
     frame->opCode = opCode;
@@ -852,7 +733,6 @@ void WebSocketChannel::enqueueBlobFrame(WebSocketFrame::OpCode opCode, const Blo
 
 void WebSocketChannel::processOutgoingFrameQueue()
 {
-    ASSERT(!m_useHixie76Protocol);
     if (m_outgoingFrameQueueStatus == OutgoingFrameQueueClosed)
         return;
 
@@ -917,7 +797,6 @@ void WebSocketChannel::processOutgoingFrameQueue()
 
 void WebSocketChannel::abortOutgoingFrameQueue()
 {
-    ASSERT(!m_useHixie76Protocol);
     m_outgoingFrameQueue.clear();
     m_outgoingFrameQueueStatus = OutgoingFrameQueueClosed;
 #if ENABLE(BLOB)
@@ -948,18 +827,6 @@ bool WebSocketChannel::sendFrame(WebSocketFrame::OpCode opCode, const char* data
     return m_handle->send(frameData.data(), frameData.size());
 }
 
-bool WebSocketChannel::sendFrameHixie76(const char* data, size_t dataLength)
-{
-    ASSERT(m_handle);
-    ASSERT(!m_suspended);
-
-    Vector<char> frame;
-    frame.append('\0'); // Frame type.
-    frame.append(data, dataLength);
-    frame.append('\xff'); // Frame end.
-    return m_handle->send(frame.data(), frame.size());
-}
-
 }  // namespace WebCore
 
 #endif  // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/Modules/websockets/WebSocketChannel.h b/Source/WebCore/Modules/websockets/WebSocketChannel.h
index 31e470aa9..09095c15a 100644
--- a/Source/WebCore/Modules/websockets/WebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.h
@@ -68,7 +68,6 @@ public:
     bool send(const char* data, int length);
 
     // ThreadableWebSocketChannel functions.
-    virtual bool useHixie76Protocol() OVERRIDE;
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
@@ -138,7 +137,6 @@ private:
     void closingTimerFired(Timer<WebSocketChannel>*);
 
     bool processFrame();
-    bool processFrameHixie76();
 
     // It is allowed to send a Blob as a binary frame if hybi-10 protocol is in use. Sending a Blob
     // can be delayed because it must be read asynchronously. Other types of data (String or
@@ -148,8 +146,6 @@ private:
     // data frame is going to be sent, it first must go to the queue. Items in the queue are processed
     // in the order they were put into the queue. Sending request of a Blob blocks further processing
     // until the Blob is completely read and sent to the socket stream.
-    //
-    // When hixie-76 protocol is chosen, the queue is not used and messages are sent directly.
     enum QueuedFrameType {
         QueuedFrameTypeString,
         QueuedFrameTypeVector,
@@ -185,7 +181,6 @@ private:
     // If you are going to send a hybi-10 frame, you need to use the outgoing frame queue
     // instead of call sendFrame() directly.
     bool sendFrame(WebSocketFrame::OpCode, const char* data, size_t dataLength);
-    bool sendFrameHixie76(const char* data, size_t dataLength);
 
 #if ENABLE(BLOB)
     enum BlobLoaderStatus {
@@ -214,8 +209,6 @@ private:
 
     unsigned long m_identifier; // m_identifier == 0 means that we could not obtain a valid identifier.
 
-    bool m_useHixie76Protocol;
-
     // Private members only for hybi-10 protocol.
     bool m_hasContinuousFrame;
     WebSocketFrame::OpCode m_continuousFrameOpCode;
diff --git a/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
index 30c08869c..f7c836965 100644
--- a/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
@@ -95,74 +95,6 @@ static String trimInputSample(const char* p, size_t len)
     return s;
 }
 
-static uint32_t randomNumberLessThan(uint32_t n)
-{
-    if (!n)
-        return 0;
-    if (n == std::numeric_limits<uint32_t>::max())
-        return cryptographicallyRandomNumber();
-    uint32_t max = std::numeric_limits<uint32_t>::max() - (std::numeric_limits<uint32_t>::max() % n);
-    ASSERT(!(max % n));
-    uint32_t v;
-    do {
-        v = cryptographicallyRandomNumber();
-    } while (v >= max);
-    return v % n;
-}
-
-static void generateHixie76SecWebSocketKey(uint32_t& number, String& key)
-{
-    uint32_t space = randomNumberLessThan(12) + 1;
-    uint32_t max = 4294967295U / space;
-    number = randomNumberLessThan(max);
-    uint32_t product = number * space;
-
-    String s = String::number(product);
-    int n = randomNumberLessThan(12) + 1;
-    DEFINE_STATIC_LOCAL(String, randomChars, (randomCharacterInSecWebSocketKey));
-    for (int i = 0; i < n; i++) {
-        int pos = randomNumberLessThan(s.length() + 1);
-        int chpos = randomNumberLessThan(randomChars.length());
-        s.insert(randomChars.substring(chpos, 1), pos);
-    }
-    DEFINE_STATIC_LOCAL(String, spaceChar, (" "));
-    for (uint32_t i = 0; i < space; i++) {
-        int pos = randomNumberLessThan(s.length() - 1) + 1;
-        s.insert(spaceChar, pos);
-    }
-    ASSERT(s[0] != ' ');
-    ASSERT(s[s.length() - 1] != ' ');
-    key = s;
-}
-
-static void generateHixie76Key3(unsigned char key3[8])
-{
-    cryptographicallyRandomValues(key3, 8);
-}
-
-static void setChallengeNumber(unsigned char* buf, uint32_t number)
-{
-    unsigned char* p = buf + 3;
-    for (int i = 0; i < 4; i++) {
-        *p = number & 0xFF;
-        --p;
-        number >>= 8;
-    }
-}
-
-static void generateHixie76ExpectedChallengeResponse(uint32_t number1, uint32_t number2, unsigned char key3[8], unsigned char expectedChallenge[16])
-{
-    unsigned char challenge[16];
-    setChallengeNumber(&challenge[0], number1);
-    setChallengeNumber(&challenge[4], number2);
-    memcpy(&challenge[8], key3, 8);
-    MD5 md5;
-    md5.addBytes(challenge, sizeof(challenge));
-    Vector<uint8_t, 16> digest;
-    md5.checksum(digest);
-    memcpy(expectedChallenge, digest.data(), 16);
-}
-
 static String generateSecWebSocketKey()
 {
     static const size_t nonceSize = 16;
@@ -184,25 +116,15 @@ String WebSocketHandshake::getExpectedWebSocketAccept(const String& secWebSocket
     return base64Encode(reinterpret_cast<const char*>(hash.data()), sha1HashSize);
 }
 
-WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context, bool useHixie76Protocol)
+WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context)
     : m_url(url)
     , m_clientProtocol(protocol)
     , m_secure(m_url.protocolIs("wss"))
     , m_context(context)
-    , m_useHixie76Protocol(useHixie76Protocol)
     , m_mode(Incomplete)
 {
-    if (m_useHixie76Protocol) {
-        uint32_t number1;
-        uint32_t number2;
-        generateHixie76SecWebSocketKey(number1, m_hixie76SecWebSocketKey1);
-        generateHixie76SecWebSocketKey(number2, m_hixie76SecWebSocketKey2);
-        generateHixie76Key3(m_hixie76Key3);
-        generateHixie76ExpectedChallengeResponse(number1, number2, m_hixie76Key3, m_hixie76ExpectedChallengeResponse);
-    } else {
-        m_secWebSocketKey = generateSecWebSocketKey();
-        m_expectedAccept = getExpectedWebSocketAccept(m_secWebSocketKey);
-    }
+    m_secWebSocketKey = generateSecWebSocketKey();
+    m_expectedAccept = getExpectedWebSocketAccept(m_secWebSocketKey);
 }
 
 WebSocketHandshake::~WebSocketHandshake()
@@ -264,10 +186,7 @@ CString WebSocketHandshake::clientHandshakeMessage() const
     builder.append(" HTTP/1.1\r\n");
 
     Vector<String> fields;
-    if (m_useHixie76Protocol)
-        fields.append("Upgrade: WebSocket");
-    else
-        fields.append("Upgrade: websocket");
+    fields.append("Upgrade: websocket");
     fields.append("Connection: Upgrade");
     fields.append("Host: " + hostName(m_url, m_secure));
     fields.append("Origin: " + clientOrigin());
@@ -283,16 +202,11 @@ CString WebSocketHandshake::clientHandshakeMessage() const
         // Set "Cookie2: <cookie>" if cookies 2 exists for url?
     }
 
-    if (m_useHixie76Protocol) {
-        fields.append("Sec-WebSocket-Key1: " + m_hixie76SecWebSocketKey1);
-        fields.append("Sec-WebSocket-Key2: " + m_hixie76SecWebSocketKey2);
-    } else {
-        fields.append("Sec-WebSocket-Key: " + m_secWebSocketKey);
-        fields.append("Sec-WebSocket-Version: 13");
-        const String extensionValue = m_extensionDispatcher.createHeaderValue();
-        if (extensionValue.length())
-            fields.append("Sec-WebSocket-Extensions: " + extensionValue);
-    }
+    fields.append("Sec-WebSocket-Key: " + m_secWebSocketKey);
+    fields.append("Sec-WebSocket-Version: 13");
+    const String extensionValue = m_extensionDispatcher.createHeaderValue();
+    if (extensionValue.length())
+        fields.append("Sec-WebSocket-Extensions: " + extensionValue);
 
     // Fields in the handshake are sent by the client in a random order; the
     // order is not meaningful.  Thus, it's ok to send the order we constructed
@@ -305,16 +219,7 @@ CString WebSocketHandshake::clientHandshakeMessage() const
 
     builder.append("\r\n");
 
-    CString handshakeHeader = builder.toString().utf8();
-    // Hybi-10 handshake is complete at this point.
-    if (!m_useHixie76Protocol)
-        return handshakeHeader;
-    // Hixie-76 protocol requires sending eight-byte data (so-called "key3") after the request header fields.
-    char* characterBuffer = 0;
-    CString msg = CString::newUninitialized(handshakeHeader.length() + sizeof(m_hixie76Key3), characterBuffer);
-    memcpy(characterBuffer, handshakeHeader.data(), handshakeHeader.length());
-    memcpy(characterBuffer + handshakeHeader.length(), m_hixie76Key3, sizeof(m_hixie76Key3));
-    return msg;
+    return builder.toString().utf8();
 }
 
 PassRefPtr<WebSocketHandshakeRequest> WebSocketHandshake::clientHandshakeRequest() const
@@ -323,10 +228,7 @@ PassRefPtr<WebSocketHandshakeRequest> WebSocketHandshake::clientHandshakeRequest
     // FIXME: do we need to store m_secWebSocketKey1, m_secWebSocketKey2 and
     // m_key3 in WebSocketHandshakeRequest?
     RefPtr<WebSocketHandshakeRequest> request = WebSocketHandshakeRequest::create("GET", m_url);
-    if (m_useHixie76Protocol)
-        request->addHeaderField("Upgrade", "WebSocket");
-    else
-        request->addHeaderField("Upgrade", "websocket");
+    request->addHeaderField("Upgrade", "websocket");
     request->addHeaderField("Connection", "Upgrade");
     request->addHeaderField("Host", hostName(m_url, m_secure));
     request->addHeaderField("Origin", clientOrigin());
@@ -342,17 +244,11 @@ PassRefPtr<WebSocketHandshakeRequest> WebSocketHandshake::clientHandshakeRequest
         // Set "Cookie2: <cookie>" if cookies 2 exists for url?
     }
 
-    if (m_useHixie76Protocol) {
-        request->addHeaderField("Sec-WebSocket-Key1", m_hixie76SecWebSocketKey1);
-        request->addHeaderField("Sec-WebSocket-Key2", m_hixie76SecWebSocketKey2);
-        request->setKey3(m_hixie76Key3);
-    } else {
-        request->addHeaderField("Sec-WebSocket-Key", m_secWebSocketKey);
-        request->addHeaderField("Sec-WebSocket-Version", "13");
-        const String extensionValue = m_extensionDispatcher.createHeaderValue();
-        if (extensionValue.length())
-            request->addHeaderField("Sec-WebSocket-Extensions", extensionValue);
-    }
+    request->addHeaderField("Sec-WebSocket-Key", m_secWebSocketKey);
+    request->addHeaderField("Sec-WebSocket-Version", "13");
+    const String extensionValue = m_extensionDispatcher.createHeaderValue();
+    if (extensionValue.length())
+        request->addHeaderField("Sec-WebSocket-Extensions", extensionValue);
 
     return request.release();
 }
@@ -406,26 +302,8 @@ int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
         return p - header;
     }
 
-    if (!m_useHixie76Protocol) { // Hybi-10 handshake is complete at this point.
-        m_mode = Connected;
-        return p - header;
-    }
-
-    // In hixie-76 protocol, server's handshake contains sixteen-byte data (called "challenge response")
-    // after the header fields.
-    if (len < static_cast<size_t>(p - header + sizeof(m_hixie76ExpectedChallengeResponse))) {
-        // Just hasn't been received /expected/ yet.
-        m_mode = Incomplete;
-        return -1;
-    }
-
-    m_response.setChallengeResponse(static_cast<const unsigned char*>(static_cast<const void*>(p)));
-    if (memcmp(p, m_hixie76ExpectedChallengeResponse, sizeof(m_hixie76ExpectedChallengeResponse))) {
-        m_mode = Failed;
-        return (p - header) + sizeof(m_hixie76ExpectedChallengeResponse);
-    }
     m_mode = Connected;
-    return (p - header) + sizeof(m_hixie76ExpectedChallengeResponse);
+    return p - header;
 }
 
 WebSocketHandshake::Mode WebSocketHandshake::mode() const
@@ -438,16 +316,6 @@ String WebSocketHandshake::failureReason() const
     return m_failureReason;
 }
 
-String WebSocketHandshake::serverWebSocketOrigin() const
-{
-    return m_response.headerFields().get("sec-websocket-origin");
-}
-
-String WebSocketHandshake::serverWebSocketLocation() const
-{
-    return m_response.headerFields().get("sec-websocket-location");
-}
-
 String WebSocketHandshake::serverWebSocketProtocol() const
 {
     return m_response.headerFields().get("sec-websocket-protocol");
@@ -619,8 +487,6 @@ const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* e
 
 bool WebSocketHandshake::checkResponseHeaders()
 {
-    const String& serverWebSocketLocation = this->serverWebSocketLocation();
-    const String& serverWebSocketOrigin = this->serverWebSocketOrigin();
     const String& serverWebSocketProtocol = this->serverWebSocketProtocol();
     const String& serverUpgrade = this->serverUpgrade();
     const String& serverConnection = this->serverConnection();
@@ -634,20 +500,9 @@ bool WebSocketHandshake::checkResponseHeaders()
         m_failureReason = "Error during WebSocket handshake: 'Connection' header is missing";
         return false;
     }
-    if (m_useHixie76Protocol) {
-        if (serverWebSocketOrigin.isNull()) {
-            m_failureReason = "Error during WebSocket handshake: 'Sec-WebSocket-Origin' header is missing";
-            return false;
-        }
-        if (serverWebSocketLocation.isNull()) {
-            m_failureReason = "Error during WebSocket handshake: 'Sec-WebSocket-Location' header is missing";
-            return false;
-        }
-    } else {
-        if (serverWebSocketAccept.isNull()) {
-            m_failureReason = "Error during WebSocket handshake: 'Sec-WebSocket-Accept' header is missing";
-            return false;
-        }
+    if (serverWebSocketAccept.isNull()) {
+        m_failureReason = "Error during WebSocket handshake: 'Sec-WebSocket-Accept' header is missing";
+        return false;
     }
 
     if (!equalIgnoringCase(serverUpgrade, "websocket")) {
@@ -659,36 +514,21 @@ bool WebSocketHandshake::checkResponseHeaders()
         return false;
     }
 
-    if (m_useHixie76Protocol) {
-        if (clientOrigin() != serverWebSocketOrigin) {
-            m_failureReason = "Error during WebSocket handshake: origin mismatch: " + clientOrigin() + " != " + serverWebSocketOrigin;
-            return false;
-        }
-        if (clientLocation() != serverWebSocketLocation) {
-            m_failureReason = "Error during WebSocket handshake: location mismatch: " + clientLocation() + " != " + serverWebSocketLocation;
-            return false;
-        }
-        if (!m_clientProtocol.isEmpty() && m_clientProtocol != serverWebSocketProtocol) {
-            m_failureReason = "Error during WebSocket handshake: protocol mismatch: " + m_clientProtocol + " != " + serverWebSocketProtocol;
+    if (serverWebSocketAccept != m_expectedAccept) {
+        m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Accept mismatch";
+        return false;
+    }
+    if (!serverWebSocketProtocol.isNull()) {
+        if (m_clientProtocol.isEmpty()) {
+            m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Protocol mismatch";
             return false;
         }
-    } else {
-        if (serverWebSocketAccept != m_expectedAccept) {
-            m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Accept mismatch";
+        Vector<String> result;
+        m_clientProtocol.split(String(WebSocket::subProtocolSeperator()), result);
+        if (!result.contains(serverWebSocketProtocol)) {
+            m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Protocol mismatch";
             return false;
         }
-        if (!serverWebSocketProtocol.isNull()) {
-            if (m_clientProtocol.isEmpty()) {
-                m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Protocol mismatch";
-                return false;
-            }
-            Vector<String> result;
-            m_clientProtocol.split(String(WebSocket::subProtocolSeperator()), result);
-            if (!result.contains(serverWebSocketProtocol)) {
-                m_failureReason = "Error during WebSocket handshake: Sec-WebSocket-Protocol mismatch";
-                return false;
-            }
-        }
     }
     return true;
 }
diff --git a/Source/WebCore/Modules/websockets/WebSocketHandshake.h b/Source/WebCore/Modules/websockets/WebSocketHandshake.h
index 21d1f3fc9..5d0c17f6b 100644
--- a/Source/WebCore/Modules/websockets/WebSocketHandshake.h
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshake.h
@@ -51,7 +51,7 @@ public:
     enum Mode {
         Incomplete, Normal, Failed, Connected
     };
-    WebSocketHandshake(const KURL&, const String& protocol, ScriptExecutionContext*, bool useHixie76Protocol);
+    WebSocketHandshake(const KURL&, const String& protocol, ScriptExecutionContext*);
     ~WebSocketHandshake();
 
     const KURL& url() const;
@@ -76,14 +76,12 @@ public:
     Mode mode() const;
     String failureReason() const; // Returns a string indicating the reason of failure if mode() == Failed.
 
-    String serverWebSocketOrigin() const; // Only for hixie-76 handshake.
-    String serverWebSocketLocation() const; // Only for hixie-76 handshake.
     String serverWebSocketProtocol() const;
     String serverSetCookie() const;
     String serverSetCookie2() const;
     String serverUpgrade() const;
     String serverConnection() const;
-    String serverWebSocketAccept() const; // Only for hybi-10 handshake.
+    String serverWebSocketAccept() const;
     String acceptedExtensions() const;
 
     const WebSocketHandshakeResponse& serverHandshakeResponse() const;
@@ -106,7 +104,6 @@ private:
     String m_clientProtocol;
     bool m_secure;
     ScriptExecutionContext* m_context;
-    bool m_useHixie76Protocol;
 
     Mode m_mode;
 
@@ -114,13 +111,6 @@ private:
 
     String m_failureReason;
 
-    // For hixie-76 handshake.
-    String m_hixie76SecWebSocketKey1;
-    String m_hixie76SecWebSocketKey2;
-    unsigned char m_hixie76Key3[8];
-    unsigned char m_hixie76ExpectedChallengeResponse[16];
-
-    // For hybi-10 handshake.
     String m_secWebSocketKey;
     String m_expectedAccept;
 
diff --git a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
index d2c53ddd2..250c01961 100644
--- a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -66,12 +66,6 @@ WorkerThreadableWebSocketChannel::~WorkerThreadableWebSocketChannel()
         m_bridge->disconnect();
 }
 
-bool WorkerThreadableWebSocketChannel::useHixie76Protocol()
-{
-    ASSERT(m_workerClientWrapper);
-    return m_workerClientWrapper->useHixie76Protocol();
-}
-
 void WorkerThreadableWebSocketChannel::connect(const KURL& url, const String& protocol)
 {
     if (m_bridge)
@@ -166,13 +160,6 @@ WorkerThreadableWebSocketChannel::Peer::~Peer()
         m_mainWebSocketChannel->disconnect();
 }
 
-bool WorkerThreadableWebSocketChannel::Peer::useHixie76Protocol()
-{
-    ASSERT(isMainThread());
-    ASSERT(m_mainWebSocketChannel);
-    return m_mainWebSocketChannel->useHixie76Protocol();
-}
-
 void WorkerThreadableWebSocketChannel::Peer::connect(const KURL& url, const String& protocol)
 {
     ASSERT(isMainThread());
@@ -376,10 +363,9 @@ class WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask : public
 public:
     static PassOwnPtr<ScriptExecutionContext::Task> create(WorkerThreadableWebSocketChannel::Peer* peer,
                                                            WorkerLoaderProxy* loaderProxy,
-                                                           PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper,
-                                                           bool useHixie76Protocol)
+                                                           PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper)
     {
-        return adoptPtr(new WorkerContextDidInitializeTask(peer, loaderProxy, workerClientWrapper, useHixie76Protocol));
+        return adoptPtr(new WorkerContextDidInitializeTask(peer, loaderProxy, workerClientWrapper));
     }
 
     virtual ~WorkerContextDidInitializeTask() { }
@@ -392,26 +378,23 @@ public:
             m_peer = 0;
             m_loaderProxy->postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadDestroy, peer.release()));
         } else
-            m_workerClientWrapper->didCreateWebSocketChannel(m_peer, m_useHixie76Protocol);
+            m_workerClientWrapper->didCreateWebSocketChannel(m_peer);
     }
     virtual bool isCleanupTask() const OVERRIDE { return true; }
 
 private:
     WorkerContextDidInitializeTask(WorkerThreadableWebSocketChannel::Peer* peer,
                                    WorkerLoaderProxy* loaderProxy,
-                                   PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper,
-                                   bool useHixie76Protocol)
+                                   PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper)
         : m_peer(peer)
         , m_loaderProxy(loaderProxy)
         , m_workerClientWrapper(workerClientWrapper)
-        , m_useHixie76Protocol(useHixie76Protocol)
     {
     }
 
     WorkerThreadableWebSocketChannel::Peer* m_peer;
     WorkerLoaderProxy* m_loaderProxy;
     RefPtr<ThreadableWebSocketChannelClientWrapper> m_workerClientWrapper;
-    bool m_useHixie76Protocol;
 };
 
 void WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize(ScriptExecutionContext* context, WorkerLoaderProxy* loaderProxy, PassRefPtr<ThreadableWebSocketChannelClientWrapper> prpClientWrapper, const String& taskMode)
@@ -423,7 +406,7 @@ void WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize(ScriptExecut
 
     Peer* peer = Peer::create(clientWrapper, *loaderProxy, context, taskMode);
     bool sent = loaderProxy->postTaskForModeToWorkerContext(
-        WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask::create(peer, loaderProxy, clientWrapper, peer->useHixie76Protocol()), taskMode);
+        WorkerThreadableWebSocketChannel::WorkerContextDidInitializeTask::create(peer, loaderProxy, clientWrapper), taskMode);
     if (!sent) {
         clientWrapper->clearPeer();
         delete peer;
diff --git a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
index 715b63acf..472b98209 100644
--- a/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
@@ -62,7 +62,6 @@ public:
     virtual ~WorkerThreadableWebSocketChannel();
 
     // ThreadableWebSocketChannel functions.
-    virtual bool useHixie76Protocol() OVERRIDE;
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
@@ -87,7 +86,6 @@ public:
         }
         ~Peer();
 
-        bool useHixie76Protocol();
         void connect(const KURL&, const String& protocol);
         void send(const String& message);
         void send(const ArrayBuffer&);
@@ -151,7 +149,7 @@ private:
     private:
         Bridge(PassRefPtr<ThreadableWebSocketChannelClientWrapper>, PassRefPtr<WorkerContext>, const String& taskMode);
 
-        static void setWebSocketChannel(ScriptExecutionContext*, Bridge* thisPtr, Peer*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, bool useHixie76Protocol);
+        static void setWebSocketChannel(ScriptExecutionContext*, Bridge* thisPtr, Peer*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>);
 
         // Executed on the main thread to create a Peer for this bridge.
         static void mainThreadInitialize(ScriptExecutionContext*, WorkerLoaderProxy*, PassRefPtr<ThreadableWebSocketChannelClientWrapper>, const String& taskMode);
diff --git a/Source/WebCore/PlatformBlackBerry.cmake b/Source/WebCore/PlatformBlackBerry.cmake
index 294095863..587ede3d0 100644
--- a/Source/WebCore/PlatformBlackBerry.cmake
+++ b/Source/WebCore/PlatformBlackBerry.cmake
@@ -218,6 +218,7 @@ if (ENABLE_REQUEST_ANIMATION_FRAME)
 ENDIF ()
 
 if (ENABLE_WEBGL)
+    ADD_DEFINITIONS (-DWTF_USE_OPENGL_ES_2=1)
     LIST(APPEND WebCore_INCLUDE_DIRECTORIES
         "${WEBCORE_DIR}/platform/graphics/gpu"
         "${WEBCORE_DIR}/platform/graphics/opengl"
@@ -225,6 +226,11 @@ if (ENABLE_WEBGL)
     LIST(APPEND WebCore_SOURCES
         platform/graphics/blackberry/DrawingBufferBlackBerry.cpp
         platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
+        platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+        platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp
+        platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
+        platform/graphics/opengl/Extensions3DOpenGLES.cpp
+        platform/graphics/gpu/SharedGraphicsContext3D.cpp
     )
 ENDIF ()
 
@@ -339,16 +345,13 @@ ADD_CUSTOM_COMMAND(
     COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
-FOREACH (_file ${WebCore_CPP_IDL_FILES})
-    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/WebDOM${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/WebDOM${_name}.h
-        MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorCPP.pm ${SUPPLEMENTAL_DEPENDENCY_FILE} ${_file}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_WEBCORE}" --generator CPP ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
-        VERBATIM)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/WebDOM${_name}.cpp)
-ENDFOREACH ()
+GENERATE_BINDINGS(WebCore_SOURCES
+    "${WebCore_CPP_IDL_FILES}"
+    "${WEBCORE_DIR}"
+    "${IDL_INCLUDES}"
+    "${FEATURE_DEFINES_WEBCORE}"
+    ${DERIVED_SOURCES_WEBCORE_DIR} WebDOM CPP
+    ${SUPPLEMENTAL_DEPENDENCY_FILE})
 
 # Generate contents for PopupPicker.cpp
 SET(WebCore_POPUP_CSS_AND_JS
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index 22af0e6ca..32a31b606 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -8,6 +8,7 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   "${WEBCORE_DIR}/page/efl"
   "${WEBCORE_DIR}/platform/efl"
   "${WEBCORE_DIR}/platform/graphics/efl"
+  "${WEBCORE_DIR}/platform/linux"
   "${WEBCORE_DIR}/platform/mediastream/gstreamer"
   "${WEBCORE_DIR}/platform/network/soup"
   "${WEBCORE_DIR}/platform/text/efl"
@@ -22,6 +23,7 @@ LIST(APPEND WebCore_SOURCES
   page/efl/DragControllerEfl.cpp
   page/efl/EventHandlerEfl.cpp
   platform/Cursor.cpp
+  platform/efl/BatteryProviderEfl.cpp
   platform/efl/ClipboardEfl.cpp
   platform/efl/ColorChooserEfl.cpp
   platform/efl/ContextMenuEfl.cpp
@@ -33,6 +35,7 @@ LIST(APPEND WebCore_SOURCES
   platform/efl/EflScreenUtilities.cpp
   platform/efl/EventLoopEfl.cpp
   platform/efl/FileSystemEfl.cpp
+  platform/efl/GamepadsEfl.cpp
   platform/efl/KURLEfl.cpp
   platform/efl/LanguageEfl.cpp
   platform/efl/LocalizedStringsEfl.cpp
@@ -74,6 +77,7 @@ LIST(APPEND WebCore_SOURCES
   platform/image-decoders/jpeg/JPEGImageDecoder.cpp
   platform/image-decoders/png/PNGImageDecoder.cpp
   platform/image-decoders/webp/WEBPImageDecoder.cpp
+  platform/linux/GamepadDeviceLinux.cpp
   platform/mediastream/gstreamer/DeprecatedPeerConnectionHandler.cpp
   platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp
   platform/network/soup/CookieJarSoup.cpp
@@ -307,3 +311,12 @@ IF (ENABLE_WEB_AUDIO)
   ADD_DEFINITIONS(-DUNINSTALLED_AUDIO_RESOURCES_DIR="${WEBCORE_DIR}/platform/audio/resources")
 ENDIF ()
 
+IF (ENABLE_GAMEPAD)
+  LIST(APPEND WebCore_INCLUDE_DIRECTORIES
+    ${EEZE_INCLUDE_DIRS}
+  )
+  LIST(APPEND WebCore_LIBRARIES
+    ${EEZE_LIBRARIES}
+  )
+ENDIF ()
+
diff --git a/Source/WebCore/Resources/calendarPicker.js b/Source/WebCore/Resources/calendarPicker.js
index 4a7ef06ac..f2a851f03 100644
--- a/Source/WebCore/Resources/calendarPicker.js
+++ b/Source/WebCore/Resources/calendarPicker.js
@@ -310,13 +310,23 @@ function fixWindowSize() {
             maxCellWidth = headers[i].offsetWidth;
     }
     var DaysAreaContainerBorder = 1;
-    var maxRight = Math.max(yearMonthRightElement.offsetLeft + yearMonthRightElement.offsetWidth,
-                            daysAreaElement.offsetLeft + maxCellWidth * 7 + DaysAreaContainerBorder);
+    var main = $("main");
+    var yearMonthEnd;
+    var daysAreaEnd;
+    if (global.params.isRTL) {
+        var startOffset = main.offsetLeft + main.offsetWidth;
+        yearMonthEnd = startOffset - yearMonthRightElement.offsetLeft;
+        daysAreaEnd = startOffset - (daysAreaElement.offsetLeft + daysAreaElement.offsetWidth) + maxCellWidth * 7 + DaysAreaContainerBorder;
+    } else {
+        yearMonthEnd = yearMonthRightElement.offsetLeft + yearMonthRightElement.offsetWidth;
+        daysAreaEnd = daysAreaElement.offsetLeft + maxCellWidth * 7 + DaysAreaContainerBorder;
+    }
+
+    var maxEnd = Math.max(yearMonthEnd, daysAreaEnd);
     var MainPadding = 6;
     var MainBorder = 1;
-    var desiredBodyWidth = maxRight + MainPadding + MainBorder;
+    var desiredBodyWidth = maxEnd + MainPadding + MainBorder;
 
-    var main = $("main");
     var mainHeight = main.offsetHeight;
     main.style.width = "auto";
     daysAreaElement.style.width = "100%";
@@ -355,6 +365,8 @@ function checkLimits() {
 function layout() {
     if (global.params.isRTL)
         document.body.dir = "rtl";
+    else
+        document.body.dir = "ltr";
     var main = $("main");
     var params = global.params;
     main.removeChild(main.firstChild);
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 4fa72577e..b91497553 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -201,6 +201,7 @@ v8 {
         bindings/v8/custom/V8MessagePortCustom.cpp \
         bindings/v8/custom/V8MessageEventCustom.cpp \
         bindings/v8/custom/V8MutationCallbackCustom.cpp \
+        bindings/v8/custom/V8MutationObserverCustom.cpp \
         bindings/v8/custom/V8NamedNodeMapCustom.cpp \
         bindings/v8/custom/V8NamedNodesCollection.cpp \
         bindings/v8/custom/V8NodeCustom.cpp \
@@ -215,7 +216,6 @@ v8 {
         bindings/v8/custom/V8StyleSheetCustom.cpp \
         bindings/v8/custom/V8StyleSheetListCustom.cpp \
         bindings/v8/custom/V8WebKitAnimationCustom.cpp \
-        bindings/v8/custom/V8WebKitMutationObserverCustom.cpp \
         bindings/v8/custom/V8WebKitPointConstructor.cpp \
         bindings/v8/custom/V8WorkerContextCustom.cpp \
         bindings/v8/custom/V8WorkerCustom.cpp \
@@ -333,6 +333,7 @@ v8 {
         bindings/js/JSMessagePortCustom.cpp \
         bindings/js/JSMessagePortCustom.h \
         bindings/js/JSMutationCallbackCustom.cpp \
+        bindings/js/JSMutationObserverCustom.cpp \
         bindings/js/JSNamedNodeMapCustom.cpp \
         bindings/js/JSNodeCustom.cpp \
         bindings/js/JSNodeFilterCondition.cpp \
@@ -360,7 +361,6 @@ v8 {
         bindings/js/JSWebKitAnimationListCustom.cpp \
         bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
         bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
-        bindings/js/JSWebKitMutationObserverCustom.cpp \
         bindings/js/JSWebKitPointCustom.cpp \
         bindings/js/JSXMLHttpRequestCustom.cpp \
         bindings/js/JSXMLHttpRequestUploadCustom.cpp \
@@ -427,6 +427,11 @@ SOURCES += \
     Modules/filesystem/FileWriterSync.cpp \
     Modules/filesystem/LocalFileSystem.cpp \
     Modules/filesystem/WorkerContextFileSystem.cpp \
+    Modules/notifications/DOMWindowNotifications.cpp \
+    Modules/notifications/Notification.cpp \
+    Modules/notifications/NotificationCenter.cpp \
+    Modules/notifications/NotificationController.cpp \
+    Modules/notifications/WorkerContextNotifications.cpp \
     css/CSSAspectRatioValue.cpp \
     css/CSSBorderImageSliceValue.cpp \
     css/CSSBorderImage.cpp \
@@ -502,6 +507,7 @@ SOURCES += \
     css/WebKitCSSKeyframesRule.cpp \
     css/WebKitCSSMatrix.cpp \
     css/WebKitCSSRegionRule.cpp \
+    css/WebKitCSSSVGDocumentValue.cpp \
     css/WebKitCSSShaderValue.cpp \
     css/WebKitCSSTransformValue.cpp \
     dom/ActiveDOMObject.cpp \
@@ -575,6 +581,7 @@ SOURCES += \
     dom/MouseEvent.cpp \
     dom/MouseRelatedEvent.cpp \
     dom/MutationEvent.cpp \
+    dom/MutationObserver.cpp \
     dom/MutationObserverInterestGroup.cpp \
     dom/MutationObserverRegistration.cpp \
     dom/MutationRecord.cpp \
@@ -629,7 +636,6 @@ SOURCES += \
     dom/UserTypingGestureIndicator.cpp \
     dom/ViewportArguments.cpp \
     dom/WebKitAnimationEvent.cpp \
-    dom/WebKitMutationObserver.cpp \
     dom/WebKitNamedFlow.cpp \
     dom/WebKitTransitionEvent.cpp \
     dom/WheelEvent.cpp \
@@ -747,6 +753,7 @@ SOURCES += \
     html/HTMLCollection.cpp \
     html/HTMLDListElement.cpp \
     html/HTMLDataListElement.cpp \
+    html/HTMLDialogElement.cpp \
     html/HTMLDirectoryElement.cpp \
     html/HTMLDetailsElement.cpp \
     html/HTMLDivElement.cpp \
@@ -998,11 +1005,6 @@ SOURCES += \
     loader/SubresourceLoader.cpp \
     loader/TextResourceDecoder.cpp \
     loader/ThreadableLoader.cpp \
-    notifications/DOMWindowNotifications.cpp \
-    notifications/Notification.cpp \
-    notifications/NotificationCenter.cpp \
-    notifications/NotificationController.cpp \
-    notifications/WorkerContextNotifications.cpp \
     page/animation/AnimationBase.cpp \
     page/animation/AnimationController.cpp \
     page/animation/CompositeAnimation.cpp \
@@ -1075,6 +1077,7 @@ SOURCES += \
     platform/Arena.cpp \
     platform/text/Base64.cpp \
     platform/text/BidiContext.cpp \
+    platform/text/DateTimeFormat.cpp \
     platform/text/Hyphenation.cpp \
     platform/text/LocaleToScriptMappingDefault.cpp \
     platform/text/LocalizedDateNone.cpp \
@@ -1585,6 +1588,13 @@ HEADERS += \
     Modules/geolocation/PositionErrorCallback.h \
     Modules/geolocation/PositionOptions.h \
     \
+    Modules/notifications/DOMWindowNotifications.h \
+    Modules/notifications/Notification.h \
+    Modules/notifications/NotificationCenter.h \
+    Modules/notifications/NotificationClient.h \
+    Modules/notifications/NotificationController.h \
+    Modules/notifications/WorkerContextNotifications.h \
+    \
     Modules/webdatabase/AbstractDatabase.h \
     Modules/webdatabase/ChangeVersionWrapper.h \
     Modules/webdatabase/DOMWindowWebDatabase.h \
@@ -1686,6 +1696,7 @@ HEADERS += \
     css/WebKitCSSKeyframesRule.h \
     css/WebKitCSSMatrix.h \
     css/WebKitCSSRegionRule.h \
+    css/WebKitCSSSVGDocumentValue.h \
     css/WebKitCSSShaderValue.h \
     css/WebKitCSSTransformValue.h \
     dom/ActiveDOMObject.h \
@@ -1757,6 +1768,7 @@ HEADERS += \
     dom/MouseRelatedEvent.h \
     dom/MutationCallback.h \
     dom/MutationEvent.h \
+    dom/MutationObserver.h \
     dom/MutationObserverRegistration.h \
     dom/MutationRecord.h \
     dom/NamedNodeMap.h \
@@ -1805,7 +1817,6 @@ HEADERS += \
     dom/UserGestureIndicator.h \
     dom/ViewportArguments.h \
     dom/WebKitAnimationEvent.h \
-    dom/WebKitMutationObserver.h \
     dom/WebKitNamedFlow.h \
     dom/WebKitTransitionEvent.h \
     dom/WheelEvent.h \
@@ -1914,6 +1925,7 @@ HEADERS += \
     html/HTMLButtonElement.h \
     html/HTMLCanvasElement.h \
     html/HTMLCollection.h \
+    html/HTMLDialogElement.h \
     html/HTMLDirectoryElement.h \
     html/HTMLDetailsElement.h \
     html/HTMLDivElement.h \
@@ -2148,12 +2160,6 @@ HEADERS += \
     mathml/MathMLInlineContainerElement.h \
     mathml/MathMLMathElement.h \
     mathml/MathMLTextElement.h \
-    notifications/DOMWindowNotifications.h \
-    notifications/Notification.h \
-    notifications/NotificationCenter.h \
-    notifications/NotificationClient.h \
-    notifications/NotificationController.h \
-    notifications/WorkerContextNotifications.h \
     page/animation/AnimationBase.h \
     page/animation/AnimationController.h \
     page/animation/CompositeAnimation.h \
@@ -2267,6 +2273,7 @@ HEADERS += \
     platform/graphics/filters/LightSource.h \
     platform/graphics/filters/SourceAlpha.h \
     platform/graphics/filters/SourceGraphic.h \
+    platform/graphics/filters/arm/NEONHelpers.h \
     platform/graphics/filters/arm/FECompositeArithmeticNEON.h \
     platform/graphics/filters/arm/FEGaussianBlurNEON.h \
     platform/graphics/filters/arm/FELightingNEON.h \
@@ -2300,6 +2307,7 @@ HEADERS += \
     platform/graphics/Path.h \
     platform/graphics/PathTraversalState.h \
     platform/graphics/Pattern.h \
+    platform/graphics/PlatformLayer.h \
     platform/graphics/Region.h \
     platform/graphics/RoundedRect.h \
     platform/graphics/qt/FontCustomPlatformData.h \
@@ -2309,6 +2317,14 @@ HEADERS += \
     platform/graphics/ShadowBlur.h \
     platform/graphics/SimpleFontData.h \
     platform/graphics/surfaces/GraphicsSurface.h \
+    platform/graphics/texmap/GraphicsLayerTextureMapper.h \
+    platform/graphics/texmap/LayerTransform.h \
+    platform/graphics/texmap/TextureMapper.h \
+    platform/graphics/texmap/TextureMapperAnimation.h \
+    platform/graphics/texmap/TextureMapperBackingStore.h \
+    platform/graphics/texmap/TextureMapperImageBuffer.h \
+    platform/graphics/texmap/TextureMapperLayer.h \
+    platform/graphics/texmap/TextureMapperPlatformLayer.h \
     platform/graphics/Tile.h \
     platform/graphics/TiledBackingStore.h \
     platform/graphics/TiledBackingStoreClient.h \
@@ -2385,6 +2401,7 @@ HEADERS += \
     platform/network/ResourceResponseBase.h \
     platform/network/qt/DnsPrefetchHelper.h \
     platform/network/qt/NetworkStateNotifierPrivate.h \
+    platform/PlatformExportMacros.h \
     platform/PlatformTouchEvent.h \
     platform/PlatformTouchPoint.h \
     platform/PopupMenu.h \
@@ -2410,6 +2427,7 @@ HEADERS += \
     platform/sql/SQLValue.h \
     platform/text/Base64.h \
     platform/text/BidiContext.h \
+    platform/text/DateTimeFormat.h \
     platform/text/DecodeEscapeSequences.h \
     platform/text/Hyphenation.h \
     platform/text/QuotedPrintable.h \
@@ -2917,6 +2935,13 @@ SOURCES += \
     platform/graphics/qt/PathQt.cpp \
     platform/graphics/qt/PatternQt.cpp \
     platform/graphics/qt/StillImageQt.cpp \
+    platform/graphics/texmap/GraphicsLayerTextureMapper.cpp \
+    platform/graphics/texmap/LayerTransform.cpp \
+    platform/graphics/texmap/TextureMapper.cpp \
+    platform/graphics/texmap/TextureMapperAnimation.cpp \
+    platform/graphics/texmap/TextureMapperBackingStore.cpp \
+    platform/graphics/texmap/TextureMapperImageBuffer.cpp \
+    platform/graphics/texmap/TextureMapperLayer.cpp \
     platform/network/MIMESniffing.cpp \
     platform/network/qt/CredentialStorageQt.cpp \
     platform/network/qt/ResourceHandleQt.cpp \
@@ -3451,7 +3476,6 @@ contains(DEFINES, ENABLE_FILTERS=1) {
         platform/graphics/filters/SourceAlpha.cpp \
         platform/graphics/filters/SourceGraphic.cpp \
         platform/graphics/filters/arm/FELightingNEON.cpp \
-        platform/graphics/filters/arm/FEGaussianBlurNEON.cpp \
 }
 
 contains(DEFINES, ENABLE_MATHML=1) {
@@ -3494,7 +3518,7 @@ contains(DEFINES, HAVE_QRAWFONT=1) {
         platform/graphics/qt/FontQt4.cpp
 }
 
-contains(DEFINES, ENABLE_FONT_BOOSTING=1) {
+contains(DEFINES, ENABLE_TEXT_AUTOSIZING=1) {
     SOURCES += # FIXME!
 }
 
@@ -3881,11 +3905,6 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/WebGLTexture.h \
         html/canvas/WebGLUniformLocation.h \
         html/canvas/WebGLVertexArrayObjectOES.h \
-        platform/graphics/ANGLEWebKitBridge.h \
-        platform/graphics/Extensions3D.h \
-        platform/graphics/GraphicsContext3D.h \
-        platform/graphics/gpu/DrawingBuffer.h \
-        platform/graphics/qt/Extensions3DQt.h
 
     v8 {
         SOURCES += \
@@ -3923,155 +3942,178 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/OESVertexArrayObject.cpp \
         html/canvas/WebGLTexture.cpp \
         html/canvas/WebGLUniformLocation.cpp \
-        html/canvas/WebGLVertexArrayObjectOES.cpp \
+        html/canvas/WebGLVertexArrayObjectOES.cpp
+}
+
+contains(DEFINES, WTF_USE_3D_GRAPHICS=1) {
+    HEADERS += \
+        platform/graphics/ANGLEWebKitBridge.h \
+        platform/graphics/Extensions3D.h \
+        platform/graphics/GraphicsContext3D.h \
+        platform/graphics/gpu/DrawingBuffer.h \
+        platform/graphics/opengl/Extensions3DOpenGL.h \
+        platform/graphics/texmap/TextureMapperGL.h \
+        platform/graphics/texmap/TextureMapperShaderManager.h
+
+    SOURCES += \
         platform/graphics/ANGLEWebKitBridge.cpp \
         platform/graphics/GraphicsContext3D.cpp \
         platform/graphics/gpu/DrawingBuffer.cpp \
         platform/graphics/gpu/qt/DrawingBufferQt.cpp \
-        platform/graphics/qt/GraphicsContext3DQt.cpp
+        platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp \
+        platform/graphics/opengl/Extensions3DOpenGLCommon.cpp \
+        platform/graphics/qt/GraphicsContext3DQt.cpp \
+        platform/graphics/texmap/TextureMapperGL.cpp \
+        platform/graphics/texmap/TextureMapperShaderManager.cpp
 
     INCLUDEPATH += $$PWD/platform/graphics/gpu
 
     contains(QT_CONFIG, opengl) | contains(QT_CONFIG, opengles2) {
         !contains(QT_CONFIG, opengles2) {
-            SOURCES += platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+            SOURCES += \
+               platform/graphics/opengl/GraphicsContext3DOpenGL.cpp \
+               platform/graphics/opengl/Extensions3DOpenGL.cpp
         } else {
-            SOURCES += platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp
+            SOURCES += \
+               platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp \
+               platform/graphics/opengl/Extensions3DOpenGLES.cpp
         }
 
         HEADERS += platform/graphics/opengl/Extensions3DOpenGL.h
 
         SOURCES += \
-            platform/graphics/opengl/Extensions3DOpenGL.cpp \
+            platform/graphics/opengl/Extensions3DOpenGLCommon.cpp \
             platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+    }
 
-        ANGLE_DIR = $$replace(PWD, "WebCore", "ThirdParty/ANGLE")
+    ANGLE_DIR = $$replace(PWD, "WebCore", "ThirdParty/ANGLE")
 
-        INCLUDEPATH += $$ANGLE_DIR/src $$ANGLE_DIR/include
+    INCLUDEPATH += $$ANGLE_DIR/src $$ANGLE_DIR/include
 
-        ANGLE_HEADERS += \
-            $$ANGLE_DIR/src/compiler/BaseTypes.h \
-            $$ANGLE_DIR/src/compiler/BuiltInFunctionEmulator.h \
-            $$ANGLE_DIR/src/compiler/Common.h \
-            $$ANGLE_DIR/src/compiler/ConstantUnion.h \
-            $$ANGLE_DIR/src/compiler/debug.h \
-            $$ANGLE_DIR/src/compiler/DetectRecursion.h \
-            $$ANGLE_DIR/src/compiler/ExtensionBehavior.h \
-            $$ANGLE_DIR/src/compiler/ForLoopUnroll.h \
-            $$ANGLE_DIR/src/compiler/glslang.h \
-            $$ANGLE_DIR/src/compiler/glslang_tab.h \
-            $$ANGLE_DIR/src/compiler/InfoSink.h \
-            $$ANGLE_DIR/src/compiler/InitializeDll.h \
-            $$ANGLE_DIR/src/compiler/InitializeGlobals.h \
-            $$ANGLE_DIR/src/compiler/Initialize.h \
-            $$ANGLE_DIR/src/compiler/InitializeParseContext.h \
-            $$ANGLE_DIR/src/compiler/intermediate.h \
-            $$ANGLE_DIR/src/compiler/localintermediate.h \
-            $$ANGLE_DIR/src/compiler/MMap.h \
-            $$ANGLE_DIR/src/compiler/MapLongVariableNames.h \
-            $$ANGLE_DIR/src/compiler/osinclude.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/atom.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/compile.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/cpp.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/length_limits.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/memory.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/parser.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/preprocess.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/scanner.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/slglobals.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/symbols.h \
-            $$ANGLE_DIR/src/compiler/preprocessor/tokens.h \
-            $$ANGLE_DIR/src/compiler/OutputESSL.h \
-            $$ANGLE_DIR/src/compiler/OutputGLSL.h \
-            $$ANGLE_DIR/src/compiler/OutputGLSLBase.h \
-            $$ANGLE_DIR/src/compiler/OutputHLSL.h \
-            $$ANGLE_DIR/src/compiler/ParseHelper.h \
-            $$ANGLE_DIR/src/compiler/PoolAlloc.h \
-            $$ANGLE_DIR/src/compiler/QualifierAlive.h \
-            $$ANGLE_DIR/src/compiler/RemoveTree.h \
-            $$ANGLE_DIR/src/compiler/SearchSymbol.h \
-            $$ANGLE_DIR/src/compiler/ShHandle.h \
-            $$ANGLE_DIR/src/compiler/SymbolTable.h \
-            $$ANGLE_DIR/src/compiler/TranslatorESSL.h \
-            $$ANGLE_DIR/src/compiler/TranslatorGLSL.h \
-            $$ANGLE_DIR/src/compiler/TranslatorHLSL.h \
-            $$ANGLE_DIR/src/compiler/Types.h \
-            $$ANGLE_DIR/src/compiler/UnfoldSelect.h \
-            $$ANGLE_DIR/src/compiler/util.h \
-            $$ANGLE_DIR/src/compiler/ValidateLimitations.h \
-            $$ANGLE_DIR/src/compiler/VariableInfo.h \
-            $$ANGLE_DIR/src/compiler/VersionGLSL.h
+    ANGLE_HEADERS += \
+        $$ANGLE_DIR/src/compiler/BaseTypes.h \
+        $$ANGLE_DIR/src/compiler/BuiltInFunctionEmulator.h \
+        $$ANGLE_DIR/src/compiler/Common.h \
+        $$ANGLE_DIR/src/compiler/ConstantUnion.h \
+        $$ANGLE_DIR/src/compiler/debug.h \
+        $$ANGLE_DIR/src/compiler/DetectRecursion.h \
+        $$ANGLE_DIR/src/compiler/ExtensionBehavior.h \
+        $$ANGLE_DIR/src/compiler/ForLoopUnroll.h \
+        $$ANGLE_DIR/src/compiler/glslang.h \
+        $$ANGLE_DIR/src/compiler/glslang_tab.h \
+        $$ANGLE_DIR/src/compiler/InfoSink.h \
+        $$ANGLE_DIR/src/compiler/InitializeDll.h \
+        $$ANGLE_DIR/src/compiler/InitializeGlobals.h \
+        $$ANGLE_DIR/src/compiler/Initialize.h \
+        $$ANGLE_DIR/src/compiler/InitializeParseContext.h \
+        $$ANGLE_DIR/src/compiler/intermediate.h \
+        $$ANGLE_DIR/src/compiler/localintermediate.h \
+        $$ANGLE_DIR/src/compiler/MMap.h \
+        $$ANGLE_DIR/src/compiler/MapLongVariableNames.h \
+        $$ANGLE_DIR/src/compiler/osinclude.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/atom.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/compile.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/cpp.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/length_limits.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/memory.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/parser.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/preprocess.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/scanner.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/slglobals.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/symbols.h \
+        $$ANGLE_DIR/src/compiler/preprocessor/tokens.h \
+        $$ANGLE_DIR/src/compiler/OutputESSL.h \
+        $$ANGLE_DIR/src/compiler/OutputGLSL.h \
+        $$ANGLE_DIR/src/compiler/OutputGLSLBase.h \
+        $$ANGLE_DIR/src/compiler/OutputHLSL.h \
+        $$ANGLE_DIR/src/compiler/ParseHelper.h \
+        $$ANGLE_DIR/src/compiler/PoolAlloc.h \
+        $$ANGLE_DIR/src/compiler/QualifierAlive.h \
+        $$ANGLE_DIR/src/compiler/RemoveTree.h \
+        $$ANGLE_DIR/src/compiler/SearchSymbol.h \
+        $$ANGLE_DIR/src/compiler/ShHandle.h \
+        $$ANGLE_DIR/src/compiler/SymbolTable.h \
+        $$ANGLE_DIR/src/compiler/TranslatorESSL.h \
+        $$ANGLE_DIR/src/compiler/TranslatorGLSL.h \
+        $$ANGLE_DIR/src/compiler/TranslatorHLSL.h \
+        $$ANGLE_DIR/src/compiler/Types.h \
+        $$ANGLE_DIR/src/compiler/UnfoldSelect.h \
+        $$ANGLE_DIR/src/compiler/util.h \
+        $$ANGLE_DIR/src/compiler/ValidateLimitations.h \
+        $$ANGLE_DIR/src/compiler/VariableInfo.h \
+        $$ANGLE_DIR/src/compiler/VersionGLSL.h
 
-        HEADERS += $$ANGLE_HEADERS
+    HEADERS += $$ANGLE_HEADERS
 
-        ANGLE_SOURCES += \
-            $$ANGLE_DIR/src/compiler/BuiltInFunctionEmulator.cpp \
-            $$ANGLE_DIR/src/compiler/CodeGenGLSL.cpp \
-            $$ANGLE_DIR/src/compiler/Compiler.cpp \
-            $$ANGLE_DIR/src/compiler/debug.cpp \
-            $$ANGLE_DIR/src/compiler/DetectRecursion.cpp \
-            $$ANGLE_DIR/src/compiler/ForLoopUnroll.cpp \
-            $$ANGLE_DIR/src/compiler/glslang_lex.cpp \
-            $$ANGLE_DIR/src/compiler/glslang_tab.cpp \
-            $$ANGLE_DIR/src/compiler/InfoSink.cpp \
-            $$ANGLE_DIR/src/compiler/Initialize.cpp \
-            $$ANGLE_DIR/src/compiler/InitializeDll.cpp \
-            $$ANGLE_DIR/src/compiler/Intermediate.cpp \
-            $$ANGLE_DIR/src/compiler/intermOut.cpp \
-            $$ANGLE_DIR/src/compiler/IntermTraverse.cpp \
-            $$ANGLE_DIR/src/compiler/MapLongVariableNames.cpp \
-            $$ANGLE_DIR/src/compiler/ossource_posix.cpp \
-            $$ANGLE_DIR/src/compiler/OutputESSL.cpp \
-            $$ANGLE_DIR/src/compiler/OutputGLSL.cpp \
-            $$ANGLE_DIR/src/compiler/OutputGLSLBase.cpp \
-            $$ANGLE_DIR/src/compiler/OutputHLSL.cpp \
-            $$ANGLE_DIR/src/compiler/parseConst.cpp \
-            $$ANGLE_DIR/src/compiler/ParseHelper.cpp \
-            $$ANGLE_DIR/src/compiler/PoolAlloc.cpp \
-            $$ANGLE_DIR/src/compiler/QualifierAlive.cpp \
-            $$ANGLE_DIR/src/compiler/RemoveTree.cpp \
-            $$ANGLE_DIR/src/compiler/SearchSymbol.cpp \
-            $$ANGLE_DIR/src/compiler/ShaderLang.cpp \
-            $$ANGLE_DIR/src/compiler/SymbolTable.cpp \
-            $$ANGLE_DIR/src/compiler/TranslatorESSL.cpp \
-            $$ANGLE_DIR/src/compiler/TranslatorGLSL.cpp \
-            $$ANGLE_DIR/src/compiler/TranslatorHLSL.cpp \
-            $$ANGLE_DIR/src/compiler/UnfoldSelect.cpp \
-            $$ANGLE_DIR/src/compiler/util.cpp \
-            $$ANGLE_DIR/src/compiler/ValidateLimitations.cpp \
-            $$ANGLE_DIR/src/compiler/VariableInfo.cpp \
-            $$ANGLE_DIR/src/compiler/VersionGLSL.cpp
+    ANGLE_SOURCES += \
+        $$ANGLE_DIR/src/compiler/BuiltInFunctionEmulator.cpp \
+        $$ANGLE_DIR/src/compiler/CodeGenGLSL.cpp \
+        $$ANGLE_DIR/src/compiler/Compiler.cpp \
+        $$ANGLE_DIR/src/compiler/debug.cpp \
+        $$ANGLE_DIR/src/compiler/DetectRecursion.cpp \
+        $$ANGLE_DIR/src/compiler/ForLoopUnroll.cpp \
+        $$ANGLE_DIR/src/compiler/glslang_lex.cpp \
+        $$ANGLE_DIR/src/compiler/glslang_tab.cpp \
+        $$ANGLE_DIR/src/compiler/InfoSink.cpp \
+        $$ANGLE_DIR/src/compiler/Initialize.cpp \
+        $$ANGLE_DIR/src/compiler/InitializeDll.cpp \
+        $$ANGLE_DIR/src/compiler/Intermediate.cpp \
+        $$ANGLE_DIR/src/compiler/intermOut.cpp \
+        $$ANGLE_DIR/src/compiler/IntermTraverse.cpp \
+        $$ANGLE_DIR/src/compiler/MapLongVariableNames.cpp \
+        $$ANGLE_DIR/src/compiler/ossource_posix.cpp \
+        $$ANGLE_DIR/src/compiler/OutputESSL.cpp \
+        $$ANGLE_DIR/src/compiler/OutputGLSL.cpp \
+        $$ANGLE_DIR/src/compiler/OutputGLSLBase.cpp \
+        $$ANGLE_DIR/src/compiler/OutputHLSL.cpp \
+        $$ANGLE_DIR/src/compiler/parseConst.cpp \
+        $$ANGLE_DIR/src/compiler/ParseHelper.cpp \
+        $$ANGLE_DIR/src/compiler/PoolAlloc.cpp \
+        $$ANGLE_DIR/src/compiler/QualifierAlive.cpp \
+        $$ANGLE_DIR/src/compiler/RemoveTree.cpp \
+        $$ANGLE_DIR/src/compiler/SearchSymbol.cpp \
+        $$ANGLE_DIR/src/compiler/ShaderLang.cpp \
+        $$ANGLE_DIR/src/compiler/SymbolTable.cpp \
+        $$ANGLE_DIR/src/compiler/TranslatorESSL.cpp \
+        $$ANGLE_DIR/src/compiler/TranslatorGLSL.cpp \
+        $$ANGLE_DIR/src/compiler/TranslatorHLSL.cpp \
+        $$ANGLE_DIR/src/compiler/UnfoldSelect.cpp \
+        $$ANGLE_DIR/src/compiler/util.cpp \
+        $$ANGLE_DIR/src/compiler/ValidateLimitations.cpp \
+        $$ANGLE_DIR/src/compiler/VariableInfo.cpp \
+        $$ANGLE_DIR/src/compiler/VersionGLSL.cpp
 
-        SOURCES += \
-            $$ANGLE_DIR/src/compiler/preprocessor/atom.c \
-            $$ANGLE_DIR/src/compiler/preprocessor/cpp.c \
-            $$ANGLE_DIR/src/compiler/preprocessor/cppstruct.c \
-            $$ANGLE_DIR/src/compiler/preprocessor/memory.c \
-            $$ANGLE_DIR/src/compiler/preprocessor/scanner.c \
-            $$ANGLE_DIR/src/compiler/preprocessor/symbols.c \
-            $$ANGLE_DIR/src/compiler/preprocessor/tokens.c
+    SOURCES += \
+        $$ANGLE_DIR/src/compiler/preprocessor/atom.c \
+        $$ANGLE_DIR/src/compiler/preprocessor/cpp.c \
+        $$ANGLE_DIR/src/compiler/preprocessor/cppstruct.c \
+        $$ANGLE_DIR/src/compiler/preprocessor/memory.c \
+        $$ANGLE_DIR/src/compiler/preprocessor/scanner.c \
+        $$ANGLE_DIR/src/compiler/preprocessor/symbols.c \
+        $$ANGLE_DIR/src/compiler/preprocessor/tokens.c
 
-        *g++* {
-            ANGLE_CFLAGS += -Wno-unused-variable
-            ANGLE_CFLAGS += -Wno-missing-noreturn
-            ANGLE_CFLAGS += -Wno-unused-function
-            ANGLE_CFLAGS += -Wno-reorder
-            ANGLE_CFLAGS += -Wno-error
+    *g++* {
+        ANGLE_CFLAGS += -Wno-unused-variable
+        ANGLE_CFLAGS += -Wno-missing-noreturn
+        ANGLE_CFLAGS += -Wno-unused-function
+        ANGLE_CFLAGS += -Wno-reorder
+        ANGLE_CFLAGS += -Wno-error
 
-            angle_cxx.commands = $$QMAKE_CXX -c $(CXXFLAGS) $$ANGLE_CFLAGS $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
-            angle_cxx.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$$QMAKE_EXT_OBJ
-            anglc_cxx.dependency_type = TYPE_C
-            angle_cxx.depends = $$ANGLE_HEADERS
-            angle_cxx.input = ANGLE_SOURCES
-            QMAKE_EXTRA_COMPILERS += angle_cxx
-        } else {
-            SOURCES += $$ANGLE_SOURCES
-        }
+        angle_cxx.commands = $$QMAKE_CXX -c $(CXXFLAGS) $$ANGLE_CFLAGS $(INCPATH) ${QMAKE_FILE_IN} -o ${QMAKE_FILE_OUT}
+        angle_cxx.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$$QMAKE_EXT_OBJ
+        anglc_cxx.dependency_type = TYPE_C
+        angle_cxx.depends = $$ANGLE_HEADERS
+        angle_cxx.input = ANGLE_SOURCES
+        QMAKE_EXTRA_COMPILERS += angle_cxx
+    } else {
+        SOURCES += $$ANGLE_SOURCES
     }
 
     CONFIG += opengl-shims
+    INCLUDEPATH += platform/graphics/gpu
 }
 
+
 contains(DEFINES, ENABLE_MHTML=1) {
 
     INCLUDEPATH += $$PWD/loader/archive/mhtml
@@ -4126,42 +4168,6 @@ win32:!win32-g++*:contains(QMAKE_HOST.arch, x86_64):{
    }
 }
 
-contains(CONFIG, texmap) {
-    HEADERS += \
-        platform/graphics/texmap/GraphicsLayerTextureMapper.h \
-        platform/graphics/texmap/LayerTransform.h \
-        platform/graphics/texmap/TextureMapper.h \
-        platform/graphics/texmap/TextureMapperAnimation.h \
-        platform/graphics/texmap/TextureMapperBackingStore.h \
-        platform/graphics/texmap/TextureMapperImageBuffer.h \
-        platform/graphics/texmap/TextureMapperLayer.h \
-        platform/graphics/texmap/TextureMapperPlatformLayer.h
-
-    SOURCES += \
-        platform/graphics/texmap/LayerTransform.cpp \
-        platform/graphics/texmap/TextureMapper.cpp \
-        platform/graphics/texmap/TextureMapperAnimation.cpp \
-        platform/graphics/texmap/TextureMapperBackingStore.cpp \
-        platform/graphics/texmap/TextureMapperImageBuffer.cpp \
-        platform/graphics/texmap/TextureMapperLayer.cpp \
-        platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
-
-    contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1) {
-        HEADERS += \
-            platform/graphics/texmap/TextureMapperGL.h \
-            platform/graphics/texmap/TextureMapperShaderManager.h
-
-        SOURCES += \
-            platform/graphics/texmap/TextureMapperGL.cpp \
-            platform/graphics/texmap/TextureMapperShaderManager.cpp
-
-        CONFIG += opengl-shims
-    }
-} else {
-    HEADERS += platform/graphics/qt/GraphicsLayerQt.h
-    SOURCES += platform/graphics/qt/GraphicsLayerQt.cpp
-}
-
 contains(CONFIG, opengl-shims) {
     HEADERS += platform/graphics/OpenGLShims.h
     SOURCES += platform/graphics/OpenGLShims.cpp
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index ce690efff..7fe841965 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -116,6 +116,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/js/JSMessageEventCustom.cpp
     bindings/js/JSMessagePortCustom.cpp
     bindings/js/JSMutationCallbackCustom.cpp
+    bindings/js/JSMutationObserverCustom.cpp
     bindings/js/JSNamedNodeMapCustom.cpp
     bindings/js/JSNodeCustom.cpp
     bindings/js/JSNodeFilterCondition.cpp
@@ -142,7 +143,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/js/JSWebKitAnimationListCustom.cpp
     bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp
     bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp
-    bindings/js/JSWebKitMutationObserverCustom.cpp
     bindings/js/JSWebKitPointCustom.cpp
     bindings/js/JSXMLHttpRequestCustom.cpp
     bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -330,24 +330,18 @@ ADD_CUSTOM_COMMAND(
     COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
-FOREACH (_file ${WebCore_IDL_FILES})
-    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.h
-        MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
-        VERBATIM)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp)
-ENDFOREACH ()
-
-FOREACH (_file ${WebCoreTestSupport_IDL_FILES})
-    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.h
-        MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
-        VERBATIM)
-    LIST(APPEND WebCoreTestSupport_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp)
-ENDFOREACH ()
+GENERATE_BINDINGS(WebCore_SOURCES
+    "${WebCore_IDL_FILES}"
+    "${WEBCORE_DIR}"
+    "${IDL_INCLUDES}"
+    "${FEATURE_DEFINES_JAVASCRIPT}"
+    ${DERIVED_SOURCES_WEBCORE_DIR} JS JS
+    ${SUPPLEMENTAL_DEPENDENCY_FILE})
+
+GENERATE_BINDINGS(WebCoreTestSupport_SOURCES
+    "${WebCoreTestSupport_IDL_FILES}"
+    "${WEBCORE_DIR}"
+    "${IDL_INCLUDES}"
+    "${FEATURE_DEFINES_JAVASCRIPT}"
+    ${DERIVED_SOURCES_WEBCORE_DIR} JS JS
+    ${SUPPLEMENTAL_DEPENDENCY_FILE})
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index 6775e952d..239cb4ef1 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -131,6 +131,7 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8MessageEventCustom.cpp
     bindings/v8/custom/V8MessagePortCustom.cpp
     bindings/v8/custom/V8MutationCallbackCustom.cpp
+    bindings/v8/custom/V8MutationObserverCustom.cpp
     bindings/v8/custom/V8NamedNodeMapCustom.cpp
     bindings/v8/custom/V8NamedNodesCollection.cpp
     bindings/v8/custom/V8NodeCustom.cpp
@@ -151,7 +152,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8Uint8ArrayCustom.cpp
     bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
     bindings/v8/custom/V8WebKitAnimationCustom.cpp
-    bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
     bindings/v8/custom/V8WebKitPointConstructor.cpp
     bindings/v8/custom/V8WebSocketCustom.cpp
     bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -273,24 +273,18 @@ ADD_CUSTOM_COMMAND(
     COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
-FOREACH (_file ${WebCore_IDL_FILES})
-    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.h
-        MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorV8.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator V8 ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
-        VERBATIM)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp)
-ENDFOREACH ()
+GENERATE_BINDINGS(WebCore_SOURCES
+    "${WebCore_IDL_FILES}"
+    "${WEBCORE_DIR}"
+    "${IDL_INCLUDES}"
+    "${FEATURE_DEFINES_JAVASCRIPT}"
+    ${DERIVED_SOURCES_WEBCORE_DIR} V8 V8
+    ${SUPPLEMENTAL_DEPENDENCY_FILE})
 
-FOREACH (_file ${WebCoreTestSupport_IDL_FILES})
-    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.h
-        MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorV8.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator V8 ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
-        VERBATIM)
-    LIST(APPEND WebCoreTestSupport_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp)
-ENDFOREACH ()
+GENERATE_BINDINGS(WebCoreTestSupport_SOURCES
+    "${WebCoreTestSupport_IDL_FILES}"
+    "${WEBCORE_DIR}"
+    "${IDL_INCLUDES}"
+    "${FEATURE_DEFINES_JAVASCRIPT}"
+    ${DERIVED_SOURCES_WEBCORE_DIR} V8 V8
+    ${SUPPLEMENTAL_DEPENDENCY_FILE})
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index abddfb722..2fa7d5cf7 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -456,6 +456,7 @@ __ZN7WebCore17HistoryController33restoreScrollPositionAndViewStateEv
 __ZN7WebCore17JSDOMGlobalObject6s_infoE
 __ZN7WebCore17RegularExpressionC1ERKN3WTF6StringENS1_19TextCaseSensitivityE
 __ZN7WebCore17RegularExpressionD1Ev
+__ZN7WebCore17ViewportArguments19deprecatedTargetDPIE
 __ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
 __ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
 __ZN7WebCore17userVisibleStringEP5NSURL
@@ -587,7 +588,6 @@ __ZN7WebCore24ComposedShadowTreeWalker11nextSiblingEv
 __ZN7WebCore24ComposedShadowTreeWalker4nextEv
 __ZN7WebCore24ComposedShadowTreeWalker8previousEv
 __ZN7WebCore24ComposedShadowTreeWalker9lastChildEv
-__ZN7WebCore24ComposedShadowTreeWalkerC1EPKNS_4NodeENS0_6PolicyE
 __ZN7WebCore24DocumentMarkerController10markersForEPNS_4NodeENS_14DocumentMarker11MarkerTypesE
 __ZN7WebCore24DocumentMarkerController13removeMarkersENS_14DocumentMarker11MarkerTypesE
 __ZN7WebCore24DocumentMarkerController23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
@@ -607,7 +607,7 @@ __ZN7WebCore25HistoryPropertyListWriter16writeHistoryItemERNS_30BinaryPropertyLi
 __ZN7WebCore25HistoryPropertyListWriter6bufferEm
 __ZN7WebCore25HistoryPropertyListWriterC2Ev
 __ZN7WebCore25addLanguageChangeObserverEPvPFvS0_E
-__ZN7WebCore25computeViewportAttributesENS_17ViewportArgumentsEiiiiNS_7IntSizeE
+__ZN7WebCore25computeViewportAttributesENS_17ViewportArgumentsEiiifNS_7IntSizeE
 __ZN7WebCore26UserTypingGestureIndicator27processingUserTypingGestureEv
 __ZN7WebCore26UserTypingGestureIndicator28focusedElementAtGestureStartEv
 __ZN7WebCore26stopObservingCookieChangesEv
@@ -626,7 +626,6 @@ __ZN7WebCore31CrossOriginPreflightResultCache5emptyEv
 __ZN7WebCore31CrossOriginPreflightResultCache6sharedEv
 __ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjbNS_20TextIteratorBehaviorE
 __ZN7WebCore33stripLeadingAndTrailingHTMLSpacesERKN3WTF6StringE
-__ZN7WebCore36initializeLoggingChannelsIfNecessaryEv
 __ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore40restrictMinimumScaleFactorToViewportSizeERNS_18ViewportAttributesENS_7IntSizeE
@@ -1149,6 +1148,7 @@ __ZNK7WebCore14FrameSelection18isFocusedAndActiveEv
 __ZNK7WebCore14FrameSelection31getClippedVisibleTextRectanglesERN3WTF6VectorINS_9FloatRectELm0EEE
 __ZNK7WebCore14FrameSelection36rootEditableElementOrDocumentElementEv
 __ZNK7WebCore14FrameSelection6boundsEb
+__ZNK7WebCore14InsertionPoint8isActiveEv
 __ZNK7WebCore14RenderListItem10markerTextEv
 __ZNK7WebCore14ResourceHandle10connectionEv
 __ZNK7WebCore14ResourceLoader11frameLoaderEv
@@ -1272,6 +1272,7 @@ __ZNK7WebCore4Node9treeScopeEv
 __ZNK7WebCore4Page10pluginDataEv
 __ZNK7WebCore4Page14renderTreeSizeEv
 __ZNK7WebCore4Page15backForwardListEv
+__ZNK7WebCore4Page17viewportArgumentsEv
 __ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
 __ZNK7WebCore4Page9groupNameEv
 __ZNK7WebCore4Page9pageCountEv
@@ -1976,6 +1977,10 @@ __ZN7WebCore20LogNotYetImplementedE
 __ZNK7WebCore7Element26fastAttributeLookupAllowedERKNS_13QualifiedNameE
 #endif
 
+#if !LOG_DISABLED
+__ZN7WebCore36initializeLoggingChannelsIfNecessaryEv
+#endif // !LOG_DISABLED
+
 #if !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES) && !PLATFORM(IOS)
 __ZN7WebCore7IntSizeC1ERK7_NSSize
 __ZNK7WebCore7IntSizecv7_NSSizeEv
diff --git a/Source/WebCore/WebCore.gyp/.gitignore b/Source/WebCore/WebCore.gyp/.gitignore
index f2f101c65..d0ba3eb0f 100644
--- a/Source/WebCore/WebCore.gyp/.gitignore
+++ b/Source/WebCore/WebCore.gyp/.gitignore
@@ -4,4 +4,8 @@
 *.sln
 *.tmp
 *.vcproj*
+*.vcxproj*
 WebCore.xcodeproj
+webcore_bindings_sources.props
+webcore_bindings_sources.targets
+webcore_bindings_sources.xml
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index cfca7714e..a53117419 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -48,6 +48,8 @@
 
     'enable_wexit_time_destructors': 1,
 
+    'use_harfbuzz_ng%': 0,
+
     'webcore_include_dirs': [
       '../',
       '../..',
@@ -59,6 +61,7 @@
       '../Modules/intents',
       '../Modules/indexeddb',
       '../Modules/mediastream',
+      '../Modules/notifications',
       '../Modules/quota',
       '../Modules/speech',
       '../Modules/webaudio',
@@ -95,7 +98,6 @@
       '../loader/cache',
       '../loader/icon',
       '../mathml',
-      '../notifications',
       '../page',
       '../page/animation',
       '../page/chromium',
@@ -231,6 +233,11 @@
           '../platform/graphics/harfbuzz',
         ],
       }],
+      ['use_x11==1 and use_harfbuzz_ng==1', {
+        'webcore_include_dirs': [
+          '../platform/graphics/harfbuzz/ng',
+        ],
+      }],
       ['OS=="win" and buildtype=="Official"', {
         # On windows official release builds, we try to preserve symbol space.
         'derived_sources_aggregate_files': [
@@ -1047,13 +1054,13 @@
               '--include', '../Modules/indexeddb',
               '--include', '../Modules/intents',
               '--include', '../Modules/mediastream',
+              '--include', '../Modules/notifications',
               '--include', '../Modules/webaudio',
               '--include', '../Modules/webdatabase',
               '--include', '../css',
               '--include', '../dom',
               '--include', '../fileapi',
               '--include', '../html',
-              '--include', '../notifications',
               '--include', '../page',
               '--include', '../plugins',
               '--include', '../storage',
@@ -1566,6 +1573,16 @@
             ['exclude', 'Harfbuzz[^/]+\\.(cpp|h)$'],
           ],
         }],
+        ['use_x11==1 and use_harfbuzz_ng==1', {
+          'sources/': [
+            ['exclude', 'platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz\\.cpp$'],
+            ['exclude', 'platform/graphics/harfbuzz/HarfBuzzSkia\\.cpp$'],
+
+            ['include', 'platform/graphics/harfbuzz/ng/HarfBuzzFace\\.(cpp|h)$'],
+            ['include', 'platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia\\.cpp$'],
+            ['include', 'platform/graphics/harfbuzz/ng/HarfBuzzShaper\\.(cpp|h)$'],
+          ],
+        }],
         ['toolkit_uses_gtk == 1', {
           'sources/': [
             # Cherry-pick files excluded by the broader regular expressions above.
@@ -1648,9 +1665,10 @@
 
             ['include', 'WebKit/mac/WebCoreSupport/WebSystemInterface\\.mm$'],
 
-            # We use LocalizedDateMac.mm instead of LocalizedDateICU.cpp.
+            # We use LocalizedDateMac.cpp with LocaleMac.mm instead of LocalizedDateICU.cpp.
             ['exclude', 'platform/text/LocalizedDateICU\\.cpp$'],
-            ['include', 'platform/text/mac/LocalizedDateMac\\.mm$'],
+            ['include', 'platform/text/mac/LocaleMac\\.mm$'],
+            ['include', 'platform/text/mac/LocalizedDateMac\\.cpp$'],
 
             # The Mac uses platform/mac/KillRingMac.mm instead of the dummy
             # implementation.
@@ -1756,6 +1774,19 @@
         }],
       ],
     },
+    {
+      'target_name': 'webcore_chromium_compositor',
+      'type': 'static_library',
+      'dependencies': [
+        'webcore_prerequisites',
+      ],
+      'defines': [
+        'WEBKIT_IMPLEMENTATION=1',
+      ],
+      'sources': [
+        '<@(webcore_chromium_compositor_files)',
+      ],
+    },
     # The *NEON.cpp files fail to compile when -mthumb is passed. Force
     # them to build in ARM mode.
     # See https://bugs.webkit.org/show_bug.cgi?id=62916.
@@ -2006,10 +2037,12 @@
         'webcore_dom',
         'webcore_html',
         'webcore_platform',
+        'webcore_chromium_compositor',
         'webcore_remaining',
         'webcore_rendering',
         # Exported.
         'webcore_bindings',
+        '../../Platform/Platform.gyp/Platform.gyp:webkit_platform',
         '../../WTF/WTF.gyp/WTF.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
@@ -2019,6 +2052,7 @@
       ],
       'export_dependent_settings': [
         'webcore_bindings',
+        '../../Platform/Platform.gyp/Platform.gyp:webkit_platform',
         '../../WTF/WTF.gyp/WTF.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index 1054e0725..9b68d3ef3 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -12,6 +12,21 @@
             'Modules/geolocation/PositionError.h',
             'Modules/geolocation/PositionErrorCallback.h',
             'Modules/geolocation/PositionOptions.h',
+            'Modules/notifications/NotificationClient.h',
+            'Modules/notifications/NotificationController.h',
+            'Modules/webdatabase/AbstractDatabase.h',
+            'Modules/webdatabase/Database.h',
+            'Modules/webdatabase/DatabaseDetails.h',
+            'Modules/webdatabase/DatabaseTracker.h',
+            'Modules/webdatabase/DatabaseTrackerClient.h',
+            'Modules/webdatabase/SQLError.h',
+            'Modules/webdatabase/SQLResultSet.h',
+            'Modules/webdatabase/SQLResultSetRowList.h',
+            'Modules/webdatabase/SQLStatementCallback.h',
+            'Modules/webdatabase/SQLStatementErrorCallback.h',
+            'Modules/webdatabase/SQLTransaction.h',
+            'Modules/webdatabase/SQLTransactionCallback.h',
+            'Modules/webdatabase/SQLTransactionErrorCallback.h',
             'accessibility/AXObjectCache.h',
             'accessibility/AccessibilityObject.h',
             'bindings/ScriptControllerBase.h',
@@ -199,21 +214,6 @@
             'loader/icon/IconDatabaseBase.h',
             'loader/icon/IconDatabaseClient.h',
             'loader/mac/LoaderNSURLExtras.h',
-            'Modules/webdatabase/AbstractDatabase.h',
-            'Modules/webdatabase/Database.h',
-            'Modules/webdatabase/DatabaseDetails.h',
-            'Modules/webdatabase/DatabaseTracker.h',
-            'Modules/webdatabase/DatabaseTrackerClient.h',
-            'Modules/webdatabase/SQLError.h',
-            'Modules/webdatabase/SQLResultSet.h',
-            'Modules/webdatabase/SQLResultSetRowList.h',
-            'Modules/webdatabase/SQLStatementCallback.h',
-            'Modules/webdatabase/SQLStatementErrorCallback.h',
-            'Modules/webdatabase/SQLTransaction.h',
-            'Modules/webdatabase/SQLTransactionCallback.h',
-            'Modules/webdatabase/SQLTransactionErrorCallback.h',
-            'notifications/NotificationClient.h',
-            'notifications/NotificationController.h',
             'page/Chrome.h',
             'page/ChromeClient.h',
             'page/Console.h',
@@ -394,6 +394,7 @@
             'platform/graphics/MediaPlayer.h',
             'platform/graphics/Path.h',
             'platform/graphics/Pattern.h',
+            'platform/graphics/PlatformLayer.h',
             'platform/graphics/Region.h',
             'platform/graphics/RoundedRect.h',
             'platform/graphics/SimpleFontData.h',
@@ -493,6 +494,7 @@
             'platform/text/BidiRunList.h',
             'platform/text/BidiContext.h',
             'platform/text/BidiResolver.h',
+            'platform/text/DateTimeFormat.h',
             'platform/text/DecodeEscapeSequences.h',
             'platform/text/LineBreakIteratorPoolICU.h',
             'platform/text/LineEnding.h',
@@ -831,6 +833,7 @@
             'Modules/mediastream/MediaStreamEvent.idl',
             'Modules/mediastream/MediaStreamList.idl',
             'Modules/mediastream/MediaStreamTrack.idl',
+            'Modules/mediastream/MediaStreamTrackEvent.idl',
             'Modules/mediastream/MediaStreamTrackList.idl',
             'Modules/mediastream/NavigatorMediaStream.idl',
             'Modules/mediastream/NavigatorUserMediaError.idl',
@@ -839,6 +842,11 @@
             'Modules/mediastream/PeerConnection00.idl',
             'Modules/mediastream/SessionDescription.idl',
             'Modules/mediastream/SignalingCallback.idl',
+            'Modules/notifications/DOMWindowNotifications.idl',
+            'Modules/notifications/Notification.idl',
+            'Modules/notifications/NotificationCenter.idl',
+            'Modules/notifications/NotificationPermissionCallback.idl',
+            'Modules/notifications/WorkerContextNotifications.idl',
             'Modules/quota/DOMWindowQuota.idl',
             'Modules/quota/StorageInfo.idl',
             'Modules/quota/StorageInfoErrorCallback.idl',
@@ -966,6 +974,7 @@
             'dom/MouseEvent.idl',
             'dom/MutationCallback.idl',
             'dom/MutationEvent.idl',
+            'dom/MutationObserver.idl',
             'dom/MutationRecord.idl',
             'dom/NamedNodeMap.idl',
             'dom/Node.idl',
@@ -991,7 +1000,6 @@
             'dom/TreeWalker.idl',
             'dom/UIEvent.idl',
             'dom/WebKitAnimationEvent.idl',
-            'dom/WebKitMutationObserver.idl',
             'dom/WebKitNamedFlow.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
@@ -1023,6 +1031,7 @@
             'html/HTMLDListElement.idl',
             'html/HTMLDataListElement.idl',
             'html/HTMLDetailsElement.idl',
+            'html/HTMLDialogElement.idl',
             'html/HTMLDirectoryElement.idl',
             'html/HTMLDivElement.idl',
             'html/HTMLDocument.idl',
@@ -1143,11 +1152,6 @@
             'inspector/ScriptProfile.idl',
             'inspector/ScriptProfileNode.idl',
             'loader/appcache/DOMApplicationCache.idl',
-            'notifications/DOMWindowNotifications.idl',
-            'notifications/Notification.idl',
-            'notifications/NotificationCenter.idl',
-            'notifications/NotificationPermissionCallback.idl',
-            'notifications/WorkerContextNotifications.idl',
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
@@ -1547,6 +1551,8 @@
             'Modules/mediastream/MediaStreamRegistry.h',
             'Modules/mediastream/MediaStreamTrack.cpp',
             'Modules/mediastream/MediaStreamTrack.h',
+            'Modules/mediastream/MediaStreamTrackEvent.cpp',
+            'Modules/mediastream/MediaStreamTrackEvent.h',
             'Modules/mediastream/MediaStreamTrackList.cpp',
             'Modules/mediastream/MediaStreamTrackList.h',
             'Modules/mediastream/NavigatorMediaStream.cpp',
@@ -1564,6 +1570,17 @@
             'Modules/mediastream/UserMediaController.h',
             'Modules/mediastream/UserMediaRequest.cpp',
             'Modules/mediastream/UserMediaRequest.h',
+            'Modules/notifications/DOMWindowNotifications.cpp',
+            'Modules/notifications/DOMWindowNotifications.h',
+            'Modules/notifications/Notification.cpp',
+            'Modules/notifications/Notification.h',
+            'Modules/notifications/NotificationCenter.cpp',
+            'Modules/notifications/NotificationCenter.h',
+            'Modules/notifications/NotificationController.cpp',
+            'Modules/notifications/NotificationController.h',
+            'Modules/notifications/NotificationPermissionCallback.h',
+            'Modules/notifications/WorkerContextNotifications.cpp',
+            'Modules/notifications/WorkerContextNotifications.h',
             'Modules/quota/DOMWindowQuota.cpp',
             'Modules/quota/DOMWindowQuota.h',
             'Modules/quota/StorageInfo.cpp',
@@ -2015,6 +2032,7 @@
             'bindings/js/JSMessagePortCustom.cpp',
             'bindings/js/JSMessagePortCustom.h',
             'bindings/js/JSMutationCallbackCustom.cpp',
+            'bindings/js/JSMutationObserverCustom.cpp',
             'bindings/js/JSNamedNodeMapCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
             'bindings/js/JSNodeFilterCondition.cpp',
@@ -2057,7 +2075,6 @@
             'bindings/js/JSWebKitAnimationListCustom.cpp',
             'bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp',
             'bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp',
-            'bindings/js/JSWebKitMutationObserverCustom.cpp',
             'bindings/js/JSWebKitPointCustom.cpp',
             'bindings/js/JSWebSocketCustom.cpp',
             'bindings/js/JSWorkerContextBase.cpp',
@@ -2141,8 +2158,6 @@
             'bindings/v8/IsolatedWorld.h',
             'bindings/v8/JavaScriptCallFrame.cpp',
             'bindings/v8/JavaScriptCallFrame.h',
-            'bindings/v8/NPObjectWrapper.cpp',
-            'bindings/v8/NPObjectWrapper.h',
             'bindings/v8/NPV8Object.cpp',
             'bindings/v8/NPV8Object.h',
             'bindings/v8/Dictionary.cpp',
@@ -2327,6 +2342,7 @@
             'bindings/v8/custom/V8MessageEventCustom.cpp',
             'bindings/v8/custom/V8MessagePortCustom.cpp',
             'bindings/v8/custom/V8MutationCallbackCustom.cpp',
+            'bindings/v8/custom/V8MutationObserverCustom.cpp',
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.h',
@@ -2356,7 +2372,6 @@
             'bindings/v8/custom/V8Uint8ClampedArrayCustom.cpp',
             'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
             'bindings/v8/custom/V8WebKitAnimationCustom.cpp',
-            'bindings/v8/custom/V8WebKitMutationObserverCustom.cpp',
             'bindings/v8/custom/V8WebKitPointConstructor.cpp',
             'bindings/v8/custom/V8WebSocketCustom.cpp',
             'bindings/v8/custom/V8WorkerContextCustom.cpp',
@@ -2582,6 +2597,8 @@
             'css/WebKitCSSRegionRule.h',
             'css/WebKitCSSShaderValue.cpp',
             'css/WebKitCSSShaderValue.h',
+            'css/WebKitCSSSVGDocumentValue.cpp',
+            'css/WebKitCSSSVGDocumentValue.h',
             'css/WebKitCSSTransformValue.cpp',
             'editing/AlternativeTextController.cpp',
             'editing/AlternativeTextController.h',
@@ -2999,17 +3016,6 @@
             'mathml/MathMLMathElement.h',
             'mathml/MathMLTextElement.cpp',
             'mathml/MathMLTextElement.h',
-            'notifications/DOMWindowNotifications.cpp',
-            'notifications/DOMWindowNotifications.h',
-            'notifications/Notification.cpp',
-            'notifications/Notification.h',
-            'notifications/NotificationCenter.cpp',
-            'notifications/NotificationCenter.h',
-            'notifications/NotificationController.cpp',
-            'notifications/NotificationController.h',
-            'notifications/NotificationPermissionCallback.h',
-            'notifications/WorkerContextNotifications.cpp',
-            'notifications/WorkerContextNotifications.h',
             'page/BarInfo.cpp',
             'page/BarInfo.h',
             'page/Chrome.cpp',
@@ -3254,6 +3260,8 @@
             'platform/audio/AudioDSPKernelProcessor.cpp',
             'platform/audio/AudioDSPKernelProcessor.h',
             'platform/audio/AudioDestination.h',
+            'platform/audio/AudioFIFO.cpp',
+            'platform/audio/AudioFIFO.h',
             'platform/audio/AudioFileReader.h',
             'platform/audio/AudioProcessor.h',
             'platform/audio/AudioPullFIFO.cpp',
@@ -3590,16 +3598,8 @@
             'platform/graphics/chromium/AnimationIdVendor.h',
             'platform/graphics/chromium/AnimationTranslationUtil.cpp',
             'platform/graphics/chromium/AnimationTranslationUtil.h',
-            'platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp',
-            'platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h',
-            'platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp',
-            'platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h',
             'platform/graphics/chromium/Canvas2DLayerBridge.cpp',
             'platform/graphics/chromium/Canvas2DLayerBridge.h',
-            'platform/graphics/chromium/CanvasLayerTextureUpdater.cpp',
-            'platform/graphics/chromium/CanvasLayerTextureUpdater.h',
-            'platform/graphics/chromium/ContentLayerChromium.cpp',
-            'platform/graphics/chromium/ContentLayerChromium.h',
             'platform/graphics/chromium/CrossProcessFontLoading.h',
             'platform/graphics/chromium/CrossProcessFontLoading.mm',
             'platform/graphics/chromium/DrawingBufferChromium.cpp',
@@ -3613,197 +3613,28 @@
             'platform/graphics/chromium/FontRenderStyle.h',
             'platform/graphics/chromium/FontUtilsChromiumWin.cpp',
             'platform/graphics/chromium/FontUtilsChromiumWin.h',
-            'platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp',
-            'platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h',
-            'platform/graphics/chromium/GeometryBinding.cpp',
-            'platform/graphics/chromium/GeometryBinding.h',
             'platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp',
             'platform/graphics/chromium/GraphicsLayerChromium.cpp',
             'platform/graphics/chromium/GraphicsLayerChromium.h',
-            'platform/graphics/chromium/IOSurfaceLayerChromium.cpp',
-            'platform/graphics/chromium/IOSurfaceLayerChromium.h',
             'platform/graphics/chromium/IconChromium.cpp',
             'platform/graphics/chromium/IconChromiumAndroid.cpp',
             'platform/graphics/chromium/ImageBufferDataSkia.h',
             'platform/graphics/chromium/ImageChromium.cpp',
-            'platform/graphics/chromium/ImageLayerChromium.cpp',
-            'platform/graphics/chromium/ImageLayerChromium.h',
-            'platform/graphics/chromium/LayerChromium.cpp',
-            'platform/graphics/chromium/LayerChromium.h',
-            'platform/graphics/chromium/LayerPainterChromium.h',
-            'platform/graphics/chromium/LayerRendererChromium.cpp',
-            'platform/graphics/chromium/LayerRendererChromium.h',
-            'platform/graphics/chromium/LayerTextureSubImage.cpp',
-            'platform/graphics/chromium/LayerTextureSubImage.h',
-            'platform/graphics/chromium/LayerTextureUpdater.h',
             'platform/graphics/chromium/LinkHighlight.cpp',
             'platform/graphics/chromium/LinkHighlight.h',
-            'platform/graphics/chromium/ManagedTexture.cpp',
-            'platform/graphics/chromium/ManagedTexture.h',
             'platform/graphics/chromium/MediaPlayerPrivateChromium.h',
             'platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp',
             'platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h',
-            'platform/graphics/chromium/PlatformCanvas.cpp',
-            'platform/graphics/chromium/PlatformCanvas.h',
-            'platform/graphics/chromium/PlatformColor.h',
             'platform/graphics/chromium/PlatformIcon.h',
-            'platform/graphics/chromium/ProgramBinding.cpp',
-            'platform/graphics/chromium/ProgramBinding.h',
-            'platform/graphics/chromium/RateLimiter.cpp',
-            'platform/graphics/chromium/RateLimiter.h',
-            'platform/graphics/chromium/RenderSurfaceChromium.cpp',
-            'platform/graphics/chromium/RenderSurfaceChromium.h',
-            'platform/graphics/chromium/ScrollbarLayerChromium.cpp',
-            'platform/graphics/chromium/ScrollbarLayerChromium.h',
-            'platform/graphics/chromium/ShaderChromium.cpp',
-            'platform/graphics/chromium/ShaderChromium.h',
             'platform/graphics/chromium/SimpleFontDataChromiumWin.cpp',
-            'platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp',
-            'platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h',
-            'platform/graphics/chromium/SolidColorLayerChromium.cpp',
-            'platform/graphics/chromium/SolidColorLayerChromium.h',
-            'platform/graphics/chromium/TextureCopier.cpp',
-            'platform/graphics/chromium/TextureCopier.h',
-            'platform/graphics/chromium/TextureLayerChromium.cpp',
-            'platform/graphics/chromium/TextureLayerChromium.h',
-            'platform/graphics/chromium/TextureManager.cpp',
-            'platform/graphics/chromium/TextureManager.h',
-            'platform/graphics/chromium/TextureUploader.h',
-            'platform/graphics/chromium/ThrottledTextureUploader.cpp',
-            'platform/graphics/chromium/ThrottledTextureUploader.h',
-            'platform/graphics/chromium/TiledLayerChromium.cpp',
-            'platform/graphics/chromium/TiledLayerChromium.h',
-            'platform/graphics/chromium/TrackingTextureAllocator.cpp',
-            'platform/graphics/chromium/TrackingTextureAllocator.h',
             'platform/graphics/chromium/TransparencyWin.cpp',
             'platform/graphics/chromium/TransparencyWin.h',
-            'platform/graphics/chromium/TreeSynchronizer.cpp',
-            'platform/graphics/chromium/TreeSynchronizer.h',
             'platform/graphics/chromium/UniscribeHelper.cpp',
             'platform/graphics/chromium/UniscribeHelper.h',
             'platform/graphics/chromium/UniscribeHelperTextRun.cpp',
             'platform/graphics/chromium/UniscribeHelperTextRun.h',
             'platform/graphics/chromium/VDMXParser.cpp',
             'platform/graphics/chromium/VDMXParser.h',
-            'platform/graphics/chromium/VideoLayerChromium.cpp',
-            'platform/graphics/chromium/VideoLayerChromium.h',
-            'platform/graphics/chromium/cc/CCActiveAnimation.cpp',
-            'platform/graphics/chromium/cc/CCActiveAnimation.h',
-            'platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp',
-            'platform/graphics/chromium/cc/CCActiveGestureAnimation.h',
-            'platform/graphics/chromium/cc/CCAnimationCurve.cpp',
-            'platform/graphics/chromium/cc/CCAnimationCurve.h',
-            'platform/graphics/chromium/cc/CCAnimationEvents.h',
-            'platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h',
-            'platform/graphics/chromium/cc/CCDamageTracker.cpp',
-            'platform/graphics/chromium/cc/CCDamageTracker.h',
-            'platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h',
-            'platform/graphics/chromium/cc/CCDebugRectHistory.cpp',
-            'platform/graphics/chromium/cc/CCDebugRectHistory.h',
-            'platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp',
-            'platform/graphics/chromium/cc/CCDelayBasedTimeSource.h',
-            'platform/graphics/chromium/cc/CCDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCDrawQuad.h',
-            'platform/graphics/chromium/cc/CCFontAtlas.cpp',
-            'platform/graphics/chromium/cc/CCFontAtlas.h',
-            'platform/graphics/chromium/cc/CCFrameRateCounter.cpp',
-            'platform/graphics/chromium/cc/CCFrameRateCounter.h',
-            'platform/graphics/chromium/cc/CCFrameRateController.cpp',
-            'platform/graphics/chromium/cc/CCFrameRateController.h',
-            'platform/graphics/chromium/cc/CCGestureCurve.h',
-            'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
-            'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
-            'platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h',
-            'platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp',
-            'platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.h',
-            'platform/graphics/chromium/cc/CCInputHandler.h',
-            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp',
-            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h',
-            'platform/graphics/chromium/cc/CCLayerAnimationController.h',
-            'platform/graphics/chromium/cc/CCLayerAnimationController.cpp',
-            'platform/graphics/chromium/cc/CCLayerAnimationDelegate.h',
-            'platform/graphics/chromium/cc/CCLayerImpl.cpp',
-            'platform/graphics/chromium/cc/CCLayerImpl.h',
-            'platform/graphics/chromium/cc/CCLayerIterator.cpp',
-            'platform/graphics/chromium/cc/CCLayerIterator.h',
-            'platform/graphics/chromium/cc/CCLayerQuad.cpp',
-            'platform/graphics/chromium/cc/CCLayerQuad.h',
-            'platform/graphics/chromium/cc/CCLayerSorter.cpp',
-            'platform/graphics/chromium/cc/CCLayerSorter.h',
-            'platform/graphics/chromium/cc/CCLayerTilingData.cpp',
-            'platform/graphics/chromium/cc/CCLayerTilingData.h',
-            'platform/graphics/chromium/cc/CCLayerTreeHost.cpp',
-            'platform/graphics/chromium/cc/CCLayerTreeHost.h',
-            'platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp',
-            'platform/graphics/chromium/cc/CCLayerTreeHostCommon.h',
-            'platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp',
-            'platform/graphics/chromium/cc/CCLayerTreeHostImpl.h',
-            'platform/graphics/chromium/cc/CCMathUtil.cpp',
-            'platform/graphics/chromium/cc/CCMathUtil.h',
-            'platform/graphics/chromium/cc/CCOcclusionTracker.cpp',
-            'platform/graphics/chromium/cc/CCOcclusionTracker.h',
-            'platform/graphics/chromium/cc/CCOverdrawMetrics.cpp',
-            'platform/graphics/chromium/cc/CCOverdrawMetrics.h',
-            'platform/graphics/chromium/cc/CCPageScaleAnimation.cpp',
-            'platform/graphics/chromium/cc/CCPageScaleAnimation.h',
-            'platform/graphics/chromium/cc/CCProxy.cpp',
-            'platform/graphics/chromium/cc/CCProxy.h',
-            'platform/graphics/chromium/cc/CCQuadCuller.cpp',
-            'platform/graphics/chromium/cc/CCQuadCuller.h',
-            'platform/graphics/chromium/cc/CCRenderingStats.h',
-            'platform/graphics/chromium/cc/CCRenderPass.cpp',
-            'platform/graphics/chromium/cc/CCRenderPass.h',
-            'platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCRenderPassDrawQuad.h',
-            'platform/graphics/chromium/cc/CCRenderSurface.cpp',
-            'platform/graphics/chromium/cc/CCRenderSurface.h',
-            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp',
-            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.h',
-            'platform/graphics/chromium/cc/CCScheduler.cpp',
-            'platform/graphics/chromium/cc/CCScheduler.h',
-            'platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp',
-            'platform/graphics/chromium/cc/CCSchedulerStateMachine.h',
-            'platform/graphics/chromium/cc/CCScopedThreadProxy.h',
-            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp',
-            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.h',
-            'platform/graphics/chromium/cc/CCSettings.cpp',
-            'platform/graphics/chromium/cc/CCSettings.h',
-            'platform/graphics/chromium/cc/CCSharedQuadState.cpp',
-            'platform/graphics/chromium/cc/CCSharedQuadState.h',
-            'platform/graphics/chromium/cc/CCSingleThreadProxy.cpp',
-            'platform/graphics/chromium/cc/CCSingleThreadProxy.h',
-            'platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCSolidColorDrawQuad.h',
-            'platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp',
-            'platform/graphics/chromium/cc/CCSolidColorLayerImpl.h',
-            'platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h',
-            'platform/graphics/chromium/cc/CCTextureDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCTextureDrawQuad.h',
-            'platform/graphics/chromium/cc/CCTextureLayerImpl.cpp',
-            'platform/graphics/chromium/cc/CCTextureLayerImpl.h',
-            'platform/graphics/chromium/cc/CCTextureUpdater.cpp',
-            'platform/graphics/chromium/cc/CCTextureUpdater.h',
-            'platform/graphics/chromium/cc/CCThread.h',
-            'platform/graphics/chromium/cc/CCTileDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCTileDrawQuad.h',
-            'platform/graphics/chromium/cc/CCTimingFunction.cpp',
-            'platform/graphics/chromium/cc/CCTimingFunction.h',
-            'platform/graphics/chromium/cc/CCThreadProxy.cpp',
-            'platform/graphics/chromium/cc/CCThreadProxy.h',
-            'platform/graphics/chromium/cc/CCThreadTask.h',
-            'platform/graphics/chromium/cc/CCTiledLayerImpl.cpp',
-            'platform/graphics/chromium/cc/CCTiledLayerImpl.h',
-            'platform/graphics/chromium/cc/CCTimer.cpp',
-            'platform/graphics/chromium/cc/CCTimer.h',
-            'platform/graphics/chromium/cc/CCTimeSource.h',
-            'platform/graphics/chromium/cc/CCVideoLayerImpl.cpp',
-            'platform/graphics/chromium/cc/CCVideoLayerImpl.h',
-            'platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp',
-            'platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h',
             'platform/graphics/cocoa/FontPlatformDataCocoa.mm',
             'platform/graphics/efl/FontEfl.cpp',
             'platform/graphics/efl/IconEfl.cpp',
@@ -3877,8 +3708,8 @@
             'platform/graphics/filters/SourceGraphic.h',
             'platform/graphics/filters/SpotLightSource.cpp',
             'platform/graphics/filters/SpotLightSource.h',
+            'platform/graphics/filters/arm/NEONHelpers.h',
             'platform/graphics/filters/arm/FECompositeArithmeticNEON.h',
-            'platform/graphics/filters/arm/FEGaussianBlurNEON.cpp',
             'platform/graphics/filters/arm/FEGaussianBlurNEON.h',
             'platform/graphics/filters/arm/FELightingNEON.cpp',
             'platform/graphics/filters/arm/FELightingNEON.h',
@@ -3940,6 +3771,7 @@
             'platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp',
             'platform/graphics/harfbuzz/HarfBuzzShaperBase.h',
             'platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp',
+            'platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp',
             'platform/graphics/harfbuzz/ng/HarfBuzzFace.cpp',
             'platform/graphics/harfbuzz/ng/HarfBuzzFace.h',
             'platform/graphics/harfbuzz/ng/HarfBuzzShaper.cpp',
@@ -3977,6 +3809,7 @@
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
             'platform/graphics/opengl/Extensions3DOpenGL.cpp',
+            'platform/graphics/opengl/Extensions3DOpenGLCommon.cpp',
             'platform/graphics/opengl/Extensions3DOpenGL.h',
             'platform/graphics/opengl/GraphicsContext3DOpenGL.cpp',
             'platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp',
@@ -4009,8 +3842,6 @@
             'platform/graphics/pango/GlyphPageTreeNodePango.cpp',
             'platform/graphics/pango/SimpleFontDataPango.cpp',
             'platform/graphics/qt/ColorQt.cpp',
-            'platform/graphics/qt/Extensions3DQt.cpp',
-            'platform/graphics/qt/Extensions3DQt.h',
             'platform/graphics/qt/FloatPointQt.cpp',
             'platform/graphics/qt/FloatRectQt.cpp',
             'platform/graphics/qt/FontCacheQt.cpp',
@@ -4023,8 +3854,6 @@
             'platform/graphics/qt/GradientQt.cpp',
             'platform/graphics/qt/GraphicsContext3DQt.cpp',
             'platform/graphics/qt/GraphicsContextQt.cpp',
-            'platform/graphics/qt/GraphicsLayerQt.cpp',
-            'platform/graphics/qt/GraphicsLayerQt.h',
             'platform/graphics/qt/IconQt.cpp',
             'platform/graphics/qt/ImageBufferDataQt.h',
             'platform/graphics/qt/ImageBufferQt.cpp',
@@ -4555,6 +4384,7 @@
             'platform/text/AtomicStringKeyedMRUCache.h',
             'platform/text/Base64.cpp',
             'platform/text/BidiContext.cpp',
+            'platform/text/DateTimeFormat.cpp',
             'platform/text/Hyphenation.cpp',
             'platform/text/Hyphenation.h',
             'platform/text/LineEnding.cpp',
@@ -4607,7 +4437,9 @@
             'platform/text/gtk/TextCodecGtk.cpp',
             'platform/text/gtk/TextCodecGtk.h',
             'platform/text/mac/HyphenationMac.mm',
-            'platform/text/mac/LocalizedDateMac.mm',
+            'platform/text/mac/LocaleMac.h',
+            'platform/text/mac/LocaleMac.mm',
+            'platform/text/mac/LocalizedDateMac.cpp',
             'platform/text/mac/LocalizedNumberMac.mm',
             'platform/text/mac/ShapeArabic.c',
             'platform/text/mac/ShapeArabic.h',
@@ -4801,6 +4633,8 @@
             'rendering/FixedTableLayout.h',
             'rendering/FlowThreadController.cpp',
             'rendering/FlowThreadController.h',
+            'rendering/TextAutosizer.cpp',
+            'rendering/TextAutosizer.h',
             'rendering/HitTestingTransformState.cpp',
             'rendering/HitTestingTransformState.h',
             'rendering/HitTestResult.cpp',
@@ -5360,6 +5194,8 @@
             'dom/MutationCallback.h',
             'dom/MutationEvent.cpp',
             'dom/MutationEvent.h',
+            'dom/MutationObserver.cpp',
+            'dom/MutationObserver.h',
             'dom/MutationObserverInterestGroup.cpp',
             'dom/MutationObserverInterestGroup.h',
             'dom/MutationObserverRegistration.cpp',
@@ -5460,8 +5296,6 @@
             'dom/ViewportArguments.cpp',
             'dom/WebKitAnimationEvent.cpp',
             'dom/WebKitAnimationEvent.h',
-            'dom/WebKitMutationObserver.cpp',
-            'dom/WebKitMutationObserver.h',
             'dom/WebKitNamedFlow.cpp',
             'dom/WebKitNamedFlow.h',
             'dom/WebKitTransitionEvent.cpp',
@@ -5546,6 +5380,8 @@
             'html/HTMLDataListElement.h',
             'html/HTMLDetailsElement.cpp',
             'html/HTMLDetailsElement.h',
+            'html/HTMLDialogElement.cpp',
+            'html/HTMLDialogElement.h',
             'html/HTMLDirectoryElement.cpp',
             'html/HTMLDirectoryElement.h',
             'html/HTMLDivElement.cpp',
@@ -6427,9 +6263,9 @@
             'inspector/front-end/DatabaseTableView.js',
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DebuggerModel.js',
-            'inspector/front-end/DebuggerResourceBinding.js',
             'inspector/front-end/DebuggerScriptMapping.js',
             'inspector/front-end/Dialog.js',
+            'inspector/front-end/DirectoryContentView.js',
             'inspector/front-end/DOMAgent.js',
             'inspector/front-end/DOMBreakpointsSidebarPane.js',
             'inspector/front-end/DOMExtension.js',
@@ -6448,7 +6284,9 @@
             'inspector/front-end/ExtensionRegistryStub.js',
             'inspector/front-end/ExtensionServer.js',
             'inspector/front-end/FileManager.js',
+            'inspector/front-end/FileContentView.js',
             'inspector/front-end/FileSystemModel.js',
+            'inspector/front-end/FileSystemView.js',
             'inspector/front-end/FilteredItemSelectionDialog.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/GoToLineDialog.js',
@@ -6554,10 +6392,10 @@
             'inspector/front-end/TabbedEditorContainer.js',
             'inspector/front-end/TabbedPane.js',
             'inspector/front-end/TestController.js',
+            'inspector/front-end/TextEditor.js',
             'inspector/front-end/TextEditorHighlighter.js',
             'inspector/front-end/TextEditorModel.js',
             'inspector/front-end/TextPrompt.js',
-            'inspector/front-end/TextViewer.js',
             'inspector/front-end/TimelineFrameController.js',
             'inspector/front-end/TimelineManager.js',
             'inspector/front-end/TimelineModel.js',
@@ -6577,6 +6415,7 @@
             'inspector/front-end/WatchExpressionsSidebarPane.js',
             'inspector/front-end/WorkerManager.js',
             'inspector/front-end/WorkersSidebarPane.js',
+            'inspector/front-end/Workspace.js',
             'inspector/front-end/dialog.css',
             'inspector/front-end/inspector.css',
             'inspector/front-end/inspectorSyntaxHighlight.css',
@@ -6604,8 +6443,8 @@
             'inspector/front-end/scriptsPanel.css',
             'inspector/front-end/splitView.css',
             'inspector/front-end/tabbedPane.css',
+            'inspector/front-end/textEditor.css',
             'inspector/front-end/textPrompt.css',
-            'inspector/front-end/textViewer.css',
             'inspector/front-end/timelinePanel.css',
         ],
         'webinspector_uglifyjs_files': [
@@ -7742,6 +7581,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSMutationCallback.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSMutationEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSMutationEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSMutationObserver.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSMutationObserver.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSMutationRecord.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSMutationRecord.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNamedNodeMap.cpp',
@@ -8288,8 +8129,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSRegionRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSTransformValue.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSTransformValue.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitMutationObserver.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitMutationObserver.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitPoint.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitPoint.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitNamedFlow.cpp',
@@ -8381,6 +8220,195 @@
             'platform/chromium/support/WrappedResourceRequest.h',
             'platform/chromium/support/WrappedResourceResponse.h',
         ],
+        'webcore_chromium_compositor_files': [
+            'platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp',
+            'platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h',
+            'platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp',
+            'platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h',
+            'platform/graphics/chromium/CanvasLayerTextureUpdater.cpp',
+            'platform/graphics/chromium/CanvasLayerTextureUpdater.h',
+            'platform/graphics/chromium/ContentLayerChromium.cpp',
+            'platform/graphics/chromium/ContentLayerChromium.h',
+            'platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp',
+            'platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h',
+            'platform/graphics/chromium/GeometryBinding.cpp',
+            'platform/graphics/chromium/GeometryBinding.h',
+            'platform/graphics/chromium/IOSurfaceLayerChromium.cpp',
+            'platform/graphics/chromium/IOSurfaceLayerChromium.h',
+            'platform/graphics/chromium/ImageLayerChromium.cpp',
+            'platform/graphics/chromium/ImageLayerChromium.h',
+            'platform/graphics/chromium/LayerChromium.cpp',
+            'platform/graphics/chromium/LayerChromium.h',
+            'platform/graphics/chromium/LayerPainterChromium.h',
+            'platform/graphics/chromium/LayerRendererChromium.cpp',
+            'platform/graphics/chromium/LayerRendererChromium.h',
+            'platform/graphics/chromium/LayerTextureSubImage.cpp',
+            'platform/graphics/chromium/LayerTextureSubImage.h',
+            'platform/graphics/chromium/LayerTextureUpdater.h',
+            'platform/graphics/chromium/ManagedTexture.cpp',
+            'platform/graphics/chromium/ManagedTexture.h',
+            'platform/graphics/chromium/PlatformCanvas.cpp',
+            'platform/graphics/chromium/PlatformCanvas.h',
+            'platform/graphics/chromium/PlatformColor.h',
+            'platform/graphics/chromium/ProgramBinding.cpp',
+            'platform/graphics/chromium/ProgramBinding.h',
+            'platform/graphics/chromium/RateLimiter.cpp',
+            'platform/graphics/chromium/RateLimiter.h',
+            'platform/graphics/chromium/RenderSurfaceChromium.cpp',
+            'platform/graphics/chromium/RenderSurfaceChromium.h',
+            'platform/graphics/chromium/ScrollbarLayerChromium.cpp',
+            'platform/graphics/chromium/ScrollbarLayerChromium.h',
+            'platform/graphics/chromium/ShaderChromium.cpp',
+            'platform/graphics/chromium/ShaderChromium.h',
+            'platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp',
+            'platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h',
+            'platform/graphics/chromium/SolidColorLayerChromium.cpp',
+            'platform/graphics/chromium/SolidColorLayerChromium.h',
+            'platform/graphics/chromium/TextureCopier.cpp',
+            'platform/graphics/chromium/TextureCopier.h',
+            'platform/graphics/chromium/TextureLayerChromium.cpp',
+            'platform/graphics/chromium/TextureLayerChromium.h',
+            'platform/graphics/chromium/TextureManager.cpp',
+            'platform/graphics/chromium/TextureManager.h',
+            'platform/graphics/chromium/TextureUploader.h',
+            'platform/graphics/chromium/ThrottledTextureUploader.cpp',
+            'platform/graphics/chromium/ThrottledTextureUploader.h',
+            'platform/graphics/chromium/TiledLayerChromium.cpp',
+            'platform/graphics/chromium/TiledLayerChromium.h',
+            'platform/graphics/chromium/TrackingTextureAllocator.cpp',
+            'platform/graphics/chromium/TrackingTextureAllocator.h',
+            'platform/graphics/chromium/TreeSynchronizer.cpp',
+            'platform/graphics/chromium/TreeSynchronizer.h',
+            'platform/graphics/chromium/VideoLayerChromium.cpp',
+            'platform/graphics/chromium/VideoLayerChromium.h',
+            'platform/graphics/chromium/cc/CCActiveAnimation.cpp',
+            'platform/graphics/chromium/cc/CCActiveAnimation.h',
+            'platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp',
+            'platform/graphics/chromium/cc/CCActiveGestureAnimation.h',
+            'platform/graphics/chromium/cc/CCAnimationCurve.cpp',
+            'platform/graphics/chromium/cc/CCAnimationCurve.h',
+            'platform/graphics/chromium/cc/CCAnimationEvents.h',
+            'platform/graphics/chromium/cc/CCCheckerboardDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCCheckerboardDrawQuad.h',
+            'platform/graphics/chromium/cc/CCDamageTracker.cpp',
+            'platform/graphics/chromium/cc/CCDamageTracker.h',
+            'platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h',
+            'platform/graphics/chromium/cc/CCDebugRectHistory.cpp',
+            'platform/graphics/chromium/cc/CCDebugRectHistory.h',
+            'platform/graphics/chromium/cc/CCDelayBasedTimeSource.cpp',
+            'platform/graphics/chromium/cc/CCDelayBasedTimeSource.h',
+            'platform/graphics/chromium/cc/CCDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCDrawQuad.h',
+            'platform/graphics/chromium/cc/CCFontAtlas.cpp',
+            'platform/graphics/chromium/cc/CCFontAtlas.h',
+            'platform/graphics/chromium/cc/CCFrameRateController.cpp',
+            'platform/graphics/chromium/cc/CCFrameRateController.h',
+            'platform/graphics/chromium/cc/CCFrameRateCounter.cpp',
+            'platform/graphics/chromium/cc/CCFrameRateCounter.h',
+            'platform/graphics/chromium/cc/CCGestureCurve.h',
+            'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
+            'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
+            'platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCIOSurfaceDrawQuad.h',
+            'platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCIOSurfaceLayerImpl.h',
+            'platform/graphics/chromium/cc/CCInputHandler.h',
+            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp',
+            'platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h',
+            'platform/graphics/chromium/cc/CCLayerAnimationController.cpp',
+            'platform/graphics/chromium/cc/CCLayerAnimationController.h',
+            'platform/graphics/chromium/cc/CCLayerAnimationDelegate.h',
+            'platform/graphics/chromium/cc/CCLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCLayerImpl.h',
+            'platform/graphics/chromium/cc/CCLayerIterator.cpp',
+            'platform/graphics/chromium/cc/CCLayerIterator.h',
+            'platform/graphics/chromium/cc/CCLayerQuad.cpp',
+            'platform/graphics/chromium/cc/CCLayerQuad.h',
+            'platform/graphics/chromium/cc/CCLayerSorter.cpp',
+            'platform/graphics/chromium/cc/CCLayerSorter.h',
+            'platform/graphics/chromium/cc/CCLayerTilingData.cpp',
+            'platform/graphics/chromium/cc/CCLayerTilingData.h',
+            'platform/graphics/chromium/cc/CCLayerTreeHost.cpp',
+            'platform/graphics/chromium/cc/CCLayerTreeHost.h',
+            'platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp',
+            'platform/graphics/chromium/cc/CCLayerTreeHostCommon.h',
+            'platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp',
+            'platform/graphics/chromium/cc/CCLayerTreeHostImpl.h',
+            'platform/graphics/chromium/cc/CCMathUtil.cpp',
+            'platform/graphics/chromium/cc/CCMathUtil.h',
+            'platform/graphics/chromium/cc/CCOcclusionTracker.cpp',
+            'platform/graphics/chromium/cc/CCOcclusionTracker.h',
+            'platform/graphics/chromium/cc/CCOverdrawMetrics.cpp',
+            'platform/graphics/chromium/cc/CCOverdrawMetrics.h',
+            'platform/graphics/chromium/cc/CCPageScaleAnimation.cpp',
+            'platform/graphics/chromium/cc/CCPageScaleAnimation.h',
+            'platform/graphics/chromium/cc/CCPrioritizedTexture.cpp',
+            'platform/graphics/chromium/cc/CCPrioritizedTexture.h',
+            'platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp',
+            'platform/graphics/chromium/cc/CCPrioritizedTextureManager.h',
+            'platform/graphics/chromium/cc/CCPriorityCalculator.cpp',
+            'platform/graphics/chromium/cc/CCPriorityCalculator.h',
+            'platform/graphics/chromium/cc/CCProxy.cpp',
+            'platform/graphics/chromium/cc/CCProxy.h',
+            'platform/graphics/chromium/cc/CCQuadCuller.cpp',
+            'platform/graphics/chromium/cc/CCQuadCuller.h',
+            'platform/graphics/chromium/cc/CCRenderPass.cpp',
+            'platform/graphics/chromium/cc/CCRenderPass.h',
+            'platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCRenderPassDrawQuad.h',
+            'platform/graphics/chromium/cc/CCRenderSurface.cpp',
+            'platform/graphics/chromium/cc/CCRenderSurface.h',
+            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp',
+            'platform/graphics/chromium/cc/CCRenderSurfaceFilters.h',
+            'platform/graphics/chromium/cc/CCRenderingStats.h',
+            'platform/graphics/chromium/cc/CCScheduler.cpp',
+            'platform/graphics/chromium/cc/CCScheduler.h',
+            'platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp',
+            'platform/graphics/chromium/cc/CCSchedulerStateMachine.h',
+            'platform/graphics/chromium/cc/CCScopedTexture.cpp',
+            'platform/graphics/chromium/cc/CCScopedTexture.h',
+            'platform/graphics/chromium/cc/CCScopedThreadProxy.h',
+            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.h',
+            'platform/graphics/chromium/cc/CCSettings.cpp',
+            'platform/graphics/chromium/cc/CCSettings.h',
+            'platform/graphics/chromium/cc/CCSharedQuadState.cpp',
+            'platform/graphics/chromium/cc/CCSharedQuadState.h',
+            'platform/graphics/chromium/cc/CCSingleThreadProxy.cpp',
+            'platform/graphics/chromium/cc/CCSingleThreadProxy.h',
+            'platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCSolidColorDrawQuad.h',
+            'platform/graphics/chromium/cc/CCSolidColorLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCSolidColorLayerImpl.h',
+            'platform/graphics/chromium/cc/CCStreamVideoDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCStreamVideoDrawQuad.h',
+            'platform/graphics/chromium/cc/CCTexture.cpp',
+            'platform/graphics/chromium/cc/CCTexture.h',
+            'platform/graphics/chromium/cc/CCTextureDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCTextureDrawQuad.h',
+            'platform/graphics/chromium/cc/CCTextureLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCTextureLayerImpl.h',
+            'platform/graphics/chromium/cc/CCTextureUpdater.cpp',
+            'platform/graphics/chromium/cc/CCTextureUpdater.h',
+            'platform/graphics/chromium/cc/CCThread.h',
+            'platform/graphics/chromium/cc/CCThreadProxy.cpp',
+            'platform/graphics/chromium/cc/CCThreadProxy.h',
+            'platform/graphics/chromium/cc/CCThreadTask.h',
+            'platform/graphics/chromium/cc/CCTileDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCTileDrawQuad.h',
+            'platform/graphics/chromium/cc/CCTiledLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCTiledLayerImpl.h',
+            'platform/graphics/chromium/cc/CCTimeSource.h',
+            'platform/graphics/chromium/cc/CCTimer.cpp',
+            'platform/graphics/chromium/cc/CCTimer.h',
+            'platform/graphics/chromium/cc/CCTimingFunction.cpp',
+            'platform/graphics/chromium/cc/CCTimingFunction.h',
+            'platform/graphics/chromium/cc/CCVideoLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCVideoLayerImpl.h',
+            'platform/graphics/chromium/cc/CCYUVVideoDrawQuad.cpp',
+            'platform/graphics/chromium/cc/CCYUVVideoDrawQuad.h',
+        ],
         'export_file_generator_files': [
             '<(PRODUCT_DIR)/DerivedSources/WebCore/ExportFileGenerator.cpp',
         ],
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index bbf6a3dd3..3b2b3f651 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -1676,10 +1676,10 @@ __ZNK7WebCore9FrameView10layoutRootEb
 __ZNK7WebCore12RenderObject13isFlexibleBoxEv
 __ZNK7WebCore9RenderBox27shouldComputeSizeAsReplacedEv
 __ZNK7WebCore11RenderStyle12logicalWidthEv
-__ZN7WebCore9RenderBox24computeLogicalWidthUsingENS_16LogicalWidthTypeEi
+__ZN7WebCore9RenderBox24computeLogicalWidthUsingENS_16SizeTypeEi
 __ZNK7WebCore11RenderStyle11marginStartEv
 __ZNK7WebCore11RenderStyle9marginEndEv
-__ZNK7WebCore9RenderBox28sizesToIntrinsicLogicalWidthENS_16LogicalWidthTypeE
+__ZNK7WebCore9RenderBox28sizesToIntrinsicLogicalWidthENS_16SizeTypeE
 __ZNK7WebCore11RenderBlock26isInlineBlockOrInlineTableEv
 __ZNK7WebCore11RenderStyle15logicalMaxWidthEv
 __ZNK7WebCore11RenderStyle15logicalMinWidthEv
@@ -28887,7 +28887,7 @@ __ZN7WebCore23RenderSVGResourceMarkerC1EPNS_16SVGMarkerElementE
 __ZN7WebCore14SVGRenderStyle20setMarkerEndResourceERKN3WTF6StringE
 __ZN7WebCore26StyleInheritedResourceDataC1ERKS0_
 __ZN7WebCore16SVGStyledElement22setHasPendingResourcesEb
-__ZN7WebCore10SVGElement17ensureRareSVGDataEv
+__ZN7WebCore10SVGElement17ensureSVGRareDataEv
 __ZThn128_NK7WebCore23RenderSVGResourceMarker12resourceTypeEv
 __ZThn128_N7WebCore23RenderSVGResourceMarker25removeAllClientsFromCacheEb
 __ZNK7WebCore26StyleInheritedResourceDataeqERKS0_
@@ -28961,7 +28961,7 @@ __ZN7WebCore14SVGPathElement25createSVGPathSegClosePathENS_14SVGPathSegRoleE
 __ZNK7WebCore19SVGPathSegClosePath11pathSegTypeEv
 __ZN7WebCore13createWrapperINS_21JSSVGPathSegClosePathENS_19SVGPathSegClosePathEEEPNS_12JSDOMWrapperEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPT0_
 __ZN7WebCore21JSSVGPathSegClosePathC1EPN3JSC9StructureEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrINS_19SVGPathSegClosePathEEE
-__ZNK7WebCore10SVGElement11rareSVGDataEv
+__ZNK7WebCore10SVGElement11svgRareDataEv
 __ZNK7WebCore16SVGStyledElement19hasPendingResourcesEv
 __ZN3WTF6VectorINS_12AtomicStringELm0EE15reserveCapacityEm
 __ZN3WTF9HashTableINS_12AtomicStringESt4pairIS1_PNS_7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFirstExtractorISD_EENS_16AtomicStringHashENS_14PairHashTraitsINS9_IS1_EENS9_ISC_EEEESI_E3addIS1_SC_NS_17HashMapTranslatorISD_SK_SG_EEEES2_INS_17HashTableIteratorIS1_SD_SF_SG_SK_SI_EEbERKT_RKT0_
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index 193f5fea3..0d60155cf 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -5,13 +5,8 @@
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
-load(features)
-
 SOURCE_DIR = $${ROOT_WEBKIT_DIR}/Source/WebCore
 
-# We enable TextureMapper by default; remove this line to enable GraphicsLayerQt.
-CONFIG += texmap
-
 QT *= network sql
 haveQt(5): QT *= gui-private
 
@@ -22,6 +17,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/Modules/filesystem \
     $$SOURCE_DIR/Modules/geolocation \
     $$SOURCE_DIR/Modules/indexeddb \
+    $$SOURCE_DIR/Modules/notifications \
     $$SOURCE_DIR/Modules/quota \
     $$SOURCE_DIR/Modules/webaudio \
     $$SOURCE_DIR/Modules/webdatabase \
@@ -49,7 +45,6 @@ INCLUDEPATH += \
     $$SOURCE_DIR/loader/cache \
     $$SOURCE_DIR/loader/icon \
     $$SOURCE_DIR/mathml \
-    $$SOURCE_DIR/notifications \
     $$SOURCE_DIR/page \
     $$SOURCE_DIR/page/animation \
     $$SOURCE_DIR/page/qt \
@@ -171,7 +166,7 @@ contains(DEFINES, ENABLE_GEOLOCATION=1) {
     MOBILITY *= location
 }
 
-contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1) {
+contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1)|contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1) {
     haveQt(5) {
         QT += sensors
     } else {
@@ -205,32 +200,16 @@ contains(DEFINES, ENABLE_VIDEO=1) {
     }
 }
 
-contains(DEFINES, ENABLE_WEBGL=1) {
-    !contains(QT_CONFIG, opengl) {
-        error( "This configuration needs an OpenGL enabled Qt. Your Qt is missing OpenGL.")
-    }
-}
-
-contains(CONFIG, texmap) {
-    DEFINES += WTF_USE_TEXTURE_MAPPER=1
-    # TextureMapperGL requires stuff from GraphicsContext3D, hence the WebGL
-    # dependency.
-    !win32-*:contains(QT_CONFIG, opengl):contains(DEFINES, ENABLE_WEBGL=1) {
-        DEFINES += WTF_USE_TEXTURE_MAPPER_GL=1
-        contains(QT_CONFIG, opengles2): LIBS += -lEGL
-    }
+contains(DEFINES, WTF_USE_3D_GRAPHICS=1) {
+    contains(QT_CONFIG, opengles2): LIBS += -lEGL
     mac: LIBS += -framework IOSurface -framework CoreFoundation
-}
-
-contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1)|contains(DEFINES, ENABLE_WEBGL=1) {
-    # Only Qt 4 needs the opengl module, for Qt 5 everything we need is part of QtGui.
-    haveQt(4): QT *= opengl
+    # Only WebKit1 needs the opengl module, so it's optional for Qt5.
+    haveQt(4)|contains(QT_CONFIG, opengl): QT *= opengl
 }
 
 !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
     INCLUDEPATH += $${SQLITE3SRCDIR}
     DEFINES += SQLITE_CORE SQLITE_OMIT_LOAD_EXTENSION SQLITE_OMIT_COMPLETE
-    CONFIG(release, debug|release): DEFINES *= NDEBUG
 } else {
     INCLUDEPATH += $${SQLITE3SRCDIR}
     LIBS += -lsqlite3
@@ -238,19 +217,19 @@ contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1)|contains(DEFINES, ENABLE_WEBGL=1)
 
 haveQt(5) {
     # Qt5 allows us to use config tests to check for the presence of these libraries
-    contains(config_test_libjpeg, yes) {
+    config_libjpeg {
         DEFINES += WTF_USE_LIBJPEG=1
         LIBS += -ljpeg
     } else {
         warning("JPEG library not found! QImageDecoder will decode JPEG images.")
     }
-    contains(config_test_libpng, yes) {
+    config_libpng {
         DEFINES += WTF_USE_LIBPNG=1
         LIBS += -lpng
     } else {
         warning("PNG library not found! QImageDecoder will decode PNG images.")
     }
-    contains(config_test_libwebp, yes) {
+    config_libwebp {
         DEFINES += WTF_USE_WEBP=1
         LIBS += -lwebp
     }
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index d12db566c..9062c8b23 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -11590,6 +11590,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSMutationObserver.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSMutationObserver.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSMutationRecord.cpp"
 				>
 				<FileConfiguration
@@ -23063,62 +23119,6 @@
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitMutationObserver.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitMutationObserver.h"
-				>
-			</File>
-			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitNamedFlow.cpp"
 				>
 				<FileConfiguration
@@ -24959,6 +24959,46 @@
 				</File>
 			</Filter>
 			<Filter
+				Name="notifications"
+				>
+				<File
+					RelativePath="..\Modules\notifications\DOMWindowNotifications.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\DOMWindowNotifications.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\Notification.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\Notification.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\NotificationCenter.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\NotificationCenter.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\NotificationClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\WorkerContextNotifications.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\notifications\WorkerContextNotifications.h"
+					>
+				</File>
+			</Filter>
+			<Filter
 				Name="webdatabase"
 				>
 				<File
@@ -29362,6 +29402,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\PlatformLayer.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\Region.cpp"
 					>
 				</File>
@@ -31585,10 +31629,6 @@
 						>
 					</File>
 					<File
-						RelativePath="..\platform\graphics\filters\arm\FEGaussianBlurNEON.cpp"
-						>
-					</File>
-					<File
 						RelativePath="..\platform\graphics\filters\arm\FEGaussianBlurNEON.h"
 						>
 					</File>
@@ -31693,6 +31733,10 @@
 						>
 					</File>
 					<File
+						RelativePath="..\platform\graphics\filters\arm\NEONHelpers.h"
+						>
+					</File>
+					<File
 						RelativePath="..\platform\graphics\filters\PointLightSource.cpp"
 						>
 					</File>
@@ -33198,6 +33242,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\DateTimeFormat.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\text\DateTimeFormat.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\DecodeEscapeSequences.h"
 					>
 				</File>
@@ -37575,11 +37627,15 @@
 				>
 			</File>
 			<File
-				RelativePath="..\css\WebKitCSSShaderValue.cpp"
+				RelativePath="..\css\WebKitCSSSVGDocumentValue.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\css\WebKitCSSShaderValue.h"
+				RelativePath="..\css\WebKitCSSSVGDocumentValue.h"
+				>
+			</File>
+			<File
+				RelativePath="..\css\WebKitCSSShaderValue.cpp"
 				>
 			</File>
 			<File
@@ -51651,6 +51707,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\MutationObserver.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\MutationObserver.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\MutationObserverInterestGroup.cpp"
 				>
 				<FileConfiguration
@@ -54339,62 +54451,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\dom\WebKitMutationObserver.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\dom\WebKitMutationObserver.h"
-				>
-			</File>
-			<File
 				RelativePath="..\dom\WebKitNamedFlow.cpp"
 				>
 				<FileConfiguration
@@ -54768,46 +54824,6 @@
 			</File>
 		</Filter>
 		<Filter
-			Name="notifications"
-			>
-			<File
-				RelativePath="..\notifications\DOMWindowNotifications.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\DOMWindowNotifications.h"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\Notification.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\Notification.h"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\NotificationCenter.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\NotificationCenter.h"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\NotificationClient.h"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\WorkerContextNotifications.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\notifications\WorkerContextNotifications.h"
-				>
-			</File>
-		</Filter>
-		<Filter
 			Name="editing"
 			>
 			<File
@@ -68218,7 +68234,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"
+					RelativePath="..\bindings\js\JSMutationObserverCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68270,7 +68286,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNodeCustom.cpp"
+					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68322,11 +68338,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNodeCustom.h"
-					>
-				</File>
-				<File
-					RelativePath="..\bindings\js\JSNodeFilterCondition.cpp"
+					RelativePath="..\bindings\js\JSNodeCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68378,11 +68390,11 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNodeFilterCondition.h"
+					RelativePath="..\bindings\js\JSNodeCustom.h"
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNodeFilterCustom.cpp"
+					RelativePath="..\bindings\js\JSNodeFilterCondition.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68434,7 +68446,11 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNodeIteratorCustom.cpp"
+					RelativePath="..\bindings\js\JSNodeFilterCondition.h"
+					>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSNodeFilterCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68486,7 +68502,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNodeListCustom.cpp"
+					RelativePath="..\bindings\js\JSNodeIteratorCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68538,7 +68554,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSNotificationCustom.cpp"
+					RelativePath="..\bindings\js\JSNodeListCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68590,7 +68606,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSPluginElementFunctions.cpp"
+					RelativePath="..\bindings\js\JSNotificationCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68642,11 +68658,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSPluginElementFunctions.h"
-					>
-				</File>
-				<File
-					RelativePath="..\bindings\js\JSProcessingInstructionCustom.cpp"
+					RelativePath="..\bindings\js\JSPluginElementFunctions.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68698,7 +68710,11 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSRequestAnimationFrameCallbackCustom.cpp"
+					RelativePath="..\bindings\js\JSPluginElementFunctions.h"
+					>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSProcessingInstructionCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68750,7 +68766,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSScriptProfileNodeCustom.cpp"
+					RelativePath="..\bindings\js\JSRequestAnimationFrameCallbackCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68802,7 +68818,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSSharedWorkerCustom.cpp"
+					RelativePath="..\bindings\js\JSScriptProfileNodeCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68854,7 +68870,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSSQLResultSetRowListCustom.cpp"
+					RelativePath="..\bindings\js\JSSharedWorkerCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68906,7 +68922,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSSQLTransactionCustom.cpp"
+					RelativePath="..\bindings\js\JSSQLResultSetRowListCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -68958,7 +68974,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSSQLTransactionSyncCustom.cpp"
+					RelativePath="..\bindings\js\JSSQLTransactionCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69010,7 +69026,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSStorageCustom.cpp"
+					RelativePath="..\bindings\js\JSSQLTransactionSyncCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69062,11 +69078,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSStorageCustom.h"
-					>
-				</File>
-				<File
-					RelativePath="..\bindings\js\JSStyleSheetCustom.cpp"
+					RelativePath="..\bindings\js\JSStorageCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69118,7 +69130,11 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSStyleSheetListCustom.cpp"
+					RelativePath="..\bindings\js\JSStorageCustom.h"
+					>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSStyleSheetCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69170,7 +69186,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSSVGElementInstanceCustom.cpp"
+					RelativePath="..\bindings\js\JSStyleSheetListCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69222,7 +69238,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSSVGLengthCustom.cpp"
+					RelativePath="..\bindings\js\JSSVGElementInstanceCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69274,7 +69290,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSSVGPathSegCustom.cpp"
+					RelativePath="..\bindings\js\JSSVGLengthCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69326,7 +69342,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSTextCustom.cpp"
+					RelativePath="..\bindings\js\JSSVGPathSegCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69378,7 +69394,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSTreeWalkerCustom.cpp"
+					RelativePath="..\bindings\js\JSTextCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69430,7 +69446,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSWebKitAnimationCustom.cpp"
+					RelativePath="..\bindings\js\JSTreeWalkerCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69482,7 +69498,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSWebKitAnimationListCustom.cpp"
+					RelativePath="..\bindings\js\JSWebKitAnimationCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69534,7 +69550,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSWebKitCSSKeyframeRuleCustom.cpp"
+					RelativePath="..\bindings\js\JSWebKitAnimationListCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69586,7 +69602,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSWebKitCSSKeyframesRuleCustom.cpp"
+					RelativePath="..\bindings\js\JSWebKitCSSKeyframeRuleCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69638,7 +69654,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSWebKitCSSMatrixCustom.cpp"
+					RelativePath="..\bindings\js\JSWebKitCSSKeyframesRuleCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -69690,7 +69706,7 @@
 					</FileConfiguration>
 				</File>
 				<File
-					RelativePath="..\bindings\js\JSWebKitMutationObserverCustom.cpp"
+					RelativePath="..\bindings\js\JSWebKitCSSMatrixCustom.cpp"
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
@@ -74818,10 +74834,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\DebuggerResourceBinding.js"
-					>
-				</File>
-				<File
 					RelativePath="..\inspector\front-end\DebuggerScriptMapping.js"
 					>
 				</File>
@@ -74834,6 +74846,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\DirectoryContentView.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\DOMAgent.js"
 					>
 				</File>
@@ -74906,6 +74922,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\FileContentView.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\FileManager.js"
 					>
 				</File>
@@ -74914,6 +74934,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\FileSystemView.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\filteredItemSelectionDialog.css"
 					>
 				</File>
@@ -75422,27 +75446,27 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TextEditorHighlighter.js"
+					RelativePath="..\inspector\front-end\textEditor.css"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TextEditorModel.js"
+					RelativePath="..\inspector\front-end\TextEditor.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\textPrompt.css"
+					RelativePath="..\inspector\front-end\TextEditorHighlighter.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TextPrompt.js"
+					RelativePath="..\inspector\front-end\TextEditorModel.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\textViewer.css"
+					RelativePath="..\inspector\front-end\textPrompt.css"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TextViewer.js"
+					RelativePath="..\inspector\front-end\TextPrompt.js"
 					>
 				</File>
 				<File
@@ -75521,6 +75545,10 @@
 					RelativePath="..\inspector\front-end\WorkersSidebarPane.js"
 					>
 				</File>
+				<File
+					RelativePath="..\inspector\front-end\Workspace.js"
+					>
+				</File>
 			</Filter>
 		</Filter>
 		<Filter
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 1cdc2f464..0641d65a0 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\filesystem&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\Modules\indexeddb&quot;;&quot;$(ProjectDir)..\Modules\quota&quot;;&quot;$(ProjectDir)..\Modules\webdatabase&quot;;&quot;$(ProjectDir)..\Modules\websockets&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\filesystem&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\Modules\indexeddb&quot;;&quot;$(ProjectDir)..\Modules\quota&quot;;&quot;$(ProjectDir)..\Modules\notifications&quot;;&quot;$(ProjectDir)..\Modules\webdatabase&quot;;&quot;$(ProjectDir)..\Modules\websockets&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
 		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index eebbcf1db..83f1f0317 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -22,6 +22,7 @@ xcopy /y /d "%CONFIGURATIONBUILDDIR%\obj\WebCore\DerivedSources\*.h" "%CONFIGURA
 xcopy /y /d "%ProjectDir%..\Modules\filesystem\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\Modules\geolocation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\Modules\quota\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\Modules\notifications\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\Modules\webdatabase\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\Modules\websockets\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
@@ -37,7 +38,6 @@ xcopy /y /d "%ProjectDir%..\history\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCor
 xcopy /y /d "%ProjectDir%..\history\cf\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\html\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\html\parser\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
-xcopy /y /d "%ProjectDir%..\notifications\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\css\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\animation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index cc8344134..c126c95af 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -78,6 +78,9 @@
 		033A6A83147E08A600509B36 /* JSHTMLPropertiesCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 033A6A82147E08A600509B36 /* JSHTMLPropertiesCollection.h */; };
 		052BFCE9128ABF1500FD338D /* GeolocationClientMock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 052BFCE8128ABF1500FD338D /* GeolocationClientMock.cpp */; };
 		052BFCEB128ABF2100FD338D /* GeolocationClientMock.h in Headers */ = {isa = PBXBuildFile; fileRef = 052BFCEA128ABF2100FD338D /* GeolocationClientMock.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0562F9461573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0562F9441573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.cpp */; };
+		0562F9471573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0562F9451573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.h */; };
+		0562F9611573F88F0031CA16 /* PlatformLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0562F9601573F88F0031CA16 /* PlatformLayer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		05FD69E012845D4300B2BEB3 /* DOMTimeStamp.h in Headers */ = {isa = PBXBuildFile; fileRef = 05FD69DF12845D4300B2BEB3 /* DOMTimeStamp.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		06027CAD0B1CBFC000884B2D /* ContextMenuItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06027CB20B1CC03D00884B2D /* ContextMenuItemMac.mm */; };
@@ -666,6 +669,8 @@
 		1F3C3BEA135CAF3C00B8C1AC /* MediaControls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1F3C3BE8135CAF3C00B8C1AC /* MediaControls.cpp */; };
 		1F3C3BEB135CAF3C00B8C1AC /* MediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 1F3C3BE9135CAF3C00B8C1AC /* MediaControls.h */; };
 		1F3F19531499CA7600A5AEA7 /* PODFreeListArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 1F3F19521499CA7600A5AEA7 /* PODFreeListArena.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1FAFBF1815A5FA6E00083A20 /* UTIUtilities.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1FAFBF1715A5FA5200083A20 /* UTIUtilities.mm */; };
+		1FAFBF1915A5FA7400083A20 /* UTIUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 1FAFBF1615A5FA5200083A20 /* UTIUtilities.h */; };
 		20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 20D629241253690B00081543 /* InspectorInstrumentation.cpp */; };
 		20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 20D629251253690B00081543 /* InspectorInstrumentation.h */; };
 		227777601345DEA9008EA455 /* InspectorFrontendChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 2277775F1345DEA9008EA455 /* InspectorFrontendChannel.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1186,9 +1191,13 @@
 		449B19F50FA72ECE0015CA4A /* HTMLParserQuirks.h in Headers */ = {isa = PBXBuildFile; fileRef = 449B19F30FA72ECE0015CA4A /* HTMLParserQuirks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		44A28AAC12DFB8AC00AE923B /* MathMLElementFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A28AAB12DFB8AC00AE923B /* MathMLElementFactory.h */; };
 		44A28AAF12DFB8BF00AE923B /* MathMLNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A28AAE12DFB8BF00AE923B /* MathMLNames.h */; };
+		44DAB5B115A623580097C1E4 /* Extensions3DOpenGLCommon.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 44DAB5AF15A623580097C1E4 /* Extensions3DOpenGLCommon.cpp */; };
+		44DAB5B215A623580097C1E4 /* Extensions3DOpenGLCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 44DAB5B015A623580097C1E4 /* Extensions3DOpenGLCommon.h */; };
 		45099C411370A7800058D513 /* IconURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 45099C401370A7800058D513 /* IconURL.cpp */; };
 		450CEBF015073BBE002BB149 /* LabelableElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 450CEBEE15073BBE002BB149 /* LabelableElement.cpp */; };
 		450CEBF115073BBE002BB149 /* LabelableElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 450CEBEF15073BBE002BB149 /* LabelableElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		453EB636159C570400001BB7 /* DateTimeFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 453EB634159C570400001BB7 /* DateTimeFormat.cpp */; };
+		453EB637159C570400001BB7 /* DateTimeFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 453EB635159C570400001BB7 /* DateTimeFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		458FE4091589DF0B005609E6 /* RenderSearchField.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 458FE4071589DF0B005609E6 /* RenderSearchField.cpp */; };
 		458FE40A1589DF0B005609E6 /* RenderSearchField.h in Headers */ = {isa = PBXBuildFile; fileRef = 458FE4081589DF0B005609E6 /* RenderSearchField.h */; };
 		45BAC2B01360BBAB005DA258 /* IconURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 45BAC2AF1360BBAB005DA258 /* IconURL.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1326,7 +1335,6 @@
 		49E912AD0EFAC906009D0CAF /* AnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A80EFAC906009D0CAF /* AnimationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A90EFAC906009D0CAF /* TimingFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49ECEB681499790D00CDD3A4 /* FECompositeArithmeticNEON.h in Headers */ = {isa = PBXBuildFile; fileRef = 49ECEB5E1499790D00CDD3A4 /* FECompositeArithmeticNEON.h */; };
-		49ECEB691499790D00CDD3A4 /* FEGaussianBlurNEON.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49ECEB5F1499790D00CDD3A4 /* FEGaussianBlurNEON.cpp */; };
 		49ECEB6A1499790D00CDD3A4 /* FEGaussianBlurNEON.h in Headers */ = {isa = PBXBuildFile; fileRef = 49ECEB601499790D00CDD3A4 /* FEGaussianBlurNEON.h */; };
 		49ECEB6B1499790D00CDD3A4 /* FELightingNEON.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49ECEB611499790D00CDD3A4 /* FELightingNEON.cpp */; };
 		49ECEB6C1499790D00CDD3A4 /* FELightingNEON.h in Headers */ = {isa = PBXBuildFile; fileRef = 49ECEB621499790D00CDD3A4 /* FELightingNEON.h */; };
@@ -1428,10 +1436,10 @@
 		4F1534DE11B532EC0021FD86 /* EditingBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DD11B532EC0021FD86 /* EditingBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F1534E011B533020021FD86 /* EditingBehaviorTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F2D205412EAE7B3005C2874 /* InspectorAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F2D205212EAE7B3005C2874 /* InspectorAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		4F32BB1B14FA85E800F6C1A3 /* MemoryInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F2D205512EAE7B3005C2874 /* InspectorAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */; };
 		4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */; };
 		4F3289B611A42AAB005ABE7E /* InspectorValues.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F3289B411A42AAB005ABE7E /* InspectorValues.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		4F32BB1B14FA85E800F6C1A3 /* MemoryInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */; };
 		4F6FDD641341DEDD001F8EE3 /* InspectorPageAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */; };
 		4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */; };
@@ -1859,8 +1867,13 @@
 		75793ED40D0CE85B007FC0AC /* DOMMessageEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */; };
 		75793ED50D0CE85B007FC0AC /* DOMMessageEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */; };
 		758978EC127090D60076D5A9 /* SpeechInputResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 758978EA127090D60076D5A9 /* SpeechInputResult.cpp */; };
+		762F1ED7159D960A007408F2 /* HTMLDialogElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 762F1ED6159D960A007408F2 /* HTMLDialogElement.h */; };
+		762F1ED9159D961A007408F2 /* HTMLDialogElement.idl in Resources */ = {isa = PBXBuildFile; fileRef = 762F1ED8159D961A007408F2 /* HTMLDialogElement.idl */; };
+		762F1EDB159D968A007408F2 /* HTMLDialogElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 762F1EDA159D968A007408F2 /* HTMLDialogElement.cpp */; };
 		7633A72613D8B33A008501B6 /* LocaleToScriptMapping.h in Headers */ = {isa = PBXBuildFile; fileRef = 7633A72413D8B33A008501B6 /* LocaleToScriptMapping.h */; };
 		7633A72713D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7633A72513D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp */; };
+		76808B4F159DADFA002B5233 /* JSHTMLDialogElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76808B4D159DADFA002B5233 /* JSHTMLDialogElement.cpp */; };
+		76808B50159DADFA002B5233 /* JSHTMLDialogElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 76808B4E159DADFA002B5233 /* JSHTMLDialogElement.h */; };
 		7694563C1214D97C0007CBAE /* JSDOMTokenList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7694563A1214D97C0007CBAE /* JSDOMTokenList.cpp */; };
 		7694563D1214D97C0007CBAE /* JSDOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 7694563B1214D97C0007CBAE /* JSDOMTokenList.h */; };
 		7694565B1214DB630007CBAE /* DOMDOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 769456591214DB630007CBAE /* DOMDOMTokenList.h */; };
@@ -3697,7 +3710,7 @@
 		A0EE0DF7144F825500F80B0D /* WebGLDebugShaders.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A0EE0DF3144F825500F80B0D /* WebGLDebugShaders.cpp */; };
 		A0EE0DF8144F825500F80B0D /* WebGLDebugShaders.h in Headers */ = {isa = PBXBuildFile; fileRef = A0EE0DF4144F825500F80B0D /* WebGLDebugShaders.h */; };
 		A104F24314C71F7A009E2C23 /* CachedSVGDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */; };
-		A104F24414C71F7A009E2C23 /* CachedSVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */; };
+		A104F24414C71F7A009E2C23 /* CachedSVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A10BB5851484E3A700B2E87A /* RenderSVGRect.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5831484E3A700B2E87A /* RenderSVGRect.h */; };
 		A10BB58B1484E3B300B2E87A /* RenderSVGShape.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5891484E3B300B2E87A /* RenderSVGShape.h */; };
 		A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A10DC76814747BAB005E2471 /* StyleGridData.cpp */; };
@@ -4544,7 +4557,7 @@
 		B22279B00D00BF220071B782 /* SVGDescElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222781A0D00BF1F0071B782 /* SVGDescElement.cpp */; };
 		B22279B10D00BF220071B782 /* SVGDescElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B222781B0D00BF1F0071B782 /* SVGDescElement.h */; };
 		B22279B30D00BF220071B782 /* SVGDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222781D0D00BF1F0071B782 /* SVGDocument.cpp */; };
-		B22279B40D00BF220071B782 /* SVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = B222781E0D00BF1F0071B782 /* SVGDocument.h */; };
+		B22279B40D00BF220071B782 /* SVGDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = B222781E0D00BF1F0071B782 /* SVGDocument.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B22279B60D00BF220071B782 /* SVGElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278200D00BF1F0071B782 /* SVGElement.cpp */; };
 		B22279B70D00BF220071B782 /* SVGElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278210D00BF1F0071B782 /* SVGElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B22279B90D00BF220071B782 /* SVGElementInstance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278230D00BF1F0071B782 /* SVGElementInstance.cpp */; };
@@ -5772,13 +5785,13 @@
 		C6F08FC91431000D00685849 /* JSMutationRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F08FC71431000D00685849 /* JSMutationRecord.cpp */; };
 		C6F08FCA1431000D00685849 /* JSMutationRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = C6F08FC81431000D00685849 /* JSMutationRecord.h */; };
 		C6F0900A14327B6100685849 /* MutationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = C6F0900114327B6100685849 /* MutationCallback.h */; };
-		C6F0900E14327B6100685849 /* WebKitMutationObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F0900514327B6100685849 /* WebKitMutationObserver.cpp */; };
-		C6F0900F14327B6100685849 /* WebKitMutationObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = C6F0900614327B6100685849 /* WebKitMutationObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C6F0900E14327B6100685849 /* MutationObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F0900514327B6100685849 /* MutationObserver.cpp */; };
+		C6F0900F14327B6100685849 /* MutationObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = C6F0900614327B6100685849 /* MutationObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C6F0902814327D4F00685849 /* JSMutationCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F0902014327D4F00685849 /* JSMutationCallback.cpp */; };
 		C6F0902914327D4F00685849 /* JSMutationCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = C6F0902114327D4F00685849 /* JSMutationCallback.h */; };
-		C6F0902C14327D4F00685849 /* JSWebKitMutationObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F0902414327D4F00685849 /* JSWebKitMutationObserver.cpp */; };
-		C6F0902D14327D4F00685849 /* JSWebKitMutationObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = C6F0902514327D4F00685849 /* JSWebKitMutationObserver.h */; };
-		C6F0917F143A2BB900685849 /* JSWebKitMutationObserverCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F0917E143A2BB900685849 /* JSWebKitMutationObserverCustom.cpp */; };
+		C6F0902C14327D4F00685849 /* JSMutationObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F0902414327D4F00685849 /* JSMutationObserver.cpp */; };
+		C6F0902D14327D4F00685849 /* JSMutationObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = C6F0902514327D4F00685849 /* JSMutationObserver.h */; };
+		C6F0917F143A2BB900685849 /* JSMutationObserverCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F0917E143A2BB900685849 /* JSMutationObserverCustom.cpp */; };
 		C6F09185143A6C3B00685849 /* JSMutationCallbackCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F09184143A6C3B00685849 /* JSMutationCallbackCustom.cpp */; };
 		C6F41047130C6E8900393DE4 /* EntryBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F41046130C6E8900393DE4 /* EntryBase.cpp */; };
 		CA3BF67C10D99BAE00E6CE53 /* ScrollAnimator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CA3BF67B10D99BAE00E6CE53 /* ScrollAnimator.cpp */; };
@@ -6993,6 +7006,9 @@
 		033A6A82147E08A600509B36 /* JSHTMLPropertiesCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLPropertiesCollection.h; sourceTree = "<group>"; };
 		052BFCE8128ABF1500FD338D /* GeolocationClientMock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GeolocationClientMock.cpp; path = mock/GeolocationClientMock.cpp; sourceTree = "<group>"; };
 		052BFCEA128ABF2100FD338D /* GeolocationClientMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = GeolocationClientMock.h; path = mock/GeolocationClientMock.h; sourceTree = "<group>"; };
+		0562F9441573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSSVGDocumentValue.cpp; sourceTree = "<group>"; };
+		0562F9451573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSSVGDocumentValue.h; sourceTree = "<group>"; };
+		0562F9601573F88F0031CA16 /* PlatformLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformLayer.h; sourceTree = "<group>"; };
 		05FD69DF12845D4300B2BEB3 /* DOMTimeStamp.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTimeStamp.h; sourceTree = "<group>"; };
 		06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ContextMenuItem.h; sourceTree = "<group>"; };
 		06027CB20B1CC03D00884B2D /* ContextMenuItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ContextMenuItemMac.mm; sourceTree = "<group>"; };
@@ -7647,6 +7663,8 @@
 		1F3C3BE8135CAF3C00B8C1AC /* MediaControls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControls.cpp; sourceTree = "<group>"; };
 		1F3C3BE9135CAF3C00B8C1AC /* MediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControls.h; sourceTree = "<group>"; };
 		1F3F19521499CA7600A5AEA7 /* PODFreeListArena.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PODFreeListArena.h; sourceTree = "<group>"; };
+		1FAFBF1615A5FA5200083A20 /* UTIUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UTIUtilities.h; sourceTree = "<group>"; };
+		1FAFBF1715A5FA5200083A20 /* UTIUtilities.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = UTIUtilities.mm; sourceTree = "<group>"; };
 		20D629241253690B00081543 /* InspectorInstrumentation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorInstrumentation.cpp; sourceTree = "<group>"; };
 		20D629251253690B00081543 /* InspectorInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorInstrumentation.h; sourceTree = "<group>"; };
 		2277775F1345DEA9008EA455 /* InspectorFrontendChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendChannel.h; sourceTree = "<group>"; };
@@ -7855,8 +7873,8 @@
 		31288E6F0E3005D6003619AE /* WebKitCSSKeyframeRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSKeyframeRule.h; sourceTree = "<group>"; };
 		31288E700E3005D6003619AE /* WebKitCSSKeyframesRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSKeyframesRule.cpp; sourceTree = "<group>"; };
 		31288E710E3005D6003619AE /* WebKitCSSKeyframesRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSKeyframesRule.h; sourceTree = "<group>"; };
-		3128CA67147331520074C72A /* NotificationController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NotificationController.cpp; path = notifications/NotificationController.cpp; sourceTree = "<group>"; };
-		3128CA6A147331630074C72A /* NotificationController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationController.h; path = notifications/NotificationController.h; sourceTree = "<group>"; };
+		3128CA67147331520074C72A /* NotificationController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NotificationController.cpp; path = Modules/notifications/NotificationController.cpp; sourceTree = "<group>"; };
+		3128CA6A147331630074C72A /* NotificationController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationController.h; path = Modules/notifications/NotificationController.h; sourceTree = "<group>"; };
 		312D67B01535691F00563D0D /* Dictionary.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Dictionary.cpp; sourceTree = "<group>"; };
 		31313F631443B35E006E2A90 /* FilterEffectRenderer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FilterEffectRenderer.cpp; sourceTree = "<group>"; };
 		31313F641443B35E006E2A90 /* FilterEffectRenderer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FilterEffectRenderer.h; sourceTree = "<group>"; };
@@ -7925,8 +7943,8 @@
 		31C0FF460E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEvent.h; sourceTree = "<group>"; };
 		31C0FF470E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitTransitionEvent.mm; sourceTree = "<group>"; };
 		31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEventInternal.h; sourceTree = "<group>"; };
-		31EC1D5014FEFD0800C94662 /* NotificationPermissionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NotificationPermissionCallback.idl; path = notifications/NotificationPermissionCallback.idl; sourceTree = "<group>"; };
-		31EC1DAC14FF26EA00C94662 /* NotificationPermissionCallback.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = NotificationPermissionCallback.h; path = notifications/NotificationPermissionCallback.h; sourceTree = "<group>"; };
+		31EC1D5014FEFD0800C94662 /* NotificationPermissionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NotificationPermissionCallback.idl; path = Modules/notifications/NotificationPermissionCallback.idl; sourceTree = "<group>"; };
+		31EC1DAC14FF26EA00C94662 /* NotificationPermissionCallback.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = NotificationPermissionCallback.h; path = Modules/notifications/NotificationPermissionCallback.h; sourceTree = "<group>"; };
 		31EC1E2614FF60EE00C94662 /* JSNotificationPermissionCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotificationPermissionCallback.cpp; sourceTree = "<group>"; };
 		31EC1E2714FF60EE00C94662 /* JSNotificationPermissionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotificationPermissionCallback.h; sourceTree = "<group>"; };
 		31FB1A4F120A5D0600DC02A0 /* DeviceMotionClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceMotionClient.h; sourceTree = "<group>"; };
@@ -7943,18 +7961,18 @@
 		31FE6E6C1501A3BF0004EBC4 /* JSNotificationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotificationCustom.cpp; sourceTree = "<group>"; };
 		3314ACE910892086000F0E56 /* JSExceptionBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSExceptionBase.cpp; sourceTree = "<group>"; };
 		3314ACEA10892086000F0E56 /* JSExceptionBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSExceptionBase.h; sourceTree = "<group>"; };
-		333F704E0FB49CA2008E12A6 /* Notification.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Notification.idl; path = notifications/Notification.idl; sourceTree = "<group>"; };
-		333F704F0FB49CA2008E12A6 /* Notification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Notification.h; path = notifications/Notification.h; sourceTree = "<group>"; };
-		33503C9910179A74003B47E1 /* NotificationClient.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationClient.h; path = notifications/NotificationClient.h; sourceTree = "<group>"; };
+		333F704E0FB49CA2008E12A6 /* Notification.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Notification.idl; path = Modules/notifications/Notification.idl; sourceTree = "<group>"; };
+		333F704F0FB49CA2008E12A6 /* Notification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Notification.h; path = Modules/notifications/Notification.h; sourceTree = "<group>"; };
+		33503C9910179A74003B47E1 /* NotificationClient.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationClient.h; path = Modules/notifications/NotificationClient.h; sourceTree = "<group>"; };
 		33503C9F10179AD7003B47E1 /* JSNotification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotification.cpp; sourceTree = "<group>"; };
 		33503CA010179AD7003B47E1 /* JSNotification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotification.h; sourceTree = "<group>"; };
 		33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotificationCenter.cpp; sourceTree = "<group>"; };
 		33503CA210179AD7003B47E1 /* JSNotificationCenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotificationCenter.h; sourceTree = "<group>"; };
 		33503CBF10179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDesktopNotificationsCustom.cpp; sourceTree = "<group>"; };
-		33503CC61017A1B1003B47E1 /* Notification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Notification.cpp; path = notifications/Notification.cpp; sourceTree = "<group>"; };
-		3390CA510FFC157B00921962 /* NotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NotificationCenter.cpp; path = notifications/NotificationCenter.cpp; sourceTree = "<group>"; };
-		3390CA520FFC157B00921962 /* NotificationCenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationCenter.h; path = notifications/NotificationCenter.h; sourceTree = "<group>"; };
-		3390CA530FFC157B00921962 /* NotificationCenter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NotificationCenter.idl; path = notifications/NotificationCenter.idl; sourceTree = "<group>"; };
+		33503CC61017A1B1003B47E1 /* Notification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Notification.cpp; path = Modules/notifications/Notification.cpp; sourceTree = "<group>"; };
+		3390CA510FFC157B00921962 /* NotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NotificationCenter.cpp; path = Modules/notifications/NotificationCenter.cpp; sourceTree = "<group>"; };
+		3390CA520FFC157B00921962 /* NotificationCenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationCenter.h; path = Modules/notifications/NotificationCenter.h; sourceTree = "<group>"; };
+		3390CA530FFC157B00921962 /* NotificationCenter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NotificationCenter.idl; path = Modules/notifications/NotificationCenter.idl; sourceTree = "<group>"; };
 		339B5B62131DAA3200F48D02 /* CookiesStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CookiesStrategy.h; sourceTree = "<group>"; };
 		33C0CCD2112C5E6200CE057D /* SecureTextInput.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SecureTextInput.cpp; sourceTree = "<group>"; };
 		33C0CCD3112C5E6200CE057D /* SecureTextInput.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecureTextInput.h; sourceTree = "<group>"; };
@@ -8236,9 +8254,13 @@
 		44A28AAE12DFB8BF00AE923B /* MathMLNames.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathMLNames.h; sourceTree = "<group>"; };
 		44D8DA98139545BE00337B75 /* SVGMPathElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGMPathElement.idl; sourceTree = "<group>"; };
 		44D8DA9A139545CD00337B75 /* SVGAnimateMotionElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGAnimateMotionElement.idl; sourceTree = "<group>"; };
+		44DAB5AF15A623580097C1E4 /* Extensions3DOpenGLCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Extensions3DOpenGLCommon.cpp; sourceTree = "<group>"; };
+		44DAB5B015A623580097C1E4 /* Extensions3DOpenGLCommon.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Extensions3DOpenGLCommon.h; sourceTree = "<group>"; };
 		45099C401370A7800058D513 /* IconURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconURL.cpp; sourceTree = "<group>"; };
 		450CEBEE15073BBE002BB149 /* LabelableElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LabelableElement.cpp; sourceTree = "<group>"; };
 		450CEBEF15073BBE002BB149 /* LabelableElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LabelableElement.h; sourceTree = "<group>"; };
+		453EB634159C570400001BB7 /* DateTimeFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DateTimeFormat.cpp; sourceTree = "<group>"; };
+		453EB635159C570400001BB7 /* DateTimeFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DateTimeFormat.h; sourceTree = "<group>"; };
 		458FE4071589DF0B005609E6 /* RenderSearchField.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSearchField.cpp; sourceTree = "<group>"; };
 		458FE4081589DF0B005609E6 /* RenderSearchField.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSearchField.h; sourceTree = "<group>"; };
 		45BAC2AF1360BBAB005DA258 /* IconURL.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IconURL.h; sourceTree = "<group>"; };
@@ -8391,7 +8413,6 @@
 		49E912A80EFAC906009D0CAF /* AnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationList.h; path = animation/AnimationList.h; sourceTree = "<group>"; };
 		49E912A90EFAC906009D0CAF /* TimingFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TimingFunction.h; path = animation/TimingFunction.h; sourceTree = "<group>"; };
 		49ECEB5E1499790D00CDD3A4 /* FECompositeArithmeticNEON.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FECompositeArithmeticNEON.h; sourceTree = "<group>"; };
-		49ECEB5F1499790D00CDD3A4 /* FEGaussianBlurNEON.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FEGaussianBlurNEON.cpp; sourceTree = "<group>"; };
 		49ECEB601499790D00CDD3A4 /* FEGaussianBlurNEON.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FEGaussianBlurNEON.h; sourceTree = "<group>"; };
 		49ECEB611499790D00CDD3A4 /* FELightingNEON.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FELightingNEON.cpp; sourceTree = "<group>"; };
 		49ECEB621499790D00CDD3A4 /* FELightingNEON.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FELightingNEON.h; sourceTree = "<group>"; };
@@ -8504,10 +8525,10 @@
 		4F1534DD11B532EC0021FD86 /* EditingBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehavior.h; sourceTree = "<group>"; };
 		4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehaviorTypes.h; sourceTree = "<group>"; };
 		4F2D205212EAE7B3005C2874 /* InspectorAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgent.h; sourceTree = "<group>"; };
-		4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentation.h; sourceTree = "<group>"; };
 		4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorAgent.cpp; sourceTree = "<group>"; };
 		4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorValues.cpp; sourceTree = "<group>"; };
 		4F3289B411A42AAB005ABE7E /* InspectorValues.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorValues.h; sourceTree = "<group>"; };
+		4F32BB1A14FA85AA00F6C1A3 /* MemoryInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryInstrumentation.h; sourceTree = "<group>"; };
 		4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
 		4F4F5FFC11CBD30100A186BF /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
 		4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorPageAgent.cpp; sourceTree = "<group>"; };
@@ -8965,8 +8986,13 @@
 		75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEventInternal.h; sourceTree = "<group>"; };
 		758978EA127090D60076D5A9 /* SpeechInputResult.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpeechInputResult.cpp; sourceTree = "<group>"; };
 		758978EB127090D60076D5A9 /* SpeechInputResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpeechInputResult.h; sourceTree = "<group>"; };
+		762F1ED6159D960A007408F2 /* HTMLDialogElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDialogElement.h; sourceTree = "<group>"; };
+		762F1ED8159D961A007408F2 /* HTMLDialogElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDialogElement.idl; sourceTree = "<group>"; };
+		762F1EDA159D968A007408F2 /* HTMLDialogElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDialogElement.cpp; sourceTree = "<group>"; };
 		7633A72413D8B33A008501B6 /* LocaleToScriptMapping.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocaleToScriptMapping.h; sourceTree = "<group>"; };
 		7633A72513D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocaleToScriptMappingDefault.cpp; sourceTree = "<group>"; };
+		76808B4D159DADFA002B5233 /* JSHTMLDialogElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSHTMLDialogElement.cpp; path = JSHTMLDialogElement.cpp; sourceTree = "<group>"; };
+		76808B4E159DADFA002B5233 /* JSHTMLDialogElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSHTMLDialogElement.h; path = JSHTMLDialogElement.h; sourceTree = "<group>"; };
 		7694563A1214D97C0007CBAE /* JSDOMTokenList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMTokenList.cpp; sourceTree = "<group>"; };
 		7694563B1214D97C0007CBAE /* JSDOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMTokenList.h; sourceTree = "<group>"; };
 		769456591214DB630007CBAE /* DOMDOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDOMTokenList.h; sourceTree = "<group>"; };
@@ -10150,6 +10176,7 @@
 		91089D3014C335CD005AFC49 /* JSUint8ClampedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSUint8ClampedArray.h; sourceTree = "<group>"; };
 		91A3905814C0F4B900F67901 /* Uint8ClampedArray.idl */ = {isa = PBXFileReference; lastKnownFileType = text; name = Uint8ClampedArray.idl; path = canvas/Uint8ClampedArray.idl; sourceTree = "<group>"; };
 		91A3905A14C0F61100F67901 /* JSUint8ClampedArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSUint8ClampedArrayCustom.cpp; sourceTree = "<group>"; };
+		930062D7159B45B600ACD48A /* NEONHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NEONHelpers.h; sourceTree = "<group>"; };
 		9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroup.cpp; sourceTree = "<group>"; };
 		9302B0BE0D79F82C00C7EE83 /* PageGroup.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageGroup.h; sourceTree = "<group>"; };
 		9305B24C098F1B6B00C28855 /* Timer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Timer.h; sourceTree = "<group>"; };
@@ -10667,9 +10694,9 @@
 		97AABD1014FA09D5007457AE /* WebSocketHandshakeResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketHandshakeResponse.h; path = Modules/websockets/WebSocketHandshakeResponse.h; sourceTree = "<group>"; };
 		97AABD1114FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerThreadableWebSocketChannel.cpp; path = Modules/websockets/WorkerThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
 		97AABD1214FA09D5007457AE /* WorkerThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerThreadableWebSocketChannel.h; path = Modules/websockets/WorkerThreadableWebSocketChannel.h; sourceTree = "<group>"; };
-		97B38E23151C4264004622E9 /* DOMWindowNotifications.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMWindowNotifications.cpp; path = notifications/DOMWindowNotifications.cpp; sourceTree = "<group>"; };
-		97B38E24151C4264004622E9 /* DOMWindowNotifications.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMWindowNotifications.h; path = notifications/DOMWindowNotifications.h; sourceTree = "<group>"; };
-		97B38E25151C4264004622E9 /* DOMWindowNotifications.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowNotifications.idl; path = notifications/DOMWindowNotifications.idl; sourceTree = "<group>"; };
+		97B38E23151C4264004622E9 /* DOMWindowNotifications.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMWindowNotifications.cpp; path = Modules/notifications/DOMWindowNotifications.cpp; sourceTree = "<group>"; };
+		97B38E24151C4264004622E9 /* DOMWindowNotifications.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMWindowNotifications.h; path = Modules/notifications/DOMWindowNotifications.h; sourceTree = "<group>"; };
+		97B38E25151C4264004622E9 /* DOMWindowNotifications.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowNotifications.idl; path = Modules/notifications/DOMWindowNotifications.idl; sourceTree = "<group>"; };
 		97BC69D61505F076001B74AC /* AbstractDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AbstractDatabase.cpp; path = Modules/webdatabase/AbstractDatabase.cpp; sourceTree = "<group>"; };
 		97BC69D71505F076001B74AC /* AbstractDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AbstractDatabase.h; path = Modules/webdatabase/AbstractDatabase.h; sourceTree = "<group>"; };
 		97BC69D81505F076001B74AC /* ChangeVersionWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ChangeVersionWrapper.cpp; path = Modules/webdatabase/ChangeVersionWrapper.cpp; sourceTree = "<group>"; };
@@ -10752,9 +10779,9 @@
 		97E4028D13A696ED00913D67 /* IconController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconController.cpp; sourceTree = "<group>"; };
 		97E4028E13A696ED00913D67 /* IconController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IconController.h; sourceTree = "<group>"; };
 		97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptControllerBase.cpp; sourceTree = "<group>"; };
-		97F8E661151D4A3F00D2D181 /* WorkerContextNotifications.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerContextNotifications.cpp; path = notifications/WorkerContextNotifications.cpp; sourceTree = "<group>"; };
-		97F8E662151D4A3F00D2D181 /* WorkerContextNotifications.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerContextNotifications.h; path = notifications/WorkerContextNotifications.h; sourceTree = "<group>"; };
-		97F8E663151D4A3F00D2D181 /* WorkerContextNotifications.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WorkerContextNotifications.idl; path = notifications/WorkerContextNotifications.idl; sourceTree = "<group>"; };
+		97F8E661151D4A3F00D2D181 /* WorkerContextNotifications.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerContextNotifications.cpp; path = Modules/notifications/WorkerContextNotifications.cpp; sourceTree = "<group>"; };
+		97F8E662151D4A3F00D2D181 /* WorkerContextNotifications.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerContextNotifications.h; path = Modules/notifications/WorkerContextNotifications.h; sourceTree = "<group>"; };
+		97F8E663151D4A3F00D2D181 /* WorkerContextNotifications.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WorkerContextNotifications.idl; path = Modules/notifications/WorkerContextNotifications.idl; sourceTree = "<group>"; };
 		9831AE49154225A200FE2644 /* ReferrerPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReferrerPolicy.h; sourceTree = "<group>"; };
 		984264EF12D5280A000D88A4 /* LinkLoaderClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LinkLoaderClient.h; sourceTree = "<group>"; };
 		9856F8C81549E82400B04F3A /* Prerenderer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Prerenderer.cpp; path = loader/Prerenderer.cpp; sourceTree = SOURCE_ROOT; };
@@ -12985,14 +13012,14 @@
 		C6F08FC81431000D00685849 /* JSMutationRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMutationRecord.h; sourceTree = "<group>"; };
 		C6F0900114327B6100685849 /* MutationCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MutationCallback.h; sourceTree = "<group>"; };
 		C6F0900214327B6100685849 /* MutationCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = MutationCallback.idl; sourceTree = "<group>"; };
-		C6F0900514327B6100685849 /* WebKitMutationObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitMutationObserver.cpp; sourceTree = "<group>"; };
-		C6F0900614327B6100685849 /* WebKitMutationObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitMutationObserver.h; sourceTree = "<group>"; };
-		C6F0900714327B6100685849 /* WebKitMutationObserver.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitMutationObserver.idl; sourceTree = "<group>"; };
+		C6F0900514327B6100685849 /* MutationObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationObserver.cpp; sourceTree = "<group>"; };
+		C6F0900614327B6100685849 /* MutationObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MutationObserver.h; sourceTree = "<group>"; };
+		C6F0900714327B6100685849 /* MutationObserver.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = MutationObserver.idl; sourceTree = "<group>"; };
 		C6F0902014327D4F00685849 /* JSMutationCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMutationCallback.cpp; sourceTree = "<group>"; };
 		C6F0902114327D4F00685849 /* JSMutationCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMutationCallback.h; sourceTree = "<group>"; };
-		C6F0902414327D4F00685849 /* JSWebKitMutationObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitMutationObserver.cpp; sourceTree = "<group>"; };
-		C6F0902514327D4F00685849 /* JSWebKitMutationObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitMutationObserver.h; sourceTree = "<group>"; };
-		C6F0917E143A2BB900685849 /* JSWebKitMutationObserverCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitMutationObserverCustom.cpp; sourceTree = "<group>"; };
+		C6F0902414327D4F00685849 /* JSMutationObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMutationObserver.cpp; sourceTree = "<group>"; };
+		C6F0902514327D4F00685849 /* JSMutationObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMutationObserver.h; sourceTree = "<group>"; };
+		C6F0917E143A2BB900685849 /* JSMutationObserverCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMutationObserverCustom.cpp; sourceTree = "<group>"; };
 		C6F09184143A6C3B00685849 /* JSMutationCallbackCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMutationCallbackCustom.cpp; sourceTree = "<group>"; };
 		C6F41046130C6E8900393DE4 /* EntryBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = EntryBase.cpp; path = Modules/filesystem/EntryBase.cpp; sourceTree = "<group>"; };
 		CA3BF67B10D99BAE00E6CE53 /* ScrollAnimator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollAnimator.cpp; sourceTree = "<group>"; };
@@ -13930,7 +13957,6 @@
 				1C81B94D0E9732D900266E07 /* inspector */,
 				BCB16BFB0979C38700467741 /* loader */,
 				FABE72EC1059C1EB00D999DD /* mathml */,
-				333F703D0FB49C16008E12A6 /* notifications */,
 				65BF02180974806300C43196 /* page */,
 				BCF1A5BA097832090061A123 /* platform */,
 				5DCF83690D59157800953BC6 /* plugins */,
@@ -15092,8 +15118,8 @@
 			isa = PBXGroup;
 			children = (
 				49ECEB5E1499790D00CDD3A4 /* FECompositeArithmeticNEON.h */,
-				49ECEB5F1499790D00CDD3A4 /* FEGaussianBlurNEON.cpp */,
 				49ECEB601499790D00CDD3A4 /* FEGaussianBlurNEON.h */,
+				930062D7159B45B600ACD48A /* NEONHelpers.h */,
 				49ECEB611499790D00CDD3A4 /* FELightingNEON.cpp */,
 				49ECEB621499790D00CDD3A4 /* FELightingNEON.h */,
 			);
@@ -15419,6 +15445,8 @@
 				514C76470CE9234E007EF3CD /* ResourceHandleMac.mm */,
 				514C76490CE9234E007EF3CD /* ResourceRequestMac.mm */,
 				514C764B0CE9234E007EF3CD /* ResourceResponseMac.mm */,
+				1FAFBF1615A5FA5200083A20 /* UTIUtilities.h */,
+				1FAFBF1715A5FA5200083A20 /* UTIUtilities.mm */,
 				37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */,
 				37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */,
 			);
@@ -17189,6 +17217,9 @@
 				D359D786129CA2710006E5D2 /* HTMLDetailsElement.cpp */,
 				D359D787129CA2710006E5D2 /* HTMLDetailsElement.h */,
 				D359D788129CA2710006E5D2 /* HTMLDetailsElement.idl */,
+				762F1EDA159D968A007408F2 /* HTMLDialogElement.cpp */,
+				762F1ED8159D961A007408F2 /* HTMLDialogElement.idl */,
+				762F1ED6159D960A007408F2 /* HTMLDialogElement.h */,
 				A8EA79ED0A1916DF00A8EF5F /* HTMLDirectoryElement.cpp */,
 				A8EA79EE0A1916DF00A8EF5F /* HTMLDirectoryElement.h */,
 				1A85B1D90A1B23A400D8C87C /* HTMLDirectoryElement.idl */,
@@ -17480,6 +17511,7 @@
 		971145FE14EF006E00674FD9 /* Modules */ = {
 			isa = PBXGroup;
 			children = (
+				333F703D0FB49C16008E12A6 /* notifications */,
 				971145FF14EF007900674FD9 /* geolocation */,
 				9712A55315004E3C0048AF10 /* indexeddb */,
 				89F60B08157F68350075E157 /* quota */,
@@ -18058,6 +18090,8 @@
 				F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */,
 				D359D8BC129CA55C0006E5D2 /* JSHTMLDetailsElement.cpp */,
 				D359D8BD129CA55C0006E5D2 /* JSHTMLDetailsElement.h */,
+				76808B4D159DADFA002B5233 /* JSHTMLDialogElement.cpp */,
+				76808B4E159DADFA002B5233 /* JSHTMLDialogElement.h */,
 				1A85B1E00A1B240500D8C87C /* JSHTMLDirectoryElement.cpp */,
 				1A85B1E10A1B240500D8C87C /* JSHTMLDirectoryElement.h */,
 				1A85B2B40A1B2AC700D8C87C /* JSHTMLDivElement.cpp */,
@@ -18682,6 +18716,8 @@
 				FE80DA620E9C4703000D6F75 /* JSGeoposition.h */,
 				C6F0902014327D4F00685849 /* JSMutationCallback.cpp */,
 				C6F0902114327D4F00685849 /* JSMutationCallback.h */,
+				C6F0902414327D4F00685849 /* JSMutationObserver.cpp */,
+				C6F0902514327D4F00685849 /* JSMutationObserver.h */,
 				C6F08FC71431000D00685849 /* JSMutationRecord.cpp */,
 				C6F08FC81431000D00685849 /* JSMutationRecord.h */,
 				BCD9C2BC0C17B69E005C90A2 /* JSNamedNodeMap.cpp */,
@@ -18714,8 +18750,6 @@
 				75415D54129AB2D2003AD669 /* JSSpeechInputResultList.h */,
 				65DF31EF09D1CC60000BE325 /* JSText.cpp */,
 				65DF31F009D1CC60000BE325 /* JSText.h */,
-				C6F0902414327D4F00685849 /* JSWebKitMutationObserver.cpp */,
-				C6F0902514327D4F00685849 /* JSWebKitMutationObserver.h */,
 				D7613AC214753E5600DB8606 /* JSWebKitNamedFlow.cpp */,
 				D7613AC314753E5600DB8606 /* JSWebKitNamedFlow.h */,
 			);
@@ -19548,6 +19582,7 @@
 		B2A015910AF6CD53006BCE0E /* graphics */ = {
 			isa = PBXGroup;
 			children = (
+				0562F9601573F88F0031CA16 /* PlatformLayer.h */,
 				076F0D0812B8192700C26AA4 /* avfoundation */,
 				499B3EC0128CCC1800E726C2 /* ca */,
 				B27535290B053814002CE64F /* cg */,
@@ -19715,6 +19750,8 @@
 				B2C3D9F30D006C1D00EF6F26 /* BidiContext.h */,
 				B2C3D9F40D006C1D00EF6F26 /* BidiResolver.h */,
 				A8C402921348B2220063F1E5 /* BidiRunList.h */,
+				453EB634159C570400001BB7 /* DateTimeFormat.cpp */,
+				453EB635159C570400001BB7 /* DateTimeFormat.h */,
 				CECCFC3A141973D5002A0AC1 /* DecodeEscapeSequences.h */,
 				375CD231119D43C800A2A859 /* Hyphenation.h */,
 				A5ABB78613B904BC00F197E3 /* LineBreakIteratorPoolICU.h */,
@@ -20113,6 +20150,7 @@
 				E1ADED460E76B8DD004A1A5E /* JSMessagePortCustom.cpp */,
 				41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */,
 				C6F09184143A6C3B00685849 /* JSMutationCallbackCustom.cpp */,
+				C6F0917E143A2BB900685849 /* JSMutationObserverCustom.cpp */,
 				BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */,
 				BCD9C2600C17AA67005C90A2 /* JSNodeCustom.cpp */,
 				BC9439C2116CF4940048C750 /* JSNodeCustom.h */,
@@ -20152,7 +20190,6 @@
 				3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */,
 				E1AD14C41297354900ACA989 /* JSWebKitCSSKeyframeRuleCustom.cpp */,
 				E1AD14B4129734CA00ACA989 /* JSWebKitCSSKeyframesRuleCustom.cpp */,
-				C6F0917E143A2BB900685849 /* JSWebKitMutationObserverCustom.cpp */,
 				BC275B7811C5D1C300C9206C /* JSWebKitPointCustom.cpp */,
 				518A34C61026C8C9001B6896 /* JSWebSocketCustom.cpp */,
 				E18258AB0EF3CD7000933242 /* JSWorkerContextCustom.cpp */,
@@ -20996,6 +21033,8 @@
 				8AA61CFD144D595B00F37350 /* WebKitCSSRegionRule.cpp */,
 				8AA61CFE144D595B00F37350 /* WebKitCSSRegionRule.h */,
 				8AD0A55614C87425000D83C5 /* WebKitCSSRegionRule.idl */,
+				0562F9441573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.cpp */,
+				0562F9451573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.h */,
 				5038BC0614711CDB0095E0D1 /* WebKitCSSShaderValue.cpp */,
 				50B42157146976960087E604 /* WebKitCSSShaderValue.h */,
 				BC9ADD7F0CC4092200098C4C /* WebKitCSSTransformValue.cpp */,
@@ -21452,6 +21491,9 @@
 				D6E528A2149A926D00EFE1F3 /* MutationObserverInterestGroup.h */,
 				D6E276AD14637455001D280A /* MutationObserverRegistration.cpp */,
 				D6E276AE14637455001D280A /* MutationObserverRegistration.h */,
+				C6F0900514327B6100685849 /* MutationObserver.cpp */,
+				C6F0900614327B6100685849 /* MutationObserver.h */,
+				C6F0900714327B6100685849 /* MutationObserver.idl */,
 				C6F08FB91430FE8F00685849 /* MutationRecord.cpp */,
 				C6F08FBA1430FE8F00685849 /* MutationRecord.h */,
 				C6F08FBB1430FE8F00685849 /* MutationRecord.idl */,
@@ -21586,9 +21628,6 @@
 				31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */,
 				31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */,
 				31C0FF1D0E4CEB6E007D6FE5 /* WebKitAnimationEvent.idl */,
-				C6F0900514327B6100685849 /* WebKitMutationObserver.cpp */,
-				C6F0900614327B6100685849 /* WebKitMutationObserver.h */,
-				C6F0900714327B6100685849 /* WebKitMutationObserver.idl */,
 				D7613A4E1474F13F00DB8606 /* WebKitNamedFlow.cpp */,
 				D7613A4D1474F13F00DB8606 /* WebKitNamedFlow.h */,
 				D7613A4A1474EE9500DB8606 /* WebKitNamedFlow.idl */,
@@ -21626,6 +21665,8 @@
 		FBC220DD1237FBEB00BCF788 /* opengl */ = {
 			isa = PBXGroup;
 			children = (
+				44DAB5AF15A623580097C1E4 /* Extensions3DOpenGLCommon.cpp */,
+				44DAB5B015A623580097C1E4 /* Extensions3DOpenGLCommon.h */,
 				6E67D2A41280E8A4008758F7 /* Extensions3DOpenGL.cpp */,
 				6E67D2A51280E8A4008758F7 /* Extensions3DOpenGL.h */,
 				FBC220DE1237FBEB00BCF788 /* GraphicsContext3DOpenGL.cpp */,
@@ -22262,6 +22303,7 @@
 				81AC599A131636E60009A7E0 /* DataTransferItemList.h in Headers */,
 				2E97CCEB12939CB800C5C8FF /* DataView.h in Headers */,
 				A5732B0B136A161D005C8D7C /* DateComponents.h in Headers */,
+				453EB637159C570400001BB7 /* DateTimeFormat.h in Headers */,
 				F55B3DB61251F12D003EF269 /* DateInputType.h in Headers */,
 				F55B3DB81251F12D003EF269 /* DateTimeInputType.h in Headers */,
 				F55B3DBA1251F12D003EF269 /* DateTimeLocalInputType.h in Headers */,
@@ -23702,6 +23744,7 @@
 				A86629D109DA2B48009633A5 /* JSMouseEvent.h in Headers */,
 				C6F0902914327D4F00685849 /* JSMutationCallback.h in Headers */,
 				65DF31FC09D1CC60000BE325 /* JSMutationEvent.h in Headers */,
+				C6F0902D14327D4F00685849 /* JSMutationObserver.h in Headers */,
 				C6F08FCA1431000D00685849 /* JSMutationRecord.h in Headers */,
 				BCD9C2C10C17B69E005C90A2 /* JSNamedNodeMap.h in Headers */,
 				A9D247F80D757E3400FDF959 /* JSNavigator.h in Headers */,
@@ -23956,7 +23999,6 @@
 				498391400F1E767500C23782 /* JSWebKitCSSMatrix.h in Headers */,
 				8AD0A59514C88336000D83C5 /* JSWebKitCSSRegionRule.h in Headers */,
 				31611E5B0E1C4DE000F6A579 /* JSWebKitCSSTransformValue.h in Headers */,
-				C6F0902D14327D4F00685849 /* JSWebKitMutationObserver.h in Headers */,
 				494BD79E0F55C94C00747828 /* JSWebKitPoint.h in Headers */,
 				31C0FF400E4CEFAC007D6FE5 /* JSWebKitTransitionEvent.h in Headers */,
 				5DA5E0FD102B953800088CF9 /* JSWebSocket.h in Headers */,
@@ -24089,6 +24131,7 @@
 				FDB1700614A2BAB200A2B5D9 /* MultiChannelResampler.h in Headers */,
 				C6F0900A14327B6100685849 /* MutationCallback.h in Headers */,
 				85031B4A0A44EFC700F992E0 /* MutationEvent.h in Headers */,
+				C6F0900F14327B6100685849 /* MutationObserver.h in Headers */,
 				D6E528A4149A926D00EFE1F3 /* MutationObserverInterestGroup.h in Headers */,
 				D6E276B014637455001D280A /* MutationObserverRegistration.h in Headers */,
 				C6F08FBD1430FE8F00685849 /* MutationRecord.h in Headers */,
@@ -24199,6 +24242,7 @@
 				A723F77B1484CA4C008C6DBE /* PlatformExportMacros.h in Headers */,
 				BC9585E112F0989500755821 /* PlatformGestureEvent.h in Headers */,
 				935C476809AC4D4300A6AAB4 /* PlatformKeyboardEvent.h in Headers */,
+				0562F9611573F88F0031CA16 /* PlatformLayer.h in Headers */,
 				932871C00B20DEB70049035A /* PlatformMenuDescription.h in Headers */,
 				41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */,
 				935C476909AC4D4300A6AAB4 /* PlatformMouseEvent.h in Headers */,
@@ -25043,10 +25087,10 @@
 				31288E750E3005D6003619AE /* WebKitCSSKeyframesRule.h in Headers */,
 				498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */,
 				8AA61D00144D595B00F37350 /* WebKitCSSRegionRule.h in Headers */,
+				0562F9471573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.h in Headers */,
 				29CD61DE146D02890068E82A /* WebKitCSSShaderValue.h in Headers */,
 				BC9ADD230CC4032600098C4C /* WebKitCSSTransformValue.h in Headers */,
 				89878566122CA064003AABDA /* WebKitFlags.h in Headers */,
-				C6F0900F14327B6100685849 /* WebKitMutationObserver.h in Headers */,
 				494BD7950F55C8EE00747828 /* WebKitPoint.h in Headers */,
 				31C0FF250E4CEB6E007D6FE5 /* WebKitTransitionEvent.h in Headers */,
 				0FCF332F0F2B9A25004B6795 /* WebLayer.h in Headers */,
@@ -25155,6 +25199,10 @@
 				50987C27157D676D00BDA835 /* CustomFilterGlobalContext.h in Headers */,
 				4F32BB1B14FA85E800F6C1A3 /* MemoryInstrumentation.h in Headers */,
 				A882DA231593848D000115ED /* CSSToStyleMap.h in Headers */,
+				762F1ED7159D960A007408F2 /* HTMLDialogElement.h in Headers */,
+				76808B50159DADFA002B5233 /* JSHTMLDialogElement.h in Headers */,
+				1FAFBF1915A5FA7400083A20 /* UTIUtilities.h in Headers */,
+				44DAB5B215A623580097C1E4 /* Extensions3DOpenGLCommon.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -25776,6 +25824,7 @@
 				2E97CCEA12939CB800C5C8FF /* DataView.cpp in Sources */,
 				A5732B0A136A161D005C8D7C /* DateComponents.cpp in Sources */,
 				F55B3DB51251F12D003EF269 /* DateInputType.cpp in Sources */,
+				453EB636159C570400001BB7 /* DateTimeFormat.cpp in Sources */,
 				F55B3DB71251F12D003EF269 /* DateTimeInputType.cpp in Sources */,
 				F55B3DB91251F12D003EF269 /* DateTimeLocalInputType.cpp in Sources */,
 				45FEA5CF156DDE8C00654101 /* Decimal.cpp in Sources */,
@@ -26210,7 +26259,6 @@
 				4358E8801360A31700E4748C /* FEDropShadow.cpp in Sources */,
 				84730D7E1248F0B300D3A9C9 /* FEFlood.cpp in Sources */,
 				84801954108BAFB300CB2B1F /* FEGaussianBlur.cpp in Sources */,
-				49ECEB691499790D00CDD3A4 /* FEGaussianBlurNEON.cpp in Sources */,
 				84730D801248F0B300D3A9C9 /* FELighting.cpp in Sources */,
 				49ECEB6B1499790D00CDD3A4 /* FELightingNEON.cpp in Sources */,
 				84730D821248F0B300D3A9C9 /* FEMerge.cpp in Sources */,
@@ -26921,6 +26969,8 @@
 				C6F0902814327D4F00685849 /* JSMutationCallback.cpp in Sources */,
 				C6F09185143A6C3B00685849 /* JSMutationCallbackCustom.cpp in Sources */,
 				65DF31FB09D1CC60000BE325 /* JSMutationEvent.cpp in Sources */,
+				C6F0902C14327D4F00685849 /* JSMutationObserver.cpp in Sources */,
+				C6F0917F143A2BB900685849 /* JSMutationObserverCustom.cpp in Sources */,
 				C6F08FC91431000D00685849 /* JSMutationRecord.cpp in Sources */,
 				BCD9C2C00C17B69E005C90A2 /* JSNamedNodeMap.cpp in Sources */,
 				BCD9C2630C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp in Sources */,
@@ -27212,8 +27262,6 @@
 				4983913F0F1E767500C23782 /* JSWebKitCSSMatrix.cpp in Sources */,
 				8AD0A59414C88336000D83C5 /* JSWebKitCSSRegionRule.cpp in Sources */,
 				31611E5A0E1C4DE000F6A579 /* JSWebKitCSSTransformValue.cpp in Sources */,
-				C6F0902C14327D4F00685849 /* JSWebKitMutationObserver.cpp in Sources */,
-				C6F0917F143A2BB900685849 /* JSWebKitMutationObserverCustom.cpp in Sources */,
 				D7613AC414753E5600DB8606 /* JSWebKitNamedFlow.cpp in Sources */,
 				494BD79D0F55C94C00747828 /* JSWebKitPoint.cpp in Sources */,
 				BC275B7911C5D1C300C9206C /* JSWebKitPointCustom.cpp in Sources */,
@@ -27346,6 +27394,7 @@
 				93309DFB099E64920056E581 /* MoveSelectionCommand.cpp in Sources */,
 				FDB1700514A2BAB200A2B5D9 /* MultiChannelResampler.cpp in Sources */,
 				85031B490A44EFC700F992E0 /* MutationEvent.cpp in Sources */,
+				C6F0900E14327B6100685849 /* MutationObserver.cpp in Sources */,
 				D6E528A3149A926D00EFE1F3 /* MutationObserverInterestGroup.cpp in Sources */,
 				D6E276AF14637455001D280A /* MutationObserverRegistration.cpp in Sources */,
 				C6F08FBC1430FE8F00685849 /* MutationRecord.cpp in Sources */,
@@ -28108,9 +28157,9 @@
 				498391580F1E776900C23782 /* WebKitCSSMatrix.cpp in Sources */,
 				8AA61CFF144D595B00F37350 /* WebKitCSSRegionRule.cpp in Sources */,
 				5038BC0714711CDB0095E0D1 /* WebKitCSSShaderValue.cpp in Sources */,
+				0562F9461573ECEB0031CA16 /* WebKitCSSSVGDocumentValue.cpp in Sources */,
 				BC9ADD800CC4092200098C4C /* WebKitCSSTransformValue.cpp in Sources */,
 				1A1414B513A0F0500019996C /* WebKitFontFamilyNames.cpp in Sources */,
-				C6F0900E14327B6100685849 /* WebKitMutationObserver.cpp in Sources */,
 				D7613A501474F13F00DB8606 /* WebKitNamedFlow.cpp in Sources */,
 				31C0FF240E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp in Sources */,
 				0FCF332E0F2B9A25004B6795 /* WebLayer.mm in Sources */,
@@ -28208,6 +28257,10 @@
 				CE7B2DB61586ABAD0098B3FA /* TextAlternativeWithRange.mm in Sources */,
 				50987C26157D676D00BDA835 /* CustomFilterGlobalContext.cpp in Sources */,
 				A882DA201593846A000115ED /* CSSToStyleMap.cpp in Sources */,
+				762F1EDB159D968A007408F2 /* HTMLDialogElement.cpp in Sources */,
+				76808B4F159DADFA002B5233 /* JSHTMLDialogElement.cpp in Sources */,
+				1FAFBF1815A5FA6E00083A20 /* UTIUtilities.mm in Sources */,
+				44DAB5B115A623580097C1E4 /* Extensions3DOpenGLCommon.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index fdb8d0240..74c2b03fa 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -2424,7 +2424,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
 void AccessibilityRenderObject::getDocumentLinks(AccessibilityChildrenVector& result)
 {
     Document* document = m_renderer->document();
-    HTMLCollection* links = document->links();
+    RefPtr<HTMLCollection> links = document->links();
     for (unsigned i = 0; Node* curr = links->item(i); i++) {
         RenderObject* obj = curr->renderer();
         if (obj) {
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index db8ce367d..494f866b0 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -198,4 +198,8 @@ bool RuntimeEnabledFeatures::isStyleScopedEnabled = false;
 bool RuntimeEnabledFeatures::isInputTypeDateEnabled = true;
 #endif
 
+#if ENABLE(DIALOG_ELEMENT)
+bool RuntimeEnabledFeatures::isDialogElementEnabled = false;
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 6f4914316..a17688909 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -231,6 +231,11 @@ public:
     static void setInputTypeDateEnabled(bool isEnabled) { isInputTypeDateEnabled = isEnabled; }
 #endif
 
+#if ENABLE(DIALOG_ELEMENT)
+    static bool dialogElementEnabled() { return isDialogElementEnabled; }
+    static void setDialogElementEnabled(bool isEnabled) { isDialogElementEnabled = isEnabled; }
+#endif
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -304,6 +309,10 @@ private:
 #if ENABLE(INPUT_TYPE_DATE)
     static bool isInputTypeDateEnabled;
 #endif
+
+#if ENABLE(DIALOG_ELEMENT)
+    static bool isDialogElementEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index c7025286d..fa0454203 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -66,6 +66,10 @@ webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMFileList.cpp \
 	DerivedSources/webkit/WebKitDOMFileListPrivate.h \
 	DerivedSources/webkit/WebKitDOMFilePrivate.h \
+	DerivedSources/webkit/WebKitDOMGamepad.cpp \
+	DerivedSources/webkit/WebKitDOMGamepadList.cpp \
+	DerivedSources/webkit/WebKitDOMGamepadListPrivate.h \
+	DerivedSources/webkit/WebKitDOMGamepadPrivate.h \
 	DerivedSources/webkit/WebKitDOMGeolocation.cpp \
 	DerivedSources/webkit/WebKitDOMGeolocationPrivate.h \
 	DerivedSources/webkit/WebKitDOMHistory.cpp \
@@ -295,6 +299,8 @@ webkitgtk_built_h_api += \
 	DerivedSources/webkit/WebKitDOMBlob.h \
 	DerivedSources/webkit/WebKitDOMFile.h \
 	DerivedSources/webkit/WebKitDOMFileList.h \
+	DerivedSources/webkit/WebKitDOMGamepad.h \
+	DerivedSources/webkit/WebKitDOMGamepadList.h \
 	DerivedSources/webkit/WebKitDOMGeolocation.h \
 	DerivedSources/webkit/WebKitDOMHTMLAnchorElement.h \
 	DerivedSources/webkit/WebKitDOMHTMLAppletElement.h \
@@ -428,7 +434,6 @@ webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMHTMLPropertiesCollectionPrivate.h
 endif
 
-
 if ENABLE_WEB_TIMING
 webkitgtk_built_h_api += \
 	$(top_builddir)/DerivedSources/webkit/WebKitDOMPerformance.h \
diff --git a/Source/WebCore/bindings/js/GCController.cpp b/Source/WebCore/bindings/js/GCController.cpp
index 96dadf373..79509687f 100644
--- a/Source/WebCore/bindings/js/GCController.cpp
+++ b/Source/WebCore/bindings/js/GCController.cpp
@@ -38,7 +38,7 @@ namespace WebCore {
 
 static void collect(void*)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
 }
 
@@ -63,7 +63,7 @@ void GCController::garbageCollectSoon()
     // down into WTF so that more platforms can take advantage of it, we will be 
     // able to use reportAbandonedObjectGraph on more platforms.
 #if USE(CF)
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     JSDOMWindow::commonJSGlobalData()->heap.reportAbandonedObjectGraph();
 #else
     if (!m_GCTimer.isActive())
@@ -80,7 +80,7 @@ void GCController::gcTimerFired(Timer<GCController>*)
 
 void GCController::garbageCollectNow()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     if (!JSDOMWindow::commonJSGlobalData()->heap.isBusy())
         JSDOMWindow::commonJSGlobalData()->heap.collectAllGarbage();
 }
@@ -104,7 +104,7 @@ void GCController::setJavaScriptGarbageCollectorTimerEnabled(bool enable)
 
 void GCController::discardAllCompiledCode()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     JSDOMWindow::commonJSGlobalData()->heap.deleteAllCompiledCode();
 }
 
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 66b4a7f43..8b94f6497 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -120,6 +120,7 @@
 #include "JSMessageEventCustom.cpp"
 #include "JSMessagePortCustom.cpp"
 #include "JSMutationCallbackCustom.cpp"
+#include "JSMutationObserverCustom.cpp"
 #include "JSNamedNodeMapCustom.cpp"
 #include "JSNodeCustom.cpp"
 #include "JSNodeFilterCondition.cpp"
@@ -158,7 +159,6 @@
 #include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
 #include "JSWebKitCSSKeyframesRuleCustom.cpp"
-#include "JSWebKitMutationObserverCustom.cpp"
 #include "JSWebKitPointCustom.cpp"
 #include "JSWebSocketCustom.cpp"
 #include "JSWorkerContextBase.cpp"
diff --git a/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 17bd910a6..34c28e9ce 100644
--- a/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/Source/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -48,7 +48,7 @@ bool JSSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLEr
 
     RefPtr<JSSQLStatementErrorCallback> protect(this);
 
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    JSC::JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
diff --git a/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp b/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp
index f830f5cdd..5d421badd 100644
--- a/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/Source/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -63,7 +63,7 @@ void JSCustomVoidCallback::handleEvent()
 
     RefPtr<JSCustomVoidCallback> protect(this);
         
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    JSC::JSLockHolder lock(m_data->globalObject()->globalData());
     MarkedArgumentBuffer args;
     m_data->invokeCallback(args);
 }
diff --git a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index bdaf0d553..a897b6fbc 100644
--- a/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -67,7 +67,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
     ASSERT(m_customResolver);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ExecState* exec = m_globalObject->globalExec();
         
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index d278a802a..c60e07d61 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -281,32 +281,53 @@ enum ParameterDefaultPolicy {
         return toJS(exec, globalObject, ptr.get());
     }
 
+    template <class T>
+    struct Traits {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const T& value)
+        {
+            return toJS(exec, globalObject, WTF::getPtr(value));
+        }
+    };
+
+    template<>
+    struct Traits<String> {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState* exec, JSDOMGlobalObject*, const String& value)
+        {
+            return jsString(exec, stringToUString(value));
+        }
+    };
+
+    template<>
+    struct Traits<float> {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState*, JSDOMGlobalObject*, const float& value)
+        {
+            return JSC::jsNumber(value);
+        }
+    };
+
+    template<>
+    struct Traits<unsigned long> {
+        static inline JSC::JSValue arrayJSValue(JSC::ExecState*, JSDOMGlobalObject*, const unsigned long& value)
+        {
+            return JSC::jsNumber(value);
+        }
+    };
+
     template <typename T, size_t inlineCapacity>
     JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<T, inlineCapacity>& iterator)
     {
         JSC::MarkedArgumentBuffer list;
-        typename Vector<T, inlineCapacity>::const_iterator end = iterator.end();
+        typename Vector<T, inlineCapacity>::const_iterator end = iterator.end();        
+        typedef Traits<T> TraitsType;
 
         for (typename Vector<T, inlineCapacity>::const_iterator iter = iterator.begin(); iter != end; ++iter)
-            list.append(toJS(exec, globalObject, WTF::getPtr(*iter)));
+            list.append(TraitsType::arrayJSValue(exec, globalObject, *iter));
 
         return JSC::constructArray(exec, globalObject, list);
     }
 
     JSC::JSValue jsArray(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<DOMStringList>);
 
-    template<>
-    inline JSC::JSValue jsArray(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<String>& iterator)
-    {
-        JSC::MarkedArgumentBuffer array;
-        Vector<String>::const_iterator end = iterator.end();
-
-        for (Vector<String>::const_iterator it = iterator.begin(); it != end; ++it)
-            array.append(jsString(exec, stringToUString(*it)));
-
-        return JSC::constructArray(exec, globalObject, array);
-    }
-
     template <class T>
     Vector<T> toNativeArray(JSC::ExecState* exec, JSC::JSValue value)
     {
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2d17465e0..bb3d79125 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -116,10 +116,10 @@ static JSValue namedItemGetter(ExecState* exec, JSValue slotBase, PropertyName p
     ASSERT(document);
     ASSERT(document->isHTMLDocument());
 
-    HTMLCollection* collection = document->windowNamedItems(propertyNameToAtomicString(propertyName));
+    RefPtr<HTMLCollection> collection = document->windowNamedItems(propertyNameToAtomicString(propertyName));
     if (collection->hasExactlyOneItem())
         return toJS(exec, thisObj, collection->item(0));
-    return toJS(exec, thisObj, collection);
+    return toJS(exec, thisObj, WTF::getPtr(collection));
 }
 
 bool JSDOMWindow::getOwnPropertySlot(JSCell* cell, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/js/JSErrorHandler.cpp b/Source/WebCore/bindings/js/JSErrorHandler.cpp
index e292d2930..5b4b59f8f 100644
--- a/Source/WebCore/bindings/js/JSErrorHandler.cpp
+++ b/Source/WebCore/bindings/js/JSErrorHandler.cpp
@@ -63,7 +63,7 @@ void JSErrorHandler::handleEvent(ScriptExecutionContext* scriptExecutionContext,
 
     ErrorEvent* errorEvent = static_cast<ErrorEvent*>(event);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptExecutionContext->globalData());
 
     JSObject* jsFunction = this->jsFunction(scriptExecutionContext);
     if (!jsFunction)
diff --git a/Source/WebCore/bindings/js/JSEventCustom.cpp b/Source/WebCore/bindings/js/JSEventCustom.cpp
index b891f8938..fdc75c7da 100644
--- a/Source/WebCore/bindings/js/JSEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSEventCustom.cpp
@@ -54,7 +54,7 @@ JSValue JSEvent::clipboardData(ExecState* exec) const
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     if (!event)
         return jsNull();
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index ab28ca813..0a557f7d4 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -75,7 +75,7 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
     if (!scriptExecutionContext || scriptExecutionContext->isJSExecutionForbidden())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptExecutionContext->globalData());
 
     JSObject* jsFunction = this->jsFunction(scriptExecutionContext);
     if (!jsFunction)
diff --git a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index fddc5a5d1..5e2f35efd 100644
--- a/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -62,9 +62,9 @@ JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, PropertyNa
     JSHTMLDocument* thisObj = jsCast<JSHTMLDocument*>(asObject(slotBase));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
 
-    HTMLCollection* collection = document->documentNamedItems(propertyNameToAtomicString(propertyName));
+    RefPtr<HTMLCollection> collection = document->documentNamedItems(propertyNameToAtomicString(propertyName));
 
-    if (!collection->hasAnyItem())
+    if (collection->isEmpty())
         return jsUndefined();
 
     if (collection->hasExactlyOneItem()) {
@@ -77,7 +77,7 @@ JSValue JSHTMLDocument::nameGetter(ExecState* exec, JSValue slotBase, PropertyNa
         return toJS(exec, thisObj->globalObject(), node);
     } 
 
-    return toJS(exec, thisObj->globalObject(), collection);
+    return toJS(exec, thisObj->globalObject(), WTF::getPtr(collection));
 }
 
 // Custom attributes
diff --git a/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp b/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp
index cf545d300..3f907ac75 100644
--- a/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp
+++ b/Source/WebCore/bindings/js/JSIDBAnyCustom.cpp
@@ -64,6 +64,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, IDBAny* idbAny)
         return jsUndefined();
     case IDBAny::NullType:
         return jsNull();
+    case IDBAny::StringType:
+        return jsString(exec, idbAny->string());
     case IDBAny::DOMStringListType:
         return toJS(exec, globalObject, idbAny->domStringList());
     case IDBAny::IDBCursorType:
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index a1d286a74..3f0935240 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -82,7 +82,7 @@ Node* InjectedScriptHost::scriptValueAsNode(ScriptValue value)
 
 ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(state);
     return ScriptValue(state->globalData(), toJS(state, deprecatedGlobalObjectForPrototype(state), node));
 }
 
@@ -95,7 +95,7 @@ JSValue JSInjectedScriptHost::inspectedObject(ExecState* exec)
     if (!object)
         return jsUndefined();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     ScriptValue scriptValue = object->get(exec);
     if (scriptValue.hasNoValue())
         return jsUndefined();
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
index 138193bba..b23774474 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
@@ -51,7 +51,7 @@ namespace WebCore {
 
 ScriptObject InjectedScriptManager::createInjectedScript(const String& source, ScriptState* scriptState, int id)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
 
     SourceCode sourceCode = makeSource(stringToUString(source));
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
@@ -81,7 +81,7 @@ ScriptObject InjectedScriptManager::createInjectedScript(const String& source, S
 
 bool InjectedScriptManager::canAccessInspectedWindow(ScriptState* scriptState)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState->lexicalGlobalObject());
     if (!inspectedWindow)
         return false;
diff --git a/Source/WebCore/bindings/js/JSLazyEventListener.cpp b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
index 64f9cb9c0..8879727e2 100644
--- a/Source/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -108,7 +108,7 @@ JSObject* JSLazyEventListener::initializeJSFunction(ScriptExecutionContext* exec
     if (m_originalNode) {
         if (!wrapper()) {
             // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(exec);
             // FIXME: Should pass the global object associated with the node
             setWrapper(exec->globalData(), asObject(toJS(exec, globalObject, m_originalNode)));
         }
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.cpp b/Source/WebCore/bindings/js/JSMainThreadExecState.cpp
index 00bc170d2..0ef0b593e 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.cpp
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 #include "JSMainThreadExecState.h"
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 
 #if ENABLE(INDEXED_DATABASE)
 #include "IDBPendingTransactionMonitor.h"
@@ -38,11 +38,13 @@ JSC::ExecState* JSMainThreadExecState::s_mainThreadState = 0;
 void JSMainThreadExecState::didLeaveScriptContext()
 {
 #if ENABLE(INDEXED_DATABASE)
-    IDBPendingTransactionMonitor::abortPendingTransactions();   
+    // Indexed DB requires that transactions are created with an internal |active| flag
+    // set to true, but the flag becomes false when control returns to the event loop.
+    IDBPendingTransactionMonitor::deactivateNewTransactions();
 #endif
 
 #if ENABLE(MUTATION_OBSERVERS)
-    WebKitMutationObserver::deliverAllMutations();
+    MutationObserver::deliverAllMutations();
 #endif
 }
 
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.h b/Source/WebCore/bindings/js/JSMainThreadExecState.h
index b9af0669a..838e3edb3 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.h
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.h
@@ -73,6 +73,7 @@ public:
     static JSC::JSValue evaluate(JSC::ExecState* exec, JSC::ScopeChainNode* chain, const JSC::SourceCode& source, JSC::JSValue thisValue, JSC::JSValue* exception)
     {
         JSMainThreadExecState currentState(exec);
+        JSC::JSLockHolder lock(exec);
         return JSC::evaluate(exec, chain, source, thisValue, exception);
     };
 
diff --git a/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp b/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp
index 4375ce417..e3de7b794 100644
--- a/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMutationCallbackCustom.cpp
@@ -34,8 +34,9 @@
 
 #include "JSMutationCallback.h"
 
+#include "JSDOMWindowBase.h"
+#include "JSMutationObserver.h"
 #include "JSMutationRecord.h"
-#include "JSWebKitMutationObserver.h"
 #include "ScriptExecutionContext.h"
 #include <runtime/JSLock.h>
 
@@ -43,14 +44,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-bool JSMutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutationObserver* observer)
+bool JSMutationCallback::handleEvent(MutationRecordArray* mutations, MutationObserver* observer)
 {
     if (!canInvokeCallback())
         return true;
 
     RefPtr<JSMutationCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
 
diff --git a/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp b/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp
index 41ffafc36..ab5560d80 100644
--- a/Source/WebCore/bindings/js/JSWebKitMutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp
@@ -32,17 +32,17 @@
 
 #if ENABLE(MUTATION_OBSERVERS)
 
-#include "JSWebKitMutationObserver.h"
+#include "JSMutationObserver.h"
 
 #include "JSMutationCallback.h"
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-EncodedJSValue JSC_HOST_CALL JSWebKitMutationObserverConstructor::constructJSWebKitMutationObserver(ExecState* exec)
+EncodedJSValue JSC_HOST_CALL JSMutationObserverConstructor::constructJSMutationObserver(ExecState* exec)
 {
     if (exec->argumentCount() < 1)
         return throwVMError(exec, createNotEnoughArgumentsError(exec));
@@ -53,9 +53,9 @@ EncodedJSValue JSC_HOST_CALL JSWebKitMutationObserverConstructor::constructJSWeb
         return JSValue::encode(jsUndefined());
     }
 
-    JSWebKitMutationObserverConstructor* jsConstructor = jsCast<JSWebKitMutationObserverConstructor*>(exec->callee());
+    JSMutationObserverConstructor* jsConstructor = jsCast<JSMutationObserverConstructor*>(exec->callee());
     RefPtr<MutationCallback> callback = JSMutationCallback::create(object, jsConstructor->globalObject());
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), WebKitMutationObserver::create(callback.release()))));
+    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), MutationObserver::create(callback.release()))));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 120f63873..7d01b9f58 100644
--- a/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/Source/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -40,7 +40,7 @@ JSNodeFilterCondition::JSNodeFilterCondition(JSGlobalData&, NodeFilter* owner, J
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     if (!m_filter)
         return NodeFilter::FILTER_ACCEPT;
diff --git a/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp b/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp
index c6be647f8..eb2ab3c56 100644
--- a/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp
+++ b/Source/WebCore/bindings/js/JSRequestAnimationFrameCallbackCustom.cpp
@@ -40,7 +40,7 @@ bool JSRequestAnimationFrameCallback::handleEvent(DOMTimeStamp time)
 
     RefPtr<JSRequestAnimationFrameCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     MarkedArgumentBuffer args;
     args.append(jsNumber(time));
diff --git a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 13b4c008a..40c329b73 100644
--- a/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -39,6 +39,7 @@
 #include "HTMLDocument.h"
 #include "InspectorInstrumentation.h"
 #include "JSArrayBuffer.h"
+#include "JSArrayBufferView.h"
 #include "JSBlob.h"
 #include "JSDOMFormData.h"
 #include "JSDOMWindowCustom.h"
@@ -126,6 +127,8 @@ JSValue JSXMLHttpRequest::send(ExecState* exec)
             impl()->send(toDOMFormData(val), ec);
         else if (val.inherits(&JSArrayBuffer::s_info))
             impl()->send(toArrayBuffer(val), ec);
+        else if (val.inherits(&JSArrayBufferView::s_info))
+            impl()->send(toArrayBufferView(val), ec);
         else
             impl()->send(ustringToString(val.toString(exec)->value(exec)), ec);
     }
diff --git a/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp b/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
index 29b739987..3aefad167 100644
--- a/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
+++ b/Source/WebCore/bindings/js/JavaScriptCallFrame.cpp
@@ -30,6 +30,7 @@
 #include "JavaScriptCallFrame.h"
 
 #include "JSDOMBinding.h"
+#include "JSDOMWindowBase.h"
 #include "PlatformString.h"
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/Completion.h>
@@ -106,7 +107,7 @@ JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception)
     if (!m_isValid)
         return jsNull();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
     return m_debuggerCallFrame.evaluate(script, exception);
 }
 
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
index 10bb8c8f6..ff0aeefb5 100755
--- a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
@@ -110,7 +110,7 @@ void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page*
 
 void PageScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     // If JavaScript stack is not empty postpone recompilation.
     if (JSDOMWindow::commonJSGlobalData()->dynamicGlobalObject)
         recompileAllJSFunctionsSoon();
diff --git a/Source/WebCore/bindings/js/ScheduledAction.cpp b/Source/WebCore/bindings/js/ScheduledAction.cpp
index 1906905f0..c469bf829 100644
--- a/Source/WebCore/bindings/js/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/js/ScheduledAction.cpp
@@ -94,7 +94,7 @@ void ScheduledAction::execute(ScriptExecutionContext* context)
 void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSValue thisValue, ScriptExecutionContext* context)
 {
     ASSERT(m_function);
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(context->globalData());
 
     CallData callData;
     CallType callType = getCallData(m_function.get(), callData);
diff --git a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 2100c6b02..9cf4e99ce 100644
--- a/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -46,7 +46,7 @@ namespace WebCore {
 
 ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ScriptController* scriptController = frame->script();
     ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
@@ -67,7 +67,7 @@ ScriptCachedFrameData::~ScriptCachedFrameData()
 
 void ScriptCachedFrameData::restore(Frame* frame)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     ScriptController* scriptController = frame->script();
     ScriptController::ShellMap& windowShells = scriptController->m_windowShells;
@@ -95,7 +95,7 @@ void ScriptCachedFrameData::clear()
     if (m_windows.isEmpty())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
     m_windows.clear();
     gcController().garbageCollectSoon();
 }
diff --git a/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp b/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp
index ccf673fd4..3bb69f42c 100644
--- a/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp
+++ b/Source/WebCore/bindings/js/ScriptCallStackFactory.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,6 +34,7 @@
 
 #include "InspectorInstrumentation.h"
 #include "JSDOMBinding.h"
+#include "JSMainThreadExecState.h"
 #include "ScriptArguments.h"
 #include "ScriptCallFrame.h"
 #include "ScriptCallStack.h"
@@ -51,9 +53,25 @@ namespace WebCore {
 
 class ScriptExecutionContext;
 
-PassRefPtr<ScriptCallStack> createScriptCallStack(size_t, bool)
+PassRefPtr<ScriptCallStack> createScriptCallStack(size_t maxStackSize, bool emptyIsAllowed)
 {
-    return 0;
+    Vector<ScriptCallFrame> frames;
+    if (JSC::ExecState* exec = JSMainThreadExecState::currentState()) {
+        Vector<StackFrame> stackTrace;
+        Interpreter::getStackTrace(&exec->globalData(), stackTrace);
+        for (Vector<StackFrame>::const_iterator iter = stackTrace.begin(); iter < stackTrace.end(); iter++) {
+            frames.append(ScriptCallFrame(iter->friendlyFunctionName(exec), iter->friendlySourceURL(), iter->friendlyLineNumber()));
+            if (frames.size() >= maxStackSize)
+                break;
+        }
+    }
+    if (frames.isEmpty() && !emptyIsAllowed) {
+        // No frames found. It may happen in the case where
+        // a bound function is called from native code for example.
+        // Fallback to setting lineNumber to 0, and source and function name to "undefined".
+        frames.append(ScriptCallFrame("undefined", "undefined", 0));
+    }
+    return ScriptCallStack::create(frames);
 }
 
 PassRefPtr<ScriptCallStack> createScriptCallStack(JSC::ExecState* exec, size_t maxStackSize)
diff --git a/Source/WebCore/bindings/js/ScriptController.cpp b/Source/WebCore/bindings/js/ScriptController.cpp
index 7999502bd..06c799640 100644
--- a/Source/WebCore/bindings/js/ScriptController.cpp
+++ b/Source/WebCore/bindings/js/ScriptController.cpp
@@ -133,7 +133,7 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
     const String* savedSourceURL = m_sourceURL;
     m_sourceURL = &sourceURL;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     RefPtr<Frame> protect = m_frame;
 
@@ -177,7 +177,7 @@ void ScriptController::clearWindowShell(bool goingIntoPageCache)
     if (m_windowShells.isEmpty())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
         JSDOMWindowShell* windowShell = iter->second.get();
@@ -209,7 +209,7 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 {
     ASSERT(!m_windowShells.contains(world));
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(world->globalData());
 
     JSDOMWindowShell* windowShell = createWindowShell(world);
 
@@ -284,9 +284,10 @@ void ScriptController::updateDocument()
     if (!m_frame->document())
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
-    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter)
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
+        JSLockHolder lock(iter->first->globalData());
         iter->second->window()->updateDocument();
+    }
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -300,7 +301,7 @@ Bindings::RootObject* ScriptController::cacheableBindingRootObject()
         return 0;
 
     if (!m_cacheableBindingRootObject) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
         m_cacheableBindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));
     }
     return m_cacheableBindingRootObject.get();
@@ -312,7 +313,7 @@ Bindings::RootObject* ScriptController::bindingRootObject()
         return 0;
 
     if (!m_bindingRootObject) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
         m_bindingRootObject = Bindings::RootObject::create(0, globalObject(pluginWorld()));
     }
     return m_bindingRootObject.get();
@@ -335,10 +336,15 @@ void ScriptController::setCaptureCallStackForUncaughtExceptions(bool)
 {
 }
 
-void ScriptController::collectIsolatedContexts(Vector<std::pair<JSC::ExecState*, SecurityOrigin*> >&)
+void ScriptController::collectIsolatedContexts(Vector<std::pair<JSC::ExecState*, SecurityOrigin*> >& result)
 {
-    // FIXME(85709): support isolated contexts inspection for JSC.
+    for (ShellMap::iterator iter = m_windowShells.begin(); iter != m_windowShells.end(); ++iter) {
+        JSC::ExecState* exec = iter->second->window()->globalExec();
+        SecurityOrigin* origin = iter->second->window()->impl()->securityOrigin();
+        result.append(std::pair<ScriptState*, SecurityOrigin*>(exec, origin));
+    }
 }
+
 #endif
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
@@ -349,9 +355,9 @@ NPObject* ScriptController::windowScriptNPObject()
         if (canExecuteScripts(NotAboutToExecuteScript)) {
             // JavaScript is enabled, so there is a JavaScript window object.
             // Return an NPObject bound to the window object.
-            JSC::JSLock lock(SilenceAssertionsOnly);
-            JSObject* win = windowShell(pluginWorld())->window();
+            JSDOMWindow* win = windowShell(pluginWorld())->window();
             ASSERT(win);
+            JSC::JSLockHolder lock(win->globalExec());
             Bindings::RootObject* root = bindingRootObject();
             m_windowScriptNPObject = _NPN_CreateScriptObject(0, win, root);
         } else {
@@ -383,8 +389,8 @@ JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
         return 0;
 
     // Create a JSObject bound to this element
-    JSLock lock(SilenceAssertionsOnly);
     JSDOMWindow* globalObj = globalObject(pluginWorld());
+    JSLockHolder lock(globalObj->globalExec());
     // FIXME: is normal okay? - used for NP plugins?
     JSValue jsElementValue = toJS(globalObj->globalExec(), globalObj, plugin);
     if (!jsElementValue || !jsElementValue.isObject())
@@ -418,7 +424,7 @@ void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
 
 void ScriptController::clearScriptObjects()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
 
     RootObjectMap::const_iterator end = m_rootObjects.end();
     for (RootObjectMap::const_iterator it = m_rootObjects.begin(); it != end; ++it)
diff --git a/Source/WebCore/bindings/js/ScriptControllerMac.mm b/Source/WebCore/bindings/js/ScriptControllerMac.mm
index 50a5a7e71..66210c7df 100644
--- a/Source/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/Source/WebCore/bindings/js/ScriptControllerMac.mm
@@ -111,7 +111,7 @@ WebScriptObject* ScriptController::windowScriptObject()
         return 0;
 
     if (!m_windowScriptObject) {
-        JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+        JSC::JSLockHolder lock(JSDOMWindowBase::commonJSGlobalData());
         JSC::Bindings::RootObject* root = bindingRootObject();
         m_windowScriptObject = [WebScriptObject scriptObjectForJSObject:toRef(windowShell(pluginWorld())) originRootObject:root rootObject:root];
     }
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index f2227c745..9ace82d93 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -222,7 +222,7 @@ void ScriptDebugServer::dispatchDidPause(ScriptDebugListener* listener)
     {
         if (m_currentCallFrame->isValid() && globalObject->inherits(&JSDOMGlobalObject::s_info)) {
             JSDOMGlobalObject* domGlobalObject = jsCast<JSDOMGlobalObject*>(globalObject);
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(state);
             jsCallFrame = toJS(state, domGlobalObject, m_currentCallFrame.get());
         } else
             jsCallFrame = jsUndefined();
diff --git a/Source/WebCore/bindings/js/ScriptEventListener.cpp b/Source/WebCore/bindings/js/ScriptEventListener.cpp
index 390fde117..7216b6f36 100644
--- a/Source/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/js/ScriptEventListener.cpp
@@ -98,7 +98,7 @@ String eventListenerHandlerBody(Document* document, EventListener* eventListener
     ASSERT(jsListener);
     if (!jsListener)
         return "";
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(jsListener->isolatedWorld()->globalData());
     JSC::JSObject* jsFunction = jsListener->jsFunction(document);
     if (!jsFunction)
         return "";
@@ -112,7 +112,7 @@ bool eventListenerHandlerLocation(Document* document, EventListener* eventListen
     ASSERT(jsListener);
     if (!jsListener)
         return false;
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(jsListener->isolatedWorld()->globalData());
     JSC::JSObject* jsObject = jsListener->jsFunction(document);
     if (!jsObject)
         return false;
diff --git a/Source/WebCore/bindings/js/ScriptFunctionCall.cpp b/Source/WebCore/bindings/js/ScriptFunctionCall.cpp
index 83b0e45b1..54778259a 100644
--- a/Source/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/Source/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -58,19 +58,19 @@ void ScriptCallArgumentHandler::appendArgument(const ScriptValue& argument)
 
 void ScriptCallArgumentHandler::appendArgument(const String& argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsString(m_exec, argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(const JSC::UString& argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsString(m_exec, argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(const char* argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsString(m_exec, UString(argument)));
 }
 
@@ -81,31 +81,31 @@ void ScriptCallArgumentHandler::appendArgument(JSC::JSValue argument)
 
 void ScriptCallArgumentHandler::appendArgument(long argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(long long argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(unsigned int argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(unsigned long argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
 void ScriptCallArgumentHandler::appendArgument(int argument)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
     m_arguments.append(jsNumber(argument));
 }
 
@@ -125,7 +125,7 @@ ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
 {
     JSObject* thisObject = m_thisObject.jsObject();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
 
     JSValue function = thisObject->get(m_exec, Identifier(m_exec, stringToUString(m_name)));
     if (m_exec->hadException()) {
@@ -163,7 +163,7 @@ ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExcept
 {
     JSObject* thisObject = m_thisObject.jsObject();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
 
     JSObject* constructor = asObject(thisObject->get(m_exec, Identifier(m_exec, stringToUString(m_name))));
     if (m_exec->hadException()) {
@@ -205,7 +205,7 @@ ScriptValue ScriptCallback::call()
 
 ScriptValue ScriptCallback::call(bool& hadException)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_exec);
 
     CallData callData;
     CallType callType = getCallData(m_function.jsValue(), callData);
diff --git a/Source/WebCore/bindings/js/ScriptObject.cpp b/Source/WebCore/bindings/js/ScriptObject.cpp
index 0cfb82b6e..bf9140d07 100644
--- a/Source/WebCore/bindings/js/ScriptObject.cpp
+++ b/Source/WebCore/bindings/js/ScriptObject.cpp
@@ -67,7 +67,7 @@ static bool handleException(ScriptState* scriptState)
 
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     scriptState->lexicalGlobalObject()->putDirect(scriptState->globalData(), Identifier(scriptState, name), value.jsObject());
     return handleException(scriptState);
 }
@@ -75,7 +75,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
 #if ENABLE(INSPECTOR)
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorFrontendHost* value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
     globalObject->putDirect(scriptState->globalData(), Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
@@ -83,7 +83,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
 
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InjectedScriptHost* value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
     globalObject->putDirect(scriptState->globalData(), Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
@@ -92,7 +92,7 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Injecte
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     JSValue jsValue = scriptState->lexicalGlobalObject()->get(scriptState, Identifier(scriptState, name));
     if (!jsValue)
         return false;
@@ -106,7 +106,7 @@ bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptO
 
 bool ScriptGlobalObject::remove(ScriptState* scriptState, const char* name)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     scriptState->lexicalGlobalObject()->methodTable()->deleteProperty(scriptState->lexicalGlobalObject(), scriptState, Identifier(scriptState, name));
     return handleException(scriptState);
 }
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index 57685354f..782eac86b 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -38,6 +38,7 @@ namespace WebCore {
 
 class ExternalArrayVisitor;
 class ExternalStringVisitor;
+class MemoryInstrumentation;
 class NodeWrapperVisitor;
 class Page;
 class ScriptObject;
@@ -75,8 +76,10 @@ public:
     static bool hasHeapProfiler() { return false; }
     // FIXME: Implement this counter for JSC. See bug 73936 for more details.
     static void visitNodeWrappers(NodeWrapperVisitor*) { }
+    // FIXME: Support these methods for JSC. See bug 90358.
     static void visitExternalStrings(ExternalStringVisitor*) { }
     static void visitExternalArrays(ExternalArrayVisitor*) { }
+    static void collectBindingMemoryInfo(MemoryInstrumentation*) { }
     static size_t profilerSnapshotsSize() { return 0; }
 };
 
diff --git a/Source/WebCore/bindings/js/ScriptValue.cpp b/Source/WebCore/bindings/js/ScriptValue.cpp
index fd32872c7..83dfd5fb8 100644
--- a/Source/WebCore/bindings/js/ScriptValue.cpp
+++ b/Source/WebCore/bindings/js/ScriptValue.cpp
@@ -49,7 +49,7 @@ bool ScriptValue::getString(ScriptState* scriptState, String& result) const
 {
     if (!m_value)
         return false;
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(scriptState);
     UString ustring;
     if (!m_value.get().getString(scriptState, ustring))
         return false;
@@ -175,6 +175,7 @@ static PassRefPtr<InspectorValue> jsToInspectorValue(ScriptState* scriptState, J
 
 PassRefPtr<InspectorValue> ScriptValue::toInspectorValue(ScriptState* scriptState) const
 {
+    JSC::JSLockHolder holder(scriptState);
     return jsToInspectorValue(scriptState, m_value.get(), InspectorValue::maxDepth);
 }
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index e2e607d95..9bfde8f2a 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -64,7 +64,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
 
 WorkerScriptController::~WorkerScriptController()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(globalData());
     m_workerContextWrapper.clear();
     m_globalData.clear();
 }
@@ -73,7 +73,7 @@ void WorkerScriptController::initScript()
 {
     ASSERT(!m_workerContextWrapper);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_globalData.get());
 
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
@@ -117,7 +117,7 @@ void WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
     ScriptValue exception;
     evaluate(sourceCode, &exception);
     if (exception.jsValue()) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(globalData());
         reportException(m_workerContextWrapper->globalExec(), exception.jsValue());
     }
 }
@@ -128,9 +128,9 @@ void WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, Script
         return;
 
     initScriptIfNeeded();
-    JSLock lock(SilenceAssertionsOnly);
 
     ExecState* exec = m_workerContextWrapper->globalExec();
+    JSLockHolder lock(exec);
 
     m_workerContextWrapper->globalData().timeoutChecker.start();
 
@@ -191,7 +191,7 @@ bool WorkerScriptController::isExecutionForbidden() const
 void WorkerScriptController::disableEval()
 {
     initScriptIfNeeded();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(globalData());
 
     m_workerContextWrapper->setEvalEnabled(false);
 }
diff --git a/Source/WebCore/bindings/objc/WebScriptObject.mm b/Source/WebCore/bindings/objc/WebScriptObject.mm
index aeef94131..cf55e7415 100644
--- a/Source/WebCore/bindings/objc/WebScriptObject.mm
+++ b/Source/WebCore/bindings/objc/WebScriptObject.mm
@@ -84,6 +84,9 @@ void removeJSWrapper(JSObject* impl)
 
 id createJSWrapper(JSC::JSObject* object, PassRefPtr<JSC::Bindings::RootObject> origin, PassRefPtr<JSC::Bindings::RootObject> root)
 {
+    // NSMap is not thread safe, hold the JSC API lock; also synchronize this vs. release.
+    JSC::JSLockHolder holder(JSDOMWindowBase::commonJSGlobalData());
+
     if (id wrapper = getJSWrapper(object))
         return [[wrapper retain] autorelease];
     return [[[WebScriptObject alloc] _initWithJSObject:object originRootObject:origin rootObject:root] autorelease];
@@ -122,13 +125,12 @@ static void addExceptionToConsole(ExecState* exec)
 
 static void _didExecute(WebScriptObject *obj)
 {
-    ASSERT(JSLock::lockCount() > 0);
-    
     RootObject* root = [obj _rootObject];
     if (!root)
         return;
 
     ExecState* exec = root->globalObject()->globalExec();
+    ASSERT(exec->globalData().apiLock().currentThreadIsHoldingLock());
     KJSDidExecuteFunctionPtr func = Instance::didExecuteFunction();
     if (func)
         func(exec, root->globalObject());
@@ -146,6 +148,9 @@ static void _didExecute(WebScriptObject *obj)
     _private->rootObject = rootObject.leakRef();
     _private->originRootObject = originRootObject.leakRef();
 
+    // NSMap is not thread safe, hold the JSC API lock.
+    JSC::JSLockHolder holder(JSDOMWindowBase::commonJSGlobalData());
+
     WebCore::addJSWrapper(self, imp);
 
     if (_private->rootObject)
@@ -224,14 +229,26 @@ static void _didExecute(WebScriptObject *obj)
     return jsCast<JSDOMWindowBase*>(root->globalObject())->allowsAccessFrom(_private->originRootObject->globalObject());
 }
 
+- (oneway void)release
+{
+    {
+        // NSMap is not thread safe, hold the JSC API lock; also synchronize this vs. getJSWrapper.
+        JSC::JSLockHolder holder(JSDOMWindowBase::commonJSGlobalData());
+
+        // If we're releasing the last reference to this object, remove if from the map,
+        // this will prevent this object from being returned by getJSWrapper.
+        if (_private->imp && [self retainCount] == 1)
+            WebCore::removeJSWrapper(_private->imp);
+    }
+
+    [super release];
+}
+
 - (void)dealloc
 {
     if (WebCoreObjCScheduleDeallocateOnMainThread([WebScriptObject class], self))
         return;
 
-    if (_private->imp)
-        WebCore::removeJSWrapper(_private->imp);
-
     if (_private->rootObject && _private->rootObject->isValid())
         _private->rootObject->gcUnprotect(_private->imp);
 
@@ -281,10 +298,9 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     if (![self _isSafeScript])
         return nil;
 
-    JSLock lock(SilenceAssertionsOnly);
-    
     // Look up the function object.
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
+    JSLockHolder lock(exec);
     ASSERT(!exec->hadException());
 
     JSValue function = [self _imp]->get(exec, Identifier(exec, stringToUString(String(name))));
@@ -325,7 +341,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     
     [self _rootObject]->globalObject()->globalData().timeoutChecker.start();
     JSValue returnValue = JSMainThreadExecState::evaluate(exec, [self _rootObject]->globalObject()->globalScopeChain(), makeSource(String(script)), JSC::JSValue(), 0);
@@ -346,7 +362,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     PutPropertySlot slot;
     [self _imp]->methodTable()->put([self _imp], exec, Identifier(exec, stringToUString(String(key))), convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]), slot);
@@ -372,7 +388,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
         // Need to scope this lock to ensure that we release the lock before calling
         // [super valueForKey:key] which might throw an exception and bypass the JSLock destructor,
         // leaving the lock permanently held
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         
         JSValue result = [self _imp]->get(exec, Identifier(exec, stringToUString(String(key))));
         
@@ -388,7 +404,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     if ([resultObj isKindOfClass:[WebUndefined class]])
         resultObj = [super valueForKey:key];    // defaults to throwing an exception
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     _didExecute(self);
     
     return resultObj;
@@ -402,7 +418,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     [self _imp]->methodTable()->deleteProperty([self _imp], exec, Identifier(exec, stringToUString(String(key))));
 
     if (exec->hadException()) {
@@ -421,7 +437,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     BOOL result = [self _imp]->hasProperty(exec, Identifier(exec, stringToUString(String(key))));
 
     if (exec->hadException()) {
@@ -441,8 +457,8 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
         return @"Undefined";
     }
 
-    JSLock lock(SilenceAssertionsOnly);
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
+    JSLockHolder lock(exec);
     
     id result = convertValueToObjcValue(exec, [self _imp], ObjcObjectType).objectValue;
 
@@ -461,7 +477,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue result = [self _imp]->get(exec, index);
 
     if (exec->hadException()) {
@@ -485,7 +501,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ExecState* exec = [self _rootObject]->globalObject()->globalExec();
     ASSERT(!exec->hadException());
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     [self _imp]->methodTable()->putByIndex([self _imp], exec, index, convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]), false);
 
     if (exec->hadException()) {
@@ -515,7 +531,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
 {
     if (value.isObject()) {
         JSObject* object = asObject(value);
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(rootObject->globalObject()->globalData());
 
         if (object->inherits(&JSHTMLElement::s_info)) {
             // Plugin elements cache the instance internally.
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index e45e762db..31c164bf0 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -1260,10 +1260,18 @@ sub GenerateParametersCheckExpression
             $usedArguments{$parameterIndex} = 1;
         } elsif (IsArrayType($type)) {
             # FIXME: Add proper support for T[], T[]?, sequence<T>
-            push(@andExpression, "(${value}.isNull() || (${value}.isObject() && asObject(${value})->inherits(&JSArray::s_info)))");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}.isNull() || (${value}.isObject() && isJSArray(${value})))");
+            } else {
+                push(@andExpression, "(${value}.isObject() && isJSArray(${value}))");
+            }
             $usedArguments{$parameterIndex} = 1;
         } elsif (!IsNativeType($type)) {
-            push(@andExpression, "(${value}.isNull() || (${value}.isObject() && asObject(${value})->inherits(&JS${type}::s_info)))");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}.isNull() || (${value}.isObject() && asObject(${value})->inherits(&JS${type}::s_info)))");
+            } else {
+                push(@andExpression, "(${value}.isObject() && asObject(${value})->inherits(&JS${type}::s_info))");
+            }
             $usedArguments{$parameterIndex} = 1;
         }
         $parameterIndex++;
@@ -2346,7 +2354,7 @@ sub GenerateImplementation
                 $rootString .= "    void* root = WebCore::root(element);\n";
             } elsif ($interfaceName eq "CanvasRenderingContext") {
                 $rootString  = "    void* root = WebCore::root(js${implClassName}->impl()->canvas());\n";
-            } elsif ($interfaceName eq "HTMLCollection" or $interfaceName eq "HTMLAllCollection") {
+            } elsif (GetGenerateIsReachable($dataNode) eq "ImplBaseRoot") {
                 $rootString  = "    void* root = WebCore::root(js${implClassName}->impl()->base());\n";
             } else {
                 $rootString  = "    void* root = WebCore::root(js${implClassName}->impl());\n";
@@ -2745,7 +2753,7 @@ END
             push(@implContent, "    if (!canInvokeCallback())\n");
             push(@implContent, "        return true;\n\n");
             push(@implContent, "    RefPtr<$className> protect(this);\n\n");
-            push(@implContent, "    JSLock lock(SilenceAssertionsOnly);\n\n");
+            push(@implContent, "    JSLockHolder lock(m_data->globalObject()->globalData());\n\n");
             push(@implContent, "    ExecState* exec = m_data->globalObject()->globalExec();\n");
             push(@implContent, "    MarkedArgumentBuffer args;\n");
 
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 254ec9396..3b0115bdf 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -214,12 +214,14 @@ void V8${implClassName}::visitDOMWrapper(DOMDataStore* store, void* object, v8::
 END
     if (GetGenerateIsReachable($dataNode) eq  "ImplElementRoot" ||
         GetGenerateIsReachable($dataNode) eq  "ImplOwnerRoot" ||
-        GetGenerateIsReachable($dataNode) eq  "ImplOwnerNodeRoot") {
+        GetGenerateIsReachable($dataNode) eq  "ImplOwnerNodeRoot" ||
+        GetGenerateIsReachable($dataNode) eq  "ImplBaseRoot") {
 
         my $methodName;
         $methodName = "element" if (GetGenerateIsReachable($dataNode) eq "ImplElementRoot");
         $methodName = "owner" if (GetGenerateIsReachable($dataNode) eq "ImplOwnerRoot");
         $methodName = "ownerNode" if (GetGenerateIsReachable($dataNode) eq "ImplOwnerNodeRoot");
+        $methodName = "base" if (GetGenerateIsReachable($dataNode) eq "ImplBaseRoot");
 
         push(@implContent, <<END);
     if (Node* owner = impl->${methodName}()) {
@@ -1060,7 +1062,7 @@ END
     MessagePortArray portsCopy(*ports);
     v8::Local<v8::Array> portArray = v8::Array::New(portsCopy.size());
     for (size_t i = 0; i < portsCopy.size(); ++i)
-        portArray->Set(v8::Integer::New(i), toV8(portsCopy[i].get(), info.GetIsolate()));
+        portArray->Set(v8Integer(i, info.GetIsolate()), toV8(portsCopy[i].get(), info.GetIsolate()));
     return portArray;
 END
     } else {
@@ -1355,9 +1357,17 @@ sub GenerateParametersCheckExpression
             push(@andExpression, "(${value}->IsNull() || ${value}->IsFunction())");
         } elsif (IsArrayType($type)) {
             # FIXME: Add proper support for T[], T[]?, sequence<T>.
-            push(@andExpression, "(${value}->IsNull() || ${value}->IsArray())");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}->IsNull() || ${value}->IsArray())");
+            } else {
+                push(@andExpression, "(${value}->IsArray())");
+            }
         } elsif (IsWrapperType($type)) {
-            push(@andExpression, "(${value}->IsNull() || V8${type}::HasInstance($value))");
+            if ($parameter->isNullable) {
+                push(@andExpression, "(${value}->IsNull() || V8${type}::HasInstance($value))");
+            } else {
+                push(@andExpression, "(V8${type}::HasInstance($value))");
+            }
         }
 
         $parameterIndex++;
@@ -3509,8 +3519,6 @@ sub IsRefPtrType
     return 0 if $type eq "unsigned";
     return 0 if $type eq "unsigned long";
     return 0 if $type eq "unsigned short";
-    return 0 if $type eq "float[]";
-    return 0 if $type eq "double[]";
 
     return 1;
 }
@@ -3571,8 +3579,6 @@ sub GetNativeType
     return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";
 
     # FIXME: Support T[], T[]?, sequence<T> generically
-    return "Vector<float>" if $type eq "float[]";
-    return "Vector<double>" if $type eq "double[]";
     return "RefPtr<DOMStringList>" if $type eq "DOMStringList";
 
     # Default, assume native type is a pointer with same type name as idl type
@@ -3631,14 +3637,6 @@ sub JSValueToNative
     return "v8ValueToWebCoreDOMStringList($value)" if $type eq "DOMStringList";
     # FIXME: Add proper support for T[], T[]? and sequence<T>.
     return "v8ValueToWebCoreDOMStringList($value)" if $type eq "DOMString[]";
-    if ($type eq "float[]") {
-        AddToImplIncludes("wtf/Vector.h");
-        return "v8NumberArrayToVector<float>($value)";
-    }
-    if ($type eq "double[]") {
-        AddToImplIncludes("wtf/Vector.h");
-        return "v8NumberArrayToVector<double>($value)";
-    }
 
     if ($type eq "DOMString" or $type eq "DOMUserData") {
         return $value;
@@ -3818,9 +3816,7 @@ my %non_wrapper_types = (
     'SerializedScriptValue' => 1,
     'boolean' => 1,
     'double' => 1,
-    'double[]' => 1,
     'float' => 1,
-    'float[]' => 1,
     'int' => 1,
     'long long' => 1,
     'long' => 1,
@@ -3892,14 +3888,14 @@ sub NativeToJSValue
     # should be returned instead.
     if ($signature->extendedAttributes->{"Reflect"} and ($type eq "unsigned long" or $type eq "unsigned short")) {
         $value =~ s/getUnsignedIntegralAttribute/getIntegralAttribute/g;
-        return "v8::Integer::NewFromUnsigned(std::max(0, " . $value . "))";
+        return "v8UnsignedInteger(std::max(0, " . $value . ")$getIsolateArg)";
     }
 
     # For all the types where we use 'int' as the representation type,
-    # we use Integer::New which has a fast Smi conversion check.
+    # we use v8Integer() which has a fast small integer conversion check.
     my $nativeType = GetNativeType($type);
-    return "v8::Integer::New($value)" if $nativeType eq "int";
-    return "v8::Integer::NewFromUnsigned($value)" if $nativeType eq "unsigned";
+    return "v8Integer($value$getIsolateArg)" if $nativeType eq "int";
+    return "v8UnsignedInteger($value$getIsolateArg)" if $nativeType eq "unsigned";
 
     return "v8DateOrNull($value$getIsolateArg)" if $type eq "Date";
     # long long and unsigned long long are not representable in ECMAScript.
@@ -3907,9 +3903,6 @@ sub NativeToJSValue
     return "v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type);
     return "$value.v8Value()" if $nativeType eq "ScriptValue";
 
-    return "v8NumberArray($value)" if $type eq "float[]";
-    return "v8NumberArray($value)" if $type eq "double[]";
-
     if ($codeGenerator->IsStringType($type)) {
         my $conv = $signature->extendedAttributes->{"TreatReturnedNullStringAs"};
         if (defined $conv) {
diff --git a/Source/WebCore/bindings/scripts/IDLAttributes.txt b/Source/WebCore/bindings/scripts/IDLAttributes.txt
index 4fe771b1c..b6d890e72 100644
--- a/Source/WebCore/bindings/scripts/IDLAttributes.txt
+++ b/Source/WebCore/bindings/scripts/IDLAttributes.txt
@@ -52,7 +52,7 @@ DoNotCheckSecurityOnGetter
 DoNotCheckSecurityOnSetter
 EventTarget
 ExtendsDOMGlobalObject
-GenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame
+GenerateIsReachable=ImplElementRoot|ImplBaseRoot
 Immutable
 ImplementedAs=*
 IndexedGetter
@@ -75,7 +75,7 @@ JSCustomPushEventHandlerScope
 JSCustomSetter
 JSCustomToJSObject
 JSCustomToNativeObject
-JSGenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame
+JSGenerateIsReachable=|Impl|ImplContext|ImplDocument|ImplElementRoot|ImplFrame|ImplBaseRoot
 JSGenerateToJSObject
 JSGenerateToNativeObject
 JSInlineGetOwnPropertySlot
@@ -116,6 +116,6 @@ V8DependentLifetime
 V8DoNotCheckSignature
 V8EnabledAtRuntime=*
 V8EnabledPerContext=*
-V8GenerateIsReachable=|ImplElementRoot|ImplOwnerRoot|ImplOwnerNodeRoot
+V8GenerateIsReachable=ImplElementRoot|ImplOwnerRoot|ImplOwnerNodeRoot|ImplBaseRoot
 V8ReadOnly
 V8Unforgeable
diff --git a/Source/WebCore/bindings/scripts/IDLParser.pm b/Source/WebCore/bindings/scripts/IDLParser.pm
index 0f08a353d..af02c64bb 100644
--- a/Source/WebCore/bindings/scripts/IDLParser.pm
+++ b/Source/WebCore/bindings/scripts/IDLParser.pm
@@ -244,13 +244,17 @@ sub parseParameters
         my $paramDirection = $1;
         my $paramExtendedAttributes = (defined($2) ? $2 : " "); chop($paramExtendedAttributes);
         my $paramType = (defined($3) ? $3 : die("Parsing error!\nSource:\n$line\n)"));
-        my $paramName = (defined($4) ? $4 : die("Parsing error!\nSource:\n$line\n)"));
+        my $paramTypeSuffix = defined($4) ? $4 : "";
+        my $paramName = (defined($5) ? $5 : die("Parsing error!\nSource:\n$line\n)"));
+
+        my $isNullable = $paramTypeSuffix eq "?";
 
         my $paramDataNode = new domSignature();
         $paramDataNode->direction($paramDirection);
         $paramDataNode->name($paramName);
         $paramDataNode->type($paramType);
         $paramDataNode->extendedAttributes(parseExtendedAttributes($paramExtendedAttributes));
+        $paramDataNode->isNullable($isNullable);
 
         my $arrayRef = $newDataNode->parameters;
         push(@$arrayRef, $paramDataNode);
diff --git a/Source/WebCore/bindings/scripts/IDLStructure.pm b/Source/WebCore/bindings/scripts/IDLStructure.pm
index 5424153dc..5e1ab45f9 100644
--- a/Source/WebCore/bindings/scripts/IDLStructure.pm
+++ b/Source/WebCore/bindings/scripts/IDLStructure.pm
@@ -65,7 +65,8 @@ struct( domSignature => {
     direction => '$', # Variable direction (in or out)
     name => '$',      # Variable name
     type => '$',      # Variable type
-    extendedAttributes => '$' # Extended attributes
+    extendedAttributes => '$', # Extended attributes
+    isNullable => '$' # Is variable type Nullable (T?)
 });
 
 # Used to represent string constants
@@ -90,6 +91,7 @@ our $idlDataType = '[a-zA-Z0-9\ ]';   # Generic data type identifier
 
 # Magic IDL parsing regular expressions
 my $supportedTypes = "((?:(?:unsigned )?(?:int|short|(?:long )?long)|(?:$idlIdNs*))(?:\\[\\]|<(?:$idlIdNsList*)>)?)";
+my $supportedTypeSuffix = "(\\?)?";
 
 # Special IDL notations. This regular expression extracts the string between the first [ and its corresponding ].
 our $extendedAttributeSyntax = qr/\[[^\[\]]*(?:(??{$IDLStructure::extendedAttributeSyntax})[^\[\]]*)*\]/x; # Used for extended attributes
@@ -104,9 +106,9 @@ our $setterRaisesSelector = '\bsetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)'
 
 our $typeNamespaceSelector = '((?:' . $idlId . '*::)*)\s*(' . $idlDataType . '*)';
 
-our $interfaceSelector = '(interface|exception)\s*((?:' . $extendedAttributeSyntax . ' )?)(' . $idlIdNs . '*)\s*(?::(\s*[^{]*))?{([-a-zA-Z0-9_"=\s(),;:\[\]<>&\|]*)';
-our $interfaceMethodSelector = '\s*((?:' . $extendedAttributeSyntax . ' )?)(static\s+)?' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]<>]*)';
-our $interfaceParameterSelector = '(in|out)\s*((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . '\s*(' . $idlIdNs . '*)';
+our $interfaceSelector = '(interface|exception)\s*((?:' . $extendedAttributeSyntax . ' )?)(' . $idlIdNs . '*)\s*(?::(\s*[^{]*))?{([-a-zA-Z0-9_"=\s(),;:\[\]<>&\|?]*)';
+our $interfaceMethodSelector = '\s*((?:' . $extendedAttributeSyntax . ' )?)(static\s+)?' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]<>?]*)';
+our $interfaceParameterSelector = '(in|out)\s*((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . $supportedTypeSuffix . '\s*(' . $idlIdNs . '*)';
 
 our $interfaceAttributeSelector = '\s*(readonly attribute|attribute)\s*(' . $extendedAttributeSyntax . ' )?' . $supportedTypes . '\s*(' . $idlType . '*)';
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
index abae044e6..e7ba4c069 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
@@ -65,7 +65,7 @@ bool JSTestCallback::callbackWithNoParam()
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -82,7 +82,7 @@ bool JSTestCallback::callbackWithClass1Param(Class1* class1Param)
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -100,7 +100,7 @@ bool JSTestCallback::callbackWithClass2Param(Class2* class2Param, const String&
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -119,7 +119,7 @@ bool JSTestCallback::callbackWithStringList(PassRefPtr<DOMStringList> listParam)
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -137,7 +137,7 @@ bool JSTestCallback::callbackWithBoolean(bool boolParam)
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
@@ -157,7 +157,7 @@ bool JSTestCallback::callbackRequiresThisToPass(Class8* class8Param, ThisClass*
 
     RefPtr<JSTestCallback> protect(this);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(m_data->globalObject()->globalData());
 
     ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index f4a5cd858..255eb560b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -2143,6 +2143,40 @@ static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod7(
     return JSValue::encode(jsUndefined());
 }
 
+static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod8(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createNotEnoughArgumentsError(exec));
+    TestObj* objArg(toTestObj(MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->overloadedMethod(objArg);
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod9(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = jsCast<JSTestObj*>(asObject(thisValue));
+    ASSERT_GC_OBJECT_INHERITS(castedThis, &JSTestObj::s_info);
+    TestObj* impl = static_cast<TestObj*>(castedThis->impl());
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createNotEnoughArgumentsError(exec));
+    RefPtr<DOMStringList> arrayArg(toDOMStringList(exec, MAYBE_MISSING_PARAMETER(exec, 0, DefaultIsUndefined)));
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    impl->overloadedMethod(arrayArg);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(ExecState* exec)
 {
     size_t argsCount = exec->argumentCount();
@@ -2160,8 +2194,12 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(ExecStat
         return jsTestObjPrototypeFunctionOverloadedMethod5(exec);
     if ((argsCount == 1 && (arg0.isNull() || (arg0.isObject() && asObject(arg0)->inherits(&JSDOMStringList::s_info)))))
         return jsTestObjPrototypeFunctionOverloadedMethod6(exec);
-    if ((argsCount == 1 && (arg0.isNull() || (arg0.isObject() && asObject(arg0)->inherits(&JSArray::s_info)))))
+    if ((argsCount == 1 && (arg0.isNull() || (arg0.isObject() && isJSArray(arg0)))))
         return jsTestObjPrototypeFunctionOverloadedMethod7(exec);
+    if ((argsCount == 1 && (arg0.isObject() && asObject(arg0)->inherits(&JSTestObj::s_info))))
+        return jsTestObjPrototypeFunctionOverloadedMethod8(exec);
+    if ((argsCount == 1 && (arg0.isObject() && isJSArray(arg0))))
+        return jsTestObjPrototypeFunctionOverloadedMethod9(exec);
     return throwVMTypeError(exec);
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index ef342f8be..513df1074 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -163,12 +163,14 @@ module test {
 
 #if defined(TESTING_V8) || defined(TESTING_JS)
         // Overloads
-        void    overloadedMethod(in TestObj objArg, in DOMString strArg);
-        void    overloadedMethod(in TestObj objArg, in [Optional] long intArg);
+        void    overloadedMethod(in TestObj? objArg, in DOMString strArg);
+        void    overloadedMethod(in TestObj? objArg, in [Optional] long intArg);
         void    overloadedMethod(in DOMString strArg);
         void    overloadedMethod(in long intArg);
         void    overloadedMethod(in [Callback] TestCallback callback);
-        void    overloadedMethod(in DOMStringList listArg);
+        void    overloadedMethod(in DOMStringList? listArg);
+        void    overloadedMethod(in DOMString[]? arrayArg);
+        void    overloadedMethod(in TestObj objArg);
         void    overloadedMethod(in DOMString[] arrayArg);
 #endif
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index 37817d5ff..0a9b88ada 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -45,7 +45,7 @@ static v8::Handle<v8::Value> excitingAttrAttrGetter(v8::Local<v8::String> name,
 {
     INC_STATS("DOM.TestActiveDOMObject.excitingAttr._get");
     TestActiveDOMObject* imp = V8TestActiveDOMObject::toNative(info.Holder());
-    return v8::Integer::New(imp->excitingAttr());
+    return v8Integer(imp->excitingAttr(), info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> excitingFunctionCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 40b8d9dbd..adf5562d6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -60,7 +60,6 @@
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 #include <wtf/UnusedParam.h>
-#include <wtf/Vector.h>
 
 #if ENABLE(Condition1)
 #include "V8TestObjectA.h"
@@ -86,7 +85,7 @@ static v8::Handle<v8::Value> readOnlyIntAttrAttrGetter(v8::Local<v8::String> nam
 {
     INC_STATS("DOM.TestObj.readOnlyIntAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->readOnlyIntAttr());
+    return v8Integer(imp->readOnlyIntAttr(), info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> readOnlyStringAttrAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
@@ -114,7 +113,7 @@ static v8::Handle<v8::Value> shortAttrAttrGetter(v8::Local<v8::String> name, con
 {
     INC_STATS("DOM.TestObj.shortAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->shortAttr());
+    return v8Integer(imp->shortAttr(), info.GetIsolate());
 }
 
 static void shortAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -130,7 +129,7 @@ static v8::Handle<v8::Value> unsignedShortAttrAttrGetter(v8::Local<v8::String> n
 {
     INC_STATS("DOM.TestObj.unsignedShortAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->unsignedShortAttr());
+    return v8Integer(imp->unsignedShortAttr(), info.GetIsolate());
 }
 
 static void unsignedShortAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -146,7 +145,7 @@ static v8::Handle<v8::Value> intAttrAttrGetter(v8::Local<v8::String> name, const
 {
     INC_STATS("DOM.TestObj.intAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->intAttr());
+    return v8Integer(imp->intAttr(), info.GetIsolate());
 }
 
 static void intAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -274,7 +273,7 @@ static v8::Handle<v8::Value> reflectedIntegralAttrAttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.reflectedIntegralAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->getIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr));
+    return v8Integer(imp->getIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr), info.GetIsolate());
 }
 
 static void reflectedIntegralAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -290,7 +289,7 @@ static v8::Handle<v8::Value> reflectedUnsignedIntegralAttrAttrGetter(v8::Local<v
 {
     INC_STATS("DOM.TestObj.reflectedUnsignedIntegralAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::NewFromUnsigned(std::max(0, imp->getIntegralAttribute(WebCore::HTMLNames::reflectedunsignedintegralattrAttr)));
+    return v8UnsignedInteger(std::max(0, imp->getIntegralAttribute(WebCore::HTMLNames::reflectedunsignedintegralattrAttr)), info.GetIsolate());
 }
 
 static void reflectedUnsignedIntegralAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -354,7 +353,7 @@ static v8::Handle<v8::Value> reflectedCustomIntegralAttrAttrGetter(v8::Local<v8:
 {
     INC_STATS("DOM.TestObj.reflectedCustomIntegralAttr._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->getIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr));
+    return v8Integer(imp->getIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr), info.GetIsolate());
 }
 
 static void reflectedCustomIntegralAttrAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -406,7 +405,7 @@ static v8::Handle<v8::Value> attrWithGetterExceptionAttrGetter(v8::Local<v8::Str
     int v = imp->attrWithGetterException(ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, info.GetIsolate());
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 static void attrWithGetterExceptionAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -425,7 +424,7 @@ static v8::Handle<v8::Value> attrWithSetterExceptionAttrGetter(v8::Local<v8::Str
 {
     INC_STATS("DOM.TestObj.attrWithSetterException._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->attrWithSetterException());
+    return v8Integer(imp->attrWithSetterException(), info.GetIsolate());
 }
 
 static void attrWithSetterExceptionAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -489,7 +488,7 @@ static v8::Handle<v8::Value> withScriptStateAttributeAttrGetter(v8::Local<v8::St
     ScriptState* state = ScriptState::current();
     if (!state)
         return v8::Undefined();
-    return v8::Integer::New(imp->withScriptStateAttribute(state));
+    return v8Integer(imp->withScriptStateAttribute(state), info.GetIsolate());
 }
 
 static void withScriptStateAttributeAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -717,7 +716,7 @@ static v8::Handle<v8::Value> conditionalAttr1AttrGetter(v8::Local<v8::String> na
 {
     INC_STATS("DOM.TestObj.conditionalAttr1._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->conditionalAttr1());
+    return v8Integer(imp->conditionalAttr1(), info.GetIsolate());
 }
 
 #endif // ENABLE(Condition1)
@@ -741,7 +740,7 @@ static v8::Handle<v8::Value> conditionalAttr2AttrGetter(v8::Local<v8::String> na
 {
     INC_STATS("DOM.TestObj.conditionalAttr2._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->conditionalAttr2());
+    return v8Integer(imp->conditionalAttr2(), info.GetIsolate());
 }
 
 #endif // ENABLE(Condition1) && ENABLE(Condition2)
@@ -765,7 +764,7 @@ static v8::Handle<v8::Value> conditionalAttr3AttrGetter(v8::Local<v8::String> na
 {
     INC_STATS("DOM.TestObj.conditionalAttr3._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->conditionalAttr3());
+    return v8Integer(imp->conditionalAttr3(), info.GetIsolate());
 }
 
 #endif // ENABLE(Condition1) || ENABLE(Condition2)
@@ -815,7 +814,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeAttr1AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtRuntimeAttr1._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtRuntimeAttr1());
+    return v8Integer(imp->enabledAtRuntimeAttr1(), info.GetIsolate());
 }
 
 static void enabledAtRuntimeAttr1AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -831,7 +830,7 @@ static v8::Handle<v8::Value> enabledAtRuntimeAttr2AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtRuntimeAttr2._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtRuntimeAttr2());
+    return v8Integer(imp->enabledAtRuntimeAttr2(), info.GetIsolate());
 }
 
 static void enabledAtRuntimeAttr2AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -847,7 +846,7 @@ static v8::Handle<v8::Value> enabledAtContextAttr1AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtContextAttr1._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtContextAttr1());
+    return v8Integer(imp->enabledAtContextAttr1(), info.GetIsolate());
 }
 
 static void enabledAtContextAttr1AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -863,7 +862,7 @@ static v8::Handle<v8::Value> enabledAtContextAttr2AttrGetter(v8::Local<v8::Strin
 {
     INC_STATS("DOM.TestObj.enabledAtContextAttr2._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->enabledAtContextAttr2());
+    return v8Integer(imp->enabledAtContextAttr2(), info.GetIsolate());
 }
 
 static void enabledAtContextAttr2AttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -879,14 +878,14 @@ static v8::Handle<v8::Value> floatArrayAttrGetter(v8::Local<v8::String> name, co
 {
     INC_STATS("DOM.TestObj.floatArray._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8NumberArray(imp->floatArray());
+    return v8Array(imp->floatArray(), info.GetIsolate());
 }
 
 static void floatArrayAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.floatArray._set");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    Vector<float> v = v8NumberArrayToVector<float>(value);
+    Vector<float> v = toNativeArray<float>(value);
     imp->setFloatArray(v);
     return;
 }
@@ -895,14 +894,14 @@ static v8::Handle<v8::Value> doubleArrayAttrGetter(v8::Local<v8::String> name, c
 {
     INC_STATS("DOM.TestObj.doubleArray._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8NumberArray(imp->doubleArray());
+    return v8Array(imp->doubleArray(), info.GetIsolate());
 }
 
 static void doubleArrayAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.doubleArray._set");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    Vector<double> v = v8NumberArrayToVector<double>(value);
+    Vector<double> v = toNativeArray<double>(value);
     imp->setDoubleArray(v);
     return;
 }
@@ -953,7 +952,7 @@ static v8::Handle<v8::Value> strawberryAttrGetter(v8::Local<v8::String> name, co
 {
     INC_STATS("DOM.TestObj.strawberry._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->blueberry());
+    return v8Integer(imp->blueberry(), info.GetIsolate());
 }
 
 static void strawberryAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -985,14 +984,14 @@ static v8::Handle<v8::Value> descriptionAttrGetter(v8::Local<v8::String> name, c
 {
     INC_STATS("DOM.TestObj.description._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->description());
+    return v8Integer(imp->description(), info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> idAttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.TestObj.id._get");
     TestObj* imp = V8TestObj::toNative(info.Holder());
-    return v8::Integer::New(imp->id());
+    return v8Integer(imp->id(), info.GetIsolate());
 }
 
 static void idAttrSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -1044,7 +1043,7 @@ static v8::Handle<v8::Value> intMethodCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.intMethod");
     TestObj* imp = V8TestObj::toNative(args.Holder());
-    return v8::Integer::New(imp->intMethod());
+    return v8Integer(imp->intMethod(), args.GetIsolate());
 }
 
 static v8::Handle<v8::Value> intMethodWithArgsCallback(const v8::Arguments& args)
@@ -1056,7 +1055,7 @@ static v8::Handle<v8::Value> intMethodWithArgsCallback(const v8::Arguments& args
     EXCEPTION_BLOCK(int, intArg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
     STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, strArg, MAYBE_MISSING_PARAMETER(args, 1, DefaultIsUndefined));
     EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 2, DefaultIsUndefined))) : 0);
-    return v8::Integer::New(imp->intMethodWithArgs(intArg, strArg, objArg));
+    return v8Integer(imp->intMethodWithArgs(intArg, strArg, objArg), args.GetIsolate());
 }
 
 static v8::Handle<v8::Value> objMethodCallback(const v8::Arguments& args)
@@ -1572,6 +1571,28 @@ static v8::Handle<v8::Value> overloadedMethod7Callback(const v8::Arguments& args
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> overloadedMethod8Callback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.overloadedMethod8");
+    if (args.Length() < 1)
+        return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EXCEPTION_BLOCK(TestObj*, objArg, V8TestObj::HasInstance(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)) ? V8TestObj::toNative(v8::Handle<v8::Object>::Cast(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined))) : 0);
+    imp->overloadedMethod(objArg);
+    return v8::Handle<v8::Value>();
+}
+
+static v8::Handle<v8::Value> overloadedMethod9Callback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.overloadedMethod9");
+    if (args.Length() < 1)
+        return V8Proxy::throwNotEnoughArgumentsError(args.GetIsolate());
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    EXCEPTION_BLOCK(RefPtr<DOMStringList>, arrayArg, v8ValueToWebCoreDOMStringList(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
+    imp->overloadedMethod(arrayArg);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> overloadedMethodCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.overloadedMethod");
@@ -1589,6 +1610,10 @@ static v8::Handle<v8::Value> overloadedMethodCallback(const v8::Arguments& args)
         return overloadedMethod6Callback(args);
     if ((args.Length() == 1 && (args[0]->IsNull() || args[0]->IsArray())))
         return overloadedMethod7Callback(args);
+    if ((args.Length() == 1 && (V8TestObj::HasInstance(args[0]))))
+        return overloadedMethod8Callback(args);
+    if ((args.Length() == 1 && (args[0]->IsArray())))
+        return overloadedMethod9Callback(args);
     return V8Proxy::throwTypeError(0, args.GetIsolate());
 }
 
@@ -1603,10 +1628,10 @@ static v8::Handle<v8::Value> classMethodWithOptionalCallback(const v8::Arguments
 {
     INC_STATS("DOM.TestObj.classMethodWithOptional");
     if (args.Length() <= 0) {
-        return v8::Integer::New(TestObj::classMethodWithOptional());
+        return v8Integer(TestObj::classMethodWithOptional(), args.GetIsolate());
     }
     EXCEPTION_BLOCK(int, arg, toInt32(MAYBE_MISSING_PARAMETER(args, 0, DefaultIsUndefined)));
-    return v8::Integer::New(TestObj::classMethodWithOptional(arg));
+    return v8Integer(TestObj::classMethodWithOptional(arg), args.GetIsolate());
 }
 
 #if ENABLE(Condition1)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index 28ecd9408..3b0f2f67d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -103,7 +103,7 @@ static v8::Handle<v8::Value> portsAttrGetter(v8::Local<v8::String> name, const v
     MessagePortArray portsCopy(*ports);
     v8::Local<v8::Array> portArray = v8::Array::New(portsCopy.size());
     for (size_t i = 0; i < portsCopy.size(); ++i)
-        portArray->Set(v8::Integer::New(i), toV8(portsCopy[i].get(), info.GetIsolate()));
+        portArray->Set(v8Integer(i, info.GetIsolate()), toV8(portsCopy[i].get(), info.GetIsolate()));
     return portArray;
 }
 
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.cpp b/Source/WebCore/bindings/v8/DOMDataStore.cpp
index 2d5b5e633..dbca39540 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.cpp
+++ b/Source/WebCore/bindings/v8/DOMDataStore.cpp
@@ -32,6 +32,7 @@
 #include "DOMDataStore.h"
 
 #include "DOMData.h"
+#include "MemoryInstrumentation.h"
 #include "V8Binding.h"
 #include <wtf/MainThread.h>
 
@@ -118,6 +119,15 @@ void* DOMDataStore::getDOMWrapperMap(DOMWrapperMapType type)
     return 0;
 }
 
+void DOMDataStore::reportMemoryUsage(MemoryInstrumentation* instrumentation)
+{
+    instrumentation->reportPointer(this, MemoryInstrumentation::Binding);
+    domNodeMap().reportMemoryUsage(instrumentation);
+    activeDomNodeMap().reportMemoryUsage(instrumentation);
+    domObjectMap().reportMemoryUsage(instrumentation);
+    activeDomObjectMap().reportMemoryUsage(instrumentation);
+}
+
 // Called when the object is near death (not reachable from JS roots).
 // It is time to remove the entry from the table and dispose the handle.
 void DOMDataStore::weakDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject)
diff --git a/Source/WebCore/bindings/v8/DOMDataStore.h b/Source/WebCore/bindings/v8/DOMDataStore.h
index 089d86d4f..b5bdfc392 100644
--- a/Source/WebCore/bindings/v8/DOMDataStore.h
+++ b/Source/WebCore/bindings/v8/DOMDataStore.h
@@ -47,6 +47,7 @@ namespace WebCore {
 
     class DOMData;
     class DOMDataStore;
+    class MemoryInstrumentation;
 
     typedef WTF::Vector<DOMDataStore*> DOMDataList;
 
@@ -86,6 +87,8 @@ namespace WebCore {
         static void weakActiveDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
         static void weakNodeCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
 
+        void reportMemoryUsage(MemoryInstrumentation*);
+
     protected:
         static void weakDOMObjectCallback(v8::Persistent<v8::Value> v8Object, void* domObject);
 
diff --git a/Source/WebCore/bindings/v8/Dictionary.cpp b/Source/WebCore/bindings/v8/Dictionary.cpp
index dc724fa95..7d692e78e 100644
--- a/Source/WebCore/bindings/v8/Dictionary.cpp
+++ b/Source/WebCore/bindings/v8/Dictionary.cpp
@@ -277,7 +277,7 @@ bool Dictionary::get(const String& key, HashSet<AtomicString>& value) const
 
     v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
     for (size_t i = 0; i < v8Array->Length(); ++i) {
-        v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
+        v8::Local<v8::Value> indexedValue = v8Array->Get(v8Integer(i));
         value.add(v8ValueToWebCoreString(indexedValue));
     }
 
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index ee76ee29a..661ff0159 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -154,13 +154,15 @@ v8::Handle<v8::Value> ensureNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue,
 
 } // anonymous namespace
 
-static PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const String& keyPath)
+static PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> prpValue, const String& keyPath)
 {
     Vector<String> keyPathElements;
     IDBKeyPathParseError error;
     IDBParseKeyPath(keyPath, keyPathElements, error);
     ASSERT(error == IDBKeyPathParseErrorNone);
 
+    RefPtr<SerializedScriptValue> value = prpValue;
+
     V8AuxiliaryContext context;
     v8::Handle<v8::Value> v8Value(value->deserialize());
     v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPathElements, keyPathElements.size()));
diff --git a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
index 5c066f010..5d61668c1 100644
--- a/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
+++ b/Source/WebCore/bindings/v8/IntrusiveDOMWrapperMap.h
@@ -32,6 +32,7 @@
 #define IntrusiveDOMWrapperMap_h
 
 #include "DOMDataStore.h"
+#include "MemoryInstrumentation.h"
 #include "V8Node.h"
 
 namespace WebCore {
@@ -101,6 +102,12 @@ class ChunkedTable {
             visitEntries(store, chunk->m_entries, chunk->m_entries + CHUNK_SIZE, visitor);
     }
 
+    void reportMemoryUsage(MemoryInstrumentation* instrumentation)
+    {
+        for (Chunk* chunk = m_chunks; chunk; chunk = chunk->m_previous)
+            instrumentation->reportPointer(chunk, MemoryInstrumentation::Binding);
+    }
+
   private:
     struct Chunk {
         explicit Chunk(Chunk* previous) : m_previous(previous) { }
@@ -176,6 +183,12 @@ public:
         m_table.clear();
     }
 
+    virtual void reportMemoryUsage(MemoryInstrumentation* instrumentation) OVERRIDE
+    {
+        instrumentation->reportPointer(this, MemoryInstrumentation::Binding);
+        m_table.reportMemoryUsage(instrumentation);
+    }
+
 private:
     static int const numberOfEntries = (1 << 10) - 1;
 
diff --git a/Source/WebCore/bindings/v8/NPObjectWrapper.cpp b/Source/WebCore/bindings/v8/NPObjectWrapper.cpp
deleted file mode 100644
index 7c73b2f03..000000000
--- a/Source/WebCore/bindings/v8/NPObjectWrapper.cpp
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "NPObjectWrapper.h"
-
-namespace WebCore {
-
-struct NPProxyObject {
-    NPObject object;
-    NPObjectWrapper* wrapper;
-};
-
-NPClass NPObjectWrapper::m_npClassWrapper = {
-    NP_CLASS_STRUCT_VERSION,
-    NPObjectWrapper::NPAllocate,
-    NPObjectWrapper::NPDeallocate,
-    NPObjectWrapper::NPPInvalidate,
-    NPObjectWrapper::NPHasMethod,
-    NPObjectWrapper::NPInvoke,
-    NPObjectWrapper::NPInvokeDefault,
-    NPObjectWrapper::NPHasProperty,
-    NPObjectWrapper::NPGetProperty,
-    NPObjectWrapper::NPSetProperty,
-    NPObjectWrapper::NPRemoveProperty,
-    NPObjectWrapper::NPNEnumerate,
-    NPObjectWrapper::NPNConstruct
-};
-
-NPObjectWrapper::NPObjectWrapper(NPObject* obj)
-    : m_wrappedNPObject(obj)
-{
-}
-
-NPObject* NPObjectWrapper::create(NPObject* object)
-{
-    ASSERT(object);
-    NPProxyObject* proxyObject = reinterpret_cast<NPProxyObject*>(_NPN_CreateObject(0, &m_npClassWrapper));
-    proxyObject->wrapper = new NPObjectWrapper(object);
-    return reinterpret_cast<NPObject*>(proxyObject);
-}
-
-void NPObjectWrapper::clear()
-{
-    m_wrappedNPObject = 0;   
-}
-
-NPObjectWrapper* NPObjectWrapper::getWrapper(NPObject* obj)
-{
-    if (&m_npClassWrapper == obj->_class) {
-        NPProxyObject* proxyObject = reinterpret_cast<NPProxyObject*>(obj);
-        return proxyObject->wrapper;
-    }
-    return 0;
-}
-
-NPObject* NPObjectWrapper::getUnderlyingNPObject(NPObject* obj)
-{
-    NPObjectWrapper* wrapper = getWrapper(obj);
-    return wrapper ? wrapper->m_wrappedNPObject : 0;
-}
-
-NPObject* NPObjectWrapper::getObjectForCall(NPObject* obj)
-{
-    NPObject* actualObject = getUnderlyingNPObject(obj);
-    return actualObject ? actualObject : 0;
-}
-
-NPObject* NPObjectWrapper::NPAllocate(NPP, NPClass*)
-{
-    return reinterpret_cast<NPObject*>(new NPProxyObject);
-}
-
-void NPObjectWrapper::NPDeallocate(NPObject* obj)
-{
-    NPProxyObject* proxyObject = reinterpret_cast<NPProxyObject*>(obj);
-    delete proxyObject->wrapper;
-    delete proxyObject;
-}
-
-void NPObjectWrapper::NPPInvalidate(NPObject* obj)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    if (actualObject && actualObject->_class->invalidate)
-        actualObject->_class->invalidate(actualObject);
-}
-
-bool NPObjectWrapper::NPHasMethod(NPObject* obj, NPIdentifier name)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_HasMethod(0, actualObject, name) : false;
-}
-
-bool NPObjectWrapper::NPInvoke(NPObject* obj, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_Invoke(0, actualObject, name, args, argCount, result) : false;
-}
-
-bool NPObjectWrapper::NPInvokeDefault(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_InvokeDefault(0, actualObject, args, argCount, result) : false;
-}
- 
-bool NPObjectWrapper::NPHasProperty(NPObject* obj, NPIdentifier name)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_HasProperty(0, actualObject, name) : false;
-}
-
-bool NPObjectWrapper::NPGetProperty(NPObject* obj, NPIdentifier name, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_GetProperty(0, actualObject, name, result) : false;
-}
-
-bool NPObjectWrapper::NPSetProperty(NPObject* obj, NPIdentifier name, const NPVariant* value)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_SetProperty(0, actualObject, name, value) : false;
-}
-
-bool NPObjectWrapper::NPRemoveProperty(NPObject* obj, NPIdentifier name) {
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_RemoveProperty(0, actualObject, name) : false;
-}
-
-bool NPObjectWrapper::NPNEnumerate(NPObject* obj, NPIdentifier** value, uint32_t* count)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_Enumerate(0, actualObject, value, count) : false;
-}
-
-bool NPObjectWrapper::NPNConstruct(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    return actualObject ? _NPN_Construct(0, actualObject, args, argCount, result) : false;
-}
-
-bool NPObjectWrapper::NPInvokePrivate(NPP npp, NPObject* obj, bool isDefault, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    NPObject* actualObject = getObjectForCall(obj);
-    if (!actualObject)
-        return false;
-
-    if (isDefault) {
-        return _NPN_InvokeDefault(0, actualObject, args, argCount, result);
-    } else {
-        return _NPN_Invoke(0, actualObject, name, args, argCount, result);
-    }
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/NPObjectWrapper.h b/Source/WebCore/bindings/v8/NPObjectWrapper.h
deleted file mode 100644
index 6fdf90b4a..000000000
--- a/Source/WebCore/bindings/v8/NPObjectWrapper.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef NPObjectWrapper_h
-#define NPObjectWrapper_h
-
-#include "npruntime_impl.h"
-
-namespace WebCore {
-
-// This class wraps a NPObject and provides functionality for the wrapped
-// object to be cleared out when this object is destroyed. This is to ensure
-// that callers trying to access the underlying object don't crash while
-// invoking methods on the NPObject.
-class NPObjectWrapper {
-public:
-    // Creates an instance of the NPObjectWrapper class and wraps the object
-    // passed in.
-    static NPObject* create(NPObject* object);
-
-    // This method should be called to invalidate the underlying NPObject pointer.
-    void clear();
-
-    // Returns a pointer to NPObjectWrapper if the object passed in was wrapped by us.
-    static NPObjectWrapper* getWrapper(NPObject* obj);
-
-    // Returns a pointer to the underlying raw NPObject pointer or 0 if the object
-    // passed in was not wrapped.
-    static NPObject* getUnderlyingNPObject(NPObject* obj);
-
-    // NPObject functions implemented by the wrapper.
-    static NPObject* NPAllocate(NPP, NPClass*);
-    static void NPDeallocate(NPObject* obj);
-    static void NPPInvalidate(NPObject *obj);
-    static bool NPHasMethod(NPObject* obj, NPIdentifier name);
-    static bool NPInvoke(NPObject* obj, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result);
-    static bool NPInvokeDefault(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result);
-    static bool NPHasProperty(NPObject* obj, NPIdentifier name);
-    static bool NPGetProperty(NPObject* obj, NPIdentifier name, NPVariant* result);
-    static bool NPSetProperty(NPObject* obj, NPIdentifier name, const NPVariant *value);
-    static bool NPRemoveProperty(NPObject* obj, NPIdentifier name);
-    static bool NPNEnumerate(NPObject* obj, NPIdentifier **value, uint32_t* count);
-    static bool NPNConstruct(NPObject* obj, const NPVariant* args, uint32_t argCount, NPVariant* result);
-    static bool NPInvokePrivate(NPP npp, NPObject* obj,bool isDefault, NPIdentifier name, const NPVariant* args, uint32_t argCount, NPVariant* result);
-
-private:
-    NPObjectWrapper(NPObject* obj);
-
-    // Returns the underlying NPObject if the object passed in was wrapped. Otherwise
-    // just returns the object passed in.
-    static NPObject* getObjectForCall(NPObject* obj);
-
-    static NPClass m_npClassWrapper;
-    // Weak NPObject poointer.
-    NPObject* m_wrappedNPObject;
-};
-
-} // namespace WebCore
-
-#endif // NPObjectWrapper_h
-
diff --git a/Source/WebCore/bindings/v8/NPV8Object.cpp b/Source/WebCore/bindings/v8/NPV8Object.cpp
index ccf2f9897..d4d6cfc9c 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.cpp
+++ b/Source/WebCore/bindings/v8/NPV8Object.cpp
@@ -31,11 +31,11 @@
 #include "PlatformSupport.h"
 #include "DOMWindow.h"
 #include "Frame.h"
-#include "NPObjectWrapper.h"
 #include <wtf/OwnArrayPtr.h>
 #include "PlatformString.h"
 #include "ScriptSourceCode.h"
 #include "UserGestureIndicator.h"
+#include "V8Binding.h"
 #include "V8GCController.h"
 #include "V8Helpers.h"
 #include "V8NPUtils.h"
@@ -75,29 +75,7 @@ static NPObject* allocV8NPObject(NPP, NPClass*)
 static void freeV8NPObject(NPObject* npObject)
 {
     V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
-    if (int v8ObjectHash = v8NpObject->v8Object->GetIdentityHash()) {
-        V8NPObjectMap::iterator iter = staticV8NPObjectMap()->find(v8ObjectHash);
-        if (iter != staticV8NPObjectMap()->end()) {
-            V8NPObjectVector& objects = iter->second;
-            for (size_t index = 0; index < objects.size(); ++index) {
-                if (objects.at(index) == v8NpObject) {
-                    objects.remove(index);
-                    break;
-                }
-            }
-            if (objects.isEmpty())
-                staticV8NPObjectMap()->remove(v8ObjectHash);
-        } else
-            ASSERT_NOT_REACHED();
-    } else {
-        ASSERT(!v8::Context::InContext());
-        staticV8NPObjectMap()->clear();
-    }
-
-#ifndef NDEBUG
-    V8GCController::unregisterGlobalHandle(v8NpObject, v8NpObject->v8Object);
-#endif
-    v8NpObject->v8Object.Dispose();
+    disposeUnderlyingV8Object(npObject);
     free(v8NpObject);
 }
 
@@ -178,6 +156,38 @@ NPObject* npCreateV8ScriptObject(NPP npp, v8::Handle<v8::Object> object, DOMWind
     return reinterpret_cast<NPObject*>(v8npObject);
 }
 
+void disposeUnderlyingV8Object(NPObject* npObject)
+{
+    ASSERT(npObject->_class == npScriptObjectClass);
+    V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
+    if (v8NpObject->v8Object.IsEmpty())
+        return;
+    if (int v8ObjectHash = v8NpObject->v8Object->GetIdentityHash()) {
+        V8NPObjectMap::iterator iter = staticV8NPObjectMap()->find(v8ObjectHash);
+        if (iter != staticV8NPObjectMap()->end()) {
+            V8NPObjectVector& objects = iter->second;
+            for (size_t index = 0; index < objects.size(); ++index) {
+                if (objects.at(index) == v8NpObject) {
+                    objects.remove(index);
+                    break;
+                }
+            }
+            if (objects.isEmpty())
+                staticV8NPObjectMap()->remove(v8ObjectHash);
+        } else
+            ASSERT_NOT_REACHED();
+    } else {
+        ASSERT(!v8::Context::InContext());
+        staticV8NPObjectMap()->clear();
+    }
+
+#ifndef NDEBUG
+    V8GCController::unregisterGlobalHandle(v8NpObject, v8NpObject->v8Object);
+#endif
+    v8NpObject->v8Object.Dispose();
+    v8NpObject->v8Object.Clear();
+}
+
 } // namespace WebCore
 
 bool _NPN_Invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
@@ -194,6 +204,8 @@ bool _NPN_Invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPV
     }
 
     V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
+    if (v8NpObject->v8Object.IsEmpty())
+        return false;
 
     PrivateIdentifier* identifier = static_cast<PrivateIdentifier*>(methodName);
     if (!identifier->isString)
@@ -258,6 +270,8 @@ bool _NPN_InvokeDefault(NPP npp, NPObject* npObject, const NPVariant* arguments,
     }
 
     V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
+    if (v8NpObject->v8Object.IsEmpty())
+        return false;
 
     VOID_TO_NPVARIANT(*result);
 
@@ -304,13 +318,8 @@ bool _NPN_EvaluateHelper(NPP npp, bool popupsAllowed, NPObject* npObject, NPStri
     if (!npObject)
         return false;
 
-    if (npObject->_class != npScriptObjectClass) {
-        // Check if the object passed in is wrapped. If yes, then we need to invoke on the underlying object.
-        NPObject* actualObject = NPObjectWrapper::getUnderlyingNPObject(npObject);
-        if (!actualObject)
-            return false;
-        npObject = actualObject;
-    }
+    if (npObject->_class != npScriptObjectClass)
+        return false;
 
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -348,6 +357,8 @@ bool _NPN_GetProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName, NP
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -383,6 +394,8 @@ bool _NPN_SetProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName, co
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -412,6 +425,8 @@ bool _NPN_RemoveProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
         return false;
 
     V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+    if (object->v8Object.IsEmpty())
+        return false;
 
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -433,6 +448,8 @@ bool _NPN_HasProperty(NPP npp, NPObject* npObject, NPIdentifier propertyName)
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -457,6 +474,8 @@ bool _NPN_HasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -501,6 +520,8 @@ bool _NPN_Enumerate(NPP npp, NPObject* npObject, NPIdentifier** identifier, uint
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
@@ -537,7 +558,7 @@ bool _NPN_Enumerate(NPP npp, NPObject* npObject, NPIdentifier** identifier, uint
         *count = props->Length();
         *identifier = static_cast<NPIdentifier*>(malloc(sizeof(NPIdentifier*) * *count));
         for (uint32_t i = 0; i < *count; ++i) {
-            v8::Local<v8::Value> name = props->Get(v8::Integer::New(i));
+            v8::Local<v8::Value> name = props->Get(v8Integer(i));
             (*identifier)[i] = getStringIdentifier(v8::Local<v8::String>::Cast(name));
         }
         return true;
@@ -556,6 +577,8 @@ bool _NPN_Construct(NPP npp, NPObject* npObject, const NPVariant* arguments, uin
 
     if (npObject->_class == npScriptObjectClass) {
         V8NPObject* object = reinterpret_cast<V8NPObject*>(npObject);
+        if (object->v8Object.IsEmpty())
+            return false;
 
         v8::HandleScope handleScope;
         v8::Handle<v8::Context> context = toV8Context(npp, npObject);
diff --git a/Source/WebCore/bindings/v8/NPV8Object.h b/Source/WebCore/bindings/v8/NPV8Object.h
index f72ba8bd1..b7e0464a1 100644
--- a/Source/WebCore/bindings/v8/NPV8Object.h
+++ b/Source/WebCore/bindings/v8/NPV8Object.h
@@ -54,8 +54,9 @@ WrapperTypeInfo* npObjectTypeInfo();
 
 extern NPClass* npScriptObjectClass;
 
-// A V8NPObject is a NPObject which carries additional V8-specific information. It is allocated and deallocated by
-// AllocV8NPObject() and FreeV8NPObject() methods.
+// A V8NPObject is a NPObject which carries additional V8-specific information.
+// It is created with npCreateV8ScriptObject() and deallocated via the deallocate
+// method in the same way as other NPObjects.
 struct V8NPObject {
     NPObject object;
     v8::Persistent<v8::Object> v8Object;
@@ -74,6 +75,8 @@ NPObject* npCreateV8ScriptObject(NPP, v8::Handle<v8::Object>, DOMWindow*);
 
 NPObject* v8ObjectToNPObject(v8::Handle<v8::Object>);
 
+void disposeUnderlyingV8Object(NPObject*);
+
 } // namespace WebCore
 
 #endif // NPV8Object_h
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
index dce148a84..03e7c57b2 100755
--- a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
@@ -112,7 +112,7 @@ void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* pag
     ASSERT(!value->IsUndefined() && value->IsArray());
     v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
     for (unsigned i = 0; i < scriptsArray->Length(); ++i)
-        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
+        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8Integer(i))));
 }
 
 void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
diff --git a/Source/WebCore/bindings/v8/ScriptController.cpp b/Source/WebCore/bindings/v8/ScriptController.cpp
index d49866d87..d0a7e06e2 100644
--- a/Source/WebCore/bindings/v8/ScriptController.cpp
+++ b/Source/WebCore/bindings/v8/ScriptController.cpp
@@ -45,7 +45,6 @@
 #include "FrameLoaderClient.h"
 #include "Node.h"
 #include "NotImplemented.h"
-#include "NPObjectWrapper.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
@@ -110,7 +109,7 @@ ScriptController::ScriptController(Frame* frame)
     , m_paused(false)
     , m_proxy(adoptPtr(new V8Proxy(frame)))
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    , m_wrappedWindowScriptNPObject(0)
+    , m_windowScriptNPObject(0)
 #endif
 {
 }
@@ -129,21 +128,14 @@ void ScriptController::clearScriptObjects()
     m_pluginObjects.clear();
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    if (m_wrappedWindowScriptNPObject) {
-        NPObjectWrapper* windowScriptObjectWrapper = NPObjectWrapper::getWrapper(m_wrappedWindowScriptNPObject);
-        ASSERT(windowScriptObjectWrapper);
-
-        NPObject* windowScriptNPObject = NPObjectWrapper::getUnderlyingNPObject(m_wrappedWindowScriptNPObject);
-        ASSERT(windowScriptNPObject);
-        // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window
-        // script object properly.
-        // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.
-        _NPN_DeallocateObject(windowScriptNPObject);
-
-        // Clear out the wrapped window script object pointer held by the wrapper.
-        windowScriptObjectWrapper->clear();
-        _NPN_ReleaseObject(m_wrappedWindowScriptNPObject);
-        m_wrappedWindowScriptNPObject = 0;
+    if (m_windowScriptNPObject) {
+        // Dispose of the underlying V8 object before releasing our reference
+        // to it, so that if the plugin fails to release it properly we will
+        // only leak the NPObject wrapper, not the object, its document, or
+        // anything else they reference.
+        disposeUnderlyingV8Object(m_windowScriptNPObject);
+        _NPN_ReleaseObject(m_windowScriptNPObject);
+        m_windowScriptNPObject = 0;
     }
 #endif
 }
@@ -391,24 +383,21 @@ static NPObject* createScriptObject(Frame* frame)
 
 NPObject* ScriptController::windowScriptNPObject()
 {
-    if (m_wrappedWindowScriptNPObject)
-        return m_wrappedWindowScriptNPObject;
+    if (m_windowScriptNPObject)
+        return m_windowScriptNPObject;
 
-    NPObject* windowScriptNPObject = 0;
     if (canExecuteScripts(NotAboutToExecuteScript)) {
         // JavaScript is enabled, so there is a JavaScript window object.
         // Return an NPObject bound to the window object.
-        windowScriptNPObject = createScriptObject(m_frame);
-        _NPN_RegisterObject(windowScriptNPObject, 0);
+        m_windowScriptNPObject = createScriptObject(m_frame);
+        _NPN_RegisterObject(m_windowScriptNPObject, 0);
     } else {
         // JavaScript is not enabled, so we cannot bind the NPObject to the
         // JavaScript window object. Instead, we create an NPObject of a
         // different class, one which is not bound to a JavaScript object.
-        windowScriptNPObject = createNoScriptObject();
+        m_windowScriptNPObject = createNoScriptObject();
     }
-
-    m_wrappedWindowScriptNPObject = NPObjectWrapper::create(windowScriptNPObject);
-    return m_wrappedWindowScriptNPObject;
+    return m_windowScriptNPObject;
 }
 
 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
diff --git a/Source/WebCore/bindings/v8/ScriptController.h b/Source/WebCore/bindings/v8/ScriptController.h
index 41d71ce32..7c7836876 100644
--- a/Source/WebCore/bindings/v8/ScriptController.h
+++ b/Source/WebCore/bindings/v8/ScriptController.h
@@ -205,14 +205,9 @@ private:
     // invalidate all sub-objects which are associated with that plugin.
     // The frame keeps a NPObject reference for each item on the list.
     PluginObjectMap m_pluginObjects;
-    // The window script object can get destroyed while there are outstanding
-    // references to it. Please refer to ScriptController::clearScriptObjects
-    // for more information as to why this is necessary. To avoid crashes due
-    // to calls on the destroyed window object, we return a proxy NPObject
-    // which wraps the underlying window object. The wrapped window object
-    // pointer in this object is cleared out when the window object is
-    // destroyed.
-    NPObject* m_wrappedWindowScriptNPObject;
+#if ENABLE(NETSCAPE_PLUGIN_API)
+    NPObject* m_windowScriptNPObject;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index f95f2b6a2..2c82510b1 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -79,8 +79,8 @@ String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBrea
 
     v8::Local<v8::Object> args = v8::Object::New();
     args->Set(v8::String::New("sourceID"), v8String(sourceID));
-    args->Set(v8::String::New("lineNumber"), v8::Integer::New(scriptBreakpoint.lineNumber));
-    args->Set(v8::String::New("columnNumber"), v8::Integer::New(scriptBreakpoint.columnNumber));
+    args->Set(v8::String::New("lineNumber"), v8Integer(scriptBreakpoint.lineNumber));
+    args->Set(v8::String::New("columnNumber"), v8Integer(scriptBreakpoint.columnNumber));
     args->Set(v8::String::New("condition"), v8String(scriptBreakpoint.condition));
 
     v8::Handle<v8::Function> setBreakpointFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("setBreakpoint")));
@@ -428,7 +428,7 @@ void ScriptDebugServer::compileScript(ScriptState* state, const String& expressi
     v8::Local<v8::String> code = v8ExternalString(expression);
     v8::TryCatch tryCatch;
 
-    v8::ScriptOrigin origin(v8ExternalString(sourceURL), v8::Integer::New(0), v8::Integer::New(0));
+    v8::ScriptOrigin origin(v8ExternalString(sourceURL), v8Integer(0), v8Integer(0));
     v8::Handle<v8::Script> script = v8::Script::New(code, &origin);
 
     if (tryCatch.HasCaught()) {
@@ -451,6 +451,8 @@ void ScriptDebugServer::clearCompiledScripts()
 
 void ScriptDebugServer::runScript(ScriptState* state, const String& scriptId, ScriptValue* result, bool* wasThrown, String* exceptionMessage)
 {
+    if (!m_compiledScripts.contains(scriptId))
+        return;
     v8::HandleScope handleScope;
     OwnHandle<v8::Script>* scriptOwnHandle = m_compiledScripts.get(scriptId);
     v8::Local<v8::Script> script = v8::Local<v8::Script>::New(scriptOwnHandle->get());
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 57bb8080e..8d6c5029e 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -33,6 +33,7 @@
 #include "ScriptProfiler.h"
 
 #include "BindingVisitors.h"
+#include "MemoryInstrumentation.h"
 #include "RetainedDOMInfo.h"
 #include "ScriptObject.h"
 #include "V8ArrayBufferView.h"
@@ -219,6 +220,14 @@ void ScriptProfiler::visitExternalArrays(ExternalArrayVisitor* visitor)
 
 }
 
+void ScriptProfiler::collectBindingMemoryInfo(MemoryInstrumentation* instrumentation)
+{
+    V8BindingPerIsolateData* data = V8BindingPerIsolateData::current();
+    if (!data)
+        return;
+    data->reportMemoryUsage(instrumentation);
+}
+
 size_t ScriptProfiler::profilerSnapshotsSize()
 {
     return v8::HeapProfiler::GetMemorySizeUsedByProfiler();
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 25f6e129e..7ffa50da7 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -42,6 +42,7 @@ namespace WebCore {
 
 class ExternalArrayVisitor;
 class ExternalStringVisitor;
+class MemoryInstrumentation;
 class NodeWrapperVisitor;
 class Page;
 class ScriptObject;
@@ -81,6 +82,7 @@ public:
     static void visitNodeWrappers(NodeWrapperVisitor*);
     static void visitExternalStrings(ExternalStringVisitor*);
     static void visitExternalArrays(ExternalArrayVisitor*);
+    static void collectBindingMemoryInfo(MemoryInstrumentation*);
     static size_t profilerSnapshotsSize();
 };
 
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
index ecba2e063..616107361 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -1574,7 +1574,7 @@ private:
         uint32_t rawValue;
         if (!doReadUint32(&rawValue))
             return false;
-        *value = v8::Integer::New(static_cast<int32_t>(ZigZag::decode(rawValue)));
+        *value = v8Integer(static_cast<int32_t>(ZigZag::decode(rawValue)), m_isolate);
         return true;
     }
 
@@ -1583,7 +1583,7 @@ private:
         uint32_t rawValue;
         if (!doReadUint32(&rawValue))
             return false;
-        *value = v8::Integer::NewFromUnsigned(rawValue);
+        *value = v8UnsignedInteger(rawValue, m_isolate);
         return true;
     }
 
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 699018692..c29bcf833 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -34,6 +34,7 @@
 #include "BindingVisitors.h"
 #include "DOMStringList.h"
 #include "Element.h"
+#include "MemoryInstrumentation.h"
 #include "PlatformString.h"
 #include "QualifiedName.h"
 #include "V8DOMStringList.h"
@@ -89,7 +90,16 @@ void V8BindingPerIsolateData::dispose(v8::Isolate* isolate)
     isolate->SetData(0);
 }
 
+void V8BindingPerIsolateData::reportMemoryUsage(MemoryInstrumentation* instrumentation)
+{
+    instrumentation->reportPointer(this, MemoryInstrumentation::Binding);
+    instrumentation->reportHashMap(m_rawTemplates, MemoryInstrumentation::Binding);
+    instrumentation->reportHashMap(m_templates, MemoryInstrumentation::Binding);
+    m_stringCache.reportMemoryUsage(instrumentation);
 
+    for (size_t i = 0; i < m_domDataList.size(); i++)
+        m_domDataList[i]->reportMemoryUsage(instrumentation);
+}
 
 // WebCoreStringResource is a helper class for v8ExternalString. It is used
 // to manage the life-cycle of the underlying buffer of the external string.
@@ -218,7 +228,7 @@ v8::Handle<v8::Value> v8Array(PassRefPtr<DOMStringList> stringList, v8::Isolate*
         return v8::Array::New();
     v8::Local<v8::Array> result = v8::Array::New(stringList->length());
     for (unsigned i = 0; i < stringList->length(); ++i)
-        result->Set(v8::Integer::New(i), v8String(stringList->item(i), isolate));
+        result->Set(v8Integer(i, isolate), v8String(stringList->item(i), isolate));
     return result;
 }
 
@@ -490,7 +500,27 @@ v8::Local<v8::String> StringCache::v8ExternalStringSlow(StringImpl* stringImpl,
 
     return newString;
 }
-    
+
+void IntegerCache::createSmallIntegers()
+{
+    ASSERT(!m_initialized);
+    // We initialize m_smallIntegers not in a constructor but in v8Integer(),
+    // because Integer::New() requires a HandleScope. At the point where
+    // IntegerCache is constructed, a HandleScope might not exist.
+    for (int value = 0; value < numberOfCachedSmallIntegers; value++)
+        m_smallIntegers[value] = v8::Persistent<v8::Integer>::New(v8::Integer::New(value));
+    m_initialized = true;
+}
+
+IntegerCache::~IntegerCache()
+{
+    if (m_initialized) {
+        for (int value = 0; value < numberOfCachedSmallIntegers; value++)
+            m_smallIntegers[value].Dispose();
+        m_initialized = false;
+    }
+}
+
 v8::Persistent<v8::FunctionTemplate> createRawTemplate()
 {
     v8::HandleScope scope;
@@ -556,6 +586,11 @@ v8::Persistent<v8::FunctionTemplate> getToStringTemplate()
         toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(constructorToString));
     return toStringTemplate;
 }
+
+void StringCache::reportMemoryUsage(MemoryInstrumentation* instrumentation)
+{
+    instrumentation->reportHashMap(m_stringCache, MemoryInstrumentation::Binding);
+}
     
 PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value> value)
 {
@@ -572,7 +607,7 @@ PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value> va
     RefPtr<DOMStringList> ret = DOMStringList::create();
     v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
     for (size_t i = 0; i < v8Array->Length(); ++i) {
-        v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
+        v8::Local<v8::Value> indexedValue = v8Array->Get(v8Integer(i));
         ret->append(v8ValueToWebCoreString(indexedValue));
     }
     return ret.release();
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 10296a700..cb420002f 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -49,6 +49,7 @@ namespace WebCore {
     class EventListener;
     class EventTarget;
     class ExternalStringVisitor;
+    class MemoryInstrumentation;
 
     // FIXME: Remove V8Binding.
     class V8Binding {
@@ -78,6 +79,8 @@ namespace WebCore {
 
         void remove(StringImpl*);
 
+        void reportMemoryUsage(MemoryInstrumentation*);
+
     private:
         v8::Local<v8::String> v8ExternalStringSlow(StringImpl*, v8::Isolate*);
 
@@ -89,6 +92,38 @@ namespace WebCore {
         RefPtr<StringImpl> m_lastStringImpl;
     };
 
+    const int numberOfCachedSmallIntegers = 64;
+
+    class IntegerCache {
+    public:
+        IntegerCache() : m_initialized(false) { };
+        ~IntegerCache();
+
+        v8::Handle<v8::Integer> v8Integer(int value)
+        {
+            if (!m_initialized)
+                createSmallIntegers();
+            if (0 <= value && value < numberOfCachedSmallIntegers)
+                return m_smallIntegers[value];
+            return v8::Integer::New(value);
+        }
+
+        v8::Handle<v8::Integer> v8UnsignedInteger(unsigned value)
+        {
+            if (!m_initialized)
+                createSmallIntegers();
+            if (value < static_cast<unsigned>(numberOfCachedSmallIntegers))
+                return m_smallIntegers[value];
+            return v8::Integer::NewFromUnsigned(value);
+        }
+
+    private:
+        void createSmallIntegers();
+
+        v8::Persistent<v8::Integer> m_smallIntegers[numberOfCachedSmallIntegers];
+        bool m_initialized;
+    };
+
     class ScriptGCEventListener;
 
     class GCEventData {
@@ -120,16 +155,13 @@ namespace WebCore {
     public:
         static V8BindingPerIsolateData* create(v8::Isolate*);
         static void ensureInitialized(v8::Isolate*);
-        static V8BindingPerIsolateData* get(v8::Isolate* isolate)
+        static V8BindingPerIsolateData* current(v8::Isolate* isolate = 0)
         {
+            if (UNLIKELY(!isolate))
+                isolate = v8::Isolate::GetCurrent();
             ASSERT(isolate->GetData());
             return static_cast<V8BindingPerIsolateData*>(isolate->GetData()); 
         }
-
-        static V8BindingPerIsolateData* current(v8::Isolate* isolate = 0)
-        {
-            return isolate ? static_cast<V8BindingPerIsolateData*>(isolate->GetData()) : get(v8::Isolate::GetCurrent());
-        }
         static void dispose(v8::Isolate*);
 
         typedef HashMap<WrapperTypeInfo*, v8::Persistent<v8::FunctionTemplate> > TemplateMap;
@@ -145,6 +177,8 @@ namespace WebCore {
         }
 
         StringCache* stringCache() { return &m_stringCache; }
+        IntegerCache* integerCache() { return &m_integerCache; }
+
 #if ENABLE(INSPECTOR)
         void visitExternalStrings(ExternalStringVisitor*);
 #endif
@@ -183,6 +217,8 @@ namespace WebCore {
 
         GCEventData& gcEventData() { return m_gcEventData; }
 
+        void reportMemoryUsage(MemoryInstrumentation*);
+
     private:
         explicit V8BindingPerIsolateData(v8::Isolate*);
         ~V8BindingPerIsolateData();
@@ -193,6 +229,7 @@ namespace WebCore {
         v8::Persistent<v8::FunctionTemplate> m_toStringTemplate;
         v8::Persistent<v8::FunctionTemplate> m_lazyEventListenerToStringTemplate;
         StringCache m_stringCache;
+        IntegerCache m_integerCache;
 
         DOMDataList m_domDataList;
         DOMDataStore* m_domDataStore;
@@ -293,29 +330,97 @@ namespace WebCore {
         return v8ExternalString(string, isolate);
     }
 
+    inline v8::Handle<v8::Integer> v8Integer(int value, v8::Isolate* isolate = 0)
+    {
+        V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+        return data->integerCache()->v8Integer(value);
+    }
+
+    inline v8::Handle<v8::Integer> v8UnsignedInteger(unsigned value, v8::Isolate* isolate = 0)
+    {
+        V8BindingPerIsolateData* data = V8BindingPerIsolateData::current(isolate);
+        return data->integerCache()->v8UnsignedInteger(value);
+    }
+
+    template <class T>
+    struct V8ValueTraits {
+        static inline v8::Handle<v8::Value> arrayV8Value(const T& value, v8::Isolate* isolate)
+        {
+            return toV8(WTF::getPtr(value), isolate);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<String> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const String& value, v8::Isolate* isolate)
+        {
+            return v8String(value, isolate);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<unsigned long> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const unsigned long& value, v8::Isolate* isolate)
+        {
+            return v8UnsignedInteger(value, isolate);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<float> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const float& value, v8::Isolate*)
+        {
+            return v8::Number::New(value);
+        }
+    };
+
+    template<>
+    struct V8ValueTraits<double> {
+        static inline v8::Handle<v8::Value> arrayV8Value(const double& value, v8::Isolate*)
+        {
+            return v8::Number::New(value);
+        }
+    };
+
     template<typename T>
     v8::Handle<v8::Value> v8Array(const Vector<T>& iterator, v8::Isolate* isolate)
     {
         v8::Local<v8::Array> result = v8::Array::New(iterator.size());
         int index = 0;
         typename Vector<T>::const_iterator end = iterator.end();
+        typedef V8ValueTraits<T> TraitsType;
         for (typename Vector<T>::const_iterator iter = iterator.begin(); iter != end; ++iter)
-            result->Set(v8::Integer::New(index++), toV8(WTF::getPtr(*iter), isolate));
+            result->Set(v8Integer(index++, isolate), TraitsType::arrayV8Value(*iter, isolate));
         return result;
     }
 
+    v8::Handle<v8::Value> v8Array(PassRefPtr<DOMStringList>, v8::Isolate*);
+
+    template<class T> struct NativeValueTraits;
+
     template<>
-    inline v8::Handle<v8::Value> v8Array(const Vector<String>& iterator, v8::Isolate* isolate)
-    {
-        v8::Local<v8::Array> array = v8::Array::New(iterator.size());
-        Vector<String>::const_iterator end = iterator.end();
-        int index = 0;
-        for (Vector<String>::const_iterator iter = iterator.begin(); iter != end; ++iter)
-            array->Set(v8::Integer::New(index++), v8String(*iter, isolate));
-        return array;
-    }
+    struct NativeValueTraits<String> {
+        static inline String arrayNativeValue(const v8::Local<v8::Array>& array, size_t i)
+        {
+            return v8ValueToWebCoreString(array->Get(i));
+        }
+    };
 
-    v8::Handle<v8::Value> v8Array(PassRefPtr<DOMStringList>, v8::Isolate*);
+    template<>
+    struct NativeValueTraits<float> {
+        static inline float arrayNativeValue(const v8::Local<v8::Array>& array, size_t i)
+        {
+            return static_cast<float>(array->Get(v8Integer(i))->NumberValue());
+        }
+    };
+
+    template<>
+    struct NativeValueTraits<double> {
+        static inline double arrayNativeValue(const v8::Local<v8::Array>& array, size_t i)
+        {
+            return static_cast<double>(array->Get(v8Integer(i))->NumberValue());
+        }
+    };
 
     template <class T>
     Vector<T> toNativeArray(v8::Handle<v8::Value> value)
@@ -324,12 +429,12 @@ namespace WebCore {
             return Vector<T>();
 
         Vector<T> result;
+        typedef NativeValueTraits<T> TraitsType;
         v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(value));
         v8::Local<v8::Array> array = v8::Local<v8::Array>::Cast(v8Value);
         size_t length = array->Length();
-
         for (size_t i = 0; i < length; ++i) {
-            result.append(v8ValueToWebCoreString(array->Get(i)));
+            result.append(TraitsType::arrayNativeValue(array, i));
         }
         return result;
     }
@@ -459,15 +564,6 @@ namespace WebCore {
         return str.isNull() ? v8::Handle<v8::Value>(v8Boolean(false)) : v8::Handle<v8::Value>(v8String(str, isolate));
     }
 
-    template <class T> v8::Handle<v8::Value> v8NumberArray(const Vector<T>& values)
-    {
-        size_t size = values.size();
-        v8::Local<v8::Array> result = v8::Array::New(size);
-        for (size_t i = 0; i < size; ++i)
-            result->Set(i, v8::Number::New(values[i]));
-        return result;
-    }
-
     inline double toWebCoreDate(v8::Handle<v8::Value> object)
     {
         return (object->IsDate() || object->IsNumber()) ? object->NumberValue() : std::numeric_limits<double>::quiet_NaN();
@@ -497,22 +593,6 @@ namespace WebCore {
 
     String int32ToWebCoreString(int value);
 
-    template <class T> Vector<T> v8NumberArrayToVector(v8::Handle<v8::Value> value)
-    {
-        v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(value));
-        if (!v8Value->IsArray())
-            return Vector<T>();
-
-        Vector<T> result;
-        v8::Local<v8::Array> v8Array = v8::Local<v8::Array>::Cast(v8Value);
-        size_t length = v8Array->Length();
-        for (size_t i = 0; i < length; ++i) {
-            v8::Local<v8::Value> indexedValue = v8Array->Get(v8::Integer::New(i));
-            result.append(static_cast<T>(indexedValue->NumberValue()));
-        }
-        return result;
-    }
-
     PassRefPtr<DOMStringList> v8ValueToWebCoreDOMStringList(v8::Handle<v8::Value>);
 
     class V8ParameterBase {
diff --git a/Source/WebCore/bindings/v8/V8Collection.h b/Source/WebCore/bindings/v8/V8Collection.h
index b50ba899c..d8cdc81cc 100644
--- a/Source/WebCore/bindings/v8/V8Collection.h
+++ b/Source/WebCore/bindings/v8/V8Collection.h
@@ -106,7 +106,7 @@ template<class Collection> static v8::Handle<v8::Array> nodeCollectionIndexedPro
     v8::Handle<v8::Array> properties = v8::Array::New(length);
     for (int i = 0; i < length; ++i) {
         // FIXME: Do we need to check that the item function returns a non-null value for this index?
-        v8::Handle<v8::Integer> integer = v8::Integer::New(i);
+        v8::Handle<v8::Integer> integer = v8Integer(i, info.GetIsolate());
         properties->Set(integer, integer);
     }
     return properties;
@@ -121,7 +121,7 @@ template<class Collection> static v8::Handle<v8::Array> collectionIndexedPropert
     v8::Handle<v8::Array> properties = v8::Array::New(length);
     for (int i = 0; i < length; ++i) {
         // FIXME: Do we need to check that the item function returns a non-null value for this index?
-        v8::Handle<v8::Integer> integer = v8::Integer::New(i);
+        v8::Handle<v8::Integer> integer = v8Integer(i, info.GetIsolate());
         properties->Set(integer, integer);
     }
     return properties;
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.cpp b/Source/WebCore/bindings/v8/V8DOMMap.cpp
index f09a4a895..0b10cb0c6 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMMap.cpp
@@ -50,10 +50,6 @@ DOMDataStoreHandle::~DOMDataStoreHandle()
     V8BindingPerIsolateData::current()->unregisterDOMDataStore(m_store.get());
 }
 
-void enableFasterDOMStoreAccess()
-{
-}
-
 DOMNodeMapping& getDOMNodeMap(v8::Isolate* isolate)
 {
     return DOMData::getCurrentStore(isolate).domNodeMap();
diff --git a/Source/WebCore/bindings/v8/V8DOMMap.h b/Source/WebCore/bindings/v8/V8DOMMap.h
index bc51540a2..4ee6c318d 100644
--- a/Source/WebCore/bindings/v8/V8DOMMap.h
+++ b/Source/WebCore/bindings/v8/V8DOMMap.h
@@ -31,6 +31,7 @@
 #ifndef V8DOMMap_h
 #define V8DOMMap_h
 
+#include "MemoryInstrumentation.h"
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <v8.h>
@@ -38,6 +39,7 @@
 namespace WebCore {
     class DOMDataStore;
     class Node;
+    class MemoryInstrumentation;
 
     template <class KeyType, class ValueType> class AbstractWeakReferenceMap {
     public:
@@ -61,6 +63,9 @@ namespace WebCore {
         virtual void clear() = 0;
 
         v8::WeakReferenceCallback weakReferenceCallback() { return m_weakReferenceCallback; }
+
+        virtual void reportMemoryUsage(MemoryInstrumentation*) = 0;
+
     private:
         v8::WeakReferenceCallback m_weakReferenceCallback;
     };
@@ -129,6 +134,11 @@ namespace WebCore {
             visitor->endMap();
         }
 
+        virtual void reportMemoryUsage(MemoryInstrumentation* instrumentation) OVERRIDE
+        {
+            instrumentation->reportHashMap(m_map, MemoryInstrumentation::Binding);
+        }
+
     protected:
         HashMap<KeyType*, ValueType*> m_map;
     };
@@ -167,7 +177,6 @@ namespace WebCore {
     // This should be called to remove all DOM objects associated with the current thread when it is tearing down.
     void removeAllDOMObjects();
 
-    void enableFasterDOMStoreAccess();
 } // namespace WebCore
 
 #endif // V8DOMMap_h
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index 056239b4f..bdbe4e1c5 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -300,6 +300,10 @@ bool V8DOMWindowShell::initContextIfNeeded()
 #endif
         V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
 
+        // FIXME: Remove the following 2 lines when V8 default has changed.
+        const char es52GlobalsFlag[] = "--es52_globals";
+        v8::V8::SetFlagsFromString(es52GlobalsFlag, sizeof(es52GlobalsFlag));
+
         isV8Initialized = true;
     }
 
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index 83b1a1403..eb0522f27 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -180,11 +180,11 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
     v8::Local<v8::Object> thisObject = v8::Object::New();
     if (thisObject.IsEmpty())
         return;
-    if (!thisObject->ForceSet(v8::Integer::NewFromUnsigned(0), nodeWrapper))
+    if (!thisObject->ForceSet(v8UnsignedInteger(0), nodeWrapper))
         return;
-    if (!thisObject->ForceSet(v8::Integer::NewFromUnsigned(1), formWrapper))
+    if (!thisObject->ForceSet(v8UnsignedInteger(1), formWrapper))
         return;
-    if (!thisObject->ForceSet(v8::Integer::NewFromUnsigned(2), documentWrapper))
+    if (!thisObject->ForceSet(v8UnsignedInteger(2), documentWrapper))
         return;
 
     // FIXME: Remove this code when we stop doing the 'with' hack above.
diff --git a/Source/WebCore/bindings/v8/V8NPObject.cpp b/Source/WebCore/bindings/v8/V8NPObject.cpp
index 6125f9a63..d480e3e69 100644
--- a/Source/WebCore/bindings/v8/V8NPObject.cpp
+++ b/Source/WebCore/bindings/v8/V8NPObject.cpp
@@ -264,7 +264,7 @@ v8::Handle<v8::Value> npObjectGetIndexedProperty(v8::Local<v8::Object> self, uin
 v8::Handle<v8::Integer> npObjectQueryProperty(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     NPIdentifier identifier = getStringIdentifier(name);
-    return npObjectGetProperty(info.Holder(), identifier, name, info.GetIsolate()).IsEmpty() ? v8::Handle<v8::Integer>() : v8::Integer::New(v8::None);
+    return npObjectGetProperty(info.Holder(), identifier, name, info.GetIsolate()).IsEmpty() ? v8::Handle<v8::Integer>() : v8Integer(0, info.GetIsolate());
 }
 
 static v8::Handle<v8::Value> npObjectSetProperty(v8::Local<v8::Object> self, NPIdentifier identifier, v8::Local<v8::Value> value, v8::Isolate* isolate)
@@ -335,9 +335,9 @@ v8::Handle<v8::Array> npObjectPropertyEnumerator(const v8::AccessorInfo& info, b
             for (uint32_t i = 0; i < count; ++i) {
                 IdentifierRep* identifier = static_cast<IdentifierRep*>(identifiers[i]);
                 if (namedProperty)
-                    properties->Set(v8::Integer::New(i), v8::String::New(identifier->string()));
+                    properties->Set(v8Integer(i, info.GetIsolate()), v8::String::New(identifier->string()));
                 else
-                    properties->Set(v8::Integer::New(i), v8::Integer::New(identifier->number()));
+                    properties->Set(v8Integer(i, info.GetIsolate()), v8Integer(identifier->number(), info.GetIsolate()));
             }
 
             return properties;
diff --git a/Source/WebCore/bindings/v8/V8NPUtils.cpp b/Source/WebCore/bindings/v8/V8NPUtils.cpp
index ca9e1ea70..89b12e836 100644
--- a/Source/WebCore/bindings/v8/V8NPUtils.cpp
+++ b/Source/WebCore/bindings/v8/V8NPUtils.cpp
@@ -83,7 +83,7 @@ v8::Handle<v8::Value> convertNPVariantToV8Object(const NPVariant* variant, NPObj
 
     switch (type) {
     case NPVariantType_Int32:
-        return v8::Integer::New(NPVARIANT_TO_INT32(*variant));
+        return v8Integer(NPVARIANT_TO_INT32(*variant));
     case NPVariantType_Double:
         return v8::Number::New(NPVARIANT_TO_DOUBLE(*variant));
     case NPVariantType_Bool:
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index f8031ec7e..ae039e3b6 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -115,8 +115,8 @@ void batchConfigureConstants(v8::Handle<v8::FunctionTemplate> functionDescriptor
 {
     for (size_t i = 0; i < constantCount; ++i) {
         const BatchedConstant* constant = &constants[i];
-        functionDescriptor->Set(v8::String::New(constant->name), v8::Integer::New(constant->value), v8::ReadOnly);
-        proto->Set(v8::String::New(constant->name), v8::Integer::New(constant->value), v8::ReadOnly);
+        functionDescriptor->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
+        proto->Set(v8::String::New(constant->name), v8Integer(constant->value), v8::ReadOnly);
     }
 }
 
@@ -181,8 +181,8 @@ v8::Handle<v8::Script> V8Proxy::compileScript(v8::Handle<v8::String> code, const
 {
     const uint16_t* fileNameString = fromWebCoreString(fileName);
     v8::Handle<v8::String> name = v8::String::New(fileNameString, fileName.length());
-    v8::Handle<v8::Integer> line = v8::Integer::New(scriptStartPosition.m_line.zeroBasedInt());
-    v8::Handle<v8::Integer> column = v8::Integer::New(scriptStartPosition.m_column.zeroBasedInt());
+    v8::Handle<v8::Integer> line = v8Integer(scriptStartPosition.m_line.zeroBasedInt());
+    v8::Handle<v8::Integer> column = v8Integer(scriptStartPosition.m_column.zeroBasedInt());
     v8::ScriptOrigin origin(name, line, column);
     v8::Handle<v8::Script> script = v8::Script::Compile(code, &origin, scriptData);
     return script;
diff --git a/Source/WebCore/bindings/v8/V8RecursionScope.cpp b/Source/WebCore/bindings/v8/V8RecursionScope.cpp
index 92be720b1..6a09e8e38 100644
--- a/Source/WebCore/bindings/v8/V8RecursionScope.cpp
+++ b/Source/WebCore/bindings/v8/V8RecursionScope.cpp
@@ -32,7 +32,7 @@
 #include "V8RecursionScope.h"
 
 #include "IDBPendingTransactionMonitor.h"
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 
 namespace WebCore {
 
@@ -41,15 +41,14 @@ void V8RecursionScope::didLeaveScriptContext()
     // FIXME: Instrument any work that takes place when script exits to c++ (e.g. Mutation Observers).
 
 #if ENABLE(INDEXED_DATABASE)
-    // If we've just left a script context and indexed database has been
-    // instantiated, we must let its transaction coordinator know so it can terminate
-    // any not-yet-started transactions.
-    IDBPendingTransactionMonitor::abortPendingTransactions();
+    // Indexed DB requires that transactions are created with an internal |active| flag
+    // set to true, but the flag becomes false when control returns to the event loop.
+    IDBPendingTransactionMonitor::deactivateNewTransactions();
 #endif
 
 #if ENABLE(MUTATION_OBSERVERS)
     if (m_isDocumentContext)
-        WebKitMutationObserver::deliverAllMutations();
+        MutationObserver::deliverAllMutations();
 #endif
 }
 
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index 9f923a918..7d9334d0e 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -81,7 +81,7 @@ void createHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value>
     }
 
     v8::Local<v8::Array> cacheArray = v8::Local<v8::Array>::Cast(cache);
-    cacheArray->Set(v8::Integer::New(cacheArray->Length()), value);
+    cacheArray->Set(v8Integer(cacheArray->Length()), value);
 }
 
 bool extractTransferables(v8::Local<v8::Value> value, MessagePortArray& ports, ArrayBufferArray& arrayBuffers)
@@ -153,7 +153,7 @@ void removeHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value>
         return;
     v8::Local<v8::Array> cacheArray = v8::Local<v8::Array>::Cast(cache);
     for (int i = cacheArray->Length() - 1; i >= 0; --i) {
-        v8::Local<v8::Value> cached = cacheArray->Get(v8::Integer::New(i));
+        v8::Local<v8::Value> cached = cacheArray->Get(v8Integer(i));
         if (cached->StrictEquals(value)) {
             cacheArray->Delete(i);
             return;
diff --git a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
index 2379723c8..aef7d1235 100644
--- a/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WindowErrorHandler.cpp
@@ -55,7 +55,7 @@ v8::Local<v8::Value> V8WindowErrorHandler::callListenerFunction(ScriptExecutionC
     if (!listener.IsEmpty() && listener->IsFunction()) {
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
-        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8Integer(errorEvent->lineno()) };
         v8::TryCatch tryCatch;
         tryCatch.SetVerbose(true);
         returnValue = V8Proxy::instrumentedCallFunction(0 /* frame */, callFunction, thisValue, 3, parameters);
diff --git a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
index b9bdecd4b..dd45a84c3 100644
--- a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
@@ -55,7 +55,7 @@ v8::Local<v8::Value> V8WorkerContextErrorHandler::callListenerFunction(ScriptExe
         ErrorEvent* errorEvent = static_cast<ErrorEvent*>(event);
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
-        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8Integer(errorEvent->lineno()) };
         V8RecursionScope recursionScope(context);
         returnValue = callFunction->Call(thisValue, 3, parameters);
     }
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index 1f4848bad..139be5191 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -122,6 +122,10 @@ void WorkerContextExecutionProxy::initIsolate()
     v8::V8::SetGlobalGCPrologueCallback(&V8GCController::gcPrologue);
     v8::V8::SetGlobalGCEpilogueCallback(&V8GCController::gcEpilogue);
 
+    // FIXME: Remove the following 2 lines when V8 default has changed.
+    const char es52GlobalsFlag[] = "--es52_globals";
+    v8::V8::SetFlagsFromString(es52GlobalsFlag, sizeof(es52GlobalsFlag));
+
     v8::ResourceConstraints resource_constraints;
     uint32_t here;
     resource_constraints.set_stack_limit(&here - kWorkerMaxStackSize / sizeof(uint32_t*));
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index cf19e0eec..79c8810fb 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -77,8 +77,8 @@ WorkerScriptController::~WorkerScriptController()
     WebKit::Platform::current()->didStopWorkerRunLoop(WebKit::WebWorkerRunLoop(&m_workerContext->thread()->runLoop()));
 #endif
     m_proxy.clear();
-    m_isolate->Exit();
     V8BindingPerIsolateData::dispose(m_isolate);
+    m_isolate->Exit();
     m_isolate->Dispose();
 }
 
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
index 1860ddc8d..15546e6d6 100755
--- a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -79,7 +79,7 @@ void WorkerScriptDebugServer::addListener(ScriptDebugListener* listener)
     ASSERT(!value->IsUndefined() && value->IsArray());
     v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
     for (unsigned i = 0; i < scriptsArray->Length(); ++i)
-        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
+        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8Integer(i))));
 }
 
 void WorkerScriptDebugServer::removeListener(ScriptDebugListener* listener)
diff --git a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
index 62fc8ecad..af2375f7c 100644
--- a/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp
@@ -174,7 +174,7 @@ v8::Handle<v8::Array> V8CSSStyleDeclaration::namedPropertyEnumerator(const v8::A
     for (unsigned i = 0; i < propertyNamesLength; ++i) {
         String key = propertyNames.at(i);
         ASSERT(!key.isNull());
-        properties->Set(v8::Integer::New(i), v8String(key, info.GetIsolate()));
+        properties->Set(v8Integer(i, info.GetIsolate()), v8String(key, info.GetIsolate()));
     }
 
     return properties;
@@ -185,7 +185,7 @@ v8::Handle<v8::Integer> V8CSSStyleDeclaration::namedPropertyQuery(v8::Local<v8::
     INC_STATS("DOM.CSSStyleDeclaration.NamedPropertyQuery");
 
     if (cssPropertyInfo(v8Name))
-        return v8::Integer::New(v8::None);
+        return v8Integer(0, info.GetIsolate());
 
     return v8::Handle<v8::Integer>();
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index 3063459e7..80030128d 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -57,7 +57,7 @@ v8::Handle<v8::Value> V8Clipboard::typesAccessorGetter(v8::Local<v8::String> nam
     HashSet<String>::const_iterator end = types.end();
     int index = 0;
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it, ++index)
-        result->Set(v8::Integer::New(index), v8String(*it, info.GetIsolate()));
+        result->Set(v8Integer(index, info.GetIsolate()), v8String(*it, info.GetIsolate()));
 
     return result;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index cdbf38581..5d43d4070 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -42,7 +42,7 @@ v8::Handle<v8::Integer> V8DOMStringMap::namedPropertyQuery(v8::Local<v8::String>
 {
     INC_STATS("DOM.DOMStringMap.NamedPropertyQuery");
     if (V8DOMStringMap::toNative(info.Holder())->contains(toWebCoreString(name)))
-        return v8::Integer::New(v8::None);
+        return v8Integer(v8::None, info.GetIsolate());
     return v8::Handle<v8::Integer>();
 }
 
@@ -62,7 +62,7 @@ v8::Handle<v8::Array> V8DOMStringMap::namedPropertyEnumerator(const v8::Accessor
     V8DOMStringMap::toNative(info.Holder())->getNames(names);
     v8::Handle<v8::Array> properties = v8::Array::New(names.size());
     for (size_t i = 0; i < names.size(); ++i)
-        properties->Set(v8::Integer::New(i), v8String(names[i], info.GetIsolate()));
+        properties->Set(v8Integer(i, info.GetIsolate()), v8String(names[i], info.GetIsolate()));
     return properties;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index c0964ad19..0dcc29952 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -131,7 +131,7 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
     } else {
         RefPtr<ScriptCallStack> callStack(createScriptCallStackForInspector());
         if (imp->document() && !imp->document()->contentSecurityPolicy()->allowEval(callStack.release()))
-            return v8::Integer::New(0);
+            return v8Integer(0, args.GetIsolate());
         id = DOMTimer::install(scriptContext, adoptPtr(new ScheduledAction(V8Proxy::context(imp->frame()), functionString)), timeout, singleShot);
     }
 
@@ -142,7 +142,7 @@ v8::Handle<v8::Value> WindowSetTimeoutImpl(const v8::Arguments& args, bool singl
         V8GCForContextDispose::instance().notifyIdleSooner(maximumFireInterval);
     }
 
-    return v8::Integer::New(id);
+    return v8Integer(id, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DOMWindow::eventAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
@@ -520,11 +520,11 @@ v8::Handle<v8::Value> V8DOMWindow::namedPropertyGetter(v8::Local<v8::String> nam
 
     if (doc && doc->isHTMLDocument()) {
         if (static_cast<HTMLDocument*>(doc)->hasNamedItem(propName.impl()) || doc->hasElementWithId(propName.impl())) {
-            HTMLCollection* items = doc->windowNamedItems(propName);
-            if (items->hasAnyItem()) {
+            RefPtr<HTMLCollection> items = doc->windowNamedItems(propName);
+            if (!items->isEmpty()) {
                 if (items->hasExactlyOneItem())
                     return toV8(items->item(0), info.GetIsolate());
-                return toV8(items, info.GetIsolate());
+                return toV8(items.release(), info.GetIsolate());
             }
         }
     }
diff --git a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
index 34110a0b6..bddba9aa0 100755
--- a/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DataViewCustom.cpp
@@ -76,7 +76,7 @@ v8::Handle<v8::Value> V8DataView::getInt8Callback(const v8::Arguments& args)
     int8_t result = imp->getInt8(byteOffset, ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, args.GetIsolate());
-    return v8::Integer::New(result);
+    return v8Integer(result, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DataView::getUint8Callback(const v8::Arguments& args)
@@ -91,7 +91,7 @@ v8::Handle<v8::Value> V8DataView::getUint8Callback(const v8::Arguments& args)
     uint8_t result = imp->getUint8(byteOffset, ec);
     if (UNLIKELY(ec))
         return V8Proxy::setDOMException(ec, args.GetIsolate());
-    return v8::Integer::New(result);
+    return v8Integer(result, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8DataView::setInt8Callback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
index df5331727..31efd0ce2 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLDocumentCustom.cpp
@@ -84,8 +84,8 @@ v8::Handle<v8::Value> V8HTMLDocument::GetNamedProperty(HTMLDocument* htmlDocumen
     if (!htmlDocument->hasNamedItem(key.impl()) && !htmlDocument->hasExtraNamedItem(key.impl()))
         return v8::Handle<v8::Value>();
 
-    HTMLCollection* items = htmlDocument->documentNamedItems(key);
-    if (!items->hasAnyItem())
+    RefPtr<HTMLCollection> items = htmlDocument->documentNamedItems(key);
+    if (items->isEmpty())
         return v8::Handle<v8::Value>();
 
     if (items->hasExactlyOneItem()) {
@@ -97,7 +97,7 @@ v8::Handle<v8::Value> V8HTMLDocument::GetNamedProperty(HTMLDocument* htmlDocumen
         return toV8(node, isolate);
     }
 
-    return toV8(items, isolate);
+    return toV8(items.release(), isolate);
 }
 
 // HTMLDocument ----------------------------------------------------------------
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
index 7a6fff47f..03ead6584 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLInputElementCustom.cpp
@@ -48,7 +48,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::selectionStartAccessorGetter(v8::Local
         return V8Proxy::throwTypeError("Accessing selectionStart on an input element that cannot have a selection.", info.GetIsolate());
 
     int v = imp->selectionStart();
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 void V8HTMLInputElement::selectionStartAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
@@ -74,7 +74,7 @@ v8::Handle<v8::Value> V8HTMLInputElement::selectionEndAccessorGetter(v8::Local<v
         return V8Proxy::throwTypeError("Accessing selectionEnd on an input element that cannot have a selection.", info.GetIsolate());
 
     int v = imp->selectionEnd();
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 void V8HTMLInputElement::selectionEndAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
index 44187c979..61efa44f2 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp
@@ -88,7 +88,7 @@ v8::Handle<v8::Value> V8HTMLOptionsCollection::lengthAccessorGetter(v8::Local<v8
     INC_STATS("DOM.HTMLOptionsCollection.length._get");
     HTMLOptionsCollection* imp = V8HTMLOptionsCollection::toNative(info.Holder());
     int v = imp->length();
-    return v8::Integer::New(v);
+    return v8Integer(v, info.GetIsolate());
 }
 
 void V8HTMLOptionsCollection::lengthAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 9a42dee90..67e8d2d57 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -168,8 +168,8 @@ v8::Handle<v8::Value> V8InjectedScriptHost::functionDetailsCallback(const v8::Ar
     int columnNumber = function->GetScriptColumnNumber();
 
     v8::Local<v8::Object> location = v8::Object::New();
-    location->Set(v8::String::New("lineNumber"), v8::Integer::New(lineNumber));
-    location->Set(v8::String::New("columnNumber"), v8::Integer::New(columnNumber));
+    location->Set(v8::String::New("lineNumber"), v8Integer(lineNumber, args.GetIsolate()));
+    location->Set(v8::String::New("columnNumber"), v8Integer(columnNumber, args.GetIsolate()));
     location->Set(v8::String::New("scriptId"), function->GetScriptId()->ToString());
 
     v8::Local<v8::Object> result = v8::Object::New();
diff --git a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
index 77ba3f266..3d8e8e18e 100644
--- a/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
@@ -101,7 +101,7 @@ v8::Handle<v8::Value> V8MessageEvent::portsAccessorGetter(v8::Local<v8::String>
 
     v8::Local<v8::Array> portArray = v8::Array::New(portsCopy.size());
     for (size_t i = 0; i < portsCopy.size(); ++i)
-        portArray->Set(v8::Integer::New(i), toV8(portsCopy[i].get(), info.GetIsolate()));
+        portArray->Set(v8Integer(i, info.GetIsolate()), toV8(portsCopy[i].get(), info.GetIsolate()));
 
     return portArray;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
index bffbe7400..9280b216c 100644
--- a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
@@ -37,9 +37,9 @@
 #include "ScriptExecutionContext.h"
 #include "V8Binding.h"
 #include "V8CustomVoidCallback.h"
+#include "V8MutationObserver.h"
 #include "V8MutationRecord.h"
 #include "V8Proxy.h"
-#include "V8WebKitMutationObserver.h"
 #include <wtf/Assertions.h>
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
@@ -47,7 +47,7 @@
 
 namespace WebCore {
 
-bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutationObserver* observer)
+bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, MutationObserver* observer)
 {
     ASSERT(mutations);
     if (!mutations)
@@ -66,7 +66,7 @@ bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutat
 
     v8::Local<v8::Array> mutationsArray = v8::Array::New(mutations->size());
     for (size_t i = 0; i < mutations->size(); ++i)
-        mutationsArray->Set(v8::Integer::New(i), toV8(mutations->at(i).get()));
+        mutationsArray->Set(v8Integer(i), toV8(mutations->at(i).get()));
 
     v8::Handle<v8::Value> observerHandle = toV8(observer);
     if (observerHandle.IsEmpty()) {
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
index 7667854b2..a43d6e91d 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebKitMutationObserverCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationObserverCustom.cpp
@@ -32,21 +32,21 @@
 
 #if ENABLE(MUTATION_OBSERVERS)
 
-#include "V8WebKitMutationObserver.h"
+#include "V8MutationObserver.h"
 
+#include "MutationObserver.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
 #include "V8DOMWrapper.h"
 #include "V8MutationCallback.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
-#include "WebKitMutationObserver.h"
 
 namespace WebCore {
 
-v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Arguments& args)
+v8::Handle<v8::Value> V8MutationObserver::constructorCallback(const v8::Arguments& args)
 {
-    INC_STATS("DOM.WebKitMutationObserver.Constructor");
+    INC_STATS("DOM.MutationObserver.Constructor");
 
     if (!args.IsConstructCall())
         return V8Proxy::throwTypeError("DOM object constructor cannot be called as a function.", args.GetIsolate());
@@ -63,10 +63,10 @@ v8::Handle<v8::Value> V8WebKitMutationObserver::constructorCallback(const v8::Ar
 
     ScriptExecutionContext* context = getScriptExecutionContext();
     if (!context)
-        return V8Proxy::throwError(V8Proxy::ReferenceError, "WebKitMutationObserver constructor's associated frame unavailable", args.GetIsolate());
+        return V8Proxy::throwError(V8Proxy::ReferenceError, "MutationObserver constructor's associated frame unavailable", args.GetIsolate());
 
     RefPtr<MutationCallback> callback = V8MutationCallback::create(arg, context);
-    RefPtr<WebKitMutationObserver> observer = WebKitMutationObserver::create(callback.release());
+    RefPtr<MutationObserver> observer = MutationObserver::create(callback.release());
 
     V8DOMWrapper::setDOMWrapper(args.Holder(), &info, observer.get());
     V8DOMWrapper::setJSWrapperForDOMObject(observer.release(), v8::Persistent<v8::Object>::New(args.Holder()));
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
index 656b9d510..9e1be9ade 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeListCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8NodeList.h" 
 
+#include "DynamicNodeList.h"
 #include "NodeList.h"
 #include "V8Binding.h"
 #include "V8Node.h"
@@ -50,7 +51,7 @@ v8::Handle<v8::Value> V8NodeList::namedPropertyGetter(v8::Local<v8::String> name
     // Length property cannot be overridden.
     DEFINE_STATIC_LOCAL(const AtomicString, length, ("length"));
     if (key == length)
-        return v8::Integer::New(list->length());
+        return v8Integer(list->length(), info.GetIsolate());
 
     RefPtr<Node> result = list->itemWithName(key);
     if (!result)
@@ -59,4 +60,19 @@ v8::Handle<v8::Value> V8NodeList::namedPropertyGetter(v8::Local<v8::String> name
     return toV8(result.release(), info.GetIsolate());
 }
 
+void V8NodeList::visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+{
+    NodeList* impl = static_cast<NodeList*>(object);
+    if (impl->isDynamicNodeList()) {
+        Node* owner = static_cast<DynamicNodeList*>(impl)->ownerNode();
+        if (owner) {
+            v8::Persistent<v8::Object> ownerWrapper = store->domNodeMap().get(owner);
+            if (!ownerWrapper.IsEmpty()) {
+                v8::Persistent<v8::Value> value = wrapper;
+                v8::V8::AddImplicitReferences(ownerWrapper, &value, 1);
+            }
+        }
+    }
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
index 71c4f3bd3..e79f937d6 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
@@ -73,7 +73,7 @@ v8::Handle<v8::Value> V8SQLTransaction::executeSqlCallback(const v8::Arguments&
             sqlArgsLength = length->Uint32Value();
 
         for (unsigned int i = 0; i < sqlArgsLength; ++i) {
-            v8::Local<v8::Integer> key = v8::Integer::New(i);
+            v8::Handle<v8::Integer> key = v8Integer(i, args.GetIsolate());
             EXCEPTION_BLOCK(v8::Local<v8::Value>, value, sqlArgsObject->Get(key));
 
             if (value.IsEmpty() || value->IsNull())
diff --git a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
index 707b0d8b6..622937d6a 100644
--- a/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
@@ -73,7 +73,7 @@ v8::Handle<v8::Value> V8SQLTransactionSync::executeSqlCallback(const v8::Argumen
             sqlArgsLength = length->Uint32Value();
 
         for (unsigned int i = 0; i < sqlArgsLength; ++i) {
-            v8::Local<v8::Integer> key = v8::Integer::New(i);
+            v8::Handle<v8::Integer> key = v8Integer(i, args.GetIsolate());
             EXCEPTION_BLOCK(v8::Local<v8::Value>, value, sqlArgsObject->Get(key));
 
             if (value.IsEmpty() || value->IsNull())
diff --git a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
index 1bdadb5d9..89396a30c 100644
--- a/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8StorageCustom.cpp
@@ -47,7 +47,7 @@ v8::Handle<v8::Array> V8Storage::namedPropertyEnumerator(const v8::AccessorInfo&
         String key = storage->key(i);
         ASSERT(!key.isNull());
         String val = storage->getItem(key);
-        properties->Set(v8::Integer::New(i), v8String(key, info.GetIsolate()));
+        properties->Set(v8Integer(i, info.GetIsolate()), v8String(key, info.GetIsolate()));
     }
 
     return properties;
@@ -67,7 +67,7 @@ static v8::Handle<v8::Value> storageGetter(v8::Local<v8::String> v8Name, const v
 v8::Handle<v8::Value> V8Storage::indexedPropertyGetter(uint32_t index, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Storage.IndexedPropertyGetter");
-    v8::Local<v8::Integer> indexV8 = v8::Integer::New(index);
+    v8::Handle<v8::Integer> indexV8 = v8Integer(index, info.GetIsolate());
     return storageGetter(indexV8->ToString(), info);
 }
 
@@ -87,7 +87,7 @@ v8::Handle<v8::Integer> V8Storage::namedPropertyQuery(v8::Local<v8::String> v8Na
     String name = toWebCoreString(v8Name);
 
     if (name != "length" && storage->contains(name))
-        return v8::Integer::New(v8::None);
+        return v8Integer(0, info.GetIsolate());
 
     return v8::Handle<v8::Integer>();
 }
@@ -116,7 +116,7 @@ static v8::Handle<v8::Value> storageSetter(v8::Local<v8::String> v8Name, v8::Loc
 v8::Handle<v8::Value> V8Storage::indexedPropertySetter(uint32_t index, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Storage.NamedPropertyGetter");
-    v8::Local<v8::Integer> indexV8 = v8::Integer::New(index);
+    v8::Handle<v8::Integer> indexV8 = v8Integer(index, info.GetIsolate());
     return storageSetter(indexV8->ToString(), value, info);
 }
 
@@ -142,7 +142,7 @@ static v8::Handle<v8::Boolean> storageDeleter(v8::Local<v8::String> v8Name, cons
 v8::Handle<v8::Boolean> V8Storage::indexedPropertyDeleter(uint32_t index, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.Storage.IndexedPropertyDeleter");
-    v8::Local<v8::Integer> indexV8 = v8::Integer::New(index);
+    v8::Handle<v8::Integer> indexV8 = v8Integer(index, info.GetIsolate());
     return storageDeleter(indexV8->ToString(), info);
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 5059ddf0a..5904ec2fa 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -125,19 +125,19 @@ static v8::Handle<v8::Value> toV8Object(const WebGLGetInfo& info, v8::Isolate* i
         const Vector<bool>& value = info.getBoolArray();
         v8::Local<v8::Array> array = v8::Array::New(value.size());
         for (size_t ii = 0; ii < value.size(); ++ii)
-            array->Set(v8::Integer::New(ii), v8::Boolean::New(value[ii]));
+            array->Set(v8Integer(ii, isolate), v8::Boolean::New(value[ii]));
         return array;
     }
     case WebGLGetInfo::kTypeFloat:
         return v8::Number::New(info.getFloat());
     case WebGLGetInfo::kTypeInt:
-        return v8::Integer::New(info.getInt());
+        return v8Integer(info.getInt(), isolate);
     case WebGLGetInfo::kTypeNull:
         return v8::Null(isolate);
     case WebGLGetInfo::kTypeString:
         return v8::String::New(fromWebCoreString(info.getString()), info.getString().length());
     case WebGLGetInfo::kTypeUnsignedInt:
-        return v8::Integer::NewFromUnsigned(info.getUnsignedInt());
+        return v8UnsignedInteger(info.getUnsignedInt(), isolate);
     case WebGLGetInfo::kTypeWebGLBuffer:
         return toV8(info.getWebGLBuffer(), isolate);
     case WebGLGetInfo::kTypeWebGLFloatArray:
@@ -289,7 +289,7 @@ v8::Handle<v8::Value> V8WebGLRenderingContext::getAttachedShadersCallback(const
         return v8::Null(args.GetIsolate());
     v8::Local<v8::Array> array = v8::Array::New(shaders.size());
     for (size_t ii = 0; ii < shaders.size(); ++ii)
-        array->Set(v8::Integer::New(ii), toV8(shaders[ii].get(), args.GetIsolate()));
+        array->Set(v8Integer(ii, args.GetIsolate()), toV8(shaders[ii].get(), args.GetIsolate()));
     return array;
 }
 
@@ -398,7 +398,7 @@ v8::Handle<v8::Value> V8WebGLRenderingContext::getSupportedExtensionsCallback(co
     Vector<String> value = imp->getSupportedExtensions();
     v8::Local<v8::Array> array = v8::Array::New(value.size());
     for (size_t ii = 0; ii < value.size(); ++ii)
-        array->Set(v8::Integer::New(ii), v8::String::New(fromWebCoreString(value[ii]), value[ii].length()));
+        array->Set(v8Integer(ii, args.GetIsolate()), v8::String::New(fromWebCoreString(value[ii]), value[ii].length()));
     return array;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index 17c9f1bbf..7e27f6c05 100644
--- a/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -83,7 +83,7 @@ v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singl
     } else
         return v8::Undefined();
 
-    return v8::Integer::New(timerId);
+    return v8Integer(timerId, args.GetIsolate());
 }
 
 v8::Handle<v8::Value> V8WorkerContext::importScriptsCallback(const v8::Arguments& args)
diff --git a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 8b429f8a4..5e64fc2d3 100644
--- a/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -36,6 +36,7 @@
 #include "Frame.h"
 #include "InspectorInstrumentation.h"
 #include "V8ArrayBuffer.h"
+#include "V8ArrayBufferView.h"
 #include "V8Binding.h"
 #include "V8Blob.h"
 #include "V8DOMFormData.h"
@@ -188,6 +189,11 @@ v8::Handle<v8::Value> V8XMLHttpRequest::sendCallback(const v8::Arguments& args)
             ArrayBuffer* arrayBuffer = V8ArrayBuffer::toNative(object);
             ASSERT(arrayBuffer);
             xmlHttpRequest->send(arrayBuffer, ec);
+        } else if (V8ArrayBufferView::HasInstance(arg)) {
+            v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
+            ArrayBufferView* arrayBufferView = V8ArrayBufferView::toNative(object);
+            ASSERT(arrayBufferView);
+            xmlHttpRequest->send(arrayBufferView, ec);
 #endif
         } else
             xmlHttpRequest->send(toWebCoreStringWithNullCheck(arg), ec);
diff --git a/Source/WebCore/bridge/NP_jsobject.cpp b/Source/WebCore/bridge/NP_jsobject.cpp
index aef97f0c5..61e367956 100644
--- a/Source/WebCore/bridge/NP_jsobject.cpp
+++ b/Source/WebCore/bridge/NP_jsobject.cpp
@@ -177,7 +177,7 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
             return false;
         
         ExecState* exec = rootObject->globalObject()->globalExec();
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         
         // Call the function object.
         JSValue function = obj->imp;
@@ -225,7 +225,7 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
         if (!rootObject || !rootObject->isValid())
             return false;
         ExecState* exec = rootObject->globalObject()->globalExec();
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         JSValue function = obj->imp->get(exec, identifierFromNPIdentifier(exec, i->string()));
         CallData callData;
         CallType callType = getCallData(function, callData);
@@ -264,7 +264,7 @@ bool _NPN_Evaluate(NPP instance, NPObject* o, NPString* s, NPVariant* variant)
         PluginView::keepAlive(instance);
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         String scriptString = convertNPStringToUTF16(s);
         
         JSValue returnValue = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(scriptString), JSC::JSValue());
@@ -290,7 +290,7 @@ bool _NPN_GetProperty(NPP, NPObject* o, NPIdentifier propertyName, NPVariant* va
         ExecState* exec = rootObject->globalObject()->globalExec();
         IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
         
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         JSValue result;
         if (i->isString())
             result = obj->imp->get(exec, identifierFromNPIdentifier(exec, i->string()));
@@ -322,7 +322,7 @@ bool _NPN_SetProperty(NPP, NPObject* o, NPIdentifier propertyName, const NPVaria
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
 
         if (i->isString()) {
@@ -363,7 +363,7 @@ bool _NPN_RemoveProperty(NPP, NPObject* o, NPIdentifier propertyName)
             }
         }
 
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         if (i->isString())
             obj->imp->methodTable()->deleteProperty(obj->imp, exec, identifierFromNPIdentifier(exec, i->string()));
         else
@@ -386,7 +386,7 @@ bool _NPN_HasProperty(NPP, NPObject* o, NPIdentifier propertyName)
 
         ExecState* exec = rootObject->globalObject()->globalExec();
         IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         if (i->isString()) {
             bool result = obj->imp->hasProperty(exec, identifierFromNPIdentifier(exec, i->string()));
             exec->clearException();
@@ -418,7 +418,7 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         JSValue func = obj->imp->get(exec, identifierFromNPIdentifier(exec, i->string()));
         exec->clearException();
         return !func.isUndefined();
@@ -447,7 +447,7 @@ bool _NPN_Enumerate(NPP, NPObject* o, NPIdentifier** identifier, uint32_t* count
             return false;
         
         ExecState* exec = rootObject->globalObject()->globalExec();
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         PropertyNameArray propertyNames(exec);
 
         obj->imp->methodTable()->getPropertyNames(obj->imp, exec, propertyNames, ExcludeDontEnumProperties);
@@ -484,7 +484,7 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
             return false;
         
         ExecState* exec = rootObject->globalObject()->globalExec();
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         
         // Call the constructor object.
         JSValue constructor = obj->imp;
diff --git a/Source/WebCore/bridge/c/c_class.cpp b/Source/WebCore/bridge/c/c_class.cpp
index efd7f4ed1..cfc026b28 100644
--- a/Source/WebCore/bridge/c/c_class.cpp
+++ b/Source/WebCore/bridge/c/c_class.cpp
@@ -34,7 +34,7 @@
 #include "npruntime_impl.h"
 #include <runtime/ScopeChain.h>
 #include <runtime/Identifier.h>
-#include <runtime/JSLock.h>
+#include <runtime/JSGlobalObject.h>
 #include <runtime/JSObject.h>
 #include <wtf/text/StringHash.h>
 
@@ -47,8 +47,6 @@ CClass::CClass(NPClass* aClass)
 
 CClass::~CClass()
 {
-    JSLock lock(SilenceAssertionsOnly);
-
     deleteAllValues(_methods);
     _methods.clear();
 
@@ -90,10 +88,7 @@ MethodList CClass::methodsNamed(PropertyName propertyName, Instance* instance) c
     NPObject* obj = inst->getObject();
     if (_isa->hasMethod && _isa->hasMethod(obj, ident)){
         Method* aMethod = new CMethod(ident); // deleted in the CClass destructor
-        {
-            JSLock lock(SilenceAssertionsOnly);
-            _methods.set(name.impl(), aMethod);
-        }
+        _methods.set(name.impl(), aMethod);
         methodList.append(aMethod);
     }
     
@@ -113,10 +108,7 @@ Field* CClass::fieldNamed(PropertyName propertyName, Instance* instance) const
     NPObject* obj = inst->getObject();
     if (_isa->hasProperty && _isa->hasProperty(obj, ident)){
         aField = new CField(ident); // deleted in the CClass destructor
-        {
-            JSLock lock(SilenceAssertionsOnly);
-            _fields.set(name.impl(), aField);
-        }
+        _fields.set(name.impl(), aField);
     }
     return aField;
 }
diff --git a/Source/WebCore/bridge/c/c_instance.cpp b/Source/WebCore/bridge/c/c_instance.cpp
index fad386c89..5b98f6ee1 100644
--- a/Source/WebCore/bridge/c/c_instance.cpp
+++ b/Source/WebCore/bridge/c/c_instance.cpp
@@ -73,7 +73,7 @@ void CInstance::moveGlobalExceptionToExecState(ExecState* exec)
         return;
 
     {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         throwError(exec, createError(exec, globalExceptionString()));
     }
 
@@ -182,7 +182,7 @@ JSValue CInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
     VOID_TO_NPVARIANT(resultVariant);
 
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(exec);
         ASSERT(globalExceptionString().isNull());
         retval = _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
@@ -217,7 +217,7 @@ JSValue CInstance::invokeDefaultMethod(ExecState* exec)
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(exec);
         ASSERT(globalExceptionString().isNull());
         retval = _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
@@ -256,7 +256,7 @@ JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(exec);
         ASSERT(globalExceptionString().isNull());
         retval = _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
         moveGlobalExceptionToExecState(exec);
@@ -315,7 +315,7 @@ void CInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArray)
     NPIdentifier* identifiers;
 
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(exec);
         ASSERT(globalExceptionString().isNull());
         bool ok = _object->_class->enumerate(_object, &identifiers, &count);
         moveGlobalExceptionToExecState(exec);
diff --git a/Source/WebCore/bridge/c/c_runtime.cpp b/Source/WebCore/bridge/c/c_runtime.cpp
index a84acbbe3..a92cfe553 100644
--- a/Source/WebCore/bridge/c/c_runtime.cpp
+++ b/Source/WebCore/bridge/c/c_runtime.cpp
@@ -49,7 +49,7 @@ JSValue CField::valueFromInstance(ExecState* exec, const Instance* inst) const
 
         bool result;
         {
-            JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+            JSLock::DropAllLocks dropAllLocks(exec);
             result = obj->_class->getProperty(obj, _fieldIdentifier, &property);
             CInstance::moveGlobalExceptionToExecState(exec);
         }
@@ -71,7 +71,7 @@ void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValue a
         convertValueToNPVariant(exec, aValue, &variant);
 
         {
-            JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+            JSLock::DropAllLocks dropAllLocks(exec);
             obj->_class->setProperty(obj, _fieldIdentifier, &variant);
             CInstance::moveGlobalExceptionToExecState(exec);
         }
diff --git a/Source/WebCore/bridge/c/c_utility.cpp b/Source/WebCore/bridge/c/c_utility.cpp
index 8a70b2779..dc3755f27 100644
--- a/Source/WebCore/bridge/c/c_utility.cpp
+++ b/Source/WebCore/bridge/c/c_utility.cpp
@@ -68,7 +68,7 @@ static String convertUTF8ToUTF16WithLatin1Fallback(const NPUTF8* UTF8Chars, int
 // Variant value must be released with NPReleaseVariantValue()
 void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     VOID_TO_NPVARIANT(*result);
 
@@ -107,7 +107,7 @@ void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)
 
 JSValue convertNPVariantToValue(ExecState* exec, const NPVariant* variant, RootObject* rootObject)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     
     NPVariantType type = variant->type;
 
diff --git a/Source/WebCore/bridge/jni/jni_jsobject.mm b/Source/WebCore/bridge/jni/jni_jsobject.mm
index 9d4513423..98f3aebdd 100644
--- a/Source/WebCore/bridge/jni/jni_jsobject.mm
+++ b/Source/WebCore/bridge/jni/jni_jsobject.mm
@@ -284,7 +284,7 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     
     // Lookup the function object.
     ExecState* exec = rootObject->globalObject()->globalExec();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     
     Identifier identifier(exec, JavaString(methodName).impl());
     JSValue function = _imp->get(exec, identifier);
@@ -307,12 +307,12 @@ jobject JavaJSObject::eval(jstring script) const
 {
     LOG(LiveConnect, "JavaJSObject::eval script = %s", JavaString(script).utf8());
 
-    JSLock lock(SilenceAssertionsOnly);
-    
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
         return 0;
 
+    JSLockHolder lock(rootObject->globalObject()->globalData());
+    
     rootObject->globalObject()->globalData().timeoutChecker.start();
     JSValue result = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script).impl()));
     rootObject->globalObject()->globalData().timeoutChecker.stop();
@@ -330,7 +330,7 @@ jobject JavaJSObject::getMember(jstring memberName) const
 
     ExecState* exec = rootObject->globalObject()->globalExec();
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue result = _imp->get(exec, Identifier(exec, JavaString(memberName).impl()));
 
     return convertValueToJObject(result);
@@ -346,7 +346,7 @@ void JavaJSObject::setMember(jstring memberName, jobject value) const
 
     ExecState* exec = rootObject->globalObject()->globalExec();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     PutPropertySlot slot;
     _imp->methodTable()->put(_imp, exec, Identifier(exec, JavaString(memberName).impl()), convertJObjectToValue(exec, value), slot);
 }
@@ -361,7 +361,7 @@ void JavaJSObject::removeMember(jstring memberName) const
         return;
 
     ExecState* exec = rootObject->globalObject()->globalExec();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     _imp->methodTable()->deleteProperty(_imp, exec, Identifier(exec, JavaString(memberName).impl()));
 }
 
@@ -376,7 +376,7 @@ jobject JavaJSObject::getSlot(jint index) const
 
     ExecState* exec = rootObject->globalObject()->globalExec();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue result = _imp->get(exec, index);
 
     return convertValueToJObject(result);
@@ -392,7 +392,7 @@ void JavaJSObject::setSlot(jint index, jobject value) const
         return;
 
     ExecState* exec = rootObject->globalObject()->globalExec();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     _imp->methodTable()->putByIndex(_imp, exec, (unsigned)index, convertJObjectToValue(exec, value), false);
 }
 
@@ -405,9 +405,9 @@ jstring JavaJSObject::toString() const
     if (!rootObject)
         return 0;
 
-    JSLock lock(SilenceAssertionsOnly);
     JSObject *thisObj = const_cast<JSObject*>(_imp);
     ExecState* exec = rootObject->globalObject()->globalExec();
+    JSLockHolder lock(exec);
     
     return static_cast<jstring>(convertValueToJValue(exec, rootObject, thisObj, JavaTypeObject, "java.lang.String").l);
 }
@@ -463,13 +463,13 @@ jlong JavaJSObject::createNative(jlong nativeHandle)
 
 jobject JavaJSObject::convertValueToJObject(JSValue value) const
 {
-    JSLock lock(SilenceAssertionsOnly);
-    
     RootObject* rootObject = this->rootObject();
     if (!rootObject)
         return 0;
 
+    
     ExecState* exec = rootObject->globalObject()->globalExec();
+    JSLockHolder lock(exec);
     JNIEnv *env = getJNIEnv();
     jobject result = 0;
     
@@ -554,7 +554,7 @@ JSValue JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject)
     // figure 22-4.
     jobject classOfInstance = callJNIMethod<jobject>(theObject, "getClass", "()Ljava/lang/Class;");
     if (!classOfInstance) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
     }
 
@@ -563,7 +563,7 @@ JSValue JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject)
     // pointer and stores it in this object, so that it can be retrieved below.
     jstring className = (jstring)callJNIMethod<jobject>(classOfInstance, "getName", "()Ljava/lang/String;");
     if (!className || (strcmp(JavaString(className).utf8(), "sun.plugin.javascript.webkit.JSObject") != 0)) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
     }
 
diff --git a/Source/WebCore/bridge/jni/jni_objc.mm b/Source/WebCore/bridge/jni/jni_objc.mm
index 9c943e828..6ae1ae565 100644
--- a/Source/WebCore/bridge/jni/jni_objc.mm
+++ b/Source/WebCore/bridge/jni/jni_objc.mm
@@ -62,7 +62,7 @@ bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletVie
         // implemented in WebCore will guarantee that only appropriate JavaScript
         // can reference the applet.
         {
-           JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+           JSLock::DropAllLocks dropAllLocks(exec);
             result = [view webPlugInCallJava:obj isStatic:isStatic returnType:returnType method:methodID arguments:args callingURL:nil exceptionDescription:&_exceptionDescription];
         }
 
@@ -72,7 +72,7 @@ bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletVie
         return true;
     }
     else if ([view respondsToSelector:@selector(webPlugInCallJava:method:returnType:arguments:)]) {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(exec);
         result = [view webPlugInCallJava:obj method:methodID returnType:returnType arguments:args];
         return true;
     }
diff --git a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
index 9872da8f5..a3b2c2e7d 100644
--- a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
@@ -174,7 +174,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
 
 jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue value, JavaType javaType, const char* javaClassName)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     jvalue result;
     memset(&result, 0, sizeof(jvalue));
diff --git a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
index 08ec6e661..aeb4020bd 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
@@ -63,7 +63,7 @@ JavaClass::JavaClass(jobject anInstance)
             jobject aJField = env->GetObjectArrayElement((jobjectArray)fields, i);
             JavaField* aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
             {
-                JSLock lock(SilenceAssertionsOnly);
+                // FIXME: Should we acquire a JSLock here?
                 m_fields.set(aField->name().impl(), aField);
             }
             env->DeleteLocalRef(aJField);
@@ -79,7 +79,7 @@ JavaClass::JavaClass(jobject anInstance)
             JavaMethod* aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
             MethodList* methodList;
             {
-                JSLock lock(SilenceAssertionsOnly);
+                // FIXME: Should we acquire a JSLock here?
 
                 methodList = m_methods.get(aMethod->name().impl());
                 if (!methodList) {
@@ -100,7 +100,7 @@ JavaClass::~JavaClass()
 {
     fastFree(const_cast<char*>(m_name));
 
-    JSLock lock(SilenceAssertionsOnly);
+    // FIXME: Should we acquire a JSLock here?
 
     deleteAllValues(m_fields);
     m_fields.clear();
diff --git a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
index 7d2b02fbe..15dffa5ad 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
@@ -87,7 +87,7 @@ Class* JavaInstance::getClass() const
 
 JSValue JavaInstance::stringValue(ExecState* exec) const
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     jstring stringValue = (jstring)callJNIMethod<jobject>(m_instance->instance(), "toString", "()Ljava/lang/String;");
 
diff --git a/Source/WebCore/bridge/jni/jsc/JavaMethodJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaMethodJSC.cpp
index 5e18ea8ba..0d2b6e563 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaMethodJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaMethodJSC.cpp
@@ -92,7 +92,7 @@ JavaMethod::~JavaMethod()
 // we get '.' between components from the reflection API.
 static void appendClassName(StringBuilder& builder, const char* className)
 {
-    ASSERT(JSLock::lockCount() > 0);
+    ASSERT(JSC::JSGlobalData::sharedInstance().apiLock().currentThreadIsHoldingLock());
 
     char* c = fastStrDup(className);
 
@@ -111,7 +111,7 @@ static void appendClassName(StringBuilder& builder, const char* className)
 const char* JavaMethod::signature() const
 {
     if (!m_signature) {
-        JSLock lock(SilenceAssertionsOnly);
+        // FIXME: Should we acquire a JSLock here?
 
         StringBuilder signatureBuilder;
         signatureBuilder.append('(');
diff --git a/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h b/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
index 0f8b779c0..1e1803aa1 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
@@ -28,6 +28,7 @@
 #define JavaStringJSC_h
 
 #include "JNIUtility.h"
+#include "JSDOMWindowBase.h"
 #include "JavaInstanceJSC.h"
 
 #include <runtime/JSLock.h>
@@ -52,20 +53,20 @@ public:
 
     JavaString()
     {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(WebCore::JSDOMWindowBase::commonJSGlobalData());
         m_impl = UString().impl();
     }
 
     ~JavaString()
     {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(WebCore::JSDOMWindowBase::commonJSGlobalData());
         m_impl = 0;
     }
 
     const char* utf8() const
     {
         if (!m_utf8String.data()) {
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(WebCore::JSDOMWindowBase::commonJSGlobalData());
             m_utf8String = UString(m_impl).utf8();
         }
         return m_utf8String.data();
@@ -79,7 +80,7 @@ private:
         int size = e->GetStringLength(s);
         const jchar* uc = getUCharactersFromJStringInEnv(e, s);
         {
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(WebCore::JSDOMWindowBase::commonJSGlobalData());
             m_impl = UString(reinterpret_cast<const UChar*>(uc), size).impl();
         }
         releaseUCharactersForJStringInEnv(e, s, uc);
diff --git a/Source/WebCore/bridge/jsc/BridgeJSC.cpp b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
index 6b81a9bc8..4cc80034e 100644
--- a/Source/WebCore/bridge/jsc/BridgeJSC.cpp
+++ b/Source/WebCore/bridge/jsc/BridgeJSC.cpp
@@ -92,7 +92,7 @@ JSObject* Instance::createRuntimeObject(ExecState* exec)
     if (RuntimeObject* existingObject = m_runtimeObject.get())
         return existingObject;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     RuntimeObject* newObject = newRuntimeObject(exec);
     m_runtimeObject = PassWeak<RuntimeObject>(newObject);
     m_rootObject->addRuntimeObject(exec->globalData(), newObject);
@@ -101,7 +101,7 @@ JSObject* Instance::createRuntimeObject(ExecState* exec)
 
 RuntimeObject* Instance::newRuntimeObject(ExecState* exec)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "i".
diff --git a/Source/WebCore/bridge/objc/objc_instance.mm b/Source/WebCore/bridge/objc/objc_instance.mm
index 88c359e20..8a97b7de8 100644
--- a/Source/WebCore/bridge/objc/objc_instance.mm
+++ b/Source/WebCore/bridge/objc/objc_instance.mm
@@ -92,7 +92,7 @@ void ObjcInstance::moveGlobalExceptionToExecState(ExecState* exec)
     }
 
     if (!s_exceptionEnvironment || s_exceptionEnvironment == exec->dynamicGlobalObject()) {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         throwError(exec, s_exception);
     }
 
@@ -239,7 +239,7 @@ JSValue ObjcInstance::invokeObjcMethod(ExecState* exec, ObjcMethod* method)
 {
     JSValue result = jsUndefined();
     
-    JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly); // Can't put this inside the @try scope because it unwinds incorrectly.
+    JSLock::DropAllLocks dropAllLocks(exec); // Can't put this inside the @try scope because it unwinds incorrectly.
 
     setGlobalException(nil);
     
@@ -354,7 +354,7 @@ JSValue ObjcInstance::invokeDefaultMethod(ExecState* exec)
 {
     JSValue result = jsUndefined();
 
-    JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly); // Can't put this inside the @try scope because it unwinds incorrectly.
+    JSLock::DropAllLocks dropAllLocks(exec); // Can't put this inside the @try scope because it unwinds incorrectly.
     setGlobalException(nil);
     
 @try {
@@ -411,7 +411,7 @@ bool ObjcInstance::setValueOfUndefinedField(ExecState* exec, PropertyName proper
     if (![targetObject respondsToSelector:@selector(setValue:forUndefinedKey:)])
         return false;
 
-    JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly); // Can't put this inside the @try scope because it unwinds incorrectly.
+    JSLock::DropAllLocks dropAllLocks(exec); // Can't put this inside the @try scope because it unwinds incorrectly.
 
     // This check is not really necessary because NSObject implements
     // setValue:forUndefinedKey:, and unfortunately the default implementation
@@ -443,7 +443,7 @@ JSValue ObjcInstance::getValueOfUndefinedField(ExecState* exec, PropertyName pro
     
     id targetObject = getObject();
 
-    JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly); // Can't put this inside the @try scope because it unwinds incorrectly.
+    JSLock::DropAllLocks dropAllLocks(exec); // Can't put this inside the @try scope because it unwinds incorrectly.
 
     // This check is not really necessary because NSObject implements
     // valueForUndefinedKey:, and unfortunately the default implementation
diff --git a/Source/WebCore/bridge/objc/objc_runtime.mm b/Source/WebCore/bridge/objc/objc_runtime.mm
index 3fa799417..335668ec6 100644
--- a/Source/WebCore/bridge/objc/objc_runtime.mm
+++ b/Source/WebCore/bridge/objc/objc_runtime.mm
@@ -92,19 +92,18 @@ JSValue ObjcField::valueFromInstance(ExecState* exec, const Instance* instance)
     
     id targetObject = (static_cast<const ObjcInstance*>(instance))->getObject();
 
-    JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly); // Can't put this inside the @try scope because it unwinds incorrectly.
+    JSLock::DropAllLocks dropAllLocks(exec); // Can't put this inside the @try scope because it unwinds incorrectly.
 
     @try {
         if (id objcValue = [targetObject valueForKey:(NSString *)_name.get()])
             result = convertObjcValueToValue(exec, &objcValue, ObjcObjectType, instance->rootObject());
         {
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(exec);
             ObjcInstance::moveGlobalExceptionToExecState(exec);
         }
     } @catch(NSException* localException) {
-        JSLock::lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         throwError(exec, [localException reason]);
-        JSLock::unlock(SilenceAssertionsOnly);
     }
 
     // Work around problem in some versions of GCC where result gets marked volatile and
@@ -125,18 +124,17 @@ void ObjcField::setValueToInstance(ExecState* exec, const Instance* instance, JS
     id targetObject = (static_cast<const ObjcInstance*>(instance))->getObject();
     id value = convertValueToObjcObject(exec, aValue);
 
-    JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly); // Can't put this inside the @try scope because it unwinds incorrectly.
+    JSLock::DropAllLocks dropAllLocks(exec); // Can't put this inside the @try scope because it unwinds incorrectly.
 
     @try {
         [targetObject setValue:value forKey:(NSString *)_name.get()];
         {
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(exec);
             ObjcInstance::moveGlobalExceptionToExecState(exec);
         }
     } @catch(NSException* localException) {
-        JSLock::lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         throwError(exec, [localException reason]);
-        JSLock::unlock(SilenceAssertionsOnly);
     }
 }
 
diff --git a/Source/WebCore/bridge/objc/objc_utility.mm b/Source/WebCore/bridge/objc/objc_utility.mm
index 999f73217..b62e3df60 100644
--- a/Source/WebCore/bridge/objc/objc_utility.mm
+++ b/Source/WebCore/bridge/objc/objc_utility.mm
@@ -86,7 +86,7 @@ ObjcValue convertValueToObjcValue(ExecState* exec, JSValue value, ObjcValueType
 
     switch (type) {
         case ObjcObjectType: {
-            JSLock lock(SilenceAssertionsOnly);
+            JSLockHolder lock(exec);
             
             JSGlobalObject *originGlobalObject = exec->dynamicGlobalObject();
             RootObject* originRootObject = findRootObject(originGlobalObject);
@@ -146,7 +146,7 @@ ObjcValue convertValueToObjcValue(ExecState* exec, JSValue value, ObjcValueType
 
 JSValue convertNSStringToString(ExecState* exec, NSString *nsstring)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     
     unichar *chars;
     unsigned int length = [nsstring length];
@@ -178,7 +178,7 @@ JSValue convertNSStringToString(ExecState* exec, NSString *nsstring)
 */
 JSValue convertObjcValueToValue(ExecState* exec, void* buffer, ObjcValueType type, RootObject* rootObject)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     
     switch (type) {
         case ObjcObjectType: {
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index e1fedc8b2..6b5e6a75a 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -22,6 +22,7 @@
 
 #include "Error.h"
 #include "JSDOMBinding.h"
+#include "JSDOMWindowBase.h"
 #include "JSGlobalObject.h"
 #include "JSLock.h"
 #include "ObjectPrototype.h"
@@ -92,7 +93,7 @@ QtInstance::QtInstance(QObject* o, PassRefPtr<RootObject> rootObject, ValueOwner
 
 QtInstance::~QtInstance()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(WebCore::JSDOMWindowBase::commonJSGlobalData());
 
     cachedInstances.remove(m_hashkey);
 
@@ -119,7 +120,7 @@ QtInstance::~QtInstance()
 
 PassRefPtr<QtInstance> QtInstance::getQtInstance(QObject* o, PassRefPtr<RootObject> rootObject, ValueOwnership ownership)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(WebCore::JSDOMWindowBase::commonJSGlobalData());
 
     foreach (QtInstance* instance, cachedInstances.values(o))
         if (instance->rootObject() == rootObject) {
@@ -180,7 +181,7 @@ Class* QtInstance::getClass() const
 
 RuntimeObject* QtInstance::newRuntimeObject(ExecState* exec)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     m_methods.clear();
     return QtRuntimeObject::create(exec, exec->lexicalGlobalObject(), this);
 }
diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
index c00fb4945..b0e5f62f9 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -420,7 +420,7 @@ RuntimeObject* QtPixmapInstance::newRuntimeObject(ExecState* exec)
 
 JSObject* QtPixmapInstance::createPixmapRuntimeObject(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& data)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     RefPtr<QtPixmapInstance> instance = adoptRef(new QtPixmapInstance(root, data));
     return instance->createRuntimeObject(exec);
 }
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 11e2e9c0d..040d51fcb 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -230,7 +230,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
         return QVariant();
     }
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSRealType type = valueRealType(exec, value);
     if (hint == QMetaType::Void) {
         switch(type) {
@@ -824,7 +824,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         return jsNull();
     }
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     if (type == QMetaType::Bool)
         return jsBoolean(variant.toBool());
@@ -1420,7 +1420,7 @@ EncodedJSValue QtRuntimeMetaMethod::call(ExecState* exec)
         return JSValue::encode(jsUndefined());
 
     // We have to pick a method that matches..
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     QObject *obj = d->m_instance->getObject();
     if (obj) {
@@ -1561,7 +1561,7 @@ EncodedJSValue QtRuntimeConnectionMethod::call(ExecState* exec)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(exec->callee())->d_func();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     QObject* sender = d->m_instance->getObject();
 
diff --git a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp b/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
index 73595f054..9682f14ec 100644
--- a/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime_qt4.cpp
@@ -230,7 +230,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type
         return QVariant();
     }
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSRealType type = valueRealType(exec, value);
     if (hint == QMetaType::Void) {
         switch(type) {
@@ -824,7 +824,7 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         return jsNull();
     }
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     if (type == QMetaType::Bool)
         return jsBoolean(variant.toBool());
@@ -1429,7 +1429,7 @@ EncodedJSValue QtRuntimeMetaMethod::call(ExecState* exec)
         return JSValue::encode(jsUndefined());
 
     // We have to pick a method that matches..
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     QObject *obj = d->m_instance->getObject();
     if (obj) {
@@ -1570,7 +1570,7 @@ EncodedJSValue QtRuntimeConnectionMethod::call(ExecState* exec)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(exec->callee())->d_func();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     QObject* sender = d->m_instance->getObject();
 
diff --git a/Source/WebCore/bridge/runtime_root.cpp b/Source/WebCore/bridge/runtime_root.cpp
index 58b078856..9b6224a8b 100644
--- a/Source/WebCore/bridge/runtime_root.cpp
+++ b/Source/WebCore/bridge/runtime_root.cpp
@@ -139,8 +139,10 @@ void RootObject::gcProtect(JSObject* jsObject)
 {
     ASSERT(m_isValid);
     
-    if (!m_protectCountSet.contains(jsObject))
+    if (!m_protectCountSet.contains(jsObject)) {
+        JSC::JSLockHolder holder(&globalObject()->globalData());
         JSC::gcProtect(jsObject);
+    }
     m_protectCountSet.add(jsObject);
 }
 
@@ -151,8 +153,10 @@ void RootObject::gcUnprotect(JSObject* jsObject)
     if (!jsObject)
         return;
 
-    if (m_protectCountSet.count(jsObject) == 1)
+    if (m_protectCountSet.count(jsObject) == 1) {
+        JSC::JSLockHolder holder(&globalObject()->globalData());
         JSC::gcUnprotect(jsObject);
+    }
     m_protectCountSet.remove(jsObject);
 }
 
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 870dee4a2..208d47019 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -237,7 +237,9 @@ static const CSSPropertyID computedProperties[] = {
     CSSPropertyWebkitAlignContent,
     CSSPropertyWebkitAlignItems,
     CSSPropertyWebkitAlignSelf,
-    CSSPropertyWebkitFlex,
+    CSSPropertyWebkitFlexBasis,
+    CSSPropertyWebkitFlexGrow,
+    CSSPropertyWebkitFlexShrink,
     CSSPropertyWebkitFlexDirection,
     CSSPropertyWebkitFlexWrap,
     CSSPropertyWebkitJustifyContent,
@@ -783,7 +785,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForFilter(RenderStyle* st
         case FilterOperation::REFERENCE: {
             ReferenceFilterOperation* referenceOperation = static_cast<ReferenceFilterOperation*>(filterOperation);
             filterValue = WebKitCSSFilterValue::create(WebKitCSSFilterValue::ReferenceFilterOperation);
-            filterValue->append(cssValuePool().createValue(referenceOperation->reference(), CSSPrimitiveValue::CSS_STRING));
+            filterValue->append(cssValuePool().createValue(referenceOperation->url(), CSSPrimitiveValue::CSS_STRING));
             break;
         }
         case FilterOperation::GRAYSCALE: {
@@ -1650,25 +1652,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
         case CSSPropertyEmptyCells:
             return cssValuePool().createValue(style->emptyCells());
 #if ENABLE(CSS3_FLEXBOX)
-        case CSSPropertyWebkitFlex: {
-            RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            list->append(cssValuePool().createValue(style->flexGrow()));
-            list->append(cssValuePool().createValue(style->flexShrink()));
-
-            Length flexBasis = style->flexBasis();
-            if (flexBasis.isAuto())
-                list->append(cssValuePool().createIdentifierValue(CSSValueAuto));
-            else if (flexBasis.isPercent())
-                list->append(cssValuePool().createValue(flexBasis.value(), CSSPrimitiveValue::CSS_PERCENTAGE));
-            else
-                list->append(cssValuePool().createValue(flexBasis.value(), CSSPrimitiveValue::CSS_PX));
-
-            return list.release();
-        }
-        case CSSPropertyWebkitOrder:
-            return cssValuePool().createValue(style->order());
-        case CSSPropertyWebkitJustifyContent:
-            return cssValuePool().createValue(style->justifyContent());
+        case CSSPropertyWebkitAlignContent:
+            return cssValuePool().createValue(style->alignContent());
         case CSSPropertyWebkitAlignItems:
             return cssValuePool().createValue(style->alignItems());
         case CSSPropertyWebkitAlignSelf:
@@ -1678,18 +1663,24 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
                 return cssValuePool().createValue(AlignStretch);
             }
             return cssValuePool().createValue(style->alignSelf());
+        case CSSPropertyWebkitFlex:
+            return getCSSPropertyValuesForShorthandProperties(webkitFlexShorthand());
+        case CSSPropertyWebkitFlexBasis:
+            return cssValuePool().createValue(style->flexBasis());
         case CSSPropertyWebkitFlexDirection:
             return cssValuePool().createValue(style->flexDirection());
+        case CSSPropertyWebkitFlexFlow:
+            return getCSSPropertyValuesForShorthandProperties(webkitFlexFlowShorthand());
+        case CSSPropertyWebkitFlexGrow:
+            return cssValuePool().createValue(style->flexGrow());
+        case CSSPropertyWebkitFlexShrink:
+            return cssValuePool().createValue(style->flexShrink());
         case CSSPropertyWebkitFlexWrap:
             return cssValuePool().createValue(style->flexWrap());
-        case CSSPropertyWebkitAlignContent:
-            return cssValuePool().createValue(style->alignContent());
-        case CSSPropertyWebkitFlexFlow: {
-            RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            list->append(cssValuePool().createValue(style->flexDirection()));
-            list->append(cssValuePool().createValue(style->flexWrap()));
-            return list.release();
-        }
+        case CSSPropertyWebkitJustifyContent:
+            return cssValuePool().createValue(style->justifyContent());
+        case CSSPropertyWebkitOrder:
+            return cssValuePool().createValue(style->order());
 #endif
         case CSSPropertyFloat:
             return cssValuePool().createValue(style->floating());
@@ -1865,8 +1856,14 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
             return zoomAdjustedPixelValueForLength(maxWidth, style.get());
         }
         case CSSPropertyMinHeight:
+            // FIXME: For flex-items, min-height:auto should compute to min-content.
+            if (style->minHeight().isAuto())
+                return zoomAdjustedPixelValue(0, style.get());
             return zoomAdjustedPixelValueForLength(style->minHeight(), style.get());
         case CSSPropertyMinWidth:
+            // FIXME: For flex-items, min-width:auto should compute to min-content.
+            if (style->minWidth().isAuto())
+                return zoomAdjustedPixelValue(0, style.get());
             return zoomAdjustedPixelValueForLength(style->minWidth(), style.get());
         case CSSPropertyOpacity:
             return cssValuePool().createValue(style->opacity(), CSSPrimitiveValue::CSS_NUMBER);
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index 7adcc37bc..c7c10b541 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -82,7 +82,7 @@ using namespace HTMLNames;
     CSSParserValueList* valueList;
     Vector<OwnPtr<MediaQueryExp> >* mediaQueryExpList;
     StyleKeyframe* keyframe;
-    StyleRuleKeyframes* keyframesRule;
+    Vector<RefPtr<StyleKeyframe> >* keyframeRuleList;
     float val;
     CSSPropertyID id;
 }
@@ -101,7 +101,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 63
+%expect 62
 
 %nonassoc LOWEST_PREC
 
@@ -252,7 +252,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %type <string> keyframe_name
 %type <keyframe> keyframe_rule
-%type <keyframesRule> keyframes_rule
+%type <keyframeRuleList> keyframes_rule
 %type <valueList> key_list
 %type <value> key
 
@@ -387,6 +387,8 @@ charset:
      CSSParser* p = static_cast<CSSParser*>(parser);
      if (p->m_styleSheet)
          p->m_styleSheet->parserSetEncodingFromCharsetRule($3);
+     if (p->isExtractingSourceData() && p->m_currentRuleDataStack->isEmpty() && p->m_ruleSourceDataResult)
+         p->addNewRuleToSourceTree(CSSRuleSourceData::createUnknown());
      $$ = 0;
   }
   | CHARSET_SYM error invalid_block {
@@ -462,22 +464,38 @@ block_rule:
   | media
   ;
 
+at_import_header_end_maybe_space:
+    maybe_space {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        p->markRuleHeaderEnd();
+        p->markRuleBodyStart();
+    }
+    ;
+
+before_import_rule:
+    /* empty */ {
+        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::IMPORT_RULE);
+    }
+    ;
 
 import:
-    IMPORT_SYM maybe_space string_or_uri maybe_space maybe_media_list ';' {
-        $$ = static_cast<CSSParser*>(parser)->createImportRule($3, $5);
+    before_import_rule IMPORT_SYM at_import_header_end_maybe_space string_or_uri maybe_space maybe_media_list ';' {
+        $$ = static_cast<CSSParser*>(parser)->createImportRule($4, $6);
     }
-  | IMPORT_SYM maybe_space string_or_uri maybe_space maybe_media_list TOKEN_EOF {
-        $$ = static_cast<CSSParser*>(parser)->createImportRule($3, $5);
+  | before_import_rule IMPORT_SYM at_import_header_end_maybe_space string_or_uri maybe_space maybe_media_list TOKEN_EOF {
+        $$ = static_cast<CSSParser*>(parser)->createImportRule($4, $6);
     }
-  | IMPORT_SYM maybe_space string_or_uri maybe_space maybe_media_list invalid_block {
+  | before_import_rule IMPORT_SYM at_import_header_end_maybe_space string_or_uri maybe_space maybe_media_list invalid_block {
         $$ = 0;
+        static_cast<CSSParser*>(parser)->popRuleData();
     }
-  | IMPORT_SYM error ';' {
+  | before_import_rule IMPORT_SYM error ';' {
         $$ = 0;
+        static_cast<CSSParser*>(parser)->popRuleData();
     }
-  | IMPORT_SYM error invalid_block {
+  | before_import_rule IMPORT_SYM error invalid_block {
         $$ = 0;
+        static_cast<CSSParser*>(parser)->popRuleData();
     }
   ;
 
@@ -602,15 +620,34 @@ media_list:
     }
     ;
 
+at_rule_body_start:
+    /* empty */ {
+        static_cast<CSSParser*>(parser)->markRuleBodyStart();
+    }
+    ;
+
+before_media_rule:
+    /* empty */ {
+        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::MEDIA_RULE);
+    }
+    ;
+
+at_rule_header_end_maybe_space:
+    maybe_space {
+        static_cast<CSSParser*>(parser)->markRuleHeaderEnd();
+    }
+    ;
+
 media:
-    MEDIA_SYM maybe_space media_list '{' maybe_space block_rule_list save_block {
-        $$ = static_cast<CSSParser*>(parser)->createMediaRule($3, $6);
+    before_media_rule MEDIA_SYM maybe_space media_list at_rule_header_end '{' at_rule_body_start maybe_space block_rule_list save_block {
+        $$ = static_cast<CSSParser*>(parser)->createMediaRule($4, $9);
     }
-    | MEDIA_SYM maybe_space '{' maybe_space block_rule_list save_block {
-        $$ = static_cast<CSSParser*>(parser)->createMediaRule(0, $5);
+    | before_media_rule MEDIA_SYM at_rule_header_end_maybe_space '{' at_rule_body_start maybe_space block_rule_list save_block {
+        $$ = static_cast<CSSParser*>(parser)->createMediaRule(0, $7);
     }
-    | MEDIA_SYM maybe_space ';' {
+    | before_media_rule MEDIA_SYM at_rule_header_end_maybe_space ';' {
         $$ = 0;
+        static_cast<CSSParser*>(parser)->popRuleData();
     }
     ;
 
@@ -620,10 +657,15 @@ medium:
   }
   ;
 
+before_keyframes_rule:
+    /* empty */ {
+        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::KEYFRAMES_RULE);
+    }
+    ;
+
 keyframes:
-    WEBKIT_KEYFRAMES_SYM maybe_space keyframe_name maybe_space '{' maybe_space keyframes_rule '}' {
-        $$ = $7;
-        $7->setName($3);
+    before_keyframes_rule WEBKIT_KEYFRAMES_SYM maybe_space keyframe_name at_rule_header_end_maybe_space '{' at_rule_body_start maybe_space keyframes_rule closing_brace {
+        $$ = static_cast<CSSParser*>(parser)->createKeyframesRule($4, static_cast<CSSParser*>(parser)->sinkFloatingKeyframeVector($9));
     }
     ;
   
@@ -633,11 +675,11 @@ keyframe_name:
     ;
 
 keyframes_rule:
-    /* empty */ { $$ = static_cast<CSSParser*>(parser)->createKeyframesRule(); }
+    /* empty */ { $$ = static_cast<CSSParser*>(parser)->createFloatingKeyframeVector(); }
     | keyframes_rule keyframe_rule maybe_space {
         $$ = $1;
         if ($2)
-            $$->parserAppendKeyframe($2);
+            $$->append($2);
     }
     ;
 
@@ -675,23 +717,32 @@ key:
     }
     ;
 
+before_page_rule:
+    /* empty */ {
+        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::PAGE_RULE);
+    }
+    ;
+
 page:
-    PAGE_SYM maybe_space page_selector maybe_space
-    '{' maybe_space declarations_and_margins closing_brace {
+    before_page_rule PAGE_SYM maybe_space page_selector at_rule_header_end_maybe_space
+    '{' at_rule_body_start maybe_space_before_declaration declarations_and_margins closing_brace {
         CSSParser* p = static_cast<CSSParser*>(parser);
-        if ($3)
-            $$ = p->createPageRule(p->sinkFloatingSelector($3));
+        if ($4)
+            $$ = p->createPageRule(p->sinkFloatingSelector($4));
         else {
             // Clear properties in the invalid @page rule.
             p->clearProperties();
             // Also clear margin at-rules here once we fully implement margin at-rules parsing.
             $$ = 0;
+            static_cast<CSSParser*>(parser)->popRuleData();
         }
     }
-    | PAGE_SYM error invalid_block {
+    | before_page_rule PAGE_SYM error invalid_block {
+      static_cast<CSSParser*>(parser)->popRuleData();
       $$ = 0;
     }
-    | PAGE_SYM error ';' {
+    | before_page_rule PAGE_SYM error ';' {
+      static_cast<CSSParser*>(parser)->popRuleData();
       $$ = 0;
     }
     ;
@@ -787,16 +838,24 @@ margin_sym :
     }
     ;
 
+before_font_face_rule:
+    /* empty */ {
+        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::FONT_FACE_RULE);
+    }
+    ;
+
 font_face:
-    FONT_FACE_SYM maybe_space
-    '{' maybe_space declaration_list '}'  maybe_space {
+    before_font_face_rule FONT_FACE_SYM at_rule_header_end_maybe_space
+    '{' at_rule_body_start maybe_space_before_declaration declaration_list closing_brace {
         $$ = static_cast<CSSParser*>(parser)->createFontFaceRule();
     }
-    | FONT_FACE_SYM error invalid_block {
+    | before_font_face_rule FONT_FACE_SYM error invalid_block {
       $$ = 0;
+      static_cast<CSSParser*>(parser)->popRuleData();
     }
-    | FONT_FACE_SYM error ';' {
+    | before_font_face_rule FONT_FACE_SYM error ';' {
       $$ = 0;
+      static_cast<CSSParser*>(parser)->popRuleData();
     }
 ;
 
@@ -838,27 +897,24 @@ unary_operator:
 
 maybe_space_before_declaration:
     maybe_space {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markPropertyStart();
+        static_cast<CSSParser*>(parser)->markPropertyStart();
     }
   ;
 
 before_selector_list:
     /* empty */ {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markSelectorListStart();
+        static_cast<CSSParser*>(parser)->markRuleHeaderStart(CSSRuleSourceData::STYLE_RULE);
     }
   ;
 
-before_rule_opening_brace:
+at_rule_header_end:
     /* empty */ {
-        CSSParser* p = static_cast<CSSParser*>(parser);
-        p->markSelectorListEnd();
+        static_cast<CSSParser*>(parser)->markRuleHeaderEnd();
     }
   ;
 
 ruleset:
-    before_selector_list selector_list before_rule_opening_brace '{' maybe_space_before_declaration declaration_list closing_brace {
+    before_selector_list selector_list at_rule_header_end '{' maybe_space_before_declaration declaration_list closing_brace {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createStyleRule($2);
     }
@@ -1304,7 +1360,7 @@ declaration:
         CSSParser* p = static_cast<CSSParser*>(parser);
         p->storeVariableDeclaration($1, p->sinkFloatingValueList($4), $5);
         $$ = true;
-        p->markPropertyEnd($5, $$);
+        p->markPropertyEnd($5, true);
 #else
         $$ = false;
 #endif
diff --git a/Source/WebCore/css/CSSMediaRule.cpp b/Source/WebCore/css/CSSMediaRule.cpp
index 6db320c27..55bbaa5fd 100644
--- a/Source/WebCore/css/CSSMediaRule.cpp
+++ b/Source/WebCore/css/CSSMediaRule.cpp
@@ -166,7 +166,7 @@ void CSSMediaRule::reattach(StyleRuleMedia* rule)
 {
     ASSERT(rule);
     m_mediaRule = rule;
-    if (m_mediaCSSOMWrapper)
+    if (m_mediaCSSOMWrapper && m_mediaRule->mediaQueries())
         m_mediaCSSOMWrapper->reattach(m_mediaRule->mediaQueries());
     for (unsigned i = 0; i < m_childRuleCSSOMWrappers.size(); ++i) {
         if (m_childRuleCSSOMWrappers[i])
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index cc96a2d1f..d68288343 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -94,6 +94,9 @@
 
 #if ENABLE(CSS_FILTERS)
 #include "WebKitCSSFilterValue.h"
+#if ENABLE(SVG)
+#include "WebKitCSSSVGDocumentValue.h"
+#endif
 #endif
 
 #if ENABLE(CSS_SHADERS)
@@ -248,9 +251,6 @@ CSSParser::CSSParser(const CSSParserContext& context)
     , m_hadSyntacticallyValidCSSRule(false)
     , m_defaultNamespace(starAtom)
     , m_parsedTextPrefixLength(0)
-    , m_inStyleRuleOrDeclaration(false)
-    , m_selectorListRange(0, 0)
-    , m_ruleBodyRange(0, 0)
     , m_propertyRange(UINT_MAX, UINT_MAX)
     , m_ruleSourceDataResult(0)
     , m_parsingMode(NormalMode)
@@ -314,7 +314,6 @@ void CSSParser::setupParser(const char* prefix, const String& string, const char
     m_dataStart[length - 1] = 0;
 
     m_currentCharacter = m_tokenStart = m_dataStart.get();
-    resetRuleBodyMarks();
 }
 
 void CSSParser::parseSheet(StyleSheetContents* sheet, const String& string, int startLineNumber, RuleSourceDataList* ruleSourceDataResult)
@@ -716,7 +715,7 @@ static inline bool isValidKeywordPropertyAndValue(CSSPropertyID propertyId, int
         break;
     case CSSPropertyWebkitFlexDirection:
         if (valueID == CSSValueRow || valueID == CSSValueRowReverse || valueID == CSSValueColumn || valueID == CSSValueColumnReverse)
-                return true;
+            return true;
         break;
     case CSSPropertyWebkitFlexWrap:
         if (valueID == CSSValueNone || valueID == CSSValueWrap || valueID == CSSValueWrapReverse)
@@ -1218,20 +1217,17 @@ void CSSParser::parseSelector(const String& string, CSSSelectorList& selectorLis
     m_selectorListForParseSelector = 0;
 }
 
-bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& string, PassRefPtr<CSSStyleSourceData> prpStyleSourceData, StyleSheetContents* contextStyleSheet)
+bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& string, PassRefPtr<CSSRuleSourceData> prpRuleSourceData, StyleSheetContents* contextStyleSheet)
 {
     // Length of the "@-webkit-decls{" prefix.
     static const unsigned prefixLength = 15;
 
     setStyleSheet(contextStyleSheet);
 
-    RefPtr<CSSStyleSourceData> styleSourceData = prpStyleSourceData;
-    if (styleSourceData) {
+    RefPtr<CSSRuleSourceData> ruleSourceData = prpRuleSourceData;
+    if (ruleSourceData) {
         m_currentRuleDataStack = adoptPtr(new RuleSourceDataList());
-        RefPtr<CSSRuleSourceData> data = CSSRuleSourceData::create();
-        data->styleSourceData = styleSourceData;
-        m_currentRuleDataStack->append(data);
-        m_inStyleRuleOrDeclaration = true;
+        m_currentRuleDataStack->append(ruleSourceData);
     }
 
     setupParser("@-webkit-decls{", string, "} ");
@@ -1247,20 +1243,18 @@ bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& st
         clearProperties();
     }
 
-    if (styleSourceData) {
-        ASSERT(!m_currentRuleDataStack->isEmpty());
-        CSSRuleSourceData* ruleData = m_currentRuleDataStack->last().get();
-        ruleData->styleSourceData->styleBodyRange.start = 0;
-        ruleData->styleSourceData->styleBodyRange.end = string.length();
-        for (size_t i = 0, size = ruleData->styleSourceData->propertyData.size(); i < size; ++i) {
-            CSSPropertySourceData& propertyData = ruleData->styleSourceData->propertyData.at(i);
+    if (ruleSourceData) {
+        ASSERT(m_currentRuleDataStack->size() == 1);
+        ruleSourceData->ruleBodyRange.start = 0;
+        ruleSourceData->ruleBodyRange.end = string.length();
+        for (size_t i = 0, size = ruleSourceData->styleSourceData->propertyData.size(); i < size; ++i) {
+            CSSPropertySourceData& propertyData = ruleSourceData->styleSourceData->propertyData.at(i);
             propertyData.range.start -= prefixLength;
             propertyData.range.end -= prefixLength;
         }
-        fixUnparsedPropertyRanges(ruleData);
 
+        fixUnparsedPropertyRanges(ruleSourceData.get());
         m_currentRuleDataStack.clear();
-        m_inStyleRuleOrDeclaration = false;
     }
 
     return ok;
@@ -1575,6 +1569,22 @@ static inline bool isComma(CSSParserValue* value)
     return value && value->unit == CSSParserValue::Operator && value->iValue == ','; 
 }
 
+bool CSSParser::validWidth(CSSParserValue* value)
+{
+    int id = value->id;
+    if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic || id == CSSValueWebkitMinContent || id == CSSValueWebkitMaxContent || id == CSSValueWebkitFillAvailable || id == CSSValueWebkitFitContent)
+        return true;
+    return !id && validUnit(value, FLength | FPercent | FNonNeg);
+}
+
+// FIXME: Combine this with validWidth when we support fit-content, et al, for heights.
+bool CSSParser::validHeight(CSSParserValue* value)
+{
+    int id = value->id;
+    if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
+        return true;
+    return !id && validUnit(value, FLength | FPercent | FNonNeg);
+}
 
 void CSSParser::checkForOrphanedUnits()
 {
@@ -1987,34 +1997,28 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg));
         break;
 
-    case CSSPropertyMaxWidth: // <length> | <percentage> | none | inherit
+    case CSSPropertyMaxWidth:
     case CSSPropertyWebkitMaxLogicalWidth:
-        if (id == CSSValueNone) {
-            validPrimitive = true;
-            break;
-        }
-        /* nobreak */
-    case CSSPropertyMinWidth: // <length> | <percentage> | inherit
+        validPrimitive = (id == CSSValueNone || validWidth(value));
+        break;
+
+    case CSSPropertyMinWidth:
     case CSSPropertyWebkitMinLogicalWidth:
-        if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic || id == CSSValueWebkitMinContent || id == CSSValueWebkitMaxContent || id == CSSValueWebkitFillAvailable || id == CSSValueWebkitFitContent)
-            validPrimitive = true;
-        else
-            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg));
+    case CSSPropertyWidth:
+    case CSSPropertyWebkitLogicalWidth:
+        validPrimitive = (id == CSSValueAuto || validWidth(value));
         break;
 
-    case CSSPropertyMaxHeight: // <length> | <percentage> | none | inherit
+    case CSSPropertyMaxHeight:
     case CSSPropertyWebkitMaxLogicalHeight:
-        if (id == CSSValueNone) {
-            validPrimitive = true;
-            break;
-        }
-        /* nobreak */
-    case CSSPropertyMinHeight: // <length> | <percentage> | inherit
+        validPrimitive = (id == CSSValueNone || validHeight(value));
+        break;
+
+    case CSSPropertyMinHeight:
     case CSSPropertyWebkitMinLogicalHeight:
-        if (id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
-            validPrimitive = true;
-        else
-            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg));
+    case CSSPropertyHeight:
+    case CSSPropertyWebkitLogicalHeight:
+        validPrimitive = (id == CSSValueAuto || validHeight(value));
         break;
 
     case CSSPropertyFontSize:
@@ -2033,22 +2037,6 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
             validPrimitive = (!id && validUnit(value, FLength | FPercent));
         break;
 
-    case CSSPropertyWidth: // <length> | <percentage> | auto | inherit
-    case CSSPropertyWebkitLogicalWidth:
-        if (id == CSSValueWebkitMinContent || id == CSSValueWebkitMaxContent || id == CSSValueWebkitFillAvailable || id == CSSValueWebkitFitContent) {
-            validPrimitive = true;
-            break;
-        }
-        /* nobreak */
-    case CSSPropertyHeight: // <length> | <percentage> | auto | inherit
-    case CSSPropertyWebkitLogicalHeight:
-        if (id == CSSValueAuto || id == CSSValueIntrinsic || id == CSSValueMinIntrinsic)
-            validPrimitive = true;
-        else if (!id && validUnit(value, FLength | FPercent | FNonNeg))
-            // ### handle multilength case where we allow relative units
-            validPrimitive = true;
-        break;
-
     case CSSPropertyBottom:               // <length> | <percentage> | auto | inherit
     case CSSPropertyLeft:                 // <length> | <percentage> | auto | inherit
     case CSSPropertyRight:                // <length> | <percentage> | auto | inherit
@@ -2275,11 +2263,26 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         break;
 #endif
 #if ENABLE(CSS3_FLEXBOX)
-    case CSSPropertyWebkitFlex:
-        if (id == CSSValueNone)
+    case CSSPropertyWebkitFlex: {
+        ShorthandScope scope(this, propId);
+        if (id == CSSValueNone) {
+            addProperty(CSSPropertyWebkitFlexGrow, cssValuePool().createValue(0, CSSPrimitiveValue::CSS_NUMBER), important);
+            addProperty(CSSPropertyWebkitFlexShrink, cssValuePool().createValue(0, CSSPrimitiveValue::CSS_NUMBER), important);
+            addProperty(CSSPropertyWebkitFlexBasis, cssValuePool().createIdentifierValue(CSSValueAuto), important);
+            return true;
+        }
+        return parseFlex(m_valueList.get(), important);
+    }
+    case CSSPropertyWebkitFlexBasis:
+        // FIXME: Support intrinsic dimensions too.
+        if (id == CSSValueAuto)
             validPrimitive = true;
         else
-            parsedValue = parseFlex(m_valueList.get());
+            validPrimitive = (!id && validUnit(value, FLength | FPercent | FNonNeg));
+        break;
+    case CSSPropertyWebkitFlexGrow:
+    case CSSPropertyWebkitFlexShrink:
+        validPrimitive = validUnit(value, FNumber | FNonNeg);
         break;
     case CSSPropertyWebkitOrder:
         validPrimitive = validUnit(value, FNumber);
@@ -3003,13 +3006,16 @@ bool CSSParser::cssVariablesEnabled() const
 
 void CSSParser::storeVariableDeclaration(const CSSParserString& name, PassOwnPtr<CSSParserValueList> value, bool important)
 {
+    ASSERT(name.length > 12);
+    AtomicString variableName = String(name.characters + 12, name.length - 12);
+
     StringBuilder builder;
     for (unsigned i = 0, size = value->size(); i < size; i++) {
         if (i)
             builder.append(' ');
         builder.append(value->valueAt(i)->createCSSValue()->cssText());
     }
-    addProperty(CSSPropertyVariable, CSSVariableValue::create(name, builder.toString()), important, false);
+    addProperty(CSSPropertyVariable, CSSVariableValue::create(variableName, builder.toString()), important, false);
 }
 #endif
 
@@ -3032,19 +3038,42 @@ void CSSParser::addAnimationValue(RefPtr<CSSValue>& lval, PassRefPtr<CSSValue> r
 
 bool CSSParser::parseAnimationShorthand(bool important)
 {
-    const unsigned numProperties = webkitAnimationShorthand().length();
+    // When we parse the animation shorthand we need to look for animation-name
+    // last because otherwise it might match against the keywords for fill mode,
+    // timing functions and infinite iteration. This means that animation names
+    // that are the same as keywords (e.g. 'forwards') won't always match in the
+    // shorthand. In that case they should be using longhands (or reconsidering
+    // their approach). This is covered by the animations spec bug:
+    // https://www.w3.org/Bugs/Public/show_bug.cgi?id=14790
+    // And in the spec (editor's draft) at:
+    // http://dev.w3.org/csswg/css3-animations/#animation-shorthand-property
+
+    static const CSSPropertyID animationProperties[] = {
+        CSSPropertyWebkitAnimationDuration,
+        CSSPropertyWebkitAnimationTimingFunction,
+        CSSPropertyWebkitAnimationDelay,
+        CSSPropertyWebkitAnimationIterationCount,
+        CSSPropertyWebkitAnimationDirection,
+        CSSPropertyWebkitAnimationFillMode,
+        CSSPropertyWebkitAnimationName
+    };
+    const unsigned numProperties = 7;
+
+    // The list of properties in the shorthand should be the same
+    // length as the list we have here, even though they are
+    // a different order.
+    ASSERT(numProperties == webkitAnimationShorthand().length());
+
     ShorthandScope scope(this, CSSPropertyWebkitAnimation);
 
-    bool parsedProperty[] = { false, false, false, false, false, false, false };
-    RefPtr<CSSValue> values[7];
+    bool parsedProperty[numProperties] = { false };
+    RefPtr<CSSValue> values[numProperties];
 
     unsigned i;
-    unsigned initialParsedPropertyIndex = 0;
     while (m_valueList->current()) {
         CSSParserValue* val = m_valueList->current();
         if (val->unit == CSSParserValue::Operator && val->iValue == ',') {
             // We hit the end.  Fill in all remaining values with the initial value.
-            initialParsedPropertyIndex = 0;
             m_valueList->next();
             for (i = 0; i < numProperties; ++i) {
                 if (!parsedProperty[i])
@@ -3056,13 +3085,13 @@ bool CSSParser::parseAnimationShorthand(bool important)
         }
 
         bool found = false;
-        for (i = initialParsedPropertyIndex; !found && i < numProperties; ++i) {
+        for (i = 0; i < numProperties; ++i) {
             if (!parsedProperty[i]) {
                 RefPtr<CSSValue> val;
-                if (parseAnimationProperty(webkitAnimationShorthand().properties()[i], val)) {
+                if (parseAnimationProperty(animationProperties[i], val)) {
                     parsedProperty[i] = found = true;
-                    initialParsedPropertyIndex = 1;
                     addAnimationValue(values[i], val.release());
+                    break;
                 }
             }
         }
@@ -3073,15 +3102,13 @@ bool CSSParser::parseAnimationShorthand(bool important)
             return false;
     }
 
-    // Fill in any remaining properties with the initial value.
     for (i = 0; i < numProperties; ++i) {
+        // If we didn't find the property, set an intial value.
         if (!parsedProperty[i])
             addAnimationValue(values[i], cssValuePool().createImplicitInitialValue());
-    }
 
-    // Now add all of the properties we found.
-    for (i = 0; i < numProperties; i++)
-        addProperty(webkitAnimationShorthand().properties()[i], values[i].release(), important);
+        addProperty(animationProperties[i], values[i].release(), important);
+    }
 
     return true;
 }
@@ -5780,49 +5807,48 @@ bool CSSParser::parseReflect(CSSPropertyID propId, bool important)
 
 #if ENABLE(CSS3_FLEXBOX)
 
-PassRefPtr<CSSValue> CSSParser::parseFlex(CSSParserValueList* args)
+bool CSSParser::parseFlex(CSSParserValueList* args, bool important)
 {
     if (!args || !args->size() || args->size() > 3)
-        return 0;
+        return false;
     static const double unsetValue = -1;
-    double positiveFlex = unsetValue;
-    double negativeFlex = unsetValue;
-    RefPtr<CSSPrimitiveValue> preferredSize;
+    double flexGrow = unsetValue;
+    double flexShrink = unsetValue;
+    RefPtr<CSSPrimitiveValue> flexBasis;
 
     while (CSSParserValue* arg = args->current()) {
         if (validUnit(arg, FNumber | FNonNeg)) {
-            if (positiveFlex == unsetValue)
-                positiveFlex = arg->fValue;
-            else if (negativeFlex == unsetValue)
-                negativeFlex = arg->fValue;
+            if (flexGrow == unsetValue)
+                flexGrow = arg->fValue;
+            else if (flexShrink == unsetValue)
+                flexShrink = arg->fValue;
             else if (!arg->fValue) {
-                // flex() only allows a preferred size of 0 (sans units) if the positive and negative flex values have already been set.
-                preferredSize = cssValuePool().createValue(0, CSSPrimitiveValue::CSS_PX);
+                // flex only allows a basis of 0 (sans units) if flex-grow and flex-shrink values have already been set.
+                flexBasis = cssValuePool().createValue(0, CSSPrimitiveValue::CSS_PX);
             } else {
-                // We only allow 3 numbers without units if the last value is 0. E.g., flex(1 1 1) is invalid.
-                return 0;
+                // We only allow 3 numbers without units if the last value is 0. E.g., flex:1 1 1 is invalid.
+                return false;
             }
-        } else if (!preferredSize && (arg->id == CSSValueAuto || validUnit(arg, FLength | FPercent | FNonNeg)))
-            preferredSize = parseValidPrimitive(arg->id, arg);
+        } else if (!flexBasis && (arg->id == CSSValueAuto || validUnit(arg, FLength | FPercent | FNonNeg)))
+            flexBasis = parseValidPrimitive(arg->id, arg);
         else {
-            // Not a valid arg for flex().
-            return 0;
+            // Not a valid arg for flex.
+            return false;
         }
         args->next();
     }
 
-    if (positiveFlex == unsetValue)
-        positiveFlex = 0;
-    if (negativeFlex == unsetValue)
-        negativeFlex = 1;
-    if (!preferredSize)
-        preferredSize = cssValuePool().createValue(0, CSSPrimitiveValue::CSS_PX);
+    if (flexGrow == unsetValue)
+        flexGrow = 0;
+    if (flexShrink == unsetValue)
+        flexShrink = 1;
+    if (!flexBasis)
+        flexBasis = cssValuePool().createValue(0, CSSPrimitiveValue::CSS_PX);
 
-    RefPtr<CSSValueList> flex = CSSValueList::createSpaceSeparated();
-    flex->append(cssValuePool().createValue(clampToFloat(positiveFlex), CSSPrimitiveValue::CSS_NUMBER));
-    flex->append(cssValuePool().createValue(clampToFloat(negativeFlex), CSSPrimitiveValue::CSS_NUMBER));
-    flex->append(preferredSize);
-    return flex;
+    addProperty(CSSPropertyWebkitFlexGrow, cssValuePool().createValue(clampToFloat(flexGrow), CSSPrimitiveValue::CSS_NUMBER), important);
+    addProperty(CSSPropertyWebkitFlexShrink, cssValuePool().createValue(clampToFloat(flexShrink), CSSPrimitiveValue::CSS_NUMBER), important);
+    addProperty(CSSPropertyWebkitFlexBasis, flexBasis, important);
+    return true;
 }
 
 #endif
@@ -7544,9 +7570,11 @@ PassRefPtr<CSSValueList> CSSParser::parseFilter()
 
         // See if the specified primitive is one we understand.
         if (value->unit == CSSPrimitiveValue::CSS_URI) {
+#if ENABLE(SVG)
             RefPtr<WebKitCSSFilterValue> referenceFilterValue = WebKitCSSFilterValue::create(WebKitCSSFilterValue::ReferenceFilterOperation);
             list->append(referenceFilterValue);
-            referenceFilterValue->append(cssValuePool().createValue(value->string, CSSPrimitiveValue::CSS_STRING));
+            referenceFilterValue->append(WebKitCSSSVGDocumentValue::create(value->string));
+#endif
         } else {
             const CSSParserString name = value->function->name;
             unsigned maximumArgumentCount = 1;
@@ -8971,21 +8999,16 @@ restartAfterComment:
     }
 
     case CharacterDash:
-#if ENABLE(CSS_VARIABLES)
-        if (cssVariablesEnabled() && isEqualToCSSIdentifier(m_currentCharacter, "webkit-var") && m_currentCharacter[10] == '-' && isIdentifierStartAfterDash(m_currentCharacter + 11)) {
-            // handle variable declarations
-            m_currentCharacter += 11;
-            parseIdentifier(result, hasEscape);
-            m_token = VAR_DEFINITION;
-            yylval->string.characters = m_tokenStart;
-            yylval->string.length = result - m_tokenStart;
-        } else
-#endif
         if (isIdentifierStartAfterDash(m_currentCharacter)) {
             --m_currentCharacter;
             parseIdentifier(result, hasEscape);
             m_token = IDENT;
 
+#if ENABLE(CSS_VARIABLES)
+            if (cssVariablesEnabled() && isEqualToCSSIdentifier(m_tokenStart + 1, "webkit-var") && m_tokenStart[11] == '-' && isIdentifierStartAfterDash(m_tokenStart + 12))
+                m_token = VAR_DEFINITION;
+            else
+#endif
             if (*m_currentCharacter == '(') {
                 m_token = FUNCTION;
                 if (!hasEscape)
@@ -9355,6 +9378,18 @@ PassOwnPtr<MediaQuery> CSSParser::sinkFloatingMediaQuery(MediaQuery* query)
     return m_floatingMediaQuery.release();
 }
 
+Vector<RefPtr<StyleKeyframe> >* CSSParser::createFloatingKeyframeVector()
+{
+    m_floatingKeyframeVector = adoptPtr(new Vector<RefPtr<StyleKeyframe> >());
+    return m_floatingKeyframeVector.get();
+}
+
+PassOwnPtr<Vector<RefPtr<StyleKeyframe> > > CSSParser::sinkFloatingKeyframeVector(Vector<RefPtr<StyleKeyframe> >* keyframeVector)
+{
+    ASSERT_UNUSED(keyframeVector, m_floatingKeyframeVector == keyframeVector);
+    return m_floatingKeyframeVector.release();
+}
+
 MediaQuerySet* CSSParser::createMediaQuerySet()
 {
     RefPtr<MediaQuerySet> queries = MediaQuerySet::create();
@@ -9370,17 +9405,23 @@ StyleRuleBase* CSSParser::createImportRule(const CSSParserString& url, MediaQuer
     RefPtr<StyleRuleImport> rule = StyleRuleImport::create(url, media);
     StyleRuleImport* result = rule.get();
     m_parsedRules.append(rule.release());
+    processAndAddNewRuleToSourceTreeIfNeeded();
     return result;
 }
 
 StyleRuleBase* CSSParser::createMediaRule(MediaQuerySet* media, RuleList* rules)
 {
-    if (!media || !rules)
-        return 0;
     m_allowImportRules = m_allowNamespaceDeclarations = false;
-    RefPtr<StyleRuleMedia> rule = StyleRuleMedia::create(media, *rules);
+    RefPtr<StyleRuleMedia> rule;
+    if (rules)
+        rule = StyleRuleMedia::create(media ? media : MediaQuerySet::create(), *rules);
+    else {
+        RuleList emptyRules;
+        rule = StyleRuleMedia::create(media ? media : MediaQuerySet::create(), emptyRules);
+    }
     StyleRuleMedia* result = rule.get();
     m_parsedRules.append(rule.release());
+    processAndAddNewRuleToSourceTreeIfNeeded();
     return result;
 }
 
@@ -9393,14 +9434,25 @@ CSSParser::RuleList* CSSParser::createRuleList()
     return listPtr;
 }
 
+void CSSParser::processAndAddNewRuleToSourceTreeIfNeeded()
+{
+    if (!isExtractingSourceData())
+        return;
+    markRuleBodyEnd();
+    RefPtr<CSSRuleSourceData> rule = popRuleData();
+    fixUnparsedPropertyRanges(rule.get());
+    addNewRuleToSourceTree(rule.release());
+}
+
 void CSSParser::addNewRuleToSourceTree(PassRefPtr<CSSRuleSourceData> rule)
 {
     // Precondition: (isExtractingSourceData()).
     if (!m_ruleSourceDataResult)
         return;
-
-    // FIXME: This temporarily builds a flat style rule data list, to avoid the client code breakage.
-    m_ruleSourceDataResult->append(rule);
+    if (m_currentRuleDataStack->isEmpty())
+        m_ruleSourceDataResult->append(rule);
+    else
+        m_currentRuleDataStack->last()->childRules.append(rule);
 }
 
 PassRefPtr<CSSRuleSourceData> CSSParser::popRuleData()
@@ -9414,19 +9466,23 @@ PassRefPtr<CSSRuleSourceData> CSSParser::popRuleData()
     return data.release();
 }
 
-StyleRuleKeyframes* CSSParser::createKeyframesRule()
+StyleRuleKeyframes* CSSParser::createKeyframesRule(const String& name, PassOwnPtr<Vector<RefPtr<StyleKeyframe> > > popKeyframes)
 {
+    OwnPtr<Vector<RefPtr<StyleKeyframe> > > keyframes = popKeyframes;
     m_allowImportRules = m_allowNamespaceDeclarations = false;
     RefPtr<StyleRuleKeyframes> rule = StyleRuleKeyframes::create();
+    for (size_t i = 0; i < keyframes->size(); ++i)
+        rule->parserAppendKeyframe(keyframes->at(i));
+    rule->setName(name);
     StyleRuleKeyframes* rulePtr = rule.get();
     m_parsedRules.append(rule.release());
+    processAndAddNewRuleToSourceTreeIfNeeded();
     return rulePtr;
 }
 
 StyleRuleBase* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selectors)
 {
     StyleRule* result = 0;
-    markRuleBodyEnd();
     if (selectors) {
         m_allowImportRules = m_allowNamespaceDeclarations = false;
         RefPtr<StyleRule> rule = StyleRule::create(m_lastSelectorLineNumber);
@@ -9436,18 +9492,7 @@ StyleRuleBase* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* se
         rule->setProperties(createStylePropertySet());
         result = rule.get();
         m_parsedRules.append(rule.release());
-        if (isExtractingSourceData()) {
-            RefPtr<CSSRuleSourceData> currentRuleData = popRuleData();
-            currentRuleData->styleSourceData->styleBodyRange = m_ruleBodyRange;
-            currentRuleData->selectorListRange = m_selectorListRange;
-            fixUnparsedPropertyRanges(currentRuleData.get());
-            addNewRuleToSourceTree(currentRuleData.release());
-            m_inStyleRuleOrDeclaration = false;
-        }
-    }
-    if (isExtractingSourceData()) {
-        resetSelectorListMarks();
-        resetRuleBodyMarks();
+        processAndAddNewRuleToSourceTreeIfNeeded();
     }
     clearProperties();
     return result;
@@ -9474,6 +9519,7 @@ StyleRuleBase* CSSParser::createFontFaceRule()
     clearProperties();
     StyleRuleFontFace* result = rule.get();
     m_parsedRules.append(rule.release());
+    processAndAddNewRuleToSourceTreeIfNeeded();
     return result;
 }
 
@@ -9553,6 +9599,7 @@ StyleRuleBase* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelec
         rule->setProperties(createStylePropertySet());
         pageRule = rule.get();
         m_parsedRules.append(rule.release());
+        processAndAddNewRuleToSourceTreeIfNeeded();
     }
     clearProperties();
     return pageRule;
@@ -9575,6 +9622,8 @@ StyleRuleBase* CSSParser::createRegionRule(Vector<OwnPtr<CSSParserSelector> >* r
 
     StyleRuleRegion* result = regionRule.get();
     m_parsedRules.append(regionRule.release());
+    if (isExtractingSourceData())
+        addNewRuleToSourceTree(CSSRuleSourceData::createUnknown());
 
     return result;
 }
@@ -9656,12 +9705,14 @@ void CSSParser::updateLastMediaLine(MediaQuerySet* media)
 
 void CSSParser::fixUnparsedPropertyRanges(CSSRuleSourceData* ruleData)
 {
+    if (!ruleData->styleSourceData)
+        return;
     Vector<CSSPropertySourceData>& propertyData = ruleData->styleSourceData->propertyData;
     unsigned size = propertyData.size();
     if (!size)
         return;
 
-    unsigned styleStart = ruleData->styleSourceData->styleBodyRange.start;
+    unsigned styleStart = ruleData->ruleBodyRange.start;
     const UChar* characters = m_dataStart.get() + m_parsedTextPrefixLength;
     CSSPropertySourceData* nextData = &(propertyData.at(0));
     for (unsigned i = 0; i < size; ++i) {
@@ -9675,7 +9726,7 @@ void CSSParser::fixUnparsedPropertyRanges(CSSRuleSourceData* ruleData)
 
         unsigned propertyEndInStyleSheet;
         if (!nextData)
-            propertyEndInStyleSheet = ruleData->styleSourceData->styleBodyRange.end - 1;
+            propertyEndInStyleSheet = ruleData->ruleBodyRange.end - 1;
         else
             propertyEndInStyleSheet = styleStart + nextData->range.start - 1;
 
@@ -9699,17 +9750,20 @@ void CSSParser::fixUnparsedPropertyRanges(CSSRuleSourceData* ruleData)
     }
 }
 
-void CSSParser::markSelectorListStart()
+void CSSParser::markRuleHeaderStart(CSSRuleSourceData::Type ruleType)
 {
     if (!isExtractingSourceData())
         return;
-    m_selectorListRange.start = m_tokenStart - m_dataStart.get();
+    RefPtr<CSSRuleSourceData> data = CSSRuleSourceData::create(ruleType);
+    data->ruleHeaderRange.start = m_tokenStart - m_dataStart.get();
+    m_currentRuleDataStack->append(data.release());
 }
 
-void CSSParser::markSelectorListEnd()
+void CSSParser::markRuleHeaderEnd()
 {
     if (!isExtractingSourceData())
         return;
+    ASSERT(!m_currentRuleDataStack->isEmpty());
     UChar* listEnd = m_tokenStart;
     while (listEnd > m_dataStart.get() + 1) {
         if (isHTMLSpace(*(listEnd - 1)))
@@ -9717,10 +9771,7 @@ void CSSParser::markSelectorListEnd()
         else
             break;
     }
-    m_selectorListRange.end = listEnd - m_dataStart.get();
-    RefPtr<CSSRuleSourceData> data = CSSRuleSourceData::create();
-    data->styleSourceData = CSSStyleSourceData::create();
-    m_currentRuleDataStack->append(data);
+    m_currentRuleDataStack->last()->ruleHeaderRange.end = listEnd - m_dataStart.get();
 }
 
 void CSSParser::markRuleBodyStart()
@@ -9730,30 +9781,33 @@ void CSSParser::markRuleBodyStart()
     unsigned offset = m_tokenStart - m_dataStart.get();
     if (*m_tokenStart == '{')
         ++offset; // Skip the rule body opening brace.
-    if (offset > m_ruleBodyRange.start)
-        m_ruleBodyRange.start = offset;
-    m_inStyleRuleOrDeclaration = true;
+    ASSERT(!m_currentRuleDataStack->isEmpty());
+    m_currentRuleDataStack->last()->ruleBodyRange.start = offset;
 }
 
 void CSSParser::markRuleBodyEnd()
 {
-    if (!isExtractingSourceData())
-        return;
+    // Precondition: (!isExtractingSourceData())
     unsigned offset = m_tokenStart - m_dataStart.get();
-    if (offset > m_ruleBodyRange.end)
-        m_ruleBodyRange.end = offset;
+    ASSERT(!m_currentRuleDataStack->isEmpty());
+    m_currentRuleDataStack->last()->ruleBodyRange.end = offset;
 }
 
 void CSSParser::markPropertyStart()
 {
-    if (!m_inStyleRuleOrDeclaration)
+    if (!isExtractingSourceData())
+        return;
+    if (m_currentRuleDataStack->isEmpty() || !m_currentRuleDataStack->last()->styleSourceData)
         return;
+
     m_propertyRange.start = m_tokenStart - m_dataStart.get();
 }
 
 void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
 {
-    if (!m_inStyleRuleOrDeclaration)
+    if (!isExtractingSourceData())
+        return;
+    if (m_currentRuleDataStack->isEmpty() || !m_currentRuleDataStack->last()->styleSourceData)
         return;
 
     unsigned offset = m_tokenStart - m_dataStart.get();
@@ -9774,8 +9828,9 @@ void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
         String name = propertyString.left(colonIndex).stripWhiteSpace();
         String value = propertyString.substring(colonIndex + 1, propertyString.length()).stripWhiteSpace();
         // The property range is relative to the declaration start offset.
+        SourceRange& topRuleBodyRange = m_currentRuleDataStack->last()->ruleBodyRange;
         m_currentRuleDataStack->last()->styleSourceData->propertyData.append(
-            CSSPropertySourceData(name, value, isImportantFound, isPropertyParsed, SourceRange(start - m_ruleBodyRange.start, end - m_ruleBodyRange.start)));
+            CSSPropertySourceData(name, value, isImportantFound, isPropertyParsed, SourceRange(start - topRuleBodyRange.start, end - topRuleBodyRange.start)));
     }
     resetPropertyRange();
 }
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 625e1e081..6acbba252 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -78,7 +78,7 @@ public:
     static bool parseSystemColor(RGBA32& color, const String&, Document*);
     static PassRefPtr<CSSValueList> parseFontFaceValue(const AtomicString&);
     PassRefPtr<CSSPrimitiveValue> parseValidPrimitive(int ident, CSSParserValue*);
-    bool parseDeclaration(StylePropertySet*, const String&, PassRefPtr<CSSStyleSourceData>, StyleSheetContents* contextStyleSheet);
+    bool parseDeclaration(StylePropertySet*, const String&, PassRefPtr<CSSRuleSourceData>, StyleSheetContents* contextStyleSheet);
     PassOwnPtr<MediaQuery> parseMediaQuery(const String&);
 
     void addProperty(CSSPropertyID, PassRefPtr<CSSValue>, bool important, bool implicit = false);
@@ -189,7 +189,7 @@ public:
 
     bool parseReflect(CSSPropertyID, bool important);
 
-    PassRefPtr<CSSValue> parseFlex(CSSParserValueList* args);
+    bool parseFlex(CSSParserValueList* args, bool important);
 
     // Image generators
     bool parseCanvas(CSSParserValueList*, RefPtr<CSSValue>&);
@@ -255,7 +255,7 @@ public:
     MediaQuerySet* createMediaQuerySet();
     StyleRuleBase* createImportRule(const CSSParserString&, MediaQuerySet*);
     StyleKeyframe* createKeyframe(CSSParserValueList*);
-    StyleRuleKeyframes* createKeyframesRule();
+    StyleRuleKeyframes* createKeyframesRule(const String&, PassOwnPtr<Vector<RefPtr<StyleKeyframe> > >);
 
     typedef Vector<RefPtr<StyleRuleBase> > RuleList;
     StyleRuleBase* createMediaRule(MediaQuerySet*, RuleList*);
@@ -276,6 +276,9 @@ public:
     MediaQuery* createFloatingMediaQuery(PassOwnPtr<Vector<OwnPtr<MediaQueryExp> > >);
     PassOwnPtr<MediaQuery> sinkFloatingMediaQuery(MediaQuery*);
 
+    Vector<RefPtr<StyleKeyframe> >* createFloatingKeyframeVector();
+    PassOwnPtr<Vector<RefPtr<StyleKeyframe> > > sinkFloatingKeyframeVector(Vector<RefPtr<StyleKeyframe> >*);
+
     void addNamespace(const AtomicString& prefix, const AtomicString& uri);
     QualifiedName determineNameInNamespace(const AtomicString& prefix, const AtomicString& localName);
     void updateSpecifiersWithElementName(const AtomicString& namespacePrefix, const AtomicString& elementName, CSSParserSelector*);
@@ -321,27 +324,20 @@ public:
 
     // tokenizer methods and data
     size_t m_parsedTextPrefixLength;
-    bool m_inStyleRuleOrDeclaration;
-    SourceRange m_selectorListRange;
-    SourceRange m_ruleBodyRange;
     SourceRange m_propertyRange;
     OwnPtr<RuleSourceDataList> m_currentRuleDataStack;
     RuleSourceDataList* m_ruleSourceDataResult;
 
     void fixUnparsedPropertyRanges(CSSRuleSourceData*);
-    void markStyleRuleHeaderStart();
+    void markRuleHeaderStart(CSSRuleSourceData::Type);
     void markRuleHeaderEnd();
-
-    void markSelectorListStart();
-    void markSelectorListEnd();
     void markRuleBodyStart();
     void markRuleBodyEnd();
     void markPropertyStart();
     void markPropertyEnd(bool isImportantFound, bool isPropertyParsed);
+    void processAndAddNewRuleToSourceTreeIfNeeded();
     void addNewRuleToSourceTree(PassRefPtr<CSSRuleSourceData>);
     PassRefPtr<CSSRuleSourceData> popRuleData();
-    void resetSelectorListMarks() { m_selectorListRange.start = m_selectorListRange.end = 0; }
-    void resetRuleBodyMarks() { m_ruleBodyRange.start = m_ruleBodyRange.end = 0; }
     void resetPropertyRange() { m_propertyRange.start = m_propertyRange.end = UINT_MAX; }
     bool isExtractingSourceData() const { return !!m_currentRuleDataStack; }
     int lex(void* yylval);
@@ -383,6 +379,9 @@ private:
 
     bool inShorthand() const { return m_inParseShorthand; }
 
+    bool validWidth(CSSParserValue*);
+    bool validHeight(CSSParserValue*);
+
     void checkForOrphanedUnits();
 
     void deleteFontFaceOnlyValues();
@@ -439,6 +438,8 @@ private:
     OwnPtr<MediaQueryExp> m_floatingMediaQueryExp;
     OwnPtr<Vector<OwnPtr<MediaQueryExp> > > m_floatingMediaQueryExpList;
 
+    OwnPtr<Vector<RefPtr<StyleKeyframe> > > m_floatingKeyframeVector;
+
     Vector<OwnPtr<CSSParserSelector> > m_reusableSelectorVector;
     Vector<OwnPtr<CSSParserSelector> > m_reusableRegionSelectorVector;
 
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index 16e43dc48..5718180f1 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -557,12 +557,7 @@ double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* r
     if (computingFontSize || isFontRelativeLength())
         return result;
 
-    // Any original result that was >= 1 should not be allowed to fall below 1.  This keeps border lines from
-    // vanishing.
-    double zoomedResult = result * multiplier;
-    if (zoomedResult < 1.0 && result >= 1.0)
-        return 1.0;
-    return zoomedResult;
+    return result * multiplier;
 }
 
 void CSSPrimitiveValue::setFloatValue(unsigned short, double, ExceptionCode& ec)
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index 7a3d7154d..76cc8ea1a 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -26,6 +26,10 @@
 #include "RenderStyleConstants.h"
 #include "StylePropertyShorthand.h"
 
+#if ENABLE(CSS_VARIABLES)
+#include "CSSVariableValue.h"
+#endif
+
 namespace WebCore {
 
 struct SameSizeAsCSSProperty {
@@ -35,9 +39,20 @@ struct SameSizeAsCSSProperty {
 
 COMPILE_ASSERT(sizeof(CSSProperty) == sizeof(SameSizeAsCSSProperty), CSSProperty_should_stay_small);
 
+String CSSProperty::cssName() const
+{
+#if ENABLE(CSS_VARIABLES)
+    if (id() == CSSPropertyVariable) {
+        ASSERT(value()->isVariableValue());
+        return "-webkit-var-" + static_cast<CSSVariableValue*>(value())->name();
+    }
+#endif
+    return String(getPropertyName(id()));
+}
+
 String CSSProperty::cssText() const
 {
-    return String(getPropertyName(id())) + ": " + m_value->cssText() + (isImportant() ? " !important" : "") + "; ";
+    return cssName() + ": " + m_value->cssText() + (isImportant() ? " !important" : "") + "; ";
 }
 
 void CSSProperty::wrapValueInCommaSeparatedList()
@@ -552,8 +567,11 @@ bool CSSProperty::isInheritedProperty(CSSPropertyID propertyID)
     case CSSPropertyWebkitAlignItems:
     case CSSPropertyWebkitAlignSelf:
     case CSSPropertyWebkitFlex:
+    case CSSPropertyWebkitFlexBasis:
     case CSSPropertyWebkitFlexDirection:
     case CSSPropertyWebkitFlexFlow:
+    case CSSPropertyWebkitFlexGrow:
+    case CSSPropertyWebkitFlexShrink:
     case CSSPropertyWebkitFlexWrap:
     case CSSPropertyWebkitJustifyContent:
     case CSSPropertyWebkitOrder:
diff --git a/Source/WebCore/css/CSSProperty.h b/Source/WebCore/css/CSSProperty.h
index b746d80b9..712414666 100644
--- a/Source/WebCore/css/CSSProperty.h
+++ b/Source/WebCore/css/CSSProperty.h
@@ -51,6 +51,7 @@ public:
 
     CSSValue* value() const { return m_value.get(); }
 
+    String cssName() const;
     String cssText() const;
 
     void wrapValueInCommaSeparatedList();
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index caaaf0eca..8d44f9808 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -6,7 +6,7 @@
 //
 // Microsoft extensions are documented here:
 // http://msdn.microsoft.com/workshop/author/css/reference/attributes.asp
-//
+// 
 
 // high-priority property names have to be listed first, to simplify the check
 // for applying them first.
@@ -268,8 +268,11 @@ z-index
 -webkit-align-items
 -webkit-align-self
 -webkit-flex
+-webkit-flex-basis
 -webkit-flex-direction
 -webkit-flex-flow
+-webkit-flex-grow
+-webkit-flex-shrink
 -webkit-flex-wrap
 -webkit-justify-content
 #endif
diff --git a/Source/WebCore/css/CSSPropertySourceData.h b/Source/WebCore/css/CSSPropertySourceData.h
index ba676ee33..69ee94da0 100644
--- a/Source/WebCore/css/CSSPropertySourceData.h
+++ b/Source/WebCore/css/CSSPropertySourceData.h
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-class StyleRule;
+class StyleRuleBase;
 
 struct SourceRange {
     SourceRange();
@@ -78,8 +78,6 @@ struct CSSStyleSourceData : public RefCounted<CSSStyleSourceData> {
         return adoptRef(new CSSStyleSourceData());
     }
 
-    // Range of the style text in the enclosing source.
-    SourceRange styleBodyRange;
     Vector<CSSPropertySourceData> propertyData;
 };
 
@@ -87,16 +85,48 @@ struct CSSRuleSourceData;
 typedef Vector<RefPtr<CSSRuleSourceData> > RuleSourceDataList;
 
 struct CSSRuleSourceData : public RefCounted<CSSRuleSourceData> {
-    static PassRefPtr<CSSRuleSourceData> create()
+    enum Type {
+        UNKNOWN_RULE,
+        STYLE_RULE,
+        CHARSET_RULE,
+        IMPORT_RULE,
+        MEDIA_RULE,
+        FONT_FACE_RULE,
+        PAGE_RULE,
+        KEYFRAMES_RULE
+    };
+
+    static PassRefPtr<CSSRuleSourceData> create(Type type)
     {
-        return adoptRef(new CSSRuleSourceData());
+        return adoptRef(new CSSRuleSourceData(type));
     }
 
+    static PassRefPtr<CSSRuleSourceData> createUnknown()
+    {
+        return adoptRef(new CSSRuleSourceData(UNKNOWN_RULE));
+    }
+
+    CSSRuleSourceData(Type type)
+        : type(type)
+    {
+        if (type == STYLE_RULE || type == FONT_FACE_RULE || type == PAGE_RULE)
+            styleSourceData = CSSStyleSourceData::create();
+    }
+
+    Type type;
+
     // Range of the selector list in the enclosing source.
-    SourceRange selectorListRange;
+    SourceRange ruleHeaderRange;
+
+    // Range of the rule body (e.g. style text for style rules) in the enclosing source.
+    SourceRange ruleBodyRange;
+
+    // Only for CSSStyleRules, CSSFontFaceRules, and CSSPageRules.
     RefPtr<CSSStyleSourceData> styleSourceData;
+
+    // Only for CSSMediaRules.
+    RuleSourceDataList childRules;
 };
-typedef HashMap<StyleRule*, RefPtr<CSSRuleSourceData> > StyleRuleRangeMap;
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/css/CSSValue.cpp b/Source/WebCore/css/CSSValue.cpp
index 40a1bc09e..cda43b9cf 100644
--- a/Source/WebCore/css/CSSValue.cpp
+++ b/Source/WebCore/css/CSSValue.cpp
@@ -59,6 +59,10 @@
 #include "WebKitCSSShaderValue.h"
 #include "WebKitCSSTransformValue.h"
 
+#if ENABLE(SVG)
+#include "WebKitCSSSVGDocumentValue.h"
+#endif
+
 namespace WebCore {
 
 struct SameSizeAsCSSValue : public RefCounted<SameSizeAsCSSValue> {
@@ -197,6 +201,8 @@ String CSSValue::cssText() const
         return static_cast<const SVGColor*>(this)->customCssText();
     case SVGPaintClass:
         return static_cast<const SVGPaint*>(this)->customCssText();
+    case WebKitCSSSVGDocumentClass:
+        return static_cast<const WebKitCSSSVGDocumentValue*>(this)->customCssText();
 #endif
     }
     ASSERT_NOT_REACHED();
@@ -331,6 +337,9 @@ void CSSValue::destroy()
     case SVGPaintClass:
         delete static_cast<SVGPaint*>(this);
         return;
+    case WebKitCSSSVGDocumentClass:
+        delete static_cast<WebKitCSSSVGDocumentValue*>(this);
+        return;
 #endif
     }
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index b4e8a89e7..38509614e 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -99,6 +99,7 @@ public:
 #if ENABLE(SVG)
     bool isSVGColor() const { return m_classType == SVGColorClass || m_classType == SVGPaintClass; }
     bool isSVGPaint() const { return m_classType == SVGPaintClass; }
+    bool isWebKitCSSSVGDocumentValue() const { return m_classType == WebKitCSSSVGDocumentClass; }
 #endif
     
     bool isCSSOMSafe() const { return m_isCSSOMSafe; }
@@ -161,6 +162,7 @@ protected:
 #if ENABLE(SVG)
         SVGColorClass,
         SVGPaintClass,
+        WebKitCSSSVGDocumentClass,
 #endif
 
         // List class types must appear after ValueListClass.
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
index 2ad4d207c..006014e61 100644
--- a/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.cpp
@@ -132,19 +132,19 @@ void PropertySetCSSStyleDeclaration::deref()
 
 unsigned PropertySetCSSStyleDeclaration::length() const
 {
-    return m_propertySet->propertyCount();
+    return propertySet()->propertyCount();
 }
 
 String PropertySetCSSStyleDeclaration::item(unsigned i) const
 {
-    if (i >= m_propertySet->propertyCount())
+    if (i >= propertySet()->propertyCount())
         return "";
-    return getPropertyName(m_propertySet->propertyAt(i).id());
+    return getPropertyName(propertySet()->propertyAt(i).id());
 }
 
 String PropertySetCSSStyleDeclaration::cssText() const
 {
-    return m_propertySet->asText();
+    return propertySet()->asText();
 }
     
 void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCode& ec)
@@ -156,7 +156,7 @@ void PropertySetCSSStyleDeclaration::setCssText(const String& text, ExceptionCod
 
     ec = 0;
     // FIXME: Detect syntax errors and set ec.
-    m_propertySet->parseDeclaration(text, contextStyleSheet());
+    ensureMutablePropertySet()->parseDeclaration(text, contextStyleSheet());
 
     didMutate(PropertyChanged);
 
@@ -170,7 +170,7 @@ PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValue(const S
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return 0;
-    return cloneAndCacheForCSSOM(m_propertySet->getPropertyCSSValue(propertyID).get());
+    return cloneAndCacheForCSSOM(propertySet()->getPropertyCSSValue(propertyID).get());
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyName)
@@ -178,7 +178,7 @@ String PropertySetCSSStyleDeclaration::getPropertyValue(const String &propertyNa
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return String();
-    return m_propertySet->getPropertyValue(propertyID);
+    return propertySet()->getPropertyValue(propertyID);
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propertyName)
@@ -186,7 +186,7 @@ String PropertySetCSSStyleDeclaration::getPropertyPriority(const String& propert
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return String();
-    return m_propertySet->propertyIsImportant(propertyID) ? "important" : "";
+    return propertySet()->propertyIsImportant(propertyID) ? "important" : "";
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& propertyName)
@@ -194,7 +194,7 @@ String PropertySetCSSStyleDeclaration::getPropertyShorthand(const String& proper
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return String();
-    CSSPropertyID shorthandID = m_propertySet->getPropertyShorthand(propertyID);
+    CSSPropertyID shorthandID = propertySet()->getPropertyShorthand(propertyID);
     if (!shorthandID)
         return String();
     return getPropertyName(shorthandID);
@@ -205,7 +205,7 @@ bool PropertySetCSSStyleDeclaration::isPropertyImplicit(const String& propertyNa
     CSSPropertyID propertyID = cssPropertyID(propertyName);
     if (!propertyID)
         return false;
-    return m_propertySet->isPropertyImplicit(propertyID);
+    return propertySet()->isPropertyImplicit(propertyID);
 }
 
 void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, const String& value, const String& priority, ExceptionCode& ec)
@@ -222,7 +222,7 @@ void PropertySetCSSStyleDeclaration::setProperty(const String& propertyName, con
     willMutate();
 
     ec = 0;
-    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
+    bool changed = ensureMutablePropertySet()->setProperty(propertyID, value, important, contextStyleSheet());
 
     didMutate(changed ? PropertyChanged : NoChanges);
 
@@ -248,7 +248,7 @@ String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName
 
     ec = 0;
     String result;
-    bool changed = m_propertySet->removeProperty(propertyID, &result);
+    bool changed = ensureMutablePropertySet()->removeProperty(propertyID, &result);
 
     didMutate(changed ? PropertyChanged : NoChanges);
 
@@ -262,12 +262,12 @@ String PropertySetCSSStyleDeclaration::removeProperty(const String& propertyName
 
 PassRefPtr<CSSValue> PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal(CSSPropertyID propertyID)
 {
-    return m_propertySet->getPropertyCSSValue(propertyID);
+    return propertySet()->getPropertyCSSValue(propertyID);
 }
 
 String PropertySetCSSStyleDeclaration::getPropertyValueInternal(CSSPropertyID propertyID)
 { 
-    return m_propertySet->getPropertyValue(propertyID); 
+    return propertySet()->getPropertyValue(propertyID);
 }
 
 void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyID, const String& value, bool important, ExceptionCode& ec)
@@ -278,7 +278,7 @@ void PropertySetCSSStyleDeclaration::setPropertyInternal(CSSPropertyID propertyI
     willMutate();
 
     ec = 0;
-    bool changed = m_propertySet->setProperty(propertyID, value, important, contextStyleSheet());
+    bool changed = ensureMutablePropertySet()->setProperty(propertyID, value, important, contextStyleSheet());
 
     didMutate(changed ? PropertyChanged : NoChanges);
 
@@ -313,17 +313,17 @@ StyleSheetContents* PropertySetCSSStyleDeclaration::contextStyleSheet() const
 
 PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::copy() const
 {
-    return m_propertySet->copy();
+    return propertySet()->copy();
 }
 
 PassRefPtr<StylePropertySet> PropertySetCSSStyleDeclaration::makeMutable()
 {
-    return m_propertySet;
+    return ensureMutablePropertySet();
 }
 
 bool PropertySetCSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
 {
-    return m_propertySet->propertyMatches(property);
+    return propertySet()->propertyMatches(property);
 }
     
 StyleRuleCSSStyleDeclaration::StyleRuleCSSStyleDeclaration(StylePropertySet* propertySet, CSSRule* parentRule)
@@ -389,6 +389,7 @@ void InlineCSSStyleDeclaration::didMutate(MutationType type)
 
     if (!m_parentElement)
         return;
+
     m_parentElement->setNeedsStyleRecalc(InlineStyleChange);
     m_parentElement->invalidateStyleAttribute();
     StyleAttributeMutationScope(this).didInvalidateStyleAttr();
@@ -399,4 +400,10 @@ CSSStyleSheet* InlineCSSStyleDeclaration::parentStyleSheet() const
     return m_parentElement ? m_parentElement->document()->elementSheet() : 0;
 }
 
+StylePropertySet* InlineCSSStyleDeclaration::ensureMutablePropertySet()
+{
+    ASSERT(m_propertySet);
+    return m_propertySet;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
index caf63bd48..44b73de6f 100644
--- a/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
+++ b/Source/WebCore/css/PropertySetCSSStyleDeclaration.h
@@ -48,6 +48,10 @@ public:
     virtual void ref() OVERRIDE;
     virtual void deref() OVERRIDE;
 
+protected:
+    const StylePropertySet* propertySet() const { return m_propertySet; }
+    virtual StylePropertySet* ensureMutablePropertySet() { return m_propertySet; }
+
 private:
     virtual CSSRule* parentRule() const OVERRIDE { return 0; };
     virtual unsigned length() const OVERRIDE;
@@ -106,6 +110,8 @@ private:
     virtual void willMutate() OVERRIDE;
     virtual void didMutate(MutationType) OVERRIDE;
 
+    virtual StylePropertySet* ensureMutablePropertySet() OVERRIDE { return m_propertySet; }
+
     unsigned m_refCount;
     CSSRule* m_parentRule;
 };
@@ -125,6 +131,8 @@ private:
     virtual void clearParentElement() OVERRIDE { m_parentElement = 0; }
 
     virtual void didMutate(MutationType) OVERRIDE;
+
+    virtual StylePropertySet* ensureMutablePropertySet() OVERRIDE;
     
     StyledElement* m_parentElement;
 };
diff --git a/Source/WebCore/css/StyleBuilder.cpp b/Source/WebCore/css/StyleBuilder.cpp
index 20d02cc15..16f08d6d0 100644
--- a/Source/WebCore/css/StyleBuilder.cpp
+++ b/Source/WebCore/css/StyleBuilder.cpp
@@ -600,7 +600,16 @@ public:
             length = 5;
         } else if (ident == CSSValueInvalid) {
             float zoom = (svgZoomEnabled && styleResolver->useSVGZoomRules()) ? 1.0f : styleResolver->style()->effectiveZoom();
-            length = primitiveValue->computeLength<T>(styleResolver->style(), styleResolver->rootElementStyle(), zoom);
+
+            // Any original result that was >= 1 should not be allowed to fall below 1.
+            // This keeps border lines from vanishing.
+            length = primitiveValue->computeLength<T>(styleResolver->style(), styleResolver->rootElementStyle(), 1.0);
+            T zoomedLength = length * zoom;
+            if (zoom < 1.0f && zoomedLength < 1.0 && length >= 1.0)
+                length = 1.0;
+            else
+                length = zoomedLength;
+
         } else {
             ASSERT_NOT_REACHED();
             length = 0;
@@ -1716,69 +1725,28 @@ public:
     }
 };
 
-class ApplyPropertyFlex {
+#if ENABLE(CSS_EXCLUSIONS)
+template <CSSWrapShape* (RenderStyle::*getterFunction)() const, void (RenderStyle::*setterFunction)(PassRefPtr<CSSWrapShape>), CSSWrapShape* (*initialFunction)()>
+class ApplyPropertyWrapShape {
 public:
-    static void applyInheritValue(StyleResolver* styleResolver)
-    {
-        ApplyPropertyDefaultBase<float, &RenderStyle::flexGrow, float, &RenderStyle::setFlexGrow, float, &RenderStyle::initialFlexGrow>::applyInheritValue(styleResolver);
-        ApplyPropertyDefaultBase<float, &RenderStyle::flexShrink, float, &RenderStyle::setFlexShrink, float, &RenderStyle::initialFlexShrink>::applyInheritValue(styleResolver);
-        ApplyPropertyDefaultBase<Length, &RenderStyle::flexBasis, Length, &RenderStyle::setFlexBasis, Length, &RenderStyle::initialFlexBasis>::applyInheritValue(styleResolver);
-    }
-
-    static void applyInitialValue(StyleResolver* styleResolver)
-    {
-        styleResolver->style()->setFlexGrow(RenderStyle::initialFlexGrow());
-        styleResolver->style()->setFlexShrink(RenderStyle::initialFlexShrink());
-        styleResolver->style()->setFlexBasis(RenderStyle::initialFlexBasis());
-    }
-
+    static void setValue(RenderStyle* style, PassRefPtr<CSSWrapShape> value) { (style->*setterFunction)(value); }
     static void applyValue(StyleResolver* styleResolver, CSSValue* value)
     {
         if (value->isPrimitiveValue()) {
             CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-            if (primitiveValue->getIdent() == CSSValueNone) {
-                styleResolver->style()->setFlexGrow(0);
-                styleResolver->style()->setFlexShrink(0);
-                styleResolver->style()->setFlexBasis(Length(Auto));
-            }
-            return;
+            if (primitiveValue->getIdent() == CSSValueAuto)
+                setValue(styleResolver->style(), 0);
+            else if (primitiveValue->isShape())
+                setValue(styleResolver->style(), primitiveValue->getShapeValue());
         }
-
-        if (!value->isValueList())
-            return;
-        CSSValueList* valueList = static_cast<CSSValueList*>(value);
-        if (valueList->length() != 3)
-            return;
-
-        float flexValue = 0;
-        if (!getFlexValue(valueList->itemWithoutBoundsCheck(0), flexValue))
-            return;
-        styleResolver->style()->setFlexGrow(flexValue);
-
-        if (!getFlexValue(valueList->itemWithoutBoundsCheck(1), flexValue))
-            return;
-        styleResolver->style()->setFlexShrink(flexValue);
-
-        ApplyPropertyLength<&RenderStyle::flexBasis, &RenderStyle::setFlexBasis, &RenderStyle::initialFlexBasis, AutoEnabled>::applyValue(styleResolver, valueList->itemWithoutBoundsCheck(2));
     }
-
     static PropertyHandler createHandler()
     {
-        return PropertyHandler(&applyInheritValue, &applyInitialValue, &applyValue);
-    }
-private:
-    static bool getFlexValue(CSSValue* value, float& flexValue)
-    {
-        if (!value->isPrimitiveValue())
-            return false;
-        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-        if (!primitiveValue->isNumber())
-            return false;
-        flexValue = primitiveValue->getFloatValue();
-        return true;
+        PropertyHandler handler = ApplyPropertyDefaultBase<CSSWrapShape*, getterFunction, PassRefPtr<CSSWrapShape>, setterFunction, CSSWrapShape*, initialFunction>::createHandler();
+        return PropertyHandler(handler.inheritFunction(), handler.initialFunction(), &applyValue);
     }
-
 };
+#endif
 
 #if ENABLE(CSS_IMAGE_RESOLUTION)
 class ApplyPropertyImageResolution {
@@ -2007,9 +1975,10 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyWebkitAlignContent, ApplyPropertyDefault<EAlignContent, &RenderStyle::alignContent, EAlignContent, &RenderStyle::setAlignContent, EAlignContent, &RenderStyle::initialAlignContent>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAlignItems, ApplyPropertyDefault<EAlignItems, &RenderStyle::alignItems, EAlignItems, &RenderStyle::setAlignItems, EAlignItems, &RenderStyle::initialAlignItems>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAlignSelf, ApplyPropertyDefault<EAlignItems, &RenderStyle::alignSelf, EAlignItems, &RenderStyle::setAlignSelf, EAlignItems, &RenderStyle::initialAlignSelf>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlex, ApplyPropertyFlex::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexBasis, ApplyPropertyLength<&RenderStyle::flexBasis, &RenderStyle::setFlexBasis, &RenderStyle::initialFlexBasis, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexDirection, ApplyPropertyDefault<EFlexDirection, &RenderStyle::flexDirection, EFlexDirection, &RenderStyle::setFlexDirection, EFlexDirection, &RenderStyle::initialFlexDirection>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexGrow, ApplyPropertyDefault<float, &RenderStyle::flexGrow, float, &RenderStyle::setFlexGrow, float, &RenderStyle::initialFlexGrow>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexShrink, ApplyPropertyDefault<float, &RenderStyle::flexShrink, float, &RenderStyle::setFlexShrink, float, &RenderStyle::initialFlexShrink>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
     setPropertyHandler(CSSPropertyWebkitJustifyContent, ApplyPropertyDefault<EJustifyContent, &RenderStyle::justifyContent, EJustifyContent, &RenderStyle::setJustifyContent, EJustifyContent, &RenderStyle::initialJustifyContent>::createHandler());
     setPropertyHandler(CSSPropertyWebkitOrder, ApplyPropertyDefault<float, &RenderStyle::order, float, &RenderStyle::setOrder, float, &RenderStyle::initialOrder>::createHandler());
@@ -2094,6 +2063,8 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyWebkitWrapMargin, ApplyPropertyLength<&RenderStyle::wrapMargin, &RenderStyle::setWrapMargin, &RenderStyle::initialWrapMargin>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapPadding, ApplyPropertyLength<&RenderStyle::wrapPadding, &RenderStyle::setWrapPadding, &RenderStyle::initialWrapPadding>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapThrough, ApplyPropertyDefault<WrapThrough, &RenderStyle::wrapThrough, WrapThrough, &RenderStyle::setWrapThrough, WrapThrough, &RenderStyle::initialWrapThrough>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitShapeInside, ApplyPropertyWrapShape<&RenderStyle::wrapShapeInside, &RenderStyle::setWrapShapeInside, &RenderStyle::initialWrapShapeInside>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitShapeOutside, ApplyPropertyWrapShape<&RenderStyle::wrapShapeOutside, &RenderStyle::setWrapShapeOutside, &RenderStyle::initialWrapShapeOutside>::createHandler());
 #endif
     setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
     setPropertyHandler(CSSPropertyWidows, ApplyPropertyDefault<short, &RenderStyle::widows, short, &RenderStyle::setWidows, short, &RenderStyle::initialWidows>::createHandler());
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index 60afd5e70..0c25a5a9c 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -162,6 +162,8 @@ String StylePropertySet::getPropertyValue(CSSPropertyID propertyID) const
     case CSSPropertyBorderStyle:
         return get4Values(borderStyleShorthand());
 #if ENABLE(CSS3_FLEXBOX)
+    case CSSPropertyWebkitFlex:
+        return getShorthandValue(webkitFlexShorthand());
     case CSSPropertyWebkitFlexFlow:
         return getShorthandValue(webkitFlexFlowShorthand());
 #endif
@@ -660,6 +662,11 @@ String StylePropertySet::asText() const
         String value;
 
         switch (propertyID) {
+#if ENABLE(CSS_VARIABLES)
+        case CSSPropertyVariable:
+            result.append(prop.cssText());
+            continue;
+#endif
         case CSSPropertyBackgroundPositionX:
             positionXProp = &prop;
             continue;
@@ -755,6 +762,11 @@ String StylePropertySet::asText() const
         case CSSPropertyWebkitFlexWrap:
             shorthandPropertyID = CSSPropertyWebkitFlexFlow;
             break;
+        case CSSPropertyWebkitFlexBasis:
+        case CSSPropertyWebkitFlexGrow:
+        case CSSPropertyWebkitFlexShrink:
+            shorthandPropertyID = CSSPropertyWebkitFlex;
+            break;
 #endif
         case CSSPropertyWebkitMaskPositionX:
         case CSSPropertyWebkitMaskPositionY:
diff --git a/Source/WebCore/css/StylePropertyShorthand.cpp b/Source/WebCore/css/StylePropertyShorthand.cpp
index 2265248e7..045bd24f0 100644
--- a/Source/WebCore/css/StylePropertyShorthand.cpp
+++ b/Source/WebCore/css/StylePropertyShorthand.cpp
@@ -314,6 +314,13 @@ const StylePropertyShorthand& webkitFlexFlowShorthand()
     DEFINE_STATIC_LOCAL(StylePropertyShorthand, webkitFlexFlowLonghands, (flexFlowProperties, WTF_ARRAY_LENGTH(flexFlowProperties)));
     return webkitFlexFlowLonghands;
 }
+
+const StylePropertyShorthand& webkitFlexShorthand()
+{
+    static const CSSPropertyID flexProperties[] = { CSSPropertyWebkitFlexGrow, CSSPropertyWebkitFlexShrink, CSSPropertyWebkitFlexBasis };
+    DEFINE_STATIC_LOCAL(StylePropertyShorthand, webkitFlexLonghands, (flexProperties, WTF_ARRAY_LENGTH(flexProperties)));
+    return webkitFlexLonghands;
+}
 #endif
 
 const StylePropertyShorthand& webkitMarginCollapseShorthand()
@@ -480,6 +487,8 @@ const StylePropertyShorthand& shorthandForProperty(CSSPropertyID propertyID)
     case CSSPropertyWebkitColumnRule:
         return webkitColumnRuleShorthand();
 #if ENABLE(CSS3_FLEXBOX)
+    case CSSPropertyWebkitFlex:
+        return webkitFlexShorthand();
     case CSSPropertyWebkitFlexFlow:
         return webkitFlexFlowShorthand();
 #endif
diff --git a/Source/WebCore/css/StylePropertyShorthand.h b/Source/WebCore/css/StylePropertyShorthand.h
index a0585381f..ee331c732 100644
--- a/Source/WebCore/css/StylePropertyShorthand.h
+++ b/Source/WebCore/css/StylePropertyShorthand.h
@@ -88,6 +88,7 @@ const StylePropertyShorthand& webkitColumnsShorthand();
 const StylePropertyShorthand& webkitColumnRuleShorthand();
 #if ENABLE(CSS3_FLEXBOX)
 const StylePropertyShorthand& webkitFlexFlowShorthand();
+const StylePropertyShorthand& webkitFlexShorthand();
 #endif
 const StylePropertyShorthand& webkitMarginCollapseShorthand();
 const StylePropertyShorthand& webkitMarqueeShorthand();
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index de3a0a9bd..8bc5efee8 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -136,8 +136,12 @@
 #endif
 
 #if ENABLE(SVG)
+#include "CachedSVGDocument.h"
+#include "SVGDocument.h"
 #include "SVGElement.h"
 #include "SVGNames.h"
+#include "SVGURIReference.h"
+#include "WebKitCSSSVGDocumentValue.h"
 #endif
 
 #if ENABLE(CSS_SHADERS)
@@ -1793,14 +1797,9 @@ PassRefPtr<RenderStyle> StyleResolver::styleForKeyframe(const RenderStyle* eleme
     // go ahead and update it a second time.
     updateFont();
 
-    // Start loading images referenced by this style.
-    loadPendingImages();
+    // Start loading resources referenced by this style.
+    loadPendingResources();
     
-#if ENABLE(CSS_SHADERS)
-    // Start loading the shaders referenced by this style.
-    loadPendingShaders();
-#endif
-
     // Add all the animating properties to the keyframe.
     if (StylePropertySet* styleDeclaration = keyframe->properties()) {
         unsigned propertyCount = styleDeclaration->propertyCount();
@@ -1914,13 +1913,8 @@ PassRefPtr<RenderStyle> StyleResolver::pseudoStyleForElement(PseudoId pseudo, El
     // Clean up our style object's display and text decorations (among other fixups).
     adjustRenderStyle(style(), parentStyle, 0);
 
-    // Start loading images referenced by this style.
-    loadPendingImages();
-
-#if ENABLE(CSS_SHADERS)
-    // Start loading the shaders referenced by this style.
-    loadPendingShaders();
-#endif
+    // Start loading resources referenced by this style.
+    loadPendingResources();
 
     // Now return the style.
     return m_style.release();
@@ -1958,13 +1952,8 @@ PassRefPtr<RenderStyle> StyleResolver::styleForPage(int pageIndex)
 
     applyMatchedProperties<LowPriorityProperties>(result, false, 0, result.matchedProperties.size() - 1, inheritedOnly);
 
-    // Start loading images referenced by this style.
-    loadPendingImages();
-
-#if ENABLE(CSS_SHADERS)
-    // Start loading the shaders referenced by this style.
-    loadPendingShaders();
-#endif
+    // Start loading resources referenced by this style.
+    loadPendingResources();
 
     // Now return the style.
     return m_style.release();
@@ -1992,36 +1981,6 @@ static void addIntrinsicMargins(RenderStyle* style)
     }
 }
 
-static bool shouldBecomeBlockWhenParentIsFlexbox(const Element* element)
-{
-    return element->hasTagName(imgTag)
-        || element->hasTagName(canvasTag)
-#if ENABLE(SVG)
-        || element->hasTagName(SVGNames::svgTag)
-#endif
-#if ENABLE(MATHML)
-        || element->hasTagName(MathMLNames::mathTag)
-#endif
-#if ENABLE(VIDEO)
-        || element->hasTagName(audioTag)
-        || element->hasTagName(videoTag)
-#endif
-        || element->hasTagName(iframeTag)
-        || element->hasTagName(objectTag)
-        || element->hasTagName(embedTag)
-        || element->hasTagName(appletTag)
-#if ENABLE(PROGRESS_TAG)
-        || element->hasTagName(progressTag)
-#endif
-#if ENABLE(METER_TAG)
-        || element->hasTagName(meterTag)
-#endif
-        || element->hasTagName(inputTag)
-        || element->hasTagName(buttonTag)
-        || element->hasTagName(selectTag)
-        || element->hasTagName(textareaTag);
-}
-
 static EDisplay equivalentBlockDisplay(EDisplay display, bool isFloating, bool strictParsing)
 {
     switch (display) {
@@ -2166,12 +2125,8 @@ void StyleResolver::adjustRenderStyle(RenderStyle* style, RenderStyle* parentSty
         if (style->writingMode() != TopToBottomWritingMode && (style->display() == BOX || style->display() == INLINE_BOX))
             style->setWritingMode(TopToBottomWritingMode);
 
-        if (e && e->parentNode() && e->parentNode()->renderer() && e->parentNode()->renderer()->isFlexibleBox()) {
-            if (shouldBecomeBlockWhenParentIsFlexbox(e))
-                style->setDisplay(BLOCK);
-            else if (style->display() != INLINE)
-                style->setDisplay(equivalentBlockDisplay(style->display(), style->isFloating(), m_checker.strictParsing()));
-        }
+        if (e && e->parentNode() && e->parentNode()->renderer() && e->parentNode()->renderer()->isFlexibleBox())
+            style->setDisplay(equivalentBlockDisplay(style->display(), style->isFloating(), m_checker.strictParsing()));
     }
 
     // Make sure our z-index value is only applied if the object is positioned.
@@ -3009,12 +2964,9 @@ void StyleResolver::applyMatchedProperties(const MatchResult& matchResult, const
     applyMatchedProperties<LowPriorityProperties>(matchResult, true, matchResult.ranges.firstAuthorRule, matchResult.ranges.lastAuthorRule, applyInheritedOnly);
     applyMatchedProperties<LowPriorityProperties>(matchResult, true, matchResult.ranges.firstUserRule, matchResult.ranges.lastUserRule, applyInheritedOnly);
     applyMatchedProperties<LowPriorityProperties>(matchResult, true, matchResult.ranges.firstUARule, matchResult.ranges.lastUARule, applyInheritedOnly);
-    
-    loadPendingImages();
-    
-#if ENABLE(CSS_SHADERS)
-    loadPendingShaders();
-#endif
+   
+    // Start loading resources referenced by this style.
+    loadPendingResources();
     
     ASSERT(!m_fontDirty);
     
@@ -3983,6 +3935,19 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
         return;
     }
 #endif
+#if ENABLE(CSS3_FLEXBOX)
+    case CSSPropertyWebkitFlex:
+        if (isInherit) {
+            m_style->setFlexGrow(m_parentStyle->flexGrow());
+            m_style->setFlexShrink(m_parentStyle->flexShrink());
+            m_style->setFlexBasis(m_parentStyle->flexBasis());
+        } else if (isInitial) {
+            m_style->setFlexGrow(RenderStyle::initialFlexGrow());
+            m_style->setFlexShrink(RenderStyle::initialFlexShrink());
+            m_style->setFlexBasis(RenderStyle::initialFlexBasis());
+        }
+        return;
+#endif
     case CSSPropertyInvalid:
         return;
     // Directional properties are resolved by resolveDirectionAwareProperty() before the switch.
@@ -4075,27 +4040,7 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
         m_style->setLineBoxContain(lineBoxContainValue->value());
         return;
     }
-#if ENABLE(CSS_EXCLUSIONS)
-    case CSSPropertyWebkitShapeInside:
-        HANDLE_INHERIT_AND_INITIAL(wrapShapeInside, WrapShapeInside);
-        if (!primitiveValue)
-            return;
-        if (primitiveValue->getIdent() == CSSValueAuto)
-            m_style->setWrapShapeInside(0);
-        else if (primitiveValue->isShape())
-            m_style->setWrapShapeInside(primitiveValue->getShapeValue());
-        return;
 
-    case CSSPropertyWebkitShapeOutside:
-        HANDLE_INHERIT_AND_INITIAL(wrapShapeOutside, WrapShapeOutside);
-        if (!primitiveValue)
-            return;
-        if (primitiveValue->getIdent() == CSSValueAuto)
-            m_style->setWrapShapeOutside(0);
-        else if (primitiveValue->isShape())
-            m_style->setWrapShapeOutside(primitiveValue->getShapeValue());
-        return;
-#endif
     // CSS Fonts Module Level 3
     case CSSPropertyWebkitFontFeatureSettings: {
         if (primitiveValue && primitiveValue->getIdent() == CSSValueNormal) {
@@ -4332,9 +4277,11 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
     case CSSPropertyWebkitAlignContent:
     case CSSPropertyWebkitAlignItems:
     case CSSPropertyWebkitAlignSelf:
-    case CSSPropertyWebkitFlex:
+    case CSSPropertyWebkitFlexBasis:
     case CSSPropertyWebkitFlexDirection:
     case CSSPropertyWebkitFlexFlow:
+    case CSSPropertyWebkitFlexGrow:
+    case CSSPropertyWebkitFlexShrink:
     case CSSPropertyWebkitFlexWrap:
     case CSSPropertyWebkitJustifyContent:
     case CSSPropertyWebkitOrder:
@@ -4414,6 +4361,8 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
     case CSSPropertyWebkitWrapMargin:
     case CSSPropertyWebkitWrapPadding:
     case CSSPropertyWebkitWrapThrough:
+    case CSSPropertyWebkitShapeInside:
+    case CSSPropertyWebkitShapeOutside:
 #endif
     case CSSPropertyWhiteSpace:
     case CSSPropertyWidows:
@@ -5095,6 +5044,34 @@ static FilterOperation::OperationType filterOperationForType(WebKitCSSFilterValu
     return FilterOperation::NONE;
 }
 
+#if ENABLE(CSS_FILTERS) && ENABLE(SVG)
+void StyleResolver::loadPendingSVGDocuments()
+{
+    if (!m_style->hasFilter() || m_pendingSVGDocuments.isEmpty())
+        return;
+
+    CachedResourceLoader* cachedResourceLoader = m_element->document()->cachedResourceLoader();
+    Vector<RefPtr<FilterOperation> >& filterOperations = m_style->filter().operations();
+    for (unsigned i = 0; i < filterOperations.size(); ++i) {
+        RefPtr<FilterOperation> filterOperation = filterOperations.at(i);
+        if (filterOperation->getOperationType() == FilterOperation::REFERENCE) {
+            ReferenceFilterOperation* referenceFilter = static_cast<ReferenceFilterOperation*>(filterOperation.get());
+
+            WebKitCSSSVGDocumentValue* value = m_pendingSVGDocuments.get(referenceFilter);
+            if (!value)
+                continue;
+            CachedSVGDocument* cachedDocument = value->load(cachedResourceLoader);
+            if (!cachedDocument)
+                continue;
+
+            // Stash the CachedSVGDocument on the reference filter.
+            referenceFilter->setData(cachedDocument);
+        }
+    }
+    m_pendingSVGDocuments.clear();
+}
+#endif
+
 #if ENABLE(CSS_SHADERS)
 StyleShader* StyleResolver::styleShader(CSSValue* value)
 {
@@ -5340,6 +5317,29 @@ bool StyleResolver::createFilterOperations(CSSValue* inValue, RenderStyle* style
             continue;
         }
 #endif
+        if (operationType == FilterOperation::REFERENCE) {
+#if ENABLE(SVG)
+            if (filterValue->length() != 1)
+                continue;
+            CSSValue* argument = filterValue->itemWithoutBoundsCheck(0);
+
+            if (!argument->isWebKitCSSSVGDocumentValue())
+                continue;
+
+            WebKitCSSSVGDocumentValue* svgDocumentValue = static_cast<WebKitCSSSVGDocumentValue*>(argument);
+            KURL url = m_element->document()->completeURL(svgDocumentValue->url());
+
+            RefPtr<ReferenceFilterOperation> operation = ReferenceFilterOperation::create(svgDocumentValue->url(), url.fragmentIdentifier(), operationType);
+            if (SVGURIReference::isExternalURIReference(svgDocumentValue->url(), m_element->document())) {
+                if (!svgDocumentValue->loadRequested())
+                    m_pendingSVGDocuments.set(operation.get(), svgDocumentValue);
+                else
+                    operation->setData(svgDocumentValue->cachedSVGDocument());
+            }
+            operations.operations().append(operation);
+#endif
+            continue;
+        }
 
         // Check that all parameters are primitive values, with the
         // exception of drop shadow which has a ShadowValue parameter.
@@ -5357,11 +5357,6 @@ bool StyleResolver::createFilterOperations(CSSValue* inValue, RenderStyle* style
 
         CSSPrimitiveValue* firstValue = filterValue->length() ? static_cast<CSSPrimitiveValue*>(filterValue->itemWithoutBoundsCheck(0)) : 0;
         switch (filterValue->operationType()) {
-        case WebKitCSSFilterValue::ReferenceFilterOperation: {
-            if (firstValue)
-                operations.operations().append(ReferenceFilterOperation::create(firstValue->getStringValue(), operationType));
-            break;
-        }
         case WebKitCSSFilterValue::GrayscaleFilterOperation:
         case WebKitCSSFilterValue::SepiaFilterOperation:
         case WebKitCSSFilterValue::SaturateFilterOperation: {
@@ -5546,4 +5541,20 @@ void StyleResolver::loadPendingImages()
     m_pendingImageProperties.clear();
 }
 
+void StyleResolver::loadPendingResources()
+{
+    // Start loading images referenced by this style.
+    loadPendingImages();
+
+#if ENABLE(CSS_SHADERS)
+    // Start loading the shaders referenced by this style.
+    loadPendingShaders();
+#endif
+    
+#if ENABLE(CSS_FILTERS) && ENABLE(SVG)
+    // Start loading the SVG Documents referenced by this style.
+    loadPendingSVGDocuments();
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/css/StyleResolver.h b/Source/WebCore/css/StyleResolver.h
index 4843eb53a..b653e8444 100644
--- a/Source/WebCore/css/StyleResolver.h
+++ b/Source/WebCore/css/StyleResolver.h
@@ -87,6 +87,7 @@ class StyleSheetList;
 class StyledElement;
 class WebKitCSSFilterValue;
 class WebKitCSSShaderValue;
+class WebKitCSSSVGDocumentValue;
 
 #if ENABLE(CSS_SHADERS)
 typedef Vector<RefPtr<CustomFilterParameter> > CustomFilterParameterList;
@@ -262,8 +263,13 @@ public:
     PassRefPtr<CustomFilterOperation> createCustomFilterOperation(WebKitCSSFilterValue*);
     void loadPendingShaders();
 #endif
+#if ENABLE(SVG)
+    void loadPendingSVGDocuments();
+#endif
 #endif // ENABLE(CSS_FILTERS)
 
+    void loadPendingResources();
+
     struct RuleFeature {
         RuleFeature(StyleRule* rule, CSSSelector* selector, bool hasDocumentSecurityOrigin)
             : rule(rule)
@@ -495,6 +501,10 @@ private:
     bool m_hasPendingShaders;
 #endif
 
+#if ENABLE(CSS_FILTERS) && ENABLE(SVG)
+    HashMap<FilterOperation*, WebKitCSSSVGDocumentValue*> m_pendingSVGDocuments;
+#endif
+
 #if ENABLE(STYLE_SCOPED)
     const ContainerNode* determineScope(const CSSStyleSheet*);
 
diff --git a/Source/WebCore/css/StyleRule.cpp b/Source/WebCore/css/StyleRule.cpp
index 20b290503..3427f0559 100644
--- a/Source/WebCore/css/StyleRule.cpp
+++ b/Source/WebCore/css/StyleRule.cpp
@@ -285,8 +285,9 @@ StyleRuleMedia::StyleRuleMedia(PassRefPtr<MediaQuerySet> media, Vector<RefPtr<St
 
 StyleRuleMedia::StyleRuleMedia(const StyleRuleMedia& o)
     : StyleRuleBlock(o)
-    , m_mediaQueries(o.m_mediaQueries->copy())
 {
+    if (o.m_mediaQueries)
+        m_mediaQueries = o.m_mediaQueries->copy();
 }
 
 StyleRuleRegion::StyleRuleRegion(Vector<OwnPtr<CSSParserSelector> >* selectors, Vector<RefPtr<StyleRuleBase> >& adoptRules)
diff --git a/Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp b/Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp
new file mode 100644
index 000000000..490250496
--- /dev/null
+++ b/Source/WebCore/css/WebKitCSSSVGDocumentValue.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "WebKitCSSSVGDocumentValue.h"
+
+#include "CSSParser.h"
+#include "CachedResourceLoader.h"
+#include "Document.h"
+
+namespace WebCore {
+
+WebKitCSSSVGDocumentValue::WebKitCSSSVGDocumentValue(const String& url)
+    : CSSValue(WebKitCSSSVGDocumentClass)
+    , m_url(url)
+    , m_loadRequested(false)
+{
+}
+
+WebKitCSSSVGDocumentValue::~WebKitCSSSVGDocumentValue()
+{
+}
+
+CachedSVGDocument* WebKitCSSSVGDocumentValue::load(CachedResourceLoader* loader)
+{
+    ASSERT(loader);
+
+    if (!m_loadRequested) {
+        m_loadRequested = true;
+
+        ResourceRequest request(loader->document()->completeURL(m_url));
+        m_document = loader->requestSVGDocument(request);
+    }
+
+    return m_document.get();
+}
+
+String WebKitCSSSVGDocumentValue::customCssText() const
+{
+    return quoteCSSStringIfNeeded(m_url);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/Source/WebCore/css/WebKitCSSSVGDocumentValue.h b/Source/WebCore/css/WebKitCSSSVGDocumentValue.h
new file mode 100644
index 000000000..cb03f56ee
--- /dev/null
+++ b/Source/WebCore/css/WebKitCSSSVGDocumentValue.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebKitCSSSVGDocumentValue_h
+#define WebKitCSSSVGDocumentValue_h
+
+#include "CSSValue.h"
+#include "CachedResourceHandle.h"
+#include "CachedSVGDocument.h"
+
+namespace WebCore {
+
+class CachedResourceLoader;
+
+class WebKitCSSSVGDocumentValue : public CSSValue {
+public:
+    static PassRefPtr<WebKitCSSSVGDocumentValue> create(const String& url) { return adoptRef(new WebKitCSSSVGDocumentValue(url)); }
+    ~WebKitCSSSVGDocumentValue();
+
+    CachedSVGDocument* cachedSVGDocument() const { return m_document.get(); }
+    CachedSVGDocument* load(CachedResourceLoader*);
+
+    String customCssText() const;
+    const String& url() const { return m_url; }
+    bool loadRequested() const { return m_loadRequested; }
+
+private:
+    WebKitCSSSVGDocumentValue(const String& url);
+
+    String m_url;
+    CachedResourceHandle<CachedSVGDocument> m_document;
+    bool m_loadRequested;
+};
+
+} // namespace WebCore
+
+#endif // WebKitCSSSVGDocumentValue_h
diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
index 76198fbe5..225a1399d 100644
--- a/Source/WebCore/dom/CharacterData.cpp
+++ b/Source/WebCore/dom/CharacterData.cpp
@@ -26,13 +26,13 @@
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "InspectorInstrumentation.h"
+#include "MemoryInstrumentation.h"
 #include "MutationEvent.h"
 #include "MutationObserverInterestGroup.h"
 #include "MutationRecord.h"
 #include "NodeRenderingContext.h"
 #include "RenderText.h"
 #include "TextBreakIterator.h"
-#include "WebKitMutationObserver.h"
 
 using namespace std;
 
@@ -92,6 +92,13 @@ unsigned CharacterData::parserAppendData(const UChar* data, unsigned dataLength,
     return end;
 }
 
+void CharacterData::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+    Node::reportMemoryUsage(memoryObjectInfo);
+    memoryObjectInfo->reportString(m_data);
+}
+
 void CharacterData::appendData(const String& data, ExceptionCode&)
 {
     String newStr = m_data;
diff --git a/Source/WebCore/dom/CharacterData.h b/Source/WebCore/dom/CharacterData.h
index 5eaedf3ce..5e413a95c 100644
--- a/Source/WebCore/dom/CharacterData.h
+++ b/Source/WebCore/dom/CharacterData.h
@@ -47,6 +47,8 @@ public:
     // Returns how much could be added before length limit was met.
     unsigned parserAppendData(const UChar*, unsigned dataLength, unsigned lengthLimit);
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const;
+
 protected:
     CharacterData(Document* document, const String& text, ConstructionType type)
         : Node(document, type)
diff --git a/Source/WebCore/dom/ChildListMutationScope.h b/Source/WebCore/dom/ChildListMutationScope.h
index 6dd523640..bce26751c 100644
--- a/Source/WebCore/dom/ChildListMutationScope.h
+++ b/Source/WebCore/dom/ChildListMutationScope.h
@@ -34,8 +34,8 @@
 #if ENABLE(MUTATION_OBSERVERS)
 
 #include "Document.h"
+#include "MutationObserver.h"
 #include "Node.h"
-#include "WebKitMutationObserver.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -46,7 +46,7 @@ class ChildListMutationScope {
     WTF_MAKE_NONCOPYABLE(ChildListMutationScope);
 public:
     ChildListMutationScope(Node* target)
-        : m_target(target->document()->hasMutationObserversOfType(WebKitMutationObserver::ChildList) ? target : 0)
+        : m_target(target->document()->hasMutationObserversOfType(MutationObserver::ChildList) ? target : 0)
     {
         if (m_target)
             MutationAccumulationRouter::instance()->incrementScopingLevel(m_target);
diff --git a/Source/WebCore/dom/ChildNodeList.cpp b/Source/WebCore/dom/ChildNodeList.cpp
index 449fb829a..4b50bc88e 100644
--- a/Source/WebCore/dom/ChildNodeList.cpp
+++ b/Source/WebCore/dom/ChildNodeList.cpp
@@ -39,15 +39,14 @@ ChildNodeList::~ChildNodeList()
 
 unsigned ChildNodeList::length() const
 {
-    if (m_caches.isLengthCacheValid)
-        return m_caches.cachedLength;
+    if (isLengthCacheValid())
+        return cachedLength();
 
     unsigned len = 0;
     for (Node* n = rootNode()->firstChild(); n; n = n->nextSibling())
         len++;
 
-    m_caches.cachedLength = len;
-    m_caches.isLengthCacheValid = true;
+    setLengthCache(len);
 
     return len;
 }
@@ -57,27 +56,27 @@ Node* ChildNodeList::item(unsigned index) const
     unsigned int pos = 0;
     Node* n = rootNode()->firstChild();
 
-    if (m_caches.isItemCacheValid) {
-        if (index == m_caches.lastItemOffset)
-            return m_caches.lastItem;
-        
-        int diff = index - m_caches.lastItemOffset;
+    if (isItemCacheValid()) {
+        if (index == cachedItemOffset())
+            return cachedItem();
+
+        int diff = index - cachedItemOffset();
         unsigned dist = abs(diff);
         if (dist < index) {
-            n = m_caches.lastItem;
-            pos = m_caches.lastItemOffset;
+            n = cachedItem();
+            pos = cachedItemOffset();
         }
     }
 
-    if (m_caches.isLengthCacheValid) {
-        if (index >= m_caches.cachedLength)
+    if (isLengthCacheValid()) {
+        if (index >= cachedLength())
             return 0;
 
         int diff = index - pos;
         unsigned dist = abs(diff);
-        if (dist > m_caches.cachedLength - 1 - index) {
+        if (dist > cachedLength() - 1 - index) {
             n = rootNode()->lastChild();
-            pos = m_caches.cachedLength - 1;
+            pos = cachedLength() - 1;
         }
     }
 
@@ -94,9 +93,7 @@ Node* ChildNodeList::item(unsigned index) const
     }
 
     if (n) {
-        m_caches.lastItem = n;
-        m_caches.lastItemOffset = pos;
-        m_caches.isItemCacheValid = true;
+        setItemCache(n, pos);
         return n;
     }
 
diff --git a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
index a48345ab6..1d8feed18 100644
--- a/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
+++ b/Source/WebCore/dom/ComposedShadowTreeWalker.cpp
@@ -43,19 +43,29 @@ static inline ElementShadow* shadowFor(const Node* node)
 
 static inline ElementShadow* shadowOfParent(const Node* node)
 {
-    if (node && node->parentNode())
-        return shadowFor(node->parentNode());
+    if (!node)
+        return 0;
+    if (Node* parent = node->parentNode())
+        if (parent->isElementNode())
+            return toElement(parent)->shadow();
     return 0;
 }
 
-ComposedShadowTreeWalker::ComposedShadowTreeWalker(const Node* node, Policy policy)
-    : m_node(node)
-    , m_policy(policy)
+inline void ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseInsertionPoint(InsertionPoint* insertionPoint)
+{
+    if (!m_insertionPoint)
+        m_insertionPoint = insertionPoint;
+}
+
+inline void ComposedShadowTreeWalker::ParentTranversalDetails::didTraverseShadowRoot(const ShadowRoot* root)
 {
-#ifndef NDEBUG
-    if (m_node)
-        assertPrecondition();
-#endif
+    m_resetStyleInheritance  = m_resetStyleInheritance || root->resetStyleInheritance();
+}
+
+inline void ComposedShadowTreeWalker::ParentTranversalDetails::didFindNode(ContainerNode* node)
+{
+    if (!m_outOfComposition)
+        m_node = node;
 }
 
 ComposedShadowTreeWalker ComposedShadowTreeWalker::fromFirstChild(const Node* node, Policy policy)
@@ -65,6 +75,14 @@ ComposedShadowTreeWalker ComposedShadowTreeWalker::fromFirstChild(const Node* no
     return walker;
 }
 
+void ComposedShadowTreeWalker::findParent(const Node* node, ParentTranversalDetails* details)
+{
+    ComposedShadowTreeWalker walker(node, CrossUpperBoundary, CanStartFromShadowBoundary);
+    ContainerNode* found = toContainerNode(walker.traverseParent(walker.get(), details));
+    if (found)
+        details->didFindNode(found);
+}
+
 void ComposedShadowTreeWalker::firstChild()
 {
     assertPrecondition();
@@ -177,7 +195,7 @@ Node* ComposedShadowTreeWalker::traverseSiblingOrBackToYoungerShadowRoot(const N
     return 0;
 }
 
-Node* ComposedShadowTreeWalker::escapeFallbackContentElement(const Node* node, TraversalDirection direction)
+inline Node* ComposedShadowTreeWalker::escapeFallbackContentElement(const Node* node, TraversalDirection direction)
 {
     ASSERT(node);
     if (node->parentNode() && isActiveInsertionPoint(node->parentNode()))
@@ -185,12 +203,14 @@ Node* ComposedShadowTreeWalker::escapeFallbackContentElement(const Node* node, T
     return 0;
 }
 
-Node* ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents(const Node* node) const
+inline Node* ComposedShadowTreeWalker::traverseNodeEscapingFallbackContents(const Node* node, ParentTranversalDetails* details) const
 {
     ASSERT(node);
-    if (isActiveInsertionPoint(node))
-        return traverseParent(node);
-    return const_cast<Node*>(node);
+    if (!isInsertionPoint(node))
+        return const_cast<Node*>(node);
+    const InsertionPoint* insertionPoint = toInsertionPoint(node);
+    return insertionPoint->hasDistribution() ? 0 :
+        insertionPoint->isActive() ? traverseParent(node, details) : const_cast<Node*>(node);
 }
 
 void ComposedShadowTreeWalker::parent()
@@ -200,36 +220,56 @@ void ComposedShadowTreeWalker::parent()
     assertPostcondition();
 }
 
-Node* ComposedShadowTreeWalker::traverseParent(const Node* node) const
+// FIXME: Use an iterative algorithm so that it can be inlined.
+// https://bugs.webkit.org/show_bug.cgi?id=90415
+Node* ComposedShadowTreeWalker::traverseParent(const Node* node, ParentTranversalDetails* details) const
 {
     if (!canCrossUpperBoundary() && node->isShadowRoot()) {
         ASSERT(toShadowRoot(node)->isYoungest());
         return 0;
     }
     if (ElementShadow* shadow = shadowOfParent(node)) {
-        if (InsertionPoint* insertionPoint = shadow->insertionPointFor(node))
-            return traverseParent(insertionPoint);
+        shadow->ensureDistribution();
+        if (InsertionPoint* insertionPoint = shadow->insertionPointFor(node)) {
+            if (details)
+                details->didTraverseInsertionPoint(insertionPoint);
+            return traverseParent(insertionPoint, details);
+        }
+
+        // The node is a non-distributed light child or older shadow's child.
+        if (details)
+            details->childWasOutOfComposition();
     }
-    return traverseParentInCurrentTree(node);
+    return traverseParentInCurrentTree(node, details);
 }
 
-Node* ComposedShadowTreeWalker::traverseParentInCurrentTree(const Node* node) const
+inline Node* ComposedShadowTreeWalker::traverseParentInCurrentTree(const Node* node, ParentTranversalDetails* details) const
 {
     if (Node* parent = node->parentNode())
-        return parent->isShadowRoot() ? traverseParentBackToYoungerShadowRootOrHost(toShadowRoot(parent)) : traverseNodeEscapingFallbackContents(parent);
+        return parent->isShadowRoot() ? traverseParentBackToYoungerShadowRootOrHost(toShadowRoot(parent), details) : traverseNodeEscapingFallbackContents(parent, details);
     return 0;
 }
 
-Node* ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost(const ShadowRoot* shadowRoot) const
+Node* ComposedShadowTreeWalker::traverseParentBackToYoungerShadowRootOrHost(const ShadowRoot* shadowRoot, ParentTranversalDetails* details) const
 {
     ASSERT(shadowRoot);
     if (shadowRoot->isYoungest()) {
-        if (canCrossUpperBoundary())
+        if (canCrossUpperBoundary()) {
+            if (details)
+                details->didTraverseShadowRoot(shadowRoot);
             return shadowRoot->host();
+        }
+
         return const_cast<ShadowRoot*>(shadowRoot);
     }
-    InsertionPoint* assignedInsertionPoint = shadowRoot->assignedTo();
-    return assignedInsertionPoint ? traverseParent(assignedInsertionPoint) : 0;
+
+    if (InsertionPoint* assignedInsertionPoint = shadowRoot->assignedTo()) {
+        if (details)
+            details->didTraverseShadowRoot(shadowRoot);
+        return traverseParent(assignedInsertionPoint, details);
+    }
+
+    return 0;
 }
 
 Node* ComposedShadowTreeWalker::traverseNextSibling(const Node* node)
diff --git a/Source/WebCore/dom/ComposedShadowTreeWalker.h b/Source/WebCore/dom/ComposedShadowTreeWalker.h
index bb9f41671..0af34cd42 100644
--- a/Source/WebCore/dom/ComposedShadowTreeWalker.h
+++ b/Source/WebCore/dom/ComposedShadowTreeWalker.h
@@ -44,11 +44,43 @@ public:
         DoNotCrossUpperBoundary,
     };
 
-    ComposedShadowTreeWalker(const Node*, Policy = CrossUpperBoundary);
+    enum StartPolicy {
+        CanStartFromShadowBoundary,
+        CannotStartFromShadowBoundary
+    };
+
+    class ParentTranversalDetails {
+    public:
+        ParentTranversalDetails()
+            : m_node(0)
+            , m_insertionPoint(0)
+            , m_resetStyleInheritance(false)
+            , m_outOfComposition(false)
+        { }
+
+        ContainerNode* node() const { return m_node; }
+        InsertionPoint* insertionPoint() const { return m_insertionPoint; }
+        bool resetStyleInheritance() const { return m_resetStyleInheritance; }
+        bool outOfComposition() const { return m_outOfComposition; }
+
+        void didFindNode(ContainerNode*);
+        void didTraverseInsertionPoint(InsertionPoint*);
+        void didTraverseShadowRoot(const ShadowRoot*);
+        void childWasOutOfComposition() { m_outOfComposition = true; }
+
+    private:
+        ContainerNode* m_node;
+        InsertionPoint* m_insertionPoint;
+        bool m_resetStyleInheritance;
+        bool m_outOfComposition;
+    };
+
+    ComposedShadowTreeWalker(const Node*, Policy = CrossUpperBoundary, StartPolicy = CannotStartFromShadowBoundary);
 
     // For a common use case such as:
     // for (ComposedShadowTreeWalker walker = ComposedShadowTreeWalker::fromFirstChild(node); walker.get(); walker.nextSibling())
     static ComposedShadowTreeWalker fromFirstChild(const Node*, Policy = CrossUpperBoundary);
+    static void findParent(const Node*, ParentTranversalDetails*);
 
     Node* get() const { return const_cast<Node*>(m_node); }
 
@@ -64,6 +96,8 @@ public:
     void previous();
 
 private:
+    ComposedShadowTreeWalker(const Node*, ParentTranversalDetails*);
+
     enum TraversalDirection {
         TraversalDirectionForward,
         TraversalDirectionBackward
@@ -97,7 +131,7 @@ private:
     Node* traverseFirstChild(const Node*) const;
     Node* traverseLastChild(const Node*) const;
     Node* traverseChild(const Node*, TraversalDirection) const;
-    Node* traverseParent(const Node*) const;
+    Node* traverseParent(const Node*, ParentTranversalDetails* = 0) const;
 
     static Node* traverseNextSibling(const Node*);
     static Node* traversePreviousSibling(const Node*);
@@ -108,14 +142,25 @@ private:
     static Node* traverseSiblingOrBackToYoungerShadowRoot(const Node*, TraversalDirection);
     static Node* escapeFallbackContentElement(const Node*, TraversalDirection);
 
-    Node* traverseNodeEscapingFallbackContents(const Node*) const;
-    Node* traverseParentInCurrentTree(const Node*) const;
-    Node* traverseParentBackToYoungerShadowRootOrHost(const ShadowRoot*) const;
+    Node* traverseNodeEscapingFallbackContents(const Node*, ParentTranversalDetails* = 0) const;
+    Node* traverseParentInCurrentTree(const Node*, ParentTranversalDetails* = 0) const;
+    Node* traverseParentBackToYoungerShadowRootOrHost(const ShadowRoot*, ParentTranversalDetails* = 0) const;
 
     const Node* m_node;
     Policy m_policy;
 };
 
+inline ComposedShadowTreeWalker::ComposedShadowTreeWalker(const Node* node, Policy policy, StartPolicy startPolicy)
+    : m_node(node)
+    , m_policy(policy)
+{
+    UNUSED_PARAM(startPolicy);
+#ifndef NDEBUG
+    if (m_node && startPolicy == CannotStartFromShadowBoundary)
+        assertPrecondition();
+#endif
+}
+
 // A special walker class which is only used for traversing a parent node, including
 // insertion points and shadow roots.
 class ComposedShadowTreeParentWalker {
diff --git a/Source/WebCore/dom/ContextFeatures.cpp b/Source/WebCore/dom/ContextFeatures.cpp
index 887db4cb2..7e3daa671 100644
--- a/Source/WebCore/dom/ContextFeatures.cpp
+++ b/Source/WebCore/dom/ContextFeatures.cpp
@@ -51,6 +51,18 @@ ContextFeatures* ContextFeatures::defaultSwitch()
     return instance.get();
 }
 
+bool ContextFeatures::dialogElementEnabled(Document* document)
+{
+#if ENABLE(DIALOG_ELEMENT)
+    if (!document)
+        return RuntimeEnabledFeatures::dialogElementEnabled();
+    return document->contextFeatures()->isEnabled(document, DialogElement, RuntimeEnabledFeatures::dialogElementEnabled());
+#else
+    UNUSED_PARAM(document);
+    return false;
+#endif
+}
+
 bool ContextFeatures::shadowDOMEnabled(Document* document)
 {
 #if ENABLE(SHADOW_DOM)
diff --git a/Source/WebCore/dom/ContextFeatures.h b/Source/WebCore/dom/ContextFeatures.h
index ef662207e..31dda92df 100644
--- a/Source/WebCore/dom/ContextFeatures.h
+++ b/Source/WebCore/dom/ContextFeatures.h
@@ -1,4 +1,3 @@
-
 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
@@ -40,20 +39,24 @@ class Page;
 class ContextFeatures : public RefCountedSupplement<Page, ContextFeatures> {
 public:
     enum FeatureType {
+        DialogElement = 0,
         ShadowDOM,
         StyleScoped,
-        PagePopup
+        PagePopup,
+        FeatureTypeSize // Should be the last entry.
     };
 
     static const AtomicString& supplementName();
     static ContextFeatures* defaultSwitch();
     static PassRefPtr<ContextFeatures> create(ContextFeaturesClient*);
 
+    static bool dialogElementEnabled(Document*);
     static bool shadowDOMEnabled(Document*);
     static bool styleScopedEnabled(Document*);
     static bool pagePopupEnabled(Document*);
 
     bool isEnabled(Document*, FeatureType, bool) const;
+    void urlDidChange(Document*);
 
 private:
     explicit ContextFeatures(ContextFeaturesClient* client)
@@ -77,6 +80,7 @@ public:
 
     virtual ~ContextFeaturesClient() { }
     virtual bool isEnabled(Document*, ContextFeatures::FeatureType, bool defaultValue) { return defaultValue; }
+    virtual void urlDidChange(Document*) { }
 };
 
 void provideContextFeaturesTo(Page*, ContextFeaturesClient*);
@@ -94,6 +98,13 @@ inline bool ContextFeatures::isEnabled(Document* document, FeatureType type, boo
     return m_client->isEnabled(document, type, defaultValue);
 }
 
+inline void ContextFeatures::urlDidChange(Document* document)
+{
+    if (m_client)
+        return;
+    m_client->urlDidChange(document);
+}
+
 } // namespace WebCore
 
 #endif // ContextFeatures_h
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index d3d4902d4..592d72992 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -92,6 +92,7 @@
 #include "MouseEvent.cpp"
 #include "MouseRelatedEvent.cpp"
 #include "MutationEvent.cpp"
+#include "MutationObserver.cpp"
 #include "MutationObserverInterestGroup.cpp"
 #include "MutationObserverRegistration.cpp"
 #include "MutationRecord.cpp"
@@ -142,7 +143,6 @@
 #include "UserTypingGestureIndicator.cpp"
 #include "ViewportArguments.cpp"
 #include "WebKitAnimationEvent.cpp"
-#include "WebKitMutationObserver.cpp"
 #include "WebKitNamedFlow.cpp"
 #include "WebKitTransitionEvent.cpp"
 #include "WheelEvent.cpp"
diff --git a/Source/WebCore/dom/DataTransferItemList.idl b/Source/WebCore/dom/DataTransferItemList.idl
index d1de50e79..aee92e7aa 100644
--- a/Source/WebCore/dom/DataTransferItemList.idl
+++ b/Source/WebCore/dom/DataTransferItemList.idl
@@ -42,7 +42,7 @@ module core {
         DataTransferItem item(in [Optional=DefaultIsUndefined] unsigned long index);
 
         void clear();
-        void add(in File file);
+        void add(in File? file);
         void add(in [Optional=DefaultIsUndefined] DOMString data, 
                  in [Optional=DefaultIsUndefined] DOMString type) raises(DOMException);
     };
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index 7f190b269..bc5eabbda 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -109,6 +109,7 @@
 #include "Logging.h"
 #include "MediaQueryList.h"
 #include "MediaQueryMatcher.h"
+#include "MemoryInstrumentation.h"
 #include "MouseEventWithHitTestResults.h"
 #include "NameNodeList.h"
 #include "NestingLevelIncrementer.h"
@@ -216,6 +217,10 @@
 #include "Prerenderer.h"
 #endif
 
+#if ENABLE(TEXT_AUTOSIZING)
+#include "TextAutosizer.h"
+#endif
+
 using namespace std;
 using namespace WTF;
 using namespace Unicode;
@@ -342,19 +347,6 @@ static bool acceptsEditingFocus(Node* node)
     return frame->editor()->shouldBeginEditing(rangeOfContents(root).get());
 }
 
-static bool disableRangeMutation(Page* page)
-{
-    // This check is made on super-hot code paths, so we only want this on Leopard.
-#ifdef TARGETING_LEOPARD
-    // Disable Range mutation on document modifications in Leopard Mail.
-    // See <rdar://problem/5865171>
-    return page && page->settings()->needsLeopardMailQuirks();
-#else
-    UNUSED_PARAM(page);
-    return false;
-#endif
-}
-
 static bool canAccessAncestor(const SecurityOrigin* activeSecurityOrigin, Frame* targetFrame)
 {
     // targetFrame can be 0 when we're trying to navigate a top-level frame
@@ -470,6 +462,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_isViewSource(false)
     , m_sawElementsInKnownNamespaces(false)
     , m_isSrcdocDocument(false)
+    , m_documentRareData(0)
     , m_eventQueue(DocumentEventQueue::create(this))
     , m_weakReference(DocumentWeakReference::create(this))
     , m_idAttributeName(idAttr)
@@ -528,6 +521,9 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 #if ENABLE(LINK_PRERENDER)
     m_prerenderer = Prerenderer::create(this);
 #endif
+#if ENABLE(TEXT_AUTOSIZING)
+    m_textAutosizer = TextAutosizer::create(this);
+#endif
     m_visuallyOrdered = false;
     m_bParsing = false;
     m_wellFormed = false;
@@ -569,6 +565,9 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     static int docID = 0;
     m_docID = docID++;
     
+    for (unsigned i = 0; i < WTF_ARRAY_LENGTH(m_collections); i++)
+        m_collections[i] = 0;
+
     InspectorCounters::incrementCounter(InspectorCounters::DocumentCounter);
 }
 
@@ -606,7 +605,6 @@ Document::~Document()
     // if the DocumentParser outlives the Document it won't cause badness.
     ASSERT(!m_parser || m_parser->refCount() == 1);
     detachParser();
-    m_document = 0;
 
     m_renderArena.clear();
 
@@ -650,6 +648,8 @@ Document::~Document()
     if (hasRareData())
         clearRareData();
 
+    m_document = 0;
+
     InspectorCounters::decrementCounter(InspectorCounters::DocumentCounter);
 }
 
@@ -2009,6 +2009,11 @@ void Document::pageSizeAndMarginsInPixels(int pageIndex, IntSize& pageSize, int&
     marginLeft = style->marginLeft().isAuto() ? marginLeft : intValueForLength(style->marginLeft(), width, view);
 }
 
+void Document::setDocumentRareData(NodeRareData* rareData)
+{
+    m_documentRareData = rareData;
+}
+
 void Document::setIsViewSource(bool isViewSource)
 {
     m_isViewSource = isViewSource;
@@ -2682,6 +2687,7 @@ void Document::setURL(const KURL& url)
     m_url = newURL;
     m_documentURI = m_url.string();
     updateBaseURL();
+    contextFeatures()->urlDidChange(this);
 }
 
 void Document::updateBaseURL()
@@ -3902,7 +3908,7 @@ void Document::moveNodeIteratorsToNewDocument(Node* node, Document* newDocument)
 
 void Document::updateRangesAfterChildrenChanged(ContainerNode* container)
 {
-    if (!disableRangeMutation(page()) && !m_ranges.isEmpty()) {
+    if (!m_ranges.isEmpty()) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->nodeChildrenChanged(container);
@@ -3911,7 +3917,7 @@ void Document::updateRangesAfterChildrenChanged(ContainerNode* container)
 
 void Document::nodeChildrenWillBeRemoved(ContainerNode* container)
 {
-    if (!disableRangeMutation(page()) && !m_ranges.isEmpty()) {
+    if (!m_ranges.isEmpty()) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->nodeChildrenWillBeRemoved(container);
@@ -3938,7 +3944,7 @@ void Document::nodeWillBeRemoved(Node* n)
     for (HashSet<NodeIterator*>::const_iterator it = m_nodeIterators.begin(); it != nodeIteratorsEnd; ++it)
         (*it)->nodeWillBeRemoved(n);
 
-    if (!disableRangeMutation(page()) && !m_ranges.isEmpty()) {
+    if (!m_ranges.isEmpty()) {
         HashSet<Range*>::const_iterator rangesEnd = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != rangesEnd; ++it)
             (*it)->nodeWillBeRemoved(n);
@@ -3953,7 +3959,7 @@ void Document::nodeWillBeRemoved(Node* n)
 
 void Document::textInserted(Node* text, unsigned offset, unsigned length)
 {
-    if (!disableRangeMutation(page()) && !m_ranges.isEmpty()) {
+    if (!m_ranges.isEmpty()) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textInserted(text, offset, length);
@@ -3965,7 +3971,7 @@ void Document::textInserted(Node* text, unsigned offset, unsigned length)
 
 void Document::textRemoved(Node* text, unsigned offset, unsigned length)
 {
-    if (!disableRangeMutation(page()) && !m_ranges.isEmpty()) {
+    if (!m_ranges.isEmpty()) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textRemoved(text, offset, length);
@@ -3978,7 +3984,7 @@ void Document::textRemoved(Node* text, unsigned offset, unsigned length)
 
 void Document::textNodesMerged(Text* oldNode, unsigned offset)
 {
-    if (!disableRangeMutation(page()) && !m_ranges.isEmpty()) {
+    if (!m_ranges.isEmpty()) {
         NodeWithIndex oldNodeWithIndex(oldNode);
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
@@ -3990,7 +3996,7 @@ void Document::textNodesMerged(Text* oldNode, unsigned offset)
 
 void Document::textNodeSplit(Text* oldNode)
 {
-    if (!disableRangeMutation(page()) && !m_ranges.isEmpty()) {
+    if (!m_ranges.isEmpty()) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textNodeSplit(oldNode);
@@ -4577,7 +4583,7 @@ KURL Document::openSearchDescriptionURL()
     if (!head())
         return KURL();
 
-    HTMLCollection* children = head()->children();
+    RefPtr<HTMLCollection> children = head()->children();
     for (unsigned i = 0; Node* child = children->item(i); i++) {
         if (!child->hasTagName(linkTag))
             continue;
@@ -4695,81 +4701,113 @@ bool Document::hasSVGRootNode() const
 }
 #endif
 
-HTMLCollection* Document::cachedCollection(CollectionType type)
+// FIXME: This caching mechanism should be merged that of DynamicNodeList in NodeRareData.
+PassRefPtr<HTMLCollection> Document::cachedCollection(CollectionType type)
 {
     ASSERT(static_cast<unsigned>(type) < NumUnnamedDocumentCachedTypes);
-    if (!m_collections[type])
-        m_collections[type] = HTMLCollection::create(this, type);
-    return m_collections[type].get();
+    if (m_collections[type])
+        return m_collections[type];
+
+    RefPtr<HTMLCollection> collection;
+    if (type == DocAll)
+        collection = HTMLAllCollection::create(this);
+    else
+        collection = HTMLCollection::create(this, type);
+    m_collections[type] = collection.get();
+
+    return collection.release();
+}
+
+void Document::removeCachedHTMLCollection(HTMLCollection* collection, CollectionType type)
+{
+    ASSERT_UNUSED(collection, m_collections[type] == collection);
+    m_collections[type] = 0;
 }
 
-HTMLCollection* Document::images()
+PassRefPtr<HTMLCollection> Document::images()
 {
     return cachedCollection(DocImages);
 }
 
-HTMLCollection* Document::applets()
+PassRefPtr<HTMLCollection> Document::applets()
 {
     return cachedCollection(DocApplets);
 }
 
-HTMLCollection* Document::embeds()
+PassRefPtr<HTMLCollection> Document::embeds()
 {
     return cachedCollection(DocEmbeds);
 }
 
-HTMLCollection* Document::plugins()
+PassRefPtr<HTMLCollection> Document::plugins()
 {
     // This is an alias for embeds() required for the JS DOM bindings.
     return cachedCollection(DocEmbeds);
 }
 
-HTMLCollection* Document::objects()
+PassRefPtr<HTMLCollection> Document::objects()
 {
     return cachedCollection(DocObjects);
 }
 
-HTMLCollection* Document::scripts()
+PassRefPtr<HTMLCollection> Document::scripts()
 {
     return cachedCollection(DocScripts);
 }
 
-HTMLCollection* Document::links()
+PassRefPtr<HTMLCollection> Document::links()
 {
     return cachedCollection(DocLinks);
 }
 
-HTMLCollection* Document::forms()
+PassRefPtr<HTMLCollection> Document::forms()
 {
     return cachedCollection(DocForms);
 }
 
-HTMLCollection* Document::anchors()
+PassRefPtr<HTMLCollection> Document::anchors()
 {
     return cachedCollection(DocAnchors);
 }
 
-HTMLAllCollection* Document::all()
+PassRefPtr<HTMLCollection> Document::all()
 {
-    if (!m_allCollection)
-        m_allCollection = HTMLAllCollection::create(this);
-    return m_allCollection.get();
+    return cachedCollection(DocAll);
 }
 
-HTMLCollection* Document::windowNamedItems(const AtomicString& name)
+PassRefPtr<HTMLCollection> Document::windowNamedItems(const AtomicString& name)
 {
-    OwnPtr<HTMLNameCollection>& collection = m_windowNamedItemCollections.add(name.impl(), nullptr).iterator->second;
-    if (!collection)
-        collection = HTMLNameCollection::create(this, WindowNamedItems, name);
-    return collection.get();
+    NamedCollectionMap::AddResult result = m_windowNamedItemCollections.add(name, 0);
+    if (!result.isNewEntry)
+        return result.iterator->second;
+
+    RefPtr<HTMLNameCollection> collection = HTMLNameCollection::create(this, WindowNamedItems, name);
+    result.iterator->second = collection.get();
+    return collection.release();
 }
 
-HTMLCollection* Document::documentNamedItems(const AtomicString& name)
+PassRefPtr<HTMLCollection> Document::documentNamedItems(const AtomicString& name)
 {
-    OwnPtr<HTMLNameCollection>& collection = m_documentNamedItemCollections.add(name.impl(), nullptr).iterator->second;
-    if (!collection)
-        collection = HTMLNameCollection::create(this, DocumentNamedItems, name);
-    return collection.get();
+    NamedCollectionMap::AddResult result = m_documentNamedItemCollections.add(name, 0);
+    if (!result.isNewEntry)
+        return result.iterator->second;
+
+    RefPtr<HTMLNameCollection> collection = HTMLNameCollection::create(this, DocumentNamedItems, name);
+    result.iterator->second = collection.get();
+    return collection.release();
+}
+
+// FIXME: This caching mechanism should be merged that of DynamicNodeList in NodeRareData.
+void Document::removeWindowNamedItemCache(HTMLCollection* collection, const AtomicString& name)
+{
+    ASSERT_UNUSED(collection, m_windowNamedItemCollections.get(name) == collection);
+    m_windowNamedItemCollections.remove(name);
+}
+
+void Document::removeDocumentNamedItemCache(HTMLCollection* collection, const AtomicString& name)
+{
+    ASSERT_UNUSED(collection, m_documentNamedItemCollections.get(name) == collection);
+    m_documentNamedItemCollections.remove(name);
 }
 
 void Document::finishedParsing()
@@ -5993,6 +6031,42 @@ void Document::setContextFeatures(PassRefPtr<ContextFeatures> features)
     m_contextFeatures = features;
 }
 
+void Document::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
+{
+    memoryObjectInfo->reportObjectInfo(this, MemoryInstrumentation::DOM);
+    ContainerNode::reportMemoryUsage(memoryObjectInfo);
+    memoryObjectInfo->reportVector(m_customFonts);
+    memoryObjectInfo->reportString(m_documentURI);
+    memoryObjectInfo->reportString(m_baseTarget);
+    if (m_pageGroupUserSheets)
+        memoryObjectInfo->reportVector(*m_pageGroupUserSheets.get());
+    if (m_userSheets)
+        memoryObjectInfo->reportVector(*m_userSheets.get());
+    memoryObjectInfo->reportHashSet(m_nodeIterators);
+    memoryObjectInfo->reportHashSet(m_ranges);
+    memoryObjectInfo->reportListHashSet(m_styleSheetCandidateNodes);
+    memoryObjectInfo->reportString(m_preferredStylesheetSet);
+    memoryObjectInfo->reportString(m_selectedStylesheetSet);
+    memoryObjectInfo->reportString(m_title.string());
+    memoryObjectInfo->reportString(m_rawTitle.string());
+    memoryObjectInfo->reportString(m_xmlEncoding);
+    memoryObjectInfo->reportString(m_xmlVersion);
+    memoryObjectInfo->reportString(m_contentLanguage);
+    memoryObjectInfo->reportHashMap(m_documentNamedItemCollections);
+    memoryObjectInfo->reportHashMap(m_windowNamedItemCollections);
+#if ENABLE(DASHBOARD_SUPPORT)
+    memoryObjectInfo->reportVector(m_dashboardRegions);
+#endif
+    memoryObjectInfo->reportHashMap(m_cssCanvasElements);
+    memoryObjectInfo->reportVector(m_iconURLs);
+    memoryObjectInfo->reportHashSet(m_documentSuspensionCallbackElements);
+    memoryObjectInfo->reportHashSet(m_mediaVolumeCallbackElements);
+    memoryObjectInfo->reportHashSet(m_privateBrowsingStateChangedElements);
+    memoryObjectInfo->reportHashMap(m_elementsByAccessKey);
+    memoryObjectInfo->reportHashSet(m_mediaCanStartListeners);
+    memoryObjectInfo->reportVector(m_pendingTasks);
+}
+
 #if ENABLE(UNDO_MANAGER)
 PassRefPtr<UndoManager> Document::undoManager()
 {
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 68885fb33..87dfa32c2 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -38,6 +38,7 @@
 #include "InspectorCounters.h"
 #include "IntRect.h"
 #include "LayoutTypes.h"
+#include "MutationObserver.h"
 #include "PageVisibilityState.h"
 #include "PlatformScreen.h"
 #include "QualifiedName.h"
@@ -47,7 +48,6 @@
 #include "Timer.h"
 #include "TreeScope.h"
 #include "ViewportArguments.h"
-#include "WebKitMutationObserver.h"
 #include <wtf/Deque.h>
 #include <wtf/FixedArray.h>
 #include <wtf/OwnPtr.h>
@@ -111,6 +111,7 @@ class MediaQueryMatcher;
 class MouseEventWithHitTestResults;
 class NodeFilter;
 class NodeIterator;
+class NodeRareData;
 class Page;
 class PlatformMouseEvent;
 class ProcessingInstruction;
@@ -172,6 +173,10 @@ class MicroDataItemList;
 class Prerenderer;
 #endif
 
+#if ENABLE(TEXT_AUTOSIZING)
+class TextAutosizer;
+#endif
+
 typedef int ExceptionCode;
 
 enum PageshowEventPersistence {
@@ -401,19 +406,22 @@ public:
 
     PassRefPtr<Node> adoptNode(PassRefPtr<Node> source, ExceptionCode&);
 
-    HTMLCollection* images();
-    HTMLCollection* embeds();
-    HTMLCollection* plugins(); // an alias for embeds() required for the JS DOM bindings.
-    HTMLCollection* applets();
-    HTMLCollection* links();
-    HTMLCollection* forms();
-    HTMLCollection* anchors();
-    HTMLCollection* objects();
-    HTMLCollection* scripts();
-    HTMLCollection* windowNamedItems(const AtomicString& name);
-    HTMLCollection* documentNamedItems(const AtomicString& name);
-
-    HTMLAllCollection* all();
+    PassRefPtr<HTMLCollection> images();
+    PassRefPtr<HTMLCollection> embeds();
+    PassRefPtr<HTMLCollection> plugins(); // an alias for embeds() required for the JS DOM bindings.
+    PassRefPtr<HTMLCollection> applets();
+    PassRefPtr<HTMLCollection> links();
+    PassRefPtr<HTMLCollection> forms();
+    PassRefPtr<HTMLCollection> anchors();
+    PassRefPtr<HTMLCollection> objects();
+    PassRefPtr<HTMLCollection> scripts();
+    PassRefPtr<HTMLCollection> all();
+    void removeCachedHTMLCollection(HTMLCollection*, CollectionType);
+
+    PassRefPtr<HTMLCollection> windowNamedItems(const AtomicString& name);
+    PassRefPtr<HTMLCollection> documentNamedItems(const AtomicString& name);
+    void removeWindowNamedItemCache(HTMLCollection*, const AtomicString&);
+    void removeDocumentNamedItemCache(HTMLCollection*, const AtomicString&);
 
     // Other methods (not part of DOM)
     bool isHTMLDocument() const { return m_isHTML; }
@@ -432,6 +440,9 @@ public:
 
     bool isSrcdocDocument() const { return m_isSrcdocDocument; }
 
+    NodeRareData* documentRareData() const { return m_documentRareData; };
+    void setDocumentRareData(NodeRareData*);
+
     StyleResolver* styleResolverIfExists() const { return m_styleResolver.get(); }
 
     bool isViewSource() const { return m_isViewSource; }
@@ -771,7 +782,7 @@ public:
     void addListenerTypeIfNeeded(const AtomicString& eventType);
 
 #if ENABLE(MUTATION_OBSERVERS)
-    bool hasMutationObserversOfType(WebKitMutationObserver::MutationType type) const
+    bool hasMutationObserversOfType(MutationObserver::MutationType type) const
     {
         return m_mutationObserverTypes & type;
     }
@@ -1125,12 +1136,18 @@ public:
     Prerenderer* prerenderer() { return m_prerenderer.get(); }
 #endif
 
+#if ENABLE(TEXT_AUTOSIZING)
+    TextAutosizer* textAutosizer() { return m_textAutosizer.get(); }
+#endif
+
     void adjustFloatQuadsForScrollAndAbsoluteZoomAndFrameScale(Vector<FloatQuad>&, RenderObject*);
     void adjustFloatRectForScrollAndAbsoluteZoomAndFrameScale(FloatRect&, RenderObject*);
 
     void setContextFeatures(PassRefPtr<ContextFeatures>);
     ContextFeatures* contextFeatures() { return m_contextFeatures.get(); }
 
+    virtual void reportMemoryUsage(MemoryObjectInfo*) const OVERRIDE;
+
 protected:
     Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
 
@@ -1202,7 +1219,7 @@ private:
     PageVisibilityState visibilityState() const;
 #endif
 
-    HTMLCollection* cachedCollection(CollectionType);
+    PassRefPtr<HTMLCollection> cachedCollection(CollectionType);
 
 #if ENABLE(FULLSCREEN_API)
     void clearFullscreenElementStack();
@@ -1390,12 +1407,11 @@ private:
     RefPtr<TextResourceDecoder> m_decoder;
 
     InheritedBool m_designMode;
-    
-    OwnPtr<HTMLCollection> m_collections[NumUnnamedDocumentCachedTypes];
-    OwnPtr<HTMLAllCollection> m_allCollection;
+
     HashSet<DynamicSubtreeNodeList*> m_listsInvalidatedAtDocument;
 
-    typedef HashMap<AtomicStringImpl*, OwnPtr<HTMLNameCollection> > NamedCollectionMap;
+    HTMLCollection* m_collections[NumUnnamedDocumentCachedTypes];
+    typedef HashMap<AtomicString, HTMLNameCollection*> NamedCollectionMap;
     NamedCollectionMap m_documentNamedItemCollections;
     NamedCollectionMap m_windowNamedItemCollections;
 
@@ -1435,6 +1451,8 @@ private:
     bool m_sawElementsInKnownNamespaces;
     bool m_isSrcdocDocument;
 
+    NodeRareData* m_documentRareData;
+
     RefPtr<DocumentEventQueue> m_eventQueue;
 
     RefPtr<DocumentWeakReference> m_weakReference;
@@ -1489,6 +1507,10 @@ private:
     OwnPtr<Prerenderer> m_prerenderer;
 #endif
 
+#if ENABLE(TEXT_AUTOSIZING)
+    OwnPtr<TextAutosizer> m_textAutosizer;
+#endif
+
     bool m_scheduledTasksAreSuspended;
     
     bool m_visualUpdatesAllowed;
diff --git a/Source/WebCore/dom/DynamicNodeList.cpp b/Source/WebCore/dom/DynamicNodeList.cpp
index d169a6cda..b97125c6b 100644
--- a/Source/WebCore/dom/DynamicNodeList.cpp
+++ b/Source/WebCore/dom/DynamicNodeList.cpp
@@ -34,8 +34,8 @@ DynamicSubtreeNodeList::~DynamicSubtreeNodeList()
 
 unsigned DynamicSubtreeNodeList::length() const
 {
-    if (m_caches.isLengthCacheValid)
-        return m_caches.cachedLength;
+    if (isLengthCacheValid())
+        return cachedLength();
 
     unsigned length = 0;
     Node* rootNode = this->rootNode();
@@ -43,8 +43,7 @@ unsigned DynamicSubtreeNodeList::length() const
     for (Node* n = rootNode->firstChild(); n; n = n->traverseNextNode(rootNode))
         length += n->isElementNode() && nodeMatches(static_cast<Element*>(n));
 
-    m_caches.cachedLength = length;
-    m_caches.isLengthCacheValid = true;
+    setLengthCache(length);
 
     return length;
 }
@@ -56,9 +55,7 @@ Node* DynamicSubtreeNodeList::itemForwardsFromCurrent(Node* start, unsigned offs
     for (Node* n = start; n; n = n->traverseNextNode(rootNode)) {
         if (n->isElementNode() && nodeMatches(static_cast<Element*>(n))) {
             if (!remainingOffset) {
-                m_caches.lastItem = n;
-                m_caches.lastItemOffset = offset;
-                m_caches.isItemCacheValid = true;
+                setItemCache(n, offset);
                 return n;
             }
             --remainingOffset;
@@ -75,9 +72,7 @@ Node* DynamicSubtreeNodeList::itemBackwardsFromCurrent(Node* start, unsigned off
     for (Node* n = start; n; n = n->traversePreviousNode(rootNode)) {
         if (n->isElementNode() && nodeMatches(static_cast<Element*>(n))) {
             if (!remainingOffset) {
-                m_caches.lastItem = n;
-                m_caches.lastItemOffset = offset;
-                m_caches.isItemCacheValid = true;
+                setItemCache(n, offset);
                 return n;
             }
             ++remainingOffset;
@@ -91,12 +86,12 @@ Node* DynamicSubtreeNodeList::item(unsigned offset) const
 {
     int remainingOffset = offset;
     Node* start = rootNode()->firstChild();
-    if (m_caches.isItemCacheValid) {
-        if (offset == m_caches.lastItemOffset)
-            return m_caches.lastItem;
-        if (offset > m_caches.lastItemOffset || m_caches.lastItemOffset - offset < offset) {
-            start = m_caches.lastItem;
-            remainingOffset -= m_caches.lastItemOffset;
+    if (isItemCacheValid()) {
+        if (offset == cachedItemOffset())
+            return cachedItem();
+        if (offset > cachedItemOffset() || cachedItemOffset() - offset < offset) {
+            start = cachedItem();
+            remainingOffset -= cachedItemOffset();
         }
     }
 
diff --git a/Source/WebCore/dom/DynamicNodeList.h b/Source/WebCore/dom/DynamicNodeList.h
index 8b33e0d0d..83b2ed3eb 100644
--- a/Source/WebCore/dom/DynamicNodeList.h
+++ b/Source/WebCore/dom/DynamicNodeList.h
@@ -34,7 +34,68 @@ namespace WebCore {
 class Element;
 class Node;
 
-class DynamicNodeList : public NodeList {
+class DynamicNodeListCacheBase {
+public:
+    enum RootType {
+        RootedAtNode,
+        RootedAtDocument,
+    };
+
+    enum InvalidationType {
+        AlwaysInvalidate,
+        DoNotInvalidateOnAttributeChange,
+    };
+
+    DynamicNodeListCacheBase(RootType rootType, InvalidationType invalidationType)
+        : m_rootedAtDocument(rootType == RootedAtDocument)
+        , m_shouldInvalidateOnAttributeChange(invalidationType == AlwaysInvalidate)
+    {
+        clearCache();
+    }
+
+public:
+    ALWAYS_INLINE bool isRootedAtDocument() const { return m_rootedAtDocument; }
+    ALWAYS_INLINE bool shouldInvalidateOnAttributeChange() const { return m_shouldInvalidateOnAttributeChange; }
+
+protected:
+    ALWAYS_INLINE bool isItemCacheValid() const { return m_isItemCacheValid; }
+    ALWAYS_INLINE Node* cachedItem() const { return m_cachedItem; }
+    ALWAYS_INLINE unsigned cachedItemOffset() const { return m_cachedItemOffset; }
+
+    ALWAYS_INLINE bool isLengthCacheValid() const { return m_isLengthCacheValid; }
+    ALWAYS_INLINE unsigned cachedLength() const { return m_cachedLength; }
+    ALWAYS_INLINE void setLengthCache(unsigned length) const
+    {
+        m_cachedLength = length;
+        m_isLengthCacheValid = true;
+    }
+    ALWAYS_INLINE void setItemCache(Node* item, unsigned offset) const
+    {
+        m_cachedItem = item;
+        m_cachedItemOffset = offset;
+        m_isItemCacheValid = true;
+    }
+
+    void clearCache() const
+    {
+        m_cachedItem = 0;
+        m_isLengthCacheValid = false;
+        m_isItemCacheValid = false;
+    }
+
+private:
+    mutable Node* m_cachedItem;
+    mutable unsigned m_cachedLength;
+    mutable unsigned m_cachedItemOffset;
+    mutable unsigned m_isLengthCacheValid : 1;
+    mutable unsigned m_isItemCacheValid : 1;
+
+    // From DynamicNodeList
+    const unsigned m_rootedAtDocument : 1;
+    const unsigned m_shouldInvalidateOnAttributeChange : 1;
+};
+
+class DynamicNodeList : public NodeList, public DynamicNodeListCacheBase {
 public:
     enum NodeListType {
         ChildNodeListType,
@@ -45,17 +106,9 @@ public:
         LabelsNodeListType,
         MicroDataItemListType,
     };
-    enum RootType {
-        RootedAtNode,
-        RootedAtDocument,
-    };
-    enum InvalidationType {
-        AlwaysInvalidate,
-        DoNotInvalidateOnAttributeChange,
-    };
     DynamicNodeList(PassRefPtr<Node> ownerNode, RootType rootType, InvalidationType invalidationType)
-        : m_ownerNode(ownerNode)
-        , m_caches(rootType, invalidationType)
+        : DynamicNodeListCacheBase(rootType, invalidationType)
+        , m_ownerNode(ownerNode)
     { }
     virtual ~DynamicNodeList() { }
 
@@ -66,52 +119,21 @@ public:
 
     // Other methods (not part of DOM)
     Node* ownerNode() const { return m_ownerNode.get(); }
-    bool isRootedAtDocument() const { return m_caches.rootedAtDocument; }
-    bool shouldInvalidateOnAttributeChange() const { return m_caches.shouldInvalidateOnAttributeChange; }
-    void invalidateCache() { m_caches.reset(); }
+    void invalidateCache() { clearCache(); }
 
 protected:
     Node* rootNode() const
     {
-        if (m_caches.rootedAtDocument && m_ownerNode->inDocument())
+        if (isRootedAtDocument() && m_ownerNode->inDocument())
             return m_ownerNode->document();
         return m_ownerNode.get();
     }
     Document* document() const { return m_ownerNode->document(); }
     virtual bool nodeMatches(Element*) const = 0;
 
-    struct Caches {
-        Caches(RootType rootType, InvalidationType invalidationType)
-            : rootedAtDocument(rootType == RootedAtDocument)
-            , shouldInvalidateOnAttributeChange(invalidationType == AlwaysInvalidate)
-        {
-            reset();
-        }
-
-        void reset()
-        {
-            lastItem = 0;
-            isLengthCacheValid = false;
-            isItemCacheValid = false;
-        }
-
-        Node* lastItem;
-        unsigned cachedLength;
-        unsigned lastItemOffset;
-        unsigned isLengthCacheValid : 1;
-        unsigned isItemCacheValid : 1;
-
-        // Following flags should belong in DynamicSubtreeNode but are here for bit-packing.
-        unsigned type : 4;
-        unsigned rootedAtDocument : 1;
-        unsigned shouldInvalidateOnAttributeChange : 1;
-    };
-
-    RefPtr<Node> m_ownerNode;
-    mutable Caches m_caches;
-
 private:
     virtual bool isDynamicNodeList() const OVERRIDE { return true; }
+    RefPtr<Node> m_ownerNode;
 };
 
 class DynamicSubtreeNodeList : public DynamicNodeList {
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 9da156b4f..2287f40b1 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -46,9 +46,12 @@
 #include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "HTMLElement.h"
+#include "HTMLFormCollection.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
+#include "HTMLOptionsCollection.h"
 #include "HTMLParserIdioms.h"
+#include "HTMLTableRowsCollection.h"
 #include "InspectorInstrumentation.h"
 #include "MutationObserverInterestGroup.h"
 #include "MutationRecord.h"
@@ -68,7 +71,6 @@
 #include "Text.h"
 #include "TextIterator.h"
 #include "VoidCallback.h"
-#include "WebKitMutationObserver.h"
 #include "WebKitAnimationList.h"
 #include "XMLNSNames.h"
 #include "XMLNames.h"
@@ -137,7 +139,7 @@ Element::~Element()
 
     if (ElementShadow* elementShadow = shadow()) {
         elementShadow->removeAllShadowRoots();
-        rareData()->m_shadow.clear();
+        elementRareData()->m_shadow.clear();
     }
 
     if (hasAttrList()) {
@@ -146,15 +148,15 @@ Element::~Element()
     }
 }
 
-inline ElementRareData* Element::rareData() const
+inline ElementRareData* Element::elementRareData() const
 {
     ASSERT(hasRareData());
     return static_cast<ElementRareData*>(NodeRareData::rareDataFromMap(this));
 }
     
-inline ElementRareData* Element::ensureRareData()
+inline ElementRareData* Element::ensureElementRareData()
 {
-    return static_cast<ElementRareData*>(Node::ensureRareData());
+    return static_cast<ElementRareData*>(ensureRareData());
 }
     
 OwnPtr<NodeRareData> Element::createRareData()
@@ -234,7 +236,7 @@ void Element::setBooleanAttribute(const QualifiedName& name, bool value)
 NamedNodeMap* Element::attributes() const
 {
     ensureUpdatedAttributeData();
-    ElementRareData* rareData = const_cast<Element*>(this)->ensureRareData();
+    ElementRareData* rareData = const_cast<Element*>(this)->ensureElementRareData();
     if (NamedNodeMap* attributeMap = rareData->m_attributeMap.get())
         return attributeMap;
 
@@ -607,10 +609,10 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
 }
 
-const AtomicString& Element::getAttribute(const String& name) const
+const AtomicString& Element::getAttribute(const AtomicString& name) const
 {
     bool ignoreCase = shouldIgnoreAttributeCase(this);
-    
+
     // Update the 'style' attribute if it's invalid and being requested:
     if (!isStyleAttributeValid() && equalPossiblyIgnoringCase(name, styleAttr.localName(), ignoreCase))
         updateStyleAttribute();
@@ -677,7 +679,7 @@ inline void Element::setAttributeInternal(size_t index, const QualifiedName& nam
         old->setValue(value);
 
     if (inUpdateStyleAttribute == NotInUpdateStyleAttribute)
-        didModifyAttribute(*old);
+        didModifyAttribute(Attribute(old->name(), old->value()));
 }
 
 void Element::attributeChanged(const Attribute& attribute)
@@ -948,7 +950,7 @@ void Element::attach()
     }
 
     if (hasRareData()) {   
-        ElementRareData* data = rareData();
+        ElementRareData* data = elementRareData();
         if (data->needsFocusAppearanceUpdateSoonAfterAttach()) {
             if (isFocusable() && document()->focusedNode() == this)
                 document()->updateFocusAppearanceSoon(false /* don't restore selection */);
@@ -974,7 +976,7 @@ void Element::detach()
     unregisterNamedFlowContentNode();
     cancelFocusAppearanceUpdate();
     if (hasRareData())
-        rareData()->resetComputedStyle();
+        elementRareData()->resetComputedStyle();
 
     if (ElementShadow* shadow = this->shadow()) {
         detachChildrenIfNeeded();
@@ -1048,7 +1050,7 @@ void Element::recalcStyle(StyleChange change)
 
     if ((change > NoChange || needsStyleRecalc())) {
         if (hasRareData()) {
-            ElementRareData* data = rareData();
+            ElementRareData* data = elementRareData();
             data->resetComputedStyle();
             data->m_styleAffectedByEmpty = false;
         }
@@ -1162,16 +1164,16 @@ ElementShadow* Element::shadow() const
     if (!hasRareData())
         return 0;
 
-    return rareData()->m_shadow.get();
+    return elementRareData()->m_shadow.get();
 }
 
 ElementShadow* Element::ensureShadow()
 {
-    if (ElementShadow* shadow = ensureRareData()->m_shadow.get())
+    if (ElementShadow* shadow = ensureElementRareData()->m_shadow.get())
         return shadow;
 
-    rareData()->m_shadow = adoptPtr(new ElementShadow());
-    return rareData()->m_shadow.get();
+    elementRareData()->m_shadow = adoptPtr(new ElementShadow());
+    return elementRareData()->m_shadow.get();
 }
 
 ShadowRoot* Element::ensureShadowRoot()
@@ -1179,12 +1181,12 @@ ShadowRoot* Element::ensureShadowRoot()
     if (ElementShadow* shadow = this->shadow())
         return shadow->oldestShadowRoot();
 
-    return ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot).get();
+    return ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot).get();
 }
 
 const AtomicString& Element::shadowPseudoId() const
 {
-    return hasRareData() ? rareData()->m_shadowPseudoId : nullAtom;
+    return hasRareData() ? elementRareData()->m_shadowPseudoId : nullAtom;
 }
 
 void Element::setShadowPseudoId(const AtomicString& id, ExceptionCode& ec)
@@ -1197,7 +1199,7 @@ void Element::setShadowPseudoId(const AtomicString& id, ExceptionCode& ec)
         return;
     }
 
-    ensureRareData()->m_shadowPseudoId = id;
+    ensureElementRareData()->m_shadowPseudoId = id;
 }
 
 bool Element::childTypeAllowed(NodeType type) const
@@ -1254,7 +1256,7 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
             firstElementAfterInsertion->setNeedsStyleRecalc();
             
         // We also have to handle node removal.
-        if (childCountDelta < 0 && newFirstChild == firstElementAfterInsertion && newFirstChild && newFirstChild->renderStyle() && !newFirstChild->renderStyle()->firstChildState())
+        if (childCountDelta < 0 && newFirstChild == firstElementAfterInsertion && newFirstChild && (!newFirstChild->renderStyle() || !newFirstChild->renderStyle()->firstChildState()))
             newFirstChild->setNeedsStyleRecalc();
     }
 
@@ -1277,7 +1279,7 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
             
         // We also have to handle node removal.  The parser callback case is similar to node removal as well in that we need to change the last child
         // to match now.
-        if ((childCountDelta < 0 || finishedParsingCallback) && newLastChild == lastElementBeforeInsertion && newLastChild && newLastChild->renderStyle() && !newLastChild->renderStyle()->lastChildState())
+        if ((childCountDelta < 0 || finishedParsingCallback) && newLastChild == lastElementBeforeInsertion && newLastChild && (!newLastChild->renderStyle() || !newLastChild->renderStyle()->lastChildState()))
             newLastChild->setNeedsStyleRecalc();
     }
 
@@ -1554,7 +1556,7 @@ void Element::focus(bool restorePreviousSelection)
     doc->updateLayoutIgnorePendingStylesheets();
 
     if (!isFocusable()) {
-        ensureRareData()->setNeedsFocusAppearanceUpdateSoonAfterAttach(true);
+        ensureElementRareData()->setNeedsFocusAppearanceUpdateSoonAfterAttach(true);
         return;
     }
         
@@ -1624,14 +1626,14 @@ String Element::title() const
 
 LayoutSize Element::minimumSizeForResizing() const
 {
-    return hasRareData() ? rareData()->m_minimumSizeForResizing : defaultMinimumSizeForResizing();
+    return hasRareData() ? elementRareData()->m_minimumSizeForResizing : defaultMinimumSizeForResizing();
 }
 
 void Element::setMinimumSizeForResizing(const LayoutSize& size)
 {
     if (size == defaultMinimumSizeForResizing() && !hasRareData())
         return;
-    ensureRareData()->m_minimumSizeForResizing = size;
+    ensureElementRareData()->m_minimumSizeForResizing = size;
 }
 
 RenderStyle* Element::computedStyle(PseudoId pseudoElementSpecifier)
@@ -1652,7 +1654,7 @@ RenderStyle* Element::computedStyle(PseudoId pseudoElementSpecifier)
         // document tree and figure out when to destroy the computed style for such elements.
         return 0;
 
-    ElementRareData* data = ensureRareData();
+    ElementRareData* data = ensureElementRareData();
     if (!data->m_computedStyle)
         data->m_computedStyle = document()->styleForElementIgnoringPendingStylesheets(this);
     return pseudoElementSpecifier ? data->m_computedStyle->getCachedPseudoStyle(pseudoElementSpecifier) : data->m_computedStyle.get();
@@ -1660,13 +1662,13 @@ RenderStyle* Element::computedStyle(PseudoId pseudoElementSpecifier)
 
 void Element::setStyleAffectedByEmpty()
 {
-    ElementRareData* data = ensureRareData();
+    ElementRareData* data = ensureElementRareData();
     data->m_styleAffectedByEmpty = true;
 }
 
 bool Element::styleAffectedByEmpty() const
 {
-    return hasRareData() && rareData()->m_styleAffectedByEmpty;
+    return hasRareData() && elementRareData()->m_styleAffectedByEmpty;
 }
 
 AtomicString Element::computeInheritedLanguage() const
@@ -1694,7 +1696,7 @@ AtomicString Element::computeInheritedLanguage() const
 void Element::cancelFocusAppearanceUpdate()
 {
     if (hasRareData())
-        rareData()->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
+        elementRareData()->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
     if (document()->focusedNode() == this)
         document()->cancelFocusAppearanceUpdate();
 }
@@ -1754,7 +1756,7 @@ bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
 
 DOMTokenList* Element::classList()
 {
-    ElementRareData* data = ensureRareData();
+    ElementRareData* data = ensureElementRareData();
     if (!data->m_classList)
         data->m_classList = ClassList::create(this);
     return data->m_classList.get();
@@ -1764,12 +1766,12 @@ DOMTokenList* Element::optionalClassList() const
 {
     if (!hasRareData())
         return 0;
-    return rareData()->m_classList.get();
+    return elementRareData()->m_classList.get();
 }
 
 DOMStringMap* Element::dataset()
 {
-    ElementRareData* data = ensureRareData();
+    ElementRareData* data = ensureElementRareData();
     if (!data->m_datasetDOMStringMap)
         data->m_datasetDOMStringMap = DatasetDOMStringMap::create(this);
     return data->m_datasetDOMStringMap.get();
@@ -1846,12 +1848,12 @@ void Element::webkitRequestFullScreen(unsigned short flags)
 
 bool Element::containsFullScreenElement() const
 {
-    return hasRareData() ? rareData()->m_containsFullScreenElement : false;
+    return hasRareData() ? elementRareData()->m_containsFullScreenElement : false;
 }
 
 void Element::setContainsFullScreenElement(bool flag)
 {
-    ensureRareData()->m_containsFullScreenElement = flag;
+    ensureElementRareData()->m_containsFullScreenElement = flag;
     setNeedsStyleRecalc(SyntheticStyleChange);
 }
 
@@ -1972,7 +1974,7 @@ bool Element::fastAttributeLookupAllowed(const QualifiedName& name) const
 #ifdef DUMP_NODE_STATISTICS
 bool Element::hasNamedNodeMap() const
 {
-    return hasRareData() && rareData()->m_attributeMap;
+    return hasRareData() && elementRareData()->m_attributeMap;
 }
 #endif
 
@@ -2039,21 +2041,63 @@ void Element::updateExtraNamedItemRegistration(const AtomicString& oldId, const
         static_cast<HTMLDocument*>(document())->addExtraNamedItem(newId);
 }
 
-HTMLCollection* Element::ensureCachedHTMLCollection(CollectionType type)
+PassRefPtr<HTMLCollection> Element::ensureCachedHTMLCollection(CollectionType type)
+{
+    return ensureElementRareData()->ensureCachedHTMLCollection(this, type);
+}
+
+PassRefPtr<HTMLCollection> ElementRareData::ensureCachedHTMLCollection(Element* element, CollectionType type)
+{
+    if (!m_cachedCollections) {
+        m_cachedCollections = adoptPtr(new CachedHTMLCollectionArray);
+        for (unsigned i = 0; i < NumNodeCollectionTypes; i++)
+            (*m_cachedCollections)[i] = 0;
+    }
+
+    if (HTMLCollection* collection = (*m_cachedCollections)[type - FirstNodeCollectionType])
+        return collection;
+
+    RefPtr<HTMLCollection> collection;
+    if (type == TableRows) {
+        ASSERT(element->hasTagName(tableTag));
+        collection = HTMLTableRowsCollection::create(element);
+    } else if (type == SelectOptions) {
+        ASSERT(element->hasTagName(selectTag));
+        collection = HTMLOptionsCollection::create(element);
+    } else if (type == FormControls) {
+        ASSERT(element->hasTagName(formTag) || element->hasTagName(fieldsetTag));
+        collection = HTMLFormCollection::create(element);
+#if ENABLE(MICRODATA)
+    } else if (type == ItemProperties) {
+        collection = HTMLPropertiesCollection::create(element);
+#endif
+    } else
+        collection = HTMLCollection::create(element, type);
+    (*m_cachedCollections)[type - FirstNodeCollectionType] = collection.get();
+    return collection.release();
+}
+
+HTMLCollection* Element::cachedHTMLCollection(CollectionType type)
 {
-    return ensureRareData()->ensureCachedHTMLCollection(this, type);
+    return hasRareData() ? elementRareData()->cachedHTMLCollection(type) : 0;
+}
+
+void Element::removeCachedHTMLCollection(HTMLCollection* collection, CollectionType type)
+{
+    ASSERT(hasRareData());
+    elementRareData()->removeCachedHTMLCollection(collection, type);
 }
 
 IntSize Element::savedLayerScrollOffset() const
 {
-    return hasRareData() ? rareData()->m_savedLayerScrollOffset : IntSize();
+    return hasRareData() ? elementRareData()->m_savedLayerScrollOffset : IntSize();
 }
 
 void Element::setSavedLayerScrollOffset(const IntSize& size)
 {
     if (size.isZero() && !hasRareData())
         return;
-    ensureRareData()->m_savedLayerScrollOffset = size;
+    ensureElementRareData()->m_savedLayerScrollOffset = size;
 }
 
 PassRefPtr<Attr> Element::attrIfExists(const QualifiedName& name)
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 6c52a603c..1d576a81a 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -142,7 +142,7 @@ public:
     bool hasAttribute(const String& name) const;
     bool hasAttributeNS(const String& namespaceURI, const String& localName) const;
 
-    const AtomicString& getAttribute(const String& name) const;
+    const AtomicString& getAttribute(const AtomicString& name) const;
     const AtomicString& getAttributeNS(const String& namespaceURI, const String& localName) const;
 
     void setAttribute(const AtomicString& name, const AtomicString& value, ExceptionCode&);
@@ -165,7 +165,7 @@ public:
     Attribute* attributeItem(unsigned index) const;
     Attribute* getAttributeItem(const QualifiedName&) const;
     size_t getAttributeItemIndex(const QualifiedName& name) const { return attributeData()->getAttributeItemIndex(name); }
-    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const { return attributeData()->getAttributeItemIndex(name, shouldIgnoreAttributeCase); }
+    size_t getAttributeItemIndex(const AtomicString& name, bool shouldIgnoreAttributeCase) const { return attributeData()->getAttributeItemIndex(name, shouldIgnoreAttributeCase); }
 
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
@@ -312,6 +312,8 @@ public:
     void didModifyAttribute(const Attribute&);
     void didRemoveAttribute(const QualifiedName&);
 
+    void removeCachedHTMLCollection(HTMLCollection*, CollectionType);
+
     LayoutSize minimumSizeForResizing() const;
     void setMinimumSizeForResizing(const LayoutSize&);
 
@@ -447,7 +449,8 @@ protected:
     virtual bool shouldRegisterAsNamedItem() const { return false; }
     virtual bool shouldRegisterAsExtraNamedItem() const { return false; }
 
-    HTMLCollection* ensureCachedHTMLCollection(CollectionType);
+    PassRefPtr<HTMLCollection> ensureCachedHTMLCollection(CollectionType);
+    HTMLCollection* cachedHTMLCollection(CollectionType);
 
 private:
     void updateInvalidAttributes() const;
@@ -489,9 +492,6 @@ private:
     QualifiedName m_tagName;
     virtual OwnPtr<NodeRareData> createRareData();
 
-    ElementRareData* rareData() const;
-    ElementRareData* ensureRareData();
-
     SpellcheckAttributeState spellcheckAttributeState() const;
 
     void updateNamedItemRegistration(const AtomicString& oldName, const AtomicString& newName);
@@ -500,6 +500,9 @@ private:
     void unregisterNamedFlowContentNode();
 
 private:
+    ElementRareData* elementRareData() const;
+    ElementRareData* ensureElementRareData();
+
     mutable OwnPtr<ElementAttributeData> m_attributeData;
 };
     
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index 0722cc838..ab2768e66 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -230,7 +230,7 @@ void ElementAttributeData::detachAttrObjectsFromElement(Element* element)
     ASSERT(!element->hasAttrList());
 }
 
-size_t ElementAttributeData::getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const
+size_t ElementAttributeData::getAttributeItemIndexSlowCase(const AtomicString& name, bool shouldIgnoreAttributeCase) const
 {
     // Continue to checking case-insensitively and/or full namespaced names if necessary:
     for (unsigned i = 0; i < m_attributes.size(); ++i) {
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index 90f1b91df..a13d4d258 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -82,7 +82,7 @@ public:
     Attribute* attributeItem(unsigned index) const { return &const_cast<ElementAttributeData*>(this)->m_attributes[index]; }
     Attribute* getAttributeItem(const QualifiedName& name) const { return findAttributeInVector(m_attributes, name); }
     size_t getAttributeItemIndex(const QualifiedName&) const;
-    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
+    size_t getAttributeItemIndex(const AtomicString& name, bool shouldIgnoreAttributeCase) const;
 
     // These functions do no error checking.
     void addAttribute(const Attribute&, Element*, EInUpdateStyleAttribute = NotInUpdateStyleAttribute);
@@ -122,8 +122,8 @@ private:
     Vector<Attribute> clonedAttributeVector() const { return m_attributes; }
 
     void detachAttrObjectsFromElement(Element*);
-    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
-    size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
+    Attribute* getAttributeItem(const AtomicString& name, bool shouldIgnoreAttributeCase) const;
+    size_t getAttributeItemIndexSlowCase(const AtomicString& name, bool shouldIgnoreAttributeCase) const;
     void cloneDataFrom(const ElementAttributeData& sourceData, const Element& sourceElement, Element& targetElement);
     void clearAttributes(Element*);
     void replaceAttribute(size_t index, const Attribute&, Element*);
@@ -145,7 +145,7 @@ inline void ElementAttributeData::removeAttribute(const QualifiedName& name, Ele
     return;
 }
 
-inline Attribute* ElementAttributeData::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+inline Attribute* ElementAttributeData::getAttributeItem(const AtomicString& name, bool shouldIgnoreAttributeCase) const
 {
     size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
     if (index != notFound)
@@ -164,7 +164,7 @@ inline size_t ElementAttributeData::getAttributeItemIndex(const QualifiedName& n
 
 // We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
 // can tune the behavior (hasAttribute is case sensitive whereas getAttribute is not).
-inline size_t ElementAttributeData::getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const
+inline size_t ElementAttributeData::getAttributeItemIndex(const AtomicString& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
     bool doSlowCheck = shouldIgnoreAttributeCase;
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index 8e7bcbcf4..3723d1a08 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -26,13 +26,14 @@
 #include "DatasetDOMStringMap.h"
 #include "Element.h"
 #include "ElementShadow.h"
-#include "HTMLCollection.h"
 #include "NamedNodeMap.h"
 #include "NodeRareData.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
+class HTMLCollection;
+
 class ElementRareData : public NodeRareData {
 public:
     ElementRareData();
@@ -43,24 +44,27 @@ public:
     using NodeRareData::needsFocusAppearanceUpdateSoonAfterAttach;
     using NodeRareData::setNeedsFocusAppearanceUpdateSoonAfterAttach;
 
-    typedef FixedArray<OwnPtr<HTMLCollection>, NumNodeCollectionTypes> CachedHTMLCollectionArray;
-
     bool hasCachedHTMLCollections() const
     {
         return m_cachedCollections;
     }
 
-    HTMLCollection* ensureCachedHTMLCollection(Element* element, CollectionType type)
+    PassRefPtr<HTMLCollection> ensureCachedHTMLCollection(Element*, CollectionType);
+    HTMLCollection* cachedHTMLCollection(CollectionType type)
     {
         if (!m_cachedCollections)
-            m_cachedCollections = adoptPtr(new CachedHTMLCollectionArray);
+            return 0;
 
-        OwnPtr<HTMLCollection>& collection = (*m_cachedCollections)[type - FirstNodeCollectionType];
-        if (!collection)
-            collection = HTMLCollection::create(element, type);
-        return collection.get();
+        return (*m_cachedCollections)[type - FirstNodeCollectionType];
+    }
+    void removeCachedHTMLCollection(HTMLCollection* collection, CollectionType type)
+    {
+        ASSERT(m_cachedCollections);
+        ASSERT_UNUSED(collection, (*m_cachedCollections)[type - FirstNodeCollectionType] == collection);
+        (*m_cachedCollections)[type - FirstNodeCollectionType] = 0;
     }
 
+    typedef FixedArray<HTMLCollection*, NumNodeCollectionTypes> CachedHTMLCollectionArray;
     OwnPtr<CachedHTMLCollectionArray> m_cachedCollections;
 
     LayoutSize m_minimumSizeForResizing;
diff --git a/Source/WebCore/dom/Event.cpp b/Source/WebCore/dom/Event.cpp
index c9a45dc49..761313c59 100644
--- a/Source/WebCore/dom/Event.cpp
+++ b/Source/WebCore/dom/Event.cpp
@@ -126,6 +126,11 @@ bool Event::isKeyboardEvent() const
     return false;
 }
 
+bool Event::isTouchEvent() const
+{
+    return false;
+}
+
 bool Event::isDragEvent() const
 {
     return false;
diff --git a/Source/WebCore/dom/Event.h b/Source/WebCore/dom/Event.h
index 36ed9a6d9..d298d90a7 100644
--- a/Source/WebCore/dom/Event.h
+++ b/Source/WebCore/dom/Event.h
@@ -120,6 +120,7 @@ namespace WebCore {
         virtual bool isUIEvent() const;
         virtual bool isMouseEvent() const;
         virtual bool isKeyboardEvent() const;
+        virtual bool isTouchEvent() const;
 
         // Drag events are a subset of mouse events.
         virtual bool isDragEvent() const;
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index 598bcdde5..836e6308b 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -216,6 +216,7 @@ namespace WebCore {
     macro(addstream) \
     macro(removestream) \
     macro(statechange) \
+    macro(removetrack) \
     \
     macro(show) \
     \
diff --git a/Source/WebCore/dom/EventNames.in b/Source/WebCore/dom/EventNames.in
index f42b4b4fb..9c0ac5558 100644
--- a/Source/WebCore/dom/EventNames.in
+++ b/Source/WebCore/dom/EventNames.in
@@ -30,6 +30,7 @@ XMLHttpRequestProgressEvent
 AudioProcessingEvent conditional=WEB_AUDIO
 OfflineAudioCompletionEvent conditional=WEB_AUDIO
 MediaStreamEvent conditional=MEDIA_STREAM
+MediaStreamTrackEvent conditional=MEDIA_STREAM
 SpeechInputEvent conditional=INPUT_SPEECH
 SpeechRecognitionError conditional=SCRIPTED_SPEECH
 SpeechRecognitionEvent conditional=SCRIPTED_SPEECH
diff --git a/Source/WebCore/dom/EventTargetFactory.in b/Source/WebCore/dom/EventTargetFactory.in
index 3ec6db944..821717b0d 100644
--- a/Source/WebCore/dom/EventTargetFactory.in
+++ b/Source/WebCore/dom/EventTargetFactory.in
@@ -17,6 +17,7 @@ JavaScriptAudioNode conditional=WEB_AUDIO
 LocalMediaStream conditional=MEDIA_STREAM
 MediaController conditional=VIDEO
 MediaStream conditional=MEDIA_STREAM
+MediaStreamTrackList conditional=MEDIA_STREAM
 MessagePort
 NetworkInfoConnection conditional=NETWORK_INFO
 Node
diff --git a/Source/WebCore/dom/MemoryInstrumentation.h b/Source/WebCore/dom/MemoryInstrumentation.h
index 6f0e7a470..7a0d41c50 100644
--- a/Source/WebCore/dom/MemoryInstrumentation.h
+++ b/Source/WebCore/dom/MemoryInstrumentation.h
@@ -31,7 +31,9 @@
 #ifndef MemoryInstrumentation_h
 #define MemoryInstrumentation_h
 
+#include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -46,6 +48,7 @@ public:
         Other,
         DOM,
         CSS,
+        Binding,
         LastTypeEntry
     };
 
@@ -58,11 +61,42 @@ public:
             return;
         countObjectSize(objectType, sizeof(T));
     }
+    template <typename HashMapType> void reportHashMap(const HashMapType&, ObjectType, bool contentOnly = false);
+    template <typename HashSetType> void reportHashSet(const HashSetType&, ObjectType, bool contentOnly = false);
+    template <typename ListHashSetType> void reportListHashSet(const ListHashSetType&, ObjectType, bool contentOnly = false);
+    template <typename VectorType> void reportVector(const VectorType&, ObjectType, bool contentOnly = false);
+
+protected:
+    class InstrumentedPointerBase {
+    public:
+        virtual ~InstrumentedPointerBase() { }
+
+        virtual void process(MemoryInstrumentation*) = 0;
+    };
+
+    template <typename Container>
+    size_t calculateContainerSize(const Container& container, bool contentOnly = false)
+    {
+        return (contentOnly ? 0 : sizeof(container)) + container.capacity() * sizeof(typename Container::ValueType);
+    }
 
 private:
     friend class MemoryObjectInfo;
 
+    template <typename T>
+    class InstrumentedPointer : public InstrumentedPointerBase {
+    public:
+        explicit InstrumentedPointer(const T* pointer) : m_pointer(pointer) { }
+
+        virtual void process(MemoryInstrumentation*) OVERRIDE;
+
+    private:
+        const T* m_pointer;
+    };
+
+    virtual void reportString(ObjectType, const String&) = 0;
     virtual void countObjectSize(ObjectType, size_t) = 0;
+    virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase>) = 0;
     virtual bool visited(const void*) = 0;
 };
 
@@ -104,9 +138,40 @@ public:
         m_objectSize = sizeof(T);
     }
 
+    template <typename HashMapType>
+    void reportHashMap(const HashMapType& map)
+    {
+        m_memoryInstrumentation->reportHashMap(map, objectType(), true);
+    }
+
+    template <typename HashSetType>
+    void reportHashSet(const HashSetType& set)
+    {
+        m_memoryInstrumentation->reportHashSet(set, objectType(), true);
+    }
+
+    template <typename ListHashSetType>
+    void reportListHashSet(const ListHashSetType& set)
+    {
+        m_memoryInstrumentation->reportListHashSet(set, objectType(), true);
+    }
+
+    template <typename VectorType>
+    void reportVector(const VectorType& vector)
+    {
+        m_memoryInstrumentation->reportVector(vector, objectType(), true);
+    }
+
+    void reportString(const String& string)
+    {
+        m_memoryInstrumentation->reportString(objectType(), string);
+    }
+
     MemoryInstrumentation::ObjectType objectType() const { return m_objectType; }
     size_t objectSize() const { return m_objectSize; }
 
+    MemoryInstrumentation* memoryInstrumentation() { return m_memoryInstrumentation; }
+
  private:
     MemoryInstrumentation* m_memoryInstrumentation;
     MemoryInstrumentation::ObjectType m_objectType;
@@ -118,9 +183,7 @@ void MemoryInstrumentation::reportInstrumentedPointer(const T* const object)
 {
     if (!object || visited(object))
         return;
-    MemoryObjectInfo memoryObjectInfo(this);
-    object->reportMemoryUsage(&memoryObjectInfo);
-    countObjectSize(memoryObjectInfo.objectType(), memoryObjectInfo.objectSize());
+    deferInstrumentedPointer(adoptPtr(new InstrumentedPointer<T>(object)));
 }
 
 template<typename T>
@@ -132,6 +195,45 @@ void MemoryInstrumentation::reportInstrumentedObject(const T& object)
     object.reportMemoryUsage(&memoryObjectInfo);
 }
 
+template<typename HashMapType>
+void MemoryInstrumentation::reportHashMap(const HashMapType& hashMap, ObjectType objectType, bool contentOnly)
+{
+    countObjectSize(objectType, calculateContainerSize(hashMap, contentOnly));
+}
+
+template<typename HashSetType>
+void MemoryInstrumentation::reportHashSet(const HashSetType& hashSet, ObjectType objectType, bool contentOnly)
+{
+    if (visited(&hashSet))
+        return;
+    countObjectSize(objectType, calculateContainerSize(hashSet, contentOnly));
+}
+
+template<typename ListHashSetType>
+void MemoryInstrumentation::reportListHashSet(const ListHashSetType& hashSet, ObjectType objectType, bool contentOnly)
+{
+    if (visited(&hashSet))
+        return;
+    size_t size = (contentOnly ? 0 : sizeof(ListHashSetType)) + hashSet.capacity() * sizeof(void*) + hashSet.size() * (sizeof(typename ListHashSetType::ValueType) + 2 * sizeof(void*));
+    countObjectSize(objectType, size);
+}
+
+template <typename VectorType>
+void MemoryInstrumentation::reportVector(const VectorType& vector, ObjectType objectType, bool contentOnly)
+{
+    if (visited(vector.data()))
+        return;
+    countObjectSize(objectType, calculateContainerSize(vector, contentOnly));
+}
+
+template<typename T>
+void MemoryInstrumentation::InstrumentedPointer<T>::process(MemoryInstrumentation* memoryInstrumentation)
+{
+    MemoryObjectInfo memoryObjectInfo(memoryInstrumentation);
+    m_pointer->reportMemoryUsage(&memoryObjectInfo);
+    memoryInstrumentation->countObjectSize(memoryObjectInfo.objectType(), memoryObjectInfo.objectSize());
+}
+
 } // namespace WebCore
 
 #endif // !defined(MemoryInstrumentation_h)
diff --git a/Source/WebCore/dom/MutationCallback.h b/Source/WebCore/dom/MutationCallback.h
index 80739c88a..119197abe 100644
--- a/Source/WebCore/dom/MutationCallback.h
+++ b/Source/WebCore/dom/MutationCallback.h
@@ -40,7 +40,7 @@
 namespace WebCore {
 
 class MutationRecord;
-class WebKitMutationObserver;
+class MutationObserver;
 
 typedef Vector<RefPtr<MutationRecord> > MutationRecordArray;
 
@@ -48,7 +48,7 @@ class MutationCallback : public RefCounted<MutationCallback> {
 public:
     virtual ~MutationCallback() { }
 
-    virtual bool handleEvent(MutationRecordArray*, WebKitMutationObserver*) = 0;
+    virtual bool handleEvent(MutationRecordArray*, MutationObserver*) = 0;
 };
 
 }
diff --git a/Source/WebCore/dom/MutationCallback.idl b/Source/WebCore/dom/MutationCallback.idl
index 16381714c..2aecd9be9 100644
--- a/Source/WebCore/dom/MutationCallback.idl
+++ b/Source/WebCore/dom/MutationCallback.idl
@@ -33,6 +33,6 @@ module core {
         Conditional=MUTATION_OBSERVERS,
         Callback
     ] MutationCallback {
-        [Custom] boolean handleEvent(in MutationRecordArray mutations, in WebKitMutationObserver observer);
+        [Custom] boolean handleEvent(in MutationRecordArray mutations, in MutationObserver observer);
     };
 }
diff --git a/Source/WebCore/dom/WebKitMutationObserver.cpp b/Source/WebCore/dom/MutationObserver.cpp
index 80c26a577..a40d507fe 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.cpp
+++ b/Source/WebCore/dom/MutationObserver.cpp
@@ -32,7 +32,7 @@
 
 #if ENABLE(MUTATION_OBSERVERS)
 
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 
 #include "Dictionary.h"
 #include "Document.h"
@@ -50,31 +50,31 @@ namespace WebCore {
 
 static unsigned s_observerPriority = 0;
 
-struct WebKitMutationObserver::ObserverLessThan {
-    bool operator()(const RefPtr<WebKitMutationObserver>& lhs, const RefPtr<WebKitMutationObserver>& rhs)
+struct MutationObserver::ObserverLessThan {
+    bool operator()(const RefPtr<MutationObserver>& lhs, const RefPtr<MutationObserver>& rhs)
     {
         return lhs->m_priority < rhs->m_priority;
     }
 };
 
-PassRefPtr<WebKitMutationObserver> WebKitMutationObserver::create(PassRefPtr<MutationCallback> callback)
+PassRefPtr<MutationObserver> MutationObserver::create(PassRefPtr<MutationCallback> callback)
 {
     ASSERT(isMainThread());
-    return adoptRef(new WebKitMutationObserver(callback));
+    return adoptRef(new MutationObserver(callback));
 }
 
-WebKitMutationObserver::WebKitMutationObserver(PassRefPtr<MutationCallback> callback)
+MutationObserver::MutationObserver(PassRefPtr<MutationCallback> callback)
     : m_callback(callback)
     , m_priority(s_observerPriority++)
 {
 }
 
-WebKitMutationObserver::~WebKitMutationObserver()
+MutationObserver::~MutationObserver()
 {
     ASSERT(m_registrations.isEmpty());
 }
 
-bool WebKitMutationObserver::validateOptions(MutationObserverOptions options)
+bool MutationObserver::validateOptions(MutationObserverOptions options)
 {
     return (options & (Attributes | CharacterData | ChildList))
         && ((options & Attributes) || !(options & AttributeOldValue))
@@ -82,7 +82,7 @@ bool WebKitMutationObserver::validateOptions(MutationObserverOptions options)
         && ((options & CharacterData) || !(options & CharacterDataOldValue));
 }
 
-void WebKitMutationObserver::observe(Node* node, const Dictionary& optionsDictionary, ExceptionCode& ec)
+void MutationObserver::observe(Node* node, const Dictionary& optionsDictionary, ExceptionCode& ec)
 {
     if (!node) {
         ec = NOT_FOUND_ERR;
@@ -93,12 +93,12 @@ void WebKitMutationObserver::observe(Node* node, const Dictionary& optionsDictio
         const char* name;
         MutationObserverOptions value;
     } booleanOptions[] = {
-        { "childList", WebKitMutationObserver::ChildList },
-        { "attributes", WebKitMutationObserver::Attributes },
-        { "characterData", WebKitMutationObserver::CharacterData },
-        { "subtree", WebKitMutationObserver::Subtree },
-        { "attributeOldValue", WebKitMutationObserver::AttributeOldValue },
-        { "characterDataOldValue", WebKitMutationObserver::CharacterDataOldValue }
+        { "childList", ChildList },
+        { "attributes", Attributes },
+        { "characterData", CharacterData },
+        { "subtree", Subtree },
+        { "attributeOldValue", AttributeOldValue },
+        { "characterDataOldValue", CharacterDataOldValue }
     };
     MutationObserverOptions options = 0;
     for (unsigned i = 0; i < sizeof(booleanOptions) / sizeof(booleanOptions[0]); ++i) {
@@ -109,7 +109,7 @@ void WebKitMutationObserver::observe(Node* node, const Dictionary& optionsDictio
 
     HashSet<AtomicString> attributeFilter;
     if (optionsDictionary.get("attributeFilter", attributeFilter))
-        options |= WebKitMutationObserver::AttributeFilter;
+        options |= AttributeFilter;
 
     if (!validateOptions(options)) {
         ec = SYNTAX_ERR;
@@ -122,14 +122,14 @@ void WebKitMutationObserver::observe(Node* node, const Dictionary& optionsDictio
     node->document()->addMutationObserverTypes(registration->mutationTypes());
 }
 
-Vector<RefPtr<MutationRecord> > WebKitMutationObserver::takeRecords()
+Vector<RefPtr<MutationRecord> > MutationObserver::takeRecords()
 {
     Vector<RefPtr<MutationRecord> > records;
     records.swap(m_records);
     return records;
 }
 
-void WebKitMutationObserver::disconnect()
+void MutationObserver::disconnect()
 {
     m_records.clear();
     HashSet<MutationObserverRegistration*> registrations(m_registrations);
@@ -137,19 +137,19 @@ void WebKitMutationObserver::disconnect()
         (*iter)->unregister();
 }
 
-void WebKitMutationObserver::observationStarted(MutationObserverRegistration* registration)
+void MutationObserver::observationStarted(MutationObserverRegistration* registration)
 {
     ASSERT(!m_registrations.contains(registration));
     m_registrations.add(registration);
 }
 
-void WebKitMutationObserver::observationEnded(MutationObserverRegistration* registration)
+void MutationObserver::observationEnded(MutationObserverRegistration* registration)
 {
     ASSERT(m_registrations.contains(registration));
     m_registrations.remove(registration);
 }
 
-typedef HashSet<RefPtr<WebKitMutationObserver> > MutationObserverSet;
+typedef HashSet<RefPtr<MutationObserver> > MutationObserverSet;
 
 static MutationObserverSet& activeMutationObservers()
 {
@@ -157,20 +157,20 @@ static MutationObserverSet& activeMutationObservers()
     return activeObservers;
 }
 
-void WebKitMutationObserver::enqueueMutationRecord(PassRefPtr<MutationRecord> mutation)
+void MutationObserver::enqueueMutationRecord(PassRefPtr<MutationRecord> mutation)
 {
     ASSERT(isMainThread());
     m_records.append(mutation);
     activeMutationObservers().add(this);
 }
 
-void WebKitMutationObserver::setHasTransientRegistration()
+void MutationObserver::setHasTransientRegistration()
 {
     ASSERT(isMainThread());
     activeMutationObservers().add(this);
 }
 
-void WebKitMutationObserver::deliver()
+void MutationObserver::deliver()
 {
     // Calling clearTransientRegistrations() can modify m_registrations, so it's necessary
     // to make a copy of the transient registrations before operating on them.
@@ -191,7 +191,7 @@ void WebKitMutationObserver::deliver()
     m_callback->handleEvent(&records, this);
 }
 
-void WebKitMutationObserver::deliverAllMutations()
+void MutationObserver::deliverAllMutations()
 {
     ASSERT(isMainThread());
     static bool deliveryInProgress = false;
@@ -200,7 +200,7 @@ void WebKitMutationObserver::deliverAllMutations()
     deliveryInProgress = true;
 
     while (!activeMutationObservers().isEmpty()) {
-        Vector<RefPtr<WebKitMutationObserver> > observers;
+        Vector<RefPtr<MutationObserver> > observers;
         copyToVector(activeMutationObservers(), observers);
         activeMutationObservers().clear();
         std::sort(observers.begin(), observers.end(), ObserverLessThan());
diff --git a/Source/WebCore/dom/WebKitMutationObserver.h b/Source/WebCore/dom/MutationObserver.h
index bf0964726..7fd372069 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.h
+++ b/Source/WebCore/dom/MutationObserver.h
@@ -28,8 +28,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebKitMutationObserver_h
-#define WebKitMutationObserver_h
+#ifndef MutationObserver_h
+#define MutationObserver_h
 
 #if ENABLE(MUTATION_OBSERVERS)
 
@@ -54,7 +54,7 @@ typedef int ExceptionCode;
 typedef unsigned char MutationObserverOptions;
 typedef unsigned char MutationRecordDeliveryOptions;
 
-class WebKitMutationObserver : public RefCounted<WebKitMutationObserver> {
+class MutationObserver : public RefCounted<MutationObserver> {
 public:
     enum MutationType {
         ChildList = 1 << 0,
@@ -74,10 +74,10 @@ public:
         CharacterDataOldValue = 1 << 6,
     };
 
-    static PassRefPtr<WebKitMutationObserver> create(PassRefPtr<MutationCallback>);
+    static PassRefPtr<MutationObserver> create(PassRefPtr<MutationCallback>);
     static void deliverAllMutations();
 
-    ~WebKitMutationObserver();
+    ~MutationObserver();
 
     void observe(Node*, const Dictionary&, ExceptionCode&);
     Vector<RefPtr<MutationRecord> > takeRecords();
@@ -90,7 +90,7 @@ public:
 private:
     struct ObserverLessThan;
 
-    WebKitMutationObserver(PassRefPtr<MutationCallback>);
+    MutationObserver(PassRefPtr<MutationCallback>);
     void deliver();
 
     static bool validateOptions(MutationObserverOptions);
@@ -105,4 +105,4 @@ private:
 
 #endif // ENABLE(MUTATION_OBSERVERS)
 
-#endif // WebKitMutationObserver_h
+#endif // MutationObserver_h
diff --git a/Source/WebCore/dom/WebKitMutationObserver.idl b/Source/WebCore/dom/MutationObserver.idl
index c338be28d..0ae992e6d 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.idl
+++ b/Source/WebCore/dom/MutationObserver.idl
@@ -33,7 +33,7 @@ module core {
         Conditional=MUTATION_OBSERVERS,
         CustomConstructor,
         ConstructorParameters=1
-    ] WebKitMutationObserver {
+    ] MutationObserver {
         void observe(in Node target, in Dictionary options)
             raises(DOMException);
         sequence<MutationRecord> takeRecords();
diff --git a/Source/WebCore/dom/MutationObserverInterestGroup.cpp b/Source/WebCore/dom/MutationObserverInterestGroup.cpp
index dd0288d51..24c0cb586 100644
--- a/Source/WebCore/dom/MutationObserverInterestGroup.cpp
+++ b/Source/WebCore/dom/MutationObserverInterestGroup.cpp
@@ -41,10 +41,10 @@
 
 namespace WebCore {
 
-PassOwnPtr<MutationObserverInterestGroup> MutationObserverInterestGroup::createIfNeeded(Node* target, WebKitMutationObserver::MutationType type, MutationRecordDeliveryOptions oldValueFlag, const QualifiedName* attributeName)
+PassOwnPtr<MutationObserverInterestGroup> MutationObserverInterestGroup::createIfNeeded(Node* target, MutationObserver::MutationType type, MutationRecordDeliveryOptions oldValueFlag, const QualifiedName* attributeName)
 {
-    ASSERT((type == WebKitMutationObserver::Attributes && attributeName) || !attributeName);
-    HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions> observers;
+    ASSERT((type == MutationObserver::Attributes && attributeName) || !attributeName);
+    HashMap<MutationObserver*, MutationRecordDeliveryOptions> observers;
     target->getRegisteredMutationObserversOfType(observers, type, attributeName);
     if (observers.isEmpty())
         return nullptr;
@@ -52,7 +52,7 @@ PassOwnPtr<MutationObserverInterestGroup> MutationObserverInterestGroup::createI
     return adoptPtr(new MutationObserverInterestGroup(observers, oldValueFlag));
 }
 
-MutationObserverInterestGroup::MutationObserverInterestGroup(HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>& observers, MutationRecordDeliveryOptions oldValueFlag)
+MutationObserverInterestGroup::MutationObserverInterestGroup(HashMap<MutationObserver*, MutationRecordDeliveryOptions>& observers, MutationRecordDeliveryOptions oldValueFlag)
     : m_oldValueFlag(oldValueFlag)
 {
     ASSERT(!observers.isEmpty());
@@ -61,7 +61,7 @@ MutationObserverInterestGroup::MutationObserverInterestGroup(HashMap<WebKitMutat
 
 bool MutationObserverInterestGroup::isOldValueRequested()
 {
-    for (HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>::iterator iter = m_observers.begin(); iter != m_observers.end(); ++iter) {
+    for (HashMap<MutationObserver*, MutationRecordDeliveryOptions>::iterator iter = m_observers.begin(); iter != m_observers.end(); ++iter) {
         if (hasOldValue(iter->second))
             return true;
     }
@@ -72,8 +72,8 @@ void MutationObserverInterestGroup::enqueueMutationRecord(PassRefPtr<MutationRec
 {
     RefPtr<MutationRecord> mutation = prpMutation;
     RefPtr<MutationRecord> mutationWithNullOldValue;
-    for (HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>::iterator iter = m_observers.begin(); iter != m_observers.end(); ++iter) {
-        WebKitMutationObserver* observer = iter->first;
+    for (HashMap<MutationObserver*, MutationRecordDeliveryOptions>::iterator iter = m_observers.begin(); iter != m_observers.end(); ++iter) {
+        MutationObserver* observer = iter->first;
         if (hasOldValue(iter->second)) {
             observer->enqueueMutationRecord(mutation);
             continue;
diff --git a/Source/WebCore/dom/MutationObserverInterestGroup.h b/Source/WebCore/dom/MutationObserverInterestGroup.h
index 933334a1b..7fde32eea 100644
--- a/Source/WebCore/dom/MutationObserverInterestGroup.h
+++ b/Source/WebCore/dom/MutationObserverInterestGroup.h
@@ -34,9 +34,9 @@
 #if ENABLE(MUTATION_OBSERVERS)
 
 #include "Document.h"
+#include "MutationObserver.h"
 #include "Node.h"
 #include "QualifiedName.h"
-#include "WebKitMutationObserver.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassOwnPtr.h>
 
@@ -46,39 +46,39 @@ class MutationObserverInterestGroup {
 public:
     static PassOwnPtr<MutationObserverInterestGroup> createForChildListMutation(Node* target)
     {
-        if (!target->document()->hasMutationObserversOfType(WebKitMutationObserver::ChildList))
+        if (!target->document()->hasMutationObserversOfType(MutationObserver::ChildList))
             return nullptr;
 
         MutationRecordDeliveryOptions oldValueFlag = 0;
-        return createIfNeeded(target, WebKitMutationObserver::ChildList, oldValueFlag);
+        return createIfNeeded(target, MutationObserver::ChildList, oldValueFlag);
     }
 
     static PassOwnPtr<MutationObserverInterestGroup> createForCharacterDataMutation(Node* target)
     {
-        if (!target->document()->hasMutationObserversOfType(WebKitMutationObserver::CharacterData))
+        if (!target->document()->hasMutationObserversOfType(MutationObserver::CharacterData))
             return nullptr;
 
-        return createIfNeeded(target, WebKitMutationObserver::CharacterData, WebKitMutationObserver::CharacterDataOldValue);
+        return createIfNeeded(target, MutationObserver::CharacterData, MutationObserver::CharacterDataOldValue);
     }
 
     static PassOwnPtr<MutationObserverInterestGroup> createForAttributesMutation(Node* target, const QualifiedName& attributeName)
     {
-        if (!target->document()->hasMutationObserversOfType(WebKitMutationObserver::Attributes))
+        if (!target->document()->hasMutationObserversOfType(MutationObserver::Attributes))
             return nullptr;
 
-        return createIfNeeded(target, WebKitMutationObserver::Attributes, WebKitMutationObserver::AttributeOldValue, &attributeName);
+        return createIfNeeded(target, MutationObserver::Attributes, MutationObserver::AttributeOldValue, &attributeName);
     }
 
     bool isOldValueRequested();
     void enqueueMutationRecord(PassRefPtr<MutationRecord>);
 
 private:
-    static PassOwnPtr<MutationObserverInterestGroup> createIfNeeded(Node* target, WebKitMutationObserver::MutationType, MutationRecordDeliveryOptions oldValueFlag, const QualifiedName* attributeName = 0);
-    MutationObserverInterestGroup(HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>& observers, MutationRecordDeliveryOptions oldValueFlag);
+    static PassOwnPtr<MutationObserverInterestGroup> createIfNeeded(Node* target, MutationObserver::MutationType, MutationRecordDeliveryOptions oldValueFlag, const QualifiedName* attributeName = 0);
+    MutationObserverInterestGroup(HashMap<MutationObserver*, MutationRecordDeliveryOptions>& observers, MutationRecordDeliveryOptions oldValueFlag);
 
     bool hasOldValue(MutationRecordDeliveryOptions options) { return options & m_oldValueFlag; }
 
-    HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions> m_observers;
+    HashMap<MutationObserver*, MutationRecordDeliveryOptions> m_observers;
     MutationRecordDeliveryOptions m_oldValueFlag;
 };
 
diff --git a/Source/WebCore/dom/MutationObserverRegistration.cpp b/Source/WebCore/dom/MutationObserverRegistration.cpp
index 190b85bd8..5895ef49f 100644
--- a/Source/WebCore/dom/MutationObserverRegistration.cpp
+++ b/Source/WebCore/dom/MutationObserverRegistration.cpp
@@ -40,12 +40,12 @@
 
 namespace WebCore {
 
-PassOwnPtr<MutationObserverRegistration> MutationObserverRegistration::create(PassRefPtr<WebKitMutationObserver> observer, Node* registrationNode)
+PassOwnPtr<MutationObserverRegistration> MutationObserverRegistration::create(PassRefPtr<MutationObserver> observer, Node* registrationNode)
 {
     return adoptPtr(new MutationObserverRegistration(observer, registrationNode));
 }
 
-MutationObserverRegistration::MutationObserverRegistration(PassRefPtr<WebKitMutationObserver> observer, Node* registrationNode)
+MutationObserverRegistration::MutationObserverRegistration(PassRefPtr<MutationObserver> observer, Node* registrationNode)
      : m_observer(observer)
      , m_registrationNode(registrationNode)
      , m_options(0)
@@ -105,16 +105,16 @@ void MutationObserverRegistration::unregister()
     // The above line will cause this object to be deleted, so don't do any more in this function.
 }
 
-bool MutationObserverRegistration::shouldReceiveMutationFrom(Node* node, WebKitMutationObserver::MutationType type, const QualifiedName* attributeName)
+bool MutationObserverRegistration::shouldReceiveMutationFrom(Node* node, MutationObserver::MutationType type, const QualifiedName* attributeName)
 {
-    ASSERT((type == WebKitMutationObserver::Attributes && attributeName) || !attributeName);
+    ASSERT((type == MutationObserver::Attributes && attributeName) || !attributeName);
     if (!(m_options & type))
         return false;
 
     if (m_registrationNode != node && !isSubtree())
         return false;
 
-    if (type != WebKitMutationObserver::Attributes || !(m_options & WebKitMutationObserver::AttributeFilter))
+    if (type != MutationObserver::Attributes || !(m_options & MutationObserver::AttributeFilter))
         return true;
 
     if (!attributeName->namespaceURI().isNull())
diff --git a/Source/WebCore/dom/MutationObserverRegistration.h b/Source/WebCore/dom/MutationObserverRegistration.h
index 232ee25d5..d4914625a 100644
--- a/Source/WebCore/dom/MutationObserverRegistration.h
+++ b/Source/WebCore/dom/MutationObserverRegistration.h
@@ -33,7 +33,7 @@
 
 #if ENABLE(MUTATION_OBSERVERS)
 
-#include "WebKitMutationObserver.h"
+#include "MutationObserver.h"
 #include <wtf/HashSet.h>
 #include <wtf/text/AtomicString.h>
 #include <wtf/text/AtomicStringHash.h>
@@ -45,7 +45,7 @@ class QualifiedName;
 class MutationObserverRegistration {
 public:
 
-    static PassOwnPtr<MutationObserverRegistration> create(PassRefPtr<WebKitMutationObserver>, Node*);
+    static PassOwnPtr<MutationObserverRegistration> create(PassRefPtr<MutationObserver>, Node*);
 
     ~MutationObserverRegistration();
 
@@ -55,19 +55,19 @@ public:
     bool hasTransientRegistrations() { return m_transientRegistrationNodes && !m_transientRegistrationNodes->isEmpty(); }
     void unregister();
 
-    bool shouldReceiveMutationFrom(Node*, WebKitMutationObserver::MutationType, const QualifiedName* attributeName);
-    bool inline isSubtree() const { return m_options & WebKitMutationObserver::Subtree; }
+    bool shouldReceiveMutationFrom(Node*, MutationObserver::MutationType, const QualifiedName* attributeName);
+    bool inline isSubtree() const { return m_options & MutationObserver::Subtree; }
 
-    WebKitMutationObserver* observer() { return m_observer.get(); }
-    MutationRecordDeliveryOptions deliveryOptions() const { return m_options & (WebKitMutationObserver::AttributeOldValue | WebKitMutationObserver::CharacterDataOldValue); }
-    MutationObserverOptions mutationTypes() const { return m_options & WebKitMutationObserver::AllMutationTypes; }
+    MutationObserver* observer() { return m_observer.get(); }
+    MutationRecordDeliveryOptions deliveryOptions() const { return m_options & (MutationObserver::AttributeOldValue | MutationObserver::CharacterDataOldValue); }
+    MutationObserverOptions mutationTypes() const { return m_options & MutationObserver::AllMutationTypes; }
 
 private:
-    MutationObserverRegistration(PassRefPtr<WebKitMutationObserver>, Node*);
+    MutationObserverRegistration(PassRefPtr<MutationObserver>, Node*);
 
     const HashSet<AtomicString>& caseInsensitiveAttributeFilter();
 
-    RefPtr<WebKitMutationObserver> m_observer;
+    RefPtr<MutationObserver> m_observer;
     Node* m_registrationNode;
     RefPtr<Node> m_registrationNodeKeepAlive;
     typedef HashSet<RefPtr<Node> > NodeHashSet;
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index ae3945be5..0950cd933 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -399,7 +399,6 @@ Node::~Node()
     liveNodeSet.remove(this);
 #endif
 
-    ASSERT(hasRareData() == NodeRareData::rareDataMap().contains(this));
     if (hasRareData())
         clearRareData();
 
@@ -459,17 +458,25 @@ TreeScope* Node::treeScope() const
 NodeRareData* Node::rareData() const
 {
     ASSERT(hasRareData());
-    return NodeRareData::rareDataFromMap(this);
+    NodeRareData* data = isDocumentNode() ? static_cast<const Document*>(this)->documentRareData() : NodeRareData::rareDataFromMap(this);
+    ASSERT(data);
+    return data;
 }
 
 NodeRareData* Node::ensureRareData()
 {
     if (hasRareData())
         return rareData();
-    
-    ASSERT(!NodeRareData::rareDataMap().contains(this));
+
     NodeRareData* data = createRareData().leakPtr();
-    NodeRareData::rareDataMap().set(this, data);
+    if (isDocumentNode()) {
+        // Fast path for a Document. A Document knows a pointer to NodeRareData.
+        ASSERT(!static_cast<Document*>(this)->documentRareData());
+        static_cast<Document*>(this)->setDocumentRareData(data);
+    } else {
+        ASSERT(!NodeRareData::rareDataMap().contains(this));
+        NodeRareData::rareDataMap().set(this, data);
+    }
     setFlag(HasRareDataFlag);
     return data;
 }
@@ -489,11 +496,19 @@ void Node::clearRareData()
     ASSERT(!transientMutationObserverRegistry() || transientMutationObserverRegistry()->isEmpty());
 #endif
 
-    NodeRareData::NodeRareDataMap& dataMap = NodeRareData::rareDataMap();
-    NodeRareData::NodeRareDataMap::iterator it = dataMap.find(this);
-    ASSERT(it != dataMap.end());
-    delete it->second;
-    dataMap.remove(it);
+    if (isDocumentNode()) {
+        Document* document = static_cast<Document*>(this);
+        NodeRareData* data = document->documentRareData();
+        ASSERT(data);
+        delete data;
+        document->setDocumentRareData(0);
+    } else {
+        NodeRareData::NodeRareDataMap& dataMap = NodeRareData::rareDataMap();
+        NodeRareData::NodeRareDataMap::iterator it = dataMap.find(this);
+        ASSERT(it != dataMap.end());
+        delete it->second;
+        dataMap.remove(it);
+    }
     clearFlag(HasRareDataFlag);
 }
 
@@ -2403,16 +2418,16 @@ HashSet<MutationObserverRegistration*>* Node::transientMutationObserverRegistry(
     return hasRareData() ? rareData()->transientMutationObserverRegistry() : 0;
 }
 
-void Node::collectMatchingObserversForMutation(HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>& observers, Node* fromNode, WebKitMutationObserver::MutationType type, const QualifiedName* attributeName)
+void Node::collectMatchingObserversForMutation(HashMap<MutationObserver*, MutationRecordDeliveryOptions>& observers, Node* fromNode, MutationObserver::MutationType type, const QualifiedName* attributeName)
 {
-    ASSERT((type == WebKitMutationObserver::Attributes && attributeName) || !attributeName);
+    ASSERT((type == MutationObserver::Attributes && attributeName) || !attributeName);
     if (Vector<OwnPtr<MutationObserverRegistration> >* registry = fromNode->mutationObserverRegistry()) {
         const size_t size = registry->size();
         for (size_t i = 0; i < size; ++i) {
             MutationObserverRegistration* registration = registry->at(i).get();
             if (registration->shouldReceiveMutationFrom(this, type, attributeName)) {
                 MutationRecordDeliveryOptions deliveryOptions = registration->deliveryOptions();
-                HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>::AddResult result = observers.add(registration->observer(), deliveryOptions);
+                HashMap<MutationObserver*, MutationRecordDeliveryOptions>::AddResult result = observers.add(registration->observer(), deliveryOptions);
                 if (!result.isNewEntry)
                     result.iterator->second |= deliveryOptions;
 
@@ -2425,7 +2440,7 @@ void Node::collectMatchingObserversForMutation(HashMap<WebKitMutationObserver*,
             MutationObserverRegistration* registration = *iter;
             if (registration->shouldReceiveMutationFrom(this, type, attributeName)) {
                 MutationRecordDeliveryOptions deliveryOptions = registration->deliveryOptions();
-                HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>::AddResult result = observers.add(registration->observer(), deliveryOptions);
+                HashMap<MutationObserver*, MutationRecordDeliveryOptions>::AddResult result = observers.add(registration->observer(), deliveryOptions);
                 if (!result.isNewEntry)
                     result.iterator->second |= deliveryOptions;
             }
@@ -2433,15 +2448,15 @@ void Node::collectMatchingObserversForMutation(HashMap<WebKitMutationObserver*,
     }
 }
 
-void Node::getRegisteredMutationObserversOfType(HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>& observers, WebKitMutationObserver::MutationType type, const QualifiedName* attributeName)
+void Node::getRegisteredMutationObserversOfType(HashMap<MutationObserver*, MutationRecordDeliveryOptions>& observers, MutationObserver::MutationType type, const QualifiedName* attributeName)
 {
-    ASSERT((type == WebKitMutationObserver::Attributes && attributeName) || !attributeName);
+    ASSERT((type == MutationObserver::Attributes && attributeName) || !attributeName);
     collectMatchingObserversForMutation(observers, this, type, attributeName);
     for (Node* node = parentNode(); node; node = node->parentNode())
         collectMatchingObserversForMutation(observers, node, type, attributeName);
 }
 
-MutationObserverRegistration* Node::registerMutationObserver(PassRefPtr<WebKitMutationObserver> observer)
+MutationObserverRegistration* Node::registerMutationObserver(PassRefPtr<MutationObserver> observer)
 {
     Vector<OwnPtr<MutationObserverRegistration> >* registry = ensureRareData()->ensureMutationObserverRegistry();
     for (size_t i = 0; i < registry->size(); ++i) {
@@ -2763,10 +2778,6 @@ void Node::setItemType(const String& value)
     ensureRareData()->setItemType(value);
 }
 
-HTMLPropertiesCollection* Node::properties()
-{
-    return ensureRareData()->properties(this);
-}
 #endif
 
 void NodeRareData::createNodeLists(Node* node)
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index c9c2674d2..93a66d9ec 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -30,10 +30,10 @@
 #include "KURLHash.h"
 #include "LayoutTypes.h"
 #include "MemoryInstrumentation.h"
+#include "MutationObserver.h"
 #include "RenderStyleConstants.h"
 #include "ScriptWrappable.h"
 #include "TreeShared.h"
-#include "WebKitMutationObserver.h"
 #include <wtf/Forward.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/text/AtomicString.h>
@@ -630,12 +630,11 @@ public:
     DOMSettableTokenList* itemProp();
     DOMSettableTokenList* itemRef();
     DOMSettableTokenList* itemType();
-    HTMLPropertiesCollection* properties();
 #endif
 
 #if ENABLE(MUTATION_OBSERVERS)
-    void getRegisteredMutationObserversOfType(HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>&, WebKitMutationObserver::MutationType, const QualifiedName* attributeName);
-    MutationObserverRegistration* registerMutationObserver(PassRefPtr<WebKitMutationObserver>);
+    void getRegisteredMutationObserversOfType(HashMap<MutationObserver*, MutationRecordDeliveryOptions>&, MutationObserver::MutationType, const QualifiedName* attributeName);
+    MutationObserverRegistration* registerMutationObserver(PassRefPtr<MutationObserver>);
     void unregisterMutationObserver(MutationObserverRegistration*);
     void registerTransientMutationObserver(MutationObserverRegistration*);
     void unregisterTransientMutationObserver(MutationObserverRegistration*);
@@ -781,7 +780,7 @@ private:
 #if ENABLE(MUTATION_OBSERVERS)
     Vector<OwnPtr<MutationObserverRegistration> >* mutationObserverRegistry();
     HashSet<MutationObserverRegistration*>* transientMutationObserverRegistry();
-    void collectMatchingObserversForMutation(HashMap<WebKitMutationObserver*, MutationRecordDeliveryOptions>&, Node* fromNode, WebKitMutationObserver::MutationType, const QualifiedName* attributeName);
+    void collectMatchingObserversForMutation(HashMap<MutationObserver*, MutationRecordDeliveryOptions>&, Node* fromNode, MutationObserver::MutationType, const QualifiedName* attributeName);
 #endif
 
     mutable uint32_t m_nodeFlags;
@@ -808,9 +807,9 @@ protected:
     bool isSynchronizingSVGAttributes() const { return getFlag(IsSynchronizingSVGAttributesFlag); }
     void setIsSynchronizingSVGAttributes() const { setFlag(IsSynchronizingSVGAttributesFlag); }
     void clearIsSynchronizingSVGAttributes() const { clearFlag(IsSynchronizingSVGAttributesFlag); }
-    bool hasRareSVGData() const { return getFlag(HasSVGRareDataFlag); }
-    void setHasRareSVGData() { setFlag(HasSVGRareDataFlag); }
-    void clearHasRareSVGData() { clearFlag(HasSVGRareDataFlag); }
+    bool hasSVGRareData() const { return getFlag(HasSVGRareDataFlag); }
+    void setHasSVGRareData() { setFlag(HasSVGRareDataFlag); }
+    void clearHasSVGRareData() { clearFlag(HasSVGRareDataFlag); }
 #endif
 
 #if ENABLE(MICRODATA)
diff --git a/Source/WebCore/dom/NodeList.idl b/Source/WebCore/dom/NodeList.idl
index 71544d16b..e5d0f9074 100644
--- a/Source/WebCore/dom/NodeList.idl
+++ b/Source/WebCore/dom/NodeList.idl
@@ -21,9 +21,10 @@
 module core {
 
     interface [
-        JSCustomIsReachable,
+        CustomIsReachable,
         IndexedGetter,
-        NamedGetter
+        NamedGetter,
+        V8DependentLifetime
     ] NodeList {
 
         Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index b7f359e60..5c03d8b38 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -25,10 +25,10 @@
 #include "ChildNodeList.h"
 #include "DOMSettableTokenList.h"
 #include "DynamicNodeList.h"
+#include "MutationObserver.h"
 #include "MutationObserverRegistration.h"
 #include "QualifiedName.h"
 #include "TagNodeList.h"
-#include "WebKitMutationObserver.h"
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -305,14 +305,6 @@ public:
 
         m_itemType->setValue(value);
     }
-
-    HTMLPropertiesCollection* properties(Node* node)
-    {
-        if (!m_properties)
-            m_properties = HTMLPropertiesCollection::create(node);
-
-        return m_properties.get();
-    }
 #endif
 
 #if ENABLE(STYLE_SCOPED)
@@ -368,7 +360,6 @@ private:
     mutable RefPtr<DOMSettableTokenList> m_itemProp;
     mutable RefPtr<DOMSettableTokenList> m_itemRef;
     mutable RefPtr<DOMSettableTokenList> m_itemType;
-    mutable OwnPtr<HTMLPropertiesCollection> m_properties;
 #endif
 
 #if ENABLE(STYLE_SCOPED)
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index b62ffe20e..180aa94fe 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "NodeRenderingContext.h"
 
+#include "ComposedShadowTreeWalker.h"
 #include "ContainerNode.h"
 #include "ContentDistributor.h"
 #include "ElementShadow.h"
@@ -53,80 +54,14 @@ static RenderObject* lastRendererOf(Node*);
 
 NodeRenderingContext::NodeRenderingContext(Node* node)
     : m_node(node)
-    , m_parentNodeForRenderingAndStyle(0)
-    , m_resetStyleInheritance(false)
-    , m_insertionPoint(0)
     , m_style(0)
     , m_parentFlowRenderer(0)
 {
-    ContainerNode* parent = m_node->parentOrHostNode();
-    if (!parent)
-        return;
-
-    if (parent->isShadowRoot() && toShadowRoot(parent)->isYoungest()) {
-        m_parentNodeForRenderingAndStyle = toShadowRoot(parent)->host();
-        m_resetStyleInheritance = toShadowRoot(parent)->resetStyleInheritance();
-        return;
-    }
-
-    if (parent->isElementNode() || parent->isShadowRoot()) {
-        ElementShadow* parentShadow = 0;
-
-        if (parent->isElementNode())
-            parentShadow = toElement(parent)->shadow();
-        else if (parent->isShadowRoot())
-            parentShadow = toShadowRoot(parent)->owner();
-
-        if (parentShadow) {
-            parentShadow->ensureDistribution();
-
-            if (InsertionPoint* insertionPoint = parentShadow->insertionPointFor(m_node)) {
-                if (insertionPoint->shadowRoot()->isUsedForRendering()) {
-                    NodeRenderingContext insertionPointContext(insertionPoint);
-                    m_parentNodeForRenderingAndStyle = insertionPointContext.parentNodeForRenderingAndStyle();
-                    m_resetStyleInheritance = insertionPointContext.resetStyleInheritance();
-                    m_insertionPoint = insertionPoint;
-                    return;
-                }
-            }
-
-            return;
-        }
-
-        if (isLowerEncapsulationBoundary(parent)) {
-            ShadowRoot* parentScope = parent->shadowRoot();
-            parentScope->owner()->ensureDistribution();
-
-            // The shadow tree isn't part of composed tree.
-            if (!parentScope->isUsedForRendering())
-                return;
-
-            // the parent insertion point doesn't need any fallback content.
-            if (toInsertionPoint(parent)->hasDistribution())
-                return;
-
-            if (toInsertionPoint(parent)->isActive()) {
-                // Uses m_node as a fallback node of the insertion point.
-                NodeRenderingContext parentContext(parent);
-                m_parentNodeForRenderingAndStyle = parentContext.parentNodeForRenderingAndStyle();
-                m_resetStyleInheritance = parentContext.resetStyleInheritance();
-                return;
-            }
-
-            // The insertion point isn't active thus behaves as a plain old element.
-            m_parentNodeForRenderingAndStyle = parent;
-            return;
-        }
-    }
-
-    m_parentNodeForRenderingAndStyle = parent;
+    ComposedShadowTreeWalker::findParent(m_node, &m_parentDetails);
 }
 
 NodeRenderingContext::NodeRenderingContext(Node* node, RenderStyle* style)
     : m_node(node)
-    , m_parentNodeForRenderingAndStyle(0)
-    , m_resetStyleInheritance(false)
-    , m_insertionPoint(0)
     , m_style(style)
     , m_parentFlowRenderer(0)
 {
@@ -242,10 +177,10 @@ RenderObject* NodeRenderingContext::nextRenderer() const
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->nextRendererForNode(m_node);
 
-    if (m_insertionPoint) {
-        if (RenderObject* found = nextRendererOfInsertionPoint(m_insertionPoint, m_node))
+    if (m_parentDetails.insertionPoint()) {
+        if (RenderObject* found = nextRendererOfInsertionPoint(m_parentDetails.insertionPoint(), m_node))
             return found;
-        return NodeRenderingContext(m_insertionPoint).nextRenderer();
+        return NodeRenderingContext(m_parentDetails.insertionPoint()).nextRenderer();
     }
 
     // Avoid an O(N^2) problem with this function by not checking for
@@ -264,10 +199,10 @@ RenderObject* NodeRenderingContext::previousRenderer() const
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer->previousRendererForNode(m_node);
 
-    if (m_insertionPoint) {
-        if (RenderObject* found = previousRendererOfInsertionPoint(m_insertionPoint, m_node))
+    if (m_parentDetails.insertionPoint()) {
+        if (RenderObject* found = previousRendererOfInsertionPoint(m_parentDetails.insertionPoint(), m_node))
             return found;
-        return NodeRenderingContext(m_insertionPoint).previousRenderer();
+        return NodeRenderingContext(m_parentDetails.insertionPoint()).previousRenderer();
     }
 
     // FIXME: We should have the same O(N^2) avoidance as nextRenderer does
@@ -282,19 +217,19 @@ RenderObject* NodeRenderingContext::parentRenderer() const
     if (m_parentFlowRenderer)
         return m_parentFlowRenderer;
 
-    return m_parentNodeForRenderingAndStyle ? m_parentNodeForRenderingAndStyle->renderer() : 0;
+    return m_parentDetails.node() ? m_parentDetails.node()->renderer() : 0;
 }
 
 bool NodeRenderingContext::shouldCreateRenderer() const
 {
-    if (!m_parentNodeForRenderingAndStyle)
+    if (!m_parentDetails.node())
         return false;
     RenderObject* parentRenderer = this->parentRenderer();
     if (!parentRenderer)
         return false;
     if (!parentRenderer->canHaveChildren())
         return false;
-    if (!m_parentNodeForRenderingAndStyle->childShouldCreateRenderer(*this))
+    if (!m_parentDetails.node()->childShouldCreateRenderer(*this))
         return false;
     return true;
 }
@@ -327,7 +262,7 @@ void NodeRenderingContext::moveToFlowThreadIfNeeded()
 
 bool NodeRenderingContext::isOnEncapsulationBoundary() const
 {
-    return isOnUpperEncapsulationBoundary() || isLowerEncapsulationBoundary(m_insertionPoint) || isLowerEncapsulationBoundary(m_node->parentNode());
+    return isOnUpperEncapsulationBoundary() || isLowerEncapsulationBoundary(m_parentDetails.insertionPoint()) || isLowerEncapsulationBoundary(m_node->parentNode());
 }
 
 bool NodeRenderingContext::isOnUpperEncapsulationBoundary() const
diff --git a/Source/WebCore/dom/NodeRenderingContext.h b/Source/WebCore/dom/NodeRenderingContext.h
index 28f028fe9..36171dd1e 100644
--- a/Source/WebCore/dom/NodeRenderingContext.h
+++ b/Source/WebCore/dom/NodeRenderingContext.h
@@ -26,6 +26,7 @@
 #ifndef NodeRenderingContext_h
 #define NodeRenderingContext_h
 
+#include "ComposedShadowTreeWalker.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/AtomicString.h>
@@ -69,9 +70,7 @@ public:
 
 private:
     Node* m_node;
-    ContainerNode* m_parentNodeForRenderingAndStyle;
-    bool m_resetStyleInheritance;
-    InsertionPoint* m_insertionPoint;
+    ComposedShadowTreeWalker::ParentTranversalDetails m_parentDetails;
     RefPtr<RenderStyle> m_style;
     RenderNamedFlowThread* m_parentFlowRenderer;
     AtomicString m_flowThread;
@@ -84,12 +83,12 @@ inline Node* NodeRenderingContext::node() const
 
 inline ContainerNode* NodeRenderingContext::parentNodeForRenderingAndStyle() const
 {
-    return m_parentNodeForRenderingAndStyle;
+    return m_parentDetails.node();
 }
 
 inline bool NodeRenderingContext::resetStyleInheritance() const
 {
-    return m_resetStyleInheritance;
+    return m_parentDetails.resetStyleInheritance();
 }
 
 inline RenderStyle* NodeRenderingContext::style() const
@@ -99,7 +98,7 @@ inline RenderStyle* NodeRenderingContext::style() const
 
 inline InsertionPoint* NodeRenderingContext::insertionPoint() const
 {
-    return m_insertionPoint;
+    return m_parentDetails.insertionPoint();
 }
 
 class NodeRendererFactory {
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 746e6c37b..9c1654e1f 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -250,6 +250,8 @@ bool ScriptElement::requestScript(const String& sourceUrl)
         return false;
     if (!m_element->inDocument() || m_element->document() != originalDocument)
         return false;
+    if (!m_element->document()->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr), m_element->document()->url(), m_startLineNumber, m_element->document()->completeURL(sourceUrl)))
+        return false;
 
     ASSERT(!m_cachedScript);
     if (!stripLeadingAndTrailingHTMLSpaces(sourceUrl).isEmpty()) {
@@ -281,6 +283,9 @@ void ScriptElement::executeScript(const ScriptSourceCode& sourceCode)
     if (sourceCode.isEmpty())
         return;
 
+    if (!m_element->document()->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr), m_element->document()->url(), m_startLineNumber))
+        return;
+
     if (!m_isExternalScript && !m_element->document()->contentSecurityPolicy()->allowInlineScript(m_element->document()->url(), m_startLineNumber))
         return;
 
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 2c57560bf..6c2e5c7d1 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -99,10 +99,10 @@ static bool allowsAuthorShadowRoot(Element* element)
 
 PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ExceptionCode& ec)
 {
-    return create(element, CreatingAuthorShadowRoot, ec);
+    return create(element, AuthorShadowRoot, ec);
 }
 
-PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPurpose purpose, ExceptionCode& ec)
+PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootType type, ExceptionCode& ec)
 {
     if (!element) {
         ec = HIERARCHY_REQUEST_ERR;
@@ -111,12 +111,15 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPu
 
     // Since some elements recreates shadow root dynamically, multiple shadow subtrees won't work well in that element.
     // Until they are fixed, we disable adding author shadow root for them.
-    if (purpose == CreatingAuthorShadowRoot && !allowsAuthorShadowRoot(element)) {
+    if (type == AuthorShadowRoot && !allowsAuthorShadowRoot(element)) {
         ec = HIERARCHY_REQUEST_ERR;
         return 0;
     }
 
     RefPtr<ShadowRoot> shadowRoot = adoptRef(new ShadowRoot(element->document()));
+#ifndef NDEBUG
+    shadowRoot->m_type = type;
+#endif
 
     ec = 0;
     element->ensureShadow()->addShadowRoot(element, shadowRoot, ec);
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index 6a76e4f22..9c9fcd006 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -51,11 +51,11 @@ public:
     // if a shadow root is dynamically created. So we prohibit multiple shadow subtrees
     // in several elements for a while.
     // See https://bugs.webkit.org/show_bug.cgi?id=77503 and related bugs.
-    enum ShadowRootCreationPurpose {
-        CreatingUserAgentShadowRoot,
-        CreatingAuthorShadowRoot,
+    enum ShadowRootType {
+        UserAgentShadowRoot,
+        AuthorShadowRoot
     };
-    static PassRefPtr<ShadowRoot> create(Element*, ShadowRootCreationPurpose, ExceptionCode& = ASSERT_NO_EXCEPTION);
+    static PassRefPtr<ShadowRoot> create(Element*, ShadowRootType, ExceptionCode& = ASSERT_NO_EXCEPTION);
 
     void recalcShadowTreeStyle(StyleChange);
 
@@ -89,6 +89,10 @@ public:
     InsertionPoint* assignedTo() const;
     void setAssignedTo(InsertionPoint*);
 
+#ifndef NDEBUG
+    ShadowRootType type() const { return m_type; }
+#endif
+
 private:
     ShadowRoot(Document*);
     virtual ~ShadowRoot();
@@ -102,6 +106,10 @@ private:
     bool m_applyAuthorStyles : 1;
     bool m_resetStyleInheritance : 1;
     InsertionPoint* m_insertionPointAssignedTo;
+
+#ifndef NDEBUG
+    ShadowRootType m_type;
+#endif
 };
 
 inline Element* ShadowRoot::host() const
diff --git a/Source/WebCore/dom/SpaceSplitString.h b/Source/WebCore/dom/SpaceSplitString.h
index 36521d46e..6c5037ddb 100644
--- a/Source/WebCore/dom/SpaceSplitString.h
+++ b/Source/WebCore/dom/SpaceSplitString.h
@@ -49,6 +49,7 @@ namespace WebCore {
         void add(const AtomicString&);
         void remove(const AtomicString&);
 
+        bool isUnique() const { return m_keyString.isNull(); } 
         size_t size() const { return m_vector.size(); }
         const AtomicString& operator[](size_t i) { ASSERT(i < size()); return m_vector[i]; }
 
@@ -82,7 +83,7 @@ namespace WebCore {
     private:
         void ensureUnique()
         {
-            if (m_data && !m_data->hasOneRef())
+            if (m_data && !m_data->isUnique())
                 m_data = SpaceSplitStringData::createUnique(*m_data);
         }
 
diff --git a/Source/WebCore/dom/Touch.cpp b/Source/WebCore/dom/Touch.cpp
index cf721df90..a6bda2568 100644
--- a/Source/WebCore/dom/Touch.cpp
+++ b/Source/WebCore/dom/Touch.cpp
@@ -29,6 +29,7 @@
 
 #include "Touch.h"
 
+#include "DOMWindow.h"
 #include "Frame.h"
 #include "FrameView.h"
 
@@ -68,6 +69,10 @@ Touch::Touch(Frame* frame, EventTarget* target, unsigned identifier, int screenX
     , m_rotationAngle(rotationAngle)
     , m_force(force)
 {
+    float scaleFactor = frame->pageZoomFactor() * frame->frameScaleFactor();
+    float x = pageX * scaleFactor;
+    float y = pageY * scaleFactor;
+    m_absoluteLocation = roundedLayoutPoint(FloatPoint(x, y));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Touch.h b/Source/WebCore/dom/Touch.h
index f4c9e8061..1e80253e6 100644
--- a/Source/WebCore/dom/Touch.h
+++ b/Source/WebCore/dom/Touch.h
@@ -29,6 +29,7 @@
 #if ENABLE(TOUCH_EVENTS)
 
 #include "EventTarget.h"
+#include "LayoutTypes.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -59,6 +60,7 @@ public:
     int webkitRadiusY() const { return m_radiusY; }
     float webkitRotationAngle() const { return m_rotationAngle; }
     float webkitForce() const { return m_force; }
+    const LayoutPoint& absoluteLocation() const { return m_absoluteLocation; }
 
 private:
     Touch(Frame* frame, EventTarget* target, unsigned identifier,
@@ -77,6 +79,7 @@ private:
     int m_radiusY;
     float m_rotationAngle;
     float m_force;
+    LayoutPoint m_absoluteLocation;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/TouchEvent.cpp b/Source/WebCore/dom/TouchEvent.cpp
index bfd6360fb..a58f1dcc9 100644
--- a/Source/WebCore/dom/TouchEvent.cpp
+++ b/Source/WebCore/dom/TouchEvent.cpp
@@ -94,6 +94,11 @@ const AtomicString& TouchEvent::interfaceName() const
     return eventNames().interfaceForTouchEvent;
 }
 
+bool TouchEvent::isTouchEvent() const
+{
+    return true;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(TOUCH_EVENTS)
diff --git a/Source/WebCore/dom/TouchEvent.h b/Source/WebCore/dom/TouchEvent.h
index 297e340f4..b2e5b2ee3 100644
--- a/Source/WebCore/dom/TouchEvent.h
+++ b/Source/WebCore/dom/TouchEvent.h
@@ -69,6 +69,7 @@ public:
     void setTouchHold(bool touchHold) { m_touchHold = touchHold; }
     bool isTouchHold() const { return m_touchHold; }
 #endif
+    virtual bool isTouchEvent() const OVERRIDE;
 
     virtual const AtomicString& interfaceName() const;
 
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index a93e14eea..dc22e6e1f 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -41,11 +41,9 @@ using namespace std;
 
 namespace WebCore {
 
-// FIXME: We shouldn't hardcode the targetDPI to 160.
-// See https://bugs.webkit.org/show_bug.cgi?id=88114
-static float targetDPI = 160;
+const float ViewportArguments::deprecatedTargetDPI = 160;
 
-ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, int deviceDPI, IntSize visibleViewport)
+ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, float devicePixelRatio, IntSize visibleViewport)
 {
     ViewportAttributes result;
 
@@ -54,7 +52,7 @@ ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktop
 
     ASSERT(availableWidth > 0 && availableHeight > 0);
 
-    result.devicePixelRatio = deviceDPI / targetDPI;
+    result.devicePixelRatio = devicePixelRatio;
 
     // Resolve non-'auto' width and height to pixel values.
     if (result.devicePixelRatio != 1.0) {
diff --git a/Source/WebCore/dom/ViewportArguments.h b/Source/WebCore/dom/ViewportArguments.h
index 707630592..94fb1fab8 100644
--- a/Source/WebCore/dom/ViewportArguments.h
+++ b/Source/WebCore/dom/ViewportArguments.h
@@ -72,10 +72,6 @@ struct ViewportArguments {
         ValueDesktopWidth = -2,
         ValueDeviceWidth = -3,
         ValueDeviceHeight = -4,
-        ValueDeviceDPI = -5,
-        ValueLowDPI = -6,
-        ValueMediumDPI = -7,
-        ValueHighDPI = -8
     };
 
     ViewportArguments(Type type = Implicit)
@@ -112,9 +108,14 @@ struct ViewportArguments {
     {
         return !(*this == other);
     }
+
+    // FIXME: We're going to keep this constant around until all embedders
+    // refactor their code to no longer need it.
+    static const float deprecatedTargetDPI;
 };
 
-ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, int deviceDPI, IntSize visibleViewport);
+ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, float devicePixelRatio, IntSize visibleViewport);
+
 void restrictMinimumScaleFactorToViewportSize(ViewportAttributes& result, IntSize visibleViewport);
 void restrictScaleFactorToInitialScaleIfNotUserScalable(ViewportAttributes& result);
 float computeMinimumScaleFactorForContentContained(const ViewportAttributes& result, const IntSize& viewportSize, const IntSize& contentSize);
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index 19e122922..0ffb703fd 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -56,7 +56,23 @@ bool WebKitNamedFlow::overset() const
     return m_parentFlowThread->overset();
 }
 
-PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContentNode(Node* contentNode)
+int WebKitNamedFlow::firstEmptyRegionIndex() const
+{
+    m_parentFlowThread->document()->updateLayoutIgnorePendingStylesheets();
+
+    const RenderRegionList& regionList = m_parentFlowThread->renderRegionList();
+    if (regionList.isEmpty())
+        return -1;
+    RenderRegionList::const_iterator iter = regionList.begin();
+    for (int index = 0; iter != regionList.end(); ++index, ++iter) {
+        const RenderRegion* renderRegion = *iter;
+        if (renderRegion->regionState() == RenderRegion::RegionEmpty)
+            return index;
+    }
+    return -1;
+}
+
+PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContent(Node* contentNode)
 {
     if (!contentNode)
         return 0;
@@ -79,7 +95,7 @@ PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContentNode(Node* contentNode)
     return StaticNodeList::adopt(regionNodes);
 }
 
-PassRefPtr<NodeList> WebKitNamedFlow::contentNodes() const
+PassRefPtr<NodeList> WebKitNamedFlow::getContent()
 {
     m_parentFlowThread->document()->updateLayoutIgnorePendingStylesheets();
 
diff --git a/Source/WebCore/dom/WebKitNamedFlow.h b/Source/WebCore/dom/WebKitNamedFlow.h
index b81e5a4b0..f0c6a124c 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.h
+++ b/Source/WebCore/dom/WebKitNamedFlow.h
@@ -51,8 +51,9 @@ public:
 
     String name() const;
     bool overset() const;
-    PassRefPtr<NodeList> getRegionsByContentNode(Node*);
-    PassRefPtr<NodeList> contentNodes() const;
+    int firstEmptyRegionIndex() const;
+    PassRefPtr<NodeList> getRegionsByContent(Node*);
+    PassRefPtr<NodeList> getContent();
 
 private:
     WebKitNamedFlow(RenderNamedFlowThread*);
diff --git a/Source/WebCore/dom/WebKitNamedFlow.idl b/Source/WebCore/dom/WebKitNamedFlow.idl
index 0da90e00c..f586a9d08 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.idl
+++ b/Source/WebCore/dom/WebKitNamedFlow.idl
@@ -33,8 +33,9 @@ module core {
     ] WebKitNamedFlow {
         readonly attribute DOMString name;
         readonly attribute boolean overset;
-        NodeList getRegionsByContentNode(in Node contentNode);
-        readonly attribute NodeList contentNodes;
+        readonly attribute int firstEmptyRegionIndex;
+        NodeList getRegionsByContent(in Node contentNode);
+        NodeList getContent();
     };
 }
 
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 9018a8949..c3043b504 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -2085,7 +2085,7 @@ void Editor::markAndReplaceFor(PassRefPtr<SpellCheckRequest> request, const Vect
             if (result->type == TextCheckingTypeLink && selectionOffset > resultLocation + resultLength + 1)
                 continue;
 
-            if (!(shouldPerformReplacement || shouldCheckForCorrection || shouldMarkLink) || !doReplacement)
+            if (!(shouldPerformReplacement || shouldShowCorrectionPanel || shouldMarkLink) || !doReplacement)
                 continue;
 
             String replacedString = plainText(rangeToReplace.get());
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index bc16190b7..60772e8bb 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -123,6 +123,9 @@ static Position positionAvoidingPrecedingNodes(Position pos)
     // The two positions above are the same visual position, but we want to stay in the same block.
     Node* enclosingBlockNode = enclosingBlock(pos.containerNode());
     for (Position nextPosition = pos; nextPosition.containerNode() != enclosingBlockNode; pos = nextPosition) {
+        if (lineBreakExistsAtPosition(pos))
+            break;
+
         if (pos.containerNode()->nonShadowBoundaryParentNode())
             nextPosition = positionInParentAfterNode(pos.containerNode());
         
diff --git a/Source/WebCore/editing/SpellingCorrectionCommand.cpp b/Source/WebCore/editing/SpellingCorrectionCommand.cpp
index 225cf9351..673b68271 100644
--- a/Source/WebCore/editing/SpellingCorrectionCommand.cpp
+++ b/Source/WebCore/editing/SpellingCorrectionCommand.cpp
@@ -30,7 +30,7 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "Frame.h"
-#include "ReplaceSelectionCommand.h"
+#include "InsertTextCommand.h"
 #include "SetSelectionCommand.h"
 #include "TextIterator.h"
 #include "markup.h"
@@ -97,15 +97,11 @@ void SpellingCorrectionCommand::doApply()
     if (!document()->frame()->selection()->shouldChangeSelection(m_selectionToBeCorrected))
         return;
 
-    RefPtr<DocumentFragment> fragment = createFragmentFromText(m_rangeToBeCorrected.get(), m_correction);
-    if (!fragment)
-        return;
-
     applyCommandToComposite(SetSelectionCommand::create(m_selectionToBeCorrected, FrameSelection::SpellCorrectionTriggered | FrameSelection::CloseTyping | FrameSelection::ClearTypingStyle));
 #if USE(AUTOCORRECTION_PANEL)
     applyCommandToComposite(SpellingCorrectionRecordUndoCommand::create(document(), m_corrected, m_correction));
 #endif
-    applyCommandToComposite(ReplaceSelectionCommand::create(document(), fragment, ReplaceSelectionCommand::MatchStyle | ReplaceSelectionCommand::PreventNesting, EditActionPaste));
+    applyCommandToComposite(InsertTextCommand::create(document(), m_correction));
 }
 
 bool SpellingCorrectionCommand::shouldRetainAutocorrectionIndicator() const
diff --git a/Source/WebCore/editing/SurroundingText.cpp b/Source/WebCore/editing/SurroundingText.cpp
index df9aa7e80..4c8dae459 100644
--- a/Source/WebCore/editing/SurroundingText.cpp
+++ b/Source/WebCore/editing/SurroundingText.cpp
@@ -43,20 +43,35 @@ namespace WebCore {
 SurroundingText::SurroundingText(const VisiblePosition& visiblePosition, unsigned maxLength)
     : m_positionOffsetInContent(0)
 {
+    if (visiblePosition.isNull())
+        return;
+
     const unsigned halfMaxLength = maxLength / 2;
     CharacterIterator forwardIterator(makeRange(visiblePosition, endOfDocument(visiblePosition)).get(), TextIteratorStopsOnFormControls);
-    forwardIterator.advance(maxLength - halfMaxLength);
+    if (!forwardIterator.atEnd())
+        forwardIterator.advance(maxLength - halfMaxLength);
 
     Position position = visiblePosition.deepEquivalent().parentAnchoredEquivalent();
     Document* document = position.document();
-    if (!Range::create(document, position, forwardIterator.range()->startPosition())->text().length())
+    RefPtr<Range> forwardRange = forwardIterator.range();
+    if (!forwardRange || !Range::create(document, position, forwardRange->startPosition())->text().length()) {
+        ASSERT(forwardRange);
         return;
+    }
 
     BackwardsCharacterIterator backwardsIterator(makeRange(startOfDocument(visiblePosition), visiblePosition).get(), TextIteratorStopsOnFormControls);
-    backwardsIterator.advance(halfMaxLength);
+    if (!backwardsIterator.atEnd())
+        backwardsIterator.advance(halfMaxLength);
+
+    RefPtr<Range> backwardsRange = backwardsIterator.range();
+    if (!backwardsRange) {
+        ASSERT(backwardsRange);
+        return;
+    }
 
-    m_positionOffsetInContent = Range::create(document, backwardsIterator.range()->endPosition(), position)->text().length();
-    m_contentRange = Range::create(document, backwardsIterator.range()->endPosition(), forwardIterator.range()->startPosition());
+    m_positionOffsetInContent = Range::create(document, backwardsRange->endPosition(), position)->text().length();
+    m_contentRange = Range::create(document, backwardsRange->endPosition(), forwardRange->startPosition());
+    ASSERT(m_contentRange);
 }
 
 PassRefPtr<Range> SurroundingText::rangeFromContentOffsets(unsigned startOffsetInContent, unsigned endOffsetInContent)
@@ -65,11 +80,19 @@ PassRefPtr<Range> SurroundingText::rangeFromContentOffsets(unsigned startOffsetI
         return 0;
 
     CharacterIterator iterator(m_contentRange.get());
+
+    ASSERT(!iterator.atEnd());
     iterator.advance(startOffsetInContent);
 
+    ASSERT(iterator.range());
     Position start = iterator.range()->startPosition();
+
+    ASSERT(!iterator.atEnd());
     iterator.advance(endOffsetInContent - startOffsetInContent);
+
+    ASSERT(iterator.range());
     Position end = iterator.range()->startPosition();
+
     return Range::create(start.document(), start, end);
 }
 
diff --git a/Source/WebCore/editing/TypingCommand.cpp b/Source/WebCore/editing/TypingCommand.cpp
index f3c42329f..219473694 100644
--- a/Source/WebCore/editing/TypingCommand.cpp
+++ b/Source/WebCore/editing/TypingCommand.cpp
@@ -297,7 +297,7 @@ void TypingCommand::markMisspellingsAfterTyping(ETypingCommand commandType)
     if (!frame)
         return;
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC)
     if (!frame->editor()->isContinuousSpellCheckingEnabled()
      && !frame->editor()->isAutomaticQuoteSubstitutionEnabled()
      && !frame->editor()->isAutomaticLinkDetectionEnabled()
@@ -336,7 +336,7 @@ void TypingCommand::typingAddedToOpenCommand(ETypingCommand commandTypeForAddedT
 
     updatePreservesTypingStyle(commandTypeForAddedTyping);
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC)
     frame->editor()->appliedEditing(this);
     // Since the spellchecking code may also perform corrections and other replacements, it should happen after the typing changes.
     if (!m_shouldPreventSpellChecking)
diff --git a/Source/WebCore/editing/VisibleSelection.h b/Source/WebCore/editing/VisibleSelection.h
index 2312769bb..92282040f 100644
--- a/Source/WebCore/editing/VisibleSelection.h
+++ b/Source/WebCore/editing/VisibleSelection.h
@@ -28,7 +28,6 @@
 
 #include "TextGranularity.h"
 #include "VisiblePosition.h"
-#include "htmlediting.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index d8aa5dfa3..c42c623bf 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -81,7 +81,7 @@ void Editor::pasteWithPasteboard(Pasteboard* pasteboard, bool allowPlainText)
     bool choosePlainText;
     
     m_frame->editor()->client()->setInsertionPasteboard(NSGeneralPboard);
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     RefPtr<DocumentFragment> fragment = pasteboard->documentFragment(m_frame, range, allowPlainText, choosePlainText);
     if (fragment && shouldInsertFragment(fragment, range, EditorInsertActionPasted))
         pasteAsFragment(fragment, canSmartReplaceWithPasteboard(pasteboard), false);
diff --git a/Source/WebCore/fileapi/WebKitBlobBuilder.idl b/Source/WebCore/fileapi/WebKitBlobBuilder.idl
index e3479a40a..8ec12802a 100644
--- a/Source/WebCore/fileapi/WebKitBlobBuilder.idl
+++ b/Source/WebCore/fileapi/WebKitBlobBuilder.idl
@@ -39,10 +39,10 @@ module html {
 #if !defined(LANGUAGE_OBJECTIVE_C)
         Blob getBlob(in [Optional, TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString contentType);
 #endif
-        void append(in Blob blob);
+        void append(in Blob? blob);
 #if defined(ENABLE_BLOB) && ENABLE_BLOB
-        [CallWith=ScriptExecutionContext] void append(in ArrayBuffer arrayBuffer);
-        void append(in ArrayBufferView arrayBufferView);
+        [CallWith=ScriptExecutionContext] void append(in ArrayBuffer? arrayBuffer);
+        void append(in ArrayBufferView? arrayBufferView);
 #endif
         void append(in DOMString value, in [Optional, TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString endings) raises (DOMException);
     };
diff --git a/Source/WebCore/html/BaseTextInputType.cpp b/Source/WebCore/html/BaseTextInputType.cpp
index 3eb661f06..dfc823d87 100644
--- a/Source/WebCore/html/BaseTextInputType.cpp
+++ b/Source/WebCore/html/BaseTextInputType.cpp
@@ -41,7 +41,7 @@ bool BaseTextInputType::patternMismatch(const String& value) const
 {
     const AtomicString& rawPattern = element()->fastGetAttribute(patternAttr);
     // Empty values can't be mismatched
-    if (rawPattern.isEmpty() || value.isEmpty())
+    if (rawPattern.isNull() || value.isEmpty())
         return false;
     String pattern = "^(" + rawPattern + ")$";
     int matchLength = 0;
diff --git a/Source/WebCore/html/CollectionType.h b/Source/WebCore/html/CollectionType.h
index dd71d918b..f308afd15 100644
--- a/Source/WebCore/html/CollectionType.h
+++ b/Source/WebCore/html/CollectionType.h
@@ -49,8 +49,10 @@ enum CollectionType {
     NodeChildren, // first-level children (IE)
     TableTBodies, // all <tbody> elements in this table
     TSectionRows, // all row elements in this table section
+    TableRows,
     TRCells,      // all cells in this row
     SelectOptions,
+    SelectedOptions,
     DataListOptions,
     MapAreas,
 
@@ -58,15 +60,24 @@ enum CollectionType {
     ItemProperties, // Microdata item properties in the document
 #endif
 
-    FormControls,
-    OtherCollection
+    FormControls
 };
 
 static const CollectionType FirstUnnamedDocumentCachedType = DocImages;
-static const unsigned NumUnnamedDocumentCachedTypes = WindowNamedItems - DocImages + 1;
+static const unsigned NumUnnamedDocumentCachedTypes = WindowNamedItems - DocImages;
 
 static const CollectionType FirstNodeCollectionType = NodeChildren;
-static const unsigned NumNodeCollectionTypes = OtherCollection - NodeChildren + 1;
+static const unsigned NumNodeCollectionTypes = FormControls - NodeChildren + 1;
+
+inline bool isUnnamedDocumentCachedType(CollectionType type)
+{
+    return static_cast<unsigned>(type) < NumUnnamedDocumentCachedTypes;
+}
+
+inline bool isNodeCollectionType(CollectionType type)
+{
+    return type >= FirstNodeCollectionType;
+}
 
 } // namespace
 
diff --git a/Source/WebCore/html/DOMURL.idl b/Source/WebCore/html/DOMURL.idl
index 44bb63849..ed04c23d5 100644
--- a/Source/WebCore/html/DOMURL.idl
+++ b/Source/WebCore/html/DOMURL.idl
@@ -34,9 +34,9 @@ module html {
         InterfaceName=URL
     ] DOMURL {
 #if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in MediaStream stream);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in MediaStream? stream);
 #endif
-        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in Blob blob);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Null] static DOMString createObjectURL(in Blob? blob);
         [CallWith=ScriptExecutionContext] static void revokeObjectURL(in DOMString url);
     };
 }
diff --git a/Source/WebCore/html/FormController.cpp b/Source/WebCore/html/FormController.cpp
index 8719443b4..b7c38e2a8 100644
--- a/Source/WebCore/html/FormController.cpp
+++ b/Source/WebCore/html/FormController.cpp
@@ -22,6 +22,8 @@
 #include "FormController.h"
 
 #include "HTMLFormControlElementWithState.h"
+#include "HTMLFormElement.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -67,6 +69,74 @@ FormControlState FormControlState::deserialize(const Vector<String>& stateVector
 
 // ----------------------------------------------------------------------------
 
+class FormKeyGenerator {
+    WTF_MAKE_NONCOPYABLE(FormKeyGenerator);
+    WTF_MAKE_FAST_ALLOCATED;
+
+public:
+    static PassOwnPtr<FormKeyGenerator> create() { return adoptPtr(new FormKeyGenerator); }
+    AtomicString formKey(const HTMLFormControlElementWithState&);
+    void willDeleteForm(HTMLFormElement*);
+
+private:
+    FormKeyGenerator() { }
+
+    typedef HashMap<HTMLFormElement*, AtomicString> FormToKeyMap;
+    FormToKeyMap m_formToKeyMap;
+    HashSet<AtomicString> m_existingKeys;
+};
+
+static inline AtomicString createKey(HTMLFormElement* form, unsigned index)
+{
+    ASSERT(form);
+    KURL actionURL = form->getURLAttribute(actionAttr);
+    // Remove the query part because it might contain volatile parameters such
+    // as a session key.
+    actionURL.setQuery(String());
+    StringBuilder builder;
+    if (!actionURL.isEmpty())
+        builder.append(actionURL.string());
+    builder.append(" #");
+    builder.append(String::number(index));
+    return builder.toAtomicString();
+}
+
+AtomicString FormKeyGenerator::formKey(const HTMLFormControlElementWithState& control)
+{
+    // Assume contorl with form attribute have no owners because we restores
+    // state during parsing and form owners of such controls might be
+    // indeterminate.
+    HTMLFormElement* form = control.fastHasAttribute(formAttr) ? 0 : control.form();
+    if (!form) {
+        DEFINE_STATIC_LOCAL(AtomicString, formKeyForNoOwner, ("No owner"));
+        return formKeyForNoOwner;
+    }
+    FormToKeyMap::const_iterator it = m_formToKeyMap.find(form);
+    if (it != m_formToKeyMap.end())
+        return it->second;
+
+    AtomicString candidateKey;
+    unsigned index = 0;
+    do {
+        candidateKey = createKey(form, index++);
+    } while (!m_existingKeys.add(candidateKey).isNewEntry);
+    m_formToKeyMap.add(form, candidateKey);
+    return candidateKey;
+}
+
+void FormKeyGenerator::willDeleteForm(HTMLFormElement* form)
+{
+    ASSERT(form);
+    if (m_formToKeyMap.isEmpty())
+        return;
+    FormToKeyMap::iterator it = m_formToKeyMap.find(form);
+    if (it == m_formToKeyMap.end())
+        return;
+    m_existingKeys.remove(it->second);
+    m_formToKeyMap.remove(it);
+}
+
+// ----------------------------------------------------------------------------
 
 FormController::FormController()
 {
@@ -81,14 +151,15 @@ static String formStateSignature()
     // In the legacy version of serialized state, the first item was a name
     // attribute value of a form control. The following string literal should
     // contain some characters which are rarely used for name attribute values.
-    DEFINE_STATIC_LOCAL(String, signature, ("\n\r?% WebKit serialized form state version 3 \n\r=&"));
+    DEFINE_STATIC_LOCAL(String, signature, ("\n\r?% WebKit serialized form state version 5 \n\r=&"));
     return signature;
 }
 
 Vector<String> FormController::formElementsState() const
 {
+    OwnPtr<FormKeyGenerator> keyGenerator = FormKeyGenerator::create();
     Vector<String> stateVector;
-    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 4 + 1);
+    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 5 + 1);
     stateVector.append(formStateSignature());
     typedef FormElementListHashSet::const_iterator Iterator;
     Iterator end = m_formElementsWithState.end();
@@ -98,6 +169,7 @@ Vector<String> FormController::formElementsState() const
             continue;
         stateVector.append(elementWithState->name().string());
         stateVector.append(elementWithState->formControlType().string());
+        stateVector.append(keyGenerator->formKey(*elementWithState).string());
         elementWithState->saveFormControlState().serializeTo(stateVector);
     }
     return stateVector;
@@ -120,11 +192,12 @@ void FormController::setStateForNewFormElements(const Vector<String>& stateVecto
     while (i + 2 < stateVector.size()) {
         AtomicString name = stateVector[i++];
         AtomicString type = stateVector[i++];
+        AtomicString formKey = stateVector[i++];
         FormControlState state = FormControlState::deserialize(stateVector, i);
         if (type.isEmpty() || type.impl()->find(isNotFormControlTypeCharacter) != notFound || state.isFailure())
             break;
 
-        FormElementKey key(name.impl(), type.impl());
+        FormElementKey key(name.impl(), type.impl(), formKey.impl());
         Iterator it = m_stateForNewFormElements.find(key);
         if (it != m_stateForNewFormElements.end())
             it->second.append(state);
@@ -142,17 +215,28 @@ FormControlState FormController::takeStateForFormElement(const HTMLFormControlEl
 {
     if (m_stateForNewFormElements.isEmpty())
         return FormControlState();
+    if (!m_formKeyGenerator)
+        m_formKeyGenerator = FormKeyGenerator::create();
     typedef FormElementStateMap::iterator Iterator;
-    Iterator it = m_stateForNewFormElements.find(FormElementKey(control.name().impl(), control.type().impl()));
+    Iterator it = m_stateForNewFormElements.find(FormElementKey(control.name().impl(), control.type().impl(), m_formKeyGenerator->formKey(control).impl()));
     if (it == m_stateForNewFormElements.end())
         return FormControlState();
     ASSERT(it->second.size());
     FormControlState state = it->second.takeFirst();
-    if (!it->second.size())
+    if (!it->second.size()) {
         m_stateForNewFormElements.remove(it);
+        if (m_stateForNewFormElements.isEmpty())
+            m_formKeyGenerator.clear();
+    }
     return state;
 }
 
+void FormController::willDeleteForm(HTMLFormElement* form)
+{
+    if (m_formKeyGenerator)
+        m_formKeyGenerator->willDeleteForm(form);
+}
+
 void FormController::registerFormElementWithFormAttribute(FormAssociatedElement* element)
 {
     ASSERT(toHTMLElement(element)->fastHasAttribute(formAttr));
@@ -172,8 +256,10 @@ void FormController::resetFormElementsOwner()
         (*it)->resetFormOwner();
 }
 
-FormElementKey::FormElementKey(AtomicStringImpl* name, AtomicStringImpl* type)
-    : m_name(name), m_type(type)
+FormElementKey::FormElementKey(AtomicStringImpl* name, AtomicStringImpl* type, AtomicStringImpl* formKey)
+    : m_name(name)
+    , m_type(type)
+    , m_formKey(formKey)
 {
     ref();
 }
@@ -184,7 +270,9 @@ FormElementKey::~FormElementKey()
 }
 
 FormElementKey::FormElementKey(const FormElementKey& other)
-    : m_name(other.name()), m_type(other.type())
+    : m_name(other.name())
+    , m_type(other.type())
+    , m_formKey(other.formKey())
 {
     ref();
 }
@@ -195,6 +283,7 @@ FormElementKey& FormElementKey::operator=(const FormElementKey& other)
     deref();
     m_name = other.name();
     m_type = other.type();
+    m_formKey = other.formKey();
     return *this;
 }
 
@@ -204,6 +293,8 @@ void FormElementKey::ref() const
         name()->ref();
     if (type())
         type()->ref();
+    if (formKey())
+        formKey()->ref();
 }
 
 void FormElementKey::deref() const
@@ -212,6 +303,8 @@ void FormElementKey::deref() const
         name()->deref();
     if (type())
         type()->deref();
+    if (formKey())
+        formKey()->deref();
 }
 
 unsigned FormElementKeyHash::hash(const FormElementKey& key)
diff --git a/Source/WebCore/html/FormController.h b/Source/WebCore/html/FormController.h
index 84156953e..e15c1dc24 100644
--- a/Source/WebCore/html/FormController.h
+++ b/Source/WebCore/html/FormController.h
@@ -32,17 +32,20 @@
 namespace WebCore {
 
 class FormAssociatedElement;
+class FormKeyGenerator;
 class HTMLFormControlElementWithState;
+class HTMLFormElement;
 
 class FormElementKey {
 public:
-    FormElementKey(AtomicStringImpl* = 0, AtomicStringImpl* = 0);
+    FormElementKey(AtomicStringImpl* = 0, AtomicStringImpl* = 0, AtomicStringImpl* = 0);
     ~FormElementKey();
     FormElementKey(const FormElementKey&);
     FormElementKey& operator=(const FormElementKey&);
 
     AtomicStringImpl* name() const { return m_name; }
     AtomicStringImpl* type() const { return m_type; }
+    AtomicStringImpl* formKey() const { return m_formKey; }
 
     // Hash table deleted values, which are only constructed and never copied or destroyed.
     FormElementKey(WTF::HashTableDeletedValueType) : m_name(hashTableDeletedValue()) { }
@@ -56,11 +59,12 @@ private:
 
     AtomicStringImpl* m_name;
     AtomicStringImpl* m_type;
+    AtomicStringImpl* m_formKey;
 };
 
 inline bool operator==(const FormElementKey& a, const FormElementKey& b)
 {
-    return a.name() == b.name() && a.type() == b.type();
+    return a.name() == b.name() && a.type() == b.type() && a.formKey() == b.formKey();
 }
 
 struct FormElementKeyHash {
@@ -126,6 +130,7 @@ public:
     // This should be callled only by Document::setStateForNewFormElements().
     void setStateForNewFormElements(const Vector<String>&);
     FormControlState takeStateForFormElement(const HTMLFormControlElementWithState&);
+    void willDeleteForm(HTMLFormElement*);
 
     void registerFormElementWithFormAttribute(FormAssociatedElement*);
     void unregisterFormElementWithFormAttribute(FormAssociatedElement*);
@@ -143,7 +148,7 @@ private:
 
     typedef HashMap<FormElementKey, Deque<FormControlState>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
     FormElementStateMap m_stateForNewFormElements;
-    
+    OwnPtr<FormKeyGenerator> m_formKeyGenerator;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLAllCollection.cpp b/Source/WebCore/html/HTMLAllCollection.cpp
index ea7ae9763..c68b00608 100644
--- a/Source/WebCore/html/HTMLAllCollection.cpp
+++ b/Source/WebCore/html/HTMLAllCollection.cpp
@@ -30,9 +30,9 @@
 
 namespace WebCore {
 
-PassOwnPtr<HTMLAllCollection> HTMLAllCollection::create(Document* document)
+PassRefPtr<HTMLAllCollection> HTMLAllCollection::create(Document* document)
 {
-    return adoptPtr(new HTMLAllCollection(document));
+    return adoptRef(new HTMLAllCollection(document));
 }
 
 HTMLAllCollection::HTMLAllCollection(Document* document)
@@ -49,15 +49,15 @@ Node* HTMLAllCollection::namedItemWithIndex(const AtomicString& name, unsigned i
     invalidateCacheIfNeeded();
     updateNameCache();
 
-    if (Vector<Element*>* idCache = m_cache.idCache.get(name.impl())) {
-        if (index < idCache->size())
-            return idCache->at(index);
-        index -= idCache->size();
+    if (Vector<Element*>* cache = idCache(name)) {
+        if (index < cache->size())
+            return cache->at(index);
+        index -= cache->size();
     }
 
-    if (Vector<Element*>* nameCache = m_cache.nameCache.get(name.impl())) {
-        if (index < nameCache->size())
-            return nameCache->at(index);
+    if (Vector<Element*>* cache = nameCache(name)) {
+        if (index < cache->size())
+            return cache->at(index);
     }
 
     return 0;
diff --git a/Source/WebCore/html/HTMLAllCollection.h b/Source/WebCore/html/HTMLAllCollection.h
index d636bbd01..ae97a53ac 100644
--- a/Source/WebCore/html/HTMLAllCollection.h
+++ b/Source/WebCore/html/HTMLAllCollection.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
 class HTMLAllCollection : public HTMLCollection {
 public:
-    static PassOwnPtr<HTMLAllCollection> create(Document*);
+    static PassRefPtr<HTMLAllCollection> create(Document*);
     virtual ~HTMLAllCollection();
 
     Node* namedItemWithIndex(const AtomicString& name, unsigned index) const;
diff --git a/Source/WebCore/html/HTMLAllCollection.idl b/Source/WebCore/html/HTMLAllCollection.idl
index 5ceae016c..50e189c65 100644
--- a/Source/WebCore/html/HTMLAllCollection.idl
+++ b/Source/WebCore/html/HTMLAllCollection.idl
@@ -30,7 +30,8 @@ module html {
         NamedGetter,
         CustomCall,
         MasqueradesAsUndefined,
-        JSGenerateIsReachable
+        GenerateIsReachable=ImplBaseRoot,
+        V8DependentLifetime
     ] HTMLAllCollection {
         readonly attribute unsigned long length;
         [Custom] Node item(in [Optional=DefaultIsUndefined] unsigned long index);
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index a6e75bc76..459078f64 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -158,6 +158,7 @@ multiple
 muted
 name
 nohref
+nonce
 noresize
 noshade
 novalidate
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 062316afa..073afa218 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -551,7 +551,7 @@ void HTMLCanvasElement::createImageBuffer() const
     m_contextStateSaver = adoptPtr(new GraphicsContextStateSaver(*m_imageBuffer->context()));
 
 #if USE(JSC)
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+    JSC::JSLockHolder lock(scriptExecutionContext()->globalData());
     size_t numBytes = 4 * m_imageBuffer->internalSize().width() * m_imageBuffer->internalSize().height();
     scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(numBytes);
 #endif
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index 1129cabd9..1f1c9c569 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -30,6 +30,10 @@
 #include "HTMLOptionElement.h"
 #include "NodeList.h"
 
+#if ENABLE(MICRODATA)
+#include "HTMLPropertiesCollection.h"
+#endif
+
 #include <utility>
 
 namespace WebCore {
@@ -50,8 +54,9 @@ static bool shouldIncludeChildren(CollectionType type)
     case DocScripts:
     case DocumentNamedItems:
     case MapAreas:
-    case OtherCollection:
+    case TableRows:
     case SelectOptions:
+    case SelectedOptions:
     case DataListOptions:
     case WindowNamedItems:
 #if ENABLE(MICRODATA)
@@ -70,40 +75,55 @@ static bool shouldIncludeChildren(CollectionType type)
 }
 
 HTMLCollection::HTMLCollection(Node* base, CollectionType type)
-    : m_includeChildren(shouldIncludeChildren(type))
-    , m_type(type)
+    : HTMLCollectionCacheBase(type, shouldIncludeChildren(type))
     , m_base(base)
 {
     ASSERT(m_base);
-    m_cache.clear();
 }
 
-PassOwnPtr<HTMLCollection> HTMLCollection::create(Node* base, CollectionType type)
+PassRefPtr<HTMLCollection> HTMLCollection::create(Node* base, CollectionType type)
 {
-    return adoptPtr(new HTMLCollection(base, type));
+    return adoptRef(new HTMLCollection(base, type));
 }
 
 HTMLCollection::~HTMLCollection()
 {
+    if (isUnnamedDocumentCachedType(type())) {
+        ASSERT(base()->isDocumentNode());
+        static_cast<Document*>(base())->removeCachedHTMLCollection(this, type());
+    } else if (isNodeCollectionType(type())) {
+        ASSERT(base()->isElementNode());
+        toElement(base())->removeCachedHTMLCollection(this, type());
+    } else // HTMLNameCollection removes cache by itself.
+        ASSERT(type() == WindowNamedItems || type() == DocumentNamedItems);
 }
 
 void HTMLCollection::invalidateCacheIfNeeded() const
 {
     uint64_t docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
 
-    if (m_cache.version == docversion)
+    if (cacheTreeVersion() == docversion)
         return;
 
-    m_cache.clear();
-    m_cache.version = docversion;
+    invalidateCache();
+}
+
+void HTMLCollection::invalidateCache() const
+{
+#if ENABLE(MICRODATA)
+    // FIXME: There should be more generic mechanism to clear caches in subclasses.
+    if (type() == ItemProperties)
+        static_cast<const HTMLPropertiesCollection*>(this)->clearCache();
+#endif
+    clearCache(static_cast<HTMLDocument*>(m_base->document())->domTreeVersion());
 }
 
 inline bool HTMLCollection::isAcceptableElement(Element* element) const
 {
-    if (!element->isHTMLElement() && !(m_type == DocAll || m_type == NodeChildren))
+    if (!element->isHTMLElement() && !(type() == DocAll || type() == NodeChildren))
         return false;
 
-    switch (m_type) {
+    switch (type()) {
     case DocImages:
         return element->hasLocalName(imgTag);
     case DocScripts:
@@ -118,6 +138,8 @@ inline bool HTMLCollection::isAcceptableElement(Element* element) const
         return element->hasLocalName(trTag);
     case SelectOptions:
         return element->hasLocalName(optionTag);
+    case SelectedOptions:
+        return element->hasLocalName(optionTag) && toHTMLOptionElement(element)->selected();
     case DataListOptions:
         if (element->hasLocalName(optionTag)) {
             HTMLOptionElement* option = static_cast<HTMLOptionElement*>(element);
@@ -146,7 +168,7 @@ inline bool HTMLCollection::isAcceptableElement(Element* element) const
 #endif
     case FormControls:
     case DocumentNamedItems:
-    case OtherCollection:
+    case TableRows:
     case WindowNamedItems:
         ASSERT_NOT_REACHED();
     }
@@ -158,15 +180,15 @@ static Node* nextNodeOrSibling(Node* base, Node* node, bool includeChildren)
     return includeChildren ? node->traverseNextNode(base) : node->traverseNextSibling(base);
 }
 
-Element* HTMLCollection::itemAfter(Element* previous) const
+Element* HTMLCollection::itemAfter(Node* previous) const
 {
     Node* current;
     if (!previous)
         current = m_base->firstChild();
     else
-        current = nextNodeOrSibling(m_base, previous, m_includeChildren);
+        current = nextNodeOrSibling(base(), previous, includeChildren());
 
-    for (; current; current = nextNodeOrSibling(m_base, current, m_includeChildren)) {
+    for (; current; current = nextNodeOrSibling(base(), current, includeChildren())) {
         if (!current->isElementNode())
             continue;
         Element* element = static_cast<Element*>(current);
@@ -190,32 +212,28 @@ unsigned HTMLCollection::calcLength() const
 unsigned HTMLCollection::length() const
 {
     invalidateCacheIfNeeded();
-    if (!m_cache.hasLength) {
-        m_cache.length = calcLength();
-        m_cache.hasLength = true;
-    }
-    return m_cache.length;
+    if (!isLengthCacheValid())
+        setLengthCache(calcLength());
+    return cachedLength();
 }
 
 Node* HTMLCollection::item(unsigned index) const
 {
     invalidateCacheIfNeeded();
-    if (m_cache.current && m_cache.position == index)
-        return m_cache.current;
-    if (m_cache.hasLength && m_cache.length <= index)
+    if (isItemCacheValid() && cachedItemOffset() == index)
+        return cachedItem();
+    if (isLengthCacheValid() && cachedLength() <= index)
         return 0;
-    if (!m_cache.current || m_cache.position > index) {
-        m_cache.current = itemAfter(0);
-        m_cache.position = 0;
-        if (!m_cache.current)
+    if (!isItemCacheValid() || cachedItemOffset() > index) {
+        setItemCache(itemAfter(0), 0);
+        if (!cachedItem())
             return 0;
     }
-    Element* e = m_cache.current;
-    for (unsigned pos = m_cache.position; e && pos < index; pos++)
+    Node* e = cachedItem();
+    for (unsigned pos = cachedItemOffset(); e && pos < index; pos++)
         e = itemAfter(e);
-    m_cache.current = e;
-    m_cache.position = index;
-    return m_cache.current;
+    setItemCache(e, index);
+    return cachedItem();
 }
 
 static inline bool nameShouldBeVisibleInDocumentAll(HTMLElement* element)
@@ -240,7 +258,7 @@ bool HTMLCollection::checkForNameMatch(Element* element, bool checkName, const A
     if (!checkName)
         return e->getIdAttribute() == name;
 
-    if (m_type == DocAll && !nameShouldBeVisibleInDocumentAll(e))
+    if (type() == DocAll && !nameShouldBeVisibleInDocumentAll(e))
         return false;
 
     return e->getNameAttribute() == name && e->getIdAttribute() != name;
@@ -255,27 +273,30 @@ Node* HTMLCollection::namedItem(const AtomicString& name) const
     // that are allowed a name attribute.
     invalidateCacheIfNeeded();
 
+    unsigned i = 0;
     for (Element* e = itemAfter(0); e; e = itemAfter(e)) {
         if (checkForNameMatch(e, /* checkName */ false, name)) {
-            m_cache.current = e;
+            setItemCache(e, i);
             return e;
         }
+        i++;
     }
 
+    i = 0;
     for (Element* e = itemAfter(0); e; e = itemAfter(e)) {
         if (checkForNameMatch(e, /* checkName */ true, name)) {
-            m_cache.current = e;
+            setItemCache(e, i);
             return e;
         }
+        i++;
     }
 
-    m_cache.current = 0;
     return 0;
 }
 
 void HTMLCollection::updateNameCache() const
 {
-    if (m_cache.hasNameCache)
+    if (hasNameCache())
         return;
 
     for (Element* element = itemAfter(0); element; element = itemAfter(element)) {
@@ -285,12 +306,12 @@ void HTMLCollection::updateNameCache() const
         const AtomicString& idAttrVal = e->getIdAttribute();
         const AtomicString& nameAttrVal = e->getNameAttribute();
         if (!idAttrVal.isEmpty())
-            append(m_cache.idCache, idAttrVal, e);
-        if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (m_type != DocAll || nameShouldBeVisibleInDocumentAll(e)))
-            append(m_cache.nameCache, nameAttrVal, e);
+            appendIdCache(idAttrVal, e);
+        if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && (type() != DocAll || nameShouldBeVisibleInDocumentAll(e)))
+            appendNameCache(nameAttrVal, e);
     }
 
-    m_cache.hasNameCache = true;
+    setHasNameCache();
 }
 
 bool HTMLCollection::hasNamedItem(const AtomicString& name) const
@@ -301,13 +322,13 @@ bool HTMLCollection::hasNamedItem(const AtomicString& name) const
     invalidateCacheIfNeeded();
     updateNameCache();
 
-    if (Vector<Element*>* idCache = m_cache.idCache.get(name.impl())) {
-        if (!idCache->isEmpty())
+    if (Vector<Element*>* cache = idCache(name)) {
+        if (!cache->isEmpty())
             return true;
     }
 
-    if (Vector<Element*>* nameCache = m_cache.nameCache.get(name.impl())) {
-        if (!nameCache->isEmpty())
+    if (Vector<Element*>* cache = nameCache(name)) {
+        if (!cache->isEmpty())
             return true;
     }
 
@@ -323,8 +344,8 @@ void HTMLCollection::namedItems(const AtomicString& name, Vector<RefPtr<Node> >&
     invalidateCacheIfNeeded();
     updateNameCache();
 
-    Vector<Element*>* idResults = m_cache.idCache.get(name.impl());
-    Vector<Element*>* nameResults = m_cache.nameCache.get(name.impl());
+    Vector<Element*>* idResults = idCache(name);
+    Vector<Element*>* nameResults = nameCache(name);
 
     for (unsigned i = 0; idResults && i < idResults->size(); ++i)
         result.append(idResults->at(i));
@@ -338,7 +359,7 @@ PassRefPtr<NodeList> HTMLCollection::tags(const String& name)
     return m_base->getElementsByTagName(name);
 }
 
-void HTMLCollection::append(NodeCacheMap& map, const AtomicString& key, Element* element)
+void HTMLCollectionCacheBase::append(NodeCacheMap& map, const AtomicString& key, Element* element)
 {
     OwnPtr<Vector<Element*> >& vector = map.add(key.impl(), nullptr).iterator->second;
     if (!vector)
diff --git a/Source/WebCore/html/HTMLCollection.h b/Source/WebCore/html/HTMLCollection.h
index ede81c09f..bb7c7459c 100644
--- a/Source/WebCore/html/HTMLCollection.h
+++ b/Source/WebCore/html/HTMLCollection.h
@@ -25,6 +25,7 @@
 
 #include "Node.h"
 #include "CollectionType.h"
+#include "DynamicNodeList.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/PassOwnPtr.h>
@@ -36,13 +37,74 @@ class Document;
 class Element;
 class NodeList;
 
-class HTMLCollection {
+class HTMLCollectionCacheBase : public DynamicNodeListCacheBase {
 public:
-    static PassOwnPtr<HTMLCollection> create(Node* base, CollectionType);
-    virtual ~HTMLCollection();
+    HTMLCollectionCacheBase(CollectionType type, bool includeChildren)
+        : DynamicNodeListCacheBase(RootedAtNode, AlwaysInvalidate) // These two flags are never used
+        , m_cachedElementsArrayOffset(0)
+        , m_cacheTreeVersion(0)
+        , m_hasNameCache(false)
+        , m_type(type)
+        , m_includeChildren(includeChildren)
+    {
+        ASSERT(static_cast<CollectionType>(m_type) == type);
+    }
+
+    CollectionType type() const { return static_cast<CollectionType>(m_type); }
+
+protected:
+    void clearCache(uint64_t currentDomTreeVersion) const
+    {
+        DynamicNodeListCacheBase::clearCache();
+        m_idCache.clear();
+        m_nameCache.clear();
+        m_cachedElementsArrayOffset = 0;
+        m_cacheTreeVersion = currentDomTreeVersion;
+        m_hasNameCache = false;
+    }
 
-    void ref() { m_base->ref(); }
-    void deref() { m_base->deref(); }
+    using DynamicNodeListCacheBase::setItemCache;
+    void setItemCache(Node* item, unsigned offset, unsigned elementsArrayOffset) const
+    {
+        setItemCache(item, offset);
+        m_cachedElementsArrayOffset = elementsArrayOffset;
+    }
+    unsigned cachedElementsArrayOffset() const { return m_cachedElementsArrayOffset; }
+
+    bool includeChildren() const { return m_includeChildren; }
+    uint64_t cacheTreeVersion() const { return m_cacheTreeVersion; }
+
+    typedef HashMap<AtomicStringImpl*, OwnPtr<Vector<Element*> > > NodeCacheMap;
+    Vector<Element*>* idCache(const AtomicString& name) const { return m_idCache.get(name.impl()); }
+    Vector<Element*>* nameCache(const AtomicString& name) const { return m_nameCache.get(name.impl()); }
+    void appendIdCache(const AtomicString& name, Element* element) const { append(m_idCache, name, element); }
+    void appendNameCache(const AtomicString& name, Element* element) const { append(m_nameCache, name, element); }
+
+    bool hasNameCache() const { return m_hasNameCache; }
+    void setHasNameCache() const { m_hasNameCache = true; }
+
+    static void append(NodeCacheMap&, const AtomicString&, Element*);
+
+private:
+    using DynamicNodeListCacheBase::isRootedAtDocument;
+    using DynamicNodeListCacheBase::shouldInvalidateOnAttributeChange;
+    using DynamicNodeListCacheBase::clearCache;
+
+    mutable NodeCacheMap m_idCache;
+    mutable NodeCacheMap m_nameCache;
+    mutable unsigned m_cachedElementsArrayOffset;
+    mutable uint64_t m_cacheTreeVersion;
+
+    // FIXME: Move these bit flags to DynamicNodeListCacheBase to pack them better.
+    mutable unsigned m_hasNameCache : 1;
+    const unsigned m_type : 5; // CollectionType
+    const unsigned m_includeChildren : 1;
+};
+
+class HTMLCollection : public RefCounted<HTMLCollection>, public HTMLCollectionCacheBase {
+public:
+    static PassRefPtr<HTMLCollection> create(Node* base, CollectionType);
+    virtual ~HTMLCollection();
 
     // DOM API
     unsigned length() const;
@@ -51,57 +113,37 @@ public:
     PassRefPtr<NodeList> tags(const String&);
 
     // Non-DOM API
-    bool hasNamedItem(const AtomicString& name) const;
+    virtual bool hasNamedItem(const AtomicString& name) const;
     void namedItems(const AtomicString& name, Vector<RefPtr<Node> >&) const;
-    bool hasAnyItem() const
+    bool isEmpty() const
     {
         invalidateCacheIfNeeded();
-        return (m_cache.hasLength && m_cache.length) || m_cache.current || item(0);
+        if (isLengthCacheValid())
+            return !cachedLength();
+        if (isItemCacheValid())
+            return !cachedItem();
+        return !item(0);
     }
     bool hasExactlyOneItem() const
     {
         invalidateCacheIfNeeded();
-        return (m_cache.hasLength && m_cache.length == 1) || (m_cache.current && !itemAfter(m_cache.current)) || (item(0) && !item(1));
+        if (isLengthCacheValid())
+            return cachedLength() == 1;
+        if (isItemCacheValid())
+            return cachedItem() && !cachedItemOffset() && !item(1);
+        return item(0) && !item(1);
     }
 
-    Node* base() const { return m_base; }
-    CollectionType type() const { return static_cast<CollectionType>(m_type); }
+    Node* base() const { return m_base.get(); }
+
+    void invalidateCache() const;
+    void invalidateCacheIfNeeded() const;
 
 protected:
     HTMLCollection(Node* base, CollectionType);
 
-    void invalidateCacheIfNeeded() const;
-
     virtual void updateNameCache() const;
-    virtual Element* itemAfter(Element*) const;
-
-    typedef HashMap<AtomicStringImpl*, OwnPtr<Vector<Element*> > > NodeCacheMap;
-    static void append(NodeCacheMap&, const AtomicString&, Element*);
-
-    mutable struct {
-        NodeCacheMap idCache;
-        NodeCacheMap nameCache;
-        uint64_t version;
-        Element* current;
-        unsigned position;
-        unsigned length;
-        int elementsArrayPosition;
-        bool hasLength;
-        bool hasNameCache;
-
-        void clear()
-        {
-            idCache.clear();
-            nameCache.clear();
-            version = 0;
-            current = 0;
-            position = 0;
-            length = 0;
-            elementsArrayPosition = 0;
-            hasLength = false;
-            hasNameCache = false;
-        }
-    } m_cache;
+    virtual Element* itemAfter(Node*) const;
 
 private:
     bool checkForNameMatch(Element*, bool checkName, const AtomicString& name) const;
@@ -110,10 +152,7 @@ private:
 
     bool isAcceptableElement(Element*) const;
 
-    bool m_includeChildren : 1;
-    unsigned m_type : 5; // CollectionType
-
-    Node* m_base;
+    RefPtr<Node> m_base;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLCollection.idl b/Source/WebCore/html/HTMLCollection.idl
index 778377626..efd91c72c 100644
--- a/Source/WebCore/html/HTMLCollection.idl
+++ b/Source/WebCore/html/HTMLCollection.idl
@@ -24,7 +24,8 @@ module html {
         IndexedGetter,
         NamedGetter,
         CustomToJSObject,
-        JSGenerateIsReachable,
+        GenerateIsReachable=ImplBaseRoot,
+        V8DependentLifetime,
         ObjCPolymorphic
     ] HTMLCollection {
         readonly attribute unsigned long length;
diff --git a/Source/WebCore/html/HTMLDataListElement.cpp b/Source/WebCore/html/HTMLDataListElement.cpp
index d7374c61c..ed842eecc 100644
--- a/Source/WebCore/html/HTMLDataListElement.cpp
+++ b/Source/WebCore/html/HTMLDataListElement.cpp
@@ -47,7 +47,7 @@ PassRefPtr<HTMLDataListElement> HTMLDataListElement::create(const QualifiedName&
     return adoptRef(new HTMLDataListElement(tagName, document));
 }
 
-HTMLCollection* HTMLDataListElement::options()
+PassRefPtr<HTMLCollection> HTMLDataListElement::options()
 {
     return ensureCachedHTMLCollection(DataListOptions);
 }
diff --git a/Source/WebCore/html/HTMLDataListElement.h b/Source/WebCore/html/HTMLDataListElement.h
index 524fcca6f..9129f295e 100644
--- a/Source/WebCore/html/HTMLDataListElement.h
+++ b/Source/WebCore/html/HTMLDataListElement.h
@@ -43,7 +43,7 @@ class HTMLDataListElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLDataListElement> create(const QualifiedName&, Document*);
 
-    HTMLCollection* options();
+    PassRefPtr<HTMLCollection> options();
 
 private:
     HTMLDataListElement(const QualifiedName&, Document*);
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index 4d0652a4b..531bd3306 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -112,7 +112,7 @@ void HTMLDetailsElement::createShadowSubtree()
 {
     ASSERT(!shadow());
 
-    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
+    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot);
     root->appendChild(DetailsSummaryElement::create(document()), ASSERT_NO_EXCEPTION, true);
     root->appendChild(DetailsContentElement::create(document()), ASSERT_NO_EXCEPTION, true);
 }
diff --git a/Source/WebCore/html/HTMLDialogElement.cpp b/Source/WebCore/html/HTMLDialogElement.cpp
new file mode 100644
index 000000000..bd630ef67
--- /dev/null
+++ b/Source/WebCore/html/HTMLDialogElement.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HTMLDialogElement.h"
+
+#if ENABLE(DIALOG_ELEMENT)
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLDialogElement::HTMLDialogElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
+{
+    ASSERT(hasTagName(dialogTag));
+}
+
+PassRefPtr<HTMLDialogElement> HTMLDialogElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLDialogElement(tagName, document));
+}
+
+void HTMLDialogElement::close()
+{
+    // FIXME: Implement.
+}
+
+void HTMLDialogElement::show()
+{
+    // FIXME: Implement.
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/html/HTMLDialogElement.h b/Source/WebCore/html/HTMLDialogElement.h
new file mode 100644
index 000000000..cc5c2db0b
--- /dev/null
+++ b/Source/WebCore/html/HTMLDialogElement.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLDialogElement_h
+#define HTMLDialogElement_h
+
+#if ENABLE(DIALOG_ELEMENT)
+
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class Document;
+class QualifiedName;
+
+class HTMLDialogElement : public HTMLElement {
+public:
+    static PassRefPtr<HTMLDialogElement> create(const QualifiedName&, Document*);
+
+    void close();
+    void show();
+
+private:
+    HTMLDialogElement(const QualifiedName&, Document*);
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif
diff --git a/Source/WebCore/html/HTMLDialogElement.idl b/Source/WebCore/html/HTMLDialogElement.idl
new file mode 100644
index 000000000..e5d6479ba
--- /dev/null
+++ b/Source/WebCore/html/HTMLDialogElement.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+
+    interface [
+        Conditional=DIALOG_ELEMENT
+    ] HTMLDialogElement : HTMLElement {
+        attribute [Reflect] boolean open;
+        void close();
+        void show();
+    };
+
+}
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index 50152cad1..c5b5073dc 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -56,6 +56,7 @@
 #include <wtf/text/CString.h>
 
 #if ENABLE(MICRODATA)
+#include "HTMLPropertiesCollection.h"
 #include "MicroDataItemValue.h"
 #endif
 
@@ -745,7 +746,7 @@ void HTMLElement::setTranslate(bool enable)
 }
 
 
-HTMLCollection* HTMLElement::children()
+PassRefPtr<HTMLCollection> HTMLElement::children()
 {
     return ensureCachedHTMLCollection(NodeChildren);
 }
@@ -987,6 +988,11 @@ void HTMLElement::setItemValueText(const String& value, ExceptionCode& ec)
 {
     setTextContent(value, ec);
 }
+
+PassRefPtr<HTMLPropertiesCollection> HTMLElement::properties()
+{
+    return static_cast<HTMLPropertiesCollection*>(ensureCachedHTMLCollection(ItemProperties).get());
+}
 #endif
 
 void HTMLElement::addHTMLLengthToStyle(StylePropertySet* style, CSSPropertyID propertyID, const String& value)
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 4eeab8cf6..a5fce0c05 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -32,6 +32,7 @@ class HTMLCollection;
 class HTMLFormElement;
 
 #if ENABLE(MICRODATA)
+class HTMLPropertiesCollection;
 class MicroDataItemValue;
 #endif
 
@@ -45,7 +46,7 @@ class HTMLElement : public StyledElement {
 public:
     static PassRefPtr<HTMLElement> create(const QualifiedName& tagName, Document*);
 
-    HTMLCollection* children();
+    PassRefPtr<HTMLCollection> children();
 
     virtual String title() const;
 
@@ -96,6 +97,7 @@ public:
 #if ENABLE(MICRODATA)
     void setItemValue(const String&, ExceptionCode&);
     PassRefPtr<MicroDataItemValue> itemValue() const;
+    PassRefPtr<HTMLPropertiesCollection> properties();
 #endif
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/html/HTMLElementsAllInOne.cpp b/Source/WebCore/html/HTMLElementsAllInOne.cpp
index cd89b4687..3adde30c5 100644
--- a/Source/WebCore/html/HTMLElementsAllInOne.cpp
+++ b/Source/WebCore/html/HTMLElementsAllInOne.cpp
@@ -45,6 +45,7 @@
 #include "HTMLDataListElement.cpp"
 #include "HTMLDetailsElement.cpp"
 #include "HTMLDListElement.cpp"
+#include "HTMLDialogElement.cpp"
 #include "HTMLDirectoryElement.cpp"
 #include "HTMLDivElement.cpp"
 #include "HTMLElement.cpp"
diff --git a/Source/WebCore/html/HTMLFieldSetElement.cpp b/Source/WebCore/html/HTMLFieldSetElement.cpp
index c0b07e867..6b01019be 100644
--- a/Source/WebCore/html/HTMLFieldSetElement.cpp
+++ b/Source/WebCore/html/HTMLFieldSetElement.cpp
@@ -38,6 +38,7 @@ using namespace HTMLNames;
 
 inline HTMLFieldSetElement::HTMLFieldSetElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
     : HTMLFormControlElement(tagName, document, form)
+    , m_documentVersion(0)
 {
     ASSERT(hasTagName(fieldsetTag));
 }
@@ -96,11 +97,9 @@ HTMLLegendElement* HTMLFieldSetElement::legend() const
     return 0;
 }
 
-HTMLCollection* HTMLFieldSetElement::elements()
+PassRefPtr<HTMLCollection> HTMLFieldSetElement::elements()
 {
-    if (!m_elementsCollection)
-        m_elementsCollection = HTMLFormCollection::create(this);
-    return m_elementsCollection.get();
+    return ensureCachedHTMLCollection(FormControls);
 }
 
 void HTMLFieldSetElement::refreshElementsIfNeeded() const
diff --git a/Source/WebCore/html/HTMLFieldSetElement.h b/Source/WebCore/html/HTMLFieldSetElement.h
index ea56a1c9a..7a3f3597a 100644
--- a/Source/WebCore/html/HTMLFieldSetElement.h
+++ b/Source/WebCore/html/HTMLFieldSetElement.h
@@ -38,7 +38,7 @@ public:
     static PassRefPtr<HTMLFieldSetElement> create(const QualifiedName&, Document*, HTMLFormElement*);
     HTMLLegendElement* legend() const;
 
-    HTMLCollection* elements();
+    PassRefPtr<HTMLCollection> elements();
 
     const Vector<FormAssociatedElement*>& associatedElements() const;
     unsigned length() const;
@@ -59,7 +59,6 @@ private:
     static void invalidateDisabledStateUnder(Element*);
     void refreshElementsIfNeeded() const;
 
-    OwnPtr<HTMLFormCollection> m_elementsCollection;
     mutable Vector<FormAssociatedElement*> m_associatedElements;
     // When dom tree is modified, we have to refresh the m_associatedElements array.
     mutable uint64_t m_documentVersion;
diff --git a/Source/WebCore/html/HTMLFormCollection.cpp b/Source/WebCore/html/HTMLFormCollection.cpp
index d9b6a5dff..3f95f8408 100644
--- a/Source/WebCore/html/HTMLFormCollection.cpp
+++ b/Source/WebCore/html/HTMLFormCollection.cpp
@@ -36,14 +36,15 @@ using namespace HTMLNames;
 // Since the collections are to be "live", we have to do the
 // calculation every time if anything has changed.
 
-HTMLFormCollection::HTMLFormCollection(HTMLElement* base)
+HTMLFormCollection::HTMLFormCollection(Element* base)
     : HTMLCollection(base, FormControls)
 {
+    ASSERT(base->hasTagName(formTag) || base->hasTagName(fieldsetTag));
 }
 
-PassOwnPtr<HTMLFormCollection> HTMLFormCollection::create(HTMLElement* base)
+PassRefPtr<HTMLFormCollection> HTMLFormCollection::create(Element* base)
 {
-    return adoptPtr(new HTMLFormCollection(base));
+    return adoptRef(new HTMLFormCollection(base));
 }
 
 HTMLFormCollection::~HTMLFormCollection()
@@ -84,28 +85,23 @@ Node* HTMLFormCollection::item(unsigned index) const
 {
     invalidateCacheIfNeeded();
 
-    if (m_cache.current && m_cache.position == index)
-        return m_cache.current;
+    if (isItemCacheValid() && cachedItemOffset() == index)
+        return cachedItem();
 
-    if (m_cache.hasLength && m_cache.length <= index)
+    if (isLengthCacheValid() && cachedLength() <= index)
         return 0;
 
-    if (!m_cache.current || m_cache.position > index) {
-        m_cache.current = 0;
-        m_cache.position = 0;
-        m_cache.elementsArrayPosition = 0;
-    }
+    if (!isItemCacheValid() || cachedItemOffset() > index)
+        setItemCache(0, 0, 0);
 
     const Vector<FormAssociatedElement*>& elementsArray = formControlElements();
-    unsigned currentIndex = m_cache.position;
-    
-    for (unsigned i = m_cache.elementsArrayPosition; i < elementsArray.size(); i++) {
+    unsigned currentIndex = cachedItemOffset();
+
+    for (unsigned i = cachedElementsArrayOffset(); i < elementsArray.size(); i++) {
         if (elementsArray[i]->isEnumeratable()) {
             HTMLElement* element = toHTMLElement(elementsArray[i]);
             if (index == currentIndex) {
-                m_cache.position = index;
-                m_cache.current = element;
-                m_cache.elementsArrayPosition = i;
+                setItemCache(element, index, i);
                 return element;
             }
 
@@ -116,51 +112,29 @@ Node* HTMLFormCollection::item(unsigned index) const
     return 0;
 }
 
-Element* HTMLFormCollection::getNamedItem(const QualifiedName& attrName, const AtomicString& name) const
+static HTMLElement* firstNamedItem(const Vector<FormAssociatedElement*>& elementsArray,
+    const Vector<HTMLImageElement*>* imageElementsArray, const QualifiedName& attrName, const String& name)
 {
-    m_cache.position = 0;
-    return getNamedFormItem(attrName, name, 0);
-}
+    ASSERT(attrName == idAttr || attrName == nameAttr);
 
-Element* HTMLFormCollection::getNamedFormItem(const QualifiedName& attrName, const String& name, int duplicateNumber) const
-{
-    const Vector<FormAssociatedElement*>& elementsArray = formControlElements();
-
-    bool foundInputElements = false;
     for (unsigned i = 0; i < elementsArray.size(); ++i) {
-        FormAssociatedElement* associatedElement = elementsArray[i];
-        HTMLElement* element = toHTMLElement(associatedElement);
-        if (associatedElement->isEnumeratable() && element->getAttribute(attrName) == name) {
-            foundInputElements = true;
-            if (!duplicateNumber)
-                return element;
-            --duplicateNumber;
-        }
+        HTMLElement* element = toHTMLElement(elementsArray[i]);
+        if (elementsArray[i]->isEnumeratable() && element->fastGetAttribute(attrName) == name)
+            return element;
     }
 
-    if (base()->hasTagName(fieldsetTag))
+    if (!imageElementsArray)
         return 0;
 
-    const Vector<HTMLImageElement*>& imageElementsArray = formImageElements();
-    if (!foundInputElements) {
-        for (unsigned i = 0; i < imageElementsArray.size(); ++i) {
-            HTMLImageElement* element = imageElementsArray[i];
-            if (element->getAttribute(attrName) == name) {
-                if (!duplicateNumber)
-                    return element;
-                --duplicateNumber;
-            }
-        }
+    for (unsigned i = 0; i < imageElementsArray->size(); ++i) {
+        HTMLImageElement* element = (*imageElementsArray)[i];
+        if (element->fastGetAttribute(attrName) == name)
+            return element;
     }
 
     return 0;
 }
 
-Node* HTMLFormCollection::nextItem() const
-{
-    return item(m_cache.position + 1);
-}
-
 Node* HTMLFormCollection::namedItem(const AtomicString& name) const
 {
     // http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/nameditem.asp
@@ -169,16 +143,16 @@ Node* HTMLFormCollection::namedItem(const AtomicString& name) const
     // object with a matching name attribute, but only on those elements
     // that are allowed a name attribute.
     invalidateCacheIfNeeded();
-    m_cache.current = getNamedItem(idAttr, name);
-    if (m_cache.current)
-        return m_cache.current;
-    m_cache.current = getNamedItem(nameAttr, name);
-    return m_cache.current;
+    const Vector<HTMLImageElement*>* imagesElements = base()->hasTagName(fieldsetTag) ? 0 : &formImageElements();
+    if (HTMLElement* item = firstNamedItem(formControlElements(), imagesElements, idAttr, name))
+        return item;
+
+    return firstNamedItem(formControlElements(), imagesElements, nameAttr, name);
 }
 
 void HTMLFormCollection::updateNameCache() const
 {
-    if (m_cache.hasNameCache)
+    if (hasNameCache())
         return;
 
     HashSet<AtomicStringImpl*> foundInputElements;
@@ -192,11 +166,11 @@ void HTMLFormCollection::updateNameCache() const
             const AtomicString& idAttrVal = element->getIdAttribute();
             const AtomicString& nameAttrVal = element->getNameAttribute();
             if (!idAttrVal.isEmpty()) {
-                append(m_cache.idCache, idAttrVal, element);
+                appendIdCache(idAttrVal, element);
                 foundInputElements.add(idAttrVal.impl());
             }
             if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal) {
-                append(m_cache.nameCache, nameAttrVal, element);
+                appendNameCache(nameAttrVal, element);
                 foundInputElements.add(nameAttrVal.impl());
             }
         }
@@ -209,13 +183,13 @@ void HTMLFormCollection::updateNameCache() const
             const AtomicString& idAttrVal = element->getIdAttribute();
             const AtomicString& nameAttrVal = element->getNameAttribute();
             if (!idAttrVal.isEmpty() && !foundInputElements.contains(idAttrVal.impl()))
-                append(m_cache.idCache, idAttrVal, element);
+                appendIdCache(idAttrVal, element);
             if (!nameAttrVal.isEmpty() && idAttrVal != nameAttrVal && !foundInputElements.contains(nameAttrVal.impl()))
-                append(m_cache.nameCache, nameAttrVal, element);
+                appendNameCache(nameAttrVal, element);
         }
     }
 
-    m_cache.hasNameCache = true;
+    setHasNameCache();
 }
 
 }
diff --git a/Source/WebCore/html/HTMLFormCollection.h b/Source/WebCore/html/HTMLFormCollection.h
index 315ea68b6..753a0d06e 100644
--- a/Source/WebCore/html/HTMLFormCollection.h
+++ b/Source/WebCore/html/HTMLFormCollection.h
@@ -36,24 +36,19 @@ class QualifiedName;
 
 class HTMLFormCollection : public HTMLCollection {
 public:
-    static PassOwnPtr<HTMLFormCollection> create(HTMLElement*);
+    static PassRefPtr<HTMLFormCollection> create(Element*);
 
     virtual ~HTMLFormCollection();
 
     virtual Node* item(unsigned index) const;
-    virtual Node* nextItem() const;
-
     virtual Node* namedItem(const AtomicString& name) const;
 
 private:
-    HTMLFormCollection(HTMLElement*);
+    HTMLFormCollection(Element*);
 
     virtual void updateNameCache() const;
     virtual unsigned calcLength() const;
 
-    Element* getNamedItem(const QualifiedName& attrName, const AtomicString& name) const;
-    Element* getNamedFormItem(const QualifiedName& attrName, const String& name, int duplicateNumber) const;
-
     const Vector<FormAssociatedElement*>& formControlElements() const;
     const Vector<HTMLImageElement*>& formImageElements() const;
     unsigned numberOfFormControlElements() const;
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index d09814865..901783beb 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -475,6 +475,11 @@ void HTMLFormControlElement::setCustomValidity(const String& error)
     setNeedsValidityCheck();
 }
 
+bool HTMLFormControlElement::validationMessageShadowTreeContains(Node* node) const
+{
+    return m_validationMessage && m_validationMessage->shadowTreeContains(node);
+}
+
 void HTMLFormControlElement::dispatchBlurEvent(PassRefPtr<Node> newFocusedNode)
 {
     HTMLElement::dispatchBlurEvent(newFocusedNode);
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index b3a9354ca..b82d4ee9e 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -132,6 +132,8 @@ protected:
     void setNeedsWillValidateCheck();
     virtual bool recalcWillValidate() const;
 
+    bool validationMessageShadowTreeContains(Node*) const;
+
 private:
     virtual void refFormAssociatedElement() { ref(); }
     virtual void derefFormAssociatedElement() { deref(); }
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 719b46eac..3c8bb073c 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -92,6 +92,7 @@ PassRefPtr<HTMLFormElement> HTMLFormElement::create(const QualifiedName& tagName
 
 HTMLFormElement::~HTMLFormElement()
 {
+    document()->formController()->willDeleteForm(this);
     if (!shouldAutocomplete())
         document()->unregisterForPageCacheSuspensionCallbacks(this);
 
@@ -534,11 +535,9 @@ void HTMLFormElement::removeImgElement(HTMLImageElement* e)
     removeFromVector(m_imageElements, e);
 }
 
-HTMLCollection* HTMLFormElement::elements()
+PassRefPtr<HTMLCollection> HTMLFormElement::elements()
 {
-    if (!m_elementsCollection)
-        m_elementsCollection = HTMLFormCollection::create(this);
-    return m_elementsCollection.get();
+    return ensureCachedHTMLCollection(FormControls);
 }
 
 String HTMLFormElement::name() const
diff --git a/Source/WebCore/html/HTMLFormElement.h b/Source/WebCore/html/HTMLFormElement.h
index c12c9aa4f..ee9ccf39b 100644
--- a/Source/WebCore/html/HTMLFormElement.h
+++ b/Source/WebCore/html/HTMLFormElement.h
@@ -47,7 +47,7 @@ public:
     static PassRefPtr<HTMLFormElement> create(const QualifiedName&, Document*);
     virtual ~HTMLFormElement();
 
-    HTMLCollection* elements();
+    PassRefPtr<HTMLCollection> elements();
     void getNamedElements(const AtomicString&, Vector<RefPtr<Node> >&);
 
     unsigned length() const;
@@ -150,7 +150,6 @@ private:
 
     FormSubmission::Attributes m_attributes;
     OwnPtr<AliasMap> m_elementAliases;
-    OwnPtr<HTMLFormCollection> m_elementsCollection;
 
     CheckedRadioButtons m_checkedRadioButtons;
 
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index b0e7f0427..a2e2f829a 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -93,12 +93,13 @@ void HTMLFrameSetElement::parseAttribute(const Attribute& attribute)
         }
     } else if (attribute.name() == frameborderAttr) {
         if (!attribute.isNull()) {
-            // false or "no" or "0"..
-            if (attribute.value().toInt() == 0) {
+            const AtomicString& value = attribute.value();
+            if (equalIgnoringCase(value, "no") || equalIgnoringCase(value, "0")) {
                 m_frameborder = false;
-                m_border = 0;
+                m_frameborderSet = true;
+            } else if (equalIgnoringCase(value, "yes") || equalIgnoringCase(value, "1")) {
+                m_frameborderSet = true;
             }
-            m_frameborderSet = true;
         } else {
             m_frameborder = false;
             m_frameborderSet = false;
@@ -108,8 +109,6 @@ void HTMLFrameSetElement::parseAttribute(const Attribute& attribute)
     } else if (attribute.name() == borderAttr) {
         if (!attribute.isNull()) {
             m_border = attribute.value().toInt();
-            if (!m_border)
-                m_frameborder = false;
             m_borderSet = true;
         } else
             m_borderSet = false;
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index a4c391b94..9c3311a27 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -38,7 +38,7 @@ public:
 
     int totalRows() const { return m_totalRows; }
     int totalCols() const { return m_totalCols; }
-    int border() const { return m_border; }
+    int border() const { return hasFrameBorder() ? m_border : 0; }
 
     bool hasBorderColor() const { return m_borderColorSet; }
 
diff --git a/Source/WebCore/html/HTMLImageLoader.cpp b/Source/WebCore/html/HTMLImageLoader.cpp
index 77ee1e7d8..9bf013d5b 100644
--- a/Source/WebCore/html/HTMLImageLoader.cpp
+++ b/Source/WebCore/html/HTMLImageLoader.cpp
@@ -81,8 +81,8 @@ void HTMLImageLoader::notifyFinished(CachedResource*)
 #if USE(JSC)
     if (!loadError) {
         if (!elem->inDocument()) {
-            JSC::JSLock lock(JSC::SilenceAssertionsOnly);
             JSC::JSGlobalData* globalData = JSDOMWindowBase::commonJSGlobalData();
+            JSC::JSLockHolder lock(globalData);
             globalData->heap.reportExtraMemoryCost(cachedImage->encodedSize());
         }
     }
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 6fcd158f0..a12ba7849 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -67,6 +67,10 @@
 #include "RuntimeEnabledFeatures.h"
 #endif
 
+#if ENABLE(TOUCH_EVENTS)
+#include "TouchEvent.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -95,8 +99,10 @@ HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* docum
     , m_isAutofilled(false)
     , m_stateRestored(false)
     , m_parsingInProgress(createdByParser)
+    , m_valueAttributeWasUpdatedAfterParsing(false)
     , m_wasModifiedByUser(false)
     , m_canReceiveDroppedFiles(false)
+    , m_hasTouchEventHandler(false)
     , m_inputType(InputType::createText(this))
 {
     ASSERT(hasTagName(inputTag) || hasTagName(isindexTag));
@@ -112,7 +118,7 @@ PassRefPtr<HTMLInputElement> HTMLInputElement::create(const QualifiedName& tagNa
 void HTMLInputElement::createShadowSubtree()
 {
     ASSERT(!shadow());
-    ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+    ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot, ASSERT_NO_EXCEPTION);
 
     m_inputType->createShadowSubtree();
 }
@@ -129,6 +135,10 @@ HTMLInputElement::~HTMLInputElement()
     // We should unregister it to avoid accessing a deleted object.
     if (isRadioButton())
         document()->formController()->checkedRadioButtons().removeButton(this);
+#if ENABLE(TOUCH_EVENTS)
+    if (m_hasTouchEventHandler)
+        document()->didRemoveTouchEventHandler();
+#endif
 }
 
 const AtomicString& HTMLInputElement::name() const
@@ -400,6 +410,18 @@ void HTMLInputElement::updateType()
     m_inputType = newType.release();
     m_inputType->createShadowSubtree();
 
+#if ENABLE(TOUCH_EVENTS)
+    bool hasTouchEventHandler = m_inputType->hasTouchEventHandler();
+    if (hasTouchEventHandler != m_hasTouchEventHandler) {
+      if (hasTouchEventHandler) {
+        document()->didAddTouchEventHandler();
+        document()->addListenerType(Document::TOUCH_LISTENER);
+      } else
+        document()->didRemoveTouchEventHandler();
+      m_hasTouchEventHandler = hasTouchEventHandler;
+    }
+#endif
+
     setNeedsWillValidateCheck();
 
     bool willStoreValue = m_inputType->storesValueSeparateFromAttribute();
@@ -594,6 +616,7 @@ void HTMLInputElement::parseAttribute(const Attribute& attribute)
         }
         setFormControlValueMatchesRenderer(false);
         setNeedsValidityCheck();
+        m_valueAttributeWasUpdatedAfterParsing = !m_parsingInProgress;
     } else if (attribute.name() == checkedAttr) {
         // Another radio button in the same group might be checked by state
         // restore. We shouldn't call setChecked() even if this has the checked
@@ -1036,6 +1059,14 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             return;
     }
 
+#if ENABLE(TOUCH_EVENTS)
+    if (evt->isTouchEvent()) {
+        m_inputType->handleTouchEvent(static_cast<TouchEvent*>(evt));
+        if (evt->defaultHandled())
+            return;
+    }
+#endif
+
     if (evt->isKeyboardEvent() && evt->type() == eventNames().keydownEvent) {
         m_inputType->handleKeydownEvent(static_cast<KeyboardEvent*>(evt));
         if (evt->defaultHandled())
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index faeabffba..e10825cd6 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -238,11 +238,12 @@ public:
     HTMLInputElement* checkedRadioButtonForGroup() const;
     bool isInRequiredRadioButtonGroup() const;
 
+    // Functions for InputType classes.
     void setValueInternal(const String&, TextFieldEventBehavior);
-
     bool isTextFormControlFocusable() const;
     bool isTextFormControlKeyboardFocusable(KeyboardEvent*) const;
     bool isTextFormControlMouseFocusable() const;
+    bool valueAttributeWasUpdatedAfterParsing() const { return m_valueAttributeWasUpdatedAfterParsing; }
 
     void cacheSelectionInResponseToSetValue(int caretOffset) { cacheSelection(caretOffset, caretOffset, SelectionHasNoDirection); }
 
@@ -386,8 +387,10 @@ private:
 #endif
     bool m_stateRestored : 1;
     bool m_parsingInProgress : 1;
+    bool m_valueAttributeWasUpdatedAfterParsing : 1;
     bool m_wasModifiedByUser : 1;
     bool m_canReceiveDroppedFiles : 1;
+    bool m_hasTouchEventHandler: 1;
     OwnPtr<InputType> m_inputType;
 };
 
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index 488eadb6e..499ceb341 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -87,7 +87,7 @@ inline HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Docume
     }
 
     ASSERT(!shadow());
-    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
+    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot);
     root->appendChild(select, ec);
 }
 
diff --git a/Source/WebCore/html/HTMLMapElement.cpp b/Source/WebCore/html/HTMLMapElement.cpp
index 293eee354..de3fee409 100644
--- a/Source/WebCore/html/HTMLMapElement.cpp
+++ b/Source/WebCore/html/HTMLMapElement.cpp
@@ -82,7 +82,7 @@ bool HTMLMapElement::mapMouseEvent(LayoutPoint location, const LayoutSize& size,
 
 HTMLImageElement* HTMLMapElement::imageElement()
 {
-    HTMLCollection* images = document()->images();
+    RefPtr<HTMLCollection> images = document()->images();
     for (unsigned i = 0; Node* curr = images->item(i); i++) {
         if (!curr->hasTagName(imgTag))
             continue;
@@ -125,7 +125,7 @@ void HTMLMapElement::parseAttribute(const Attribute& attribute)
     HTMLElement::parseAttribute(attribute);
 }
 
-HTMLCollection* HTMLMapElement::areas()
+PassRefPtr<HTMLCollection> HTMLMapElement::areas()
 {
     return ensureCachedHTMLCollection(MapAreas);
 }
diff --git a/Source/WebCore/html/HTMLMapElement.h b/Source/WebCore/html/HTMLMapElement.h
index be4c2a570..f73a62b1b 100644
--- a/Source/WebCore/html/HTMLMapElement.h
+++ b/Source/WebCore/html/HTMLMapElement.h
@@ -41,7 +41,7 @@ public:
     bool mapMouseEvent(LayoutPoint location, const LayoutSize&, HitTestResult&);
     
     HTMLImageElement* imageElement();
-    HTMLCollection* areas();
+    PassRefPtr<HTMLCollection> areas();
 
 private:
     HTMLMapElement(const QualifiedName&, Document*);
diff --git a/Source/WebCore/html/HTMLMeterElement.cpp b/Source/WebCore/html/HTMLMeterElement.cpp
index 07f4d777e..13dea1513 100644
--- a/Source/WebCore/html/HTMLMeterElement.cpp
+++ b/Source/WebCore/html/HTMLMeterElement.cpp
@@ -228,7 +228,7 @@ void HTMLMeterElement::createShadowSubtree()
     ExceptionCode ec = 0;
     bar->appendChild(m_value, ec);
 
-    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
+    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot);
     root->appendChild(bar, ec);
 }
 
diff --git a/Source/WebCore/html/HTMLNameCollection.cpp b/Source/WebCore/html/HTMLNameCollection.cpp
index 280c800a7..e253e3055 100644
--- a/Source/WebCore/html/HTMLNameCollection.cpp
+++ b/Source/WebCore/html/HTMLNameCollection.cpp
@@ -38,7 +38,18 @@ HTMLNameCollection::HTMLNameCollection(Document* document, CollectionType type,
 {
 }
 
-Element* HTMLNameCollection::itemAfter(Element* previous) const
+HTMLNameCollection::~HTMLNameCollection()
+{
+    ASSERT(base());
+    ASSERT(base()->isDocumentNode());
+    ASSERT(type() == WindowNamedItems || type() == DocumentNamedItems);
+    if (type() == WindowNamedItems)
+        static_cast<Document*>(base())->removeWindowNamedItemCache(this, m_name);
+    else
+        static_cast<Document*>(base())->removeDocumentNamedItemCache(this, m_name);
+}
+
+Element* HTMLNameCollection::itemAfter(Node* previous) const
 {
     ASSERT(previous != base());
 
diff --git a/Source/WebCore/html/HTMLNameCollection.h b/Source/WebCore/html/HTMLNameCollection.h
index f844657f3..08f829a91 100644
--- a/Source/WebCore/html/HTMLNameCollection.h
+++ b/Source/WebCore/html/HTMLNameCollection.h
@@ -33,15 +33,17 @@ class Document;
 
 class HTMLNameCollection : public HTMLCollection {
 public:
-    static PassOwnPtr<HTMLNameCollection> create(Document* document, CollectionType type, const AtomicString& name)
+    static PassRefPtr<HTMLNameCollection> create(Document* document, CollectionType type, const AtomicString& name)
     {
-        return adoptPtr(new HTMLNameCollection(document, type, name));
+        return adoptRef(new HTMLNameCollection(document, type, name));
     }
 
+    ~HTMLNameCollection();
+
 private:
     HTMLNameCollection(Document*, CollectionType, const AtomicString& name);
 
-    virtual Element* itemAfter(Element*) const OVERRIDE;
+    virtual Element* itemAfter(Node*) const OVERRIDE;
 
     AtomicString m_name;
 };
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index 33e39a618..3691e8241 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -245,6 +245,9 @@ void HTMLOptionElement::setSelectedState(bool selected)
 
     m_isSelected = selected;
     setNeedsStyleRecalc();
+
+    if (HTMLSelectElement* select = ownerSelectElement())
+        select->invalidateSelectedItems();
 }
 
 void HTMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
diff --git a/Source/WebCore/html/HTMLOptionsCollection.cpp b/Source/WebCore/html/HTMLOptionsCollection.cpp
index ca8a1b07d..7000f2891 100644
--- a/Source/WebCore/html/HTMLOptionsCollection.cpp
+++ b/Source/WebCore/html/HTMLOptionsCollection.cpp
@@ -27,14 +27,15 @@
 
 namespace WebCore {
 
-HTMLOptionsCollection::HTMLOptionsCollection(HTMLSelectElement* select)
+HTMLOptionsCollection::HTMLOptionsCollection(Element* select)
     : HTMLCollection(select, SelectOptions)
 {
+    ASSERT(select->hasTagName(HTMLNames::selectTag));
 }
 
-PassOwnPtr<HTMLOptionsCollection> HTMLOptionsCollection::create(HTMLSelectElement* select)
+PassRefPtr<HTMLOptionsCollection> HTMLOptionsCollection::create(Element* select)
 {
-    return adoptPtr(new HTMLOptionsCollection(select));
+    return adoptRef(new HTMLOptionsCollection(select));
 }
 
 void HTMLOptionsCollection::add(PassRefPtr<HTMLOptionElement> element, ExceptionCode &ec)
diff --git a/Source/WebCore/html/HTMLOptionsCollection.h b/Source/WebCore/html/HTMLOptionsCollection.h
index bc9bdfa70..bd6fe7d07 100644
--- a/Source/WebCore/html/HTMLOptionsCollection.h
+++ b/Source/WebCore/html/HTMLOptionsCollection.h
@@ -35,7 +35,7 @@ typedef int ExceptionCode;
 
 class HTMLOptionsCollection : public HTMLCollection {
 public:
-    static PassOwnPtr<HTMLOptionsCollection> create(HTMLSelectElement*);
+    static PassRefPtr<HTMLOptionsCollection> create(Element*);
 
     void add(PassRefPtr<HTMLOptionElement>, ExceptionCode&);
     void add(PassRefPtr<HTMLOptionElement>, int index, ExceptionCode&);
@@ -49,7 +49,7 @@ public:
     using HTMLCollection::invalidateCacheIfNeeded;
 
 private:
-    HTMLOptionsCollection(HTMLSelectElement*);
+    HTMLOptionsCollection(Element*);
 };
 
 } //namespace
diff --git a/Source/WebCore/html/HTMLProgressElement.cpp b/Source/WebCore/html/HTMLProgressElement.cpp
index 814afdf04..4030ee238 100644
--- a/Source/WebCore/html/HTMLProgressElement.cpp
+++ b/Source/WebCore/html/HTMLProgressElement.cpp
@@ -151,7 +151,7 @@ void HTMLProgressElement::createShadowSubtree()
     m_value = ProgressValueElement::create(document());
     bar->appendChild(m_value, ASSERT_NO_EXCEPTION);
 
-    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot, ASSERT_NO_EXCEPTION);
     root->appendChild(bar, ASSERT_NO_EXCEPTION);
 }
 
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.cpp b/Source/WebCore/html/HTMLPropertiesCollection.cpp
index b3f3f1c7b..87394c230 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.cpp
+++ b/Source/WebCore/html/HTMLPropertiesCollection.cpp
@@ -45,13 +45,15 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-PassOwnPtr<HTMLPropertiesCollection> HTMLPropertiesCollection::create(Node* itemNode)
+PassRefPtr<HTMLPropertiesCollection> HTMLPropertiesCollection::create(Node* itemNode)
 {
-    return adoptPtr(new HTMLPropertiesCollection(itemNode));
+    return adoptRef(new HTMLPropertiesCollection(itemNode));
 }
 
 HTMLPropertiesCollection::HTMLPropertiesCollection(Node* itemNode)
     : HTMLCollection(itemNode, ItemProperties)
+    , m_hasPropertyNameCache(false)
+    , m_hasItemRefElements(false)
 {
 }
 
@@ -59,28 +61,18 @@ HTMLPropertiesCollection::~HTMLPropertiesCollection()
 {
 }
 
-void HTMLPropertiesCollection::invalidateCacheIfNeeded() const
-{
-    uint64_t docversion = base()->document()->domTreeVersion();
-
-    if (m_cache.version == docversion)
-        return;
-
-    m_cache.clear();
-    m_cache.version = docversion;
-}
-
 void HTMLPropertiesCollection::updateRefElements() const
 {
-    if (m_cache.hasItemRefElements)
+    if (m_hasItemRefElements)
         return;
 
-    Vector<Element*> itemRefElements;
     HTMLElement* baseElement = toHTMLElement(base());
 
+    m_itemRefElements.clear();
+
     if (!baseElement->fastHasAttribute(itemrefAttr)) {
-        itemRefElements.append(baseElement);
-        m_cache.setItemRefElements(itemRefElements);
+        m_itemRefElements.append(baseElement);
+        m_hasItemRefElements = true;
         return;
     }
 
@@ -94,7 +86,7 @@ void HTMLPropertiesCollection::updateRefElements() const
         HTMLElement* element = toHTMLElement(current);
 
         if (element == baseElement) {
-            itemRefElements.append(element);
+            m_itemRefElements.append(element);
             continue;
         }
 
@@ -102,11 +94,10 @@ void HTMLPropertiesCollection::updateRefElements() const
         if (!processedItemRef->tokens().contains(id) && itemRef->tokens().contains(id)) {
             processedItemRef->setValue(id);
             if (!element->isDescendantOf(baseElement))
-                itemRefElements.append(element);
+                m_itemRefElements.append(element);
         }
     }
-
-    m_cache.setItemRefElements(itemRefElements);
+    m_hasItemRefElements = true;
 }
 
 static Node* nextNodeWithProperty(Node* base, Node* node)
@@ -119,7 +110,7 @@ static Node* nextNodeWithProperty(Node* base, Node* node)
             ? node->traverseNextNode(base) : node->traverseNextSibling(base);
 }
 
-Element* HTMLPropertiesCollection::itemAfter(Element* base, Element* previous) const
+Element* HTMLPropertiesCollection::itemAfter(Element* base, Node* previous) const
 {
     Node* current;
     current = previous ? nextNodeWithProperty(base, previous) : base;
@@ -138,45 +129,27 @@ Element* HTMLPropertiesCollection::itemAfter(Element* base, Element* previous) c
 
 unsigned HTMLPropertiesCollection::calcLength() const
 {
+    if (!toHTMLElement(base())->fastHasAttribute(itemscopeAttr))
+        return 0;
+
     unsigned length = 0;
     updateRefElements();
 
-    const Vector<Element*>& itemRefElements = m_cache.getItemRefElements();
-    for (unsigned i = 0; i < itemRefElements.size(); ++i) {
-        for (Element* element = itemAfter(itemRefElements[i], 0); element; element = itemAfter(itemRefElements[i], element))
+    for (unsigned i = 0; i < m_itemRefElements.size(); ++i) {
+        for (Element* element = itemAfter(m_itemRefElements[i], 0); element; element = itemAfter(m_itemRefElements[i], element))
             ++length;
     }
 
     return length;
 }
 
-unsigned HTMLPropertiesCollection::length() const
-{
-    if (!toHTMLElement(base())->fastHasAttribute(itemscopeAttr))
-        return 0;
-
-    invalidateCacheIfNeeded();
-
-    if (!m_cache.hasLength)
-        m_cache.updateLength(calcLength());
-
-    return m_cache.length;
-}
-
-Element* HTMLPropertiesCollection::firstProperty() const
+void HTMLPropertiesCollection::cacheFirstItem() const
 {
-    Element* element = 0;
-    m_cache.resetPosition();
-    const Vector<Element*>& itemRefElements = m_cache.getItemRefElements();
-    for (unsigned i = 0; i < itemRefElements.size(); ++i) {
-        element = itemAfter(itemRefElements[i], 0);
-        if (element) {
-            m_cache.itemRefElementPosition = i;
-            break;
-        }
+    for (unsigned i = 0; i < m_itemRefElements.size(); ++i) {
+        if (Element* element = itemAfter(m_itemRefElements[i], 0))
+            return setItemCache(element, 0, i);
     }
-
-    return element;
+    setItemCache(0, 0, 0);
 }
 
 Node* HTMLPropertiesCollection::item(unsigned index) const
@@ -185,43 +158,41 @@ Node* HTMLPropertiesCollection::item(unsigned index) const
         return 0;
 
     invalidateCacheIfNeeded();
-    if (m_cache.current && m_cache.position == index)
-        return m_cache.current;
+    if (isItemCacheValid() && cachedItemOffset() == index)
+        return cachedItem();
 
-    if (m_cache.hasLength && m_cache.length <= index)
+    if (isLengthCacheValid() && cachedLength() <= index)
         return 0;
 
     updateRefElements();
-    if (!m_cache.current || m_cache.position > index) {
-        m_cache.current = firstProperty();
-        if (!m_cache.current)
-            return 0;
+    if (!isItemCacheValid() || cachedItemOffset() > index) {
+        cacheFirstItem();
+        ASSERT(isItemCacheValid());
+        if (!cachedItem() || cachedItemOffset() == index)
+            return cachedItem();
     }
 
-    unsigned currentPosition = m_cache.position;
-    Element* element = m_cache.current;
-    unsigned itemRefElementPos = m_cache.itemRefElementPosition;
-    const Vector<Element*>& itemRefElements = m_cache.getItemRefElements();
-
-    bool found = (m_cache.position == index);
+    unsigned currentPosition = cachedItemOffset();
+    Node* element = cachedItem();
+    ASSERT(currentPosition != index);
 
-    for (unsigned i = itemRefElementPos; i < itemRefElements.size() && !found; ++i) {
+    for (unsigned i = cachedElementsArrayOffset(); i < m_itemRefElements.size(); ++i) {
         while (currentPosition < index) {
-            element = itemAfter(itemRefElements[i], element);
+            element = itemAfter(m_itemRefElements[i], element);
             if (!element)
                 break;
             currentPosition++;
 
             if (currentPosition == index) {
-                found = true;
-                itemRefElementPos = i;
-                break;
+                setItemCache(element, currentPosition, i);
+                return cachedItem();
             }
         }
     }
 
-    m_cache.updateCurrentItem(element, index, itemRefElementPos);
-    return m_cache.current;
+    setLengthCache(currentPosition);
+
+    return 0;
 }
 
 void HTMLPropertiesCollection::findProperties(Element* base) const
@@ -229,23 +200,22 @@ void HTMLPropertiesCollection::findProperties(Element* base) const
     for (Element* element = itemAfter(base, 0); element; element = itemAfter(base, element)) {
         DOMSettableTokenList* itemProperty = element->itemProp();
         for (unsigned i = 0; i < itemProperty->length(); ++i)
-            m_cache.updatePropertyCache(element, itemProperty->item(i));
+            updatePropertyCache(element, itemProperty->item(i));
     }
 }
 
 void HTMLPropertiesCollection::updateNameCache() const
 {
     invalidateCacheIfNeeded();
-    if (m_cache.hasNameCache)
+    if (m_hasPropertyNameCache)
         return;
 
     updateRefElements();
 
-    const Vector<Element*>& itemRefElements = m_cache.getItemRefElements();
-    for (unsigned i = 0; i < itemRefElements.size(); ++i)
-        findProperties(itemRefElements[i]);
+    for (unsigned i = 0; i < m_itemRefElements.size(); ++i)
+        findProperties(m_itemRefElements[i]);
 
-    m_cache.hasNameCache = true;
+    m_hasPropertyNameCache = true;
 }
 
 PassRefPtr<DOMStringList> HTMLPropertiesCollection::names() const
@@ -255,7 +225,7 @@ PassRefPtr<DOMStringList> HTMLPropertiesCollection::names() const
 
     updateNameCache();
 
-    return m_cache.propertyNames;
+    return m_propertyNames;
 }
 
 PassRefPtr<NodeList> HTMLPropertiesCollection::namedItem(const String& name) const
@@ -267,7 +237,7 @@ PassRefPtr<NodeList> HTMLPropertiesCollection::namedItem(const String& name) con
 
     updateNameCache();
 
-    Vector<Element*>* propertyResults = m_cache.propertyCache.get(AtomicString(name).impl());
+    Vector<Element*>* propertyResults = m_propertyCache.get(AtomicString(name).impl());
     for (unsigned i = 0; propertyResults && i < propertyResults->size(); ++i)
         namedItems.append(propertyResults->at(i));
 
@@ -282,7 +252,7 @@ bool HTMLPropertiesCollection::hasNamedItem(const AtomicString& name) const
 
     updateNameCache();
 
-    if (Vector<Element*>* propertyCache = m_cache.propertyCache.get(name.impl())) {
+    if (Vector<Element*>* propertyCache = m_propertyCache.get(name.impl())) {
         if (!propertyCache->isEmpty())
             return true;
     }
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.h b/Source/WebCore/html/HTMLPropertiesCollection.h
index 9cd9175bc..7826df409 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.h
+++ b/Source/WebCore/html/HTMLPropertiesCollection.h
@@ -42,108 +42,59 @@ class DOMStringList;
 
 class HTMLPropertiesCollection : public HTMLCollection {
 public:
-    static PassOwnPtr<HTMLPropertiesCollection> create(Node*);
+    static PassRefPtr<HTMLPropertiesCollection> create(Node*);
     virtual ~HTMLPropertiesCollection();
 
-    unsigned length() const OVERRIDE;
-
     virtual Node* item(unsigned) const OVERRIDE;
 
     PassRefPtr<DOMStringList> names() const;
 
-    PassRefPtr<NodeList> namedItem(const String&) const;
-    bool hasNamedItem(const AtomicString&) const;
+    virtual PassRefPtr<NodeList> namedItem(const String&) const OVERRIDE;
+    virtual bool hasNamedItem(const AtomicString&) const OVERRIDE;
+
+    void clearCache() const
+    {
+        m_itemRefElements.clear();
+        m_propertyNames.clear();
+        m_propertyCache.clear();
+        m_hasPropertyNameCache = false;
+        m_hasItemRefElements = false;
+    }
 
 private:
     HTMLPropertiesCollection(Node*);
 
-    unsigned calcLength() const;
+    virtual unsigned calcLength() const OVERRIDE;
     void findProperties(Element* base) const;
 
     Node* findRefElements(Node* previous) const;
 
-    Element* firstProperty() const;
-    Element* itemAfter(Element* base, Element* previous) const;
+    void cacheFirstItem() const;
+    Element* itemAfter(Element* base, Node* previous) const;
 
     void updateNameCache() const;
     void updateRefElements() const;
 
-    void invalidateCacheIfNeeded() const;
-
-    mutable struct {
-        uint64_t version;
-        Element* current;
-        unsigned position;
-        unsigned length;
-        bool hasLength;
-        bool hasNameCache;
-        NodeCacheMap propertyCache;
-        Vector<Element*> itemRefElements;
-        RefPtr<DOMStringList> propertyNames;
-        unsigned itemRefElementPosition;
-        bool hasItemRefElements;
-
-        void clear()
-        {
-            version = 0;
-            current = 0;
-            position = 0;
-            length = 0;
-            hasLength = false;
-            hasNameCache = false;
-            propertyCache.clear();
-            itemRefElements.clear();
-            propertyNames.clear();
-            itemRefElementPosition = 0;
-            hasItemRefElements = false;
-        }
-
-        void setItemRefElements(const Vector<Element*>& elements)
-        {
-            itemRefElements = elements;
-            hasItemRefElements = true;
-        }
-
-        const Vector<Element*>& getItemRefElements()
-        {
-            return itemRefElements;
-        }
-
-        void updateLength(unsigned len)
-        {
-            length = len;
-            hasLength = true;
-        }
-
-        void updatePropertyCache(Element* element, const AtomicString& propertyName)
-        {
-            if (!propertyNames)
-                propertyNames = DOMStringList::create();
-
-            if (!propertyNames->contains(propertyName))
-                propertyNames->append(propertyName);
-
-            Vector<Element*>* propertyResults = propertyCache.get(propertyName.impl());
-            if (!propertyResults || !propertyResults->contains(element))
-                append(propertyCache, propertyName, element);
-        }
-
-        void updateCurrentItem(Element* element, unsigned pos, unsigned itemRefElementPos)
-        {
-            current = element;
-            position = pos;
-            itemRefElementPosition = itemRefElementPos;
-        }
-
-        void resetPosition()
-        {
-            current = 0;
-            position = 0;
-            itemRefElementPosition = 0;
-        }
-
-    } m_cache;
+    void updatePropertyCache(Element* element, const AtomicString& propertyName) const
+    {
+        if (!m_propertyNames)
+            m_propertyNames = DOMStringList::create();
+
+        if (!m_propertyNames->contains(propertyName))
+            m_propertyNames->append(propertyName);
+
+        Vector<Element*>* propertyResults = m_propertyCache.get(propertyName.impl());
+        if (!propertyResults || !propertyResults->contains(element))
+            append(m_propertyCache, propertyName, element);
+    }
+
+    mutable Vector<Element*> m_itemRefElements;
+    mutable RefPtr<DOMStringList> m_propertyNames;
+    mutable NodeCacheMap m_propertyCache;
 
+    // FIXME: Move these variables to DynamicNodeListCacheBase for better bit packing.
+    mutable bool m_hasPropertyNameCache : 1;
+    mutable bool m_hasItemRefElements : 1;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLScriptElement.idl b/Source/WebCore/html/HTMLScriptElement.idl
index a41e1043e..ba16e851c 100644
--- a/Source/WebCore/html/HTMLScriptElement.idl
+++ b/Source/WebCore/html/HTMLScriptElement.idl
@@ -29,5 +29,6 @@ module html {
         attribute [Reflect, URL] DOMString src;
         attribute [Reflect] DOMString type;
         attribute [Reflect] DOMString crossOrigin;
+        attribute [Reflect, Conditional=CSP_NEXT] DOMString nonce;
     };
 }
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index 04227aec6..83ccec5c3 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -347,14 +347,21 @@ RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*
 
 bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
 {
-    return childContext.isOnUpperEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
+    if (!HTMLFormControlElementWithState::childShouldCreateRenderer(childContext))
+        return false;
+    if (!usesMenuList())
+        return true;
+    return validationMessageShadowTreeContains(childContext.node());
+}
+
+PassRefPtr<HTMLCollection> HTMLSelectElement::selectedOptions()
+{
+    return ensureCachedHTMLCollection(SelectedOptions);
 }
 
-HTMLOptionsCollection* HTMLSelectElement::options()
+PassRefPtr<HTMLOptionsCollection> HTMLSelectElement::options()
 {
-    if (!m_optionsCollection)
-        m_optionsCollection = HTMLOptionsCollection::create(this);
-    return m_optionsCollection.get();
+    return static_cast<HTMLOptionsCollection*>(ensureCachedHTMLCollection(SelectOptions).get());
 }
 
 void HTMLSelectElement::updateListItemSelectedStates()
@@ -700,6 +707,12 @@ const Vector<HTMLElement*>& HTMLSelectElement::listItems() const
     return m_listItems;
 }
 
+void HTMLSelectElement::invalidateSelectedItems()
+{
+    if (HTMLCollection* collection = cachedHTMLCollection(SelectedOptions))
+        collection->invalidateCache();
+}
+
 void HTMLSelectElement::setRecalcListItems()
 {
     m_shouldRecalcListItems = true;
@@ -707,8 +720,12 @@ void HTMLSelectElement::setRecalcListItems()
     m_activeSelectionAnchorIndex = -1;
     setOptionsChangedOnRenderer();
     setNeedsStyleRecalc();
-    if (!inDocument() && m_optionsCollection)
-        m_optionsCollection->invalidateCacheIfNeeded();
+    if (!inDocument()) {
+        if (HTMLCollection* collection = cachedHTMLCollection(SelectOptions))
+            collection->invalidateCache();
+    }
+    if (!inDocument())
+        invalidateSelectedItems();
 }
 
 void HTMLSelectElement::recalcListItems(bool updateSelectedStates) const
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index a2a2e805a..f9c55d8f7 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -34,7 +34,6 @@
 namespace WebCore {
 
 class HTMLOptionElement;
-class HTMLOptionsCollection;
 
 class HTMLSelectElement : public HTMLFormControlElementWithState {
 public:
@@ -63,11 +62,13 @@ public:
     String value() const;
     void setValue(const String&);
 
-    HTMLOptionsCollection* options();
+    PassRefPtr<HTMLOptionsCollection> options();
+    PassRefPtr<HTMLCollection> selectedOptions();
 
     void optionElementChildrenChanged();
 
     void setRecalcListItems();
+    void invalidateSelectedItems();
     void updateListItemSelectedStates();
 
     const Vector<HTMLElement*>& listItems() const;
@@ -179,8 +180,6 @@ private:
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    OwnPtr<HTMLOptionsCollection> m_optionsCollection;
-
     // m_listItems contains HTMLOptionElement, HTMLOptGroupElement, and HTMLHRElement objects.
     mutable Vector<HTMLElement*> m_listItems;
     Vector<bool> m_lastOnChangeSelection;
diff --git a/Source/WebCore/html/HTMLSelectElement.idl b/Source/WebCore/html/HTMLSelectElement.idl
index de8d2d6d0..6a1ae03d1 100644
--- a/Source/WebCore/html/HTMLSelectElement.idl
+++ b/Source/WebCore/html/HTMLSelectElement.idl
@@ -53,6 +53,7 @@ module html {
 #else
         void remove(in long index);
 #endif
+        readonly attribute HTMLCollection selectedOptions;
         attribute long selectedIndex;
         attribute [TreatNullAs=NullString] DOMString value;
 
diff --git a/Source/WebCore/html/HTMLStyleElement.cpp b/Source/WebCore/html/HTMLStyleElement.cpp
index e2189e96b..26990a5df 100644
--- a/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/Source/WebCore/html/HTMLStyleElement.cpp
@@ -199,9 +199,13 @@ void HTMLStyleElement::removedFrom(ContainerNode* insertionPoint)
     // Now, if we want to register <style scoped> even if it's not inDocument,
     // we'd need to find a way to discern whether that is the case, or whether <style scoped> itself is about to be removed.
     if (m_scopedStyleRegistrationState != NotRegistered) {
-        ContainerNode* scope = parentNode()? parentNode() : insertionPoint;
-        if (m_scopedStyleRegistrationState == RegisteredInShadowRoot)
-            scope = scope->shadowRoot();
+        ContainerNode* scope;
+        if (m_scopedStyleRegistrationState == RegisteredInShadowRoot) {
+            scope = shadowRoot();
+            if (!scope)
+                scope = insertionPoint->shadowRoot();
+        } else
+            scope = parentNode() ? parentNode() : insertionPoint;
         unregisterWithScopingNode(scope);
     }
 #endif
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index f7caeb6af..800a0efc2 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -81,7 +81,7 @@ bool HTMLSummaryElement::childShouldCreateRenderer(const NodeRenderingContext& c
 void HTMLSummaryElement::createShadowSubtree()
 {
     ASSERT(!shadow());
-    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
+    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot);
     root->appendChild(DetailsMarkerControl::create(document()), ASSERT_NO_EXCEPTION, true);
     root->appendChild(SummaryContentElement::create(document()), ASSERT_NO_EXCEPTION, true);
 }
diff --git a/Source/WebCore/html/HTMLTableElement.cpp b/Source/WebCore/html/HTMLTableElement.cpp
index a6fa17d7b..6232609fe 100644
--- a/Source/WebCore/html/HTMLTableElement.cpp
+++ b/Source/WebCore/html/HTMLTableElement.cpp
@@ -560,14 +560,12 @@ bool HTMLTableElement::isURLAttribute(const Attribute& attribute) const
     return attribute.name() == backgroundAttr || HTMLElement::isURLAttribute(attribute);
 }
 
-HTMLCollection* HTMLTableElement::rows()
+PassRefPtr<HTMLCollection> HTMLTableElement::rows()
 {
-    if (!m_rowsCollection)
-        m_rowsCollection = HTMLTableRowsCollection::create(this);
-    return m_rowsCollection.get();
+    return ensureCachedHTMLCollection(TableRows);
 }
 
-HTMLCollection* HTMLTableElement::tBodies()
+PassRefPtr<HTMLCollection> HTMLTableElement::tBodies()
 {
     return ensureCachedHTMLCollection(TableTBodies);
 }
diff --git a/Source/WebCore/html/HTMLTableElement.h b/Source/WebCore/html/HTMLTableElement.h
index d492b5453..2b05053ad 100644
--- a/Source/WebCore/html/HTMLTableElement.h
+++ b/Source/WebCore/html/HTMLTableElement.h
@@ -59,8 +59,8 @@ public:
     PassRefPtr<HTMLElement> insertRow(int index, ExceptionCode&);
     void deleteRow(int index, ExceptionCode&);
 
-    HTMLCollection* rows();
-    HTMLCollection* tBodies();
+    PassRefPtr<HTMLCollection> rows();
+    PassRefPtr<HTMLCollection> tBodies();
 
     String rules() const;
     String summary() const;
@@ -97,7 +97,6 @@ private:
                                 // are present, to none otherwise).
 
     unsigned short m_padding;
-    OwnPtr<HTMLTableRowsCollection> m_rowsCollection;
     RefPtr<StylePropertySet> m_sharedCellStyle;
 };
 
diff --git a/Source/WebCore/html/HTMLTableRowElement.cpp b/Source/WebCore/html/HTMLTableRowElement.cpp
index cc5f90767..5ec3bce2b 100644
--- a/Source/WebCore/html/HTMLTableRowElement.cpp
+++ b/Source/WebCore/html/HTMLTableRowElement.cpp
@@ -120,7 +120,7 @@ int HTMLTableRowElement::sectionRowIndex() const
 
 PassRefPtr<HTMLElement> HTMLTableRowElement::insertCell(int index, ExceptionCode& ec)
 {
-    HTMLCollection* children = cells();
+    RefPtr<HTMLCollection> children = cells();
     int numCells = children ? children->length() : 0;
     if (index < -1 || index > numCells) {
         ec = INDEX_SIZE_ERR;
@@ -143,7 +143,7 @@ PassRefPtr<HTMLElement> HTMLTableRowElement::insertCell(int index, ExceptionCode
 
 void HTMLTableRowElement::deleteCell(int index, ExceptionCode& ec)
 {
-    HTMLCollection* children = cells();
+    RefPtr<HTMLCollection> children = cells();
     int numCells = children ? children->length() : 0;
     if (index == -1)
         index = numCells-1;
@@ -154,7 +154,7 @@ void HTMLTableRowElement::deleteCell(int index, ExceptionCode& ec)
         ec = INDEX_SIZE_ERR;
 }
 
-HTMLCollection* HTMLTableRowElement::cells()
+PassRefPtr<HTMLCollection> HTMLTableRowElement::cells()
 {
     return ensureCachedHTMLCollection(TRCells);
 }
diff --git a/Source/WebCore/html/HTMLTableRowElement.h b/Source/WebCore/html/HTMLTableRowElement.h
index cce97c31b..c433677ac 100644
--- a/Source/WebCore/html/HTMLTableRowElement.h
+++ b/Source/WebCore/html/HTMLTableRowElement.h
@@ -44,7 +44,7 @@ public:
     PassRefPtr<HTMLElement> insertCell(int index, ExceptionCode&);
     void deleteCell(int index, ExceptionCode&);
 
-    HTMLCollection* cells();
+    PassRefPtr<HTMLCollection> cells();
     void setCells(HTMLCollection *, ExceptionCode&);
 
 private:
diff --git a/Source/WebCore/html/HTMLTableRowsCollection.cpp b/Source/WebCore/html/HTMLTableRowsCollection.cpp
index df8998ddf..534db17e6 100644
--- a/Source/WebCore/html/HTMLTableRowsCollection.cpp
+++ b/Source/WebCore/html/HTMLTableRowsCollection.cpp
@@ -151,19 +151,20 @@ HTMLTableRowElement* HTMLTableRowsCollection::lastRow(HTMLTableElement* table)
 // Must call get() on the table in case that argument is compiled before dereferencing the
 // table to get at the collection cache. Order of argument evaluation is undefined and can
 // differ between compilers.
-HTMLTableRowsCollection::HTMLTableRowsCollection(HTMLTableElement* table)
-    : HTMLCollection(table, OtherCollection)
+HTMLTableRowsCollection::HTMLTableRowsCollection(Element* table)
+    : HTMLCollection(table, TableRows)
 {
+    ASSERT(table->hasTagName(tableTag));
 }
 
-PassOwnPtr<HTMLTableRowsCollection> HTMLTableRowsCollection::create(HTMLTableElement* table)
+PassRefPtr<HTMLTableRowsCollection> HTMLTableRowsCollection::create(Element* table)
 {
-    return adoptPtr(new HTMLTableRowsCollection(table));
+    return adoptRef(new HTMLTableRowsCollection(table));
 }
 
-Element* HTMLTableRowsCollection::itemAfter(Element* previous) const
+Element* HTMLTableRowsCollection::itemAfter(Node* previous) const
 {
-    ASSERT(!previous || previous->hasLocalName(trTag));
+    ASSERT(!previous || (previous->isHTMLElement() && toHTMLElement(previous)->hasLocalName(trTag)));
     return rowAfter(static_cast<HTMLTableElement*>(base()), static_cast<HTMLTableRowElement*>(previous));
 }
 
diff --git a/Source/WebCore/html/HTMLTableRowsCollection.h b/Source/WebCore/html/HTMLTableRowsCollection.h
index 11fb8d199..02bb9f749 100644
--- a/Source/WebCore/html/HTMLTableRowsCollection.h
+++ b/Source/WebCore/html/HTMLTableRowsCollection.h
@@ -38,15 +38,15 @@ class HTMLTableRowElement;
 
 class HTMLTableRowsCollection : public HTMLCollection {
 public:
-    static PassOwnPtr<HTMLTableRowsCollection> create(HTMLTableElement*);
+    static PassRefPtr<HTMLTableRowsCollection> create(Element*);
 
     static HTMLTableRowElement* rowAfter(HTMLTableElement*, HTMLTableRowElement*);
     static HTMLTableRowElement* lastRow(HTMLTableElement*);
 
 private:
-    HTMLTableRowsCollection(HTMLTableElement*);
+    HTMLTableRowsCollection(Element*);
 
-    virtual Element* itemAfter(Element*) const;
+    virtual Element* itemAfter(Node*) const OVERRIDE;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLTableSectionElement.cpp b/Source/WebCore/html/HTMLTableSectionElement.cpp
index f450fea25..60e54289c 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.cpp
+++ b/Source/WebCore/html/HTMLTableSectionElement.cpp
@@ -59,7 +59,7 @@ StylePropertySet* HTMLTableSectionElement::additionalAttributeStyle()
 PassRefPtr<HTMLElement> HTMLTableSectionElement::insertRow(int index, ExceptionCode& ec)
 {
     RefPtr<HTMLTableRowElement> row;
-    HTMLCollection* children = rows();
+    RefPtr<HTMLCollection> children = rows();
     int numRows = children ? (int)children->length() : 0;
     if (index < -1 || index > numRows)
         ec = INDEX_SIZE_ERR; // per the DOM
@@ -81,7 +81,7 @@ PassRefPtr<HTMLElement> HTMLTableSectionElement::insertRow(int index, ExceptionC
 
 void HTMLTableSectionElement::deleteRow(int index, ExceptionCode& ec)
 {
-    HTMLCollection* children = rows();
+    RefPtr<HTMLCollection> children = rows();
     int numRows = children ? (int)children->length() : 0;
     if (index == -1)
         index = numRows - 1;
@@ -145,7 +145,7 @@ void HTMLTableSectionElement::setVAlign(const String &value)
     setAttribute(valignAttr, value);
 }
 
-HTMLCollection* HTMLTableSectionElement::rows()
+PassRefPtr<HTMLCollection> HTMLTableSectionElement::rows()
 {
     return ensureCachedHTMLCollection(TSectionRows);
 }
diff --git a/Source/WebCore/html/HTMLTableSectionElement.h b/Source/WebCore/html/HTMLTableSectionElement.h
index 93b5f6953..7156a70f0 100644
--- a/Source/WebCore/html/HTMLTableSectionElement.h
+++ b/Source/WebCore/html/HTMLTableSectionElement.h
@@ -51,7 +51,7 @@ public:
     String vAlign() const;
     void setVAlign(const String&);
 
-    HTMLCollection* rows();
+    PassRefPtr<HTMLCollection> rows();
 
 private:
     HTMLTableSectionElement(const QualifiedName& tagName, Document*);
diff --git a/Source/WebCore/html/HTMLTagNames.in b/Source/WebCore/html/HTMLTagNames.in
index 58093c592..bfdcd3571 100644
--- a/Source/WebCore/html/HTMLTagNames.in
+++ b/Source/WebCore/html/HTMLTagNames.in
@@ -39,6 +39,7 @@ del interfaceName=HTMLModElement
 details conditional=DETAILS
 dfn interfaceName=HTMLElement
 dir interfaceName=HTMLDirectoryElement
+dialog conditional=DIALOG_ELEMENT, contextConditional=dialogElement
 div
 dl interfaceName=HTMLDListElement
 dt interfaceName=HTMLElement
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index 9f2301303..d07a972c6 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -89,7 +89,7 @@ PassRefPtr<HTMLTextAreaElement> HTMLTextAreaElement::create(const QualifiedName&
 void HTMLTextAreaElement::createShadowSubtree()
 {
     ASSERT(!shadow());
-    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot);
+    RefPtr<ShadowRoot> root = ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot);
     root->appendChild(TextControlInnerTextElement::create(document()), ASSERT_NO_EXCEPTION);
 }
 
@@ -101,10 +101,7 @@ const AtomicString& HTMLTextAreaElement::formControlType() const
 
 FormControlState HTMLTextAreaElement::saveFormControlState() const
 {
-    String currentValue = value();
-    if (currentValue == defaultValue())
-        return FormControlState();
-    return FormControlState(currentValue);
+    return m_isDirty ? FormControlState(value()) : FormControlState();
 }
 
 void HTMLTextAreaElement::restoreFormControlState(const FormControlState& state)
diff --git a/Source/WebCore/html/HiddenInputType.cpp b/Source/WebCore/html/HiddenInputType.cpp
index 049637c0e..fb6f36a6e 100644
--- a/Source/WebCore/html/HiddenInputType.cpp
+++ b/Source/WebCore/html/HiddenInputType.cpp
@@ -54,8 +54,11 @@ const AtomicString& HiddenInputType::formControlType() const
 
 FormControlState HiddenInputType::saveFormControlState() const
 {
-    // FIXME: We should not always save the value. http://webkit.org/b/88685
-    return FormControlState(element()->value());
+    // valueAttributeWasUpdatedAfterParsing() never be true for form
+    // controls create by createElement() or cloneNode(). It's ok for
+    // now because we restore values only to form controls created by
+    // parsing.
+    return element()->valueAttributeWasUpdatedAfterParsing() ? FormControlState(element()->value()) : FormControlState();
 }
 
 void HiddenInputType::restoreFormControlState(const FormControlState& state)
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index 30602a009..99e5422ef 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -417,6 +417,12 @@ void InputType::handleWheelEvent(WheelEvent*)
 {
 }
 
+#if ENABLE(TOUCH_EVENTS)
+void InputType::handleTouchEvent(TouchEvent*)
+{
+}
+#endif
+
 void InputType::forwardEvent(Event*)
 {
 }
@@ -447,6 +453,7 @@ void InputType::destroyShadowSubtree()
         return;
 
     ShadowRoot* root = shadow->oldestShadowRoot();
+    ASSERT(root->type() == ShadowRoot::UserAgentShadowRoot);
     root->removeAllChildren();
 
     // It's ok to clear contents of all other ShadowRoots because they must have
@@ -873,6 +880,13 @@ void InputType::subtreeHasChanged()
 {
 }
 
+#if ENABLE(TOUCH_EVENTS)
+bool InputType::hasTouchEventHandler() const
+{
+    return false;
+}
+#endif
+
 String InputType::defaultToolTip() const
 {
     return String();
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 451303d13..fa41ff857 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -61,12 +61,14 @@ class Node;
 class RenderArena;
 class RenderObject;
 class RenderStyle;
+class TouchEvent;
 class WheelEvent;
 
 typedef int ExceptionCode;
 
 struct ClickHandlingState {
     WTF_MAKE_FAST_ALLOCATED;
+  
 public:
     bool checked;
     bool indeterminate;
@@ -190,6 +192,9 @@ public:
     virtual void handleKeyupEvent(KeyboardEvent*);
     virtual void handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*);
     virtual void handleWheelEvent(WheelEvent*);
+#if ENABLE(TOUCH_EVENTS)
+    virtual void handleTouchEvent(TouchEvent*);
+#endif
     virtual void forwardEvent(Event*);
     // Helpers for event handlers.
     virtual bool shouldSubmitImplicitly(Event*);
@@ -202,6 +207,9 @@ public:
     virtual void accessKeyAction(bool sendMouseEvents);
     virtual bool canBeSuccessfulSubmitButton();
     virtual void subtreeHasChanged();
+#if ENABLE(TOUCH_EVENTS)
+    virtual bool hasTouchEventHandler() const;
+#endif
 
     // Shadow tree handling
 
diff --git a/Source/WebCore/html/LabelableElement.cpp b/Source/WebCore/html/LabelableElement.cpp
index 1d59936f6..6a2632e2f 100644
--- a/Source/WebCore/html/LabelableElement.cpp
+++ b/Source/WebCore/html/LabelableElement.cpp
@@ -25,8 +25,8 @@
 #include "config.h"
 #include "LabelableElement.h"
 
-#include "ElementRareData.h"
 #include "LabelsNodeList.h"
+#include "NodeRareData.h"
 #include "RenderStyle.h"
 
 namespace WebCore {
@@ -47,7 +47,7 @@ PassRefPtr<NodeList> LabelableElement::labels()
     if (!document())
         return 0;
 
-    return Node::ensureRareData()->ensureNodeLists(this)->addCacheWithAtomicName<LabelsNodeList>(this, DynamicNodeList::LabelsNodeListType, starAtom);
+    return ensureRareData()->ensureNodeLists(this)->addCacheWithAtomicName<LabelsNodeList>(this, DynamicNodeList::LabelsNodeListType, starAtom);
 }
 
 } // namespace Webcore
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index fd11cbaa7..10c7576bf 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -49,6 +49,12 @@
 #include <wtf/MathExtras.h>
 #include <wtf/PassOwnPtr.h>
 
+#if ENABLE(TOUCH_EVENTS)
+#include "Touch.h"
+#include "TouchEvent.h"
+#include "TouchList.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -134,6 +140,34 @@ void RangeInputType::handleMouseDownEvent(MouseEvent* event)
     thumb->dragFrom(event->absoluteLocation());
 }
 
+#if ENABLE(TOUCH_EVENTS)
+#if ENABLE(TOUCH_SLIDER)
+void RangeInputType::handleTouchEvent(TouchEvent* event)
+{
+    if (element()->disabled() || element()->readOnly())
+        return;
+
+    if (event->type() == eventNames().touchendEvent) {
+        event->setDefaultHandled();
+        return;
+    }
+
+    TouchList* touches = event->targetTouches();
+    if (touches->length() == 1) {
+        Touch* touch = touches->item(0);
+        SliderThumbElement* thumb = sliderThumbElementOf(element());
+        thumb->setPositionFromPoint(touch->absoluteLocation());
+        event->setDefaultHandled();
+    }
+}
+
+bool RangeInputType::hasTouchEventHandler() const
+{
+    return true;
+}
+#endif
+#endif
+
 void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
 {
     if (element()->disabled() || element()->readOnly())
diff --git a/Source/WebCore/html/RangeInputType.h b/Source/WebCore/html/RangeInputType.h
index ff8f4028f..0983b3d57 100644
--- a/Source/WebCore/html/RangeInputType.h
+++ b/Source/WebCore/html/RangeInputType.h
@@ -51,6 +51,12 @@ private:
     virtual StepRange createStepRange(AnyStepHandling) const OVERRIDE;
     virtual bool isSteppable() const OVERRIDE;
     virtual void handleMouseDownEvent(MouseEvent*) OVERRIDE;
+#if ENABLE(TOUCH_EVENTS)
+#if ENABLE(TOUCH_SLIDER)
+    virtual void handleTouchEvent(TouchEvent*) OVERRIDE;
+    virtual bool hasTouchEventHandler() const OVERRIDE;
+#endif
+#endif
     virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
     virtual void createShadowSubtree() OVERRIDE;
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index 42bcedd2b..b63d8837d 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -182,6 +182,13 @@ void ValidationMessage::requestToHideMessage()
     m_timer->startOneShot(0);
 }
 
+bool ValidationMessage::shadowTreeContains(Node* node) const
+{
+    if (!m_bubble)
+        return false;
+    return m_bubble->treeScope() == node->treeScope();
+}
+
 void ValidationMessage::deleteBubbleTree(Timer<ValidationMessage>*)
 {
     if (m_bubble) {
diff --git a/Source/WebCore/html/ValidationMessage.h b/Source/WebCore/html/ValidationMessage.h
index f71a7c87e..42982e507 100644
--- a/Source/WebCore/html/ValidationMessage.h
+++ b/Source/WebCore/html/ValidationMessage.h
@@ -41,6 +41,7 @@ namespace WebCore {
 
 class FormAssociatedElement;
 class HTMLElement;
+class Node;
 
 class ValidationMessage {
     WTF_MAKE_NONCOPYABLE(ValidationMessage);
@@ -50,6 +51,7 @@ public:
     String message() const { return m_message; }
     void setMessage(const String&);
     void requestToHideMessage();
+    bool shadowTreeContains(Node*) const;
 
 private:
     ValidationMessage(FormAssociatedElement*);
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index c65af248b..aced0bd0b 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -1768,7 +1768,7 @@ void CanvasRenderingContext2D::didDraw(const FloatRect& r, unsigned options)
     if (isAccelerated()) {
         RenderBox* renderBox = canvas()->renderBox();
         if (renderBox && renderBox->hasAcceleratedCompositing()) {
-            renderBox->contentChanged(CanvasChanged);
+            renderBox->contentChanged(CanvasPixelsChanged);
             canvas()->clearCopiedImage();
             return;
         }
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl b/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
index d41f87592..cffa8dab9 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -168,24 +168,24 @@ module html {
                         in [Optional=DefaultIsUndefined] float height,
                         in [Optional] float lineWidth);
 
-        void drawImage(in HTMLImageElement image, in float x, in float y)
+        void drawImage(in HTMLImageElement? image, in float x, in float y)
             raises (DOMException);
-        void drawImage(in HTMLImageElement image, in float x, in float y, in float width, in float height)
+        void drawImage(in HTMLImageElement? image, in float x, in float y, in float width, in float height)
             raises (DOMException);
-        void drawImage(in HTMLImageElement image, in float sx, in float sy, in float sw, in float sh, in float dx, in float dy, in float dw, in float dh)
+        void drawImage(in HTMLImageElement? image, in float sx, in float sy, in float sw, in float sh, in float dx, in float dy, in float dw, in float dh)
             raises (DOMException);
-        void drawImage(in HTMLCanvasElement canvas, in float x, in float y)
+        void drawImage(in HTMLCanvasElement? canvas, in float x, in float y)
             raises (DOMException);
-        void drawImage(in HTMLCanvasElement canvas, in float x, in float y, in float width, in float height)
+        void drawImage(in HTMLCanvasElement? canvas, in float x, in float y, in float width, in float height)
             raises (DOMException);
-        void drawImage(in HTMLCanvasElement canvas, in float sx, in float sy, in float sw, in float sh, in float dx, in float dy, in float dw, in float dh)
+        void drawImage(in HTMLCanvasElement? canvas, in float sx, in float sy, in float sw, in float sh, in float dx, in float dy, in float dw, in float dh)
             raises (DOMException);
 #if defined(ENABLE_VIDEO) && ENABLE_VIDEO
-        void drawImage(in HTMLVideoElement video, in float x, in float y)
+        void drawImage(in HTMLVideoElement? video, in float x, in float y)
             raises (DOMException);
-        void drawImage(in HTMLVideoElement video, in float x, in float y, in float width, in float height)
+        void drawImage(in HTMLVideoElement? video, in float x, in float y, in float width, in float height)
             raises (DOMException);
-        void drawImage(in HTMLVideoElement video, in float sx, in float sy, in float sw, in float sh, in float dx, in float dy, in float dw, in float dh)
+        void drawImage(in HTMLVideoElement? video, in float sx, in float sy, in float sw, in float sh, in float dx, in float dy, in float dw, in float dh)
             raises (DOMException);
 #endif
 
@@ -199,21 +199,21 @@ module html {
         void setShadow(in float width, in float height, in float blur, in float r, in float g, in float b, in float a);
         void setShadow(in float width, in float height, in float blur, in float c, in float m, in float y, in float k, in float a);
 
-        void putImageData(in ImageData imagedata, in float dx, in float dy)
+        void putImageData(in ImageData? imagedata, in float dx, in float dy)
             raises(DOMException);
-        void putImageData(in ImageData imagedata, in float dx, in float dy, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight)
+        void putImageData(in ImageData? imagedata, in float dx, in float dy, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight)
             raises(DOMException);
 
-        void webkitPutImageDataHD(in ImageData imagedata, in float dx, in float dy)
+        void webkitPutImageDataHD(in ImageData? imagedata, in float dx, in float dy)
             raises(DOMException);
-        void webkitPutImageDataHD(in ImageData imagedata, in float dx, in float dy, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight)
+        void webkitPutImageDataHD(in ImageData? imagedata, in float dx, in float dy, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight)
             raises(DOMException);
 
-        CanvasPattern createPattern(in HTMLCanvasElement canvas, in [TreatNullAs=NullString] DOMString repetitionType)
+        CanvasPattern createPattern(in HTMLCanvasElement? canvas, in [TreatNullAs=NullString] DOMString repetitionType)
             raises (DOMException);
-        CanvasPattern createPattern(in HTMLImageElement image, in [TreatNullAs=NullString] DOMString repetitionType)
+        CanvasPattern createPattern(in HTMLImageElement? image, in [TreatNullAs=NullString] DOMString repetitionType)
             raises (DOMException);
-        ImageData createImageData(in ImageData imagedata)
+        ImageData createImageData(in ImageData? imagedata)
             raises (DOMException);
         ImageData createImageData(in float sw, in float sh)
             raises (DOMException);
diff --git a/Source/WebCore/html/canvas/WebGLDepthTexture.idl b/Source/WebCore/html/canvas/WebGLDepthTexture.idl
index 507450d18..56ef537c0 100644
--- a/Source/WebCore/html/canvas/WebGLDepthTexture.idl
+++ b/Source/WebCore/html/canvas/WebGLDepthTexture.idl
@@ -27,7 +27,9 @@ module html {
     interface [
         Conditional=WEBGL,
         JSGenerateIsReachable=ImplContext,
-        OmitConstructor
+        OmitConstructor,
+        DoNotCheckConstants
     ] WebGLDepthTexture {
+        const unsigned int UNSIGNED_INT_24_8_WEBGL = 0x84FA;
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLFramebuffer.cpp b/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
index e515423e6..a037ab8b6 100644
--- a/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
+++ b/Source/WebCore/html/canvas/WebGLFramebuffer.cpp
@@ -226,7 +226,11 @@ namespace {
 
     void WebGLTextureAttachment::unattach(GraphicsContext3D* context, GC3Denum attachment)
     {
-        context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, attachment, m_target, 0, m_level);
+        if (attachment == GraphicsContext3D::DEPTH_STENCIL_ATTACHMENT) {
+            context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, m_target, 0, m_level);
+            context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::STENCIL_ATTACHMENT, m_target, 0, m_level);
+        } else
+            context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, attachment, m_target, 0, m_level);
     }
 
     bool isAttachmentComplete(WebGLFramebuffer::WebGLAttachment* attachedObject, GC3Denum attachment, const char** reason)
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index 8f78500a1..4dad74906 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -4726,10 +4726,11 @@ bool WebGLRenderingContext::validateTexFuncFormatAndType(const char* functionNam
     case GraphicsContext3D::RGB:
     case GraphicsContext3D::RGBA:
         break;
+    case GraphicsContext3D::DEPTH_STENCIL:
     case GraphicsContext3D::DEPTH_COMPONENT:
         if (m_webglDepthTexture)
             break;
-        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, functionName, "DEPTH_COMPONENT texture format not enabled");
+        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, functionName, "depth texture formats not enabled");
         return false;
     default:
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, functionName, "invalid texture format");
@@ -4748,6 +4749,7 @@ bool WebGLRenderingContext::validateTexFuncFormatAndType(const char* functionNam
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, functionName, "invalid texture type");
         return false;
     case GraphicsContext3D::UNSIGNED_INT:
+    case GraphicsContext3D::UNSIGNED_INT_24_8:
     case GraphicsContext3D::UNSIGNED_SHORT:
         if (m_webglDepthTexture)
             break;
@@ -4801,6 +4803,20 @@ bool WebGLRenderingContext::validateTexFuncFormatAndType(const char* functionNam
           return false;
         }
         break;
+    case GraphicsContext3D::DEPTH_STENCIL:
+        if (!m_webglDepthTexture) {
+            synthesizeGLError(GraphicsContext3D::INVALID_ENUM, functionName, "invalid format. DEPTH_STENCIL not enabled");
+            return false;
+        }
+        if (type != GraphicsContext3D::UNSIGNED_INT_24_8) {
+            synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, functionName, "invalid type for DEPTH_STENCIL format");
+            return false;
+        }
+        if (level > 0) {
+          synthesizeGLError(GraphicsContext3D::INVALID_OPERATION, functionName, "level must be 0 for DEPTH_STENCIL format");
+          return false;
+        }
+        break;
     default:
         ASSERT_NOT_REACHED();
     }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.idl b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
index 0f73fbd28..9bf6ff544 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.idl
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -461,11 +461,11 @@ module html {
         [StrictTypeChecking] void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
         [StrictTypeChecking] void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
         [StrictTypeChecking] void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
-        [StrictTypeChecking] void         bufferData(in unsigned long target, in ArrayBuffer data, in unsigned long usage) raises (DOMException);
-        [StrictTypeChecking] void         bufferData(in unsigned long target, in ArrayBufferView data, in unsigned long usage) raises (DOMException);
+        [StrictTypeChecking] void         bufferData(in unsigned long target, in ArrayBuffer? data, in unsigned long usage) raises (DOMException);
+        [StrictTypeChecking] void         bufferData(in unsigned long target, in ArrayBufferView? data, in unsigned long usage) raises (DOMException);
         [StrictTypeChecking] void         bufferData(in unsigned long target, in long long size, in unsigned long usage) raises (DOMException);
-        [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long long offset, in ArrayBuffer data) raises (DOMException);
-        [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long long offset, in ArrayBufferView data) raises (DOMException);
+        [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long long offset, in ArrayBuffer? data) raises (DOMException);
+        [StrictTypeChecking] void         bufferSubData(in unsigned long target, in long long offset, in ArrayBufferView? data) raises (DOMException);
 
         [StrictTypeChecking] unsigned long checkFramebufferStatus(in unsigned long target);
         [StrictTypeChecking] void         clear(in unsigned long mask);
@@ -602,30 +602,30 @@ module html {
 
         // Supported forms:
         [StrictTypeChecking] void         texImage2D(in unsigned long target, in long level, in unsigned long internalformat, in long width, in long height, 
-                                                     in long border, in unsigned long format, in unsigned long type, in ArrayBufferView pixels) raises (DOMException);
+                                                     in long border, in unsigned long format, in unsigned long type, in ArrayBufferView? pixels) raises (DOMException);
         [StrictTypeChecking] void         texImage2D(in unsigned long target, in long level, in unsigned long internalformat,
-                                                     in unsigned long format, in unsigned long type, in ImageData pixels) raises (DOMException);
+                                                     in unsigned long format, in unsigned long type, in ImageData? pixels) raises (DOMException);
         [StrictTypeChecking] void         texImage2D(in unsigned long target, in long level, in unsigned long internalformat,
-                                                     in unsigned long format, in unsigned long type, in HTMLImageElement image) raises (DOMException);
+                                                     in unsigned long format, in unsigned long type, in HTMLImageElement? image) raises (DOMException);
         [StrictTypeChecking] void         texImage2D(in unsigned long target, in long level, in unsigned long internalformat,
-                                                     in unsigned long format, in unsigned long type, in HTMLCanvasElement canvas) raises (DOMException);
+                                                     in unsigned long format, in unsigned long type, in HTMLCanvasElement? canvas) raises (DOMException);
 #if defined(ENABLE_VIDEO) && ENABLE_VIDEO
         [StrictTypeChecking] void         texImage2D(in unsigned long target, in long level, in unsigned long internalformat,
-                                                     in unsigned long format, in unsigned long type, in HTMLVideoElement video) raises (DOMException);
+                                                     in unsigned long format, in unsigned long type, in HTMLVideoElement? video) raises (DOMException);
 #endif
 
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, 
                                                         in long width, in long height, 
-                                                        in unsigned long format, in unsigned long type, in ArrayBufferView pixels) raises (DOMException);
+                                                        in unsigned long format, in unsigned long type, in ArrayBufferView? pixels) raises (DOMException);
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset,
-                                                        in unsigned long format, in unsigned long type, in ImageData pixels) raises (DOMException);
+                                                        in unsigned long format, in unsigned long type, in ImageData? pixels) raises (DOMException);
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset,
-                                                        in unsigned long format, in unsigned long type, in HTMLImageElement image) raises (DOMException);
+                                                        in unsigned long format, in unsigned long type, in HTMLImageElement? image) raises (DOMException);
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset,
-                                                        in unsigned long format, in unsigned long type, in HTMLCanvasElement canvas) raises (DOMException);
+                                                        in unsigned long format, in unsigned long type, in HTMLCanvasElement? canvas) raises (DOMException);
 #if defined(ENABLE_VIDEO) && ENABLE_VIDEO
         [StrictTypeChecking] void         texSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset,
-                                                        in unsigned long format, in unsigned long type, in HTMLVideoElement video) raises (DOMException);
+                                                        in unsigned long format, in unsigned long type, in HTMLVideoElement? video) raises (DOMException);
 #endif
 
         [StrictTypeChecking] void uniform1f(in WebGLUniformLocation location, in float x) raises(DOMException);
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.cpp b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
index 7a06b4239..3363287ef 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -165,7 +165,7 @@ bool HTMLDocumentParser::processingData() const
 
 void HTMLDocumentParser::pumpTokenizerIfPossible(SynchronousMode mode)
 {
-    if (isStopped() || m_treeBuilder->isPaused())
+    if (isStopped() || isWaitingForScripts())
         return;
 
     // Once a resume is scheduled, HTMLParserScheduler controls when we next pump.
@@ -195,16 +195,13 @@ void HTMLDocumentParser::resumeParsingAfterYield()
     endIfDelayed();
 }
 
-bool HTMLDocumentParser::runScriptsForPausedTreeBuilder()
+void HTMLDocumentParser::runScriptsForPausedTreeBuilder()
 {
-    ASSERT(m_treeBuilder->isPaused());
-
     TextPosition scriptStartPosition = TextPosition::belowRangePosition();
     RefPtr<Element> scriptElement = m_treeBuilder->takeScriptToProcess(scriptStartPosition);
     // We will not have a scriptRunner when parsing a DocumentFragment.
-    if (!m_scriptRunner)
-        return true;
-    return m_scriptRunner->execute(scriptElement.release(), scriptStartPosition);
+    if (m_scriptRunner)
+        m_scriptRunner->execute(scriptElement.release(), scriptStartPosition);
 }
 
 bool HTMLDocumentParser::canTakeNextToken(SynchronousMode mode, PumpSession& session)
@@ -212,8 +209,7 @@ bool HTMLDocumentParser::canTakeNextToken(SynchronousMode mode, PumpSession& ses
     if (isStopped())
         return false;
 
-    // The parser will pause itself when waiting on a script to load or run.
-    if (m_treeBuilder->isPaused()) {
+    if (isWaitingForScripts()) {
         if (mode == AllowYield)
             m_parserScheduler->checkForYieldBeforeScript(session);
 
@@ -222,9 +218,8 @@ bool HTMLDocumentParser::canTakeNextToken(SynchronousMode mode, PumpSession& ses
             return false;
 
         // If we're paused waiting for a script, we try to execute scripts before continuing.
-        bool shouldContinueParsing = runScriptsForPausedTreeBuilder();
-        m_treeBuilder->setPaused(!shouldContinueParsing);
-        if (!shouldContinueParsing || isStopped())
+        runScriptsForPausedTreeBuilder();
+        if (isWaitingForScripts() || isStopped())
             return false;
     }
 
@@ -258,7 +253,7 @@ void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
     // FIXME: m_input.current().length() is only accurate if we
     // end up parsing the whole buffer in this pump.  We should pass how
     // much we parsed as part of didWriteHTML instead of willWriteHTML.
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willWriteHTML(document(), m_input.current().length(), m_tokenizer->lineNumber().zeroBasedInt());
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willWriteHTML(document(), m_input.current().length(), m_input.current().currentLine().zeroBasedInt());
 
     while (canTakeNextToken(mode, session) && !session.needsYield) {
         if (!isParsingFragment())
@@ -298,7 +293,7 @@ void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
         m_preloadScanner->scan();
     }
 
-    InspectorInstrumentation::didWriteHTML(cookie, m_tokenizer->lineNumber().zeroBasedInt());
+    InspectorInstrumentation::didWriteHTML(cookie, m_input.current().currentLine().zeroBasedInt());
 }
 
 bool HTMLDocumentParser::hasInsertionPoint()
@@ -448,7 +443,7 @@ String HTMLDocumentParser::sourceForToken(const HTMLToken& token)
 
 OrdinalNumber HTMLDocumentParser::lineNumber() const
 {
-    return m_tokenizer->lineNumber();
+    return m_input.current().currentLine();
 }
 
 TextPosition HTMLDocumentParser::textPosition() const
@@ -456,20 +451,30 @@ TextPosition HTMLDocumentParser::textPosition() const
     const SegmentedString& currentString = m_input.current();
     OrdinalNumber line = currentString.currentLine();
     OrdinalNumber column = currentString.currentColumn();
-    ASSERT(m_tokenizer->lineNumber() == line);
 
     return TextPosition(line, column);
 }
 
 bool HTMLDocumentParser::isWaitingForScripts() const
 {
-    return m_treeBuilder->isPaused();
+    // When the TreeBuilder encounters a </script> tag, it returns to the HTMLDocumentParser
+    // where the script is transfered from the treebuilder to the script runner.
+    // The script runner will hold the script until its loaded and run. During
+    // any of this time, we want to count ourselves as "waiting for a script" and thus
+    // run the preload scanner, as well as delay completion of parsing.
+    bool treeBuilderHasBlockingScript = m_treeBuilder->hasParserBlockingScript();
+    bool scriptRunnerHasBlockingScript = m_scriptRunner && m_scriptRunner->hasParserBlockingScript();
+    // Since the parser is paused while a script runner has a blocking script, it should
+    // never be possible to end up with both objects holding a blocking script.
+    ASSERT(!(treeBuilderHasBlockingScript && scriptRunnerHasBlockingScript));
+    // If either object has a blocking script, the parser should be paused.
+    return treeBuilderHasBlockingScript || scriptRunnerHasBlockingScript;
 }
 
 void HTMLDocumentParser::resumeParsingAfterScriptExecution()
 {
     ASSERT(!isExecutingScript());
-    ASSERT(!m_treeBuilder->isPaused());
+    ASSERT(!isWaitingForScripts());
 
     m_insertionPreloadScanner.clear();
     pumpTokenizerIfPossible(AllowYield);
@@ -510,13 +515,8 @@ void HTMLDocumentParser::notifyFinished(CachedResource* cachedResource)
         return;
     }
 
-    ASSERT(m_treeBuilder->isPaused());
-    // Note: We only ever wait on one script at a time, so we always know this
-    // is the one we were waiting on and can un-pause the tree builder.
-    m_treeBuilder->setPaused(false);
-    bool shouldContinueParsing = m_scriptRunner->executeScriptsWaitingForLoad(cachedResource);
-    m_treeBuilder->setPaused(!shouldContinueParsing);
-    if (shouldContinueParsing)
+    m_scriptRunner->executeScriptsWaitingForLoad(cachedResource);
+    if (!isWaitingForScripts())
         resumeParsingAfterScriptExecution();
 }
 
@@ -534,15 +534,8 @@ void HTMLDocumentParser::executeScriptsWaitingForStylesheets()
     // pumpTokenizer can cause this parser to be detached from the Document,
     // but we need to ensure it isn't deleted yet.
     RefPtr<HTMLDocumentParser> protect(this);
-
-    ASSERT(!m_scriptRunner->isExecutingScript());
-    ASSERT(m_treeBuilder->isPaused());
-    // Note: We only ever wait on one script at a time, so we always know this
-    // is the one we were waiting on and can un-pause the tree builder.
-    m_treeBuilder->setPaused(false);
-    bool shouldContinueParsing = m_scriptRunner->executeScriptsWaitingForStylesheets();
-    m_treeBuilder->setPaused(!shouldContinueParsing);
-    if (shouldContinueParsing)
+    m_scriptRunner->executeScriptsWaitingForStylesheets();
+    if (!isWaitingForScripts())
         resumeParsingAfterScriptExecution();
 }
 
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
index 2d829f658..4e26c5726 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
@@ -124,10 +124,9 @@ private:
     void pumpTokenizer(SynchronousMode);
     void pumpTokenizerIfPossible(SynchronousMode);
 
-    bool runScriptsForPausedTreeBuilder();
+    void runScriptsForPausedTreeBuilder();
     void resumeParsingAfterScriptExecution();
 
-    void begin();
     void attemptToEnd();
     void endIfDelayed();
     void attemptToRunDeferredScriptsAndEnd();
diff --git a/Source/WebCore/html/parser/HTMLScriptRunner.cpp b/Source/WebCore/html/parser/HTMLScriptRunner.cpp
index d14d69d1d..04244a658 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunner.cpp
+++ b/Source/WebCore/html/parser/HTMLScriptRunner.cpp
@@ -57,8 +57,8 @@ HTMLScriptRunner::HTMLScriptRunner(Document* document, HTMLScriptRunnerHost* hos
 HTMLScriptRunner::~HTMLScriptRunner()
 {
     // FIXME: Should we be passed a "done loading/parsing" callback sooner than destruction?
-    if (m_parsingBlockingScript.cachedScript() && m_parsingBlockingScript.watchingForLoad())
-        stopWatchingForLoad(m_parsingBlockingScript);
+    if (m_parserBlockingScript.cachedScript() && m_parserBlockingScript.watchingForLoad())
+        stopWatchingForLoad(m_parserBlockingScript);
 
     while (!m_scriptsToExecuteAfterParsing.isEmpty()) {
         PendingScript pendingScript = m_scriptsToExecuteAfterParsing.takeFirst();
@@ -112,10 +112,10 @@ void HTMLScriptRunner::executeParsingBlockingScript()
     ASSERT(m_document);
     ASSERT(!m_scriptNestingLevel);
     ASSERT(m_document->haveStylesheetsLoaded());
-    ASSERT(isPendingScriptReady(m_parsingBlockingScript));
+    ASSERT(isPendingScriptReady(m_parserBlockingScript));
 
     InsertionPointRecord insertionPointRecord(m_host->inputStream());
-    executePendingScriptAndDispatchEvent(m_parsingBlockingScript);
+    executePendingScriptAndDispatchEvent(m_parserBlockingScript);
 }
 
 void HTMLScriptRunner::executePendingScriptAndDispatchEvent(PendingScript& pendingScript)
@@ -159,54 +159,47 @@ void HTMLScriptRunner::stopWatchingForLoad(PendingScript& pendingScript)
 
 // This function should match 10.2.5.11 "An end tag whose tag name is 'script'"
 // Script handling lives outside the tree builder to keep the each class simple.
-bool HTMLScriptRunner::execute(PassRefPtr<Element> scriptElement, const TextPosition& scriptStartPosition)
+void HTMLScriptRunner::execute(PassRefPtr<Element> scriptElement, const TextPosition& scriptStartPosition)
 {
     ASSERT(scriptElement);
-    // FIXME: If scripting is disabled, always just return true;
+    // FIXME: If scripting is disabled, always just return.
 
     bool hadPreloadScanner = m_host->hasPreloadScanner();
 
     // Try to execute the script given to us.
     runScript(scriptElement.get(), scriptStartPosition);
 
-    if (haveParsingBlockingScript()) {
+    if (hasParserBlockingScript()) {
         if (m_scriptNestingLevel)
-            return false; // Block the parser.  Unwind to the outermost HTMLScriptRunner::execute before continuing parsing.
+            return; // Unwind to the outermost HTMLScriptRunner::execute before continuing parsing.
         // If preload scanner got created, it is missing the source after the current insertion point. Append it and scan.
         if (!hadPreloadScanner && m_host->hasPreloadScanner())
             m_host->appendCurrentInputStreamToPreloadScannerAndScan();
-        if (!executeParsingBlockingScripts())
-            return false; // We still have a parsing blocking script, block the parser.
+        executeParsingBlockingScripts();
     }
-    return true; // Scripts executed as expected, continue parsing.
 }
 
-bool HTMLScriptRunner::haveParsingBlockingScript() const
+bool HTMLScriptRunner::hasParserBlockingScript() const
 {
-    return !!m_parsingBlockingScript.element();
+    return !!m_parserBlockingScript.element();
 }
 
-bool HTMLScriptRunner::executeParsingBlockingScripts()
+void HTMLScriptRunner::executeParsingBlockingScripts()
 {
-    while (haveParsingBlockingScript()) {
-        // We only really need to check once.
-        if (!isPendingScriptReady(m_parsingBlockingScript))
-            return false;
+    while (hasParserBlockingScript() && isPendingScriptReady(m_parserBlockingScript))
         executeParsingBlockingScript();
-    }
-    return true;
 }
 
-bool HTMLScriptRunner::executeScriptsWaitingForLoad(CachedResource* cachedScript)
+void HTMLScriptRunner::executeScriptsWaitingForLoad(CachedResource* cachedScript)
 {
     ASSERT(!m_scriptNestingLevel);
-    ASSERT(haveParsingBlockingScript());
-    ASSERT_UNUSED(cachedScript, m_parsingBlockingScript.cachedScript() == cachedScript);
-    ASSERT(m_parsingBlockingScript.cachedScript()->isLoaded());
-    return executeParsingBlockingScripts();
+    ASSERT(hasParserBlockingScript());
+    ASSERT_UNUSED(cachedScript, m_parserBlockingScript.cachedScript() == cachedScript);
+    ASSERT(m_parserBlockingScript.cachedScript()->isLoaded());
+    executeParsingBlockingScripts();
 }
 
-bool HTMLScriptRunner::executeScriptsWaitingForStylesheets()
+void HTMLScriptRunner::executeScriptsWaitingForStylesheets()
 {
     ASSERT(m_document);
     // Callers should check hasScriptsWaitingForStylesheets() before calling
@@ -214,14 +207,14 @@ bool HTMLScriptRunner::executeScriptsWaitingForStylesheets()
     ASSERT(hasScriptsWaitingForStylesheets());
     ASSERT(!m_scriptNestingLevel);
     ASSERT(m_document->haveStylesheetsLoaded());
-    return executeParsingBlockingScripts();
+    executeParsingBlockingScripts();
 }
 
 bool HTMLScriptRunner::executeScriptsWaitingForParsing()
 {
     while (!m_scriptsToExecuteAfterParsing.isEmpty()) {
         ASSERT(!m_scriptNestingLevel);
-        ASSERT(!haveParsingBlockingScript());
+        ASSERT(!hasParserBlockingScript());
         ASSERT(m_scriptsToExecuteAfterParsing.first().cachedScript());
         if (!m_scriptsToExecuteAfterParsing.first().cachedScript()->isLoaded()) {
             watchForLoad(m_scriptsToExecuteAfterParsing.first());
@@ -229,6 +222,7 @@ bool HTMLScriptRunner::executeScriptsWaitingForParsing()
         }
         PendingScript first = m_scriptsToExecuteAfterParsing.takeFirst();
         executePendingScriptAndDispatchEvent(first);
+        // FIXME: What is this m_document check for?
         if (!m_document)
             return false;
     }
@@ -237,16 +231,16 @@ bool HTMLScriptRunner::executeScriptsWaitingForParsing()
 
 void HTMLScriptRunner::requestParsingBlockingScript(Element* element)
 {
-    if (!requestPendingScript(m_parsingBlockingScript, element))
+    if (!requestPendingScript(m_parserBlockingScript, element))
         return;
 
-    ASSERT(m_parsingBlockingScript.cachedScript());
+    ASSERT(m_parserBlockingScript.cachedScript());
 
     // We only care about a load callback if cachedScript is not already
-    // in the cache.  Callers will attempt to run the m_parsingBlockingScript
+    // in the cache. Callers will attempt to run the m_parserBlockingScript
     // if possible before returning control to the parser.
-    if (!m_parsingBlockingScript.cachedScript()->isLoaded())
-        watchForLoad(m_parsingBlockingScript);
+    if (!m_parserBlockingScript.cachedScript()->isLoaded())
+        watchForLoad(m_parserBlockingScript);
 }
 
 void HTMLScriptRunner::requestDeferredScript(Element* element)
@@ -278,7 +272,7 @@ bool HTMLScriptRunner::requestPendingScript(PendingScript& pendingScript, Elemen
 void HTMLScriptRunner::runScript(Element* script, const TextPosition& scriptStartPosition)
 {
     ASSERT(m_document);
-    ASSERT(!haveParsingBlockingScript());
+    ASSERT(!hasParserBlockingScript());
     {
         InsertionPointRecord insertionPointRecord(m_host->inputStream());
         NestingLevelIncrementer nestingLevelIncrementer(m_scriptNestingLevel);
@@ -302,8 +296,8 @@ void HTMLScriptRunner::runScript(Element* script, const TextPosition& scriptStar
             requestDeferredScript(script);
         else if (scriptElement->readyToBeParserExecuted()) {
             if (m_scriptNestingLevel == 1) {
-                m_parsingBlockingScript.setElement(script);
-                m_parsingBlockingScript.setStartingPosition(scriptStartPosition);
+                m_parserBlockingScript.setElement(script);
+                m_parserBlockingScript.setStartingPosition(scriptStartPosition);
             } else {
                 ScriptSourceCode sourceCode(script->textContent(), documentURLForScriptExecution(m_document), scriptStartPosition);
                 scriptElement->executeScript(sourceCode);
diff --git a/Source/WebCore/html/parser/HTMLScriptRunner.h b/Source/WebCore/html/parser/HTMLScriptRunner.h
index 77aad8c9c..a7226dc1c 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunner.h
+++ b/Source/WebCore/html/parser/HTMLScriptRunner.h
@@ -53,13 +53,14 @@ public:
     void detach();
 
     // Processes the passed in script and any pending scripts if possible.
-    bool execute(PassRefPtr<Element> scriptToProcess, const TextPosition& scriptStartPosition);
+    void execute(PassRefPtr<Element> scriptToProcess, const TextPosition& scriptStartPosition);
 
-    bool executeScriptsWaitingForLoad(CachedResource*);
+    void executeScriptsWaitingForLoad(CachedResource*);
     bool hasScriptsWaitingForStylesheets() const { return m_hasScriptsWaitingForStylesheets; }
-    bool executeScriptsWaitingForStylesheets();
+    void executeScriptsWaitingForStylesheets();
     bool executeScriptsWaitingForParsing();
 
+    bool hasParserBlockingScript() const;
     bool isExecutingScript() const { return !!m_scriptNestingLevel; }
 
 private:
@@ -69,8 +70,7 @@ private:
 
     void executeParsingBlockingScript();
     void executePendingScriptAndDispatchEvent(PendingScript&);
-    bool haveParsingBlockingScript() const;
-    bool executeParsingBlockingScripts();
+    void executeParsingBlockingScripts();
 
     void requestParsingBlockingScript(Element*);
     void requestDeferredScript(Element*);
@@ -86,7 +86,7 @@ private:
 
     Document* m_document;
     HTMLScriptRunnerHost* m_host;
-    PendingScript m_parsingBlockingScript;
+    PendingScript m_parserBlockingScript;
     Deque<PendingScript> m_scriptsToExecuteAfterParsing; // http://www.whatwg.org/specs/web-apps/current-work/#list-of-scripts-that-will-execute-when-the-document-has-finished-parsing
     unsigned m_scriptNestingLevel;
 
diff --git a/Source/WebCore/html/parser/HTMLTokenizer.cpp b/Source/WebCore/html/parser/HTMLTokenizer.cpp
index efe0d545f..d703129e7 100644
--- a/Source/WebCore/html/parser/HTMLTokenizer.cpp
+++ b/Source/WebCore/html/parser/HTMLTokenizer.cpp
@@ -134,7 +134,6 @@ void HTMLTokenizer::reset()
 {
     m_state = HTMLTokenizerState::DataState;
     m_token = 0;
-    m_lineNumber = 0;
     m_forceNullCharacterReplacement = false;
     m_shouldAllowCDATA = false;
     m_additionalAllowedCharacter = '\0';
@@ -160,7 +159,7 @@ inline bool HTMLTokenizer::processEntity(SegmentedString& source)
 bool HTMLTokenizer::flushBufferedEndTag(SegmentedString& source)
 {
     ASSERT(m_token->type() == HTMLTokenTypes::Character || m_token->type() == HTMLTokenTypes::Uninitialized);
-    source.advance(m_lineNumber);
+    source.advanceAndUpdateLineNumber();
     if (m_token->type() == HTMLTokenTypes::Character)
         return true;
     m_token->beginEndTag(m_bufferedEndTagName);
@@ -175,7 +174,7 @@ bool HTMLTokenizer::flushBufferedEndTag(SegmentedString& source)
         if (flushBufferedEndTag(source))                                   \
             return true;                                                   \
         if (source.isEmpty()                                               \
-            || !m_inputStreamPreprocessor.peek(source, m_lineNumber))      \
+            || !m_inputStreamPreprocessor.peek(source))                    \
             return haveBufferedCharacterToken();                           \
         cc = m_inputStreamPreprocessor.nextInputCharacter();               \
         goto stateName;                                                    \
@@ -207,7 +206,7 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         }
     }
 
-    if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source, m_lineNumber))
+    if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source))
         return haveBufferedCharacterToken();
     UChar cc = m_inputStreamPreprocessor.nextInputCharacter();
 
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 56b765896..cbdc4352f 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -351,13 +351,11 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, HTMLDocument* docum
     , m_document(document)
     , m_tree(document, maximumDOMTreeDepth)
     , m_reportErrors(reportErrors)
-    , m_isPaused(false)
     , m_insertionMode(InitialMode)
     , m_originalInsertionMode(InitialMode)
     , m_shouldSkipLeadingNewline(false)
     , m_parser(parser)
     , m_scriptToProcessStartPosition(uninitializedPositionValue1())
-    , m_lastScriptElementStartPosition(TextPosition::belowRangePosition())
     , m_usePreHTML5ParserQuirks(usePreHTML5ParserQuirks)
 {
 }
@@ -370,13 +368,11 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLDocumentParser* parser, DocumentFragment* f
     , m_document(fragment->document())
     , m_tree(fragment, scriptingPermission, maximumDOMTreeDepth)
     , m_reportErrors(false) // FIXME: Why not report errors in fragments?
-    , m_isPaused(false)
     , m_insertionMode(InitialMode)
     , m_originalInsertionMode(InitialMode)
     , m_shouldSkipLeadingNewline(false)
     , m_parser(parser)
     , m_scriptToProcessStartPosition(uninitializedPositionValue1())
-    , m_lastScriptElementStartPosition(TextPosition::belowRangePosition())
     , m_usePreHTML5ParserQuirks(usePreHTML5ParserQuirks)
 {
     // FIXME: This assertion will become invalid if <http://webkit.org/b/60316> is fixed.
@@ -427,11 +423,11 @@ HTMLTreeBuilder::FragmentParsingContext::~FragmentParsingContext()
 
 PassRefPtr<Element> HTMLTreeBuilder::takeScriptToProcess(TextPosition& scriptStartPosition)
 {
+    ASSERT(m_scriptToProcess);
     // Unpause ourselves, callers may pause us again when processing the script.
     // The HTML5 spec is written as though scripts are executed inside the tree
     // builder.  We pause the parser to exit the tree builder, and then resume
     // before running scripts.
-    m_isPaused = false;
     scriptStartPosition = m_scriptToProcessStartPosition;
     m_scriptToProcessStartPosition = uninitializedPositionValue1();
     return m_scriptToProcess.release();
@@ -751,6 +747,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         return;
     }
     if (token.name() == bodyTag) {
+        parseError(token);
         if (!m_tree.openElements()->secondElementIsHTMLBodyElement() || m_tree.openElements()->hasOnlyOneElement()) {
             ASSERT(isParsingFragment());
             return;
@@ -2128,10 +2125,8 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
     case TextMode:
         if (token.name() == scriptTag) {
             // Pause ourselves so that parsing stops until the script can be processed by the caller.
-            m_isPaused = true;
             ASSERT(m_tree.currentElement()->hasTagName(scriptTag));
             m_scriptToProcess = m_tree.currentElement();
-            m_scriptToProcessStartPosition = m_lastScriptElementStartPosition;
             m_tree.openElements()->pop();
             if (isParsingFragment() && m_fragmentContext.scriptingPermission() == DisallowScriptingContent)
                 m_scriptToProcess->removeAllChildren();
@@ -2645,9 +2640,7 @@ void HTMLTreeBuilder::processScriptStartTag(AtomicHTMLToken& token)
 
     TextPosition position = m_parser->textPosition();
 
-    ASSERT(position.m_line == m_parser->tokenizer()->lineNumber());
-
-    m_lastScriptElementStartPosition = position;
+    m_scriptToProcessStartPosition = position;
 
     setInsertionMode(TextMode);
 }
@@ -2754,7 +2747,6 @@ void HTMLTreeBuilder::processTokenInForeignContent(AtomicHTMLToken& token)
             adjustSVGTagNameCase(token);
 
         if (token.name() == SVGNames::scriptTag && m_tree.currentNode()->hasTagName(SVGNames::scriptTag)) {
-            m_isPaused = true;
             m_scriptToProcess = m_tree.currentElement();
             m_tree.openElements()->pop();
             return;
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 19bbe9519..e7c689084 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -70,14 +70,12 @@ public:
 
     void detach();
 
-    void setPaused(bool paused) { m_isPaused = paused; }
-    bool isPaused() const { return m_isPaused; }
-
     // The token really should be passed as a const& since it's never modified.
     void constructTreeFromToken(HTMLToken&);
     void constructTreeFromAtomicToken(AtomicHTMLToken&);
 
-    // Must be called when parser is paused before calling the parser again.
+    bool hasParserBlockingScript() const { return !!m_scriptToProcess; }
+    // Must be called to take the parser-blocking script before calling the parser again.
     PassRefPtr<Element> takeScriptToProcess(TextPosition& scriptStartPosition);
 
     // Done, close any open tags, etc.
@@ -216,7 +214,6 @@ private:
     HTMLConstructionSite m_tree;
 
     bool m_reportErrors;
-    bool m_isPaused;
 
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#insertion-mode
     InsertionMode m_insertionMode;
@@ -236,11 +233,6 @@ private:
     RefPtr<Element> m_scriptToProcess; // <script> tag which needs processing before resuming the parser.
     TextPosition m_scriptToProcessStartPosition; // Starting line number of the script tag needing processing.
 
-    // FIXME: We probably want to remove this member.  Originally, it was
-    // created to service the legacy tree builder, but it seems to be used for
-    // some other things now.
-    TextPosition m_lastScriptElementStartPosition;
-
     bool m_usePreHTML5ParserQuirks;
 };
 
diff --git a/Source/WebCore/html/shadow/InsertionPoint.cpp b/Source/WebCore/html/shadow/InsertionPoint.cpp
index 0794c3449..c1e020023 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.cpp
+++ b/Source/WebCore/html/shadow/InsertionPoint.cpp
@@ -143,5 +143,4 @@ void InsertionPoint::removedFrom(ContainerNode* insertionPoint)
     HTMLElement::removedFrom(insertionPoint);
 }
 
-
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 502dae13f..0186fa57d 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -218,6 +218,7 @@ void SliderThumbElement::setPositionFromPoint(const LayoutPoint& point)
     if (!input->renderer() || !renderer())
         return;
 
+    input->setTextAsOfLastFormControlChangeEvent(input->value());
     LayoutPoint offset = roundedLayoutPoint(input->renderer()->absoluteToLocal(point, false, true));
     bool isVertical = hasVerticalAppearance(input);
     LayoutUnit trackSize;
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.h b/Source/WebCore/html/shadow/SliderThumbElement.h
index e2d8b66eb..36d64186f 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.h
+++ b/Source/WebCore/html/shadow/SliderThumbElement.h
@@ -57,6 +57,7 @@ public:
     virtual void detach();
     virtual const AtomicString& shadowPseudoId() const;
     HTMLInputElement* hostInput() const;
+    void setPositionFromPoint(const LayoutPoint&);
 
 private:
     SliderThumbElement(Document*);
@@ -67,7 +68,6 @@ private:
     virtual Node* focusDelegate();
     void startDragging();
     void stopDragging();
-    void setPositionFromPoint(const LayoutPoint&);
 
     bool m_inDragMode;
 };
diff --git a/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp b/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
index a67a4bafb..9423aa8d2 100644
--- a/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
+++ b/Source/WebCore/html/shadow/TextFieldDecorationElement.cpp
@@ -89,7 +89,7 @@ static inline void getDecorationRootAndDecoratedRoot(HTMLInputElement* input, Sh
     if (newRoot)
         newRoot->removeChild(newRoot->firstChild());
     else
-        newRoot = ShadowRoot::create(input, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION).get();
+        newRoot = ShadowRoot::create(input, ShadowRoot::UserAgentShadowRoot, ASSERT_NO_EXCEPTION).get();
     decorationRoot = newRoot;
     decoratedRoot = existingRoot;
 }
diff --git a/Source/WebCore/html/track/WebVTTTokenizer.cpp b/Source/WebCore/html/track/WebVTTTokenizer.cpp
index 94618ab63..e45f1ed6d 100644
--- a/Source/WebCore/html/track/WebVTTTokenizer.cpp
+++ b/Source/WebCore/html/track/WebVTTTokenizer.cpp
@@ -65,7 +65,6 @@ void WebVTTTokenizer::reset()
 {
     m_state = WebVTTTokenizerState::DataState;
     m_token = 0;
-    m_lineNumber = 0;
     m_buffer.clear();
 }
     
@@ -76,7 +75,7 @@ bool WebVTTTokenizer::nextToken(SegmentedString& source, WebVTTToken& token)
     ASSERT(!m_token || m_token == &token || token.type() == WebVTTTokenTypes::Uninitialized);
     m_token = &token;
 
-    if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source, m_lineNumber))
+    if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source))
         return haveBufferedCharacterToken();
 
     UChar cc = m_inputStreamPreprocessor.nextInputCharacter();
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.py b/Source/WebCore/inspector/CodeGeneratorInspector.py
index 367440662..05d3f80c7 100755
--- a/Source/WebCore/inspector/CodeGeneratorInspector.py
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.py
@@ -1789,8 +1789,7 @@ $methodInCode
     if (!protocolErrors->length()) {
         $agentField->$methodName(&error$agentCallParams);
 
-        if (!error.length()) {
-${responseCook}        }
+${responseCook}
     }
     sendResponse(callId, result, String::format("Some arguments of method '%s' can't be processed", "$domainName.$methodName"), protocolErrors, error);
 }
@@ -2804,6 +2803,9 @@ class Generator:
 
             response_cook_text = join(response_cook_list, "")
 
+            if len(response_cook_text) != 0:
+                response_cook_text = "        if (!error.length()) {\n" + response_cook_text + "        }"
+
         Generator.backend_method_implementation_list.append(Templates.backend_method.substitute(None,
             domainName=domain_name, methodName=json_command_name,
             agentField="m_" + agent_field_name,
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 0f6448349..83f83194e 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -364,6 +364,20 @@
                 "parameters": [
                     { "name": "value", "type": "boolean", "description": "Whether script execution should be disabled in the page." }
                 ]
+            },
+            {
+                "name": "setGeolocationData",
+                "description": "overrides the GeolocationPosition or GeolocationError in the GeolocationController.",
+                "parameters": [
+                    { "name": "longitude", "type": "number", "optional": true, "description": "Mock longitude"},
+                    { "name": "latitude", "type": "number", "optional": true, "description": "Mock latitude"},
+                    { "name": "accuracy", "type": "number", "optional": true, "description": "Mock accuracy"},
+                    { "name": "errorType", "type": "string", "optional": true, "enum": ["PermissionDenied", "PositionUnavailable"], "description": "Error type"}
+                ]
+            },
+            {
+                "name": "clearGeolocationData",
+                "description": "clears the overriden GeolocationPosition and GeolocationError."
             }
         ],
         "events": [
@@ -471,7 +485,7 @@
                     { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." },
                     { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Determines whether Command Line API should be available during the evaluation.", "hidden": true },
                     { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether evaluation should stop on exceptions and mute console. Overrides setPauseOnException state.", "hidden": true },
-                    { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform evaluation. Each content script lives in an isolated context and this parameter may be used to specify on of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page.", "hidden": true },
+                    { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform evaluation. Each content script lives in an isolated context and this parameter may be used to specify one of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page.", "hidden": true },
                     { "name": "returnByValue", "type": "boolean", "optional": true, "description": "Whether the result is expected to be a JSON object that should be sent by value." }
                 ],
                 "returns": [
@@ -1097,6 +1111,7 @@
                 "properties": [
                     { "name": "name", "type": "string", "description": "Object store name." },
                     { "name": "keyPath", "$ref": "KeyPath", "description": "Object store key path." },
+                    { "name": "autoIncrement", "type": "boolean", "description": "If true, object store has auto increment flag set." },
                     { "name": "indexes", "type": "array", "items": { "$ref": "ObjectStoreIndex" }, "description": "Indexes in this object store." }
                 ]
             },
@@ -1417,7 +1432,8 @@
                     { "name": "name", "type": "string", "description": "The name of the file or directory." },
                     { "name": "isDirectory", "type": "boolean", "description": "True if the entry is a directory." },
                     { "name": "mimeType", "type": "string", "optional": true, "description": "MIME type of the entry, available for a file only." },
-                    { "name": "resourceType", "$ref": "Page.ResourceType", "optional": true, "description": "ResourceType of the entry, available for a file only." }
+                    { "name": "resourceType", "$ref": "Page.ResourceType", "optional": true, "description": "ResourceType of the entry, available for a file only." },
+                    { "name": "isTextFile", "type": "boolean", "optional": true, "description": "True if the entry is a text file." }
                 ],
                 "description": "Represents a browser side file or directory."
             },
@@ -1426,7 +1442,7 @@
                 "type": "object",
                 "properties": [
                     { "name": "modificationTime", "type": "number", "description": "Modification time." },
-                    { "name": "size", "type": "number", "optional": true, "description": "File size. This field is available only for a file." }
+                    { "name": "size", "type": "number", "description": "File size. This field is always zero for directories." }
                 ],
                 "description": "Represents metadata of a file or entry."
             }
@@ -1470,6 +1486,20 @@
                     { "name": "requestId", "$ref": "RequestId", "description": "Request identifier. Corresponding metadataReceived event should have same requestId with this." }
                 ],
                 "description": "Returns metadata of the entry as metadataReceived event."
+            },
+            {
+                "name": "requestFileContent",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "URL of the file that the frontend is requesting to read from." },
+                    { "name": "readAsText", "type": "boolean", "description": "True if the content should be read as text, otherwise the result will be returned as base64 encoded text." },
+                    { "name": "start", "type": "integer", "optional": true, "description": "Specifies the start of range to read." },
+                    { "name": "end", "type": "integer", "optional": true, "description": "Specifies the end of range to read exclusively." },
+                    { "name": "charset", "type": "string", "optional": true, "description": "Overrides charset of the content when content is served as text." }
+                ],
+                "returns": [
+                    { "name": "requestId", "$ref": "RequestId", "description": "Request identifier. Corresponding fileContentReceived event should have same requestId with this." }
+                ],
+                "description": "Returns content of the file as fileContentReceived event. Result should be sliced into [start, end)."
             }
         ],
         "events": [
@@ -1494,11 +1524,21 @@
             {
                 "name": "metadataReceived",
                 "parameters": [
-                    { "name": "requestId", "type": "integer", "description": "Request Identifier that was returned in response to the corresponding getMetadata request." },
+                    { "name": "requestId", "type": "integer", "description": "Request Identifier that was returned in response to the corresponding requestMetadata command." },
                     { "name": "errorCode", "type": "integer", "description": "0, if no error. Otherwise, errorCode is set to FileError::ErrorCode value." },
                     { "name": "metadata", "$ref": "FileSystem.Metadata", "optional": true, "description": "Contains metadata of the entry if the command completed successfully." }
                 ],
-                "description": "Completion event of getMetadata command."
+                "description": "Completion event of requestMetadata command."
+            },
+            {
+                "name": "fileContentReceived",
+                "parameters": [
+                    { "name": "requestId", "type": "integer", "description": "Request Identifier that was returned in response to the corresponding requestFileContent command." },
+                    { "name": "errorCode", "type": "integer", "description": "0, if no error. Otherwise, errorCode is set to FileError::ErrorCode value." },
+                    { "name": "content", "type": "string", "optional": true, "description": "Content of the file." },
+                    { "name": "charset", "type": "string", "optional": true, "description": "Charset of the content if it is served as text." }
+                ],
+                "description": "Completion event of requestFileContent command."
             }
         ]
     },
@@ -2594,8 +2634,8 @@
                 "name": "runScript",
                 "hidden": true,
                 "parameters": [
-                    { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform script run. Each content script lives in an isolated context and this parameter may be used to specify on of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page." },
                     { "name": "scriptId", "$ref": "ScriptId", "description": "Id of the script to run." },
+                    { "name": "contextId", "$ref": "Runtime.ExecutionContextId", "optional": true, "description": "Specifies in which isolated context to perform script run. Each content script lives in an isolated context and this parameter may be used to specify one of those contexts. If the parameter is omitted or 0 the evaluation will be performed in the context of the inspected page." },
                     { "name": "objectGroup", "type": "string", "optional": true, "description": "Symbolic group name that can be used to release multiple objects." },
                     { "name": "doNotPauseOnExceptionsAndMuteConsole", "type": "boolean", "optional": true, "description": "Specifies whether script run should stop on exceptions and mute console. Overrides setPauseOnException state." }
                 ],
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index 917027fb2..a54d8c9c7 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -461,7 +461,6 @@ InspectorCSSAgent::InspectorCSSAgent(InstrumentingAgents* instrumentingAgents, I
     : InspectorBaseAgent<InspectorCSSAgent>("CSS", instrumentingAgents, state)
     , m_frontend(0)
     , m_domAgent(domAgent)
-    , m_lastPseudoState(0)
     , m_lastStyleSheetId(1)
 {
     m_domAgent->setDOMListener(this);
@@ -485,7 +484,7 @@ void InspectorCSSAgent::clearFrontend()
 {
     ASSERT(m_frontend);
     m_frontend = 0;
-    clearPseudoState(true);
+    resetPseudoStates();
     String errorString;
     stopSelectorProfilerImpl(&errorString, false);
 }
@@ -514,6 +513,7 @@ void InspectorCSSAgent::reset()
     m_cssStyleSheetToInspectorStyleSheet.clear();
     m_nodeToInspectorStyleSheet.clear();
     m_documentToInspectorStyleSheet.clear();
+    resetPseudoStates();
 }
 
 void InspectorCSSAgent::enable(ErrorString*)
@@ -534,18 +534,27 @@ void InspectorCSSAgent::mediaQueryResultChanged()
 
 bool InspectorCSSAgent::forcePseudoState(Element* element, CSSSelector::PseudoType pseudoType)
 {
-    if (m_lastElementWithPseudoState != element)
+    if (m_nodeIdToForcedPseudoState.isEmpty())
         return false;
 
+    int nodeId = m_domAgent->boundNodeId(element);
+    if (!nodeId)
+        return false;
+
+    NodeIdToForcedPseudoState::iterator it = m_nodeIdToForcedPseudoState.find(nodeId);
+    if (it == m_nodeIdToForcedPseudoState.end())
+        return false;
+
+    unsigned forcedPseudoState = it->second;
     switch (pseudoType) {
     case CSSSelector::PseudoActive:
-        return m_lastPseudoState & PseudoActive;
+        return forcedPseudoState & PseudoActive;
     case CSSSelector::PseudoFocus:
-        return m_lastPseudoState & PseudoFocus;
+        return forcedPseudoState & PseudoFocus;
     case CSSSelector::PseudoHover:
-        return m_lastPseudoState & PseudoHover;
+        return forcedPseudoState & PseudoHover;
     case CSSSelector::PseudoVisited:
-        return m_lastPseudoState & PseudoVisited;
+        return forcedPseudoState & PseudoVisited;
     default:
         return false;
     }
@@ -553,12 +562,22 @@ bool InspectorCSSAgent::forcePseudoState(Element* element, CSSSelector::PseudoTy
 
 void InspectorCSSAgent::recalcStyleForPseudoStateIfNeeded(Element* element, InspectorArray* forcedPseudoClasses)
 {
-    unsigned forcePseudoState = computePseudoClassMask(forcedPseudoClasses);
-    bool needStyleRecalc = element != m_lastElementWithPseudoState || forcePseudoState != m_lastPseudoState;
-    m_lastPseudoState = forcePseudoState;
-    m_lastElementWithPseudoState = element;
-    if (needStyleRecalc)
-        element->ownerDocument()->styleResolverChanged(RecalcStyleImmediately);
+    int nodeId = m_domAgent->boundNodeId(element);
+    if (!nodeId)
+        return;
+
+    unsigned forcedPseudoState = computePseudoClassMask(forcedPseudoClasses);
+    NodeIdToForcedPseudoState::iterator it = m_nodeIdToForcedPseudoState.find(nodeId);
+    unsigned currentForcedPseudoState = it == m_nodeIdToForcedPseudoState.end() ? 0 : it->second;
+    bool needStyleRecalc = forcedPseudoState != currentForcedPseudoState;
+    if (!needStyleRecalc)
+        return;
+
+    if (forcedPseudoState)
+        m_nodeIdToForcedPseudoState.set(nodeId, forcedPseudoState);
+    else
+        m_nodeIdToForcedPseudoState.remove(nodeId);
+    element->ownerDocument()->styleResolverChanged(RecalcStyleImmediately);
 }
 
 void InspectorCSSAgent::getMatchedStylesForNode(ErrorString* errorString, int nodeId, const RefPtr<InspectorArray>* forcedPseudoClasses, const bool* includePseudo, const bool* includeInherited, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::CSSRule> >& matchedCSSRules, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::PseudoIdRules> >& pseudoIdRules, RefPtr<TypeBuilder::Array<TypeBuilder::CSS::InheritedStyleEntry> >& inheritedEntries)
@@ -844,7 +863,7 @@ Element* InspectorCSSAgent::elementForId(ErrorString* errorString, int nodeId)
         *errorString = "Not an element node";
         return 0;
     }
-    return static_cast<Element*>(node);
+    return toElement(node);
 }
 
 void InspectorCSSAgent::collectStyleSheets(CSSStyleSheet* styleSheet, TypeBuilder::Array<TypeBuilder::CSS::CSSStyleSheetHeader>* result)
@@ -985,7 +1004,6 @@ void InspectorCSSAgent::didRemoveDocument(Document* document)
 {
     if (document)
         m_documentToInspectorStyleSheet.remove(document);
-    clearPseudoState(false);
 }
 
 void InspectorCSSAgent::didRemoveDOMNode(Node* node)
@@ -993,8 +1011,9 @@ void InspectorCSSAgent::didRemoveDOMNode(Node* node)
     if (!node)
         return;
 
-    if (m_lastElementWithPseudoState.get() == node)
-        clearPseudoState(false);
+    int nodeId = m_domAgent->boundNodeId(node);
+    if (nodeId)
+        m_nodeIdToForcedPseudoState.remove(nodeId);
 
     NodeToInspectorStyleSheet::iterator it = m_nodeToInspectorStyleSheet.find(node);
     if (it == m_nodeToInspectorStyleSheet.end())
@@ -1022,16 +1041,18 @@ void InspectorCSSAgent::styleSheetChanged(InspectorStyleSheet* styleSheet)
         m_frontend->styleSheetChanged(styleSheet->id());
 }
 
-void InspectorCSSAgent::clearPseudoState(bool recalcStyles)
+void InspectorCSSAgent::resetPseudoStates()
 {
-    RefPtr<Element> element = m_lastElementWithPseudoState;
-    m_lastElementWithPseudoState = 0;
-    m_lastPseudoState = 0;
-    if (recalcStyles && element) {
-        Document* document = element->ownerDocument();
-        if (document)
-            document->styleResolverChanged(RecalcStyleImmediately);
+    HashSet<Document*> documentsToChange;
+    for (NodeIdToForcedPseudoState::iterator it = m_nodeIdToForcedPseudoState.begin(), end = m_nodeIdToForcedPseudoState.end(); it != end; ++it) {
+        Element* element = toElement(m_domAgent->nodeForId(it->first));
+        if (element && element->ownerDocument())
+            documentsToChange.add(element->ownerDocument());
     }
+
+    m_nodeIdToForcedPseudoState.clear();
+    for (HashSet<Document*>::iterator it = documentsToChange.begin(), end = documentsToChange.end(); it != end; ++it)
+        (*it)->styleResolverChanged(RecalcStyleImmediately);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index d6390f7bd..791a7bf18 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -134,6 +134,7 @@ private:
     typedef HashMap<CSSStyleSheet*, RefPtr<InspectorStyleSheet> > CSSStyleSheetToInspectorStyleSheet;
     typedef HashMap<Node*, RefPtr<InspectorStyleSheetForInlineStyle> > NodeToInspectorStyleSheet; // bogus "stylesheets" with elements' inline styles
     typedef HashMap<RefPtr<Document>, RefPtr<InspectorStyleSheet> > DocumentToViaInspectorStyleSheet; // "via inspector" stylesheets
+    typedef HashMap<int, unsigned> NodeIdToForcedPseudoState;
 
     void recalcStyleForPseudoStateIfNeeded(Element*, InspectorArray* forcedPseudoClasses);
     InspectorStyleSheetForInlineStyle* asInspectorStyleSheet(Element* element);
@@ -156,7 +157,7 @@ private:
     // InspectorCSSAgent::Listener implementation
     virtual void styleSheetChanged(InspectorStyleSheet*);
 
-    void clearPseudoState(bool recalcStyles);
+    void resetPseudoStates();
 
     InspectorFrontend::CSS* m_frontend;
     InspectorDOMAgent* m_domAgent;
@@ -165,9 +166,7 @@ private:
     CSSStyleSheetToInspectorStyleSheet m_cssStyleSheetToInspectorStyleSheet;
     NodeToInspectorStyleSheet m_nodeToInspectorStyleSheet;
     DocumentToViaInspectorStyleSheet m_documentToInspectorStyleSheet;
-
-    RefPtr<Element> m_lastElementWithPseudoState;
-    unsigned m_lastPseudoState;
+    NodeIdToForcedPseudoState m_nodeIdToForcedPseudoState;
 
     int m_lastStyleSheetId;
 
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 71db17aa4..9079589e5 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -350,6 +350,9 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
     }
 
     nodesMap->remove(node);
+    if (m_domListener)
+        m_domListener->didRemoveDOMNode(node);
+
     bool childrenRequested = m_childrenRequested.contains(id);
     if (childrenRequested) {
         // Unbind subtree known to client recursively.
@@ -1443,9 +1446,6 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
 
     int parentId = m_documentNodeToIdMap.get(parent);
 
-    if (m_domListener)
-        m_domListener->didRemoveDOMNode(node);
-
     if (!m_childrenRequested.contains(parentId)) {
         // No children are mapped yet -> only notify on changes of hasChildren.
         if (innerChildNodeCount(parent) == 1)
@@ -1511,8 +1511,11 @@ void InspectorDOMAgent::styleAttributeInvalidated(const Vector<Element*>& elemen
 void InspectorDOMAgent::characterDataModified(CharacterData* characterData)
 {
     int id = m_documentNodeToIdMap.get(characterData);
-    if (!id)
+    if (!id) {
+        // Push text node if it is being created.
+        didInsertDOMNode(characterData);
         return;
+    }
     m_frontend->characterDataModified(id, characterData->data());
 }
 
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index a1ff91c6d..11807a3f9 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -535,7 +535,7 @@ void InspectorDebuggerAgent::compileScript(ErrorString* errorString, const Strin
     *scriptId = scriptIdValue;
 }
 
-void InspectorDebuggerAgent::runScript(ErrorString* errorString, const int* executionContextId, const ScriptId& scriptId, const String* const objectGroup, const bool* const doNotPauseOnExceptionsAndMuteConsole, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
+void InspectorDebuggerAgent::runScript(ErrorString* errorString, const ScriptId& scriptId, const int* executionContextId, const String* const objectGroup, const bool* const doNotPauseOnExceptionsAndMuteConsole, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown)
 {
     InjectedScript injectedScript = injectedScriptForEval(errorString, executionContextId);
     if (injectedScript.hasNoValue()) {
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index a97d04a13..09c97d195 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -111,7 +111,7 @@ public:
                              RefPtr<TypeBuilder::Runtime::RemoteObject>& result,
                              TypeBuilder::OptOutput<bool>* wasThrown);
     void compileScript(ErrorString*, const String& expression, const String& sourceURL, TypeBuilder::OptOutput<TypeBuilder::Debugger::ScriptId>*, TypeBuilder::OptOutput<String>* syntaxErrorMessage);
-    void runScript(ErrorString*, const int* executionContextId, const TypeBuilder::Debugger::ScriptId&, const String* objectGroup, const bool* doNotPauseOnExceptionsAndMuteConsole, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown);
+    void runScript(ErrorString*, const TypeBuilder::Debugger::ScriptId&, const int* executionContextId, const String* objectGroup, const bool* doNotPauseOnExceptionsAndMuteConsole, RefPtr<TypeBuilder::Runtime::RemoteObject>& result, TypeBuilder::OptOutput<bool>* wasThrown);
 
     class Listener {
     public:
diff --git a/Source/WebCore/inspector/InspectorFileSystemAgent.cpp b/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
index 06206de26..f97abbf96 100644
--- a/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
+++ b/Source/WebCore/inspector/InspectorFileSystemAgent.cpp
@@ -34,7 +34,9 @@
 
 #include "InspectorFileSystemAgent.h"
 
+#include "Base64.h"
 #include "DOMFileSystem.h"
+#include "DOMImplementation.h"
 #include "DirectoryEntry.h"
 #include "DirectoryReader.h"
 #include "Document.h"
@@ -42,7 +44,10 @@
 #include "EntryArray.h"
 #include "EntryCallback.h"
 #include "ErrorCallback.h"
+#include "FileCallback.h"
+#include "FileEntry.h"
 #include "FileError.h"
+#include "FileReader.h"
 #include "FileSystemCallback.h"
 #include "FileSystemCallbacks.h"
 #include "Frame.h"
@@ -54,7 +59,10 @@
 #include "MIMETypeRegistry.h"
 #include "Metadata.h"
 #include "MetadataCallback.h"
+#include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
+#include "TextEncoding.h"
+#include "TextResourceDecoder.h"
 
 using WebCore::TypeBuilder::Array;
 
@@ -132,12 +140,12 @@ public:
     }
 };
 
-class GetFileSystemRootTask : public RefCounted<GetFileSystemRootTask> {
-    WTF_MAKE_NONCOPYABLE(GetFileSystemRootTask);
+class FileSystemRootRequest : public RefCounted<FileSystemRootRequest> {
+    WTF_MAKE_NONCOPYABLE(FileSystemRootRequest);
 public:
-    static PassRefPtr<GetFileSystemRootTask> create(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& type)
+    static PassRefPtr<FileSystemRootRequest> create(PassRefPtr<FrontendProvider> frontendProvider, int requestId, FileSystemType type)
     {
-        return adoptRef(new GetFileSystemRootTask(frontendProvider, requestId, type));
+        return adoptRef(new FileSystemRootRequest(frontendProvider, requestId, type));
     }
 
     void start(ScriptExecutionContext*);
@@ -154,57 +162,50 @@ private:
         m_frontendProvider = 0;
     }
 
-    GetFileSystemRootTask(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& type)
+    FileSystemRootRequest(PassRefPtr<FrontendProvider> frontendProvider, int requestId, FileSystemType type)
         : m_frontendProvider(frontendProvider)
         , m_requestId(requestId)
         , m_type(type) { }
 
     RefPtr<FrontendProvider> m_frontendProvider;
     int m_requestId;
-    String m_type;
+    FileSystemType m_type;
 };
 
-bool GetFileSystemRootTask::didHitError(FileError* error)
+bool FileSystemRootRequest::didHitError(FileError* error)
 {
     reportResult(error->code(), 0);
     return true;
 }
 
-void GetFileSystemRootTask::start(ScriptExecutionContext* scriptExecutionContext)
+void FileSystemRootRequest::start(ScriptExecutionContext* scriptExecutionContext)
 {
-    FileSystemType type;
-    if (m_type == DOMFileSystemBase::persistentPathPrefix)
-        type = FileSystemTypePersistent;
-    else if (m_type == DOMFileSystemBase::temporaryPathPrefix)
-        type = FileSystemTypeTemporary;
-    else {
-        reportResult(FileError::SYNTAX_ERR, 0);
-        return;
-    }
-
-    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &GetFileSystemRootTask::didGetEntry);
-    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &GetFileSystemRootTask::didHitError);
-    OwnPtr<ResolveURICallbacks> fileSystemCallbacks = ResolveURICallbacks::create(successCallback, errorCallback, scriptExecutionContext, type, "/");
+    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &FileSystemRootRequest::didGetEntry);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &FileSystemRootRequest::didHitError);
+    OwnPtr<ResolveURICallbacks> fileSystemCallbacks = ResolveURICallbacks::create(successCallback, errorCallback, scriptExecutionContext, m_type, "/");
 
-    LocalFileSystem::localFileSystem().readFileSystem(scriptExecutionContext, type, fileSystemCallbacks.release());
+    LocalFileSystem::localFileSystem().readFileSystem(scriptExecutionContext, m_type, fileSystemCallbacks.release());
 }
 
-bool GetFileSystemRootTask::didGetEntry(Entry* entry)
+bool FileSystemRootRequest::didGetEntry(Entry* entry)
 {
-    RefPtr<TypeBuilder::FileSystem::Entry> result(TypeBuilder::FileSystem::Entry::create().setUrl(entry->toURL()).setName("/").setIsDirectory(true));
+    RefPtr<TypeBuilder::FileSystem::Entry> result = TypeBuilder::FileSystem::Entry::create()
+        .setUrl(entry->toURL())
+        .setName("/")
+        .setIsDirectory(true);
     reportResult(static_cast<FileError::ErrorCode>(0), result);
     return true;
 }
 
-class ReadDirectoryTask : public RefCounted<ReadDirectoryTask> {
-    WTF_MAKE_NONCOPYABLE(ReadDirectoryTask);
+class DirectoryContentRequest : public RefCounted<DirectoryContentRequest> {
+    WTF_MAKE_NONCOPYABLE(DirectoryContentRequest);
 public:
-    static PassRefPtr<ReadDirectoryTask> create(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
+    static PassRefPtr<DirectoryContentRequest> create(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
     {
-        return adoptRef(new ReadDirectoryTask(frontendProvider, requestId, url));
+        return adoptRef(new DirectoryContentRequest(frontendProvider, requestId, url));
     }
 
-    virtual ~ReadDirectoryTask()
+    virtual ~DirectoryContentRequest()
     {
         reportResult(FileError::ABORT_ERR, 0);
     }
@@ -229,7 +230,7 @@ private:
         m_frontendProvider = 0;
     }
 
-    ReadDirectoryTask(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
+    DirectoryContentRequest(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
         : m_frontendProvider(frontendProvider)
         , m_requestId(requestId)
         , m_url(ParsedURLString, url) { }
@@ -243,7 +244,7 @@ private:
     RefPtr<DirectoryReader> m_directoryReader;
 };
 
-void ReadDirectoryTask::start(ScriptExecutionContext* scriptExecutionContext)
+void DirectoryContentRequest::start(ScriptExecutionContext* scriptExecutionContext)
 {
     ASSERT(scriptExecutionContext);
 
@@ -254,14 +255,14 @@ void ReadDirectoryTask::start(ScriptExecutionContext* scriptExecutionContext)
         return;
     }
 
-    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &ReadDirectoryTask::didGetEntry);
-    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &ReadDirectoryTask::didHitError);
+    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &DirectoryContentRequest::didGetEntry);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &DirectoryContentRequest::didHitError);
     OwnPtr<ResolveURICallbacks> fileSystemCallbacks = ResolveURICallbacks::create(successCallback, errorCallback, scriptExecutionContext, type, path);
 
     LocalFileSystem::localFileSystem().readFileSystem(scriptExecutionContext, type, fileSystemCallbacks.release());
 }
 
-bool ReadDirectoryTask::didGetEntry(Entry* entry)
+bool DirectoryContentRequest::didGetEntry(Entry* entry)
 {
     if (!entry->isDirectory()) {
         reportResult(FileError::TYPE_MISMATCH_ERR, 0);
@@ -274,19 +275,19 @@ bool ReadDirectoryTask::didGetEntry(Entry* entry)
     return true;
 }
 
-void ReadDirectoryTask::readDirectoryEntries()
+void DirectoryContentRequest::readDirectoryEntries()
 {
     if (!m_directoryReader->filesystem()->scriptExecutionContext()) {
         reportResult(FileError::ABORT_ERR, 0);
         return;
     }
 
-    RefPtr<EntriesCallback> successCallback = CallbackDispatcherFactory<EntriesCallback>::create(this, &ReadDirectoryTask::didReadDirectoryEntries);
-    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &ReadDirectoryTask::didHitError);
+    RefPtr<EntriesCallback> successCallback = CallbackDispatcherFactory<EntriesCallback>::create(this, &DirectoryContentRequest::didReadDirectoryEntries);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &DirectoryContentRequest::didHitError);
     m_directoryReader->readEntries(successCallback, errorCallback);
 }
 
-bool ReadDirectoryTask::didReadDirectoryEntries(EntryArray* entries)
+bool DirectoryContentRequest::didReadDirectoryEntries(EntryArray* entries)
 {
     if (!entries->length()) {
         reportResult(static_cast<FileError::ErrorCode>(0), m_entries);
@@ -295,20 +296,28 @@ bool ReadDirectoryTask::didReadDirectoryEntries(EntryArray* entries)
 
     for (unsigned i = 0; i < entries->length(); ++i) {
         Entry* entry = entries->item(i);
-        RefPtr<TypeBuilder::FileSystem::Entry> entryForFrontend = TypeBuilder::FileSystem::Entry::create().setUrl(entry->toURL()).setName(entry->name()).setIsDirectory(entry->isDirectory());
+        RefPtr<TypeBuilder::FileSystem::Entry> entryForFrontend = TypeBuilder::FileSystem::Entry::create()
+            .setUrl(entry->toURL())
+            .setName(entry->name())
+            .setIsDirectory(entry->isDirectory());
 
         using TypeBuilder::Page::ResourceType;
         if (!entry->isDirectory()) {
             String mimeType = MIMETypeRegistry::getMIMETypeForPath(entry->name());
             ResourceType::Enum resourceType;
-            if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
+            if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType)) {
                 resourceType = ResourceType::Image;
-            else if (MIMETypeRegistry::isSupportedJavaScriptMIMEType(mimeType))
+                entryForFrontend->setIsTextFile(false);
+            } else if (MIMETypeRegistry::isSupportedJavaScriptMIMEType(mimeType)) {
                 resourceType = ResourceType::Script;
-            else if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
+                entryForFrontend->setIsTextFile(true);
+            } else if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType)) {
                 resourceType = ResourceType::Document;
-            else
+                entryForFrontend->setIsTextFile(true);
+            } else {
                 resourceType = ResourceType::Other;
+                entryForFrontend->setIsTextFile(DOMImplementation::isXMLMIMEType(mimeType) || DOMImplementation::isTextMIMEType(mimeType));
+            }
 
             entryForFrontend->setMimeType(mimeType);
             entryForFrontend->setResourceType(resourceType);
@@ -320,15 +329,15 @@ bool ReadDirectoryTask::didReadDirectoryEntries(EntryArray* entries)
     return true;
 }
 
-class GetMetadataTask : public RefCounted<GetMetadataTask> {
-    WTF_MAKE_NONCOPYABLE(GetMetadataTask);
+class MetadataRequest : public RefCounted<MetadataRequest> {
+    WTF_MAKE_NONCOPYABLE(MetadataRequest);
 public:
-    static PassRefPtr<GetMetadataTask> create(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
+    static PassRefPtr<MetadataRequest> create(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
     {
-        return adoptRef(new GetMetadataTask(frontendProvider, requestId, url));
+        return adoptRef(new MetadataRequest(frontendProvider, requestId, url));
     }
 
-    virtual ~GetMetadataTask()
+    virtual ~MetadataRequest()
     {
         reportResult(FileError::ABORT_ERR, 0);
     }
@@ -352,7 +361,7 @@ public:
     }
 
 private:
-    GetMetadataTask(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
+    MetadataRequest(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url)
         : m_frontendProvider(frontendProvider)
         , m_requestId(requestId)
         , m_url(ParsedURLString, url) { }
@@ -364,42 +373,180 @@ private:
     bool m_isDirectory;
 };
 
-void GetMetadataTask::start(ScriptExecutionContext* scriptExecutionContext)
+void MetadataRequest::start(ScriptExecutionContext* scriptExecutionContext)
 {
     FileSystemType type;
     DOMFileSystemBase::crackFileSystemURL(m_url, type, m_path);
 
-    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &GetMetadataTask::didGetEntry);
-    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &GetMetadataTask::didHitError);
+    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &MetadataRequest::didGetEntry);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &MetadataRequest::didHitError);
 
     OwnPtr<ResolveURICallbacks> fileSystemCallbacks = ResolveURICallbacks::create(successCallback, errorCallback, scriptExecutionContext, type, m_path);
     LocalFileSystem::localFileSystem().readFileSystem(scriptExecutionContext, type, fileSystemCallbacks.release());
 }
 
-bool GetMetadataTask::didGetEntry(Entry* entry)
+bool MetadataRequest::didGetEntry(Entry* entry)
 {
     if (!entry->filesystem()->scriptExecutionContext()) {
         reportResult(FileError::ABORT_ERR, 0);
         return true;
     }
 
-    RefPtr<MetadataCallback> successCallback = CallbackDispatcherFactory<MetadataCallback>::create(this, &GetMetadataTask::didGetMetadata);
-    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &GetMetadataTask::didHitError);
+    RefPtr<MetadataCallback> successCallback = CallbackDispatcherFactory<MetadataCallback>::create(this, &MetadataRequest::didGetMetadata);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &MetadataRequest::didHitError);
     entry->getMetadata(successCallback, errorCallback);
     m_isDirectory = entry->isDirectory();
     return true;
 }
 
-bool GetMetadataTask::didGetMetadata(Metadata* metadata)
+bool MetadataRequest::didGetMetadata(Metadata* metadata)
 {
     using TypeBuilder::FileSystem::Metadata;
-    RefPtr<Metadata> result = Metadata::create().setModificationTime(metadata->modificationTime());
-    if (!m_isDirectory)
-        result->setSize(metadata->size());
+    RefPtr<Metadata> result = Metadata::create()
+        .setModificationTime(metadata->modificationTime())
+        .setSize(metadata->size());
     reportResult(static_cast<FileError::ErrorCode>(0), result);
     return true;
 }
 
+class FileContentRequest : public EventListener {
+    WTF_MAKE_NONCOPYABLE(FileContentRequest);
+public:
+    static PassRefPtr<FileContentRequest> create(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url, bool readAsText, long long start, long long end, const String& charset)
+    {
+        return adoptRef(new FileContentRequest(frontendProvider, requestId, url, readAsText, start, end, charset));
+    }
+
+    virtual ~FileContentRequest()
+    {
+        reportResult(FileError::ABORT_ERR, 0, 0);
+    }
+
+    void start(ScriptExecutionContext*);
+
+
+    virtual bool operator==(const EventListener& other) OVERRIDE
+    {
+        return this == &other;
+    }
+
+    virtual void handleEvent(ScriptExecutionContext*, Event* event) OVERRIDE
+    {
+        if (event->type() == eventNames().loadEvent)
+            didRead();
+        else if (event->type() == eventNames().errorEvent)
+            didHitError(m_reader->error().get());
+    }
+
+private:
+    bool didHitError(FileError* error)
+    {
+        reportResult(error->code(), 0, 0);
+        return true;
+    }
+
+    bool didGetEntry(Entry*);
+    bool didGetFile(File*);
+    void didRead();
+
+    void reportResult(FileError::ErrorCode errorCode, const String* result, const String* charset)
+    {
+        if (!m_frontendProvider || !m_frontendProvider->frontend())
+            return;
+        m_frontendProvider->frontend()->fileContentReceived(m_requestId, static_cast<int>(errorCode), result, charset);
+        m_frontendProvider = 0;
+    }
+
+    FileContentRequest(PassRefPtr<FrontendProvider> frontendProvider, int requestId, const String& url, bool readAsText, long long start, long long end, const String& charset)
+        : EventListener(EventListener::CPPEventListenerType)
+        , m_frontendProvider(frontendProvider)
+        , m_requestId(requestId)
+        , m_url(ParsedURLString, url)
+        , m_readAsText(readAsText)
+        , m_start(start)
+        , m_end(end)
+        , m_charset(charset) { }
+
+    RefPtr<FrontendProvider> m_frontendProvider;
+    int m_requestId;
+    KURL m_url;
+    bool m_readAsText;
+    int m_start;
+    long long m_end;
+    String m_mimeType;
+    String m_charset;
+
+    RefPtr<FileReader> m_reader;
+};
+
+void FileContentRequest::start(ScriptExecutionContext* scriptExecutionContext)
+{
+    ASSERT(scriptExecutionContext);
+
+    FileSystemType type;
+    String path;
+    if (!DOMFileSystemBase::crackFileSystemURL(m_url, type, path)) {
+        reportResult(FileError::SYNTAX_ERR, 0, 0);
+        return;
+    }
+
+    RefPtr<EntryCallback> successCallback = CallbackDispatcherFactory<EntryCallback>::create(this, &FileContentRequest::didGetEntry);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &FileContentRequest::didHitError);
+    OwnPtr<ResolveURICallbacks> fileSystemCallbacks = ResolveURICallbacks::create(successCallback, errorCallback, scriptExecutionContext, type, path);
+
+    LocalFileSystem::localFileSystem().readFileSystem(scriptExecutionContext, type, fileSystemCallbacks.release());
+}
+
+bool FileContentRequest::didGetEntry(Entry* entry)
+{
+    if (entry->isDirectory()) {
+        reportResult(FileError::TYPE_MISMATCH_ERR, 0, 0);
+        return true;
+    }
+
+    if (!entry->filesystem()->scriptExecutionContext()) {
+        reportResult(FileError::ABORT_ERR, 0, 0);
+        return true;
+    }
+
+    RefPtr<FileCallback> successCallback = CallbackDispatcherFactory<FileCallback>::create(this, &FileContentRequest::didGetFile);
+    RefPtr<ErrorCallback> errorCallback = CallbackDispatcherFactory<ErrorCallback>::create(this, &FileContentRequest::didHitError);
+    static_cast<FileEntry*>(entry)->file(successCallback, errorCallback);
+
+    m_reader = FileReader::create(entry->filesystem()->scriptExecutionContext());
+    m_mimeType = MIMETypeRegistry::getMIMETypeForPath(entry->name());
+
+    return true;
+}
+
+bool FileContentRequest::didGetFile(File* file)
+{
+    RefPtr<Blob> blob = file->slice(m_start, m_end);
+    m_reader->setOnload(this);
+    m_reader->setOnerror(this);
+
+    ExceptionCode ec = 0;
+    m_reader->readAsArrayBuffer(blob.get(), ec);
+    return true;
+}
+
+void FileContentRequest::didRead()
+{
+    RefPtr<ArrayBuffer> buffer = m_reader->arrayBufferResult();
+
+    if (!m_readAsText) {
+        String result = base64Encode(static_cast<char*>(buffer->data()), buffer->byteLength());
+        reportResult(static_cast<FileError::ErrorCode>(0), &result, 0);
+        return;
+    }
+
+    RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create(m_mimeType, m_charset, true);
+    String result = decoder->decode(static_cast<char*>(buffer->data()), buffer->byteLength());
+    result += decoder->flush();
+    m_charset = decoder->encoding().domName();
+    reportResult(static_cast<FileError::ErrorCode>(0), &result, &m_charset);
+}
+
 }
 
 // static
@@ -431,7 +578,7 @@ void InspectorFileSystemAgent::disable(ErrorString*)
     m_state->setBoolean(FileSystemAgentState::fileSystemAgentEnabled, m_enabled);
 }
 
-void InspectorFileSystemAgent::requestFileSystemRoot(ErrorString* error, const String& origin, const String& type, int* requestId)
+void InspectorFileSystemAgent::requestFileSystemRoot(ErrorString* error, const String& origin, const String& typeString, int* requestId)
 {
     if (!m_enabled || !m_frontendProvider) {
         *error = "FileSystem agent is not enabled";
@@ -439,11 +586,22 @@ void InspectorFileSystemAgent::requestFileSystemRoot(ErrorString* error, const S
     }
     ASSERT(m_frontendProvider->frontend());
 
+    ScriptExecutionContext* scriptExecutionContext = assertScriptExecutionContextForOrigin(error, SecurityOrigin::createFromString(origin).get());
+    if (!scriptExecutionContext)
+        return;
+
+    FileSystemType type;
+    if (typeString == DOMFileSystemBase::persistentPathPrefix)
+        type = FileSystemTypePersistent;
+    else if (typeString == DOMFileSystemBase::temporaryPathPrefix)
+        type = FileSystemTypeTemporary;
+    else {
+        *error = "Invalid FileSystem type";
+        return;
+    }
+
     *requestId = m_nextRequestId++;
-    if (ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextForOrigin(SecurityOrigin::createFromString(origin).get()))
-        GetFileSystemRootTask::create(m_frontendProvider, *requestId, type)->start(scriptExecutionContext);
-    else
-        m_frontendProvider->frontend()->fileSystemRootReceived(*requestId, static_cast<int>(FileError::ABORT_ERR), 0);
+    FileSystemRootRequest::create(m_frontendProvider, *requestId, type)->start(scriptExecutionContext);
 }
 
 void InspectorFileSystemAgent::requestDirectoryContent(ErrorString* error, const String& url, int* requestId)
@@ -454,12 +612,12 @@ void InspectorFileSystemAgent::requestDirectoryContent(ErrorString* error, const
     }
     ASSERT(m_frontendProvider->frontend());
 
-    *requestId = m_nextRequestId++;
+    ScriptExecutionContext* scriptExecutionContext = assertScriptExecutionContextForOrigin(error, SecurityOrigin::createFromString(url).get());
+    if (!scriptExecutionContext)
+        return;
 
-    if (ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextForOrigin(SecurityOrigin::createFromString(url).get()))
-        ReadDirectoryTask::create(m_frontendProvider, *requestId, url)->start(scriptExecutionContext);
-    else
-        m_frontendProvider->frontend()->directoryContentReceived(*requestId, static_cast<int>(FileError::ABORT_ERR), 0);
+    *requestId = m_nextRequestId++;
+    DirectoryContentRequest::create(m_frontendProvider, *requestId, url)->start(scriptExecutionContext);
 }
 
 void InspectorFileSystemAgent::requestMetadata(ErrorString* error, const String& url, int* requestId)
@@ -470,12 +628,31 @@ void InspectorFileSystemAgent::requestMetadata(ErrorString* error, const String&
     }
     ASSERT(m_frontendProvider->frontend());
 
+    ScriptExecutionContext* scriptExecutionContext = assertScriptExecutionContextForOrigin(error, SecurityOrigin::createFromString(url).get());
+    if (!scriptExecutionContext)
+        return;
+
+    *requestId = m_nextRequestId++;
+    MetadataRequest::create(m_frontendProvider, *requestId, url)->start(scriptExecutionContext);
+}
+
+void InspectorFileSystemAgent::requestFileContent(ErrorString* error, const String& url, bool readAsText, const int* start, const int* end, const String* charset, int* requestId)
+{
+    if (!m_enabled || !m_frontendProvider) {
+        *error = "FileSystem agent is not enabled";
+        return;
+    }
+    ASSERT(m_frontendProvider->frontend());
+
+    ScriptExecutionContext* scriptExecutionContext = assertScriptExecutionContextForOrigin(error, SecurityOrigin::createFromString(url).get());
+    if (!scriptExecutionContext)
+        return;
+
     *requestId = m_nextRequestId++;
 
-    if (ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextForOrigin(SecurityOrigin::createFromString(url).get()))
-        GetMetadataTask::create(m_frontendProvider, *requestId, url)->start(scriptExecutionContext);
-    else
-        m_frontendProvider->frontend()->metadataReceived(*requestId, static_cast<int>(FileError::ABORT_ERR), 0);
+    long long startPosition = start ? *start : 0;
+    long long endPosition = end ? *end : std::numeric_limits<long long>::max();
+    FileContentRequest::create(m_frontendProvider, *requestId, url, readAsText, startPosition, endPosition, charset ? *charset : "")->start(scriptExecutionContext);
 }
 
 void InspectorFileSystemAgent::setFrontend(InspectorFrontend* frontend)
@@ -511,12 +688,14 @@ InspectorFileSystemAgent::InspectorFileSystemAgent(InstrumentingAgents* instrume
     m_instrumentingAgents->setInspectorFileSystemAgent(this);
 }
 
-ScriptExecutionContext* InspectorFileSystemAgent::scriptExecutionContextForOrigin(SecurityOrigin* origin)
+ScriptExecutionContext* InspectorFileSystemAgent::assertScriptExecutionContextForOrigin(ErrorString* error, SecurityOrigin* origin)
 {
     for (Frame* frame = m_pageAgent->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
         if (frame->document() && frame->document()->securityOrigin()->isSameSchemeHostPort(origin))
             return frame->document();
     }
+
+    *error = "No frame is available for the request";
     return 0;
 }
 
diff --git a/Source/WebCore/inspector/InspectorFileSystemAgent.h b/Source/WebCore/inspector/InspectorFileSystemAgent.h
index 82f95c4b6..f7350d416 100644
--- a/Source/WebCore/inspector/InspectorFileSystemAgent.h
+++ b/Source/WebCore/inspector/InspectorFileSystemAgent.h
@@ -34,18 +34,14 @@
 #if ENABLE(INSPECTOR) && ENABLE(FILE_SYSTEM)
 
 #include "InspectorBaseAgent.h"
-#include "InspectorFrontend.h"
 
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-class DOMFileSystem;
 class InspectorFrontend;
 class InspectorPageAgent;
-class InspectorState;
-class InstrumentingAgents;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
@@ -59,9 +55,10 @@ public:
     virtual void enable(ErrorString*) OVERRIDE;
     virtual void disable(ErrorString*) OVERRIDE;
 
-    virtual void requestFileSystemRoot(ErrorString*, const String& origin, const String& type, int* requestId) OVERRIDE;
+    virtual void requestFileSystemRoot(ErrorString*, const String& origin, const String& typeString, int* requestId) OVERRIDE;
     virtual void requestDirectoryContent(ErrorString*, const String& url, int* requestId) OVERRIDE;
     virtual void requestMetadata(ErrorString*, const String& url, int* requestId) OVERRIDE;
+    virtual void requestFileContent(ErrorString*, const String& url, bool readAsText, const int* start, const int* end, const String* charset, int* requestId) OVERRIDE;
 
     virtual void setFrontend(InspectorFrontend*) OVERRIDE;
     virtual void clearFrontend() OVERRIDE;
@@ -69,7 +66,7 @@ public:
 
 private:
     InspectorFileSystemAgent(InstrumentingAgents*, InspectorPageAgent*, InspectorState*);
-    ScriptExecutionContext* scriptExecutionContextForOrigin(SecurityOrigin*);
+    ScriptExecutionContext* assertScriptExecutionContextForOrigin(ErrorString*, SecurityOrigin*);
 
     InspectorPageAgent* m_pageAgent;
     RefPtr<FrontendProvider> m_frontendProvider;
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
index d4ede21a7..6107eb982 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
@@ -105,16 +105,17 @@ class InspectorIDBCallback : public IDBCallbacks {
 public:
     virtual ~InspectorIDBCallback() { }
 
-    virtual void onError(PassRefPtr<IDBDatabaseError>) { }
-    virtual void onSuccess(PassRefPtr<DOMStringList>) { }
-    virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>) { }
-    virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>) { }
-    virtual void onSuccess(PassRefPtr<IDBKey>) { }
-    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) { }
-    virtual void onSuccess(PassRefPtr<SerializedScriptValue>) { }
-    virtual void onSuccessWithContinuation() { }
-    virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<SerializedScriptValue> >&) { }
-    virtual void onBlocked() { }
+    virtual void onError(PassRefPtr<IDBDatabaseError>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<DOMStringList>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<IDBKey>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, const IDBKeyPath&) OVERRIDE { }
+    virtual void onSuccessWithContinuation() OVERRIDE { }
+    virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<SerializedScriptValue> >&) OVERRIDE { }
+    virtual void onBlocked() OVERRIDE { }
 };
 
 class InspectorIDBDatabaseCallbacks : public IDBDatabaseCallbacks {
@@ -329,10 +330,11 @@ public:
                     .setMultiEntry(indexMetadata.multiEntry);
                 indexes->addItem(objectStoreIndex);
             }
-            // FIXME: add objectStoreMetadata.autoIncrement property http://webkit.org/b/89701
+
             RefPtr<ObjectStore> objectStore = ObjectStore::create()
                 .setName(objectStoreMetadata.name)
                 .setKeyPath(keyPathFromIDBKeyPath(objectStoreMetadata.keyPath))
+                .setAutoIncrement(objectStoreMetadata.autoIncrement)
                 .setIndexes(indexes);
             objectStores->addItem(objectStore);
         }
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index a65ff7e32..dadd599c6 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -68,6 +68,7 @@
 #include "WorkerThread.h"
 #include "XMLHttpRequest.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/ThreadSpecific.h>
 #include <wtf/text/CString.h>
 
 namespace WebCore {
@@ -629,11 +630,11 @@ void InspectorInstrumentation::didLoadResourceFromMemoryCacheImpl(InstrumentingA
         resourceAgent->didLoadResourceFromMemoryCache(loader, cachedResource);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceDataImpl(InstrumentingAgents* instrumentingAgents, unsigned long identifier, Frame* frame)
+InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceDataImpl(InstrumentingAgents* instrumentingAgents, unsigned long identifier, Frame* frame, int length)
 {
     int timelineAgentId = 0;
     if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent()) {
-        timelineAgent->willReceiveResourceData(identifier, frame);
+        timelineAgent->willReceiveResourceData(identifier, frame, length);
         timelineAgentId = timelineAgent->id();
     }
     return InspectorInstrumentationCookie(instrumentingAgents, timelineAgentId);
@@ -879,6 +880,8 @@ void InspectorInstrumentation::consoleCountImpl(InstrumentingAgents* instrumenti
 
 void InspectorInstrumentation::startConsoleTimingImpl(InstrumentingAgents* instrumentingAgents, const String& title)
 {
+    if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
+        timelineAgent->time(title);
     if (InspectorConsoleAgent* consoleAgent = instrumentingAgents->inspectorConsoleAgent())
         consoleAgent->startTiming(title);
 }
@@ -887,6 +890,8 @@ void InspectorInstrumentation::stopConsoleTimingImpl(InstrumentingAgents* instru
 {
     if (InspectorConsoleAgent* consoleAgent = instrumentingAgents->inspectorConsoleAgent())
         consoleAgent->stopTiming(title, stack);
+    if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
+        timelineAgent->timeEnd(title);
 }
 
 void InspectorInstrumentation::consoleTimeStampImpl(InstrumentingAgents* instrumentingAgents, PassRefPtr<ScriptArguments> arguments)
@@ -1132,6 +1137,22 @@ void InspectorInstrumentation::didFireAnimationFrameImpl(const InspectorInstrume
         timelineAgent->didFireAnimationFrame();
 }
 
+InspectorTimelineAgent* InspectorInstrumentation::timelineAgentForOrphanEvents()
+{
+    return *threadSpecificTimelineAgentForOrphanEvents();
+}
+
+void InspectorInstrumentation::setTimelineAgentForOrphanEvents(InspectorTimelineAgent* inspectorTimelineAgent)
+{
+    *threadSpecificTimelineAgentForOrphanEvents() = inspectorTimelineAgent;
+}
+
+WTF::ThreadSpecific<InspectorTimelineAgent*>& InspectorInstrumentation::threadSpecificTimelineAgentForOrphanEvents()
+{
+    AtomicallyInitializedStatic(WTF::ThreadSpecific<InspectorTimelineAgent*>*, instance = new WTF::ThreadSpecific<InspectorTimelineAgent*>());
+    return *instance;
+}
+
 InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
 {
     if (!cookie.first)
@@ -1165,6 +1186,19 @@ InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForNonDocument
 }
 #endif
 
+#if ENABLE(GEOLOCATION)
+GeolocationPosition* InspectorInstrumentation::checkGeolocationPositionOrErrorImpl(InstrumentingAgents* instrumentingAgents, GeolocationPosition* position)
+{
+    if (InspectorPageAgent* pageAgent = instrumentingAgents->inspectorPageAgent()) {
+        if (pageAgent->sendGeolocationError())
+            return 0;
+        if (pageAgent->geolocationPosition())
+            position = pageAgent->geolocationPosition();
+    }
+    return position;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // !ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 1d79f2423..16fd159b1 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -56,6 +56,7 @@ class Database;
 class Element;
 class EventContext;
 class DocumentLoader;
+class GeolocationPosition;
 class GraphicsContext;
 class HitTestResult;
 class InspectorCSSAgent;
@@ -165,7 +166,7 @@ public:
     static void continueAfterPingLoader(Frame*, unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse&);
     static void markResourceAsCached(Page*, unsigned long identifier);
     static void didLoadResourceFromMemoryCache(Page*, DocumentLoader*, CachedResource*);
-    static InspectorInstrumentationCookie willReceiveResourceData(Frame*, unsigned long identifier);
+    static InspectorInstrumentationCookie willReceiveResourceData(Frame*, unsigned long identifier, int length);
     static void didReceiveResourceData(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponse(Frame*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponse(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
@@ -252,14 +253,22 @@ public:
     static bool hasFrontends() { return s_frontendCounter; }
     static bool hasFrontendForScriptContext(ScriptExecutionContext*);
     static bool collectingHTMLParseErrors(Page*);
+    static InspectorTimelineAgent* timelineAgentForOrphanEvents();
+    static void setTimelineAgentForOrphanEvents(InspectorTimelineAgent*);
 #else
     static bool hasFrontends() { return false; }
     static bool hasFrontendForScriptContext(ScriptExecutionContext*) { return false; }
     static bool collectingHTMLParseErrors(Page*) { return false; }
 #endif
 
+#if ENABLE(GEOLOCATION)
+    static GeolocationPosition* checkGeolocationPositionOrError(Page*, GeolocationPosition*);
+#endif
+
 private:
 #if ENABLE(INSPECTOR)
+    static WTF::ThreadSpecific<InspectorTimelineAgent*>& threadSpecificTimelineAgentForOrphanEvents();
+
     static void didClearWindowObjectInWorldImpl(InstrumentingAgents*, Frame*, DOMWrapperWorld*);
     static bool isDebuggerPausedImpl(InstrumentingAgents*);
 
@@ -330,7 +339,7 @@ private:
     static void continueAfterPingLoaderImpl(InstrumentingAgents*, unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse&);
     static void markResourceAsCachedImpl(InstrumentingAgents*, unsigned long identifier);
     static void didLoadResourceFromMemoryCacheImpl(InstrumentingAgents*, DocumentLoader*, CachedResource*);
-    static InspectorInstrumentationCookie willReceiveResourceDataImpl(InstrumentingAgents*, unsigned long identifier, Frame*);
+    static InspectorInstrumentationCookie willReceiveResourceDataImpl(InstrumentingAgents*, unsigned long identifier, Frame*, int length);
     static void didReceiveResourceDataImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponseImpl(InstrumentingAgents*, unsigned long identifier, const ResourceResponse&, Frame*);
     static void didReceiveResourceResponseImpl(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
@@ -417,6 +426,10 @@ private:
     static void cancelPauseOnNativeEvent(InstrumentingAgents*);
     static InspectorTimelineAgent* retrieveTimelineAgent(const InspectorInstrumentationCookie&);
 
+#if ENABLE(GEOLOCATION)
+    static GeolocationPosition* checkGeolocationPositionOrErrorImpl(InstrumentingAgents*, GeolocationPosition*);
+#endif
+
     static int s_frontendCounter;
 #endif
 };
@@ -1014,12 +1027,12 @@ inline void InspectorInstrumentation::didLoadResourceFromMemoryCache(Page* page,
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceData(Frame* frame, unsigned long identifier)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceData(Frame* frame, unsigned long identifier, int length)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
     if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForFrame(frame))
-        return willReceiveResourceDataImpl(instrumentingAgents, identifier, frame);
+        return willReceiveResourceDataImpl(instrumentingAgents, identifier, frame, length);
 #endif
     return InspectorInstrumentationCookie();
 }
@@ -1382,6 +1395,19 @@ inline void InspectorInstrumentation::didFireAnimationFrame(const InspectorInstr
 #endif
 }
 
+
+#if ENABLE(GEOLOCATION)
+inline GeolocationPosition* InspectorInstrumentation::checkGeolocationPositionOrError(Page* page, GeolocationPosition* position)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(position);
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
+        return checkGeolocationPositionOrErrorImpl(instrumentingAgents, position);
+#endif
+    return position;
+}
+#endif
+
 #if ENABLE(INSPECTOR)
 inline bool InspectorInstrumentation::collectingHTMLParseErrors(Page* page)
 {
diff --git a/Source/WebCore/inspector/InspectorMemoryAgent.cpp b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
index b05f622d0..ff01ffbf9 100644
--- a/Source/WebCore/inspector/InspectorMemoryAgent.cpp
+++ b/Source/WebCore/inspector/InspectorMemoryAgent.cpp
@@ -54,7 +54,12 @@
 #include <wtf/ArrayBuffer.h>
 #include <wtf/ArrayBufferView.h>
 #include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
 #include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringImpl.h>
+#include <wtf/text/WTFString.h>
 
 using WebCore::TypeBuilder::Memory::DOMGroup;
 using WebCore::TypeBuilder::Memory::ListenerCount;
@@ -73,6 +78,8 @@ static const char jsExternalResources[] = "JSExternalResources";
 static const char jsExternalArrays[] = "JSExternalArrays";
 static const char jsExternalStrings[] = "JSExternalStrings";
 static const char inspectorData[] = "InspectorData";
+static const char inspectorDOMData[] = "InspectorDOMData";
+static const char inspectorJSHeapData[] = "InspectorJSHeapData";
 static const char memoryCache[] = "MemoryCache";
 static const char processPrivateMemory[] = "ProcessPrivateMemory";
 
@@ -88,10 +95,13 @@ static const char dom[] = "DOM";
 static const char domTreeOther[] = "DOMTreeOther";
 static const char domTreeDOM[] = "DOMTreeDOM";
 static const char domTreeCSS[] = "DOMTreeCSS";
+static const char domTreeBinding[] = "DOMTreeBinding";
 }
 
 namespace {
 
+typedef HashSet<const void*> VisitedObjects;
+
 String nodeName(Node* node)
 {
     if (node->document()->isXHTMLDocument())
@@ -101,8 +111,15 @@ String nodeName(Node* node)
 
 size_t stringSize(StringImpl* string)
 {
+    // FIXME: support substrings
     size_t size = string->length();
-    if (!string->is8Bit())
+    if (string->is8Bit()) {
+        if (string->has16BitShadow()) {
+            size += 2 * size;
+            if (string->hasTerminatingNullCharacter())
+                size += 2;
+        }
+    } else
         size *= 2;
     return size + sizeof(*string);
 }
@@ -315,8 +332,9 @@ private:
 
 class ExternalResourceVisitor : public ExternalStringVisitor, public ExternalArrayVisitor {
 public:
-    ExternalResourceVisitor()
-        : m_jsExternalStringSize(0)
+    explicit ExternalResourceVisitor(VisitedObjects& visitedObjects)
+        : m_visitedObjects(visitedObjects)
+        , m_jsExternalStringSize(0)
         , m_externalArraySize(0)
     { }
 
@@ -327,18 +345,50 @@ private:
     virtual void visitJSExternalArray(ArrayBufferView* bufferView)
     {
         ArrayBuffer* buffer = bufferView->buffer().get();
-        if (m_arrayBuffers.add(buffer).isNewEntry)
+        if (m_visitedObjects.add(buffer).isNewEntry)
             m_externalArraySize += buffer->byteLength();
     }
     virtual void visitJSExternalString(StringImpl* string)
     {
-        int size = stringSize(string);
-        m_jsExternalStringSize += size;
+        if (m_visitedObjects.add(string).isNewEntry)
+            m_jsExternalStringSize += stringSize(string);
     }
 
+    VisitedObjects& m_visitedObjects;
     size_t m_jsExternalStringSize;
     size_t m_externalArraySize;
-    HashSet<ArrayBuffer*> m_arrayBuffers;
+};
+
+class InspectorDataCounter {
+public:
+    void addComponent(const String& name, size_t size)
+    {
+        m_components.append(ComponentInfo(name, size));
+    }
+
+    PassRefPtr<InspectorMemoryBlock> dumpStatistics()
+    {
+        size_t totalSize = 0;
+        RefPtr<InspectorMemoryBlock> block = InspectorMemoryBlock::create().setName(MemoryBlockName::inspectorData);
+        for (Vector<ComponentInfo>::iterator it = m_components.begin(); it != m_components.end(); ++it) {
+            RefPtr<InspectorMemoryBlock> block = InspectorMemoryBlock::create().setName(it->m_name);
+            block->setSize(it->m_size);
+            totalSize += it->m_size;
+        }
+        block->setSize(totalSize);
+        return block;
+    }
+
+private:
+    class ComponentInfo {
+    public:
+        ComponentInfo(const String& name, size_t size) : m_name(name), m_size(size) { }
+
+        const String m_name;
+        size_t m_size;
+    };
+
+    Vector<ComponentInfo> m_components;
 };
 
 } // namespace
@@ -383,14 +433,6 @@ static PassRefPtr<InspectorMemoryBlock> jsHeapInfo()
     return jsHeapAllocated.release();
 }
 
-static PassRefPtr<InspectorMemoryBlock> inspectorData()
-{
-    size_t dataSize = ScriptProfiler::profilerSnapshotsSize();
-    RefPtr<InspectorMemoryBlock> inspectorData = InspectorMemoryBlock::create().setName(MemoryBlockName::inspectorData);
-    inspectorData->setSize(dataSize);
-    return inspectorData.release();
-}
-
 static PassRefPtr<InspectorMemoryBlock> renderTreeInfo(Page* page)
 {
     ArenaSize arenaSize = page->renderTreeSize();
@@ -418,14 +460,20 @@ namespace {
 
 class MemoryInstrumentationImpl : public MemoryInstrumentation {
 public:
-    MemoryInstrumentationImpl()
+    explicit MemoryInstrumentationImpl(VisitedObjects& visitedObjects)
+        : m_visitedObjects(visitedObjects)
     {
         for (int i = 0; i < LastTypeEntry; ++i)
             m_totalSizes[i] = 0;
     }
 
-    PassRefPtr<InspectorMemoryBlock> dumpStatistics()
+    PassRefPtr<InspectorMemoryBlock> dumpStatistics(InspectorDataCounter* inspectorData)
     {
+        size_t inspectorSize
+            = calculateContainerSize(m_visitedObjects)
+            + calculateContainerSize(m_deferredInstrumentedPointers);
+        inspectorData->addComponent(MemoryBlockName::inspectorDOMData, inspectorSize);
+
         size_t totalSize = 0;
         for (int i = Other; i < LastTypeEntry; ++i)
             totalSize += m_totalSizes[i];
@@ -434,6 +482,7 @@ public:
         addMemoryBlockFor(domChildren.get(), m_totalSizes[Other], MemoryBlockName::domTreeOther);
         addMemoryBlockFor(domChildren.get(), m_totalSizes[DOM], MemoryBlockName::domTreeDOM);
         addMemoryBlockFor(domChildren.get(), m_totalSizes[CSS], MemoryBlockName::domTreeCSS);
+        addMemoryBlockFor(domChildren.get(), m_totalSizes[Binding], MemoryBlockName::domTreeBinding);
 
         RefPtr<InspectorMemoryBlock> dom = InspectorMemoryBlock::create().setName(MemoryBlockName::dom);
         dom->setSize(totalSize);
@@ -441,35 +490,70 @@ public:
         return dom.release();
     }
 
+    void processDeferredInstrumentedPointers()
+    {
+        while (!m_deferredInstrumentedPointers.isEmpty()) {
+            OwnPtr<InstrumentedPointerBase> pointer = m_deferredInstrumentedPointers.last().release();
+            m_deferredInstrumentedPointers.removeLast();
+            pointer->process(this);
+        }
+    }
+
 private:
-    virtual void countObjectSize(ObjectType objectType, size_t size)
+    virtual void reportString(ObjectType objectType, const String& string)
+    {
+        if (string.isNull() || visited(string.impl()))
+            return;
+        countObjectSize(objectType, stringSize(string.impl()));
+    }
+
+    virtual void countObjectSize(ObjectType objectType, size_t size) OVERRIDE
     {
         ASSERT(objectType >= 0 && objectType < LastTypeEntry);
         m_totalSizes[objectType] += size;
     }
 
-    virtual bool visited(const void* object)
+    virtual void deferInstrumentedPointer(PassOwnPtr<InstrumentedPointerBase> pointer) OVERRIDE
+    {
+        m_deferredInstrumentedPointers.append(pointer);
+    }
+
+    virtual bool visited(const void* object) OVERRIDE
     {
         return !m_visitedObjects.add(object).isNewEntry;
     }
+
     size_t m_totalSizes[LastTypeEntry];
-    typedef HashSet<const void*> VisitedObjects;
-    VisitedObjects m_visitedObjects;
+    VisitedObjects& m_visitedObjects;
+    Vector<OwnPtr<InstrumentedPointerBase> > m_deferredInstrumentedPointers;
 };
 
 class DOMTreesIterator : public NodeWrapperVisitor {
 public:
-    explicit DOMTreesIterator(Page* page) : m_page(page) { }
+    DOMTreesIterator(Page* page, VisitedObjects& visitedObjects)
+        : m_page(page)
+        , m_domMemoryUsage(visitedObjects)
+    {
+    }
 
-    virtual void visitNode(Node* node)
+    virtual void visitNode(Node* node) OVERRIDE
     {
         if (node->document() && node->document()->frame() && m_page != node->document()->frame()->page())
             return;
 
         m_domMemoryUsage.reportInstrumentedPointer(node);
+        m_domMemoryUsage.processDeferredInstrumentedPointers();
+    }
+
+    void visitBindings()
+    {
+        ScriptProfiler::collectBindingMemoryInfo(&m_domMemoryUsage);
     }
 
-    PassRefPtr<InspectorMemoryBlock> dumpStatistics() { return m_domMemoryUsage.dumpStatistics(); }
+    PassRefPtr<InspectorMemoryBlock> dumpStatistics(InspectorDataCounter* inspectorData)
+    {
+        return m_domMemoryUsage.dumpStatistics(inspectorData);
+    }
 
 private:
     Page* m_page;
@@ -478,9 +562,9 @@ private:
 
 }
 
-static PassRefPtr<InspectorMemoryBlock> domTreeInfo(Page* page)
+static PassRefPtr<InspectorMemoryBlock> domTreeInfo(Page* page, VisitedObjects& visitedObjects, InspectorDataCounter* inspectorData)
 {
-    DOMTreesIterator domTreesIterator(page);
+    DOMTreesIterator domTreesIterator(page, visitedObjects);
     ScriptProfiler::visitNodeWrappers(&domTreesIterator);
 
     // Make sure all documents reachable from the main frame are accounted.
@@ -489,7 +573,9 @@ static PassRefPtr<InspectorMemoryBlock> domTreeInfo(Page* page)
             domTreesIterator.visitNode(doc);
     }
 
-    return domTreesIterator.dumpStatistics();
+    domTreesIterator.visitBindings();
+
+    return domTreesIterator.dumpStatistics(inspectorData);
 }
 
 static PassRefPtr<InspectorMemoryBlock> memoryCacheInfo()
@@ -513,9 +599,9 @@ static PassRefPtr<InspectorMemoryBlock> memoryCacheInfo()
     return memoryCacheStats.release();
 }
 
-static PassRefPtr<InspectorMemoryBlock> jsExternalResourcesInfo()
+static PassRefPtr<InspectorMemoryBlock> jsExternalResourcesInfo(VisitedObjects& visitedObjects)
 {
-    ExternalResourceVisitor visitor;
+    ExternalResourceVisitor visitor(visitedObjects);
     ScriptProfiler::visitExternalStrings(&visitor);
     ScriptProfiler::visitExternalArrays(&visitor);
 
@@ -536,20 +622,25 @@ static PassRefPtr<InspectorMemoryBlock> jsExternalResourcesInfo()
 
 void InspectorMemoryAgent::getProcessMemoryDistribution(ErrorString*, RefPtr<InspectorMemoryBlock>& processMemory)
 {
-    size_t privateBytes = 0;
-    size_t sharedBytes = 0;
-    MemoryUsageSupport::processMemorySizesInBytes(&privateBytes, &sharedBytes);
     processMemory = InspectorMemoryBlock::create().setName(MemoryBlockName::processPrivateMemory);
-    processMemory->setSize(privateBytes);
 
+    InspectorDataCounter inspectorData;
+    inspectorData.addComponent(MemoryBlockName::inspectorJSHeapData, ScriptProfiler::profilerSnapshotsSize());
+
+    VisitedObjects visitedObjects;
     RefPtr<TypeBuilder::Array<InspectorMemoryBlock> > children = TypeBuilder::Array<InspectorMemoryBlock>::create();
     children->addItem(jsHeapInfo());
-    children->addItem(jsExternalResourcesInfo());
-    children->addItem(inspectorData());
     children->addItem(memoryCacheInfo());
-    children->addItem(renderTreeInfo(m_page)); // TODO: collect for all pages?
-    children->addItem(domTreeInfo(m_page)); // TODO: collect for all pages?
+    children->addItem(renderTreeInfo(m_page)); // FIXME: collect for all pages?
+    children->addItem(domTreeInfo(m_page, visitedObjects, &inspectorData)); // FIXME: collect for all pages?
+    children->addItem(jsExternalResourcesInfo(visitedObjects));
+    children->addItem(inspectorData.dumpStatistics());
     processMemory->setChildren(children);
+
+    size_t privateBytes = 0;
+    size_t sharedBytes = 0;
+    MemoryUsageSupport::processMemorySizesInBytes(&privateBytes, &sharedBytes);
+    processMemory->setSize(privateBytes);
 }
 
 InspectorMemoryAgent::InspectorMemoryAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, Page* page, InspectorDOMAgent*)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 4e06a436b..aed08419d 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -51,6 +51,9 @@
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameView.h"
+#include "GeolocationController.h"
+#include "GeolocationError.h"
+#include "GeolocationPosition.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
 #include "IdentifiersFactory.h"
@@ -318,6 +321,8 @@ InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents,
     , m_lastScriptIdentifier(0)
     , m_lastPaintContext(0)
     , m_didLoadEventFire(false)
+    , m_geolocationError()
+    , m_geolocationPosition()
 {
 }
 
@@ -967,6 +972,52 @@ void InspectorPageAgent::updateViewMetrics(int width, int height, double fontSca
     InspectorInstrumentation::mediaQueryResultChanged(document);
 }
 
+void InspectorPageAgent::setGeolocationData(ErrorString*, const double* longitude, const double* latitude, const double* accuracy, const String* errorType)
+{
+#if ENABLE (GEOLOCATION)
+    GeolocationController* controller = GeolocationController::from(m_page);
+    if (!controller)
+        return;
+
+    clearGeolocationData(0);
+
+    if (*errorType == "PermissionDenied")
+        m_geolocationError = GeolocationError::create(GeolocationError::PermissionDenied, *errorType).leakRef();
+    else if (*errorType == "PositionUnavailable")
+        m_geolocationError = GeolocationError::create(GeolocationError::PositionUnavailable, *errorType).leakRef();
+
+    if (m_geolocationError.get()) {
+        controller->errorOccurred(m_geolocationError.get());
+        return;
+    }
+
+    m_geolocationPosition = GeolocationPosition::create(currentTimeMS(), *longitude, *latitude, *accuracy).leakRef();
+    controller->positionChanged(m_geolocationPosition.get());
+#endif
+}
+
+void InspectorPageAgent::clearGeolocationData(ErrorString*)
+{
+#if ENABLE(GEOLOCATION)
+    m_geolocationError.clear();
+    m_geolocationPosition.clear();
+#endif
+}
+
+bool InspectorPageAgent::sendGeolocationError()
+{
+#if ENABLE(GEOLOCATION)
+    if (m_geolocationError.get()) {
+        GeolocationController* controller = GeolocationController::from(m_page);
+        if (controller) {
+            controller->errorOccurred(m_geolocationError.get());
+            return true;
+        }
+    }
+#endif
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index 964bc85fc..c2f84f43d 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -34,6 +34,8 @@
 #if ENABLE(INSPECTOR)
 
 #include "Frame.h"
+#include "GeolocationError.h"
+#include "GeolocationPosition.h"
 #include "InspectorBaseAgent.h"
 #include "InspectorFrontend.h"
 #include "PlatformString.h"
@@ -108,6 +110,12 @@ public:
     virtual void setShowPaintRects(ErrorString*, bool show);
     virtual void getScriptExecutionStatus(ErrorString*, PageCommandHandler::Result::Enum*);
     virtual void setScriptExecutionDisabled(ErrorString*, bool);
+    virtual void setGeolocationData(ErrorString*, const double*, const double*, const double*, const String*);
+    virtual void clearGeolocationData(ErrorString*);
+
+    // Geolocation override helpers.
+    bool sendGeolocationError();
+    GeolocationPosition* geolocationPosition() const {return m_geolocationPosition.get();}
 
     // InspectorInstrumentation API
     void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
@@ -156,6 +164,8 @@ private:
     GraphicsContext* m_lastPaintContext;
     LayoutRect m_lastPaintRect;
     bool m_didLoadEventFire;
+    RefPtr<GeolocationError> m_geolocationError;
+    RefPtr<GeolocationPosition> m_geolocationPosition;
 };
 
 
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index a6ff0dbf8..5f5bb050c 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -50,6 +50,7 @@
 #include "SVGNames.h"
 #include "StyleResolver.h"
 #include "StyleRule.h"
+#include "StyleRuleImport.h"
 #include "StyleSheetContents.h"
 #include "StyleSheetList.h"
 #include "WebKitCSSKeyframesRule.h"
@@ -61,6 +62,7 @@
 
 using WebCore::TypeBuilder::Array;
 using WebCore::RuleSourceDataList;
+using WebCore::CSSRuleSourceData;
 
 class ParsedStyleSheet {
 public:
@@ -73,7 +75,7 @@ public:
     RuleSourceDataList* sourceData() const { return m_sourceData.get(); }
     void setSourceData(PassOwnPtr<RuleSourceDataList>);
     bool hasSourceData() const { return m_sourceData; }
-    RefPtr<WebCore::CSSRuleSourceData> ruleSourceDataAt(unsigned index) const;
+    PassRefPtr<WebCore::CSSRuleSourceData> ruleSourceDataAt(unsigned) const;
 
 private:
 
@@ -97,12 +99,33 @@ void ParsedStyleSheet::setText(const String& text)
     setSourceData(nullptr);
 }
 
+static void flattenSourceData(RuleSourceDataList* dataList, RuleSourceDataList* target)
+{
+    for (size_t i = 0; i < dataList->size(); ++i) {
+        RefPtr<CSSRuleSourceData>& data = dataList->at(i);
+        if (data->type == CSSRuleSourceData::STYLE_RULE)
+            target->append(data);
+        else if (data->type == CSSRuleSourceData::MEDIA_RULE)
+            flattenSourceData(&data->childRules, target);
+    }
+}
+
 void ParsedStyleSheet::setSourceData(PassOwnPtr<RuleSourceDataList> sourceData)
 {
-    m_sourceData = sourceData;
+    if (!sourceData) {
+        m_sourceData.clear();
+        return;
+    }
+
+    m_sourceData = adoptPtr(new RuleSourceDataList());
+
+    // FIXME: This is a temporary solution to retain the original flat sourceData structure
+    // containing only style rules, even though CSSParser now provides the full rule source data tree.
+    // Normally, we should just assign m_sourceData = sourceData;
+    flattenSourceData(sourceData.get(), m_sourceData.get());
 }
 
-RefPtr<WebCore::CSSRuleSourceData> ParsedStyleSheet::ruleSourceDataAt(unsigned index) const
+PassRefPtr<WebCore::CSSRuleSourceData> ParsedStyleSheet::ruleSourceDataAt(unsigned index) const
 {
     if (!hasSourceData() || index >= m_sourceData->size())
         return 0;
@@ -271,7 +294,7 @@ PassRefPtr<TypeBuilder::CSS::CSSStyle> InspectorStyle::buildObjectForStyle() con
 
     RefPtr<CSSRuleSourceData> sourceData = m_parentStyleSheet ? m_parentStyleSheet->ruleSourceDataFor(m_style.get()) : 0;
     if (sourceData)
-        result->setRange(buildSourceRangeObject(sourceData->styleSourceData->styleBodyRange));
+        result->setRange(buildSourceRangeObject(sourceData->ruleBodyRange));
 
     return result.release();
 }
@@ -314,10 +337,10 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
 
     if (propertyText.stripWhiteSpace().length()) {
         RefPtr<StylePropertySet> tempMutableStyle = StylePropertySet::create();
-        RefPtr<CSSStyleSourceData> sourceData = CSSStyleSourceData::create();
+        RefPtr<CSSRuleSourceData> sourceData = CSSRuleSourceData::create(CSSRuleSourceData::STYLE_RULE);
         CSSParser p(CSSStrictMode);
         p.parseDeclaration(tempMutableStyle.get(), propertyText + " " + bogusPropertyName + ": none", sourceData, m_style->parentStyleSheet()->contents());
-        Vector<CSSPropertySourceData>& propertyData = sourceData->propertyData;
+        Vector<CSSPropertySourceData>& propertyData = sourceData->styleSourceData->propertyData;
         unsigned propertyCount = propertyData.size();
 
         // At least one property + the bogus property added just above should be present.
@@ -355,7 +378,7 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
         *oldText = allProperties.at(index).rawText;
         editor.replaceProperty(index, propertyText);
     } else
-        editor.insertProperty(index, propertyText, sourceData->styleSourceData->styleBodyRange.length());
+        editor.insertProperty(index, propertyText, sourceData->ruleBodyRange.length());
 
     return applyStyleText(editor.styleText());
 }
@@ -413,7 +436,7 @@ bool InspectorStyle::styleText(String* result) const
     if (!success)
         return false;
 
-    SourceRange& bodyRange = sourceData->styleSourceData->styleBodyRange;
+    SourceRange& bodyRange = sourceData->ruleBodyRange;
     *result = styleSheetText.substring(bodyRange.start, bodyRange.end - bodyRange.start);
     return true;
 }
@@ -771,7 +794,7 @@ bool InspectorStyleSheet::setRuleSelector(const InspectorCSSId& id, const String
     }
 
     String sheetText = m_parsedStyleSheet->text();
-    sheetText.replace(sourceData->selectorListRange.start, sourceData->selectorListRange.end - sourceData->selectorListRange.start, selector);
+    sheetText.replace(sourceData->ruleHeaderRange.start, sourceData->ruleHeaderRange.length(), selector);
     m_parsedStyleSheet->setText(sheetText);
     fireStyleSheetChanged();
     return true;
@@ -830,7 +853,7 @@ bool InspectorStyleSheet::deleteRule(const InspectorCSSId& id, ExceptionCode& ec
     }
 
     String sheetText = m_parsedStyleSheet->text();
-    sheetText.remove(sourceData->selectorListRange.start, sourceData->styleSourceData->styleBodyRange.end - sourceData->selectorListRange.start + 1);
+    sheetText.remove(sourceData->ruleHeaderRange.start, sourceData->ruleBodyRange.end - sourceData->ruleHeaderRange.start + 1);
     m_parsedStyleSheet->setText(sheetText);
     fireStyleSheetChanged();
     return true;
@@ -911,12 +934,8 @@ PassRefPtr<TypeBuilder::CSS::CSSRule> InspectorStyleSheet::buildObjectForRule(CS
     RefPtr<CSSRuleSourceData> sourceData;
     if (ensureParsedDataReady())
         sourceData = ruleSourceDataFor(rule->style());
-    if (sourceData) {
-        RefPtr<TypeBuilder::CSS::SourceRange> selectorRange = TypeBuilder::CSS::SourceRange::create()
-            .setStart(sourceData->selectorListRange.start)
-            .setEnd(sourceData->selectorListRange.end);
-        result->setSelectorRange(selectorRange.release());
-    }
+    if (sourceData)
+        result->setSelectorRange(buildSourceRangeObject(sourceData->ruleHeaderRange));
 
     RefPtr<Array<TypeBuilder::CSS::CSSMedia> > mediaArray = Array<TypeBuilder::CSS::CSSMedia>::create();
 
@@ -948,7 +967,7 @@ PassRefPtr<TypeBuilder::CSS::CSSStyle> InspectorStyleSheet::buildObjectForStyle(
         String sheetText;
         bool success = getText(&sheetText);
         if (success) {
-            const SourceRange& bodyRange = sourceData->styleSourceData->styleBodyRange;
+            const SourceRange& bodyRange = sourceData->ruleBodyRange;
             result->setCssText(sheetText.substring(bodyRange.start, bodyRange.end - bodyRange.start));
         }
     }
@@ -1097,10 +1116,10 @@ bool InspectorStyleSheet::ensureSourceData()
         return false;
 
     RefPtr<StyleSheetContents> newStyleSheet = StyleSheetContents::create();
-    CSSParser p(CSSStrictMode);
-    OwnPtr<RuleSourceDataList> rangesVector(adoptPtr(new RuleSourceDataList()));
-    p.parseSheet(newStyleSheet.get(), m_parsedStyleSheet->text(), 0, rangesVector.get());
-    m_parsedStyleSheet->setSourceData(rangesVector.release());
+    CSSParser p(m_pageStyleSheet->ownerDocument());
+    OwnPtr<RuleSourceDataList> ruleSourceDataResult = adoptPtr(new RuleSourceDataList());
+    p.parseSheet(newStyleSheet.get(), m_parsedStyleSheet->text(), 0, ruleSourceDataResult.get());
+    m_parsedStyleSheet->setSourceData(ruleSourceDataResult.release());
     return m_parsedStyleSheet->hasSourceData();
 }
 
@@ -1144,8 +1163,8 @@ bool InspectorStyleSheet::styleSheetTextWithChangedStyle(CSSStyleDeclaration* st
         return false;
 
     RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(style);
-    unsigned bodyStart = sourceData->styleSourceData->styleBodyRange.start;
-    unsigned bodyEnd = sourceData->styleSourceData->styleBodyRange.end;
+    unsigned bodyStart = sourceData->ruleBodyRange.start;
+    unsigned bodyEnd = sourceData->ruleBodyRange.end;
     ASSERT(bodyStart <= bodyEnd);
 
     String text = m_parsedStyleSheet->text();
@@ -1326,13 +1345,11 @@ bool InspectorStyleSheetForInlineStyle::ensureParsedDataReady()
     if (m_ruleSourceData)
         return true;
 
-    m_ruleSourceData = CSSRuleSourceData::create();
-    RefPtr<CSSStyleSourceData> sourceData = CSSStyleSourceData::create();
-    bool success = getStyleAttributeRanges(&sourceData);
+    m_ruleSourceData = CSSRuleSourceData::create(CSSRuleSourceData::STYLE_RULE);
+    bool success = getStyleAttributeRanges(m_ruleSourceData.get());
     if (!success)
         return false;
 
-    m_ruleSourceData->styleSourceData = sourceData.release();
     return true;
 }
 
@@ -1352,20 +1369,20 @@ const String& InspectorStyleSheetForInlineStyle::elementStyleText() const
     return m_element->getAttribute("style").string();
 }
 
-bool InspectorStyleSheetForInlineStyle::getStyleAttributeRanges(RefPtr<CSSStyleSourceData>* result) const
+bool InspectorStyleSheetForInlineStyle::getStyleAttributeRanges(CSSRuleSourceData* result) const
 {
     if (!m_element->isStyledElement())
         return false;
 
     if (m_styleText.isEmpty()) {
-        (*result)->styleBodyRange.start = 0;
-        (*result)->styleBodyRange.end = 0;
+        result->ruleBodyRange.start = 0;
+        result->ruleBodyRange.end = 0;
         return true;
     }
 
     RefPtr<StylePropertySet> tempDeclaration = StylePropertySet::create();
     CSSParser p(m_element->document());
-    p.parseDeclaration(tempDeclaration.get(), m_styleText, *result, m_element->document()->elementSheet()->contents());
+    p.parseDeclaration(tempDeclaration.get(), m_styleText, result, m_element->document()->elementSheet()->contents());
     return true;
 }
 
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.h b/Source/WebCore/inspector/InspectorStyleSheet.h
index 55556abdc..0af9f3c5a 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.h
+++ b/Source/WebCore/inspector/InspectorStyleSheet.h
@@ -272,7 +272,7 @@ protected:
 private:
     CSSStyleDeclaration* inlineStyle() const;
     const String& elementStyleText() const;
-    bool getStyleAttributeRanges(RefPtr<CSSStyleSourceData>* result) const;
+    bool getStyleAttributeRanges(CSSRuleSourceData* result) const;
 
     RefPtr<Element> m_element;
     RefPtr<CSSRuleSourceData> m_ruleSourceData;
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index 47282e957..1d8b1bc7f 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -40,6 +40,7 @@
 #include "InspectorClient.h"
 #include "InspectorCounters.h"
 #include "InspectorFrontend.h"
+#include "InspectorInstrumentation.h"
 #include "InspectorPageAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
@@ -60,6 +61,8 @@ static const char includeMemoryDetails[] = "includeMemoryDetails";
 
 // Must be kept in sync with WebInspector.TimelineModel.RecordType in TimelineModel.js
 namespace TimelineRecordType {
+static const char Program[] = "Program";
+
 static const char EventDispatch[] = "EventDispatch";
 static const char BeginFrame[] = "BeginFrame";
 static const char Layout[] = "Layout";
@@ -79,6 +82,8 @@ static const char MarkLoad[] = "MarkLoad";
 static const char MarkDOMContent[] = "MarkDOMContent";
 
 static const char TimeStamp[] = "TimeStamp";
+static const char Time[] = "Time";
+static const char TimeEnd[] = "TimeEnd";
 
 static const char ScheduleResourceRequest[] = "ScheduleResourceRequest";
 static const char ResourceSendRequest[] = "ResourceSendRequest";
@@ -192,12 +197,12 @@ void InspectorTimelineAgent::supportsFrameInstrumentation(ErrorString*, bool* re
 
 void InspectorTimelineAgent::didBeginFrame()
 {
-    pushCancelableRecord(InspectorObject::create(), TimelineRecordType::BeginFrame, 0);
+    m_pendingFrameRecord = TimelineRecordFactory::createGenericRecord(timestamp(), 0);
 }
 
 void InspectorTimelineAgent::didCancelFrame()
 {
-    cancelRecord(TimelineRecordType::BeginFrame);
+    m_pendingFrameRecord.clear();
 }
 
 void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scriptLine, Frame* frame)
@@ -242,7 +247,7 @@ void InspectorTimelineAgent::didRecalculateStyle()
 
 void InspectorTimelineAgent::willPaint(const LayoutRect& rect, Frame* frame)
 {
-    pushCurrentRecord(TimelineRecordFactory::createPaintData(rect), TimelineRecordType::Paint, true, frame);
+    pushCurrentRecord(TimelineRecordFactory::createPaintData(rect), TimelineRecordType::Paint, true, frame, true);
 }
 
 void InspectorTimelineAgent::didPaint()
@@ -318,7 +323,7 @@ void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumbe
 {
     pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptData(url, lineNumber), TimelineRecordType::EvaluateScript, true, frame);
 }
-    
+
 void InspectorTimelineAgent::didEvaluateScript()
 {
     didCompleteCurrentRecord(TimelineRecordType::EvaluateScript);
@@ -340,23 +345,23 @@ void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, c
         String frameId(m_pageAgent->frameId(frame));
         recordRaw->setString("frameId", frameId);
     }
-    setHeapSizeStatistic(recordRaw.get());
+    setHeapSizeStatistics(recordRaw.get());
     // FIXME: runtimeCast is a hack. We do it because we can't build TimelineEvent directly now.
     RefPtr<TypeBuilder::Timeline::TimelineEvent> record = TypeBuilder::Timeline::TimelineEvent::runtimeCast(recordRaw.release());
     m_frontend->eventRecorded(record.release());
 }
 
-void InspectorTimelineAgent::willReceiveResourceData(unsigned long identifier, Frame* frame)
+void InspectorTimelineAgent::willReceiveResourceData(unsigned long identifier, Frame* frame, int length)
 {
     String requestId = IdentifiersFactory::requestId(identifier);
-    pushCurrentRecord(TimelineRecordFactory::createReceiveResourceData(requestId), TimelineRecordType::ResourceReceivedData, false, frame);
+    pushCurrentRecord(TimelineRecordFactory::createReceiveResourceData(requestId, length), TimelineRecordType::ResourceReceivedData, false, frame);
 }
 
 void InspectorTimelineAgent::didReceiveResourceData()
 {
     didCompleteCurrentRecord(TimelineRecordType::ResourceReceivedData);
 }
-    
+
 void InspectorTimelineAgent::willReceiveResourceResponse(unsigned long identifier, const ResourceResponse& response, Frame* frame)
 {
     String requestId = IdentifiersFactory::requestId(identifier);
@@ -378,6 +383,16 @@ void InspectorTimelineAgent::didTimeStamp(const String& message)
     appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::TimeStamp, true, 0);
 }
 
+void InspectorTimelineAgent::time(const String& message)
+{
+    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::Time, true, 0);
+}
+
+void InspectorTimelineAgent::timeEnd(const String& message)
+{
+    appendRecord(TimelineRecordFactory::createTimeStampData(message), TimelineRecordType::TimeEnd, true, 0);
+}
+
 void InspectorTimelineAgent::didMarkDOMContentEvent(Frame* frame)
 {
     appendRecord(InspectorObject::create(), TimelineRecordType::MarkDOMContent, false, frame);
@@ -415,27 +430,31 @@ void InspectorTimelineAgent::didFireAnimationFrame()
 
 void InspectorTimelineAgent::willProcessTask()
 {
-    // TODO: Record task processing start time.
+    pushCurrentRecord(InspectorObject::create(), TimelineRecordType::Program, false, 0);
 }
 
 void InspectorTimelineAgent::didProcessTask()
 {
-    // TODO: Record task processing end time.
+    didCompleteCurrentRecord(TimelineRecordType::Program);
 }
 
 void InspectorTimelineAgent::addRecordToTimeline(PassRefPtr<InspectorObject> record, const String& type, const String& frameId)
 {
-    commitCancelableRecords();
+    commitFrameRecord();
     innerAddRecordToTimeline(record, type, frameId);
 }
 
 void InspectorTimelineAgent::innerAddRecordToTimeline(PassRefPtr<InspectorObject> prpRecord, const String& type, const String& frameId)
 {
+    DEFINE_STATIC_LOCAL(String, program, (TimelineRecordType::Program));
+
     RefPtr<InspectorObject> record(prpRecord);
     record->setString("type", type);
     if (!frameId.isEmpty())
         record->setString("frameId", frameId);
-    setHeapSizeStatistic(record.get());
+    if (type != program)
+        setHeapSizeStatistics(record.get());
+
     if (m_recordStack.isEmpty()) {
         // FIXME: runtimeCast is a hack. We do it because we can't build TimelineEvent directly now.
         RefPtr<TypeBuilder::Timeline::TimelineEvent> recordChecked = TypeBuilder::Timeline::TimelineEvent::runtimeCast(record.release());
@@ -446,7 +465,7 @@ void InspectorTimelineAgent::innerAddRecordToTimeline(PassRefPtr<InspectorObject
     }
 }
 
-void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
+void InspectorTimelineAgent::setHeapSizeStatistics(InspectorObject* record)
 {
     size_t usedHeapSize = 0;
     size_t totalHeapSize = 0;
@@ -469,6 +488,11 @@ void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
     // An empty stack could merely mean that the timeline agent was turned on in the middle of
     // an event.  Don't treat as an error.
     if (!m_recordStack.isEmpty()) {
+        if (m_orphanEventsEnabledStackMark == m_recordStack.size()) {
+            m_orphanEventsEnabledStackMark = 0;
+            InspectorInstrumentation::setTimelineAgentForOrphanEvents(0);
+        }
+
         pushGCEventRecords();
         TimelineRecordEntry entry = m_recordStack.last();
         m_recordStack.removeLast();
@@ -487,6 +511,7 @@ InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentin
     , m_timestampOffset(0)
     , m_id(1)
     , m_maxCallStackDepth(5)
+    , m_orphanEventsEnabledStackMark(0)
     , m_inspectorType(type)
     , m_client(client)
 {
@@ -504,55 +529,33 @@ void InspectorTimelineAgent::appendRecord(PassRefPtr<InspectorObject> data, cons
     addRecordToTimeline(record.release(), type, frameId);
 }
 
-void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack, Frame* frame)
+void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack, Frame* frame, bool hasOrphanDetails)
 {
     pushGCEventRecords();
-    commitCancelableRecords();
+    commitFrameRecord();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), captureCallStack ? m_maxCallStackDepth : 0);
     String frameId;
     if (frame && m_pageAgent)
         frameId = m_pageAgent->frameId(frame);
     m_recordStack.append(TimelineRecordEntry(record.release(), data, InspectorArray::create(), type, frameId));
-}
-
-void InspectorTimelineAgent::pushCancelableRecord(PassRefPtr<InspectorObject> data, const String& type, Frame* frame)
-{
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), 0);
-    String frameId;
-    if (frame && m_pageAgent)
-        frameId = m_pageAgent->frameId(frame);
-    m_recordStack.append(TimelineRecordEntry(record.release(), data, 0, type, frameId, true));
-}
-
-void InspectorTimelineAgent::commitCancelableRecords()
-{
-    Vector<TimelineRecordEntry> cancelableRecords;
-    while (!m_recordStack.isEmpty()) {
-        TimelineRecordEntry entry = m_recordStack.last();
-        if (!m_recordStack.last().cancelable)
-            break;
-        m_recordStack.removeLast();
-        cancelableRecords.append(entry);
-    }
-    while (!cancelableRecords.isEmpty()) {
-        TimelineRecordEntry entry = cancelableRecords.last();
-        cancelableRecords.removeLast();
-        entry.record->setObject("data", entry.data);
-        innerAddRecordToTimeline(entry.record.release(), entry.type, entry.frameId);
+    if (hasOrphanDetails && !m_orphanEventsEnabledStackMark && !InspectorInstrumentation::timelineAgentForOrphanEvents()) {
+        m_orphanEventsEnabledStackMark = m_recordStack.size();
+        InspectorInstrumentation::setTimelineAgentForOrphanEvents(this);
     }
 }
 
-void InspectorTimelineAgent::cancelRecord(const String& type)
+void InspectorTimelineAgent::commitFrameRecord()
 {
-    if (m_recordStack.isEmpty())
+    if (!m_pendingFrameRecord)
         return;
-    TimelineRecordEntry entry = m_recordStack.last();
-    if (entry.cancelable && entry.type == type)
-        m_recordStack.removeLast();
+    
+    m_pendingFrameRecord->setObject("data", InspectorObject::create());
+    innerAddRecordToTimeline(m_pendingFrameRecord.release(), TimelineRecordType::BeginFrame, "");
 }
 
 void InspectorTimelineAgent::clearRecordStack()
 {
+    m_pendingFrameRecord.clear();
     m_recordStack.clear();
     m_id++;
 }
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index 94c7fcaee..2961b7720 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -125,12 +125,15 @@ public:
     void didMarkDOMContentEvent(Frame*);
     void didMarkLoadEvent(Frame*);
 
+    void time(const String&);
+    void timeEnd(const String&);
+
     void didScheduleResourceRequest(const String& url, Frame*);
     void willSendResourceRequest(unsigned long, const ResourceRequest&, Frame*);
     void willReceiveResourceResponse(unsigned long, const ResourceResponse&, Frame*);
     void didReceiveResourceResponse();
     void didFinishLoadingResource(unsigned long, bool didFail, double finishTime, Frame*);
-    void willReceiveResourceData(unsigned long identifier, Frame*);
+    void willReceiveResourceData(unsigned long identifier, Frame*, int length);
     void didReceiveResourceData();
 
     void didRequestAnimationFrame(int callbackId, Frame*);
@@ -145,8 +148,8 @@ public:
 
 private:
     struct TimelineRecordEntry {
-        TimelineRecordEntry(PassRefPtr<InspectorObject> record, PassRefPtr<InspectorObject> data, PassRefPtr<InspectorArray> children, const String& type, const String& frameId, bool cancelable = false)
-            : record(record), data(data), children(children), type(type), frameId(frameId), cancelable(cancelable)
+        TimelineRecordEntry(PassRefPtr<InspectorObject> record, PassRefPtr<InspectorObject> data, PassRefPtr<InspectorArray> children, const String& type, const String& frameId)
+            : record(record), data(data), children(children), type(type), frameId(frameId)
         {
         }
         RefPtr<InspectorObject> record;
@@ -154,19 +157,16 @@ private:
         RefPtr<InspectorArray> children;
         String type;
         String frameId;
-        bool cancelable;
     };
         
     InspectorTimelineAgent(InstrumentingAgents*, InspectorPageAgent*, InspectorState*, InspectorType, InspectorClient*);
 
-    void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type, bool captureCallStack, Frame*);
-    void setHeapSizeStatistic(InspectorObject* record);
-        
+    void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type, bool captureCallStack, Frame*, bool hasOrphanDetails = false);
+    void setHeapSizeStatistics(InspectorObject* record);
+
     void didCompleteCurrentRecord(const String& type);
+    void commitFrameRecord();
     void appendRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack, Frame*);
-    void pushCancelableRecord(PassRefPtr<InspectorObject>, const String& type, Frame*);
-    void commitCancelableRecords();
-    void cancelRecord(const String& type);
     void addRecordToTimeline(PassRefPtr<InspectorObject>, const String& type, const String& frameId);
     void innerAddRecordToTimeline(PassRefPtr<InspectorObject>, const String& type, const String& frameId);
 
@@ -196,6 +196,8 @@ private:
     typedef Vector<GCEvent> GCEvents;
     GCEvents m_gcEvents;
     int m_maxCallStackDepth;
+    unsigned m_orphanEventsEnabledStackMark;
+    RefPtr<InspectorObject> m_pendingFrameRecord;
     InspectorType m_inspectorType;
     InspectorClient* m_client;
 };
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.cpp b/Source/WebCore/inspector/TimelineRecordFactory.cpp
index 152be3aef..6f3b4aacf 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/Source/WebCore/inspector/TimelineRecordFactory.cpp
@@ -161,10 +161,11 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createResourceFinishData(cons
     return data.release();
 }
 
-PassRefPtr<InspectorObject> TimelineRecordFactory::createReceiveResourceData(const String& requestId)
+PassRefPtr<InspectorObject> TimelineRecordFactory::createReceiveResourceData(const String& requestId, int length)
 {
     RefPtr<InspectorObject> data = InspectorObject::create();
     data->setString("requestId", requestId);
+    data->setNumber("encodedDataLength", length);
     return data.release();
 }
     
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.h b/Source/WebCore/inspector/TimelineRecordFactory.h
index 5d3e5aeba..555f232af 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.h
+++ b/Source/WebCore/inspector/TimelineRecordFactory.h
@@ -71,7 +71,7 @@ namespace WebCore {
 
         static PassRefPtr<InspectorObject> createResourceReceiveResponseData(const String& requestId, const ResourceResponse&);
 
-        static PassRefPtr<InspectorObject> createReceiveResourceData(const String& requestId);
+        static PassRefPtr<InspectorObject> createReceiveResourceData(const String& requestId, int length);
 
         static PassRefPtr<InspectorObject> createResourceFinishData(const String& requestId, bool didFail, double finishTime);
 
diff --git a/Source/WebCore/inspector/compile-front-end.py b/Source/WebCore/inspector/compile-front-end.py
index c32815be7..97a61717f 100755
--- a/Source/WebCore/inspector/compile-front-end.py
+++ b/Source/WebCore/inspector/compile-front-end.py
@@ -79,7 +79,6 @@ modules = [
             "DOMAgent.js",
             "DOMStorage.js",
             "DebuggerModel.js",
-            "DebuggerResourceBinding.js",
             "DebuggerScriptMapping.js",
             "FileManager.js",
             "FileSystemModel.js",
@@ -106,6 +105,7 @@ modules = [
             "NetworkRequest.js",
             "UISourceCode.js",
             "UserAgentSupport.js",
+            "Workspace.js",
         ]
     },
     {
@@ -141,10 +141,10 @@ modules = [
             "SplitView.js",
             "StatusBarButton.js",
             "TabbedPane.js",
-            "TextEditorModel.js",
+            "TextEditor.js",
             "TextEditorHighlighter.js",
+            "TextEditorModel.js",
             "TextPrompt.js",
-            "TextViewer.js",
             "Toolbar.js",
             "UIUtils.js",
             "View.js",
@@ -210,7 +210,10 @@ modules = [
             "CookieItemsView.js",
             "DatabaseQueryView.js",
             "DatabaseTableView.js",
+            "DirectoryContentView.js",
             "DOMStorageItemsView.js",
+            "FileContentView.js",
+            "FileSystemView.js",
             "IndexedDBViews.js",
             "ResourcesPanel.js",
         ]
diff --git a/Source/WebCore/inspector/front-end/AdvancedSearchController.js b/Source/WebCore/inspector/front-end/AdvancedSearchController.js
index d7ec214f3..b82f77485 100644
--- a/Source/WebCore/inspector/front-end/AdvancedSearchController.js
+++ b/Source/WebCore/inspector/front-end/AdvancedSearchController.js
@@ -172,7 +172,7 @@ WebInspector.AdvancedSearchController.prototype = {
 WebInspector.SearchView = function(controller)
 {
     WebInspector.View.call(this);
-    this.registerRequiredCSS("textViewer.css");
+    this.registerRequiredCSS("textEditor.css");
     
     this._controller = controller;
 
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 67c0b001a..1bccada70 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -335,6 +335,14 @@ WebInspector.CSSStyleModel.prototype = {
             return;
         }
         this._resourceBinding._requestViaInspectorResource(rule.id.styleSheetId, callback);
+    },
+
+    /**
+     * @return {WebInspector.CSSStyleModelResourceBinding}
+     */
+    resourceBinding: function()
+    {
+        return this._resourceBinding;
     }
 }
 
@@ -926,7 +934,6 @@ WebInspector.CSSStyleSheet.prototype = {
 
 /**
  * @constructor
- * @implements {WebInspector.ResourceDomainModelBinding}
  */
 WebInspector.CSSStyleModelResourceBinding = function(cssModel)
 {
@@ -935,21 +942,18 @@ WebInspector.CSSStyleModelResourceBinding = function(cssModel)
     this._styleSheetIdToHeader = {};
     this._cssModel.addEventListener(WebInspector.CSSStyleModel.Events.StyleSheetChanged, this._styleSheetChanged, this);
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.InspectedURLChanged, this._inspectedURLChanged, this);
-    WebInspector.Resource.registerDomainModelBinding(WebInspector.resourceTypes.Stylesheet, this);
 }
 
 WebInspector.CSSStyleModelResourceBinding.prototype = {
     /**
-     * @param {WebInspector.Resource} resource
+     * @param {WebInspector.StyleSource} styleSource
      * @param {string} content
      * @param {boolean} majorChange
      * @param {function(?string)} userCallback
      */
-    setContent: function(resource, content, majorChange, userCallback)
+    setStyleContent: function(styleSource, content, majorChange, userCallback)
     {
-        if (majorChange && resource.type === WebInspector.resourceTypes.Stylesheet)
-            resource.addRevision(content);
-
+        var resource = styleSource.resource();
         if (this._styleSheetIdForResource(resource)) {
             this._innerSetContent(resource, content, majorChange, userCallback, null);
             return;
@@ -958,14 +962,6 @@ WebInspector.CSSStyleModelResourceBinding.prototype = {
     },
 
     /**
-     * @return {boolean}
-     */
-    canSetContent: function()
-    {
-        return true;
-    },
-
-    /**
      * @param {WebInspector.Resource} resource
      * @return {CSSAgent.StyleSheetId}
      */
@@ -1174,8 +1170,6 @@ WebInspector.CSSStyleModelResourceBinding.prototype = {
     }
 }
 
-WebInspector.CSSStyleModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
-
 /**
  * @constructor
  * @implements {CSSAgent.Dispatcher}
diff --git a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
index d2c917614..df5ca2cb3 100644
--- a/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/CompilerScriptMapping.js
@@ -162,10 +162,6 @@ WebInspector.CompilerScriptMapping.prototype = {
 
     reset: function()
     {
-        var uiSourceCodes = this.uiSourceCodes();
-        for (var i = 0; i < uiSourceCodes.length; ++i)
-            this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, uiSourceCodes[i]);
-
         this._sourceMapByURL = {};
         this._sourceMapForScriptId = {};
         this._scriptForSourceMap = new Map();
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index c06e947b6..4dfed1a83 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -712,6 +712,36 @@ WebInspector.ConsoleView.prototype = {
         this._appendCommand(str, "", true, false);
     },
 
+    runScript: function(scriptId)
+    {
+        var contextId = WebInspector.consoleView._currentEvaluationContextId();
+        DebuggerAgent.runScript(scriptId, contextId, "console", false, runCallback.bind(this));
+        WebInspector.userMetrics.ConsoleEvaluated.record();
+
+        /**
+         * @param {?string} error
+         * @param {?RuntimeAgent.RemoteObject} result
+         * @param {boolean=} wasThrown
+         */
+        function runCallback(error, result, wasThrown)
+        {
+            if (error) {
+                console.error(error);
+                return;
+            }
+            
+            this._printResult(result, wasThrown);
+        }
+    },
+
+    _printResult: function(result, wasThrown)
+    {
+        if (!result)
+            return;
+
+        this._appendConsoleMessage(new WebInspector.ConsoleCommandResult(result, wasThrown, null, this._linkifier));
+    },
+
     _appendCommand: function(text, newPromptText, useCommandLineAPI, showResultOnly)
     {
         if (!showResultOnly) {
@@ -730,8 +760,8 @@ WebInspector.ConsoleView.prototype = {
                 this.prompt.pushHistoryItem(text);
                 WebInspector.settings.consoleHistory.set(this.prompt.historyData.slice(-30));
             }
-
-            this._appendConsoleMessage(new WebInspector.ConsoleCommandResult(result, wasThrown, commandMessage, this._linkifier));
+            
+            this._printResult(result, wasThrown);
         }
         this.evalInInspectedWindow(text, "console", useCommandLineAPI, false, false, printResult.bind(this));
 
diff --git a/Source/WebCore/inspector/front-end/DebuggerResourceBinding.js b/Source/WebCore/inspector/front-end/DebuggerResourceBinding.js
deleted file mode 100644
index 5094462f3..000000000
--- a/Source/WebCore/inspector/front-end/DebuggerResourceBinding.js
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @constructor
- * @implements {WebInspector.ResourceDomainModelBinding}
- * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
- */
-WebInspector.DebuggerResourceBinding = function(uiSourceCodeProvider)
-{
-    this._uiSourceCodeProvider = uiSourceCodeProvider;
-    WebInspector.Resource.registerDomainModelBinding(WebInspector.resourceTypes.Script, this);
-}
-
-/**
- * @param {WebInspector.JavaScriptSource} javaScriptSource
- * @param {string} newSource
- * @param {function(?Protocol.Error)} callback
- */
-WebInspector.DebuggerResourceBinding.setScriptSource = function(javaScriptSource, newSource, callback)
-{
-    var rawLocation = javaScriptSource.uiLocationToRawLocation(0, 0);
-    var script = WebInspector.debuggerModel.scriptForId(rawLocation.scriptId);
-
-    /**
-     * @this {WebInspector.DebuggerResourceBinding}
-     * @param {?Protocol.Error} error
-     */
-    function didEditScriptSource(error)
-    {
-        if (error) {
-            callback(error);
-            return;
-        }
-
-        var resource = javaScriptSource.resource();
-        if (resource)
-            resource.addRevision(newSource);
-
-        callback(null);
-    }
-    WebInspector.debuggerModel.setScriptSource(script.scriptId, newSource, didEditScriptSource.bind(this));
-}
-
-WebInspector.DebuggerResourceBinding.prototype = {
-    /**
-     * @param {WebInspector.Resource} resource
-     * @return {boolean}
-     */
-    canSetContent: function(resource)
-    {
-        var uiSourceCode = resource.uiSourceCode();
-        return !!uiSourceCode && uiSourceCode.isEditable();
-    },
-
-    /**
-     * @param {WebInspector.Resource} resource
-     * @param {string} content
-     * @param {boolean} majorChange
-     * @param {function(?string)} userCallback
-     */
-    setContent: function(resource, content, majorChange, userCallback)
-    {
-        if (!majorChange)
-            return;
-
-        var javaScriptSource = /** @type {WebInspector.JavaScriptSource} */ resource.uiSourceCode();
-        if (!javaScriptSource) {
-            userCallback("Resource is not editable");
-            return;
-        }
-
-        resource.requestContent(this._setContentWithInitialContent.bind(this, javaScriptSource, content, userCallback));
-    },
-
-    /**
-     * @param {WebInspector.JavaScriptSource} javaScriptSource
-     * @param {string} content
-     * @param {function(?string)} userCallback
-     * @param {?string} oldContent
-     * @param {boolean} oldContentEncoded
-     * @param {string} mimeType
-     */
-    _setContentWithInitialContent: function(javaScriptSource, content, userCallback, oldContent, oldContentEncoded, mimeType)
-    {
-        /**
-         * @this {WebInspector.DebuggerResourceBinding}
-         * @param {?string} error
-         */
-        function callback(error)
-        {
-            if (userCallback)
-                userCallback(error);
-        }
-        WebInspector.DebuggerResourceBinding.setScriptSource(javaScriptSource, content, callback.bind(this));
-    }
-}
-
-WebInspector.DebuggerResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
diff --git a/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js b/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
index 1e5bc06ea..9c5034a49 100644
--- a/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/DebuggerScriptMapping.js
@@ -44,7 +44,6 @@ WebInspector.DebuggerScriptMapping = function()
 
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._parsedScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, this._debuggerReset, this);
 }
 
 WebInspector.DebuggerScriptMapping.prototype = {
@@ -83,11 +82,5 @@ WebInspector.DebuggerScriptMapping.prototype = {
         }
 
         return this._resourceMapping;
-    },
-
-    _debuggerReset: function()
-    {
-        for (var i = 0; i < this._mappings.length; ++i)
-            this._mappings[i].reset();
     }
 }
diff --git a/Source/WebCore/inspector/front-end/DirectoryContentView.js b/Source/WebCore/inspector/front-end/DirectoryContentView.js
new file mode 100644
index 000000000..21ced2515
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/DirectoryContentView.js
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.DataGrid}
+ */
+WebInspector.DirectoryContentView = function()
+{
+    const indexes = WebInspector.DirectoryContentView.columnIndexes;
+    var columns = {};
+    columns[indexes.Name] = {};
+    columns[indexes.Name].title = WebInspector.UIString("Name");
+    columns[indexes.Name].sort = "ascending";
+    columns[indexes.Name].sortable = true;
+    columns[indexes.Name].width = "20%";
+    columns[indexes.URL] = {};
+    columns[indexes.URL].title = WebInspector.UIString("URL");
+    columns[indexes.URL].sortable = true;
+    columns[indexes.URL].width = "20%";
+    columns[indexes.Type] = {};
+    columns[indexes.Type].title = WebInspector.UIString("Type");
+    columns[indexes.Type].sortable = true;
+    columns[indexes.Type].width = "15%";
+    columns[indexes.Size] = {};
+    columns[indexes.Size].title = WebInspector.UIString("Size");
+    columns[indexes.Size].sortable = true;
+    columns[indexes.Size].width = "10%";
+    columns[indexes.ModificationTime] = {};
+    columns[indexes.ModificationTime].title = WebInspector.UIString("Modification Time");
+    columns[indexes.ModificationTime].sortable = true;
+    columns[indexes.ModificationTime].width = "25%";
+
+    WebInspector.DataGrid.call(this, columns);
+    this.addEventListener("sorting changed", this._sort, this);
+}
+
+WebInspector.DirectoryContentView.columnIndexes = {
+    Name: "0",
+    URL: "1",
+    Type: "2",
+    Size: "3",
+    ModificationTime: "4"
+}
+
+WebInspector.DirectoryContentView.prototype = {
+    /**
+     * @param {Array.<WebInspector.FileSystemModel.Directory>} entries
+     */
+    showEntries: function(entries)
+    {
+        const indexes = WebInspector.DirectoryContentView.columnIndexes;
+        this.rootNode().removeChildren();
+        for (var i = 0; i < entries.length; ++i)
+            this.rootNode().appendChild(new WebInspector.DirectoryContentView.Node(entries[i]));
+    },
+
+    _sort: function()
+    {
+        var column = /** @type {string} */ this.sortColumnIdentifier;
+        this.sortNodes(WebInspector.DirectoryContentView.Node.comparator(column, this.sortOrder === "descending"), false);
+    }
+}
+
+WebInspector.DirectoryContentView.prototype.__proto__ = WebInspector.DataGrid.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.DataGridNode}
+ * @param {WebInspector.FileSystemModel.Entry} entry
+ */
+WebInspector.DirectoryContentView.Node = function(entry)
+{
+    const indexes = WebInspector.DirectoryContentView.columnIndexes;
+    var data = {};
+    data[indexes.Name] = entry.name;
+    data[indexes.URL] = entry.url;
+    data[indexes.Type] = entry.isDirectory ? WebInspector.UIString("Directory") : entry.mimeType;
+    data[indexes.Size] = "";
+    data[indexes.ModificationTime] = "";
+
+    WebInspector.DataGridNode.call(this, data);
+    this._entry = entry;
+    this._metadata = null;
+
+    this._entry.requestMetadata(this._metadataReceived.bind(this));
+}
+
+/**
+ * @param {string} column
+ * @param {boolean} reverse
+ */
+WebInspector.DirectoryContentView.Node.comparator = function(column, reverse)
+{
+    var reverseFactor = reverse ? -1 : 1;
+    const indexes = WebInspector.DirectoryContentView.columnIndexes;
+
+    switch (column) {
+    case indexes.Name:
+    case indexes.URL:
+        return function(x, y)
+        {
+            return isDirectoryCompare(x, y) || nameCompare(x, y);
+        };
+    case indexes.Type:
+        return function(x, y)
+        {
+            return isDirectoryCompare(x ,y) || typeCompare(x, y) || nameCompare(x, y);
+        };
+    case indexes.Size:
+        return function(x, y)
+        {
+            return isDirectoryCompare(x, y) || sizeCompare(x, y) || nameCompare(x, y);
+        };
+    case indexes.ModificationTime:
+        return function(x, y)
+        {
+            return isDirectoryCompare(x, y) || modificationTimeCompare(x, y) || nameCompare(x, y);
+        };
+    }
+
+    function isDirectoryCompare(x, y)
+    {
+        if (x._entry.isDirectory != y._entry.isDirectory)
+            return y._entry.isDirectory ? 1 : -1;
+        return 0;
+    }
+
+    function nameCompare(x, y)
+    {
+        return reverseFactor * x._entry.name.localeCompare(y._entry.name);
+    }
+
+    function typeCompare(x, y)
+    {
+        return reverseFactor * (x._entry.mimeType || "").localeCompare(y._entry.mimeType || "");
+    }
+
+    function sizeCompare(x, y)
+    {
+        return reverseFactor * ((x._metadata ? x._metadata.size : 0) - (y._metadata ? y._metadata.size : 0));
+    }
+
+    function modificationTimeCompare(x, y)
+    {
+        return reverseFactor * ((x._metadata ? x._metadata.modificationTime : 0) - (y._metadata ? y._metadata.modificationTime : 0));
+    }
+}
+
+WebInspector.DirectoryContentView.Node.prototype = {
+    /**
+     * @param {number} errorCode
+     * @param {FileSystemAgent.Metadata} metadata
+     */
+    _metadataReceived: function(errorCode, metadata)
+    {
+        const indexes = WebInspector.DirectoryContentView.columnIndexes;
+        if (errorCode !== 0)
+            return;
+
+        this._metadata = metadata;
+        var data = this.data;
+        if (this._entry.isDirectory)
+            data[indexes.Size] = WebInspector.UIString("-");
+        else
+            data[indexes.Size] = Number.bytesToString(metadata.size);
+        data[indexes.ModificationTime] = new Date(metadata.modificationTime).toGMTString();
+        this.data = data;
+    }
+}
+
+WebInspector.DirectoryContentView.Node.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 3ad2534aa..3feaf354f 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -55,7 +55,7 @@ WebInspector.ElementsPanel = function()
 
     this.contentElement.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 
-    this.treeOutline = new WebInspector.ElementsTreeOutline(true, true, false, this._populateContextMenu.bind(this));
+    this.treeOutline = new WebInspector.ElementsTreeOutline(true, true, false, this._populateContextMenu.bind(this), this._setPseudoClassForNodeId.bind(this));
     this.treeOutline.wireToDomAgent();
 
     this.treeOutline.addEventListener(WebInspector.ElementsTreeOutline.Events.SelectedNodeChanged, this._selectedNodeChanged, this);
@@ -67,7 +67,7 @@ WebInspector.ElementsPanel = function()
 
     this.sidebarPanes = {};
     this.sidebarPanes.computedStyle = new WebInspector.ComputedStyleSidebarPane();
-    this.sidebarPanes.styles = new WebInspector.StylesSidebarPane(this.sidebarPanes.computedStyle);
+    this.sidebarPanes.styles = new WebInspector.StylesSidebarPane(this.sidebarPanes.computedStyle, this._setPseudoClassForNodeId.bind(this));
     this.sidebarPanes.metrics = new WebInspector.MetricsSidebarPane();
     this.sidebarPanes.properties = new WebInspector.PropertiesSidebarPane();
     this.sidebarPanes.domBreakpoints = WebInspector.domBreakpointsSidebarPane;
@@ -166,6 +166,37 @@ WebInspector.ElementsPanel.prototype = {
         this.updateBreadcrumbSizes();
     },
 
+    /**
+     * @param {DOMAgent.NodeId} nodeId
+     * @param {string} pseudoClass
+     * @param {boolean} enable
+     */
+    _setPseudoClassForNodeId: function(nodeId, pseudoClass, enable)
+    {
+        var node = WebInspector.domAgent.nodeForId(nodeId);
+        if (!node)
+            return;
+
+        var pseudoClasses = node.getUserProperty("pseudoState");
+        if (enable) {
+            pseudoClasses = pseudoClasses || [];
+            if (pseudoClasses.indexOf(pseudoClass) >= 0)
+                return;
+            pseudoClasses.push(pseudoClass);
+            node.setUserProperty("pseudoState", pseudoClasses);
+        } else {
+            if (!pseudoClasses || pseudoClasses.indexOf(pseudoClass) < 0)
+                return;
+            pseudoClasses.remove(pseudoClass);
+            if (!pseudoClasses.length)
+                node.removeUserProperty("pseudoState");
+        }
+
+        this.treeOutline.updateOpenCloseTags(node);
+        this._metricsPaneEdited();
+        this._stylesPaneEdited();
+    },
+
     _selectedNodeChanged: function()
     {
         var selectedNode = this.selectedDOMNode();
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 233c54e15..46c0e3354 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -35,8 +35,9 @@
  * @param {boolean=} selectEnabled
  * @param {boolean=} showInElementsPanelEnabled
  * @param {function(WebInspector.ContextMenu, WebInspector.DOMNode)=} contextMenuCallback
+ * @param {function(DOMAgent.NodeId, string, boolean)=} setPseudoClassCallback
  */
-WebInspector.ElementsTreeOutline = function(omitRootDOMNode, selectEnabled, showInElementsPanelEnabled, contextMenuCallback)
+WebInspector.ElementsTreeOutline = function(omitRootDOMNode, selectEnabled, showInElementsPanelEnabled, contextMenuCallback, setPseudoClassCallback)
 {
     this.element = document.createElement("ol");
     this.element.addEventListener("mousedown", this._onmousedown.bind(this), false);
@@ -62,6 +63,8 @@ WebInspector.ElementsTreeOutline = function(omitRootDOMNode, selectEnabled, show
 
     this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
     this._contextMenuCallback = contextMenuCallback;
+    this._setPseudoClassCallback = setPseudoClassCallback;
+    this._createNodeDecorators();
 }
 
 WebInspector.ElementsTreeOutline.Events = {
@@ -69,6 +72,12 @@ WebInspector.ElementsTreeOutline.Events = {
 }
 
 WebInspector.ElementsTreeOutline.prototype = {
+    _createNodeDecorators: function()
+    {
+        this._nodeDecorators = [];
+        this._nodeDecorators.push(new WebInspector.ElementsTreeOutline.PseudoStateDecorator());
+    },
+
     wireToDomAgent: function()
     {
         this._elementsTreeUpdater = new WebInspector.ElementsTreeUpdater(this);
@@ -182,11 +191,28 @@ WebInspector.ElementsTreeOutline.prototype = {
         element.updateSelection();
     },
 
+    /**
+     * @param {WebInspector.DOMNode} node
+     */
+    updateOpenCloseTags: function(node)
+    {
+        var treeElement = this.findTreeElement(node);
+        if (treeElement)
+            treeElement.updateTitle();
+        var children = treeElement.children;
+        var closingTagElement = children[children.length - 1];
+        if (closingTagElement && closingTagElement._elementCloseTag)
+            closingTagElement.updateTitle();
+    },
+
     _selectedNodeChanged: function()
     {
         this._eventSupport.dispatchEventToListeners(WebInspector.ElementsTreeOutline.Events.SelectedNodeChanged, this._selectedDOMNode);
     },
 
+    /**
+     * @param {WebInspector.DOMNode} node
+     */
     findTreeElement: function(node)
     {
         function isAncestorNode(ancestor, node)
@@ -208,6 +234,9 @@ WebInspector.ElementsTreeOutline.prototype = {
         return treeElement;
     },
 
+    /**
+     * @param {WebInspector.DOMNode} node
+     */
     createTreeElementFor: function(node)
     {
         var treeElement = this.findTreeElement(node);
@@ -554,6 +583,67 @@ WebInspector.ElementsTreeOutline.prototype = {
 WebInspector.ElementsTreeOutline.prototype.__proto__ = TreeOutline.prototype;
 
 /**
+ * @interface
+ */
+WebInspector.ElementsTreeOutline.ElementDecorator = function()
+{
+}
+
+WebInspector.ElementsTreeOutline.ElementDecorator.prototype = {
+    /**
+     * @param {WebInspector.DOMNode} node
+     */
+    decorate: function(node)
+    {
+    },
+
+    /**
+     * @param {WebInspector.DOMNode} node
+     */
+    decorateAncestor: function(node)
+    {
+    }
+}
+
+/**
+ * @constructor
+ * @implements {WebInspector.ElementsTreeOutline.ElementDecorator}
+ */
+WebInspector.ElementsTreeOutline.PseudoStateDecorator = function()
+{
+    WebInspector.ElementsTreeOutline.ElementDecorator.call(this);
+}
+
+WebInspector.ElementsTreeOutline.PseudoStateDecorator.PropertyName = "pseudoState";
+
+WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype = {
+    decorate: function(node)
+    {
+        if (node.nodeType() !== Node.ELEMENT_NODE)
+            return null;
+        var propertyValue = node.getUserProperty(WebInspector.ElementsTreeOutline.PseudoStateDecorator.PropertyName);
+        if (!propertyValue)
+            return null;
+        return WebInspector.UIString("Element state: %s", ":" + propertyValue.join(", :"));
+    },
+
+    decorateAncestor: function(node)
+    {
+        if (node.nodeType() !== Node.ELEMENT_NODE)
+            return null;
+
+        var descendantCount = node.descendantUserPropertyCount(WebInspector.ElementsTreeOutline.PseudoStateDecorator.PropertyName);
+        if (!descendantCount)
+            return null;
+        if (descendantCount === 1)
+            return WebInspector.UIString("%d descendant with forced state", descendantCount);
+        return WebInspector.UIString("%d descendants with forced state", descendantCount);
+    }
+}
+
+WebInspector.ElementsTreeOutline.PseudoStateDecorator.prototype.__proto__ = WebInspector.ElementsTreeOutline.ElementDecorator.prototype;
+
+/**
  * @constructor
  * @extends {TreeElement}
  * @param {boolean=} elementCloseTag
@@ -1064,9 +1154,29 @@ WebInspector.ElementsTreeElement.prototype = {
         if (attribute && !newAttribute)
             contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Edit attribute" : "Edit Attribute"), this._startEditingAttribute.bind(this, attribute, event.target));
         contextMenu.appendSeparator();
+        if (this.treeOutline._setPseudoClassCallback) {
+            var pseudoSubMenu = contextMenu.appendSubMenuItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Force element state" : "Force Element State"));
+            this._populateForcedPseudoStateItems(pseudoSubMenu);
+            contextMenu.appendSeparator();
+        }
 
         this._populateNodeContextMenu(contextMenu);
         this.treeOutline._populateContextMenu(contextMenu, this.representedObject);
+
+        contextMenu.appendSeparator();
+        contextMenu.appendItem(WebInspector.UIString(WebInspector.useLowerCaseMenuTitles() ? "Scroll into view" : "Scroll Into View"), this._scrollIntoView.bind(this)); 
+    },
+
+    _populateForcedPseudoStateItems: function(subMenu)
+    {
+        const pseudoClasses = ["active", "hover", "focus", "visited"];
+        var node = this.representedObject;
+        var forcedPseudoState = (node ? node.getUserProperty("pseudoState") : null) || [];
+        var elementsPanel = WebInspector.panels.elements;
+        for (var i = 0; i < pseudoClasses.length; ++i) {
+            var pseudoClassForced = forcedPseudoState.indexOf(pseudoClasses[i]) >= 0;
+            subMenu.appendCheckboxItem(":" + pseudoClasses[i], this.treeOutline._setPseudoClassCallback.bind(null, node.id, pseudoClasses[i], !pseudoClassForced), pseudoClassForced, false);
+        }
     },
 
     _populateTextContextMenu: function(contextMenu, textNode)
@@ -1167,6 +1277,26 @@ WebInspector.ElementsTreeElement.prototype = {
         removeZeroWidthSpaceRecursive(attribute);
 
         var config = new WebInspector.EditingConfig(this._attributeEditingCommitted.bind(this), this._editingCancelled.bind(this), attributeName);
+        
+        function handleKeyDownEvents(event)
+        {
+            var isMetaOrCtrl = WebInspector.isMac() ?
+                event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey :
+                event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
+            if (isEnterKey(event) && (event.isMetaOrCtrlForTest || !config.multiline || isMetaOrCtrl))
+                return "commit";
+            else if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Esc.code || event.keyIdentifier === "U+001B")
+                return "cancel";
+            else if (event.keyIdentifier === "U+0009") // Tab key
+                return "move-" + (event.shiftKey ? "backward" : "forward");
+            else {
+                WebInspector.handleElementValueModifications(event, attribute);
+                return "";
+            }
+        }
+
+        config.customFinishHandler = handleKeyDownEvents.bind(this);
+        
         this._editing = WebInspector.startEditing(attribute, config);
 
         window.getSelection().setBaseAndExtent(elementForSelection, 0, elementForSelection, 1);
@@ -1179,6 +1309,9 @@ WebInspector.ElementsTreeElement.prototype = {
         if (WebInspector.isBeingEdited(textNode))
             return true;
 
+        var container = textNode.enclosingNodeOrSelfWithClass("webkit-html-text-node");
+        if (container)
+            container.innerText = container.innerText; // Strip the CSS or JS highlighting if present.
         var config = new WebInspector.EditingConfig(this._textNodeEditingCommitted.bind(this), this._editingCancelled.bind(this));
         this._editing = WebInspector.startEditing(textNode, config);
         window.getSelection().setBaseAndExtent(textNode, 0, textNode, 1);
@@ -1466,6 +1599,7 @@ WebInspector.ElementsTreeElement.prototype = {
             highlightElement.className = "highlight";
             highlightElement.appendChild(this._nodeTitleInfo(WebInspector.linkifyURLAsNode).titleDOM);
             this.title = highlightElement;
+            this._updateDecorations();
             delete this._highlightResult;
         }
 
@@ -1476,6 +1610,46 @@ WebInspector.ElementsTreeElement.prototype = {
         this._highlightSearchResults();
     },
 
+    _createDecoratorElement: function()
+    {
+        var node = this.representedObject;
+        var decoratorMessages = [];
+        var parentDecoratorMessages = [];
+        for (var i = 0; i < this.treeOutline._nodeDecorators.length; ++i) {
+            var decorator = this.treeOutline._nodeDecorators[i];
+            var message = decorator.decorate(node);
+            if (message) {
+                decoratorMessages.push(message);
+                continue;
+            }
+
+            if (this.expanded || this._elementCloseTag)
+                continue;
+
+            message = decorator.decorateAncestor(node);
+            if (message)
+                parentDecoratorMessages.push(message)
+        }
+        if (!decoratorMessages.length && !parentDecoratorMessages.length)
+            return null;
+
+        var decoratorElement = document.createElement("div");
+        decoratorElement.addStyleClass("elements-gutter-decoration");
+        if (!decoratorMessages.length)
+            decoratorElement.addStyleClass("elements-has-decorated-children");
+        decoratorElement.title = decoratorMessages.concat(parentDecoratorMessages).join("\n");
+        return decoratorElement;
+    },
+
+    _updateDecorations: function()
+    {
+        if (this._decoratorElement && this._decoratorElement.parentElement)
+            this._decoratorElement.parentElement.removeChild(this._decoratorElement);
+        this._decoratorElement = this._createDecoratorElement();
+        if (this._decoratorElement && this.listItemElement)
+            this.listItemElement.insertBefore(this._decoratorElement, this.listItemElement.firstChild);
+    },
+
     /**
      * @param {WebInspector.DOMNode=} node
      * @param {function(string, string, string, boolean=, string=)=} linkify
@@ -1761,6 +1935,23 @@ WebInspector.ElementsTreeElement.prototype = {
 
         this._highlightResult = [];
         WebInspector.highlightSearchResults(this.listItemElement, matchRanges, this._highlightResult);
+    },
+
+    _scrollIntoView: function()
+    {
+        function scrollIntoViewCallback(object)
+        {
+            function scrollIntoView()
+            {
+                this.scrollIntoViewIfNeeded(true);
+            }
+
+            if (object)
+                object.callFunction(scrollIntoView);
+        }
+        
+        var node = /** @type {WebInspector.DOMNode} */ this.representedObject;
+        WebInspector.RemoteObject.resolveNode(node, "", scrollIntoViewCallback);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ExtensionServer.js b/Source/WebCore/inspector/front-end/ExtensionServer.js
index d55c26f2e..b835fb9d3 100644
--- a/Source/WebCore/inspector/front-end/ExtensionServer.js
+++ b/Source/WebCore/inspector/front-end/ExtensionServer.js
@@ -290,15 +290,17 @@ WebInspector.ExtensionServer.prototype = {
 
     _handleOpenURL: function(port, details)
     {
-        var resource = WebInspector.resourceForURL(details.url);
-        if (!resource)
+        var url = /** @type {string} */ details.url;
+        var contentProvider = WebInspector.workspace.uiSourceCodeForURL(url) || WebInspector.resourceForURL(url);
+        if (!contentProvider)
             return false;
+            
         var lineNumber = details.lineNumber;
         if (typeof lineNumber === "number")
             lineNumber += 1;
         port.postMessage({
             command: "open-resource",
-            resource: this._makeResource(resource),
+            resource: this._makeResource(contentProvider),
             lineNumber: lineNumber
         });
         return true;
@@ -424,26 +426,35 @@ WebInspector.ExtensionServer.prototype = {
         return harLog;
     },
 
-    _makeResource: function(resource)
+    /**
+     * @param {WebInspector.ContentProvider} contentProvider
+     */
+    _makeResource: function(contentProvider)
     {
         return {
-            url: resource.url,
-            type: resource.type.name()
+            url: contentProvider.contentURL(),
+            type: contentProvider.contentType().name()
         };
     },
 
     _onGetPageResources: function()
     {
-        var resources = [];
-        function pushResourceData(resource)
+        var resources = {};
+
+        function pushResourceData(contentProvider)
         {
-            resources.push(this._makeResource(resource));
+            if (!resources[contentProvider.contentURL()])
+                resources[contentProvider.contentURL()] = this._makeResource(contentProvider);
         }
+        WebInspector.workspace.uiSourceCodes().forEach(pushResourceData.bind(this));
         WebInspector.resourceTreeModel.forAllResources(pushResourceData.bind(this));
-        return resources;
+        return Object.values(resources);
     },
 
-    _getResourceContent: function(resource, message, port)
+    /**
+     * @param {WebInspector.ContentProvider} contentProvider
+     */
+    _getResourceContent: function(contentProvider, message, port)
     {
         /**
          * @param {?string} content
@@ -458,7 +469,7 @@ WebInspector.ExtensionServer.prototype = {
             };
             this._dispatchCallback(message.requestId, port, response);
         }
-        resource.requestContent(onContentAvailable.bind(this));
+        contentProvider.requestContent(onContentAvailable.bind(this));
     },
 
     _onGetRequestContent: function(message, port)
@@ -471,10 +482,11 @@ WebInspector.ExtensionServer.prototype = {
 
     _onGetResourceContent: function(message, port)
     {
-        var resource = WebInspector.resourceTreeModel.resourceForURL(message.url);
-        if (!resource)
-            return this._status.E_NOTFOUND(message.url);
-        this._getResourceContent(resource.uiSourceCode() || resource, message, port);
+        var url = /** @type {string} */ message.url;
+        var contentProvider = WebInspector.workspace.uiSourceCodeForURL(url) || WebInspector.resourceForURL(url);
+        if (!contentProvider)
+            return this._status.E_NOTFOUND(url);
+        this._getResourceContent(contentProvider, message, port);
     },
 
     _onSetResourceContent: function(message, port)
@@ -487,10 +499,20 @@ WebInspector.ExtensionServer.prototype = {
             var response = error ? this._status.E_FAILED(error) : this._status.OK();
             this._dispatchCallback(message.requestId, port, response);
         }
-        var resource = WebInspector.resourceTreeModel.resourceForURL(message.url);
-        if (!resource)
-            return this._status.E_NOTFOUND(message.url);
-        resource.setContent(message.content, message.commit, callbackWrapper.bind(this));
+
+        var url = /** @type {string} */ message.url;
+        var uiSourceCode = WebInspector.workspace.uiSourceCodeForURL(url);
+        if (!uiSourceCode) {
+            var resource = WebInspector.resourceTreeModel.resourceForURL(url);
+            if (!resource)
+                return this._status.E_NOTFOUND(url);
+            return this._status.E_NOTSUPPORTED("Resource is not editable")
+        }
+        uiSourceCode.setWorkingCopy(message.content);
+        if (message.commit)
+            uiSourceCode.commitWorkingCopy(callbackWrapper.bind(this));
+        else
+            callbackWrapper.call(this, null);
     },
 
     _requestId: function(request)
@@ -550,8 +572,8 @@ WebInspector.ExtensionServer.prototype = {
         this._registerAutosubscriptionHandler(WebInspector.extensionAPI.Events.NetworkRequestFinished,
             WebInspector.networkManager, WebInspector.NetworkManager.EventTypes.RequestFinished, this._notifyRequestFinished);
         this._registerAutosubscriptionHandler(WebInspector.extensionAPI.Events.ResourceAdded,
-            WebInspector.resourceTreeModel,
-            WebInspector.ResourceTreeModel.EventTypes.ResourceAdded,
+            WebInspector.workspace,
+            WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded,
             this._notifyResourceAdded);
         if (WebInspector.panels.elements) {
             this._registerAutosubscriptionHandler(WebInspector.extensionAPI.Events.ElementsPanelObjectSelected,
@@ -592,13 +614,15 @@ WebInspector.ExtensionServer.prototype = {
 
     _notifyResourceAdded: function(event)
     {
-        var resource = event.data;
-        this._postNotification(WebInspector.extensionAPI.Events.ResourceAdded, this._makeResource(resource));
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        this._postNotification(WebInspector.extensionAPI.Events.ResourceAdded, this._makeResource(uiSourceCode));
     },
 
     _notifyResourceContentCommitted: function(event)
     {
-        this._postNotification(WebInspector.extensionAPI.Events.ResourceContentCommitted, this._makeResource(event.data.resource), event.data.content);
+        var resource = /** @type {WebInspector.Resource} */ event.data.resource;
+        var contentProvider = resource.uiSourceCode() || resource;
+        this._postNotification(WebInspector.extensionAPI.Events.ResourceContentCommitted, this._makeResource(contentProvider), event.data.content);
     },
 
     _notifyRequestFinished: function(event)
diff --git a/Source/WebCore/inspector/front-end/FileContentView.js b/Source/WebCore/inspector/front-end/FileContentView.js
new file mode 100644
index 000000000..98cf2661a
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/FileContentView.js
@@ -0,0 +1,171 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.View}
+ * @param {WebInspector.FileSystemModel.File} file
+ */
+WebInspector.FileContentView = function(file)
+{
+    WebInspector.View.call(this);
+
+    this._innerView = null;
+    this._file = file;
+    this._content = null;
+}
+
+WebInspector.FileContentView.prototype = {
+    wasShown: function()
+    {
+        if (!this._innerView) {
+            if (this._file.isTextFile)
+                this._innerView = new WebInspector.EmptyView(WebInspector.UIString("Loading..."));
+            else
+                this._innerView = new WebInspector.EmptyView(WebInspector.UIString("Binary File"));
+            this.refresh();
+        }
+
+        this._innerView.show(this.element);
+    },
+
+    /**
+     * @param {number} errorCode
+     * @param {FileSystemAgent.Metadata} metadata
+     */
+    _metadataReceived: function(errorCode, metadata)
+    {
+        if (errorCode || !metadata)
+            return;
+
+        if (this._content) {
+            if (!this._content.updateMetadata(metadata))
+                return;
+            var sourceFrame = /** @type {WebInspector.SourceFrame} */ this._innerView;
+            this._content.requestContent(sourceFrame.setContent.bind(sourceFrame));
+        } else {
+            this._innerView.detach();
+            this._content = new WebInspector.FileContentView.FileContentProvider(this._file, metadata);
+            this._innerView = new WebInspector.SourceFrame(this._content);
+            this._innerView.show(this.element);
+        }
+    },
+
+    refresh: function()
+    {
+        if (!this._innerView)
+            return;
+
+        if (this._file.isTextFile)
+            this._file.requestMetadata(this._metadataReceived.bind(this));
+    }
+}
+
+WebInspector.FileContentView.prototype.__proto__ = WebInspector.View.prototype;
+
+/**
+ * @constructor
+ * @implements {WebInspector.ContentProvider}
+ * @param {WebInspector.FileSystemModel.File} file
+ * @param {FileSystemAgent.Metadata} metadata
+ */
+WebInspector.FileContentView.FileContentProvider = function(file, metadata)
+{
+    this._file = file;
+    this._metadata = metadata;
+}
+
+WebInspector.FileContentView.FileContentProvider.prototype = {
+    /**
+     * @return {?string}
+     */
+    contentURL: function()
+    {
+        return this._file.url;
+    },
+
+    /**
+     * @return {WebInspector.ResourceType}
+     */
+    contentType: function()
+    {
+        return this._file.resourceType;
+    },
+
+    /**
+     * @param {function(?string, boolean, string)} callback
+     */
+    requestContent: function(callback)
+    {
+        var size = /** @type {number} */ this._metadata.size;
+        this._file.requestFileContent(true, 0, size, this._charset || "", this._fileContentReceived.bind(this, callback));
+    },
+
+    /**
+     * @param {function(?string, boolean, string)} callback
+     * @param {number} errorCode
+     * @param {string=} content
+     * @param {boolean=} base64Encoded
+     * @param {string=} charset
+     */
+    _fileContentReceived: function(callback, errorCode, content, base64Encoded, charset)
+    {
+        if (errorCode || !content) {
+            callback(null, false, "");
+            return;
+        }
+
+        this._charset = charset;
+        callback(content, false, this.contentType().canonicalMimeType());
+    },
+
+    /**
+     * @param {string} query
+     * @param {boolean} caseSensitive
+     * @param {boolean} isRegex
+     * @param {function(Array.<WebInspector.ContentProvider.SearchMatch>)} callback
+     */
+    searchInContent: function(query, caseSensitive, isRegex, callback)
+    {
+        setTimeout(callback.bind(null, []), 0);
+    },
+
+    /**
+     * @param {FileSystemAgent.Metadata} metadata
+     * @return {boolean}
+     */
+    updateMetadata: function(metadata)
+    {
+        if (this._metadata.modificationTime >= metadata.modificationTime)
+            return false;
+        this._metadata = metadata.modificationTime;
+        return true;
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/FileSystemModel.js b/Source/WebCore/inspector/front-end/FileSystemModel.js
index edb647fa7..96402bd9b 100644
--- a/Source/WebCore/inspector/front-end/FileSystemModel.js
+++ b/Source/WebCore/inspector/front-end/FileSystemModel.js
@@ -237,9 +237,26 @@ WebInspector.FileSystemModel.prototype = {
         callback(errorCode, entries);
     },
 
+    /**
+     * @param {WebInspector.FileSystemModel.Entry} entry
+     * @param {function(number, FileSystemAgent.Metadata=)} callback
+     */
     requestMetadata: function(entry, callback)
     {
         this._agentWrapper.requestMetadata(entry.url, callback);
+    },
+
+    /**
+     * @param {WebInspector.FileSystemModel.File} file
+     * @param {boolean} readAsText
+     * @param {number=} start
+     * @param {number=} end
+     * @param {string=} charset
+     * @param {function(number, string=, string=)=} callback
+     */
+    requestFileContent: function(file, readAsText, start, end, charset, callback)
+    {
+        this._agentWrapper.requestFileContent(file.url, readAsText, start, end, charset, callback);
     }
 }
 
@@ -291,6 +308,18 @@ WebInspector.FileSystemModel.Entry = function(fileSystemModel, fileSystem, backe
     this._isDirectory = backendEntry.isDirectory;
 }
 
+/**
+ * @param {WebInspector.FileSystemModel.Entry} x
+ * @param {WebInspector.FileSystemModel.Entry} y
+ * @return {number}
+ */
+WebInspector.FileSystemModel.Entry.compare = function(x, y)
+{
+    if (x.isDirectory != y.isDirectory)
+        return y.isDirectory ? 1 : -1;
+    return x.name.localeCompare(y.name);
+}
+
 WebInspector.FileSystemModel.Entry.prototype = {
     /**
      * @type {WebInspector.FileSystemModel}
@@ -378,6 +407,7 @@ WebInspector.FileSystemModel.File = function(fileSystemModel, fileSystem, backen
 
     this._mimeType = backendEntry.mimeType;
     this._resourceType = WebInspector.resourceTypes[backendEntry.resourceType];
+    this._isTextFile = backendEntry.isTextFile;
 }
 
 WebInspector.FileSystemModel.File.prototype = {
@@ -395,6 +425,26 @@ WebInspector.FileSystemModel.File.prototype = {
     get resourceType()
     {
         return this._resourceType;
+    },
+
+    /**
+     * @type {boolean}
+     */
+    get isTextFile()
+    {
+        return this._isTextFile;
+    },
+
+    /**
+     * @param {boolean} readAsText
+     * @param {number=} start
+     * @param {number=} end
+     * @param {string=} charset
+     * @param {function(number, string=)=} callback
+     */
+    requestFileContent: function(readAsText, start, end, charset, callback)
+    {
+        this.fileSystemModel.requestFileContent(this, readAsText, start, end, charset, callback);
     }
 }
 
@@ -408,6 +458,7 @@ WebInspector.FileSystemRequestManager = function()
     this._pendingFileSystemRootRequests = {};
     this._pendingDirectoryContentRequests = {};
     this._pendingMetadataRequests = {};
+    this._pendingFileContentRequests = {};
 
     InspectorBackend.registerFileSystemDispatcher(new WebInspector.FileSystemDispatcher(this));
     FileSystemAgent.enable();
@@ -417,7 +468,7 @@ WebInspector.FileSystemRequestManager.prototype = {
     /**
      * @param {string} origin
      * @param {string} type
-     * @param {function(number, FileSystemAgent.Entry)} callback
+     * @param {function(number, FileSystemAgent.Entry=)=} callback
      */
     requestFileSystemRoot: function(origin, type, callback)
     {
@@ -426,8 +477,10 @@ WebInspector.FileSystemRequestManager.prototype = {
 
         function requestAccepted(error, requestId)
         {
-            if (!error)
-                store[requestId] = callback;
+            if (error)
+                callback(FileError.SECURITY_ERR);
+            else
+                store[requestId] = callback || function() {};
         }
     },
 
@@ -447,7 +500,7 @@ WebInspector.FileSystemRequestManager.prototype = {
 
     /**
      * @param {string} url
-     * @param {function(number, Array.<FileSystemAgent.Entry>=)} callback
+     * @param {function(number, Array.<FileSystemAgent.Entry>=)=} callback
      */
     requestDirectoryContent: function(url, callback)
     {
@@ -456,8 +509,10 @@ WebInspector.FileSystemRequestManager.prototype = {
 
         function requestAccepted(error, requestId)
         {
-            if (!error)
-                store[requestId] = callback;
+            if (error)
+                callback(FileError.SECURITY_ERR);
+            else
+                store[requestId] = callback || function() {};
         }
     },
 
@@ -477,7 +532,7 @@ WebInspector.FileSystemRequestManager.prototype = {
 
     /**
      * @param {string} url
-     * @param {function(number, FileSystemAgent.Metadata=)} callback
+     * @param {function(number, FileSystemAgent.Metadata=)=} callback
      */
     requestMetadata: function(url, callback)
     {
@@ -486,8 +541,10 @@ WebInspector.FileSystemRequestManager.prototype = {
 
         function requestAccepted(error, requestId)
         {
-            if (!error)
-                store[requestId] = callback;
+            if (error)
+                callback(FileError.SECURITY_ERR);
+            else
+                store[requestId] = callback || function() {};
         }
     },
 
@@ -498,6 +555,43 @@ WebInspector.FileSystemRequestManager.prototype = {
             return;
         delete this._pendingMetadataRequests[requestId];
         callback(errorCode, metadata);
+    },
+
+    /**
+     * @param {string} url
+     * @param {boolean} readAsText
+     * @param {number=} start
+     * @param {number=} end
+     * @param {string=} charset
+     * @param {function(number, string=, string=)=} callback
+     */
+    requestFileContent: function(url, readAsText, start, end, charset, callback)
+    {
+        var store = this._pendingFileContentRequests;
+        FileSystemAgent.requestFileContent(url, readAsText, start, end, charset, requestAccepted);
+
+        function requestAccepted(error, requestId)
+        {
+            if (error)
+                callback(FileError.SECURITY_ERR);
+            else
+                store[requestId] = callback || function() {};
+        }
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {number} errorCode
+     * @param {string=} content
+     * @param {string=} charset
+     */
+    _fileContentReceived: function(requestId, errorCode, content, charset)
+    {
+        var callback = /** @type {function(number, string=, string=)} */ this._pendingFileContentRequests[requestId];
+        if (!callback)
+            return;
+        delete this._pendingFileContentRequests[requestId];
+        callback(errorCode, content, charset);
     }
 }
 
@@ -540,5 +634,16 @@ WebInspector.FileSystemDispatcher.prototype = {
     metadataReceived: function(requestId, errorCode, metadata)
     {
         this._agentWrapper._metadataReceived(requestId, errorCode, metadata);
+    },
+
+    /**
+     * @param {number} requestId
+     * @param {number} errorCode
+     * @param {string=} content
+     * @param {string=} charset
+     */
+    fileContentReceived: function(requestId, errorCode, content, charset)
+    {
+        this._agentWrapper._fileContentReceived(requestId, errorCode, content, charset);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/FileSystemView.js b/Source/WebCore/inspector/front-end/FileSystemView.js
new file mode 100644
index 000000000..9b89beab1
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/FileSystemView.js
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.SplitView}
+ * @param {WebInspector.FileSystemModel.FileSystem} fileSystem
+ */
+WebInspector.FileSystemView = function(fileSystem)
+{
+    WebInspector.SplitView.call(this, WebInspector.SplitView.SidebarPosition.Left, "FileSystemViewSidebarWidth");
+    this.element.addStyleClass("file-system-view");
+    this.element.addStyleClass("storage-view");
+
+    var directoryTreeElement = this.element.createChild("ol", "filesystem-directory-tree");
+    this._directoryTree = new TreeOutline(directoryTreeElement);
+    this.sidebarElement.appendChild(directoryTreeElement);
+    this.sidebarElement.addStyleClass("outline-disclosure");
+    this.sidebarElement.addStyleClass("sidebar");
+
+    var rootItem = new WebInspector.FileSystemView.EntryTreeElement(this, fileSystem.root);
+    rootItem.expanded = true;
+    this._directoryTree.appendChild(rootItem);
+    this._visibleView = null;
+
+    this._refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
+    this._refreshButton.visible = true;
+    this._refreshButton.addEventListener("click", this._refresh, this);
+}
+
+WebInspector.FileSystemView.prototype = {
+    /**
+     * @type {Array.<Element>}
+     */
+    get statusBarItems()
+    {
+        return [this._refreshButton.element];
+    },
+
+    /**
+     * @type {WebInspector.View}
+     */
+    get visibleView()
+    {
+        return this._visibleView;
+    },
+
+    /**
+     * @param {WebInspector.View} view
+     */
+    showView: function(view)
+    {
+        if (this._visibleView === view)
+            return;
+        if (this._visibleView)
+            this._visibleView.detach();
+        this._visibleView = view;
+        view.show(this.mainElement);
+    },
+
+    _refresh: function()
+    {
+        this._directoryTree.children[0].refresh();
+    }
+}
+
+WebInspector.FileSystemView.prototype.__proto__ = WebInspector.SplitView.prototype;
+
+/**
+ * @constructor
+ * @extends {TreeElement}
+ * @param {WebInspector.FileSystemView} fileSystemView
+ * @param {WebInspector.FileSystemModel.Entry} entry
+ */
+WebInspector.FileSystemView.EntryTreeElement = function(fileSystemView, entry)
+{
+    TreeElement.call(this, entry.name, null, entry.isDirectory);
+
+    this._entry = entry;
+    this._fileSystemView = fileSystemView;
+}
+
+WebInspector.FileSystemView.EntryTreeElement.prototype = {
+    onattach: function()
+    {
+        var selection = this.listItemElement.createChild("div", "selection");
+        this.listItemElement.insertBefore(selection, this.listItemElement.firstChild);
+    },
+
+    onselect: function()
+    {
+        if (!this._view) {
+            if (this._entry.isDirectory)
+                this._view = new WebInspector.DirectoryContentView();
+            else {
+                var file = /** @type {WebInspector.FileSystemModel.File} */ this._entry;
+                this._view = new WebInspector.FileContentView(file);
+            }
+        }
+        this._fileSystemView.showView(this._view);
+        this.refresh();
+    },
+
+    onpopulate: function()
+    {
+        this.refresh();
+    },
+
+    /**
+     * @param {number} errorCode
+     * @param {Array.<WebInspector.FileSystemModel.Entry>=} entries
+     */
+    _directoryContentReceived: function(errorCode, entries)
+    {
+        if (errorCode === FileError.NOT_FOUND_ERR) {
+            if (this.parent !== this.treeOutline)
+                this.parent.refresh();
+            return;
+        }
+
+        if (errorCode !== 0 || !entries) {
+            console.error("Failed to read directory: " + errorCode);
+            return;
+        }
+
+        entries.sort(WebInspector.FileSystemModel.Entry.compare);
+        if (this._view)
+            this._view.showEntries(entries);
+
+        var oldChildren = this.children.slice(0);
+
+        var newEntryIndex = 0;
+        var oldChildIndex = 0;
+        var currentTreeItem = 0;
+        while (newEntryIndex < entries.length && oldChildIndex < oldChildren.length) {
+            var newEntry = entries[newEntryIndex];
+            var oldChild = oldChildren[oldChildIndex];
+            var order = newEntry.name.localeCompare(oldChild._entry.name);
+
+            if (order === 0) {
+                if (oldChild._entry.isDirectory)
+                    oldChild.shouldRefreshChildren = true;
+                else
+                    oldChild.refresh();
+
+                ++newEntryIndex;
+                ++oldChildIndex;
+                ++currentTreeItem;
+                continue;
+            }
+            if (order < 0) {
+                this.insertChild(new WebInspector.FileSystemView.EntryTreeElement(this._fileSystemView, newEntry), currentTreeItem);
+                ++newEntryIndex;
+                ++currentTreeItem;
+                continue;
+            }
+
+            this.removeChildAtIndex(currentTreeItem);
+            ++oldChildIndex;
+        }
+        for (; newEntryIndex < entries.length; ++newEntryIndex)
+            this.appendChild(new WebInspector.FileSystemView.EntryTreeElement(this._fileSystemView, entries[newEntryIndex]));
+
+        for (; oldChildIndex < oldChildren.length; ++oldChildIndex)
+            this.removeChild(oldChildren[oldChildIndex]);
+    },
+
+    refresh: function()
+    {
+        if (!this._entry.isDirectory) {
+            if (this._view && this._view === this._fileSystemView.visibleView) {
+                var fileContentView = /** @type {WebInspector.FileContentView} */ this._view;
+                fileContentView.refresh();
+            }
+        } else
+            this._entry.requestDirectoryContent(this._directoryContentReceived.bind(this));
+    }
+}
+
+WebInspector.FileSystemView.EntryTreeElement.prototype.__proto__ = TreeElement.prototype;
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
index 382a8462e..74eec1d3b 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
diff --git a/Source/WebCore/inspector/front-end/IndexedDBModel.js b/Source/WebCore/inspector/front-end/IndexedDBModel.js
index b875ddd3d..60e2eea39 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBModel.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBModel.js
@@ -390,7 +390,7 @@ WebInspector.IndexedDBModel.prototype = {
             for (var i = 0; i < databaseWithObjectStores.objectStores.length; ++i) {
                 var objectStore = databaseWithObjectStores.objectStores[i];
                 var objectStoreIDBKeyPath = WebInspector.IndexedDBModel.idbKeyPathFromKeyPath(objectStore.keyPath);
-                var objectStoreModel = new WebInspector.IndexedDBModel.ObjectStore(objectStore.name, objectStoreIDBKeyPath);
+                var objectStoreModel = new WebInspector.IndexedDBModel.ObjectStore(objectStore.name, objectStoreIDBKeyPath, objectStore.autoIncrement);
                 for (var j = 0; j < objectStore.indexes.length; ++j) {
                      var index = objectStore.indexes[j];
                      var indexIDBKeyPath = WebInspector.IndexedDBModel.idbKeyPathFromKeyPath(index.keyPath);
@@ -538,10 +538,11 @@ WebInspector.IndexedDBModel.Database = function(databaseId, version)
  * @param {string} name
  * @param {*} keyPath
  */
-WebInspector.IndexedDBModel.ObjectStore = function(name, keyPath)
+WebInspector.IndexedDBModel.ObjectStore = function(name, keyPath, autoIncrement)
 {
     this.name = name;
     this.keyPath = keyPath;
+    this.autoIncrement = autoIncrement;
     this.indexes = {};
 }
 
diff --git a/Source/WebCore/inspector/front-end/InspectorView.js b/Source/WebCore/inspector/front-end/InspectorView.js
index 74d5a84ac..de3345501 100644
--- a/Source/WebCore/inspector/front-end/InspectorView.js
+++ b/Source/WebCore/inspector/front-end/InspectorView.js
@@ -51,6 +51,8 @@ WebInspector.InspectorView = function()
     // Windows and Mac have two different definitions of ']', so accept both.
     this._closeBracketIdentifiers = ["U+005D", "U+00DD"].keySet();
     this._closeBracketCharCode = "]".charCodeAt(0);
+    this._footerElementContainer = this.element.createChild("div", "inspector-footer status-bar hidden");
+    this._panelsElement = this.element.createChild("div", "fill");
 }
 
 WebInspector.InspectorView.Events = {
@@ -190,6 +192,28 @@ WebInspector.InspectorView.prototype = {
         if (!this._history.length || this._history[this._history.length - 1] !== panelName)
             this._history.push(panelName);
         this._historyIterator = this._history.length - 1;
+    },
+
+    panelsElement: function()
+    {
+        return this._panelsElement;
+    },
+
+    /**
+     * @param {Element?} element
+     */
+    setFooterElement: function(element)
+    {
+        if (element) {
+            this._footerElementContainer.removeStyleClass("hidden");
+            this._footerElementContainer.appendChild(element);
+            this._panelsElement.style.bottom = this._footerElementContainer.offsetHeight + "px";
+        } else {
+            this._footerElementContainer.addStyleClass("hidden");
+            this._footerElementContainer.removeChildren();
+            this._panelsElement.style.bottom = 0;
+        }
+        this.doResize();
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSource.js b/Source/WebCore/inspector/front-end/JavaScriptSource.js
index 6487cbb40..53afc906f 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSource.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSource.js
@@ -86,6 +86,7 @@ WebInspector.JavaScriptSource.prototype = {
 
         // Re-request content
         this._contentLoaded = false;
+        this._content = false;
         WebInspector.UISourceCode.prototype.requestContent.call(this, didGetContent.bind(this));
   
         /**
@@ -160,6 +161,14 @@ WebInspector.JavaScriptSource.prototype = {
     },
 
     /**
+     * @return {boolean}
+     */
+    supportsEnabledBreakpointsWhileEditing: function()
+    {
+        return false;
+    },
+
+    /**
      * @return {string}
      */
     breakpointStorageId: function()
@@ -188,7 +197,7 @@ WebInspector.JavaScriptSource.prototype = {
      * @param {function(?string)} callback
      */
     workingCopyCommitted: function(callback)
-    {  
+    {
         /**
          * @param {?string} error
          */
@@ -198,7 +207,9 @@ WebInspector.JavaScriptSource.prototype = {
             callback(error);
         }
 
-        WebInspector.DebuggerResourceBinding.setScriptSource(this, this.workingCopy(), innerCallback.bind(this));
+        var rawLocation = this.uiLocationToRawLocation(0, 0);
+        var script = WebInspector.debuggerModel.scriptForId(rawLocation.scriptId);
+        WebInspector.debuggerModel.setScriptSource(script.scriptId, this.workingCopy(), innerCallback.bind(this));
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index c231e034d..435ae2185 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -46,11 +46,11 @@ WebInspector.JavaScriptSourceFrame = function(scriptsPanel, javaScriptSource)
 
     WebInspector.SourceFrame.call(this, javaScriptSource);
 
-    this._popoverHelper = new WebInspector.ObjectPopoverHelper(this.textViewer.element,
+    this._popoverHelper = new WebInspector.ObjectPopoverHelper(this.textEditor.element,
             this._getPopoverAnchor.bind(this), this._resolveObjectForPopover.bind(this), this._onHidePopover.bind(this), true);
 
-    this.textViewer.element.addEventListener("mousedown", this._onMouseDown.bind(this), true);
-    this.textViewer.element.addEventListener("keydown", this._onKeyDown.bind(this), true);
+    this.textEditor.element.addEventListener("mousedown", this._onMouseDown.bind(this), true);
+    this.textEditor.element.addEventListener("keydown", this._onKeyDown.bind(this), true);
 
     this._breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.BreakpointAdded, this._breakpointAdded, this);
     this._breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.BreakpointRemoved, this._breakpointRemoved, this);
@@ -149,14 +149,32 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
     afterTextChanged: function(oldRange, newRange)
     {
+        WebInspector.SourceFrame.prototype.afterTextChanged.call(this, oldRange, newRange);
         this._javaScriptSource.setWorkingCopy(this.textModel.text);
-        if (!this._javaScriptSource.isDirty())
-            this._didEditContent(null);
+        this._restoreBreakpointsAfterEditing();
     },
 
     beforeTextChanged: function()
     {
-        if (!this._javaScriptSource.isDirty()) {
+        WebInspector.SourceFrame.prototype.beforeTextChanged.call(this);
+        this._removeBreakpointsBeforeEditing();
+    },
+
+    _didEditContent: function(error)
+    {
+        delete this._isCommittingEditing;
+
+        if (error) {
+            WebInspector.log(error, WebInspector.ConsoleMessage.MessageLevel.Error, true);
+            return;
+        }
+        if (!this._javaScriptSource.supportsEnabledBreakpointsWhileEditing())
+            this._restoreBreakpointsAfterEditing();
+    },
+
+    _removeBreakpointsBeforeEditing: function()
+    {
+        if (!this._javaScriptSource.isDirty() || this._javaScriptSource.supportsEnabledBreakpointsWhileEditing()) {
             // Disable all breakpoints in the model, store them as muted breakpoints.
             var breakpointLocations = this._breakpointManager.breakpointLocationsForUISourceCode(this._javaScriptSource);
             var lineNumbers = {};
@@ -168,27 +186,20 @@ WebInspector.JavaScriptSourceFrame.prototype = {
             }
             this.clearExecutionLine();
         }
-
-        WebInspector.SourceFrame.prototype.beforeTextChanged.call(this);
     },
 
-    _didEditContent: function(error)
+    _restoreBreakpointsAfterEditing: function()
     {
-        delete this._isCommittingEditing;
-
-        if (error) {
-            WebInspector.log(error, WebInspector.ConsoleMessage.MessageLevel.Error, true);
-            return;
-        }
-
-        // Restore all muted breakpoints.
-        for (var lineNumber = 0; lineNumber < this.textModel.linesCount; ++lineNumber) {
-            var breakpointDecoration = this.textModel.getAttribute(lineNumber, "breakpoint");
-            if (breakpointDecoration) {
-                // Remove fake decoration
-                this._removeBreakpointDecoration(lineNumber);
-                // Set new breakpoint
-                this._setBreakpoint(lineNumber, breakpointDecoration.condition, breakpointDecoration.enabled);
+        if (!this._javaScriptSource.isDirty() || this._javaScriptSource.supportsEnabledBreakpointsWhileEditing()) {
+            // Restore all muted breakpoints.
+            for (var lineNumber = 0; lineNumber < this.textModel.linesCount; ++lineNumber) {
+                var breakpointDecoration = this.textModel.getAttribute(lineNumber, "breakpoint");
+                if (breakpointDecoration) {
+                    // Remove fake decoration
+                    this._removeBreakpointDecoration(lineNumber);
+                    // Set new breakpoint
+                    this._setBreakpoint(lineNumber, breakpointDecoration.condition, breakpointDecoration.enabled);
+                }
             }
         }
     },
@@ -275,7 +286,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         if (!highlightElement)
             return;
         // FIXME: the text editor should maintain highlight on its own. The check below is a workaround for
-        // the case when highlight element is detached from DOM by the TextViewer when re-building the DOM.
+        // the case when highlight element is detached from DOM by the TextEditor when re-building the DOM.
         var parentElement = highlightElement.parentElement;
         if (parentElement) {
             var child = highlightElement.firstChild;
@@ -324,32 +335,32 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         };
         this.textModel.setAttribute(lineNumber, "breakpoint", breakpoint);
 
-        this.textViewer.beginUpdates();
-        this.textViewer.addDecoration(lineNumber, "webkit-breakpoint");
-        if (!enabled || mutedWhileEditing)
-            this.textViewer.addDecoration(lineNumber, "webkit-breakpoint-disabled");
+        this.textEditor.beginUpdates();
+        this.textEditor.addDecoration(lineNumber, "webkit-breakpoint");
+        if (!enabled || (mutedWhileEditing && !this._javaScriptSource.supportsEnabledBreakpointsWhileEditing()))
+            this.textEditor.addDecoration(lineNumber, "webkit-breakpoint-disabled");
         else
-            this.textViewer.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
+            this.textEditor.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
         if (!!condition)
-            this.textViewer.addDecoration(lineNumber, "webkit-breakpoint-conditional");
+            this.textEditor.addDecoration(lineNumber, "webkit-breakpoint-conditional");
         else
-            this.textViewer.removeDecoration(lineNumber, "webkit-breakpoint-conditional");
-        this.textViewer.endUpdates();
+            this.textEditor.removeDecoration(lineNumber, "webkit-breakpoint-conditional");
+        this.textEditor.endUpdates();
     },
 
     _removeBreakpointDecoration: function(lineNumber)
     {
         this.textModel.removeAttribute(lineNumber, "breakpoint");
-        this.textViewer.beginUpdates();
-        this.textViewer.removeDecoration(lineNumber, "webkit-breakpoint");
-        this.textViewer.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
-        this.textViewer.removeDecoration(lineNumber, "webkit-breakpoint-conditional");
-        this.textViewer.endUpdates();
+        this.textEditor.beginUpdates();
+        this.textEditor.removeDecoration(lineNumber, "webkit-breakpoint");
+        this.textEditor.removeDecoration(lineNumber, "webkit-breakpoint-disabled");
+        this.textEditor.removeDecoration(lineNumber, "webkit-breakpoint-conditional");
+        this.textEditor.endUpdates();
     },
 
     _onMouseDown: function(event)
     {
-        if (this._javaScriptSource.isDirty())
+        if (this._javaScriptSource.isDirty() && !this._javaScriptSource.supportsEnabledBreakpointsWhileEditing())
             return;
 
         if (event.button != 0 || event.altKey || event.ctrlKey || event.metaKey)
@@ -359,14 +370,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
             return;
         var lineNumber = target.lineNumber;
 
-        var breakpoint = this._breakpointManager.findBreakpoint(this._javaScriptSource, lineNumber);
-        if (breakpoint) {
-            if (event.shiftKey)
-                breakpoint.setEnabled(!breakpoint.enabled());
-            else
-                breakpoint.remove();
-        } else
-            this._setBreakpoint(lineNumber, "", true);
+        this._toggleBreakpoint(lineNumber, event.shiftKey);
         event.preventDefault();
     },
 
@@ -387,11 +391,11 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     _editBreakpointCondition: function(lineNumber, breakpoint)
     {
         this._conditionElement = this._createConditionElement(lineNumber);
-        this.textViewer.addDecoration(lineNumber, this._conditionElement);
+        this.textEditor.addDecoration(lineNumber, this._conditionElement);
 
         function finishEditing(committed, element, newText)
         {
-            this.textViewer.removeDecoration(lineNumber, this._conditionElement);
+            this.textEditor.removeDecoration(lineNumber, this._conditionElement);
             delete this._conditionEditorElement;
             delete this._conditionElement;
             if (breakpoint)
@@ -434,15 +438,17 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     {
         this._executionLineNumber = lineNumber;
         if (this.loaded) {
-            this.textViewer.addDecoration(lineNumber, "webkit-execution-line");
+            this.textEditor.addDecoration(lineNumber, "webkit-execution-line");
             this.revealLine(this._executionLineNumber);
+            if (this.canEditSource())
+                this.setSelection(WebInspector.TextRange.createFromLocation(lineNumber, 0));
         }
     },
 
     clearExecutionLine: function()
     {
         if (this.loaded && typeof this._executionLineNumber === "number")
-            this.textViewer.removeDecoration(this._executionLineNumber, "webkit-execution-line");
+            this.textEditor.removeDecoration(this._executionLineNumber, "webkit-execution-line");
         delete this._executionLineNumber;
     },
 
@@ -510,7 +516,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         this.clearMessages();
     },
 
-    onTextViewerContentLoaded: function()
+    onTextEditorContentLoaded: function()
     {
         if (typeof this._executionLineNumber === "number")
             this.setExecutionLine(this._executionLineNumber);
@@ -530,6 +536,30 @@ WebInspector.JavaScriptSourceFrame.prototype = {
 
     /**
      * @param {number} lineNumber
+     * @param {boolean} onlyDisable
+     */
+    _toggleBreakpoint: function(lineNumber, onlyDisable)
+    {
+        var breakpoint = this._breakpointManager.findBreakpoint(this._javaScriptSource, lineNumber);
+        if (breakpoint) {
+            if (onlyDisable)
+                breakpoint.setEnabled(!breakpoint.enabled());
+            else
+                breakpoint.remove();
+        } else
+            this._setBreakpoint(lineNumber, "", true);
+    },
+
+    toggleBreakpointOnCurrentLine: function()
+    {
+        var selection = this.textEditor.selection();
+        if (!selection)
+            return;
+        this._toggleBreakpoint(selection.startLine, false);
+    },
+
+    /**
+     * @param {number} lineNumber
      * @param {string} condition
      * @param {boolean} enabled
      */
diff --git a/Source/WebCore/inspector/front-end/MemoryStatistics.js b/Source/WebCore/inspector/front-end/MemoryStatistics.js
index c915ce752..aa52e222e 100644
--- a/Source/WebCore/inspector/front-end/MemoryStatistics.js
+++ b/Source/WebCore/inspector/front-end/MemoryStatistics.js
@@ -257,15 +257,20 @@ WebInspector.MemoryStatistics.prototype = {
 
     _onRecordAdded: function(event)
     {
-        var counters = event.data["counters"];
-        if (!counters)
-            return;
-        this._counters.push({
-            time: event.data.endTime || event.data.startTime,
-            documentCount: counters["documents"],
-            nodeCount: counters["nodes"],
-            listenerCount: counters["jsEventListeners"]
-        });
+        var statistics = this._counters;
+        function addStatistics(record)
+        {
+            var counters = record["counters"];
+            if (!counters)
+                return;
+            statistics.push({
+                time: record.endTime || record.startTime,
+                documentCount: counters["documents"],
+                nodeCount: counters["nodes"],
+                listenerCount: counters["jsEventListeners"]
+            });
+        }
+        WebInspector.TimelinePresentationModel.forAllRecords([event.data], null, addStatistics);
     },
 
     _draw: function()
diff --git a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
index 8416337aa..fd952ac39 100644
--- a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -300,56 +300,21 @@ WebInspector.MetricsSidebarPane.prototype = {
 
     _handleKeyDown: function(context, styleProperty, event)
     {
-        if (!/^(?:Page)?(?:Up|Down)$/.test(event.keyIdentifier))
-            return;
         var element = event.currentTarget;
 
-        var selection = window.getSelection();
-        if (!selection.rangeCount)
-            return;
-
-        var selectionRange = selection.getRangeAt(0);
-        if (!selectionRange.commonAncestorContainer.isSelfOrDescendant(element))
-            return;
-
-        var originalValue = element.textContent;
-        var wordRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, WebInspector.StylesSidebarPane.StyleValueDelimiters, element);
-        var wordString = wordRange.toString();
-
-        var matches = /(.*?)(-?(?:\d+(?:\.\d+)?|\.\d+))(.*)/.exec(wordString);
-        var replacementString;
-        if (matches && matches.length) {
-            var prefix = matches[1];
-            var suffix = matches[3];
-            var number = WebInspector.StylesSidebarPane.alteredFloatNumber(parseFloat(matches[2]), event);
-            if (number === null) {
-                // Need to check for null explicitly.
-                return;
-            }
+        function finishHandler(originalValue, replacementString)
+        {
+            this._applyUserInput(element, replacementString, originalValue, context, false);
+        }
 
+        function customNumberHandler(number)
+        {
             if (styleProperty !== "margin" && number < 0)
                 number = 0;
-
-            replacementString = prefix + number + suffix;
+            return number;
         }
-        if (!replacementString)
-            return;
-
-        var replacementTextNode = document.createTextNode(replacementString);
-
-        wordRange.deleteContents();
-        wordRange.insertNode(replacementTextNode);
-
-        var finalSelectionRange = document.createRange();
-        finalSelectionRange.setStart(replacementTextNode, 0);
-        finalSelectionRange.setEnd(replacementTextNode, replacementString.length);
-
-        selection.removeAllRanges();
-        selection.addRange(finalSelectionRange);
 
-        event.handled = true;
-        event.preventDefault();
-        this._applyUserInput(element, replacementString, originalValue, context, false);
+        WebInspector.handleElementValueModifications(event, element, finishHandler.bind(this), undefined, customNumberHandler);
     },
 
     editingEnded: function(element, context)
diff --git a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
index e123b8fa5..b83470a53 100644
--- a/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
+++ b/Source/WebCore/inspector/front-end/NativeMemorySnapshotView.js
@@ -216,6 +216,7 @@ WebInspector.MemoryBlockViewProperties._initialize = function()
     }
     addBlock("hsl(  0,  0%, 100%)", "ProcessPrivateMemory", "Total");
     addBlock("hsl(  0,  0%,  80%)", "Other", "Other");
+    addBlock("hsl(300, 30%,  80%)", "DOM", "DOM tree structures");
     addBlock("hsl( 90, 60%,  80%)", "JSHeapAllocated", "JavaScript heap");
     addBlock("hsl( 90, 80%,  80%)", "JSHeapUsed", "Used JavaScript heap");
     addBlock("hsl( 90, 30%,  80%)", "JSExternalResources", "JavaScript external resources");
@@ -455,9 +456,9 @@ WebInspector.NativeMemoryBarChart.prototype = {
                 nameDiv.textContent = title;
                 nameDiv.addStyleClass("memory-bar-chart-name");
                 var barCell = row.insertCell(-1);
-                barDiv = barCell.createChild("div");
+                var barDiv = barCell.createChild("div");
                 barDiv.addStyleClass("memory-bar-chart-bar");
-                var viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(child);
+                viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(child);
                 barDiv.style.backgroundColor = viewProperties._fillStyle;
                 var unusedDiv = barDiv.createChild("div");
                 unusedDiv.addStyleClass("memory-bar-chart-unused");
@@ -482,8 +483,8 @@ WebInspector.NativeMemoryBarChart.prototype = {
             divs.sizeDiv.textContent = (child.size / MB).toFixed(1) + "\u2009MB";
         }
 
-        var viewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(memoryBlock);
-        this._totalDiv.textContent = viewProperties._description + ": " + (memoryBlock.size / MB).toFixed(1) + "\u2009MB";
+        var memoryBlockViewProperties = WebInspector.MemoryBlockViewProperties._forMemoryBlock(memoryBlock);
+        this._totalDiv.textContent = memoryBlockViewProperties._description + ": " + (memoryBlock.size / MB).toFixed(1) + "\u2009MB";
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/NavigatorOverlayController.js b/Source/WebCore/inspector/front-end/NavigatorOverlayController.js
index 51ce67d72..806c00182 100644
--- a/Source/WebCore/inspector/front-end/NavigatorOverlayController.js
+++ b/Source/WebCore/inspector/front-end/NavigatorOverlayController.js
@@ -28,14 +28,12 @@
 
 /**
  * @constructor
- * @param {WebInspector.Panel} panel
  * @param {WebInspector.SplitView} parentSplitView
  * @param {WebInspector.View} navigatorView
  * @param {WebInspector.View} editorView
  */
-WebInspector.NavigatorOverlayController = function(panel, parentSplitView, navigatorView, editorView)
+WebInspector.NavigatorOverlayController = function(parentSplitView, navigatorView, editorView)
 {
-    this._panel = panel;
     this._parentSplitView = parentSplitView;
     this._navigatorView = navigatorView;
     this._editorView = editorView;
@@ -61,11 +59,6 @@ WebInspector.NavigatorOverlayController.prototype = {
         window.setTimeout(this._maybeShowNavigatorOverlay.bind(this), 0);
     },
 
-    _escDownWhileNavigatorOverlayOpen: function(event)
-    {
-        this.hideNavigatorOverlay();
-    },
-
     _maybeShowNavigatorOverlay: function()
     {
         if (WebInspector.settings.navigatorHidden.get() && !WebInspector.settings.navigatorWasOnceHidden.get())
@@ -124,6 +117,8 @@ WebInspector.NavigatorOverlayController.prototype = {
         this._navigatorShowHideButton.title = WebInspector.UIString("Pin navigator");
 
         this._sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
+        this._boundKeyDown = this._keyDown.bind(this);
+        this._sidebarOverlay.element.addEventListener("keydown", this._boundKeyDown, false);
         var navigatorOverlayResizeWidgetElement = document.createElement("div");
         navigatorOverlayResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
         this._sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
@@ -131,12 +126,22 @@ WebInspector.NavigatorOverlayController.prototype = {
         this._navigatorView.element.appendChild(this._navigatorShowHideButton.element);
         this._boundContainingElementFocused = this._containingElementFocused.bind(this);
         this._parentSplitView.element.addEventListener("mousedown", this._boundContainingElementFocused, false);
-        this._panel.registerShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code, this._escDownWhileNavigatorOverlayOpen.bind(this));
 
         this._sidebarOverlay.show(this._parentSplitView.element);
         this._navigatorView.focus();
     },
 
+    _keyDown: function(event)
+    {
+        if (event.handled)
+            return;
+
+        if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Esc.code) {
+            this.hideNavigatorOverlay();
+            event.consume(true);
+        }
+    },
+
     hideNavigatorOverlay: function()
     {
         if (this._navigatorShowHideButton.state !== "overlay")
@@ -153,7 +158,7 @@ WebInspector.NavigatorOverlayController.prototype = {
     _innerHideNavigatorOverlay: function()
     {
         this._parentSplitView.element.removeEventListener("mousedown", this._boundContainingElementFocused, false);
-        this._panel.unregisterShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code);
+        this._sidebarOverlay.element.removeEventListener("keydown", this._boundKeyDown, false);
         this._sidebarOverlay.hide();
     },
 
diff --git a/Source/WebCore/inspector/front-end/NavigatorView.js b/Source/WebCore/inspector/front-end/NavigatorView.js
index 44b015953..a02217474 100644
--- a/Source/WebCore/inspector/front-end/NavigatorView.js
+++ b/Source/WebCore/inspector/front-end/NavigatorView.js
@@ -161,7 +161,7 @@ WebInspector.NavigatorView.prototype = {
 
             if (this._lastSelectedUISourceCode === oldUISourceCode)
                 selected = true;
-            this._removeUISourceCode(oldUISourceCode);
+            this.removeUISourceCode(oldUISourceCode);
         }
 
         if (!added)
@@ -185,7 +185,7 @@ WebInspector.NavigatorView.prototype = {
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    _removeUISourceCode: function(uiSourceCode)
+    removeUISourceCode: function(uiSourceCode)
     {
         var treeElement = this._scriptTreeElementsByUISourceCode.get(uiSourceCode);
         while (treeElement) {
@@ -252,20 +252,19 @@ WebInspector.NavigatorView.prototype = {
             return;
 
         // Tree outline should be marked as edited as well as the tree element to prevent search from starting.
-        WebInspector.markBeingEdited(scriptTreeElement.treeOutline.element, true);
+        var treeOutlineElement = scriptTreeElement.treeOutline.element;
+        WebInspector.markBeingEdited(treeOutlineElement, true);
 
         function commitHandler(element, newTitle, oldTitle)
         {
             if (newTitle && newTitle !== oldTitle)
                 this._fileRenamed(uiSourceCode, newTitle);
-            else
-                this._updateScriptTitle(uiSourceCode);
-            afterEditing(true);
+            afterEditing.call(this, true);
         }
 
         function cancelHandler()
         {
-            afterEditing(false);
+            afterEditing.call(this, false);
         }
 
         /**
@@ -273,7 +272,8 @@ WebInspector.NavigatorView.prototype = {
          */
         function afterEditing(committed)
         {
-            WebInspector.markBeingEdited(scriptTreeElement.treeOutline.element, false);
+            WebInspector.markBeingEdited(treeOutlineElement, false);
+            this._updateScriptTitle(uiSourceCode);
             if (callback)
                 callback(committed);
         }
diff --git a/Source/WebCore/inspector/front-end/NetworkItemView.js b/Source/WebCore/inspector/front-end/NetworkItemView.js
index 6c0c6473a..1fe90248a 100644
--- a/Source/WebCore/inspector/front-end/NetworkItemView.js
+++ b/Source/WebCore/inspector/front-end/NetworkItemView.js
@@ -41,9 +41,16 @@ WebInspector.NetworkItemView = function(request)
     var headersView = new WebInspector.RequestHeadersView(request);
     this.appendTab("headers", WebInspector.UIString("Headers"), headersView);
 
+    this.addEventListener(WebInspector.TabbedPane.EventTypes.TabSelected, this._tabSelected, this);
+
+    if (request.frames().length > 0) {
+        var frameView = new WebInspector.ResourceWebSocketFrameView(request);
+        this.appendTab("webSocketFrames", WebInspector.UIString("Frames"), frameView);
+        return;
+    }
+
     var responseView = new WebInspector.RequestResponseView(request);
     var previewView = new WebInspector.RequestPreviewView(request, responseView);
-
     this.appendTab("preview", WebInspector.UIString("Preview"), previewView);
     this.appendTab("response", WebInspector.UIString("Response"), responseView);
 
@@ -57,12 +64,6 @@ WebInspector.NetworkItemView = function(request)
         this.appendTab("timing", WebInspector.UIString("Timing"), timingView);
     }
 
-    if (request.frames().length > 0) {
-        var frameView = new WebInspector.ResourceWebSocketFrameView(request);
-        this.appendTab("webSocketFrames", WebInspector.UIString("WebSocket Frames"), frameView);
-    }
-
-    this.addEventListener(WebInspector.TabbedPane.EventTypes.TabSelected, this._tabSelected, this);
 }
 
 WebInspector.NetworkItemView.prototype = {
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 64617b240..67364ad3a 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -1135,7 +1135,7 @@ WebInspector.NetworkLogView.prototype = {
             this._highlightedSubstringChanges = node._highlightMatchedSubstring(this._searchRegExp);
             if (reveal)
                 node.reveal();
-            this._currentMatcRequestrceIndex = matchedRequestIndex;
+            this._currentMatchedRequestIndex = matchedRequestIndex;
         }
         this.dispatchEventToListeners(WebInspector.NetworkLogView.EventTypes.SearchIndexUpdated, this._currentMatchedRequestIndex);
     },
diff --git a/Source/WebCore/inspector/front-end/NetworkRequest.js b/Source/WebCore/inspector/front-end/NetworkRequest.js
index 78628507f..7f8995a87 100644
--- a/Source/WebCore/inspector/front-end/NetworkRequest.js
+++ b/Source/WebCore/inspector/front-end/NetworkRequest.js
@@ -802,22 +802,6 @@ WebInspector.NetworkRequest.prototype = {
     },
 
     /**
-     * @param {WebInspector.Resource} resource
-     */
-    setResource: function(resource)
-    {
-        this._resource = resource;
-    },
-
-    /**
-     * @return {WebInspector.Resource}
-     */
-    resource: function()
-    {
-        return this._resource;
-    },
-
-    /**
      * @return {Object}
      */
     frames: function()
diff --git a/Source/WebCore/inspector/front-end/Panel.js b/Source/WebCore/inspector/front-end/Panel.js
index 566f105f5..ecfb3e889 100644
--- a/Source/WebCore/inspector/front-end/Panel.js
+++ b/Source/WebCore/inspector/front-end/Panel.js
@@ -63,7 +63,7 @@ WebInspector.Panel.prototype = {
 
     show: function()
     {
-        WebInspector.View.prototype.show.call(this, WebInspector.inspectorView.element);
+        WebInspector.View.prototype.show.call(this, WebInspector.inspectorView.panelsElement());
     },
 
     wasShown: function()
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index f3d3a4cd6..e1b3e6f15 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -272,8 +272,8 @@ WebInspector.RemoteObject.prototype = {
 
     /**
      * @param {function(this:Object)} functionDeclaration
-     * @param {Array.<RuntimeAgent.CallArgument>|undefined} args
-     * @param {function(?WebInspector.RemoteObject)} callback
+     * @param {Array.<RuntimeAgent.CallArgument>=} args
+     * @param {function(?WebInspector.RemoteObject)=} callback
      */
     callFunction: function(functionDeclaration, args, callback)
     {
@@ -284,6 +284,9 @@ WebInspector.RemoteObject.prototype = {
          */
         function mycallback(error, result, wasThrown)
         {
+            if (!callback)
+                return;
+
             callback((error || wasThrown) ? null : WebInspector.RemoteObject.fromPayload(result));
         }
 
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index 0b4b94535..9a5f91468 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -42,8 +42,6 @@
 WebInspector.Resource = function(request, url, documentURL, frameId, loaderId, type, mimeType, isHidden)
 {
     this._request = request;
-    if (this._request)
-        this._request.setResource(this);
     this.url = url;
     this._documentURL = documentURL;
     this._frameId = frameId;
@@ -56,119 +54,10 @@ WebInspector.Resource = function(request, url, documentURL, frameId, loaderId, t
     /** @type {?string} */ this._content;
     /** @type {boolean} */ this._contentEncoded;
     this._pendingContentCallbacks = [];
-}
-
-WebInspector.Resource._domainModelBindings = [];
-
-/**
- * @param {WebInspector.ResourceType} type
- * @param {WebInspector.ResourceDomainModelBinding} binding
- */
-WebInspector.Resource.registerDomainModelBinding = function(type, binding)
-{
-    WebInspector.Resource._domainModelBindings[type.name()] = binding;
-}
-
-WebInspector.Resource._resourceRevisionRegistry = function()
-{
-    if (!WebInspector.Resource._resourceRevisionRegistryObject) {
-        if (window.localStorage) {
-            var resourceHistory = window.localStorage["resource-history"];
-            try {
-                WebInspector.Resource._resourceRevisionRegistryObject = resourceHistory ? JSON.parse(resourceHistory) : {};
-            } catch (e) {
-                WebInspector.Resource._resourceRevisionRegistryObject = {};
-            }
-        } else
-            WebInspector.Resource._resourceRevisionRegistryObject = {};
-    }
-    return WebInspector.Resource._resourceRevisionRegistryObject;
-}
-
-WebInspector.Resource.restoreRevisions = function()
-{
-    var registry = WebInspector.Resource._resourceRevisionRegistry();
-    var filteredRegistry = {};
-    for (var url in registry) {
-        var historyItems = registry[url];
-        var resource = WebInspector.resourceForURL(url);
-
-        var filteredHistoryItems = [];
-        for (var i = 0; historyItems && i < historyItems.length; ++i) {
-            var historyItem = historyItems[i];
-            if (resource && historyItem.loaderId === resource.loaderId) {
-                resource.addRevision(window.localStorage[historyItem.key], new Date(historyItem.timestamp), true);
-                filteredHistoryItems.push(historyItem);
-                filteredRegistry[url] = filteredHistoryItems;
-            } else
-                delete window.localStorage[historyItem.key];
-        }
-    }
-    WebInspector.Resource._resourceRevisionRegistryObject = filteredRegistry;
-
-    function persist()
-    {
-        window.localStorage["resource-history"] = JSON.stringify(filteredRegistry);
-    }
-
-    // Schedule async storage.
-    setTimeout(persist, 0);
-}
-
-/**
- * @param {WebInspector.ResourceRevision} revision
- */
-WebInspector.Resource.persistRevision = function(revision)
-{
-    if (!window.localStorage)
-        return;
-
-    if (revision.resource.url.startsWith("inspector://"))
-        return;
-
-    var resource = revision.resource;
-    var url = resource.url;
-    var loaderId = resource.loaderId;
-    var timestamp = revision.timestamp.getTime();
-    var key = "resource-history|" + url + "|" + loaderId + "|" + timestamp;
-    var content = revision._content;
-
-    var registry = WebInspector.Resource._resourceRevisionRegistry();
-
-    var historyItems = registry[resource.url];
-    if (!historyItems) {
-        historyItems = [];
-        registry[resource.url] = historyItems;
-    }
-    historyItems.push({url: url, loaderId: loaderId, timestamp: timestamp, key: key});
-
-    function persist()
-    {
-        window.localStorage[key] = content;
-        window.localStorage["resource-history"] = JSON.stringify(registry);
-    }
-
-    // Schedule async storage.
-    setTimeout(persist, 0);
-}
-
-/**
- * @param {WebInspector.Resource} resource
- */
-WebInspector.Resource._clearResourceHistory = function(resource)
-{
-    if (!window.localStorage)
-        return;
-
-    if (resource.url.startsWith("inspector://"))
-        return;
-
-    var registry = WebInspector.Resource._resourceRevisionRegistry();
-    var historyItems = registry[resource.url];
-    for (var i = 0; historyItems && i < historyItems.length; ++i)
-        delete window.localStorage[historyItems[i].key];
-    delete registry[resource.url];
-    window.localStorage["resource-history"] = JSON.stringify(registry);
+    if (this._request && !this._request.finished)
+        this._request.addEventListener(WebInspector.NetworkRequest.Events.FinishedLoading, this._requestFinished, this);
+    
+    this._restoreRevisionHistory();
 }
 
 WebInspector.Resource.Events = {
@@ -326,30 +215,16 @@ WebInspector.Resource.prototype = {
     },
 
     /**
-     * @return {boolean}
-     */
-    isEditable: function()
-    {
-        if (this._actualResource)
-            return false;
-        var binding = WebInspector.Resource._domainModelBindings[this.type.name()];
-        return binding && binding.canSetContent(this);
-    },
-
-    /**
      * @param {string} newContent
-     * @param {boolean} majorChange
-     * @param {function(?string)} callback
+     * @param {function(String)=} callback
      */
-    setContent: function(newContent, majorChange, callback)
+    _setContent: function(newContent, callback)
     {
-        if (!this.isEditable()) {
-            if (callback)
-                callback("Resource is not editable");
+        var uiSourceCode = this._uiSourceCode;
+        if (!this._uiSourceCode || !this._uiSourceCode.isEditable())
             return;
-        }
-        var binding = WebInspector.Resource._domainModelBindings[this.type.name()];
-        binding.setContent(this, newContent, majorChange, callback);
+        this._uiSourceCode.setWorkingCopy(newContent);
+        this._uiSourceCode.commitWorkingCopy(callback);
     },
 
     /**
@@ -364,15 +239,40 @@ WebInspector.Resource.prototype = {
             if (lastRevision._content === content)
                 return;
         }
-        var revision = new WebInspector.ResourceRevision(this, content, timestamp || new Date());
+        var revision = new WebInspector.Revision(this, content, timestamp || new Date());
         this.history.push(revision);
 
         this.dispatchEventToListeners(WebInspector.Resource.Events.RevisionAdded, revision);
         if (!restoringHistory)
-            revision._persistRevision();
+            revision._persist();
         WebInspector.resourceTreeModel.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.ResourceContentCommitted, { resource: this, content: content });
     },
 
+    _restoreRevisionHistory: function()
+    {
+        if (!window.localStorage)
+            return;
+
+        WebInspector.Revision._ensureStaleRevisionsFileteredOut();
+        var registry = WebInspector.Revision._revisionHistoryRegistry();
+        var historyItems = registry[this.url];
+        for (var i = 0; historyItems && i < historyItems.length; ++i)
+            this.addRevision(window.localStorage[historyItems[i].key], new Date(historyItems[i].timestamp), true);
+    },
+
+    _clearRevisionHistory: function()
+    {
+        if (!window.localStorage)
+            return;
+
+        var registry = WebInspector.Revision._revisionHistoryRegistry();
+        var historyItems = registry[this.url];
+        for (var i = 0; historyItems && i < historyItems.length; ++i)
+            delete window.localStorage[historyItems[i].key];
+        delete registry[this.url];
+        window.localStorage["revision-history"] = JSON.stringify(registry);
+    },
+   
     /**
      * @return {?string}
      */
@@ -400,7 +300,8 @@ WebInspector.Resource.prototype = {
         }
 
         this._pendingContentCallbacks.push(callback);
-        this._innerRequestContent();
+        if (!this._request || this._request.finished)
+            this._innerRequestContent();
     },
 
     canonicalMimeType: function()
@@ -457,6 +358,15 @@ WebInspector.Resource.prototype = {
         return "data:" + this.mimeType + (this._contentEncoded ? ";base64," : ",") + this._content;
     },
 
+
+    _requestFinished: function()
+    {
+        this._request.removeEventListener(WebInspector.NetworkRequest.Events.FinishedLoading, this._requestFinished, this);
+        if (this._pendingContentCallbacks.length)
+            this._innerRequestContent();
+    },
+
+
     _innerRequestContent: function()
     {
         if (this._contentRequested)
@@ -485,19 +395,25 @@ WebInspector.Resource.prototype = {
     {
         function revert(content)
         {
-            this.setContent(content, true, function() {});
+            this._setContent(content, function() {});
         }
         this.requestContent(revert.bind(this));
     },
 
-    revertAndClearHistory: function()
+    revertAndClearHistory: function(callback)
     {
         function revert(content)
         {
-            this.setContent(content, true, function() {});
-            WebInspector.Resource._clearResourceHistory(this);
+            this._setContent(content, clearHistory.bind(this));
+        }
+
+        function clearHistory()
+        {
+            this._clearRevisionHistory();
             this.history = [];
+            callback();
         }
+
         this.requestContent(revert.bind(this));
     },
 
@@ -535,14 +451,64 @@ WebInspector.Resource.prototype.__proto__ = WebInspector.Object.prototype;
  * @param {?string|undefined} content
  * @param {Date} timestamp
  */
-WebInspector.ResourceRevision = function(resource, content, timestamp)
+WebInspector.Revision = function(resource, content, timestamp)
 {
     this._resource = resource;
     this._content = content;
     this._timestamp = timestamp;
 }
 
-WebInspector.ResourceRevision.prototype = {
+WebInspector.Revision._revisionHistoryRegistry = function()
+{
+    if (!WebInspector.Revision._revisionHistoryRegistryObject) {
+        if (window.localStorage) {
+            var revisionHistory = window.localStorage["revision-history"];
+            try {
+                WebInspector.Revision._revisionHistoryRegistryObject = revisionHistory ? JSON.parse(revisionHistory) : {};
+            } catch (e) {
+                WebInspector.Revision._revisionHistoryRegistryObject = {};
+            }
+        } else
+            WebInspector.Revision._revisionHistoryRegistryObject = {};
+    }
+    return WebInspector.Revision._revisionHistoryRegistryObject;
+}
+
+WebInspector.Revision._ensureStaleRevisionsFileteredOut = function()
+{
+    if (!window.localStorage)
+        return;
+
+    if (WebInspector.Revision._staleRevisionsFilteredOut)
+        return;
+    WebInspector.Revision._staleRevisionsFilteredOut = true;
+    
+    var registry = WebInspector.Revision._revisionHistoryRegistry();
+    var filteredRegistry = {};
+    for (var url in registry) {
+        var historyItems = registry[url];
+        var filteredHistoryItems = [];
+        for (var i = 0; historyItems && i < historyItems.length; ++i) {
+            var historyItem = historyItems[i];
+            if (historyItem.loaderId === WebInspector.resourceTreeModel.mainFrame.loaderId) {
+                filteredHistoryItems.push(historyItem);
+                filteredRegistry[url] = filteredHistoryItems;
+            } else
+                delete window.localStorage[historyItem.key];
+        }
+    }
+    WebInspector.Revision._revisionHistoryRegistryObject = filteredRegistry;
+
+    function persist()
+    {
+        window.localStorage["revision-history"] = JSON.stringify(filteredRegistry);
+    }
+
+    // Schedule async storage.
+    setTimeout(persist, 0);
+}
+
+WebInspector.Revision.prototype = {
     /**
      * @return {WebInspector.Resource}
      */
@@ -572,7 +538,7 @@ WebInspector.ResourceRevision.prototype = {
         function revert(content)
         {
             if (this._resource._content !== content)
-                this._resource.setContent(content, true, function() {});
+                this._resource._setContent(content, function() {});
         }
         this.requestContent(revert.bind(this));
     },
@@ -612,29 +578,35 @@ WebInspector.ResourceRevision.prototype = {
         callback([]);
     },
 
-    _persistRevision: function()
+    _persist: function()
     {
-        WebInspector.Resource.persistRevision(this);
-    }
-}
+        if (!window.localStorage)
+            return;
 
-/**
- * @interface
- */
-WebInspector.ResourceDomainModelBinding = function() { }
+        var url = this.contentURL();
+        if (url.startsWith("inspector://"))
+            return;
 
-WebInspector.ResourceDomainModelBinding.prototype = {
-    /**
-     * @param {WebInspector.Resource} resource
-     * @return {boolean}
-     */
-    canSetContent: function(resource) { return true; },
+        var loaderId = WebInspector.resourceTreeModel.mainFrame.loaderId;
+        var timestamp = this.timestamp.getTime();
+        var key = "revision-history|" + url + "|" + loaderId + "|" + timestamp;
 
-    /**
-     * @param {WebInspector.Resource} resource
-     * @param {string} content
-     * @param {boolean} majorChange
-     * @param {function(?string)} callback
-     */
-    setContent: function(resource, content, majorChange, callback) { }
+        var registry = WebInspector.Revision._revisionHistoryRegistry();
+
+        var historyItems = registry[url];
+        if (!historyItems) {
+            historyItems = [];
+            registry[url] = historyItems;
+        }
+        historyItems.push({url: url, loaderId: loaderId, timestamp: timestamp, key: key});
+
+        function persist()
+        {
+            window.localStorage[key] = this._content;
+            window.localStorage["revision-history"] = JSON.stringify(registry);
+        }
+
+        // Schedule async storage.
+        setTimeout(persist.bind(this), 0);
+    }
 }
diff --git a/Source/WebCore/inspector/front-end/ResourceScriptMapping.js b/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
index c97eb01b1..6e2519f26 100644
--- a/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
+++ b/Source/WebCore/inspector/front-end/ResourceScriptMapping.js
@@ -161,6 +161,8 @@ WebInspector.ResourceScriptMapping.prototype = {
      */
     _uiSourceCodeAdded: function(rawSourceCode, uiSourceCode)
     {
+        if (!uiSourceCode.url)
+            return;
         this._rawSourceCodeForUISourceCode.put(uiSourceCode, rawSourceCode);
         this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
     },
@@ -172,6 +174,8 @@ WebInspector.ResourceScriptMapping.prototype = {
      */
     _uiSourceCodeReplaced: function(rawSourceCode, oldUISourceCode, uiSourceCode)
     {
+        if (!uiSourceCode.url)
+            return;
         this._rawSourceCodeForUISourceCode.remove(oldUISourceCode);
         this._rawSourceCodeForUISourceCode.put(uiSourceCode, rawSourceCode);
 
@@ -188,8 +192,9 @@ WebInspector.ResourceScriptMapping.prototype = {
      */
     _uiSourceCodeRemoved: function(rawSourceCode, uiSourceCode)
     {
+        if (!uiSourceCode.url)
+            return;
         this._rawSourceCodeForUISourceCode.remove(uiSourceCode);
-        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, uiSourceCode);
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/ResourceTreeModel.js b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
index a02c1f068..96515861f 100644
--- a/Source/WebCore/inspector/front-end/ResourceTreeModel.js
+++ b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
@@ -93,8 +93,6 @@ WebInspector.ResourceTreeModel.prototype = {
         this._addFramesRecursively(null, mainFramePayload);
         this._dispatchInspectedURLChanged();
         this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded);
-        WebInspector.Resource.restoreRevisions();
-
         this._cachedResourcesProcessed = true;
     },
 
@@ -334,23 +332,16 @@ WebInspector.ResourceTreeModel.prototype = {
     {
         var framePayload = frameTreePayload.frame;
         var frame = new WebInspector.ResourceTreeFrame(this, parentFrame, framePayload);
+        this._addFrame(frame);
 
-        // Create frame resource.
         var frameResource = this._createResourceFromFramePayload(framePayload, framePayload.url, WebInspector.resourceTypes.Document, framePayload.mimeType);
-
         if (frame.isMainFrame())
             WebInspector.inspectedPageURL = frameResource.url;
-
-        this._addFrame(frame);
         frame.addResource(frameResource);
 
         for (var i = 0; frameTreePayload.childFrames && i < frameTreePayload.childFrames.length; ++i)
             this._addFramesRecursively(frame, frameTreePayload.childFrames[i]);
 
-        if (!frameTreePayload.resources)
-            return;
-
-        // Create frame subresources.
         for (var i = 0; i < frameTreePayload.resources.length; ++i) {
             var subresource = frameTreePayload.resources[i];
             var resource = this._createResourceFromFramePayload(framePayload, subresource.url, WebInspector.resourceTypes[subresource.type], subresource.mimeType);
diff --git a/Source/WebCore/inspector/front-end/ResourceWebSocketFrameView.js b/Source/WebCore/inspector/front-end/ResourceWebSocketFrameView.js
index de277b004..59acd6518 100644
--- a/Source/WebCore/inspector/front-end/ResourceWebSocketFrameView.js
+++ b/Source/WebCore/inspector/front-end/ResourceWebSocketFrameView.js
@@ -23,77 +23,76 @@
 WebInspector.ResourceWebSocketFrameView = function(resource)
 {
     WebInspector.View.call(this);
-    this.element.addStyleClass("resource-websocket-frame-view");
+    this.element.addStyleClass("resource-websocket");
     this.resource = resource;
     this.element.removeChildren();
-    var table = document.createElement("table");
-    var header = document.createElement("thead");
 
-    var headerRow = document.createElement("tr");
-    headerRow.createChild("td");
-
-    var timeHeader = document.createElement("td");
-    timeHeader.innerText = WebInspector.UIString("Time");
-    headerRow.appendChild(timeHeader);
-
-    var opCodeHeader = document.createElement("td");
-    opCodeHeader.innerText = WebInspector.UIString("OpCode");
-    headerRow.appendChild(opCodeHeader);
-
-    var maskHeader = document.createElement("td");
-    maskHeader.innerText = WebInspector.UIString("Mask");
-    headerRow.appendChild(maskHeader);
-
-    var lengthHeader = document.createElement("td");
-    lengthHeader.innerText = WebInspector.UIString("Length");
-    headerRow.appendChild(lengthHeader);
-
-    var dataHeader = document.createElement("td");
-    dataHeader.innerText = WebInspector.UIString("Data");
-    headerRow.appendChild(dataHeader);
-    table.appendChild(headerRow);
+    var dataGrid = new WebInspector.DataGrid({
+        data: {title: WebInspector.UIString("Data"), sortable: false},
+        length: {title: WebInspector.UIString("Length"), sortable: false, aligned: "right", width: "50px"},
+        time: {title: WebInspector.UIString("Time"), width: "70px"}
+    });
 
     var frames = this.resource.frames();
     for (var i = 0; i < frames.length; i++) {
         var payload = frames[i];
 
-        var row = document.createElement("tr");
-
-        var count = document.createElement("td");
-        count.innerText = i + 1;
-        row.appendChild(count);
-
-        var dateCell = document.createElement("td");
-        var date = new Date();
-        date.setTime(payload.time * 1000);
-        dateCell.innerText = String.sprintf("%s %s", (payload.sent ? "\u2192" : (payload.errorMessage ? "" : "\u2190")), date.toISOString());
-        row.appendChild(dateCell);
+        var date = new Date(payload.time * 1000);
+        var row = {
+            data: "",
+            length: payload.payloadData.length.toString(),
+            time: date.toLocaleTimeString()
+        };
 
+        var rowClass = "";
         if (payload.errorMessage) {
-            var spanCell = document.createElement("td");
-            spanCell.setAttribute("colspan", 4);
-            spanCell.innerText = payload.errorMessage;
-            row.appendChild(spanCell);
+            rowClass = "error";
+            row.data = payload.errorMessage;
+        } else if (payload.opcode == WebInspector.ResourceWebSocketFrameView.OpCodes.TextFrame) {
+            if (payload.sent)
+                rowClass = "outcoming";
+
+            row.data = payload.payloadData;
         } else {
-            var opcode = document.createElement("td");
-            opcode.innerText = payload.opcode;
-            row.appendChild(opcode);
+            rowClass = "opcode";
+            var opcodeMeaning = "";
+            switch (payload.opcode) {
+            case WebInspector.ResourceWebSocketFrameView.OpCodes.ContinuationFrame:
+                opcodeMeaning = WebInspector.UIString("Continuation Frame");
+                break;
+            case WebInspector.ResourceWebSocketFrameView.OpCodes.BinaryFrame:
+                opcodeMeaning = WebInspector.UIString("Binary Frame");
+                break;
+            case WebInspector.ResourceWebSocketFrameView.OpCodes.ConnectionCloseFrame:
+                opcodeMeaning = WebInspector.UIString("Connection Close Frame");
+                break;
+            case WebInspector.ResourceWebSocketFrameView.OpCodes.PingFrame:
+                opcodeMeaning = WebInspector.UIString("Ping Frame");
+                break;
+            case WebInspector.ResourceWebSocketFrameView.OpCodes.PongFrame:
+                opcodeMeaning = WebInspector.UIString("Pong Frame");
+                break;
+            }
+            row.data = WebInspector.UIString("%s (Opcode %d%s)", opcodeMeaning, payload.opcode, (payload.mask ? ", mask" : ""));
+        }
 
-            var mask = document.createElement("td");
-            mask.innerText = payload.mask;
-            row.appendChild(mask);
+        var node = new WebInspector.DataGridNode(row, false);
+        dataGrid.rootNode().appendChild(node);
 
-            var length = document.createElement("td");
-            length.innerText = payload.payloadData.length;
-            row.appendChild(length);
+        if (rowClass)
+            node.element.classList.add("resource-websocket-row-" + rowClass);
 
-            var data = document.createElement("td");
-            data.textContent = payload.payloadData;
-            row.appendChild(data);
-        }
-        table.appendChild(row);
     }
-    this.element.appendChild(table);
+    dataGrid.show(this.element);
 }
 
+WebInspector.ResourceWebSocketFrameView.OpCodes = {
+    ContinuationFrame: 0,
+    TextFrame: 1,
+    BinaryFrame: 2,
+    ConnectionCloseFrame: 8,
+    PingFrame: 9,
+    PongFrame: 10
+};
+
 WebInspector.ResourceWebSocketFrameView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index c97c1f25b..ee5fc5033 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -462,6 +462,14 @@ WebInspector.ResourcesPanel.prototype = {
         this._innerShowView(this._applicationCacheViews[frameId]);
     },
 
+    /**
+     *  @param {WebInspector.View} view
+     */
+    showFileSystem: function(view)
+    {
+        this._innerShowView(view);
+    },
+
     showCategoryView: function(categoryName)
     {
         if (!this._categoryView)
@@ -1525,6 +1533,7 @@ WebInspector.FileSystemListTreeElement.prototype = {
         var fileSystemTreeElement = this._fileSystemTreeElementByName(fileSystem.name);
         if (!fileSystemTreeElement)
             return;
+        fileSystemTreeElement.clear();
         this.removeChild(fileSystemTreeElement);
     },
 
@@ -1722,8 +1731,12 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
 
     _updateTooltip: function()
     {
+        
         var keyPathString = this._objectStore.keyPathString;
-        this.tooltip = keyPathString !== null ? (WebInspector.UIString("Key path: ") + keyPathString) : "";
+        var tooltipString = keyPathString !== null ? (WebInspector.UIString("Key path: ") + keyPathString) : "";
+        if (this._objectStore.autoIncrement)
+            tooltipString += "\n" + WebInspector.UIString("autoIncrement");
+        this.tooltip = tooltipString
     },
 
     onselect: function()
@@ -1977,6 +1990,19 @@ WebInspector.FileSystemTreeElement.prototype = {
     get itemURL()
     {
         return "filesystem://" + this._fileSystem.name;
+    },
+
+    onselect: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onselect.call(this);
+        this._fileSystemView = new WebInspector.FileSystemView(this._fileSystem);
+        this._storagePanel.showFileSystem(this._fileSystemView);
+    },
+
+    clear: function()
+    {
+        if (this.fileSystemView && this._storagePanel.visibleView == this.fileSystemView)
+            this._storagePanel.closeVisibleView();
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/RevisionHistoryView.js b/Source/WebCore/inspector/front-end/RevisionHistoryView.js
index c42904500..fad2cb143 100644
--- a/Source/WebCore/inspector/front-end/RevisionHistoryView.js
+++ b/Source/WebCore/inspector/front-end/RevisionHistoryView.js
@@ -112,17 +112,26 @@ WebInspector.RevisionHistoryView.prototype = {
         revertToOriginal.textContent = WebInspector.UIString("apply original content");
         revertToOriginal.addEventListener("click", resource.revertToOriginal.bind(resource));
 
-        function clearHistory()
+        var clearHistoryElement = resourceItem.listItemElement.createChild("span", "revision-history-link");
+        clearHistoryElement.textContent = WebInspector.UIString("revert");
+        clearHistoryElement.addEventListener("click", this._clearHistory.bind(this, resource));
+        return resourceItem;
+    },
+
+    /**
+     * @param {WebInspector.Resource} resource
+     */
+    _clearHistory: function(resource)
+    {
+        resource.revertAndClearHistory(historyCleared.bind(this));
+
+        function historyCleared()
         {
-            resource.revertAndClearHistory();
+            var resourceItem = this._resourceItems.get(resource);
             this._treeOutline.removeChild(resourceItem);
             this._resourceItems.remove(resource);
         }
 
-        var clearHistoryElement = resourceItem.listItemElement.createChild("span", "revision-history-link");
-        clearHistoryElement.textContent = WebInspector.UIString("revert");
-        clearHistoryElement.addEventListener("click", clearHistory.bind(this));
-        return resourceItem;
     },
 
     _revisionAdded: function(event)
@@ -165,8 +174,8 @@ WebInspector.RevisionHistoryView.prototype.__proto__ = WebInspector.View.prototy
 /**
  * @constructor
  * @extends {TreeElement}
- * @param {WebInspector.ResourceRevision} revision
- * @param {WebInspector.ResourceRevision} baseRevision
+ * @param {WebInspector.Revision} revision
+ * @param {WebInspector.Revision} baseRevision
  * @param {boolean} allowRevert
  */
 WebInspector.RevisionHistoryTreeElement = function(revision, baseRevision, allowRevert)
diff --git a/Source/WebCore/inspector/front-end/ScriptSnippetModel.js b/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
index 9593089cd..9d712d0c7 100644
--- a/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
+++ b/Source/WebCore/inspector/front-end/ScriptSnippetModel.js
@@ -42,13 +42,10 @@ WebInspector.ScriptSnippetModel = function()
     this._lastSnippetEvaluationIndexSetting = WebInspector.settings.createSetting("lastSnippetEvaluationIndex", 0);
     this._snippetScriptMapping = new WebInspector.SnippetScriptMapping(this);
     
-    var snippets = this._snippetStorage.snippets;
-    for (var i = 0; i < snippets.length; ++i)
-        this._addScriptSnippet(snippets[i]);
+    this._loadSnippets();
 }
 
-WebInspector.ScriptSnippetModel.evaluatedSnippetExtraLinesCount = 2;
-WebInspector.ScriptSnippetModel.snippetSourceURLPrefix = "snippets://";
+WebInspector.ScriptSnippetModel.snippetSourceURLPrefix = "snippets:///";
 
 WebInspector.ScriptSnippetModel.prototype = {
     /**
@@ -59,6 +56,13 @@ WebInspector.ScriptSnippetModel.prototype = {
         return this._snippetScriptMapping;
     },
 
+    _loadSnippets: function()
+    {
+        var snippets = this._snippetStorage.snippets();
+        for (var i = 0; i < snippets.length; ++i)
+            this._addScriptSnippet(snippets[i]);
+    },
+
     /**
      * @return {WebInspector.SnippetJavaScriptSource}
      */
@@ -87,6 +91,7 @@ WebInspector.ScriptSnippetModel.prototype = {
     {
         var snippet = this._snippetStorage.snippetForId(snippetJavaScriptSource.snippetId);
         this._snippetStorage.deleteSnippet(snippet);
+        this._removeBreakpoints(snippetJavaScriptSource);
         this._releaseSnippetScript(snippetJavaScriptSource);
         delete this._snippetJavaScriptSourceForSnippetId[snippet.id];
         this._snippetScriptMapping._fireUISourceCodeRemoved(snippetJavaScriptSource);
@@ -107,9 +112,19 @@ WebInspector.ScriptSnippetModel.prototype = {
 
     /**
      * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     * @return {boolean}
+     */
+    _isDivergedFromVM: function(snippetJavaScriptSource)
+    {
+        var script = this._scriptForUISourceCode.get(snippetJavaScriptSource);
+        return !script;
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
      * @param {string} newContent
      */
-    setScriptSnippetContent: function(snippetJavaScriptSource, newContent)
+    _setScriptSnippetContent: function(snippetJavaScriptSource, newContent)
     {
         var snippet = this._snippetStorage.snippetForId(snippetJavaScriptSource.snippetId);
         snippet.content = newContent;
@@ -119,17 +134,86 @@ WebInspector.ScriptSnippetModel.prototype = {
     /**
      * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
      */
-    evaluateScriptSnippet: function(snippetJavaScriptSource)
+    _scriptSnippetEdited: function(snippetJavaScriptSource)
     {
+        var script = this._scriptForUISourceCode.get(snippetJavaScriptSource);
+        if (!script)
+            return;
+        
+        var breakpointLocations = this._removeBreakpoints(snippetJavaScriptSource);
         this._releaseSnippetScript(snippetJavaScriptSource);
+        this._restoreBreakpoints(snippetJavaScriptSource, breakpointLocations);
+    },
+
+    /**
+     * @param {string} snippetId
+     * @return {number}
+     */
+    _nextEvaluationIndex: function(snippetId)
+    {
         var evaluationIndex = this._lastSnippetEvaluationIndexSetting.get() + 1;
         this._lastSnippetEvaluationIndexSetting.set(evaluationIndex);
+        return evaluationIndex;
+    },
 
-        var snippet = this._snippetStorage.snippetForId(snippetJavaScriptSource.snippetId);
-        var sourceURL = this._sourceURLForSnippet(snippet, evaluationIndex);
-        snippet._lastEvaluationSourceURL = sourceURL;
-        var expression = "\n//@ sourceURL=" + sourceURL + "\n" + snippet.content;
-        WebInspector.evaluateInConsole(expression, true);
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     */
+    evaluateScriptSnippet: function(snippetJavaScriptSource)
+    {
+        var breakpointLocations = this._removeBreakpoints(snippetJavaScriptSource);
+        this._releaseSnippetScript(snippetJavaScriptSource);
+        this._restoreBreakpoints(snippetJavaScriptSource, breakpointLocations);
+        var evaluationIndex = this._nextEvaluationIndex(snippetJavaScriptSource.snippetId);
+        snippetJavaScriptSource._evaluationIndex = evaluationIndex;
+        var evaluationUrl = this._evaluationSourceURL(snippetJavaScriptSource);
+
+        var expression = snippetJavaScriptSource.workingCopy();
+        
+        // In order to stop on the breakpoints during the snippet evaluation we need to compile and run it separately.
+        // If separate compilation and execution is not supported by the port we fall back to evaluation in console.
+        // In case we don't need that since debugger is already paused.
+        // We do the same when we are stopped on the call frame  since debugger is already paused and can not stop on breakpoint anymore.
+        if (WebInspector.debuggerModel.selectedCallFrame() || !Capabilities.separateScriptCompilationAndExecutionEnabled) {
+            expression = snippetJavaScriptSource.workingCopy() + "\n//@ sourceURL=" + evaluationUrl + "\n";
+            WebInspector.evaluateInConsole(expression, true);
+            return;
+        }
+        
+        WebInspector.showConsole();
+        DebuggerAgent.compileScript(expression, evaluationUrl, compileCallback.bind(this));
+
+        /**
+         * @param {?string} error
+         * @param {string=} scriptId
+         * @param {string=} syntaxErrorMessage
+         */
+        function compileCallback(error, scriptId, syntaxErrorMessage)
+        {
+            if (!snippetJavaScriptSource || snippetJavaScriptSource._evaluationIndex !== evaluationIndex)
+                return;
+
+            if (error) {
+                console.error(error);
+                return;
+            }
+
+            if (!scriptId) {
+                var consoleMessage = WebInspector.ConsoleMessage.create(
+                        WebInspector.ConsoleMessage.MessageSource.JS,
+                        WebInspector.ConsoleMessage.MessageLevel.Error,
+                        syntaxErrorMessage || "",
+                        WebInspector.ConsoleMessage.MessageType.Log,
+                        "", 0, 1, null, null, null);
+                WebInspector.console.addMessage(consoleMessage);
+                return;
+            }
+
+            var breakpointLocations = this._removeBreakpoints(snippetJavaScriptSource);
+            this._restoreBreakpoints(snippetJavaScriptSource, breakpointLocations);
+
+            WebInspector.consoleView.runScript(scriptId);
+        }
     },
 
     /**
@@ -139,11 +223,6 @@ WebInspector.ScriptSnippetModel.prototype = {
     _rawLocationToUILocation: function(rawLocation)
     {
         var uiSourceCode = this._uiSourceCodeForScriptId[rawLocation.scriptId];
-        if (uiSourceCode.isSnippet) {
-            var uiLineNumber = rawLocation.lineNumber - WebInspector.ScriptSnippetModel.evaluatedSnippetExtraLinesCount;
-            return new WebInspector.UILocation(uiSourceCode, uiLineNumber, rawLocation.columnNumber || 0);
-        }
-
         return new WebInspector.UILocation(uiSourceCode, rawLocation.lineNumber, rawLocation.columnNumber || 0);
     },
 
@@ -159,11 +238,6 @@ WebInspector.ScriptSnippetModel.prototype = {
         if (!script)
             return null;
 
-        if (uiSourceCode.isSnippet) {
-            var rawLineNumber = lineNumber + WebInspector.ScriptSnippetModel.evaluatedSnippetExtraLinesCount;
-            return WebInspector.debuggerModel.createRawLocation(script, rawLineNumber, columnNumber);
-        }
-
         return WebInspector.debuggerModel.createRawLocation(script, lineNumber, columnNumber);
     },
 
@@ -199,7 +273,8 @@ WebInspector.ScriptSnippetModel.prototype = {
     {
         var snippetId = this._snippetIdForSourceURL(script.sourceURL);
         var snippetJavaScriptSource = this._snippetJavaScriptSourceForSnippetId[snippetId];
-        if (!snippetJavaScriptSource) {
+        
+        if (!snippetJavaScriptSource || this._evaluationSourceURL(snippetJavaScriptSource) !== script.sourceURL) {
             this._createUISourceCodeForScript(script);
             return;
         }
@@ -219,12 +294,36 @@ WebInspector.ScriptSnippetModel.prototype = {
         uiSourceCode.isSnippetEvaluation = true;
         this._uiSourceCodeForScriptId[script.scriptId] = uiSourceCode;
         this._scriptForUISourceCode.put(uiSourceCode, script);
-        this._snippetScriptMapping._fireUISourceCodeAdded(uiSourceCode);
         script.setSourceMapping(this._snippetScriptMapping);
     },
 
     /**
      * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     * @return {Array.<Object>}
+     */
+    _removeBreakpoints: function(snippetJavaScriptSource)
+    {
+        var breakpointLocations = WebInspector.breakpointManager.breakpointLocationsForUISourceCode(snippetJavaScriptSource);
+        for (var i = 0; i < breakpointLocations.length; ++i)
+            breakpointLocations[i].breakpoint.remove();
+        return breakpointLocations;
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
+     * @param {Array.<Object>} breakpointLocations
+     */
+    _restoreBreakpoints: function(snippetJavaScriptSource, breakpointLocations)
+    {
+        for (var i = 0; i < breakpointLocations.length; ++i) {
+            var uiLocation = breakpointLocations[i].uiLocation;
+            var breakpoint = breakpointLocations[i].breakpoint;
+            WebInspector.breakpointManager.setBreakpoint(uiLocation.uiSourceCode, uiLocation.lineNumber, breakpoint.condition(), breakpoint.enabled());
+        }
+    },
+
+    /**
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
      */
     _releaseSnippetScript: function(snippetJavaScriptSource)
     {
@@ -234,20 +333,19 @@ WebInspector.ScriptSnippetModel.prototype = {
 
         delete this._uiSourceCodeForScriptId[script.scriptId];
         this._scriptForUISourceCode.remove(snippetJavaScriptSource);
-
+        delete snippetJavaScriptSource._evaluationIndex;
         this._createUISourceCodeForScript(script);
     },
 
     /**
-     * @param {WebInspector.Snippet} snippet
-     * @param {string} evaluationIndex
+     * @param {WebInspector.SnippetJavaScriptSource} snippetJavaScriptSource
      * @return {string}
      */
-    _sourceURLForSnippet: function(snippet, evaluationIndex)
+    _evaluationSourceURL: function(snippetJavaScriptSource)
     {
         var snippetPrefix = WebInspector.ScriptSnippetModel.snippetSourceURLPrefix;
-        var evaluationSuffix = evaluationIndex ? "_" + evaluationIndex : "";
-        return snippetPrefix + snippet.id + evaluationSuffix;
+        var evaluationSuffix = "_" + snippetJavaScriptSource._evaluationIndex;
+        return snippetPrefix + snippetJavaScriptSource.snippetId + evaluationSuffix;
     },
 
     /**
@@ -264,28 +362,12 @@ WebInspector.ScriptSnippetModel.prototype = {
         return snippetId;
     },
 
-    /**
-     * @param {string} sourceURL
-     * @return {WebInspector.Snippet|null}
-     */
-    _snippetForSourceURL: function(sourceURL)
-    {
-        var snippetId = this._snippetIdForSourceURL(sourceURL);
-        if (!snippetId)
-            return null;
-        var snippet = this._snippetStorage.snippetForId(snippetId);
-        if (!snippet || snippet._lastEvaluationSourceURL !== sourceURL)
-            return null;
-        return snippet;
-    },
-
     _reset: function()
     {
         var removedUISourceCodes = this._releasedUISourceCodes();
         this._uiSourceCodeForScriptId = {};
         this._scriptForUISourceCode = new Map();
-        for (var i = 0; i < removedUISourceCodes.length; ++i)
-            this._snippetScriptMapping._fireUISourceCodeRemoved(removedUISourceCodes[i]);
+        this._loadSnippets();
     }
 }
 
@@ -317,14 +399,48 @@ WebInspector.SnippetJavaScriptSource.prototype = {
     },
 
     /**
+     * @return {boolean}
+     */
+    isDivergedFromVM: function()
+    {
+        return this._scriptSnippetModel._isDivergedFromVM(this);
+    },
+
+    /**
      * @param {function(?string)} callback
      */
     workingCopyCommitted: function(callback)
     {  
-        this._scriptSnippetModel.setScriptSnippetContent(this, this.workingCopy());
+        this._scriptSnippetModel._setScriptSnippetContent(this, this.workingCopy());
         callback(null);
     },
 
+    workingCopyChanged: function()
+    {  
+        this._scriptSnippetModel._scriptSnippetEdited(this);
+    },
+
+    evaluate: function()
+    {
+        this._scriptSnippetModel.evaluateScriptSnippet(this);
+    },
+
+    /**
+     * @return {boolean}
+     */
+    supportsEnabledBreakpointsWhileEditing: function()
+    {
+        return true;
+    },
+
+    /**
+     * @return {string}
+     */
+    breakpointStorageId: function()
+    {
+        return WebInspector.ScriptSnippetModel.snippetSourceURLPrefix + this.snippetId;
+    },
+
     /**
      * @return {string}
      */
diff --git a/Source/WebCore/inspector/front-end/ScriptsNavigator.js b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
index a6dea59c2..d8caf8416 100644
--- a/Source/WebCore/inspector/front-end/ScriptsNavigator.js
+++ b/Source/WebCore/inspector/front-end/ScriptsNavigator.js
@@ -48,6 +48,7 @@ WebInspector.ScriptsNavigator = function()
     this._snippetsView.addEventListener(WebInspector.NavigatorView.Events.ItemSelected, this._scriptSelected, this);
     this._snippetsView.addEventListener(WebInspector.NavigatorView.Events.FileRenamed, this._fileRenamed, this);
     this._snippetsView.addEventListener(WebInspector.SnippetsNavigatorView.Events.SnippetCreationRequested, this._snippetCreationRequested, this);
+    this._snippetsView.addEventListener(WebInspector.SnippetsNavigatorView.Events.ItemRenamingRequested, this._itemRenamingRequested, this);
 
     this._tabbedPane.appendTab(WebInspector.ScriptsNavigator.ScriptsTab, WebInspector.UIString("Sources"), this._scriptsView);
     this._tabbedPane.selectTab(WebInspector.ScriptsNavigator.ScriptsTab);
@@ -59,6 +60,7 @@ WebInspector.ScriptsNavigator = function()
 WebInspector.ScriptsNavigator.Events = {
     ScriptSelected: "ScriptSelected",
     SnippetCreationRequested: "SnippetCreationRequested",
+    ItemRenamingRequested: "ItemRenamingRequested",
     FileRenamed: "FileRenamed"
 }
 
@@ -98,6 +100,14 @@ WebInspector.ScriptsNavigator.prototype = {
 
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    removeUISourceCode: function(uiSourceCode)
+    {
+        this._snippetsNavigatorViewForUISourceCode(uiSourceCode).removeUISourceCode(uiSourceCode);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
      * @return {boolean}
      */
     isScriptSourceAdded: function(uiSourceCode)
@@ -158,6 +168,14 @@ WebInspector.ScriptsNavigator.prototype = {
     /**
      * @param {WebInspector.Event} event
      */
+    _itemRenamingRequested: function(event)
+    {
+        this.dispatchEventToListeners(WebInspector.ScriptsNavigator.Events.ItemRenamingRequested, event.data);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
     _snippetCreationRequested: function(event)
     {    
         this.dispatchEventToListeners(WebInspector.ScriptsNavigator.Events.SnippetCreationRequested, event.data);
@@ -184,7 +202,8 @@ WebInspector.SnippetsNavigatorView = function()
 }
 
 WebInspector.SnippetsNavigatorView.Events = {
-    SnippetCreationRequested: "SnippetCreationRequested"
+    SnippetCreationRequested: "SnippetCreationRequested",
+    ItemRenamingRequested: "ItemRenamingRequested"
 }
 
 WebInspector.SnippetsNavigatorView.prototype = {
@@ -232,7 +251,10 @@ WebInspector.SnippetsNavigatorView.prototype = {
      */
     _handleEvaluateSnippet: function(uiSourceCode, event)
     {
-        // FIXME: To be implemented.
+        if (!uiSourceCode.isSnippet)
+            return;
+        var snippetJavaScriptSource = /** @type {WebInspector.SnippetJavaScriptSource} */ uiSourceCode;
+        snippetJavaScriptSource.evaluate();
     },
 
     /**
@@ -241,7 +263,7 @@ WebInspector.SnippetsNavigatorView.prototype = {
      */
     _handleRenameSnippet: function(uiSourceCode, event)
     {
-        this.rename(uiSourceCode);
+        this.dispatchEventToListeners(WebInspector.ScriptsNavigator.Events.ItemRenamingRequested, uiSourceCode);
     },
 
     /**
@@ -250,7 +272,10 @@ WebInspector.SnippetsNavigatorView.prototype = {
      */
     _handleRemoveSnippet: function(uiSourceCode, event)
     {
-        // FIXME: To be implemented.
+        if (!uiSourceCode.isSnippet)
+            return;
+        var snippetJavaScriptSource = /** @type {WebInspector.SnippetJavaScriptSource} */ uiSourceCode;
+        WebInspector.scriptSnippetModel.deleteScriptSnippet(snippetJavaScriptSource);
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index 2d64e20f9..d31fa2dfe 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -29,9 +29,9 @@
  * @implements {WebInspector.TabbedEditorContainerDelegate}
  * @implements {WebInspector.ContextMenu.Provider}
  * @extends {WebInspector.Panel}
- * @param {WebInspector.CompositeUISourceCodeProvider=} uiSourceCodeProviderForTest
+ * @param {WebInspector.Workspace=} workspaceForTest
  */
-WebInspector.ScriptsPanel = function(uiSourceCodeProviderForTest)
+WebInspector.ScriptsPanel = function(workspaceForTest)
 {
     WebInspector.Panel.call(this, "scripts");
     this.registerRequiredCSS("scriptsPanel.css");
@@ -40,13 +40,7 @@ WebInspector.ScriptsPanel = function(uiSourceCodeProviderForTest)
     WebInspector.settings.navigatorWasOnceHidden = WebInspector.settings.createSetting("navigatorWasOnceHidden", false);
     WebInspector.settings.debuggerSidebarHidden = WebInspector.settings.createSetting("debuggerSidebarHidden", false);
 
-    var scriptMapping = new WebInspector.DebuggerScriptMapping();
-    var providers = scriptMapping.uiSourceCodeProviders();
-    providers = providers.concat(new WebInspector.StylesUISourceCodeProvider());
-    this._uiSourceCodeProvider = uiSourceCodeProviderForTest || new WebInspector.CompositeUISourceCodeProvider(providers);
-
-    new WebInspector.PresentationConsoleMessageHelper(this._uiSourceCodeProvider);
-    new WebInspector.DebuggerResourceBinding(this._uiSourceCodeProvider);
+    this._workspace = workspaceForTest || WebInspector.workspace;
 
     function viewGetter()
     {
@@ -86,10 +80,11 @@ WebInspector.ScriptsPanel = function(uiSourceCodeProviderForTest)
     this._editorContainer = new WebInspector.TabbedEditorContainer(this, "previouslyViewedFiles");
     this._editorContainer.show(this.editorView.mainElement);
 
-    this._navigatorController = new WebInspector.NavigatorOverlayController(this, this.editorView, this._navigator.view, this._editorContainer.view);
+    this._navigatorController = new WebInspector.NavigatorOverlayController(this.editorView, this._navigator.view, this._editorContainer.view);
 
     this._navigator.addEventListener(WebInspector.ScriptsNavigator.Events.ScriptSelected, this._scriptSelected, this);
     this._navigator.addEventListener(WebInspector.ScriptsNavigator.Events.SnippetCreationRequested, this._snippetCreationRequested, this);
+    this._navigator.addEventListener(WebInspector.ScriptsNavigator.Events.ItemRenamingRequested, this._itemRenamingRequested, this);
     this._navigator.addEventListener(WebInspector.ScriptsNavigator.Events.FileRenamed, this._fileRenamed, this);
 
     this._editorContainer.addEventListener(WebInspector.TabbedEditorContainer.Events.EditorSelected, this._editorSelected, this);
@@ -133,6 +128,10 @@ WebInspector.ScriptsPanel = function(uiSourceCodeProviderForTest)
     helpSection.addKey(outlineShortcut.name, WebInspector.UIString("Go to member"));
     this.registerShortcut(outlineShortcut.key, this._showOutlineDialog.bind(this));
 
+    var createBreakpointShortcut = WebInspector.KeyboardShortcut.makeDescriptor("b", WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta);
+    helpSection.addKey(createBreakpointShortcut.name, WebInspector.UIString("Toggle breakpoint"));
+    this.registerShortcut(createBreakpointShortcut.key, this._toggleBreakpoint.bind(this));
+
     var panelEnablerHeading = WebInspector.UIString("You need to enable debugging before you can use the Scripts panel.");
     var panelEnablerDisclaimer = WebInspector.UIString("Enabling debugging will make scripts run slower.");
     var panelEnablerButton = WebInspector.UIString("Enable Debugging");
@@ -168,18 +167,18 @@ WebInspector.ScriptsPanel = function(uiSourceCodeProviderForTest)
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.CallFrameSelected, this._callFrameSelected, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ConsoleCommandEvaluatedInSelectedCallFrame, this._consoleCommandEvaluatedInSelectedCallFrame, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ExecutionLineChanged, this._executionLineChanged, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.GlobalObjectCleared, this._reset.bind(this, false));
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointsActiveStateChanged, this._breakpointsActiveStateChanged, this);
 
-    this._uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, this._handleUISourceCodeAdded, this);
-    this._uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, this._uiSourceCodeReplaced, this);
-    this._uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, this._uiSourceCodeRemoved, this);
+    this._workspace.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, this._handleUISourceCodeAdded, this);
+    this._workspace.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, this._uiSourceCodeReplaced, this);
+    this._workspace.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, this._uiSourceCodeRemoved, this);
+    this._workspace.addEventListener(WebInspector.Workspace.Events.WorkspaceReset, this._reset.bind(this, false), this);
 
     var enableDebugger = !Capabilities.debuggerCausesRecompilation || WebInspector.settings.debuggerEnabled.get();
     if (enableDebugger)
         WebInspector.debuggerModel.enableDebugger();
 
-    WebInspector.advancedSearchController.registerSearchScope(new WebInspector.ScriptsSearchScope(this._uiSourceCodeProvider));
+    WebInspector.advancedSearchController.registerSearchScope(new WebInspector.ScriptsSearchScope(this._workspace));
     WebInspector.ContextMenu.registerProvider(this);
 }
 
@@ -239,7 +238,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     _loadUISourceCodes: function()
     {
-        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
+        var uiSourceCodes = this._workspace.uiSourceCodes();
         for (var i = 0; i < uiSourceCodes.length; ++i)
             this._uiSourceCodeAdded(uiSourceCodes[i]);
     },
@@ -249,11 +248,6 @@ WebInspector.ScriptsPanel.prototype = {
      */
     _uiSourceCodeAdded: function(uiSourceCode)
     {
-        if (!uiSourceCode.url || uiSourceCode.isSnippetEvaluation) {
-            // Anonymous sources and snippets evaluations are shown only when stepping.
-            return;
-        }
-
         this._addUISourceCode(uiSourceCode);
     },
 
@@ -263,12 +257,14 @@ WebInspector.ScriptsPanel.prototype = {
     _addUISourceCode: function(uiSourceCode)
     {
         this._navigator.addUISourceCode(uiSourceCode);
-        this._editorContainer.uiSourceCodeAdded(uiSourceCode);
+        this._editorContainer.addUISourceCode(uiSourceCode);
     },
 
     _uiSourceCodeRemoved: function(event)
     {
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        this._editorContainer.removeUISourceCode(uiSourceCode);
+        this._navigator.removeUISourceCode(uiSourceCode);
         this._removeSourceFrame(uiSourceCode);
     },
 
@@ -372,6 +368,10 @@ WebInspector.ScriptsPanel.prototype = {
             this.sidebarPanes.workers.reset();
         WebInspector.RevisionHistoryView.reset();
 
+        var uiSourceCodes = this._workspace.uiSourceCodes();
+        for (var i = 0; i < uiSourceCodes.length; ++i)
+            this._removeSourceFrame(uiSourceCodes[i]);
+
         this._loadUISourceCodes();
     },
 
@@ -396,7 +396,7 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (this._debuggerEnabled && anchor.uiSourceCode)
             return true;
-        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
+        var uiSourceCodes = this._workspace.uiSourceCodes();
         for (var i = 0; i < uiSourceCodes.length; ++i) {
             if (uiSourceCodes[i].url === anchor.href) {
                 anchor.uiSourceCode = uiSourceCodes[i];
@@ -545,9 +545,10 @@ WebInspector.ScriptsPanel.prototype = {
     _revealExecutionLine: function(uiLocation)
     {
         // Some scripts (anonymous and snippets evaluations) are not added to files select by default.
-        this._editorContainer.uiSourceCodeAdded(uiLocation.uiSourceCode);
+        this._editorContainer.addUISourceCode(uiLocation.uiSourceCode);
         var sourceFrame = this._showFile(uiLocation.uiSourceCode);
         sourceFrame.revealLine(uiLocation.lineNumber);
+        sourceFrame.focus();
     },
 
     _callFrameSelected: function(event)
@@ -578,8 +579,9 @@ WebInspector.ScriptsPanel.prototype = {
     _editorSelected: function(event)
     {
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
-        this._showFile(uiSourceCode);
+        var sourceFrame = this._showFile(uiSourceCode);
         this._navigatorController.hideNavigatorOverlay();
+        sourceFrame.focus();
     },
 
     _scriptSelected: function(event)
@@ -894,7 +896,7 @@ WebInspector.ScriptsPanel.prototype = {
                 return;
 
             WebInspector.searchController.updateSearchMatchesCount(searchMatches, this);
-            view.jumpToFirstSearchResult();
+            view.jumpToNextSearchResult();
             WebInspector.searchController.updateCurrentMatchIndex(view.currentSearchResultIndex, this);
         }
 
@@ -940,7 +942,7 @@ WebInspector.ScriptsPanel.prototype = {
     _toggleFormatSource: function()
     {
         this._toggleFormatSourceButton.toggled = !this._toggleFormatSourceButton.toggled;
-        var uiSourceCodes = this._uiSourceCodeProvider.uiSourceCodes();
+        var uiSourceCodes = this._workspace.uiSourceCodes();
         for (var i = 0; i < uiSourceCodes.length; ++i)
             uiSourceCodes[i].setFormatted(this._toggleFormatSourceButton.toggled);
     },
@@ -950,16 +952,28 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.watchExpressions.addExpression(expression);
     },
 
+    _toggleBreakpoint: function()
+    {
+        var sourceFrame = this.visibleView;
+        if (!sourceFrame)
+            return;
+
+        if (sourceFrame instanceof WebInspector.JavaScriptSourceFrame) {
+            var javaScriptSourceFrame = /** @type {WebInspector.JavaScriptSourceFrame} */ sourceFrame;
+            javaScriptSourceFrame.toggleBreakpointOnCurrentLine();
+        }            
+    },
+
     _showOutlineDialog: function()
     {
-         var uiSourceCode = this._editorContainer.currentFile();
-         if (!uiSourceCode)
-             return;
+        var uiSourceCode = this._editorContainer.currentFile();
+        if (!uiSourceCode)
+            return;
 
-         if (uiSourceCode instanceof WebInspector.JavaScriptSource)
-             WebInspector.JavaScriptOutlineDialog.show(this.visibleView, uiSourceCode);
-         else if (uiSourceCode instanceof WebInspector.StyleSource)
-             WebInspector.StyleSheetOutlineDialog.show(this.visibleView, /** @type {WebInspector.StyleSource} */ uiSourceCode);
+        if (uiSourceCode instanceof WebInspector.JavaScriptSource)
+            WebInspector.JavaScriptOutlineDialog.show(this.visibleView, uiSourceCode);
+        else if (uiSourceCode instanceof WebInspector.StyleSource)
+            WebInspector.StyleSheetOutlineDialog.show(this.visibleView, /** @type {WebInspector.StyleSource} */ uiSourceCode);
     },
 
     _installDebuggerSidebarController: function()
@@ -1012,7 +1026,10 @@ WebInspector.ScriptsPanel.prototype = {
         WebInspector.scriptSnippetModel.renameScriptSnippet(snippetJavaScriptSource, name);
     },
         
-    _snippetCreationRequested: function()
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _snippetCreationRequested: function(event)
     {
         var snippetJavaScriptSource = WebInspector.scriptSnippetModel.createScriptSnippet();
         this._showSourceLine(snippetJavaScriptSource);
@@ -1040,11 +1057,27 @@ WebInspector.ScriptsPanel.prototype = {
     },
 
     /**
-     * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
+     * @param {WebInspector.Event} event
      */
-    registerUISourceCodeProvider: function(uiSourceCodeProvider)
+    _itemRenamingRequested: function(event)
     {
-        this._uiSourceCodeProvider._registerUISourceCodeProvider(uiSourceCodeProvider);
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
+        
+        var shouldHideNavigator = !this._navigatorController.isNavigatorPinned();
+        if (this._navigatorController.isNavigatorHidden())
+            this._navigatorController.showNavigatorOverlay();
+        this._navigator.rename(uiSourceCode, callback.bind(this));
+    
+        /**
+         * @param {boolean} committed
+         */
+        function callback(committed)
+        {
+            if (shouldHideNavigator && committed) {
+                this._navigatorController.hideNavigatorOverlay();
+                this._showSourceLine(uiSourceCode);
+            }
+        }
     },
 
     /**
@@ -1073,72 +1106,8 @@ WebInspector.ScriptsPanel.prototype = {
     showGoToSourceDialog: function()
     {
         WebInspector.inspectorView.setCurrentPanel(this);
-        WebInspector.OpenResourceDialog.show(this, this._uiSourceCodeProvider, this.editorView.mainElement);
+        WebInspector.OpenResourceDialog.show(this, this._workspace, this.editorView.mainElement);
     }
 }
 
 WebInspector.ScriptsPanel.prototype.__proto__ = WebInspector.Panel.prototype;
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- * @implements {WebInspector.UISourceCodeProvider}
- * @param {Array.<WebInspector.UISourceCodeProvider>} uiSourceCodeProviders
- */
-WebInspector.CompositeUISourceCodeProvider = function(uiSourceCodeProviders)
-{
-    WebInspector.Object.call(this);
-    this._uiSourceCodeProviders = [];
-    for (var i = 0; i < uiSourceCodeProviders.length; ++i)
-        this._registerUISourceCodeProvider(uiSourceCodeProviders[i]);
-}
-
-WebInspector.CompositeUISourceCodeProvider.prototype = {
-    /**
-     * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
-     */
-    _registerUISourceCodeProvider: function(uiSourceCodeProvider)
-    {
-        this._uiSourceCodeProviders.push(uiSourceCodeProvider);
-        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, this._handleUISourceCodeAdded, this);
-        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, this._handleUISourceCodeReplaced, this);
-        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, this._handleUISourceCodeRemoved, this);
-    },
-
-    _handleUISourceCodeAdded: function(event)
-    {
-        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, event.data);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _handleUISourceCodeReplaced: function(event)
-    {
-        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, event.data);
-    },
-
-    /**
-     * @param {WebInspector.Event} event
-     */
-    _handleUISourceCodeRemoved: function(event)
-    {
-        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, event.data);
-    },
-
-    /**
-     * @return {Array.<WebInspector.UISourceCode>}
-     */
-    uiSourceCodes: function()
-    {
-        var result = [];
-        for (var i = 0; i < this._uiSourceCodeProviders.length; ++i) {
-            var uiSourceCodes = this._uiSourceCodeProviders[i].uiSourceCodes();
-            for (var j = 0; j < uiSourceCodes.length; ++j)
-                result.push(uiSourceCodes[j]);
-        }
-        return result;
-    }
-}
-
-WebInspector.CompositeUISourceCodeProvider.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/SearchController.js b/Source/WebCore/inspector/front-end/SearchController.js
index 6ef124fd9..1565f4d25 100644
--- a/Source/WebCore/inspector/front-end/SearchController.js
+++ b/Source/WebCore/inspector/front-end/SearchController.js
@@ -34,16 +34,32 @@
  */
 WebInspector.SearchController = function()
 {
-    this.element = document.getElementById("search");
-    this._matchesElement = document.getElementById("search-results-matches");
-    this._searchItemElement = document.getElementById("toolbar-search-item");
-    this._searchControlBoxElement = document.getElementById("toolbar-search-navigation-control");
-
-    this.element.addEventListener("search", this._onSearch.bind(this), false); // when the search is emptied
-    this.element.addEventListener("mousedown", this._onSearchFieldManualFocus.bind(this), false); // when the search field is manually selected
-    this.element.addEventListener("keydown", this._onKeyDown.bind(this), true);
-   
-    this._populateSearchNavigationButtons();
+    this._element = document.createElement("div");
+    this._element.textContent = "Search:";
+
+    this._searchInputElement = this._element.createChild("input");
+    this._searchInputElement.id = "search";
+    this._searchInputElement.type = "search";
+    this._searchInputElement.incremental = true;
+    this._searchInputElement.results = 0;
+
+    this._searchNavigationNextElement = this._element.createChild("div", "toolbar-search-navigation toolbar-search-navigation-next hidden");
+    this._searchNavigationNextElement.addEventListener("mousedown", this._onNextButtonSearch.bind(this), false); 
+    this._searchNavigationNextElement.title = WebInspector.UIString("Search Next");
+
+    this._searchNavigationPrevElement = this._element.createChild("div", "toolbar-search-navigation toolbar-search-navigation-prev hidden");
+    this._searchNavigationPrevElement.addEventListener("mousedown", this._onPrevButtonSearch.bind(this), false);
+    this._searchNavigationPrevElement.title = WebInspector.UIString("Search Previous");
+
+    this._matchesElement = this._element.createChild("span", "search-results-matches");
+
+    this._searchInputElement.addEventListener("search", this._onSearch.bind(this), false); // when the search is emptied
+    this._searchInputElement.addEventListener("mousedown", this._onSearchFieldManualFocus.bind(this), false); // when the search field is manually selected
+    this._searchInputElement.addEventListener("keydown", this._onKeyDown.bind(this), true);
+
+    var closeButtonElement = this._element.createChild("span", "drawer-header-close-button");
+    closeButtonElement.textContent = WebInspector.UIString("\u00D7");
+    closeButtonElement.addEventListener("click", this.cancelSearch.bind(this), false);
 }
 
 WebInspector.SearchController.prototype = {
@@ -70,13 +86,14 @@ WebInspector.SearchController.prototype = {
         if (!panelName)
             return;
         var newLabel = WebInspector.UIString("Search %s", panelName);
-        this.element.setAttribute("placeholder", newLabel);
+        this._searchInputElement.setAttribute("placeholder", newLabel);
     },
 
     cancelSearch: function()
     {
-        this.element.value = "";
+        this._searchInputElement.value = "";
         this._performSearch("");
+        WebInspector.inspectorView.setFooterElement(null);
     },
 
     disableSearchUntilExplicitAction: function(event)
@@ -156,12 +173,15 @@ WebInspector.SearchController.prototype = {
         }
     },
 
-    _updateSearchNavigationButtonState: function(visible)
+    _updateSearchNavigationButtonState: function(enabled)
     {
-        if (visible)
-            this._searchItemElement.addStyleClass("with-navigation-buttons");
-        else
-            this._searchItemElement.removeStyleClass("with-navigation-buttons");
+        if (enabled) {
+            this._searchNavigationPrevElement.removeStyleClass("hidden");
+            this._searchNavigationNextElement.removeStyleClass("hidden");
+        } else {
+            this._searchNavigationPrevElement.addStyleClass("hidden");
+            this._searchNavigationNextElement.addStyleClass("hidden");
+        }
     },
 
     /**
@@ -204,8 +224,9 @@ WebInspector.SearchController.prototype = {
 
     focusSearchField: function()
     {
-        this.element.focus();
-        this.element.select();
+        WebInspector.inspectorView.setFooterElement(this._element);
+        this._searchInputElement.focus();
+        this._searchInputElement.select();
     },
 
     _onSearchFieldManualFocus: function(event)
@@ -217,14 +238,7 @@ WebInspector.SearchController.prototype = {
     {
         // Escape Key will clear the field and clear the search results
         if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Esc.code) {
-            // If focus belongs here and text is empty - nothing to do, return unhandled.
-            // When search was selected manually and is currently blank, we'd like Esc stay unhandled
-            // and hit console drawer handler.
-            if (event.target.value === "")
-                return;
-
             event.consume(true);
-
             this.cancelSearch();
             WebInspector.setCurrentFocusElement(WebInspector.previousFocusElement());
             if (WebInspector.currentFocusElement() === event.target)
@@ -257,13 +271,13 @@ WebInspector.SearchController.prototype = {
     _onNextButtonSearch: function(event)
     {
         // Simulate next search on search-navigation-button click.
-        this._performSearch(this.element.value, true, false, false);
+        this._performSearch(this._searchInputElement.value, true, false, false);
     },
 
     _onPrevButtonSearch: function(event)
     {
         // Simulate previous search on search-navigation-button click.
-        this._performSearch(this.element.value, true, true, false);
+        this._performSearch(this._searchInputElement.value, true, true, false);
     },
 
     /**
@@ -327,44 +341,6 @@ WebInspector.SearchController.prototype = {
 
         currentPanel.currentQuery = query;
         currentPanel.performSearch(query);
-    },
-
-    /**
-     * @param {string=} direction
-     */ 
-    _createSearchNavigationButton: function(direction) 
-    {
-        var searchNavigationControlElement = document.createElement("div");
-        var searchNavigationIconElement = document.createElement("div");
-        
-        searchNavigationControlElement.className = "toolbar-search-navigation-label";
-        
-        switch (direction) {
-        case "prev":
-            var searchTitle = WebInspector.UIString("Search Previous");
-            searchNavigationIconElement.className = "toolbar-search-navigation-icon-prev";
-            this._searchNavigationPrev = searchNavigationControlElement;
-            this._searchNavigationPrev.addEventListener("mousedown", this._onPrevButtonSearch.bind(this), false);
-            break;
-             
-        case "next":
-            var searchTitle = WebInspector.UIString("Search Next");
-            searchNavigationIconElement.className = "toolbar-search-navigation-icon-next";
-            this._searchNavigationNext = searchNavigationControlElement;
-            this._searchNavigationNext.addEventListener("mousedown", this._onNextButtonSearch.bind(this), false); 
-            break;
-        }
-
-        searchNavigationControlElement.setAttribute("title" , searchTitle);
-        searchNavigationControlElement.appendChild(searchNavigationIconElement);  
-        this._searchControlBoxElement.appendChild(searchNavigationControlElement);
-    },
-
-    _populateSearchNavigationButtons: function() 
-    {
-        // Lazily adding search navigation keys to dom.
-        this._createSearchNavigationButton("prev");
-        this._createSearchNavigationButton("next");
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index a37829daf..19c143a48 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -99,6 +99,8 @@ WebInspector.Settings = function()
     this.zoomLevel = this.createSetting("zoomLevel", 0);
     this.savedURLs = this.createSetting("savedURLs", {});
     this.javaScriptDisabled = this.createSetting("javaScriptDisabled", false);
+    this.geolocationOverride = this.createSetting("geolocationOverride", "");
+    this.geolocationError = this.createSetting("geolocationError", "None");
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
diff --git a/Source/WebCore/inspector/front-end/SettingsScreen.js b/Source/WebCore/inspector/front-end/SettingsScreen.js
index 6876e86cb..f63922705 100644
--- a/Source/WebCore/inspector/front-end/SettingsScreen.js
+++ b/Source/WebCore/inspector/front-end/SettingsScreen.js
@@ -349,6 +349,7 @@ WebInspector.UserAgentSettingsTab = function()
     p.appendChild(this._createUserAgentControl());
     if (Capabilities.canOverrideDeviceMetrics)
         p.appendChild(this._createDeviceMetricsControl());
+    p.appendChild(this._createGeolocationOverrideControl());
     p.appendChild(this._createCheckboxSetting(WebInspector.UIString("Emulate touch events"), WebInspector.settings.emulateTouchEvents));
 }
 
@@ -649,6 +650,115 @@ WebInspector.UserAgentSettingsTab.prototype = {
         cellElement.appendChild(this._createCheckboxSetting(WebInspector.UIString("Fit in window"), WebInspector.settings.deviceFitWindow, true, this._fitWindowCheckboxElement));
 
         return fieldsetElement;
+    },
+
+    _createGeolocationOverrideControl: function()
+    {
+        const geolocationSetting = WebInspector.settings.geolocationOverride.get();
+        var geolocation = WebInspector.UserAgentSupport.GeolocationPosition.parseSetting(geolocationSetting);
+
+        const p = document.createElement("p");
+        const labelElement = p.createChild("label");
+        const checkboxElement = labelElement.createChild("input");
+        checkboxElement.id = "geolocation-override-checkbox";
+        checkboxElement.type = "checkbox";
+        checkboxElement.checked = !geolocation || (geolocation._latitude && geolocation._longitude);
+        checkboxElement.addEventListener("click", this._onGeolocationOverrideCheckboxClicked.bind(this), false);
+        this._geolocationOverrideCheckboxElement = checkboxElement;
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("Override Geolocation")));
+
+        const geolocationSectionElement = this._createGeolocationOverrideElement(geolocation);
+        p.appendChild(geolocationSectionElement);
+
+        const geolocationErrorElement = this._createRadioSetting(WebInspector.UIString("Geolocation Error"), [
+        [ "None", WebInspector.UIString("None") ],
+        [ "PermissionDenied", WebInspector.UIString("PermissionDenied") ],
+        [ "PositionUnavailable", WebInspector.UIString("PositionUnavailable") ] ], WebInspector.settings.geolocationError);
+        p.appendChild(geolocationErrorElement);
+        this._geolocationErrorElement = geolocationErrorElement;
+        this._geolocationSectionElement = geolocationSectionElement;
+
+        this._setGeolocationPosition(geolocation, false, true);
+
+        return p;
+    },
+
+    _onGeolocationOverrideCheckboxClicked: function()
+    {
+        if (this._geolocationOverrideCheckboxElement.checked) {
+            this._geolocationSectionElement.removeStyleClass("hidden");
+            this._geolocationErrorElement.removeStyleClass("hidden");
+            var geolocation = WebInspector.UserAgentSupport.GeolocationPosition.parseUserInput(this._latitudeElement.value, this._longitudeElement.value);
+            if (geolocation)
+                this._setGeolocationPosition(geolocation, false, false);
+            if (!this._latitudeElement.value)
+                this._latitudeElement.focus();
+        } else {
+            this._geolocationSectionElement.addStyleClass("hidden");
+            this._geolocationErrorElement.addStyleClass("hidden");
+            PageAgent.clearGeolocationData();
+        }
+    },
+
+    _applyGeolocationUserInput: function()
+    {
+        this._setGeolocationPosition(WebInspector.UserAgentSupport.GeolocationPosition.parseUserInput(this._latitudeElement.value.trim(), this._longitudeElement.value.trim()), true, false);
+    },
+
+    /**
+     * @param {?WebInspector.UserAgentSupport.GeolocationPosition} geolocation
+     * @param {boolean} userInputModified
+     * @param {boolean} updateCheckbox
+     */
+    _setGeolocationPosition: function(geolocation, userInputModified, updateCheckbox)
+    {
+        if (!geolocation)
+            return;
+
+        if (!userInputModified) {
+            this._latitudeElement.value = geolocation._latitude;
+            this._longitudeElement.value = geolocation._longitude;
+        }
+
+        var value = geolocation.toSetting();
+        WebInspector.settings.geolocationOverride.set(value);
+
+        if (this._geolocationOverrideCheckboxElement && updateCheckbox) {
+            this._geolocationOverrideCheckboxElement.checked = !!geolocation.toSetting();
+            this._onGeolocationOverrideCheckboxClicked();
+        }
+    },
+
+    /**
+     * @param {WebInspector.UserAgentSupport.GeolocationPosition} geolocation
+     */
+    _createGeolocationOverrideElement: function(geolocation)
+    {
+        var fieldsetElement = document.createElement("fieldset");
+        fieldsetElement.id = "geolocation-override-section";
+
+        function createInput(parentElement, id, defaultText)
+        {
+            var element = parentElement.createChild("input");
+            element.id = id;
+            element.maxLength = 12;
+            element.style.width = "80px";
+            element.value = defaultText;
+            element.addEventListener("blur", this._applyGeolocationUserInput.bind(this), false);
+            return element;
+        }
+
+        var tableElement = fieldsetElement.createChild("table");
+
+        var rowElement = tableElement.createChild("tr");
+        var cellElement = rowElement.createChild("td");
+        cellElement.appendChild(document.createTextNode(WebInspector.UIString("Geolocation Position:")));
+        cellElement = rowElement.createChild("td");
+        this._latitudeElement = createInput.call(this, cellElement, "geolocation-override-latitude", String(geolocation._latitude));
+        cellElement.appendChild(document.createTextNode(" , "));
+        this._longitudeElement = createInput.call(this, cellElement, "geolocation-override-longitude", String(geolocation._longitude));
+
+        return fieldsetElement;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/SnippetStorage.js b/Source/WebCore/inspector/front-end/SnippetStorage.js
index 114a503e3..4a525c9c2 100644
--- a/Source/WebCore/inspector/front-end/SnippetStorage.js
+++ b/Source/WebCore/inspector/front-end/SnippetStorage.js
@@ -81,7 +81,7 @@ WebInspector.SnippetStorage.prototype = {
     {
         var savedSnippets = this._snippetsSetting.get();
         for (var i = 0; i < savedSnippets.length; ++i)
-            this._snippetAdded(WebInspector.Snippet.fromObject(savedSnippets[i]));
+            this._snippetAdded(WebInspector.Snippet.fromObject(this, savedSnippets[i]));
     },
 
     /**
@@ -142,12 +142,13 @@ WebInspector.Snippet = function(storage, id, name, content)
 }
 
 /**
+ * @param {WebInspector.SnippetStorage} storage
  * @param {Object} serializedSnippet
  * @return {WebInspector.Snippet}
  */
-WebInspector.Snippet.fromObject = function(serializedSnippet)
+WebInspector.Snippet.fromObject = function(storage, serializedSnippet)
 {
-    return new WebInspector.Snippet(this, serializedSnippet.id, serializedSnippet.name, serializedSnippet.content);
+    return new WebInspector.Snippet(storage, serializedSnippet.id, serializedSnippet.name, serializedSnippet.content);
 }
 
 WebInspector.Snippet.prototype = {
diff --git a/Source/WebCore/inspector/front-end/SourceCSSTokenizer.js b/Source/WebCore/inspector/front-end/SourceCSSTokenizer.js
index 9bc5414f9..42638b312 100644
--- a/Source/WebCore/inspector/front-end/SourceCSSTokenizer.js
+++ b/Source/WebCore/inspector/front-end/SourceCSSTokenizer.js
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Mon Dec 19 17:28:29 2011 */
+/* Generated by re2c 0.13.5 on Mon Jul  9 19:31:30 2012 */
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ -33,14 +33,15 @@
 
 /*
 re2c -isc Source/WebCore/inspector/front-end/SourceCSSTokenizer.re2js \
- | sed 's|^yy\([^:]*\)*\:|case \1:|' \
- | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
- | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
- | sed 's|[*]cursor|this._charAt(cursor)|' \
- | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
- | sed 's|{ gotoCase = \([^; continue; };]*\)|{ gotoCase = \1; continue; }|' \
- | sed 's|unsigned\ int|var|' \
- | sed 's|var\ yych|case 1: case 1: var yych|' > Source/WebCore/inspector/front-end/SourceCSSTokenizer.js
+  | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+  | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+  | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+  | sed 's|[*]cursor|this._charAt(cursor)|' \
+  | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+  | sed 's|{ gotoCase = \([^; continue; };]*\)|{ gotoCase = \1; continue; }|' \
+  | sed 's|yych <= \(0x[0-9a-fA-F]*\)|yych \<\= String.fromCharCode(\1)|' \
+  | sed 's|unsigned\ int|var|' \
+  | sed 's|var\ yych|case 1: case 1: var yych|' > Source/WebCore/inspector/front-end/SourceCSSTokenizer.js
 */
 
 /**
@@ -648,7 +649,7 @@ case 43:
 case 45:
             ++cursor;
             {
-                    this.tokenType = null;
+                    this.tokenType = "block-start";
                     if (this._condition.parseCondition === this._parseConditions.AT_MEDIA_RULE)
                         this._condition.parseCondition = this._parseConditions.INITIAL;
                     else
@@ -658,7 +659,7 @@ case 45:
 case 47:
             ++cursor;
             {
-                    this.tokenType = null;
+                    this.tokenType = "block-end";
                     this._condition.parseCondition = this._parseConditions.INITIAL;
                     return cursor;
                 }
diff --git a/Source/WebCore/inspector/front-end/SourceCSSTokenizer.re2js b/Source/WebCore/inspector/front-end/SourceCSSTokenizer.re2js
index cab2cad38..017d59063 100644
--- a/Source/WebCore/inspector/front-end/SourceCSSTokenizer.re2js
+++ b/Source/WebCore/inspector/front-end/SourceCSSTokenizer.re2js
@@ -32,14 +32,15 @@
 
 /*
 re2c -isc Source/WebCore/inspector/front-end/SourceCSSTokenizer.re2js \
- | sed 's|^yy\([^:]*\)*\:|case \1:|' \
- | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
- | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
- | sed 's|[*]cursor|this._charAt(cursor)|' \
- | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
- | sed 's|goto case \([^;]*\)|{ gotoCase = \1; continue; }|' \
- | sed 's|unsigned\ int|var|' \
- | sed 's|var\ yych|case 1: var yych|' > Source/WebCore/inspector/front-end/SourceCSSTokenizer.js
+  | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+  | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+  | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+  | sed 's|[*]cursor|this._charAt(cursor)|' \
+  | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+  | sed 's|goto case \([^;]*\)|{ gotoCase = \1; continue; }|' \
+  | sed 's|yych <= \(0x[0-9a-fA-F]*\)|yych \<\= String.fromCharCode(\1)|' \
+  | sed 's|unsigned\ int|var|' \
+  | sed 's|var\ yych|case 1: var yych|' > Source/WebCore/inspector/front-end/SourceCSSTokenizer.js
 */
 
 /**
@@ -211,7 +212,7 @@ WebInspector.SourceCSSTokenizer.prototype = {
 
                 <INITIAL> OpenCurlyBracket
                 {
-                    this.tokenType = null;
+                    this.tokenType = "block-start";
                     if (this._condition.parseCondition === this._parseConditions.AT_MEDIA_RULE)
                         this._condition.parseCondition = this._parseConditions.INITIAL;
                     else
@@ -221,7 +222,7 @@ WebInspector.SourceCSSTokenizer.prototype = {
 
                 <INITIAL> CloseCurlyBracket
                 {
-                    this.tokenType = null;
+                    this.tokenType = "block-end";
                     this._condition.parseCondition = this._parseConditions.INITIAL;
                     return cursor;
                 }
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index 2689a772d..ab2c85628 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -43,8 +43,8 @@ WebInspector.SourceFrame = function(contentProvider)
 
     this._textModel = new WebInspector.TextEditorModel();
 
-    var textViewerDelegate = new WebInspector.TextViewerDelegateForSourceFrame(this);
-    this._textViewer = new WebInspector.TextViewer(this._textModel, WebInspector.platform(), this._url, textViewerDelegate);
+    var textEditorDelegate = new WebInspector.TextEditorDelegateForSourceFrame(this);
+    this._textEditor = new WebInspector.TextEditor(this._textModel, this._url, textEditorDelegate);
 
     this._currentSearchResultIndex = -1;
     this._searchResults = [];
@@ -53,7 +53,7 @@ WebInspector.SourceFrame = function(contentProvider)
     this._rowMessages = {};
     this._messageBubbles = {};
 
-    this._textViewer.setReadOnly(!this.canEditSource());
+    this._textEditor.setReadOnly(!this.canEditSource());
 }
 
 WebInspector.SourceFrame.createSearchRegex = function(query)
@@ -75,18 +75,24 @@ WebInspector.SourceFrame.createSearchRegex = function(query)
     return regex;
 }
 
+WebInspector.SourceFrame.Events = {
+    ScrollChanged: "ScrollChanged",
+    SelectionChanged: "SelectionChanged"
+}
+
 WebInspector.SourceFrame.prototype = {
     wasShown: function()
     {
         this._ensureContentLoaded();
-        this._textViewer.show(this.element);
+        this._textEditor.show(this.element);
+        this._wasShownOrLoaded();
     },
 
     willHide: function()
     {
         WebInspector.View.prototype.willHide.call(this);
         if (this.loaded)
-            this._textViewer.freeCachedElements();
+            this._textEditor.freeCachedElements();
 
         this._clearLineHighlight();
         this._clearLineToReveal();
@@ -94,7 +100,7 @@ WebInspector.SourceFrame.prototype = {
 
     defaultFocusedElement: function()
     {
-        return this._textViewer.defaultFocusedElement();
+        return this._textEditor.defaultFocusedElement();
     },
 
     get loaded()
@@ -107,9 +113,9 @@ WebInspector.SourceFrame.prototype = {
         return true;
     },
 
-    get textViewer()
+    get textEditor()
     {
-        return this._textViewer;
+        return this._textEditor;
     },
 
     _ensureContentLoaded: function()
@@ -138,7 +144,7 @@ WebInspector.SourceFrame.prototype = {
         this._rowMessages = {};
         this._messageBubbles = {};
 
-        this._textViewer.doResize();
+        this._textEditor.doResize();
     },
 
     get textModel()
@@ -146,35 +152,61 @@ WebInspector.SourceFrame.prototype = {
         return this._textModel;
     },
 
+    /**
+     * @param {number} line
+     */
     canHighlightLine: function(line)
     {
         return true;
     },
 
+    /**
+     * @param {number} line
+     */
     highlightLine: function(line)
     {
         this._clearLineToReveal();
-        if (this.loaded)
-            this._textViewer.highlightLine(line);
-        else
-            this._lineToHighlight = line;
+        this._clearLineToScrollTo();
+        this._lineToHighlight = line;
+        this._innerHighlightLineIfNeeded();
+        this._textEditor.setSelection(WebInspector.TextRange.createFromLocation(line, 0));
+    },
+
+    _innerHighlightLineIfNeeded: function()
+    {
+        if (typeof this._lineToHighlight === "number") {
+            if (this.loaded && this._textEditor.isShowing()) {
+                this._textEditor.highlightLine(this._lineToHighlight);
+                delete this._lineToHighlight
+            }
+        }
     },
 
     _clearLineHighlight: function()
     {
-        if (this.loaded)
-            this._textViewer.clearLineHighlight();
-        else
-            delete this._lineToHighlight;
+        this._textEditor.clearLineHighlight();
+        delete this._lineToHighlight;
     },
 
+    /**
+     * @param {number} line
+     */
     revealLine: function(line)
     {
         this._clearLineHighlight();
-        if (this.loaded)
-            this._textViewer.revealLine(line);
-        else
-            this._lineToReveal = line;
+        this._clearLineToScrollTo();
+        this._lineToReveal = line;
+        this._innerRevealLineIfNeeded();
+    },
+
+    _innerRevealLineIfNeeded: function()
+    {
+        if (typeof this._lineToReveal === "number") {
+            if (this.loaded && this._textEditor.isShowing()) {
+                this._textEditor.revealLine(this._lineToReveal);
+                delete this._lineToReveal
+            }
+        }
     },
 
     _clearLineToReveal: function()
@@ -182,6 +214,57 @@ WebInspector.SourceFrame.prototype = {
         delete this._lineToReveal;
     },
 
+    /**
+     * @param {number} line
+     */
+    scrollToLine: function(line)
+    {
+        this._clearLineHighlight();
+        this._clearLineToReveal();
+        this._lineToScrollTo = line;
+        this._innerScrollToLineIfNeeded();
+    },
+
+    _innerScrollToLineIfNeeded: function()
+    {
+        if (typeof this._lineToScrollTo === "number") {
+            if (this.loaded && this._textEditor.isShowing()) {
+                this._textEditor.scrollToLine(this._lineToScrollTo);
+                delete this._lineToScrollTo
+            }
+        }
+    },
+
+    _clearLineToScrollTo: function()
+    {
+        delete this._lineToScrollTo;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} textRange
+     */
+    setSelection: function(textRange)
+    {
+        this._selectionToSet = textRange;
+        this._innerSetSelectionIfNeeded();
+    },
+
+    _innerSetSelectionIfNeeded: function()
+    {
+        if (this._selectionToSet && this.loaded && this._textEditor.isShowing()) {
+            this._textEditor.setSelection(this._selectionToSet);
+            delete this._selectionToSet;
+        }
+    },
+
+    _wasShownOrLoaded: function()
+    {
+        this._innerHighlightLineIfNeeded();
+        this._innerRevealLineIfNeeded();
+        this._innerScrollToLineIfNeeded();
+        this._innerSetSelectionIfNeeded();
+    },
+
     beforeTextChanged: function()
     {
         WebInspector.searchController.cancelSearch();
@@ -199,49 +282,41 @@ WebInspector.SourceFrame.prototype = {
      */
     setContent: function(content, contentEncoded, mimeType)
     {
-        this._textViewer.mimeType = mimeType;
+        this._textEditor.mimeType = mimeType;
 
         this._loaded = true;
         this._textModel.setText(content || "");
 
-        this._textViewer.beginUpdates();
+        this._textEditor.beginUpdates();
 
-        this._setTextViewerDecorations();
-
-        if (typeof this._lineToHighlight === "number") {
-            this.highlightLine(this._lineToHighlight);
-            delete this._lineToHighlight;
-        }
+        this._setTextEditorDecorations();
 
-        if (typeof this._lineToReveal === "number") {
-            this.revealLine(this._lineToReveal);
-            delete this._lineToReveal;
-        }
+        this._wasShownOrLoaded();
 
         if (this._delayedFindSearchMatches) {
             this._delayedFindSearchMatches();
             delete this._delayedFindSearchMatches;
         }
 
-        this.onTextViewerContentLoaded();
+        this.onTextEditorContentLoaded();
 
-        this._textViewer.endUpdates();
+        this._textEditor.endUpdates();
     },
 
-    onTextViewerContentLoaded: function() {},
+    onTextEditorContentLoaded: function() {},
 
-    _setTextViewerDecorations: function()
+    _setTextEditorDecorations: function()
     {
         this._rowMessages = {};
         this._messageBubbles = {};
 
-        this._textViewer.beginUpdates();
+        this._textEditor.beginUpdates();
 
         this._addExistingMessagesToSource();
 
-        this._textViewer.doResize();
+        this._textEditor.doResize();
 
-        this._textViewer.endUpdates();
+        this._textEditor.endUpdates();
     },
 
     performSearch: function(query, callback)
@@ -256,6 +331,13 @@ WebInspector.SourceFrame.prototype = {
 
             var regex = WebInspector.SourceFrame.createSearchRegex(query);
             this._searchResults = this._collectRegexMatches(regex);
+            var selection = this._textEditor.lastSelection();
+            for (var i = 0; selection && i < this._searchResults.length; ++i) {
+                if (this._searchResults[i].compareTo(selection) > 0) {
+                    this._currentSearchResultIndex = i - 1;
+                    break;
+                }
+            }
 
             callback(this, this._searchResults.length);
         }
@@ -276,7 +358,7 @@ WebInspector.SourceFrame.prototype = {
 
         this._currentSearchResultIndex = -1;
         this._searchResults = [];
-        this._textViewer.markAndRevealRange(null);
+        this._textEditor.markAndRevealRange(null);
     },
 
     hasSearchResults: function()
@@ -324,7 +406,7 @@ WebInspector.SourceFrame.prototype = {
         if (!this.loaded || !this._searchResults.length)
             return;
         this._currentSearchResultIndex = (index + this._searchResults.length) % this._searchResults.length;
-        this._textViewer.markAndRevealRange(this._searchResults[this._currentSearchResultIndex]);
+        this._textEditor.markAndRevealRange(this._searchResults[this._currentSearchResultIndex]);
     },
 
     _collectRegexMatches: function(regexObject)
@@ -365,7 +447,7 @@ WebInspector.SourceFrame.prototype = {
             messageBubbleElement = document.createElement("div");
             messageBubbleElement.className = "webkit-html-message-bubble";
             this._messageBubbles[lineNumber] = messageBubbleElement;
-            this._textViewer.addDecoration(lineNumber, messageBubbleElement);
+            this._textEditor.addDecoration(lineNumber, messageBubbleElement);
         }
 
         var rowMessages = this._rowMessages[lineNumber];
@@ -447,7 +529,7 @@ WebInspector.SourceFrame.prototype = {
             if (!rowMessages.length)
                 delete this._rowMessages[lineNumber];
             if (!messageBubbleElement.childElementCount) {
-                this._textViewer.removeDecoration(lineNumber, messageBubbleElement);
+                this._textEditor.removeDecoration(lineNumber, messageBubbleElement);
                 delete this._messageBubbles[lineNumber];
             }
             break;
@@ -464,7 +546,7 @@ WebInspector.SourceFrame.prototype = {
 
     inheritScrollPositions: function(sourceFrame)
     {
-        this._textViewer.inheritScrollPositions(sourceFrame._textViewer);
+        this._textEditor.inheritScrollPositions(sourceFrame._textEditor);
     },
 
     /**
@@ -480,6 +562,22 @@ WebInspector.SourceFrame.prototype = {
      */
     commitEditing: function(text)
     {
+    },
+
+    /**
+     * @param {WebInspector.TextRange} textRange
+     */
+    selectionChanged: function(textRange)
+    {
+        this.dispatchEventToListeners(WebInspector.SourceFrame.Events.SelectionChanged, textRange);
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    scrollChanged: function(lineNumber)
+    {
+        this.dispatchEventToListeners(WebInspector.SourceFrame.Events.ScrollChanged, lineNumber);
     }
 }
 
@@ -487,15 +585,15 @@ WebInspector.SourceFrame.prototype.__proto__ = WebInspector.View.prototype;
 
 
 /**
- * @implements {WebInspector.TextViewerDelegate}
+ * @implements {WebInspector.TextEditorDelegate}
  * @constructor
  */
-WebInspector.TextViewerDelegateForSourceFrame = function(sourceFrame)
+WebInspector.TextEditorDelegateForSourceFrame = function(sourceFrame)
 {
     this._sourceFrame = sourceFrame;
 }
 
-WebInspector.TextViewerDelegateForSourceFrame.prototype = {
+WebInspector.TextEditorDelegateForSourceFrame.prototype = {
     beforeTextChanged: function()
     {
         this._sourceFrame.beforeTextChanged();
@@ -511,6 +609,22 @@ WebInspector.TextViewerDelegateForSourceFrame.prototype = {
         this._sourceFrame.commitEditing(this._sourceFrame._textModel.text);
     },
 
+    /**
+     * @param {WebInspector.TextRange} textRange
+     */
+    selectionChanged: function(textRange)
+    {
+        this._sourceFrame.selectionChanged(textRange);
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    scrollChanged: function(lineNumber)
+    {
+        this._sourceFrame.scrollChanged(lineNumber);
+    },
+
     populateLineGutterContextMenu: function(contextMenu, lineNumber)
     {
         this._sourceFrame.populateLineGutterContextMenu(contextMenu, lineNumber);
@@ -522,4 +636,4 @@ WebInspector.TextViewerDelegateForSourceFrame.prototype = {
     }
 }
 
-WebInspector.TextViewerDelegateForSourceFrame.prototype.__proto__ = WebInspector.TextViewerDelegate.prototype;
+WebInspector.TextEditorDelegateForSourceFrame.prototype.__proto__ = WebInspector.TextEditorDelegate.prototype;
diff --git a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
index 903e19d2a..0c7dccb69 100644
--- a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
+++ b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Fri May 13 20:01:13 2011 */
+/* Generated by re2c 0.13.5 on Mon Jul  9 18:23:02 2012 */
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ -29,18 +29,19 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-// Generate js file as follows:
-//
-// re2c -isc WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js \
-// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
-// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
-// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
-// | sed 's|[*]cursor|this._charAt(cursor)|' \
-// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
-// | sed 's|{ gotoCase = \([^; continue; };]*\)|{ gotoCase = \1; continue; }|' \
-// | sed 's|yych <= \(0x[0-9a-fA-f]+\)|yych <= String.fromCharCode(\1)|' \
-// | sed 's|unsigned\ int|var|' \
-// | sed 's|var\ yych|case 1: case 1: var yych|'
+/*
+ * Generate js file as follows:
+re2c -isc Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js \
+  | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+  | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+  | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+  | sed 's|[*]cursor|this._charAt(cursor)|' \
+  | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+  | sed 's|{ gotoCase = \([^; continue; };]*\)|{ gotoCase = \1; continue; }|' \
+  | sed 's|yych <= \(0x[0-9a-fA-F]*\)|yych \<\= String.fromCharCode(\1)|' \
+  | sed 's|unsigned\ int|var|' \
+  | sed 's|var\ yych|case 1: case 1: var yych|'
+ */
 
 /**
  * @constructor
@@ -90,7 +91,7 @@ WebInspector.SourceJavaScriptTokenizer.prototype = {
         while (1) {
             switch (gotoCase)
             // Following comment is replaced with generated state machine.
-
+            
         {
             case 1: var yych;
             var yyaccept = 0;
@@ -243,7 +244,15 @@ case 17:
             if ((yych = this._charAt(cursor)) == '=') { gotoCase = 115; continue; };
 case 18:
             this.setLexCondition(this._lexConditions.NODIV);
-            { this.tokenType = null; return cursor; }
+            {
+                    var token = this._line.charAt(cursorOnEnter);
+                    if (token === "{")
+                        this.tokenType = "block-start";
+                    else if (token === "}")
+                        this.tokenType = "block-end";
+                    else this.tokenType = null;
+                    return cursor;
+                }
 case 19:
             yyaccept = 0;
             yych = this._charAt(YYMARKER = ++cursor);
@@ -1174,7 +1183,15 @@ case 138:
             ++cursor;
             if ((yych = this._charAt(cursor)) == '=') { gotoCase = 260; continue; };
 case 139:
-            { this.tokenType = null; return cursor; }
+            {
+                    var token = this._line.charAt(cursorOnEnter);
+                    if (token === "{")
+                        this.tokenType = "block-start";
+                    else if (token === "}")
+                        this.tokenType = "block-end";
+                    else this.tokenType = null;
+                    return cursor;
+                }
 case 140:
             yyaccept = 0;
             yych = this._charAt(YYMARKER = ++cursor);
diff --git a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
index 969c4db24..34a678634 100644
--- a/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
+++ b/Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js
@@ -28,18 +28,19 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-// Generate js file as follows:
-//
-// re2c -isc Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js \
-// | sed 's|^yy\([^:]*\)*\:|case \1:|' \
-// | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
-// | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
-// | sed 's|[*]cursor|this._charAt(cursor)|' \
-// | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
-// | sed 's|goto case \([^;]*\)|{ gotoCase = \1; continue; }|' \
-// | sed 's|yych <= \(0x[0-9a-fA-f]*\)|yych <= String.fromCharCode(\1)|' \
-// | sed 's|unsigned\ int|var|' \
-// | sed 's|var\ yych|case 1: var yych|'
+/*
+ * Generate js file as follows:
+re2c -isc Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.re2js \
+  | sed 's|^yy\([^:]*\)*\:|case \1:|' \
+  | sed 's|[*]cursor[+][+]|this._charAt(cursor++)|' \
+  | sed 's|[[*][+][+]cursor|this._charAt(++cursor)|' \
+  | sed 's|[*]cursor|this._charAt(cursor)|' \
+  | sed 's|yych = \*\([^;]*\)|yych = this._charAt\1|' \
+  | sed 's|goto case \([^;]*\)|{ gotoCase = \1; continue; }|' \
+  | sed 's|yych <= \(0x[0-9a-fA-F]*\)|yych \<\= String.fromCharCode(\1)|' \
+  | sed 's|unsigned\ int|var|' \
+  | sed 's|var\ yych|case 1: var yych|' > Source/WebCore/inspector/front-end/SourceJavaScriptTokenizer.js
+ */
 
 /**
  * @constructor
@@ -177,7 +178,16 @@ WebInspector.SourceJavaScriptTokenizer.prototype = {
                     return cursor;
                 }
                 <DIV,NODIV> RightParen => DIV { this.tokenType = null; return cursor; }
-                <DIV,NODIV> Punctuation => NODIV { this.tokenType = null; return cursor; }
+                <DIV,NODIV> Punctuation => NODIV
+                {
+                    var token = this._line.charAt(cursorOnEnter);
+                    if (token === "{")
+                        this.tokenType = "block-start";
+                    else if (token === "}")
+                        this.tokenType = "block-end";
+                    else this.tokenType = null;
+                    return cursor;
+                }
                 <DIV> Division => NODIV { this.tokenType = null; return cursor; }
                 <*> [^] { this.tokenType = null; return cursor; }
             */
diff --git a/Source/WebCore/inspector/front-end/StatusBarButton.js b/Source/WebCore/inspector/front-end/StatusBarButton.js
index 9ef0062da..78f0405f4 100644
--- a/Source/WebCore/inspector/front-end/StatusBarButton.js
+++ b/Source/WebCore/inspector/front-end/StatusBarButton.js
@@ -65,6 +65,8 @@ WebInspector.StatusBarButton.prototype = {
     _clicked: function()
     {
         this.dispatchEventToListeners("click");
+        if (this._showOptionsTimer)
+            clearTimeout(this._showOptionsTimer);
     },
 
     get disabled()
@@ -147,6 +149,94 @@ WebInspector.StatusBarButton.prototype = {
         else
             this.element.addStyleClass("hidden");
         this._visible = x;
+    },
+
+    /**
+     * @param {function():Array.<WebInspector.StatusBarButton>} buttonsProvider
+     */
+    makeLongClickEnabled: function(buttonsProvider)
+    {
+        this.longClickGlyph = document.createElement("div");
+        this.longClickGlyph.className = "fill long-click-glyph";
+        this.element.appendChild(this.longClickGlyph);
+  
+        this.longClickGlyphShadow = document.createElement("div");
+        this.longClickGlyphShadow.className = "fill long-click-glyph shadow";
+        this.element.appendChild(this.longClickGlyphShadow);
+
+        this.element.addEventListener("mousedown", mouseDown.bind(this), false);
+        this.element.addEventListener("mouseout", mouseUp.bind(this), false);
+        this.element.addEventListener("mouseup", mouseUp.bind(this), false);
+
+        function mouseDown(e)
+        {
+            if (e.which !== 1)
+                return;
+            this._showOptionsTimer = setTimeout(this._showOptions.bind(this, buttonsProvider), 200);
+        }
+
+        function mouseUp(e)
+        {
+            if (e.which !== 1)
+                return;
+            if (this._showOptionsTimer)
+                clearTimeout(this._showOptionsTimer);
+        }
+    },
+
+    /**
+     * @param {function():Array.<WebInspector.StatusBarButton>} buttonsProvider
+     */
+    _showOptions: function(buttonsProvider)
+    {
+        var buttons = buttonsProvider();
+
+        var mouseUpListener = mouseUp.bind(this);
+        document.documentElement.addEventListener("mouseup", mouseUpListener, false);
+
+        var optionsGlassPane = new WebInspector.GlassPane();
+        var optionsBarElement = optionsGlassPane.element.createChild("div", "alternate-status-bar-buttons-bar");
+        const buttonHeight = 24;
+        optionsBarElement.style.height = (buttonHeight * buttons.length) + "px";
+        optionsBarElement.style.left = this.element.offsetLeft + "px";
+
+        var boundMouseOver = mouseOver.bind(this);
+        var boundMouseOut = mouseOut.bind(this);
+        for (var i = 0; i < buttons.length; ++i) {
+            buttons[i].element.addEventListener("mousemove", boundMouseOver.bind(this), false);
+            buttons[i].element.addEventListener("mouseout", boundMouseOut.bind(this), false);
+            optionsBarElement.appendChild(buttons[i].element);
+        }
+        buttons[buttons.length - 1].element.addStyleClass("emulate-active");
+
+        function mouseOver(e)
+        {
+            if (e.which !== 1)
+                return;
+            var buttonElement = e.target.enclosingNodeOrSelfWithClass("status-bar-item");
+            buttonElement.addStyleClass("emulate-active");
+        }
+
+        function mouseOut(e)
+        {
+            if (e.which !== 1)
+                return;
+            var buttonElement = e.target.enclosingNodeOrSelfWithClass("status-bar-item");
+            buttonElement.removeStyleClass("emulate-active");
+        }
+
+        function mouseUp(e)
+        {
+            if (e.which !== 1)
+                return;
+            optionsGlassPane.dispose();
+            document.documentElement.removeEventListener("mouseup", mouseUpListener, false);
+
+            for (var i = 0; i < buttons.length; ++i) {
+                if (buttons[i].element.hasStyleClass("emulate-active"))
+                    buttons[i]._clicked();
+            }
+        }
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/StylesPanel.js b/Source/WebCore/inspector/front-end/StylesPanel.js
index 316969de9..87b09b435 100644
--- a/Source/WebCore/inspector/front-end/StylesPanel.js
+++ b/Source/WebCore/inspector/front-end/StylesPanel.js
@@ -34,8 +34,7 @@
 WebInspector.StylesUISourceCodeProvider = function()
 {
     WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.CachedResourcesLoaded, this._initialize, this);
-    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.WillLoadCachedResources, this._reset, this);
-    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.MainFrameNavigated, this._reset, this);
+    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.WillLoadCachedResources, this.reset, this);
 
     this._uiSourceCodes = [];
 }
@@ -79,7 +78,7 @@ WebInspector.StylesUISourceCodeProvider.prototype = {
         this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, uiSourceCode);
     },
 
-    _reset: function()
+    reset: function()
     {
         this._uiSourceCodes = [];
     }
@@ -97,23 +96,57 @@ WebInspector.StyleSource = function(resource)
     WebInspector.UISourceCode.call(this, resource.url, resource, resource);
 }
 
+WebInspector.StyleSource.updateTimeout = 200;
+
 WebInspector.StyleSource.prototype = {
     /**
+     * @return {boolean}
+     */
+    isEditable: function()
+    {
+        return true;
+    },
+
+    /**
      * @param {function(?string)} callback
      */
     workingCopyCommitted: function(callback)
     {  
-        this._resource.setContent(this.workingCopy(), true, callback);
+        this._commitIncrementalEdit(true, callback);
     },
 
     workingCopyChanged: function()
-    {  
-        function commitIncrementalEdit()
-        {
-            this._resource.setContent(this.workingCopy(), false, function() {});
-        }
-        const updateTimeout = 200;
-        this._incrementalUpdateTimer = setTimeout(commitIncrementalEdit.bind(this), updateTimeout);
+    {
+        this._callOrSetTimeout(this._commitIncrementalEdit.bind(this, false, function() {}));
+    },
+
+    /**
+     * @param {function(?string)} callback
+     */
+    _callOrSetTimeout: function(callback)
+    {
+        // FIXME: Extensions tests override updateTimeout because extensions don't have any control over applying changes to domain specific bindings.   
+        if (WebInspector.StyleSource.updateTimeout >= 0)
+            this._incrementalUpdateTimer = setTimeout(callback, WebInspector.StyleSource.updateTimeout);
+        else
+            callback(null);
+    },
+
+    /**
+     * @param {boolean} majorChange
+     * @param {function(?string)} callback
+     */
+    _commitIncrementalEdit: function(majorChange, callback)
+    {
+        this._clearIncrementalUpdateTimer();
+        WebInspector.cssModel.resourceBinding().setStyleContent(this, this.workingCopy(), majorChange, callback);
+    },
+
+    _clearIncrementalUpdateTimer: function()
+    {
+        if (this._incrementalUpdateTimer)
+            clearTimeout(this._incrementalUpdateTimer);
+        delete this._incrementalUpdateTimer;
     }
 }
 
@@ -183,13 +216,6 @@ WebInspector.StyleSourceFrame.prototype = {
         delete this._isCommittingEditing;
     },
 
-    _clearIncrementalUpdateTimer: function()
-    {
-        if (this._incrementalUpdateTimer)
-            clearTimeout(this._incrementalUpdateTimer);
-        delete this._incrementalUpdateTimer;
-    },
-
     /**
      * @param {WebInspector.Event} event
      */
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index ef091cdac..40d3416b9 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -30,8 +30,10 @@
 /**
  * @constructor
  * @extends {WebInspector.SidebarPane}
+ * @param {WebInspector.ComputedStyleSidebarPane} computedStylePane
+ * @param {function(DOMAgent.NodeId, string, boolean)} setPseudoClassCallback
  */
-WebInspector.StylesSidebarPane = function(computedStylePane)
+WebInspector.StylesSidebarPane = function(computedStylePane, setPseudoClassCallback)
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Styles"));
 
@@ -82,6 +84,7 @@ WebInspector.StylesSidebarPane = function(computedStylePane)
 
     this._computedStylePane = computedStylePane;
     computedStylePane._stylesSidebarPane = this;
+    this._setPseudoClassCallback = setPseudoClassCallback;
     this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
     WebInspector.settings.colorFormat.addChangeListener(this._colorFormatSettingChanged.bind(this));
 
@@ -111,9 +114,6 @@ WebInspector.StylesSidebarPane.ColorFormat = {
     HSLA: "hsla"
 }
 
-WebInspector.StylesSidebarPane.StyleValueDelimiters = " \xA0\t\n\"':;,/()";
-
-
 // Keep in sync with RenderStyleConstants.h PseudoId enum. Array below contains pseudo id names for corresponding enum indexes.
 // First item is empty due to its artificial NOPSEUDO nature in the enum.
 // FIXME: find a way of generating this mapping or getting it from combination of RenderStyleConstants and CSSSelector.cpp at
@@ -132,65 +132,6 @@ WebInspector.StylesSidebarPane.PseudoIdNames = [
     "-webkit-resizer", "-webkit-inner-spin-button", "-webkit-outer-spin-button"
 ];
 
-WebInspector.StylesSidebarPane.CSSNumberRegex = /^(-?(?:\d+(?:\.\d+)?|\.\d+))$/;
-
-WebInspector.StylesSidebarPane.alteredFloatNumber = function(number, event)
-{
-    var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
-
-    // Jump by 10 when shift is down or jump by 0.1 when Alt/Option is down.
-    // Also jump by 10 for page up and down, or by 100 if shift is held with a page key.
-    var changeAmount = 1;
-    if (event.shiftKey && !arrowKeyPressed)
-        changeAmount = 100;
-    else if (event.shiftKey || !arrowKeyPressed)
-        changeAmount = 10;
-    else if (event.altKey)
-        changeAmount = 0.1;
-
-    if (event.keyIdentifier === "Down" || event.keyIdentifier === "PageDown")
-        changeAmount *= -1;
-
-    // Make the new number and constrain it to a precision of 6, this matches numbers the engine returns.
-    // Use the Number constructor to forget the fixed precision, so 1.100000 will print as 1.1.
-    var result = Number((number + changeAmount).toFixed(6));
-    if (!String(result).match(WebInspector.StylesSidebarPane.CSSNumberRegex))
-        return null;
-
-    return result;
-}
-
-WebInspector.StylesSidebarPane.alteredHexNumber = function(hexString, event)
-{
-    var number = parseInt(hexString, 16);
-    if (isNaN(number) || !isFinite(number))
-        return hexString;
-
-    var maxValue = Math.pow(16, hexString.length) - 1;
-    var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
-
-    var delta;
-    if (arrowKeyPressed)
-        delta = (event.keyIdentifier === "Up") ? 1 : -1;
-    else
-        delta = (event.keyIdentifier === "PageUp") ? 16 : -16;
-
-    if (event.shiftKey)
-        delta *= 16;
-
-    var result = number + delta;
-    if (result < 0)
-        result = 0; // Color hex values are never negative, so clamp to 0.
-    else if (result > maxValue)
-        return hexString;
-
-    // Ensure the result length is the same as the original hex value.
-    var resultString = result.toString(16).toUpperCase();
-    for (var i = 0, lengthDelta = hexString.length - resultString.length; i < lengthDelta; ++i)
-        resultString = "0" + resultString;
-    return resultString;
-}
-
 WebInspector.StylesSidebarPane.canonicalPropertyName = function(name)
 {
     if (!name || name.length < 9 || name.charAt(0) !== "-")
@@ -211,7 +152,21 @@ WebInspector.StylesSidebarPane.prototype = {
 
     get forcedPseudoClasses()
     {
-        return this._forcedPseudoClasses;
+        return this.node ? (this.node.getUserProperty("pseudoState") || undefined) : undefined;
+    },
+
+    _updateForcedPseudoStateInputs: function()
+    {
+        if (!this.node)
+            return;
+
+        var nodePseudoState = this.forcedPseudoClasses;
+        if (!nodePseudoState)
+            nodePseudoState = [];
+
+        var inputs = this._elementStatePane.inputs;
+        for (var i = 0; i < inputs.length; ++i)
+            inputs[i].checked = nodePseudoState.indexOf(inputs[i].state) >= 0;
     },
 
     update: function(node, forceUpdate)
@@ -238,6 +193,8 @@ WebInspector.StylesSidebarPane.prototype = {
         else
             node = this.node;
 
+        this._updateForcedPseudoStateInputs();
+
         if (refresh)
             this._refreshUpdate();
         else
@@ -279,7 +236,7 @@ WebInspector.StylesSidebarPane.prototype = {
 
         if (this._computedStylePane.expanded || forceFetchComputedStyle) {
             this._refreshUpdateInProgress = true;
-            WebInspector.cssModel.getComputedStyleAsync(node.id, this._forcedPseudoClasses, computedStyleCallback.bind(this));
+            WebInspector.cssModel.getComputedStyleAsync(node.id, this.forcedPseudoClasses, computedStyleCallback.bind(this));
         } else {
             this._innerRefreshUpdate(node, null, editedSection);
             if (userCallback)
@@ -337,11 +294,14 @@ WebInspector.StylesSidebarPane.prototype = {
         }
 
         if (this._computedStylePane.expanded)
-            WebInspector.cssModel.getComputedStyleAsync(node.id, this._forcedPseudoClasses, computedCallback.bind(this));
+            WebInspector.cssModel.getComputedStyleAsync(node.id, this.forcedPseudoClasses, computedCallback.bind(this));
         WebInspector.cssModel.getInlineStylesAsync(node.id, inlineCallback.bind(this));
-        WebInspector.cssModel.getMatchedStylesAsync(node.id, this._forcedPseudoClasses, true, true, stylesCallback.bind(this));
+        WebInspector.cssModel.getMatchedStylesAsync(node.id, this.forcedPseudoClasses, true, true, stylesCallback.bind(this));
     },
 
+    /**
+     * @param {function()=} userCallback
+     */
     _validateNode: function(userCallback)
     {
         if (!this.node) {
@@ -813,13 +773,6 @@ WebInspector.StylesSidebarPane.prototype = {
         } else {
             this._elementStateButton.removeStyleClass("toggled");
             this._elementStatePane.removeStyleClass("expanded");
-            // Clear flags on hide.
-            if (this._forcedPseudoClasses) {
-                for (var i = 0; i < this._elementStatePane.inputs.length; ++i)
-                    this._elementStatePane.inputs[i].checked = false;
-                delete this._forcedPseudoClasses;
-                this._rebuildUpdate();
-            }
         }
     },
 
@@ -834,13 +787,10 @@ WebInspector.StylesSidebarPane.prototype = {
 
         function clickListener(event)
         {
-            var pseudoClasses = [];
-            for (var i = 0; i < inputs.length; ++i) {
-                if (inputs[i].checked)
-                    pseudoClasses.push(inputs[i].state);
-            }
-            this._forcedPseudoClasses = pseudoClasses.length ? pseudoClasses : undefined;
-            this._rebuildUpdate();
+            var node = this._validateNode();
+            if (!node)
+                return;
+            this._setPseudoClassCallback(node.id, event.target.state, event.target.checked);
         }
 
         function createCheckbox(state)
@@ -2526,7 +2476,7 @@ WebInspector.StylePropertyTreeElement.prototype.__proto__ = TreeElement.prototyp
 WebInspector.StylesSidebarPane.CSSPropertyPrompt = function(cssCompletions, sidebarPane, isEditingName, acceptCallback)
 {
     // Use the same callback both for applyItemCallback and acceptItemCallback.
-    WebInspector.TextPrompt.call(this, this._buildPropertyCompletions.bind(this), WebInspector.StylesSidebarPane.StyleValueDelimiters);
+    WebInspector.TextPrompt.call(this, this._buildPropertyCompletions.bind(this), WebInspector.StyleValueDelimiters);
     this.setSuggestBoxEnabled("generic-suggest");
     this._cssCompletions = cssCompletions;
     this._sidebarPane = sidebarPane;
@@ -2561,80 +2511,16 @@ WebInspector.StylesSidebarPane.CSSPropertyPrompt.prototype = {
 
     _handleNameOrValueUpDown: function(event)
     {
-        // Handle numeric value increment/decrement only at this point.
-        if (!this._isEditingName && this._handleUpOrDownValue(event))
-            return true;
-
-        return false;
-    },
-
-    _handleUpOrDownValue: function(event)
-    {
-        var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
-        var pageKeyPressed = (event.keyIdentifier === "PageUp" || event.keyIdentifier === "PageDown");
-        if (!arrowKeyPressed && !pageKeyPressed)
-            return false;
-
-        var selection = window.getSelection();
-        if (!selection.rangeCount)
-            return false;
-
-        var selectionRange = selection.getRangeAt(0);
-        if (!selectionRange.commonAncestorContainer.isSelfOrDescendant(this._sidebarPane.valueElement))
-            return false;
-
-        var wordRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, WebInspector.StylesSidebarPane.StyleValueDelimiters, this._sidebarPane.valueElement);
-        var wordString = wordRange.toString();
-        if (this._isValueSuggestion(wordString))
-            return false;
-
-        var replacementString;
-        var prefix, suffix, number;
-
-        var matches;
-        matches = /(.*#)([\da-fA-F]+)(.*)/.exec(wordString);
-        if (matches && matches.length) {
-            prefix = matches[1];
-            suffix = matches[3];
-            number = WebInspector.StylesSidebarPane.alteredHexNumber(matches[2], event);
-
-            replacementString = prefix + number + suffix;
-        } else {
-            matches = /(.*?)(-?(?:\d+(?:\.\d+)?|\.\d+))(.*)/.exec(wordString);
-            if (matches && matches.length) {
-                prefix = matches[1];
-                suffix = matches[3];
-                number = WebInspector.StylesSidebarPane.alteredFloatNumber(parseFloat(matches[2]), event);
-                if (number === null) {
-                    // Need to check for null explicitly.
-                    return false;
-                }
-
-                replacementString = prefix + number + suffix;
-            }
-        }
-
-        if (replacementString) {
-            var replacementTextNode = document.createTextNode(replacementString);
-
-            wordRange.deleteContents();
-            wordRange.insertNode(replacementTextNode);
-
-            var finalSelectionRange = document.createRange();
-            finalSelectionRange.setStart(replacementTextNode, 0);
-            finalSelectionRange.setEnd(replacementTextNode, replacementString.length);
-
-            selection.removeAllRanges();
-            selection.addRange(finalSelectionRange);
-
-            event.handled = true;
-            event.preventDefault();
-
+        function finishHandler(originalValue, replacementString)
+        {
             // Synthesize property text disregarding any comments, custom whitespace etc.
             this._sidebarPane.applyStyleText(this._sidebarPane.nameElement.textContent + ": " + this._sidebarPane.valueElement.textContent, false, false, false);
-
-            return true;
         }
+    
+        // Handle numeric value increment/decrement only at this point.
+        if (!this._isEditingName && WebInspector.handleElementValueModifications(event, this._sidebarPane.valueElement, finishHandler.bind(this), this._isValueSuggestion.bind(this)))
+            return true;
+
         return false;
     },
 
diff --git a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
index c18e00511..0657e90af 100644
--- a/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
+++ b/Source/WebCore/inspector/front-end/TabbedEditorContainer.js
@@ -62,7 +62,7 @@ WebInspector.TabbedEditorContainer = function(delegate, settingName)
     this._loadedURLs = {};
 
     this._previouslyViewedFilesSetting = WebInspector.settings.createSetting(settingName, []);
-    this._history = new WebInspector.TabbedEditorContainer.History(this._previouslyViewedFilesSetting.get());
+    this._history = WebInspector.TabbedEditorContainer.History.fromObject(this._previouslyViewedFilesSetting.get());
 }
 
 
@@ -108,6 +108,37 @@ WebInspector.TabbedEditorContainer.prototype = {
         this._innerShowFile(uiSourceCode, true);
     },
 
+    _addScrollAndSelectionListeners: function()
+    {
+        console.assert(this._currentFile);
+        var sourceFrame = this._delegate.viewForFile(this._currentFile);
+        sourceFrame.addEventListener(WebInspector.SourceFrame.Events.ScrollChanged, this._scrollChanged, this);
+        sourceFrame.addEventListener(WebInspector.SourceFrame.Events.SelectionChanged, this._selectionChanged, this);
+    },
+
+    _removeScrollAndSelectionListeners: function()
+    {
+        if (!this._currentFile)
+            return;
+        var sourceFrame = this._delegate.viewForFile(this._currentFile);
+        sourceFrame.removeEventListener(WebInspector.SourceFrame.Events.ScrollChanged, this._scrollChanged, this);
+        sourceFrame.removeEventListener(WebInspector.SourceFrame.Events.SelectionChanged, this._selectionChanged, this);
+    },
+
+    _scrollChanged: function(event)
+    {
+        var lineNumber = /** @type {number} */ event.data;
+        this._history.updateScrollLineNumber(this._currentFile.url, lineNumber);
+        this._history.save(this._previouslyViewedFilesSetting);
+    },
+
+    _selectionChanged: function(event)
+    {
+        var range = /** @type {WebInspector.TextRange} */ event.data;
+        this._history.updateSelectionRange(this._currentFile.url, range);
+        this._history.save(this._previouslyViewedFilesSetting);
+    },
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      * @param {boolean=} userGesture
@@ -116,6 +147,7 @@ WebInspector.TabbedEditorContainer.prototype = {
     {
         if (this._currentFile === uiSourceCode)
             return;
+        this._removeScrollAndSelectionListeners();
         this._currentFile = uiSourceCode;
 
         var tabId = this._tabIds.get(uiSourceCode) || this._appendFileTab(uiSourceCode, userGesture);
@@ -124,6 +156,8 @@ WebInspector.TabbedEditorContainer.prototype = {
         if (userGesture)
             this._editorSelectedByUserAction();
         
+        this._addScrollAndSelectionListeners();
+        
         this.dispatchEventToListeners(WebInspector.TabbedEditorContainer.Events.EditorSelected, this._currentFile);
     },
 
@@ -156,7 +190,7 @@ WebInspector.TabbedEditorContainer.prototype = {
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    uiSourceCodeAdded: function(uiSourceCode)
+    addUISourceCode: function(uiSourceCode)
     {
         if (this._userSelectedFiles || this._loadedURLs[uiSourceCode.url])
             return;
@@ -172,7 +206,17 @@ WebInspector.TabbedEditorContainer.prototype = {
         if (index === 0)
             this._innerShowFile(uiSourceCode, false);
     },
-    
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     */
+    removeUISourceCode: function(uiSourceCode)
+    {
+        var tabId = this._tabIds.get(uiSourceCode);
+        if (tabId)
+            this._tabbedPane.closeTab(tabId);
+    },
+
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
@@ -225,6 +269,13 @@ WebInspector.TabbedEditorContainer.prototype = {
         this._tabIds.put(uiSourceCode, tabId);
         this._files[tabId] = uiSourceCode;
 
+        var savedScrollLineNumber = this._history.scrollLineNumber(uiSourceCode.url);
+        if (savedScrollLineNumber)
+            view.scrollToLine(savedScrollLineNumber);
+        var savedSelectionRange = this._history.selectionRange(uiSourceCode.url);
+        if (savedSelectionRange)
+            view.setSelection(savedSelectionRange);
+
         this._tabbedPane.appendTab(tabId, title, view, tooltip, userGesture);
 
         uiSourceCode.addEventListener(WebInspector.UISourceCode.Events.TitleChanged, this._uiSourceCodeTitleChanged, this);
@@ -234,17 +285,6 @@ WebInspector.TabbedEditorContainer.prototype = {
     },
 
     /**
-     * @param {WebInspector.UISourceCode} uiSourceCode
-     */
-    _removeFileTab: function(uiSourceCode)
-    {
-        var tabId = this._tabIds.get(uiSourceCode);
-
-        if (tabId)
-            this._tabbedPane.closeTab(tabId);
-    },
-
-    /**
      * @param {WebInspector.Event} event
      */
     _tabClosed: function(event)
@@ -252,6 +292,7 @@ WebInspector.TabbedEditorContainer.prototype = {
         var tabId = /** @type {string} */ event.data.tabId;
         var userGesture = /** @type {boolean} */ event.data.isUserGesture;
 
+        this._removeScrollAndSelectionListeners();
         var uiSourceCode = this._files[tabId];
         this._tabIds.remove(uiSourceCode);
         delete this._files[tabId];
@@ -361,19 +402,122 @@ WebInspector.TabbedEditorContainer.prototype.__proto__ = WebInspector.Object.pro
 
 /**
  * @constructor
+ * @param {string} url
+ * @param {WebInspector.TextRange=} selectionRange
+ * @param {number=} scrollLineNumber
+ */
+WebInspector.TabbedEditorContainer.HistoryItem = function(url, selectionRange, scrollLineNumber)
+{
+    this.url = url;
+    this.selectionRange = selectionRange;
+    this.scrollLineNumber = scrollLineNumber;
+}
+
+/**
+ * @param {Object} serializedHistoryItem
+ * @return {WebInspector.TabbedEditorContainer.HistoryItem}
+ */
+WebInspector.TabbedEditorContainer.HistoryItem.fromObject = function (serializedHistoryItem)
+{
+    var selectionRange = serializedHistoryItem.selectionRange ? WebInspector.TextRange.fromObject(serializedHistoryItem.selectionRange) : null;
+    return new WebInspector.TabbedEditorContainer.HistoryItem(serializedHistoryItem.url, selectionRange, serializedHistoryItem.scrollLineNumber);
+}
+
+WebInspector.TabbedEditorContainer.HistoryItem.prototype = {
+    /**
+     * @return {Object}
+     */
+    serializeToObject: function()
+    {
+        var serializedHistoryItem = {};
+        serializedHistoryItem.url = this.url;
+        serializedHistoryItem.selectionRange = this.selectionRange;
+        serializedHistoryItem.scrollLineNumber = this.scrollLineNumber;
+        return serializedHistoryItem;
+    }
+}
+
+WebInspector.TabbedEditorContainer.HistoryItem.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @param {Array.<WebInspector.TabbedEditorContainer.HistoryItem>} items
+ */
+WebInspector.TabbedEditorContainer.History = function(items)
+{
+    this._items = items;
+}
+
+/**
+ * @param {Object} serializedHistory
+ * @return {WebInspector.TabbedEditorContainer.History}
  */
-WebInspector.TabbedEditorContainer.History = function(urls)
+WebInspector.TabbedEditorContainer.History.fromObject = function(serializedHistory)
 {
-    this._urls = urls;
+    var items = [];
+    for (var i = 0; i < serializedHistory.length; ++i)
+        items.push(WebInspector.TabbedEditorContainer.HistoryItem.fromObject(serializedHistory[i]));
+    return new WebInspector.TabbedEditorContainer.History(items);
 }
 
 WebInspector.TabbedEditorContainer.History.prototype = {
     /**
      * @param {string} url
+     * @return {number}
      */
     index: function(url)
     {
-        return this._urls.indexOf(url);
+        for (var i = 0; i < this._items.length; ++i) {
+            if (this._items[i].url === url)
+                return i;
+        }
+        return -1;
+    },
+
+    /**
+     * @param {string} url
+     * @return {WebInspector.TextRange|undefined}
+     */
+    selectionRange: function(url)
+    {
+        var index = this.index(url);
+        return index !== -1 ? this._items[index].selectionRange : undefined;
+    },
+
+    /**
+     * @param {string} url
+     * @param {WebInspector.TextRange} selectionRange
+     */
+    updateSelectionRange: function(url, selectionRange)
+    {
+        if (!selectionRange)
+            return;
+        var index = this.index(url);
+        if (index === -1)
+            return;
+        this._items[index].selectionRange = selectionRange;
+    },
+
+    /**
+     * @param {string} url
+     * @return {number|undefined}
+     */
+    scrollLineNumber: function(url)
+    {
+        var index = this.index(url);
+        return index !== -1 ? this._items[index].scrollLineNumber : undefined;
+    },
+
+    /**
+     * @param {string} url
+     * @param {number} scrollLineNumber
+     */
+    updateScrollLineNumber: function(url, scrollLineNumber)
+    {
+        var index = this.index(url);
+        if (index === -1)
+            return;
+        this._items[index].scrollLineNumber = scrollLineNumber;
     },
 
     /**
@@ -382,10 +526,14 @@ WebInspector.TabbedEditorContainer.History.prototype = {
     update: function(urls)
     {
         for (var i = urls.length - 1; i >= 0; --i) {
-            var index = this._urls.indexOf(urls[i]);
-            if (index !== -1)
-                this._urls.splice(index, 1);
-            this._urls.unshift(urls[i]);
+            var index = this.index(urls[i]);
+            var item;
+            if (index !== -1) {
+                item = this._items[index];
+                this._items.splice(index, 1);
+            } else
+                item = new WebInspector.TabbedEditorContainer.HistoryItem(urls[i]);
+            this._items.unshift(item);
         }
     },
 
@@ -394,9 +542,9 @@ WebInspector.TabbedEditorContainer.History.prototype = {
      */
     remove: function(url)
     {
-        var index = this._urls.indexOf(url);
+        var index = this.index(url);
         if (index !== -1)
-            this._urls.splice(index, 1);
+            this._items.splice(index, 1);
     },
     
     /**
@@ -404,7 +552,18 @@ WebInspector.TabbedEditorContainer.History.prototype = {
      */
     save: function(setting)
     {
-        setting.set(this._urls);
+        setting.set(this._serializeToObject());
+    },
+    
+    /**
+     * @return {Object}
+     */
+    _serializeToObject: function()
+    {
+        var serializedHistory = [];
+        for (var i = 0; i < this._items.length; ++i)
+            serializedHistory.push(this._items[i].serializeToObject());
+        return serializedHistory;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/TextViewer.js b/Source/WebCore/inspector/front-end/TextEditor.js
index e36e19d66..f0b0544b9 100644
--- a/Source/WebCore/inspector/front-end/TextViewer.js
+++ b/Source/WebCore/inspector/front-end/TextEditor.js
@@ -32,11 +32,14 @@
 /**
  * @extends {WebInspector.View}
  * @constructor
+ * @param {WebInspector.TextEditorModel} textModel
+ * @param {?string} url
+ * @param {WebInspector.TextEditorDelegate} delegate
  */
-WebInspector.TextViewer = function(textModel, platform, url, delegate)
+WebInspector.TextEditor = function(textModel, url, delegate)
 {
     WebInspector.View.call(this);
-    this.registerRequiredCSS("textViewer.css");
+    this.registerRequiredCSS("textEditor.css");
 
     this._textModel = textModel;
     this._textModel.addEventListener(WebInspector.TextEditorModel.Events.TextChanged, this._textChanged, this);
@@ -52,6 +55,10 @@ WebInspector.TextViewer = function(textModel, platform, url, delegate)
     var syncLineHeightListener = this._syncLineHeight.bind(this);
     this._mainPanel = new WebInspector.TextEditorMainPanel(this._textModel, url, syncScrollListener, syncDecorationsForLineListener, enterTextChangeMode, exitTextChangeMode);
     this._gutterPanel = new WebInspector.TextEditorGutterPanel(this._textModel, syncDecorationsForLineListener, syncLineHeightListener);
+
+    this._mainPanel.element.addEventListener("scroll", this._handleScrollChanged.bind(this), false);
+    this._mainPanel._container.addEventListener("focus", this._handleFocused.bind(this), false);
+
     this.element.appendChild(this._mainPanel.element);
     this.element.appendChild(this._gutterPanel.element);
 
@@ -74,7 +81,10 @@ WebInspector.TextViewer = function(textModel, platform, url, delegate)
     this._registerShortcuts();
 }
 
-WebInspector.TextViewer.prototype = {
+WebInspector.TextEditor.prototype = {
+    /**
+     * @param {string} mimeType
+     */
     set mimeType(mimeType)
     {
         this._mainPanel.mimeType = mimeType;
@@ -91,43 +101,71 @@ WebInspector.TextViewer.prototype = {
         WebInspector.markBeingEdited(this.element, !readOnly);
     },
 
+    /**
+     * @return {boolean}
+     */
     readOnly: function()
     {
         return this._mainPanel.readOnly();
     },
 
+    /**
+     * @return {WebInspector.TextEditorModel}
+     */
     get textModel()
     {
         return this._textModel;
     },
 
+    /**
+     * @return {Element}
+     */
     defaultFocusedElement: function()
     {
         return this._mainPanel.defaultFocusedElement();
     },
 
+    /**
+     * @param {number} lineNumber
+     */
     revealLine: function(lineNumber)
     {
         this._mainPanel.revealLine(lineNumber);
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
     addDecoration: function(lineNumber, decoration)
     {
         this._mainPanel.addDecoration(lineNumber, decoration);
         this._gutterPanel.addDecoration(lineNumber, decoration);
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
     removeDecoration: function(lineNumber, decoration)
     {
         this._mainPanel.removeDecoration(lineNumber, decoration);
         this._gutterPanel.removeDecoration(lineNumber, decoration);
     },
 
+    /**
+     * @param {WebInspector.TextRange} range
+     */
     markAndRevealRange: function(range)
     {
+        if (range)
+            this.setSelection(range);
         this._mainPanel.markAndRevealRange(range);
     },
 
+    /**
+     * @param {number} lineNumber
+     */
     highlightLine: function(lineNumber)
     {
         if (typeof lineNumber !== "number" || lineNumber < 0)
@@ -148,15 +186,21 @@ WebInspector.TextViewer.prototype = {
         this._gutterPanel.freeCachedElements();
     },
 
+    /**
+     * @return {Array.<Element>}
+     */
     elementsToRestoreScrollPositionsFor: function()
     {
         return [this._mainPanel.element];
     },
 
-    inheritScrollPositions: function(textViewer)
+    /**
+     * @param {WebInspector.TextEditor} textEditor
+     */
+    inheritScrollPositions: function(textEditor)
     {
-        this._mainPanel.element._scrollTop = textViewer._mainPanel.element.scrollTop;
-        this._mainPanel.element._scrollLeft = textViewer._mainPanel.element.scrollLeft;
+        this._mainPanel.element._scrollTop = textEditor._mainPanel.element.scrollTop;
+        this._mainPanel.element._scrollLeft = textEditor._mainPanel.element.scrollLeft;
     },
 
     beginUpdates: function()
@@ -194,6 +238,10 @@ WebInspector.TextViewer.prototype = {
         this._delegate.beforeTextChanged();
     },
 
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
     _exitInternalTextChangeMode: function(oldRange, newRange)
     {
         this._internalTextChangeMode = false;
@@ -204,7 +252,7 @@ WebInspector.TextViewer.prototype = {
     {
         var lineNumbersWidth = this._gutterPanel.element.offsetWidth;
         if (lineNumbersWidth)
-            this._mainPanel.element.style.setProperty("left", lineNumbersWidth + "px");
+            this._mainPanel.element.style.setProperty("left", (lineNumbersWidth + 2) + "px");
         else
             this._mainPanel.element.style.removeProperty("left"); // Use default value set in CSS.
     },
@@ -218,6 +266,9 @@ WebInspector.TextViewer.prototype = {
         gutterElement.scrollTop = mainElement.scrollTop;
     },
 
+    /**
+     * @param {number} lineNumber
+     */
     _syncDecorationsForLine: function(lineNumber)
     {
         if (lineNumber >= this._textModel.linesCount)
@@ -238,6 +289,9 @@ WebInspector.TextViewer.prototype = {
         }
     },
 
+    /**
+     * @param {Element} gutterRow
+     */
     _syncLineHeight: function(gutterRow)
     {
         if (this._lineHeightSynced)
@@ -307,42 +361,129 @@ WebInspector.TextViewer.prototype = {
         return true;
     },
 
+    _handleScrollChanged: function(event)
+    {
+        var visibleFrom = this._mainPanel.element.scrollTop;
+        var firstVisibleLineNumber = this._mainPanel._findFirstVisibleLineNumber(visibleFrom);
+        this._delegate.scrollChanged(firstVisibleLineNumber);
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
+    scrollToLine: function(lineNumber)
+    {
+        this._mainPanel.scrollToLine(lineNumber);
+    },
+
+    _handleSelectionChange: function(event)
+    {
+        var textRange = this._mainPanel._getSelection();
+        if (textRange) {
+            // We do not restore selection after focus lost to avoid selection blinking. We restore only cursor position instead.
+            // FIXME: consider adding selection decoration to blurred editor.
+            this._lastSelection = WebInspector.TextRange.createFromLocation(textRange.endLine, textRange.endColumn);
+        }
+        this._delegate.selectionChanged(textRange);
+    },
+
+    /**
+     * @return {WebInspector.TextRange}
+     */
+    selection: function(textRange)
+    {
+        return this._mainPanel._getSelection();
+    },
+
+    /**
+     * @return {WebInspector.TextRange?}
+     */
+    lastSelection: function()
+    {
+        return this._lastSelection;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} textRange
+     */
+    setSelection: function(textRange)
+    {
+        this._lastSelection = textRange;
+        if (this.element.isAncestor(document.activeElement))
+            this._mainPanel._restoreSelection(textRange);
+    },
+
     wasShown: function()
     {
         if (!this.readOnly())
             WebInspector.markBeingEdited(this.element, true);
+
+        this._boundSelectionChangeListener = this._handleSelectionChange.bind(this);
+        document.addEventListener("selectionchange", this._boundSelectionChangeListener, false);
+    },
+
+    _handleFocused: function()
+    {
+        if (this._lastSelection)
+            this.setSelection(this._lastSelection);
     },
 
     willHide: function()
     {
+        document.removeEventListener("selectionchange", this._boundSelectionChangeListener, false);
+        delete this._boundSelectionChangeListener;
+
         if (!this.readOnly())
             WebInspector.markBeingEdited(this.element, false);
     }
 }
 
-WebInspector.TextViewer.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.TextEditor.prototype.__proto__ = WebInspector.View.prototype;
 
 /**
  * @interface
  */
-WebInspector.TextViewerDelegate = function()
+WebInspector.TextEditorDelegate = function()
 {
 }
 
-WebInspector.TextViewerDelegate.prototype = {
+WebInspector.TextEditorDelegate.prototype = {
     beforeTextChanged: function() { },
 
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
     afterTextChanged: function(oldRange, newRange) { },
 
     commitEditing: function() { },
 
+    /**
+     * @param {WebInspector.TextRange} textRange
+     */
+    selectionChanged: function(textRange) { },
+
+    /**
+     * @param {number} lineNumber
+     */
+    scrollChanged: function(lineNumber) { },
+
+    /**
+     * @param {WebInspector.ContextMenu} contextMenu
+     * @param {number} lineNumber
+     */
     populateLineGutterContextMenu: function(contextMenu, lineNumber) { },
 
+    /**
+     * @param {WebInspector.ContextMenu} contextMenu
+     * @param {number} lineNumber
+     */
     populateTextAreaContextMenu: function(contextMenu, lineNumber) { }
 }
 
 /**
  * @constructor
+ * @param {WebInspector.TextEditorModel} textModel
  */
 WebInspector.TextEditorChunkedPanel = function(textModel)
 {
@@ -354,11 +495,29 @@ WebInspector.TextEditorChunkedPanel = function(textModel)
 }
 
 WebInspector.TextEditorChunkedPanel.prototype = {
+    /**
+     * @return {WebInspector.TextEditorModel}
+     */
     get textModel()
     {
         return this._textModel;
     },
 
+    /**
+     * @param {number} lineNumber
+     */
+    scrollToLine: function(lineNumber)
+    {
+        if (lineNumber >= this._textModel.linesCount)
+            return;
+
+        var chunk = this.makeLineAChunk(lineNumber);
+        this.element.scrollTop = chunk.offsetTop;
+    },
+
+    /**
+     * @param {number} lineNumber
+     */
     revealLine: function(lineNumber)
     {
         if (lineNumber >= this._textModel.linesCount)
@@ -368,6 +527,10 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         chunk.element.scrollIntoViewIfNeeded();
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
     addDecoration: function(lineNumber, decoration)
     {
         if (lineNumber >= this._textModel.linesCount)
@@ -377,6 +540,10 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         chunk.addDecoration(decoration);
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
     removeDecoration: function(lineNumber, decoration)
     {
         if (lineNumber >= this._textModel.linesCount)
@@ -404,6 +571,9 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         this.endDomUpdates();
     },
 
+    /**
+     * @param {number} lineNumber
+     */
     makeLineAChunk: function(lineNumber)
     {
         var chunkNumber = this._chunkNumberForLine(lineNumber);
@@ -420,6 +590,11 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return this._splitChunkOnALine(lineNumber, chunkNumber, true);
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {number} chunkNumber
+     * @param {boolean=} createSuffixChunk
+     */
     _splitChunkOnALine: function(lineNumber, chunkNumber, createSuffixChunk)
     {
         this.beginDomUpdates();
@@ -472,10 +647,6 @@ WebInspector.TextEditorChunkedPanel.prototype = {
 
     _scroll: function()
     {
-        // FIXME: Replace the "2" with the padding-left value from CSS.
-        if (this.element.scrollLeft <= 2)
-            this.element.scrollLeft = 0;
-
         this._scheduleRepaintAll();
         if (this._syncScrollListener)
             this._syncScrollListener();
@@ -510,6 +681,9 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         this._domUpdateCoalescingLevel--;
     },
 
+    /**
+     * @param {number} lineNumber
+     */
     _chunkNumberForLine: function(lineNumber)
     {
         function compareLineNumbers(value, chunk)
@@ -520,11 +694,17 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return insertBefore - 1;
     },
 
+    /**
+     * @param {number} lineNumber
+     */
     chunkForLine: function(lineNumber)
     {
         return this._textChunks[this._chunkNumberForLine(lineNumber)];
     },
 
+    /**
+     * @param {number} visibleFrom
+     */
     _findFirstVisibleChunkNumber: function(visibleFrom)
     {
         function compareOffsetTops(value, chunk)
@@ -535,6 +715,10 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return insertBefore - 1;
     },
 
+    /**
+     * @param {number} visibleFrom
+     * @param {number} visibleTo
+     */
     _findVisibleChunks: function(visibleFrom, visibleTo)
     {
         var from = this._findFirstVisibleChunkNumber(visibleFrom);
@@ -545,6 +729,9 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return { start: from, end: to };
     },
 
+    /**
+     * @param {number} visibleFrom
+     */
     _findFirstVisibleLineNumber: function(visibleFrom)
     {
         var chunk = this._textChunks[this._findFirstVisibleChunkNumber(visibleFrom)];
@@ -581,6 +768,10 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         }
     },
 
+    /**
+     * @param {number} fromIndex
+     * @param {number} toIndex
+     */
     _expandChunks: function(fromIndex, toIndex)
     {
         // First collapse chunks to collect the DOM elements into a cache to reuse them later.
@@ -592,6 +783,10 @@ WebInspector.TextEditorChunkedPanel.prototype = {
             this._textChunks[i].expanded = true;
     },
 
+    /**
+     * @param {Element} firstElement
+     * @param {Element=} lastElement
+     */
     _totalHeight: function(firstElement, lastElement)
     {
         lastElement = (lastElement || firstElement).nextElementSibling;
@@ -619,6 +814,7 @@ WebInspector.TextEditorChunkedPanel.prototype = {
 /**
  * @constructor
  * @extends {WebInspector.TextEditorChunkedPanel}
+ * @param {WebInspector.TextEditorModel} textModel
  */
 WebInspector.TextEditorGutterPanel = function(textModel, syncDecorationsForLineListener, syncLineHeightListener)
 {
@@ -647,11 +843,19 @@ WebInspector.TextEditorGutterPanel.prototype = {
         this._cachedRows = [];
     },
 
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
     _createNewChunk: function(startLine, endLine)
     {
         return new WebInspector.TextEditorGutterChunk(this, startLine, endLine);
     },
 
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
     textChanged: function(oldRange, newRange)
     {
         this.beginDomUpdates();
@@ -720,6 +924,9 @@ WebInspector.TextEditorGutterPanel.prototype = {
         this.endDomUpdates();
     },
 
+    /**
+     * @param {number} clientHeight
+     */
     syncClientHeight: function(clientHeight)
     {
         if (this.element.offsetHeight > clientHeight)
@@ -728,6 +935,10 @@ WebInspector.TextEditorGutterPanel.prototype = {
             this._container.style.removeProperty("padding-bottom");
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
     addDecoration: function(lineNumber, decoration)
     {
         WebInspector.TextEditorChunkedPanel.prototype.addDecoration.call(this, lineNumber, decoration);
@@ -739,6 +950,10 @@ WebInspector.TextEditorGutterPanel.prototype = {
         decorations.push(decoration);
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {string|Element} decoration
+     */
     removeDecoration: function(lineNumber, decoration)
     {
         WebInspector.TextEditorChunkedPanel.prototype.removeDecoration.call(this, lineNumber, decoration);
@@ -756,10 +971,10 @@ WebInspector.TextEditorGutterPanel.prototype.__proto__ = WebInspector.TextEditor
 /**
  * @constructor
  */
-WebInspector.TextEditorGutterChunk = function(textViewer, startLine, endLine)
+WebInspector.TextEditorGutterChunk = function(textEditor, startLine, endLine)
 {
-    this._textViewer = textViewer;
-    this._textModel = textViewer._textModel;
+    this._textEditor = textEditor;
+    this._textModel = textEditor._textModel;
 
     this.startLine = startLine;
     endLine = Math.min(this._textModel.linesCount, endLine);
@@ -790,22 +1005,31 @@ WebInspector.TextEditorGutterChunk = function(textViewer, startLine, endLine)
 }
 
 WebInspector.TextEditorGutterChunk.prototype = {
+    /**
+     * @param {string} decoration
+     */
     addDecoration: function(decoration)
     {
-        this._textViewer.beginDomUpdates();
+        this._textEditor.beginDomUpdates();
         if (typeof decoration === "string")
             this.element.addStyleClass(decoration);
-        this._textViewer.endDomUpdates();
+        this._textEditor.endDomUpdates();
     },
 
+    /**
+     * @param {string} decoration
+     */
     removeDecoration: function(decoration)
     {
-        this._textViewer.beginDomUpdates();
+        this._textEditor.beginDomUpdates();
         if (typeof decoration === "string")
             this.element.removeStyleClass(decoration);
-        this._textViewer.endDomUpdates();
+        this._textEditor.endDomUpdates();
     },
 
+    /**
+     * @return {boolean}
+     */
     get expanded()
     {
         return this._expanded;
@@ -814,7 +1038,7 @@ WebInspector.TextEditorGutterChunk.prototype = {
     set expanded(expanded)
     {
         if (this.linesCount === 1)
-            this._textViewer._syncDecorationsForLineListener(this.startLine);
+            this._textEditor._syncDecorationsForLineListener(this.startLine);
 
         if (this._expanded === expanded)
             return;
@@ -824,7 +1048,7 @@ WebInspector.TextEditorGutterChunk.prototype = {
         if (this.linesCount === 1)
             return;
 
-        this._textViewer.beginDomUpdates();
+        this._textEditor.beginDomUpdates();
 
         if (expanded) {
             this._expandedLineRows = [];
@@ -835,7 +1059,7 @@ WebInspector.TextEditorGutterChunk.prototype = {
                 this._expandedLineRows.push(lineRow);
             }
             parentElement.removeChild(this.element);
-            this._textViewer._syncLineHeightListener(this._expandedLineRows[0]);
+            this._textEditor._syncLineHeightListener(this._expandedLineRows[0]);
         } else {
             var elementInserted = false;
             for (var i = 0; i < this._expandedLineRows.length; ++i) {
@@ -848,29 +1072,39 @@ WebInspector.TextEditorGutterChunk.prototype = {
                     }
                     parentElement.removeChild(lineRow);
                 }
-                this._textViewer._cachedRows.push(lineRow);
+                this._textEditor._cachedRows.push(lineRow);
             }
             delete this._expandedLineRows;
         }
 
-        this._textViewer.endDomUpdates();
+        this._textEditor.endDomUpdates();
     },
 
+    /**
+     * @return {number}
+     */
     get height()
     {
         if (!this._expandedLineRows)
-            return this._textViewer._totalHeight(this.element);
-        return this._textViewer._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
+            return this._textEditor._totalHeight(this.element);
+        return this._textEditor._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
     },
 
+    /**
+     * @return {number}
+     */
     get offsetTop()
     {
         return (this._expandedLineRows && this._expandedLineRows.length) ? this._expandedLineRows[0].offsetTop : this.element.offsetTop;
     },
 
+    /**
+     * @param {number} lineNumber
+     * @return {Element}
+     */
     _createRow: function(lineNumber)
     {
-        var lineRow = this._textViewer._cachedRows.pop() || document.createElement("div");
+        var lineRow = this._textEditor._cachedRows.pop() || document.createElement("div");
         lineRow.lineNumber = lineNumber;
         lineRow.className = "webkit-line-number";
         lineRow.textContent = lineNumber + 1;
@@ -881,6 +1115,8 @@ WebInspector.TextEditorGutterChunk.prototype = {
 /**
  * @constructor
  * @extends {WebInspector.TextEditorChunkedPanel}
+ * @param {WebInspector.TextEditorModel} textModel
+ * @param {?string} url
  */
 WebInspector.TextEditorMainPanel = function(textModel, url, syncScrollListener, syncDecorationsForLineListener, enterTextChangeMode, exitTextChangeMode)
 {
@@ -925,11 +1161,18 @@ WebInspector.TextEditorMainPanel = function(textModel, url, syncScrollListener,
 }
 
 WebInspector.TextEditorMainPanel.prototype = {
+    /**
+     * @param {string} mimeType
+     */
     set mimeType(mimeType)
     {
         this._highlighter.mimeType = mimeType;
     },
 
+    /**
+     * @param {boolean} readOnly
+     * @param {boolean} requestFocus
+     */
     setReadOnly: function(readOnly, requestFocus)
     {
         if (this._readOnly === readOnly)
@@ -947,6 +1190,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         this.endDomUpdates();
     },
 
+    /**
+     * @return {boolean}
+     */
     readOnly: function()
     {
         return this._readOnly;
@@ -958,6 +1204,9 @@ WebInspector.TextEditorMainPanel.prototype = {
             this._container.focus();
     },
 
+    /**
+     * @return {Element}
+     */
     defaultFocusedElement: function()
     {
         if (this._readOnly)
@@ -986,6 +1235,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         selection.addRange(range);
     },
 
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
     setEditableRange: function(startLine, endLine)
     {
         this.beginDomUpdates();
@@ -1023,6 +1276,9 @@ WebInspector.TextEditorMainPanel.prototype = {
             this._textChunks[chunkNumber].readOnly = false;
     },
 
+    /**
+     * @param {WebInspector.TextRange} range
+     */
     markAndRevealRange: function(range)
     {
         if (this._rangeToMark) {
@@ -1052,6 +1308,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         delete this._markedRangeElement;
     },
 
+    /**
+     * @param {number} lineNumber
+     */
     highlightLine: function(lineNumber)
     {
         this.clearLineHighlight();
@@ -1059,7 +1318,7 @@ WebInspector.TextEditorMainPanel.prototype = {
         this.revealLine(lineNumber);
 
         if (!this._readOnly)
-            this._restoreSelection(new WebInspector.TextRange(lineNumber, 0, lineNumber, 0), false);
+            this._restoreSelection(WebInspector.TextRange.createFromLocation(lineNumber, 0), false);
 
         this.addDecoration(lineNumber, "webkit-highlighted-line");
     },
@@ -1079,6 +1338,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._cachedRows = [];
     },
 
+    /**
+     * @param {boolean} redo
+     */
     handleUndoRedo: function(redo)
     {
         if (this._dirtyLines)
@@ -1107,6 +1369,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         return true;
     },
 
+    /**
+     * @param {boolean} shiftKey
+     */
     handleTabKeyPress: function(shiftKey)
     {
         if (this._dirtyLines)
@@ -1140,6 +1405,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         return true;
     },
 
+    /**
+     * @param {WebInspector.TextRange} range
+     */
     _indentLines: function(range)
     {
         var indent = WebInspector.settings.textEditorIndent.get();
@@ -1160,13 +1428,16 @@ WebInspector.TextEditorMainPanel.prototype = {
             indentEndLine--;
 
         for (var lineNumber = range.startLine; lineNumber <= indentEndLine; lineNumber++)
-            this._textModel.editRange(new WebInspector.TextRange(lineNumber, 0, lineNumber, 0), indent);
+            this._textModel.editRange(WebInspector.TextRange.createFromLocation(lineNumber, 0), indent);
 
         this._lastEditedRange = newRange;
 
         return newRange;
     },
 
+    /**
+     * @param {WebInspector.TextRange} range
+     */
     _unindentLines: function(range)
     {
         if (this._lastEditedRange)
@@ -1256,6 +1527,11 @@ WebInspector.TextEditorMainPanel.prototype = {
         return true;
     },
 
+    /**
+     * @param {number} lineNumber
+     * @param {number} chunkNumber
+     * @param {boolean=} createSuffixChunk
+     */
     _splitChunkOnALine: function(lineNumber, chunkNumber, createSuffixChunk)
     {
         var selection = this._getSelection();
@@ -1284,6 +1560,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         }
     },
 
+    /**
+     * @param {Element} lineRow
+     * @param {boolean} enable
+     */
     _enableDOMNodeRemovedListener: function(lineRow, enable)
     {
         if (enable)
@@ -1300,11 +1580,19 @@ WebInspector.TextEditorMainPanel.prototype = {
         WebInspector.TextEditorChunkedPanel.prototype._buildChunks.call(this);
     },
 
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
     _createNewChunk: function(startLine, endLine)
     {
         return new WebInspector.TextEditorMainChunk(this, startLine, endLine);
     },
 
+    /**
+     * @param {number} fromIndex
+     * @param {number} toIndex
+     */
     _expandChunks: function(fromIndex, toIndex)
     {
         var lastChunk = this._textChunks[toIndex - 1];
@@ -1323,6 +1611,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._restoreSelection(selection);
     },
 
+    /**
+     * @param {number} fromLine
+     * @param {number} toLine
+     */
     _highlightDataReady: function(fromLine, toLine)
     {
         if (this._muteHighlightListener)
@@ -1331,6 +1623,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._paintLines(fromLine, toLine, true /*restoreSelection*/);
     },
 
+    /**
+     * @param {number} startLine
+     * @param {number} endLine
+     */
     _schedulePaintLines: function(startLine, endLine)
     {
         if (startLine >= endLine)
@@ -1356,6 +1652,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         }
     },
 
+    /**
+     * @param {boolean} skipRestoreSelection
+     */
     _paintScheduledLines: function(skipRestoreSelection)
     {
         if (this._paintScheduledLinesTimer)
@@ -1401,6 +1700,8 @@ WebInspector.TextEditorMainPanel.prototype = {
     },
 
     /**
+     * @param {number} fromLine
+     * @param {number} toLine
      * @param {boolean=} restoreSelection
      */
     _paintLines: function(fromLine, toLine, restoreSelection)
@@ -1408,6 +1709,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._paintLineChunks([ { startLine: fromLine, endLine: toLine } ], restoreSelection);
     },
 
+    /**
+     * @param {boolean=} restoreSelection
+     */
     _paintLineChunks: function(lineChunks, restoreSelection)
     {
         // First, paint visible lines, so that in case of long lines we should start highlighting
@@ -1454,6 +1758,9 @@ WebInspector.TextEditorMainPanel.prototype = {
             this._restoreSelection(selection);
     },
 
+    /**
+     * @param {Element} lineRow
+     */
     _paintLine: function(lineRow)
     {
         var lineNumber = lineRow.lineNumber;
@@ -1515,6 +1822,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         }
     },
 
+    /**
+     * @param {Element} lineRow
+     */
     _releaseLinesHighlight: function(lineRow)
     {
         if (!lineRow)
@@ -1534,12 +1844,15 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._cachedRows.push(lineRow);
     },
 
+    /**
+     * @return {WebInspector.TextRange}
+     */
     _getSelection: function()
     {
         var selection = window.getSelection();
         if (!selection.rangeCount)
             return null;
-        // Selection may be outside of the viewer.
+        // Selection may be outside of the editor.
         if (!this._container.isAncestor(selection.anchorNode) || !this._container.isAncestor(selection.focusNode))
             return null;
         var start = this._selectionToPosition(selection.anchorNode, selection.anchorOffset);
@@ -1568,12 +1881,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         }
     },
 
-    _setCaretLocation: function(line, column, scrollIntoView)
-    {
-        var range = new WebInspector.TextRange(line, column, line, column);
-        this._restoreSelection(range, scrollIntoView);
-    },
-
+    /**
+     * @param {Node} container
+     * @param {number} offset
+     */
     _selectionToPosition: function(container, offset)
     {
         if (container === this._container && offset === 0)
@@ -1614,6 +1925,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         return { line: lineNumber, column: column };
     },
 
+    /**
+     * @param {number} line
+     * @param {number} column
+     */
     _positionToSelection: function(line, column)
     {
         var chunk = this.chunkForLine(line);
@@ -1634,6 +1949,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         return rangeBoundary;
     },
 
+    /**
+     * @param {Node} element
+     */
     _enclosingLineRowOrSelf: function(element)
     {
         var lineRow = element.enclosingNodeOrSelfWithClass("webkit-line-content");
@@ -1647,6 +1965,11 @@ WebInspector.TextEditorMainPanel.prototype = {
         return null;
     },
 
+    /**
+     * @param {Element} element
+     * @param {string} content
+     * @param {string} className
+     */
     _appendSpan: function(element, content, className)
     {
         if (className === "html-resource-link" || className === "html-external-link") {
@@ -1663,6 +1986,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         element.spans.push(span);
     },
 
+    /**
+     * @param {Element} element
+     * @param {string} text
+     */
     _appendTextNode: function(element, text)
     {
         var textNode = this._cachedTextNodes.pop();
@@ -1676,6 +2003,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         element.textNodes.push(textNode);
     },
 
+    /**
+     * @param {string} content
+     * @param {boolean} isExternal
+     */
     _createLink: function(content, isExternal)
     {
         var quote = content.charAt(0);
@@ -1696,6 +2027,7 @@ WebInspector.TextEditorMainPanel.prototype = {
     },
 
     /**
+     * @param {string=} hrefValue
      * @param {boolean=} isExternal
      */
     _rewriteHref: function(hrefValue, isExternal)
@@ -1859,6 +2191,9 @@ WebInspector.TextEditorMainPanel.prototype = {
             return; // Noop
         }
 
+        if (lines.length === 1 && lines[0] === "}" && oldRange.isEmpty() && selection.isEmpty() && !this._textModel.line(oldRange.endLine).trim())
+            this._unindentAfterBlock(oldRange, selection);
+        
         // This is a "foreign" call outside of this class. Should be before we delete the dirty lines flag.
         this._enterTextChangeMode();
 
@@ -1872,6 +2207,42 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._exitTextChangeMode(oldRange, newRange);
     },
 
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} selection
+     */
+    _unindentAfterBlock: function(oldRange, selection)
+    {
+        var nestingLevel = 1;
+        for (var i = oldRange.endLine; i >= 0; --i) {
+            var attribute = this._textModel.getAttribute(i, "highlight");
+            if (!attribute)
+                continue;
+            var columnNumbers = Object.keys(attribute).reverse();
+            for (var j = 0; j < columnNumbers.length; ++j) {
+                var column = columnNumbers[j];
+                if (attribute[column].tokenType === "block-start") {
+                    if (!(--nestingLevel)) {
+                        var lineContent = this._textModel.line(i);
+                        var blockOffset = lineContent.length - lineContent.trimLeft().length;
+                        if (blockOffset < oldRange.startColumn) {
+                            oldRange.startColumn = blockOffset;
+                            selection.startColumn = blockOffset + 1;
+                            selection.endColumn = blockOffset + 1;
+                        }
+                        return;
+                    }
+                }
+                if (attribute[column].tokenType === "block-end")
+                    ++nestingLevel;
+            }
+        }
+    },
+
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
     textChanged: function(oldRange, newRange)
     {
         this.beginDomUpdates();
@@ -1881,6 +2252,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         this.endDomUpdates();
     },
 
+    /**
+     * @param {WebInspector.TextRange} range
+     * @param {string} text
+     */
     _editRange: function(range, text)
     {
         if (this._lastEditedRange && (!text || text.indexOf("\n") !== -1 || this._lastEditedRange.endLine !== range.startLine || this._lastEditedRange.endColumn !== range.startColumn))
@@ -1892,6 +2267,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         return newRange;
     },
 
+    /**
+     * @param {WebInspector.TextRange} range
+     */
     _removeDecorationsInRange: function(range)
     {
         for (var i = this._chunkNumberForLine(range.startLine); i < this._textChunks.length; ++i) {
@@ -1902,6 +2280,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         }
     },
 
+    /**
+     * @param {WebInspector.TextRange} oldRange
+     * @param {WebInspector.TextRange} newRange
+     */
     _updateChunksForRanges: function(oldRange, newRange)
     {
         // Update the chunks in range: firstChunkNumber <= index <= lastChunkNumber
@@ -1998,6 +2380,9 @@ WebInspector.TextEditorMainPanel.prototype = {
         this.element.scrollLeft = scrollLeft;
     },
 
+    /**
+     * @param {WebInspector.TextRange} range
+     */
     _updateHighlightsForRange: function(range)
     {
         var visibleFrom = this.element.scrollTop;
@@ -2020,6 +2405,10 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._repaintAll();
     },
 
+    /**
+     * @param {Array.<string>} lines
+     * @param {Element} element
+     */
     _collectLinesFromDiv: function(lines, element)
     {
         var textContents = [];
@@ -2050,16 +2439,19 @@ WebInspector.TextEditorMainPanel.prototype.__proto__ = WebInspector.TextEditorCh
 
 /**
  * @constructor
- */
-WebInspector.TextEditorMainChunk = function(textViewer, startLine, endLine)
+ * @param {WebInspector.TextEditorChunkedPanel} chunkedPanel
+ * @param {number} startLine
+ * @param {number} endLine
+*/
+WebInspector.TextEditorMainChunk = function(chunkedPanel, startLine, endLine)
 {
-    this._textViewer = textViewer;
-    this._textModel = textViewer._textModel;
+    this._chunkedPanel = chunkedPanel;
+    this._textModel = chunkedPanel._textModel;
 
     this.element = document.createElement("div");
     this.element.lineNumber = startLine;
     this.element.className = "webkit-line-content";
-    this._textViewer._enableDOMNodeRemovedListener(this.element, true);
+    this._chunkedPanel._enableDOMNodeRemovedListener(this.element, true);
 
     this._startLine = startLine;
     endLine = Math.min(this._textModel.linesCount, endLine);
@@ -2074,7 +2466,7 @@ WebInspector.TextEditorMainChunk = function(textViewer, startLine, endLine)
 WebInspector.TextEditorMainChunk.prototype = {
     addDecoration: function(decoration)
     {
-        this._textViewer.beginDomUpdates();
+        this._chunkedPanel.beginDomUpdates();
         if (typeof decoration === "string")
             this.element.addStyleClass(decoration);
         else {
@@ -2085,35 +2477,44 @@ WebInspector.TextEditorMainChunk.prototype = {
             }
             this.element.decorationsElement.appendChild(decoration);
         }
-        this._textViewer.endDomUpdates();
+        this._chunkedPanel.endDomUpdates();
     },
 
+    /**
+     * @param {string|Element} decoration
+     */
     removeDecoration: function(decoration)
     {
-        this._textViewer.beginDomUpdates();
+        this._chunkedPanel.beginDomUpdates();
         if (typeof decoration === "string")
             this.element.removeStyleClass(decoration);
         else if (this.element.decorationsElement)
             this.element.decorationsElement.removeChild(decoration);
-        this._textViewer.endDomUpdates();
+        this._chunkedPanel.endDomUpdates();
     },
 
     removeAllDecorations: function()
     {
-        this._textViewer.beginDomUpdates();
+        this._chunkedPanel.beginDomUpdates();
         this.element.className = "webkit-line-content";
         if (this.element.decorationsElement) {
             this.element.removeChild(this.element.decorationsElement);
             delete this.element.decorationsElement;
         }
-        this._textViewer.endDomUpdates();
+        this._chunkedPanel.endDomUpdates();
     },
 
+    /**
+     * @return {boolean}
+     */
     get decorated()
     {
         return this.element.className !== "webkit-line-content" || !!(this.element.decorationsElement && this.element.decorationsElement.firstChild);
     },
 
+    /**
+     * @return {number}
+     */
     get startLine()
     {
         return this._startLine;
@@ -2129,6 +2530,9 @@ WebInspector.TextEditorMainChunk.prototype = {
         }
     },
 
+    /**
+     * @return {boolean}
+     */
     get expanded()
     {
         return this._expanded;
@@ -2143,45 +2547,45 @@ WebInspector.TextEditorMainChunk.prototype = {
 
         if (this.linesCount === 1) {
             if (expanded)
-                this._textViewer._paintLine(this.element);
+                this._chunkedPanel._paintLine(this.element);
             return;
         }
 
-        this._textViewer.beginDomUpdates();
+        this._chunkedPanel.beginDomUpdates();
 
         if (expanded) {
             this._expandedLineRows = [];
             var parentElement = this.element.parentElement;
             for (var i = this.startLine; i < this.startLine + this.linesCount; ++i) {
                 var lineRow = this._createRow(i);
-                this._textViewer._enableDOMNodeRemovedListener(lineRow, true);
+                this._chunkedPanel._enableDOMNodeRemovedListener(lineRow, true);
                 this._updateElementReadOnlyState(lineRow);
                 parentElement.insertBefore(lineRow, this.element);
                 this._expandedLineRows.push(lineRow);
             }
-            this._textViewer._enableDOMNodeRemovedListener(this.element, false);
+            this._chunkedPanel._enableDOMNodeRemovedListener(this.element, false);
             parentElement.removeChild(this.element);
-            this._textViewer._paintLines(this.startLine, this.startLine + this.linesCount);
+            this._chunkedPanel._paintLines(this.startLine, this.startLine + this.linesCount);
         } else {
             var elementInserted = false;
             for (var i = 0; i < this._expandedLineRows.length; ++i) {
                 var lineRow = this._expandedLineRows[i];
-                this._textViewer._enableDOMNodeRemovedListener(lineRow, false);
+                this._chunkedPanel._enableDOMNodeRemovedListener(lineRow, false);
                 var parentElement = lineRow.parentElement;
                 if (parentElement) {
                     if (!elementInserted) {
                         elementInserted = true;
-                        this._textViewer._enableDOMNodeRemovedListener(this.element, true);
+                        this._chunkedPanel._enableDOMNodeRemovedListener(this.element, true);
                         parentElement.insertBefore(this.element, lineRow);
                     }
                     parentElement.removeChild(lineRow);
                 }
-                this._textViewer._releaseLinesHighlight(lineRow);
+                this._chunkedPanel._releaseLinesHighlight(lineRow);
             }
             delete this._expandedLineRows;
         }
 
-        this._textViewer.endDomUpdates();
+        this._chunkedPanel.endDomUpdates();
     },
 
     set readOnly(readOnly)
@@ -2197,6 +2601,9 @@ WebInspector.TextEditorMainChunk.prototype = {
         }
     },
 
+    /**
+     * @return {boolean}
+     */
     get readOnly()
     {
         return this._readOnly;
@@ -2210,21 +2617,31 @@ WebInspector.TextEditorMainChunk.prototype = {
             element.removeStyleClass("text-editor-read-only");
     },
 
+    /**
+     * @return {number}
+     */
     get height()
     {
         if (!this._expandedLineRows)
-            return this._textViewer._totalHeight(this.element);
-        return this._textViewer._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
+            return this._chunkedPanel._totalHeight(this.element);
+        return this._chunkedPanel._totalHeight(this._expandedLineRows[0], this._expandedLineRows[this._expandedLineRows.length - 1]);
     },
 
+    /**
+     * @return {number}
+     */
     get offsetTop()
     {
         return (this._expandedLineRows && this._expandedLineRows.length) ? this._expandedLineRows[0].offsetTop : this.element.offsetTop;
     },
 
+    /**
+     * @param {number} lineNumber
+     * @return {Element}
+     */
     _createRow: function(lineNumber)
     {
-        var lineRow = this._textViewer._cachedRows.pop() || document.createElement("div");
+        var lineRow = this._chunkedPanel._cachedRows.pop() || document.createElement("div");
         lineRow.lineNumber = lineNumber;
         lineRow.className = "webkit-line-content";
         lineRow.textContent = this._textModel.line(lineNumber);
@@ -2233,6 +2650,10 @@ WebInspector.TextEditorMainChunk.prototype = {
         return lineRow;
     },
 
+    /**
+     * @param {number} lineNumber
+     * @return {Element}
+     */
     getExpandedLineRow: function(lineNumber)
     {
         if (!this._expanded || lineNumber < this.startLine || lineNumber >= this.startLine + this.linesCount)
diff --git a/Source/WebCore/inspector/front-end/TextEditorModel.js b/Source/WebCore/inspector/front-end/TextEditorModel.js
index 7a41db46b..55205db4c 100644
--- a/Source/WebCore/inspector/front-end/TextEditorModel.js
+++ b/Source/WebCore/inspector/front-end/TextEditorModel.js
@@ -43,6 +43,20 @@ WebInspector.TextRange = function(startLine, startColumn, endLine, endColumn)
     this.endColumn = endColumn;
 }
 
+WebInspector.TextRange.createFromLocation = function(line, column)
+{
+    return new WebInspector.TextRange(line, column, line, column);
+}
+
+/**
+ * @param {Object} serializedTextRange
+ * @return {WebInspector.TextRange}
+ */
+WebInspector.TextRange.fromObject = function (serializedTextRange)
+{
+    return new WebInspector.TextRange(serializedTextRange.startLine, serializedTextRange.startColumn, serializedTextRange.endLine, serializedTextRange.endColumn);
+}
+
 WebInspector.TextRange.prototype = {
     /**
      * @return {boolean}
@@ -82,6 +96,36 @@ WebInspector.TextRange.prototype = {
     clone: function()
     {
         return new WebInspector.TextRange(this.startLine, this.startColumn, this.endLine, this.endColumn);
+    },
+
+    /**
+     * @return {Object}
+     */
+    serializeToObject: function()
+    {
+        var serializedTextRange = {};
+        serializedTextRange.startLine = this.startLine;
+        serializedTextRange.startColumn = this.startColumn;
+        serializedTextRange.endLine = this.endLine;
+        serializedTextRange.endColumn = this.endColumn;
+        return serializedTextRange;
+    },
+
+    /**
+     * @param {WebInspector.TextRange} other
+     * @return {number}
+     */
+    compareTo: function(other)
+    {
+        if (this.startLine > other.startLine)
+            return 1;
+        if (this.startLine < other.startLine)
+            return -1;
+        if (this.startColumn > other.startColumn)
+            return 1;
+        if (this.startColumn < other.startColumn)
+            return -1;
+        return 0;
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/TimelineFrameController.js b/Source/WebCore/inspector/front-end/TimelineFrameController.js
index 4e41e2435..06380966e 100644
--- a/Source/WebCore/inspector/front-end/TimelineFrameController.js
+++ b/Source/WebCore/inspector/front-end/TimelineFrameController.js
@@ -61,6 +61,16 @@ WebInspector.TimelineFrameController.prototype = {
 
     _addRecord: function(record)
     {
+        var records;
+        if (record.type === WebInspector.TimelineModel.RecordType.Program)
+            records = record["children"] || [];
+        else
+            records = [record];
+        records.forEach(this._innerAddRecord, this);
+    },
+
+    _innerAddRecord: function(record)
+    {
         if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame && this._lastFrame)
             this._flushFrame(record);
         else {
diff --git a/Source/WebCore/inspector/front-end/TimelineModel.js b/Source/WebCore/inspector/front-end/TimelineModel.js
index 03ff0e734..b3b6a6617 100644
--- a/Source/WebCore/inspector/front-end/TimelineModel.js
+++ b/Source/WebCore/inspector/front-end/TimelineModel.js
@@ -44,6 +44,7 @@ WebInspector.TimelineModel = function()
 
 WebInspector.TimelineModel.RecordType = {
     Root: "Root",
+    Program: "Program",
     EventDispatch: "EventDispatch",
 
     BeginFrame: "BeginFrame",
@@ -62,11 +63,13 @@ WebInspector.TimelineModel.RecordType = {
     XHRLoad: "XHRLoad",
     EvaluateScript: "EvaluateScript",
 
-    TimeStamp: "TimeStamp",
-
     MarkLoad: "MarkLoad",
     MarkDOMContent: "MarkDOMContent",
 
+    TimeStamp: "TimeStamp",
+    Time: "Time",
+    TimeEnd: "TimeEnd",
+
     ScheduleResourceRequest: "ScheduleResourceRequest",
     ResourceSendRequest: "ResourceSendRequest",
     ResourceReceiveResponse: "ResourceReceiveResponse",
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index 4e4891eb7..0a28c3b9e 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -885,6 +885,8 @@ WebInspector.TimelineCategoryStrips.prototype = {
             var recordStart = Math.floor((WebInspector.TimelineModel.startTimeInSeconds(record) - timeOffset) * scale);
             var recordEnd = Math.ceil((WebInspector.TimelineModel.endTimeInSeconds(record) - timeOffset) * scale);
             var category = WebInspector.TimelinePresentationModel.categoryForRecord(record);
+            if (category.overviewStripGroupIndex < 0)
+                return;
             var bar = lastBarByGroup[category.overviewStripGroupIndex];
             // This bar may be merged with previous -- so just adjust the previous bar.
             const barsMergeThreshold = 2;
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index c80ec438e..0d2358792 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -157,7 +157,6 @@ WebInspector.TimelinePanel.prototype = {
         var top = event.pageY + this._dragOffset
         this._setSplitterPosition(top);
         event.preventDefault();
-        this._refresh();
     },
 
     /**
@@ -180,6 +179,8 @@ WebInspector.TimelinePanel.prototype = {
         this.splitView.element.style.height = (top - overviewHeight) + "px";
         this._timelineMemorySplitter.style.top = (top - 2) + "px";
         this._memoryStatistics.setTopPosition(top);
+        this._containerElementHeight = this._containerElement.clientHeight;
+        this.onResize();
     },
 
     get calculator()
@@ -231,6 +232,8 @@ WebInspector.TimelinePanel.prototype = {
         var categories = WebInspector.TimelinePresentationModel.categories();
         for (var categoryName in categories) {
             var category = categories[categoryName];
+            if (category.overviewStripGroupIndex < 0)
+                continue;
             this.statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCategoryCheckboxClicked.bind(this, category)));
         }
     },
@@ -436,13 +439,13 @@ WebInspector.TimelinePanel.prototype = {
             this._memoryStatistics.hide();
             this.splitView.element.style.height = "auto";
             this.splitView.element.style.bottom = "0";
+            this.onResize();
         } else {
             this._timelineMemorySplitter.removeStyleClass("hidden");
             this._memoryStatistics.show();
             this.splitView.element.style.bottom = "auto";
             this._setSplitterPosition(WebInspector.settings.memoryCounterGraphsHeight.get());
         }
-        this._refresh();
     },
 
     _toggleTimelineButtonClicked: function()
@@ -494,8 +497,8 @@ WebInspector.TimelinePanel.prototype = {
 
     _innerAddRecordToTimeline: function(record, parentRecord)
     {
-        var formattedRecord = this._presentationModel.addRecord(record, parentRecord);
-        ++this._allRecordsCount;
+        var records = this._presentationModel.addRecord(record, parentRecord);
+        this._allRecordsCount += records.length;
         var recordTypes = WebInspector.TimelineModel.RecordType;
         var timeStampRecords = this._timeStampRecords;
         var hasVisibleRecords = false;
@@ -506,10 +509,14 @@ WebInspector.TimelinePanel.prototype = {
                 timeStampRecords.push(record);
             hasVisibleRecords |= presentationModel.isVisible(record);
         }
-        var records = [ formattedRecord ];
         WebInspector.TimelinePresentationModel.forAllRecords(records, processRecord);
+
+        function isAdoptedRecord(record)
+        {
+            return record.parent !== presentationModel.rootRecord;
+        }
         // Tell caller update is necessary either if we added a visible record or if we re-parented a record.
-        return hasVisibleRecords || formattedRecord.parent !== this._presentationModel.rootRecord;
+        return hasVisibleRecords || records.some(isAdoptedRecord);
     },
 
     sidebarResized: function(event)
diff --git a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
index 66a77ac84..02ad99051 100644
--- a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
@@ -47,6 +47,7 @@ WebInspector.TimelinePresentationModel.categories = function()
     if (WebInspector.TimelinePresentationModel._categories)
         return WebInspector.TimelinePresentationModel._categories;
     WebInspector.TimelinePresentationModel._categories = {
+        program: new WebInspector.TimelineCategory("program", WebInspector.UIString("Program"), -1, "#BBBBBB", "#DDDDDD", "#FFFFFF"),
         loading: new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), 0, "#5A8BCC", "#8EB6E9", "#70A2E3"),
         scripting: new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), 1, "#D8AA34", "#F3D07A", "#F1C453"),
         rendering: new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), 2, "#8266CC", "#AF9AEB", "#9A7EE6"),
@@ -68,6 +69,7 @@ WebInspector.TimelinePresentationModel.recordStyle = function(record)
 
     var recordStyles = {};
     recordStyles[recordTypes.Root] = { title: "#root", category: categories["loading"] };
+    recordStyles[recordTypes.Program] = { title: WebInspector.UIString("Program"), category: categories["program"] };
     recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: categories["scripting"] };
     recordStyles[recordTypes.BeginFrame] = { title: WebInspector.UIString("Frame Start"), category: categories["rendering"] };
     recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: categories["rendering"] };
@@ -81,7 +83,6 @@ WebInspector.TimelinePresentationModel.recordStyle = function(record)
     recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: categories["scripting"] };
     recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: categories["scripting"] };
     recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: categories["scripting"] };
-    recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
     recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: categories["loading"] };
     recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: categories["loading"] };
     recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: categories["loading"] };
@@ -90,6 +91,9 @@ WebInspector.TimelinePresentationModel.recordStyle = function(record)
     recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: categories["scripting"] };
     recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: categories["scripting"] };
     recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: categories["scripting"] };
+    recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
+    recordStyles[recordTypes.Time] = { title: WebInspector.UIString("Time"), category: categories["scripting"] };
+    recordStyles[recordTypes.TimeEnd] = { title: WebInspector.UIString("Time End"), category: categories["scripting"] };
     recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: categories["loading"] };
     recordStyles[recordTypes.RequestAnimationFrame] = { title: WebInspector.UIString("Request Animation Frame"), category: categories["scripting"] };
     recordStyles[recordTypes.CancelAnimationFrame] = { title: WebInspector.UIString("Cancel Animation Frame"), category: categories["scripting"] };
@@ -101,7 +105,7 @@ WebInspector.TimelinePresentationModel.recordStyle = function(record)
 
 WebInspector.TimelinePresentationModel.categoryForRecord = function(record)
 {
-        return WebInspector.TimelinePresentationModel.recordStyle(record).category;
+    return WebInspector.TimelinePresentationModel.recordStyle(record).category;
 }
 
 WebInspector.TimelinePresentationModel.isEventDivider = function(record)
@@ -115,7 +119,12 @@ WebInspector.TimelinePresentationModel.isEventDivider = function(record)
     return false;
 }
 
-WebInspector.TimelinePresentationModel.forAllRecords = function(recordsArray, callback)
+/**
+ * @param {Array} recordsArray
+ * @param {?function(*)} preOrderCallback
+ * @param {function(*)=} postOrderCallback
+ */
+WebInspector.TimelinePresentationModel.forAllRecords = function(recordsArray, preOrderCallback, postOrderCallback)
 {
     if (!recordsArray)
         return;
@@ -125,13 +134,18 @@ WebInspector.TimelinePresentationModel.forAllRecords = function(recordsArray, ca
         var records = entry.array;
         if (entry.index < records.length) {
              var record = records[entry.index];
-             if (callback(record))
+             if (preOrderCallback && preOrderCallback(record))
                  return;
              if (record.children)
-                 stack.push({array: record.children, index: 0});
+                 stack.push({array: record.children, index: 0, record: record});
+             else if (postOrderCallback && postOrderCallback(record))
+                return;
              ++entry.index;
-        } else
+        } else {
+            if (entry.record && postOrderCallback && postOrderCallback(entry.record))
+                return;
             stack.pop();
+        }
     }
 }
 
@@ -145,9 +159,6 @@ WebInspector.TimelinePresentationModel.createEventDivider = function(recordType,
     eventDivider.className = "resources-event-divider";
     var recordTypes = WebInspector.TimelineModel.RecordType;
 
-    var eventDividerPadding = document.createElement("div");
-    eventDividerPadding.className = "resources-event-divider-padding";
-
     if (recordType === recordTypes.MarkDOMContent)
         eventDivider.className += " resources-blue-divider";
     else if (recordType === recordTypes.MarkLoad)
@@ -158,10 +169,9 @@ WebInspector.TimelinePresentationModel.createEventDivider = function(recordType,
         eventDivider.className += " timeline-frame-divider";
 
     if (title)
-        eventDividerPadding.title = title;
+        eventDivider.title = title;
 
-    eventDividerPadding.appendChild(eventDivider);
-    return eventDividerPadding;
+    return eventDivider;
 }
 
 WebInspector.TimelinePresentationModel.prototype = {
@@ -191,6 +201,7 @@ WebInspector.TimelinePresentationModel.prototype = {
         this._scheduledResourceRequests = {};
         this._timerRecords = {};
         this._requestAnimationFrameRecords = {};
+        this._timeRecords = {};
         this._frames = [];
         this._minimumRecordTime = -1;
     },
@@ -202,15 +213,37 @@ WebInspector.TimelinePresentationModel.prototype = {
 
     addRecord: function(record, parentRecord)
     {
-        var connectedToOldRecord = false;
-        var recordTypes = WebInspector.TimelineModel.RecordType;
-
         if (this._minimumRecordTime === -1 || record.startTime < this._minimumRecordTime)
             this._minimumRecordTime = WebInspector.TimelineModel.startTimeInSeconds(record);
 
-        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
-            parentRecord = null; // No bar entry for load events.
-        else {
+        var records;
+        if (record.type === WebInspector.TimelineModel.RecordType.Program)
+            records = record.children;
+        else
+            records = [record];
+
+        var formattedRecords = [];
+        var recordsCount = records.length;
+        for (var i = 0; i < recordsCount; ++i)
+            formattedRecords.push(this._innerAddRecord(records[i], parentRecord));
+        return formattedRecords;
+    },
+
+    _innerAddRecord: function(record, parentRecord)
+    {
+        var connectedToOldRecord = false;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
+
+        switch (record.type) {
+        // No bar entry for load events.
+        case recordTypes.MarkDOMContent:
+        case recordTypes.MarkLoad:
+            parentRecord = null;
+            break;
+        case recordTypes.Time:
+            parentRecord = this._rootRecord;
+            break;
+        default:
             var newParentRecord = this._findParentRecord(record);
             if (newParentRecord) {
                 parentRecord = newParentRecord;
@@ -247,7 +280,7 @@ WebInspector.TimelinePresentationModel.prototype = {
 
         var childrenCount = children ? children.length : 0;
         for (var i = 0; i < childrenCount; ++i)
-            this.addRecord(children[i], formattedRecord);
+            this._innerAddRecord(children[i], formattedRecord);
 
         formattedRecord.calculateAggregatedStats(WebInspector.TimelinePresentationModel.categories());
 
@@ -274,18 +307,25 @@ WebInspector.TimelinePresentationModel.prototype = {
         if (!this._glueRecords)
             return null;
         var recordTypes = WebInspector.TimelineModel.RecordType;
-        var parentRecord;
-        if (record.type === recordTypes.ResourceReceiveResponse ||
-            record.type === recordTypes.ResourceFinish ||
-            record.type === recordTypes.ResourceReceivedData)
-            parentRecord = this._sendRequestRecords[record.data["requestId"]];
-        else if (record.type === recordTypes.TimerFire)
-            parentRecord = this._timerRecords[record.data["timerId"]];
-        else if (record.type === recordTypes.ResourceSendRequest)
-            parentRecord = this._scheduledResourceRequests[record.data["url"]];
-        else if (record.type === recordTypes.FireAnimationFrame)
-            parentRecord = this._requestAnimationFrameRecords[record.data["id"]];
-        return parentRecord;
+
+        switch (record.type) {
+        case recordTypes.ResourceReceiveResponse:
+        case recordTypes.ResourceFinish:
+        case recordTypes.ResourceReceivedData:
+            return this._sendRequestRecords[record.data["requestId"]];
+
+        case recordTypes.TimerFire:
+            return this._timerRecords[record.data["timerId"]];
+
+        case recordTypes.ResourceSendRequest:
+            return this._scheduledResourceRequests[record.data["url"]];
+
+        case recordTypes.FireAnimationFrame:
+            return this._requestAnimationFrameRecords[record.data["id"]];
+
+        case recordTypes.TimeEnd:
+            return this._timeRecords[record.data["message"]];
+        }
     },
 
     setGlueRecords: function(glue)
@@ -376,12 +416,18 @@ WebInspector.TimelinePresentationModel.Record = function(presentationModel, reco
         this.scriptName = scriptDetails.scriptName;
         this.scriptLine = scriptDetails.scriptLine;
     }
-    // Make resource receive record last since request was sent; make finish record last since response received.
-    if (record.type === recordTypes.ResourceSendRequest) {
+
+    switch (record.type) {
+    case recordTypes.ResourceSendRequest:
+        // Make resource receive record last since request was sent; make finish record last since response received.
         presentationModel._sendRequestRecords[record.data["requestId"]] = this;
-    } else if (record.type === recordTypes.ScheduleResourceRequest) {
+        break;
+
+    case recordTypes.ScheduleResourceRequest:
         presentationModel._scheduledResourceRequests[record.data["url"]] = this;
-    } else if (record.type === recordTypes.ResourceReceiveResponse) {
+        break;
+
+    case recordTypes.ResourceReceiveResponse:
         var sendRequestRecord = presentationModel._sendRequestRecords[record.data["requestId"]];
         if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
             this.url = sendRequestRecord.url;
@@ -390,27 +436,52 @@ WebInspector.TimelinePresentationModel.Record = function(presentationModel, reco
             if (sendRequestRecord.parent !== presentationModel._rootRecord && sendRequestRecord.parent.type === recordTypes.ScheduleResourceRequest)
                 sendRequestRecord.parent._refreshDetails();
         }
-    } else if (record.type === recordTypes.ResourceReceivedData || record.type === recordTypes.ResourceFinish) {
+        break;
+
+    case recordTypes.ResourceReceivedData:
+    case recordTypes.ResourceFinish:
         var sendRequestRecord = presentationModel._sendRequestRecords[record.data["requestId"]];
         if (sendRequestRecord) // False for main resource.
             this.url = sendRequestRecord.url;
-    } else if (record.type === recordTypes.TimerInstall) {
+        break;
+
+    case recordTypes.TimerInstall:
         this.timeout = record.data["timeout"];
         this.singleShot = record.data["singleShot"];
         presentationModel._timerRecords[record.data["timerId"]] = this;
-    } else if (record.type === recordTypes.TimerFire) {
+        break;
+
+    case recordTypes.TimerFire:
         var timerInstalledRecord = presentationModel._timerRecords[record.data["timerId"]];
         if (timerInstalledRecord) {
             this.callSiteStackTrace = timerInstalledRecord.stackTrace;
             this.timeout = timerInstalledRecord.timeout;
             this.singleShot = timerInstalledRecord.singleShot;
         }
-    } else if (record.type === recordTypes.RequestAnimationFrame) {
+        break;
+
+    case recordTypes.RequestAnimationFrame:
         presentationModel._requestAnimationFrameRecords[record.data["id"]] = this;
-    } else if (record.type === recordTypes.FireAnimationFrame) {
+        break;
+
+    case recordTypes.FireAnimationFrame:
         var requestAnimationRecord = presentationModel._requestAnimationFrameRecords[record.data["id"]];
         if (requestAnimationRecord)
             this.callSiteStackTrace = requestAnimationRecord.stackTrace;
+        break;
+
+    case recordTypes.Time:
+        presentationModel._timeRecords[record.data["message"]] = this;
+        break;
+
+    case recordTypes.TimeEnd:
+        var timeRecord = presentationModel._timeRecords[record.data["message"]];
+        if (timeRecord) {
+            var intervalDuration = this.startTime - timeRecord.startTime;
+            this.intervalDuration = intervalDuration;
+            timeRecord.intervalDuration = intervalDuration;
+        }
+        break;
     }
     this._refreshDetails();
 }
@@ -515,6 +586,8 @@ WebInspector.TimelinePresentationModel.Record.prototype = {
                     contentHelper._appendTextRow(WebInspector.UIString("Status Code"), this.data["statusCode"]);
                 if (this.data["mimeType"])
                     contentHelper._appendTextRow(WebInspector.UIString("MIME Type"), this.data["mimeType"]);
+                if (this.data["encodedDataLength"])
+                    contentHelper._appendTextRow(WebInspector.UIString("Encoded Data Length"), WebInspector.UIString("%d Bytes", this.data["encodedDataLength"]));
                 break;
             case recordTypes.EvaluateScript:
                 if (this.data && this.url)
@@ -523,8 +596,14 @@ WebInspector.TimelinePresentationModel.Record.prototype = {
             case recordTypes.Paint:
                 contentHelper._appendTextRow(WebInspector.UIString("Location"), WebInspector.UIString("(%d, %d)", this.data["x"], this.data["y"]));
                 contentHelper._appendTextRow(WebInspector.UIString("Dimensions"), WebInspector.UIString("%d × %d", this.data["width"], this.data["height"]));
+                break;
             case recordTypes.RecalculateStyles: // We don't want to see default details.
                 break;
+            case recordTypes.Time:
+            case recordTypes.TimeEnd:
+                if (typeof this.intervalDuration === "number")
+                    contentHelper._appendTextRow(WebInspector.UIString("Interval Duration"), Number.secondsToString(this.intervalDuration, true));
+                break;
             default:
                 if (this.details)
                     contentHelper._appendTextRow(WebInspector.UIString("Details"), this.details);
diff --git a/Source/WebCore/inspector/front-end/UISourceCode.js b/Source/WebCore/inspector/front-end/UISourceCode.js
index 4c2b3da27..49e5e310b 100644
--- a/Source/WebCore/inspector/front-end/UISourceCode.js
+++ b/Source/WebCore/inspector/front-end/UISourceCode.js
@@ -127,7 +127,7 @@ WebInspector.UISourceCode.prototype = {
      */
     requestContent: function(callback)
     {
-        if (this._contentLoaded) {
+        if (this._content || this._contentLoaded) {
             callback(this._content, false, this._mimeType);
             return;
         }
@@ -138,7 +138,7 @@ WebInspector.UISourceCode.prototype = {
 
     _revisionAdded: function(event)
     {
-        var revision = /** @type {WebInspector.ResourceRevision} */ event.data;
+        var revision = /** @type {WebInspector.Revision} */ event.data;
         this.contentChanged(revision.content || "", this._resource.canonicalMimeType());
     },
 
@@ -171,7 +171,6 @@ WebInspector.UISourceCode.prototype = {
      */
     workingCopy: function()
     {
-        console.assert(this._contentLoaded);
         if (this.isDirty())
             return this._workingCopy;
         return this._content;
@@ -182,7 +181,6 @@ WebInspector.UISourceCode.prototype = {
      */
     setWorkingCopy: function(newWorkingCopy)
     {
-        console.assert(this._contentLoaded);
         var oldWorkingCopy = this._workingCopy;
         if (this._content === newWorkingCopy)
             delete this._workingCopy;
@@ -202,19 +200,19 @@ WebInspector.UISourceCode.prototype = {
      */
     commitWorkingCopy: function(callback)
     {
-        /**
-         * @param {?string} error
-         */
-        function innerCallback(error)
-        {
-            delete this._committingWorkingCopy;
-            this.contentChanged(newContent, this._mimeType);
-            callback(error);
+        if (!this.isDirty()) {
+            callback(null);
+            return;
         }
 
         var newContent = this._workingCopy;
         this._committingWorkingCopy = true;
-        this.workingCopyCommitted(innerCallback.bind(this));
+        this.workingCopyCommitted(callback);
+        if (this.resource())
+            this.resource().addRevision(newContent);
+        delete this._committingWorkingCopy;
+        this.contentChanged(newContent, this._mimeType);
+
     },
 
     /**
@@ -230,7 +228,7 @@ WebInspector.UISourceCode.prototype = {
      */
     isDirty: function()
     {
-        return this._contentLoaded && typeof this._workingCopy !== "undefined" && this._workingCopy !== this._content;
+        return typeof this._workingCopy !== "undefined" && this._workingCopy !== this._content;
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/UIUtils.js b/Source/WebCore/inspector/front-end/UIUtils.js
index 5c15ac451..5ebfc9e5e 100644
--- a/Source/WebCore/inspector/front-end/UIUtils.js
+++ b/Source/WebCore/inspector/front-end/UIUtils.js
@@ -37,13 +37,9 @@ WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, e
     if (element) {
         // Install glass pane
         if (WebInspector._elementDraggingGlassPane)
-            WebInspector._elementDraggingGlassPane.parentElement.removeChild(WebInspector._elementDraggingGlassPane);
+            WebInspector._elementDraggingGlassPane.dispose();
 
-        var glassPane = document.createElement("div");
-        glassPane.style.cssText = "position:absolute;top:0;bottom:0;left:0;right:0;opacity:0;z-index:1";
-        glassPane.id = "glass-pane-for-drag";
-        element.ownerDocument.body.appendChild(glassPane);
-        WebInspector._elementDraggingGlassPane = glassPane;
+        WebInspector._elementDraggingGlassPane = new WebInspector.GlassPane();
     }
 
     WebInspector._elementDraggingEventListener = dividerDrag;
@@ -67,7 +63,7 @@ WebInspector.elementDragEnd = function(event)
     targetDocument.body.style.removeProperty("cursor");
 
     if (WebInspector._elementDraggingGlassPane)
-        WebInspector._elementDraggingGlassPane.parentElement.removeChild(WebInspector._elementDraggingGlassPane);
+        WebInspector._elementDraggingGlassPane.dispose();
 
     delete WebInspector._elementDraggingGlassPane;
     delete WebInspector._elementDraggingEventListener;
@@ -76,6 +72,25 @@ WebInspector.elementDragEnd = function(event)
     event.preventDefault();
 }
 
+/**
+ * @constructor
+ */
+WebInspector.GlassPane = function()
+{
+    this.element = document.createElement("div");
+    this.element.style.cssText = "position:absolute;top:0;bottom:0;left:0;right:0;background-color:transparent;z-index:1";
+    this.element.id = "glass-pane-for-drag";
+    document.body.appendChild(this.element);
+}
+
+WebInspector.GlassPane.prototype = {
+    dispose: function()
+    {
+        if (this.element.parentElement)
+            this.element.parentElement.removeChild(this.element);
+    }
+}
+
 WebInspector.animateStyle = function(animations, duration, callback)
 {
     var interval;
@@ -261,6 +276,160 @@ WebInspector.EditingConfig.prototype = {
     }
 }
 
+WebInspector.CSSNumberRegex = /^(-?(?:\d+(?:\.\d+)?|\.\d+))$/;
+
+WebInspector.StyleValueDelimiters = " \xA0\t\n\"':;,/()";
+
+/**
+ * @param {string} hexString
+ * @param {Event} event
+ */
+WebInspector._modifiedHexValue = function(hexString, event)
+{
+    var number = parseInt(hexString, 16);
+    if (isNaN(number) || !isFinite(number))
+        return hexString;
+
+    var maxValue = Math.pow(16, hexString.length) - 1;
+    var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
+
+    var delta;
+    if (arrowKeyPressed)
+        delta = (event.keyIdentifier === "Up") ? 1 : -1;
+    else
+        delta = (event.keyIdentifier === "PageUp") ? 16 : -16;
+
+    if (event.shiftKey)
+        delta *= 16;
+
+    var result = number + delta;
+    if (result < 0)
+        result = 0; // Color hex values are never negative, so clamp to 0.
+    else if (result > maxValue)
+        return hexString;
+
+    // Ensure the result length is the same as the original hex value.
+    var resultString = result.toString(16).toUpperCase();
+    for (var i = 0, lengthDelta = hexString.length - resultString.length; i < lengthDelta; ++i)
+        resultString = "0" + resultString;
+    return resultString;
+}
+
+/**
+ * @param {number} number
+ * @param {Event} event
+ */
+WebInspector._modifiedFloatNumber = function(number, event)
+{
+    var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
+
+    // Jump by 10 when shift is down or jump by 0.1 when Alt/Option is down.
+    // Also jump by 10 for page up and down, or by 100 if shift is held with a page key.
+    var changeAmount = 1;
+    if (event.shiftKey && !arrowKeyPressed)
+        changeAmount = 100;
+    else if (event.shiftKey || !arrowKeyPressed)
+        changeAmount = 10;
+    else if (event.altKey)
+        changeAmount = 0.1;
+
+    if (event.keyIdentifier === "Down" || event.keyIdentifier === "PageDown")
+        changeAmount *= -1;
+
+    // Make the new number and constrain it to a precision of 6, this matches numbers the engine returns.
+    // Use the Number constructor to forget the fixed precision, so 1.100000 will print as 1.1.
+    var result = Number((number + changeAmount).toFixed(6));
+    if (!String(result).match(WebInspector.CSSNumberRegex))
+        return null;
+
+    return result;
+}
+
+/**
+  * @param {Event} event
+  * @param {Element} element
+  * @param {function(string,string)=} finishHandler
+  * @param {function(string)=} suggestionHandler
+  * @param {function(number):number=} customNumberHandler
+ */
+WebInspector.handleElementValueModifications = function(event, element, finishHandler, suggestionHandler, customNumberHandler)
+{
+    var arrowKeyPressed = (event.keyIdentifier === "Up" || event.keyIdentifier === "Down");
+    var pageKeyPressed = (event.keyIdentifier === "PageUp" || event.keyIdentifier === "PageDown");
+    if (!arrowKeyPressed && !pageKeyPressed)
+        return false;
+
+    var selection = window.getSelection();
+    if (!selection.rangeCount)
+        return false;
+
+    var selectionRange = selection.getRangeAt(0);
+    if (!selectionRange.commonAncestorContainer.isSelfOrDescendant(element))
+        return false;
+
+    var originalValue = element.textContent;
+    var wordRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, WebInspector.StyleValueDelimiters, element);
+    var wordString = wordRange.toString();
+    
+    if (suggestionHandler && suggestionHandler(wordString))
+        return false;
+
+    var replacementString;
+    var prefix, suffix, number;
+
+    var matches;
+    matches = /(.*#)([\da-fA-F]+)(.*)/.exec(wordString);
+    if (matches && matches.length) {
+        prefix = matches[1];
+        suffix = matches[3];
+        number = WebInspector._modifiedHexValue(matches[2], event);
+        
+        if (customNumberHandler)
+            number = customNumberHandler(number);
+
+        replacementString = prefix + number + suffix;
+    } else {
+        matches = /(.*?)(-?(?:\d+(?:\.\d+)?|\.\d+))(.*)/.exec(wordString);
+        if (matches && matches.length) {
+            prefix = matches[1];
+            suffix = matches[3];
+            number = WebInspector._modifiedFloatNumber(parseFloat(matches[2]), event);
+            
+            // Need to check for null explicitly.
+            if (number === null)                
+                return false;
+            
+            if (customNumberHandler)
+                number = customNumberHandler(number);
+
+            replacementString = prefix + number + suffix;
+        }
+    }
+
+    if (replacementString) {
+        var replacementTextNode = document.createTextNode(replacementString);
+
+        wordRange.deleteContents();
+        wordRange.insertNode(replacementTextNode);
+
+        var finalSelectionRange = document.createRange();
+        finalSelectionRange.setStart(replacementTextNode, 0);
+        finalSelectionRange.setEnd(replacementTextNode, replacementString.length);
+
+        selection.removeAllRanges();
+        selection.addRange(finalSelectionRange);
+
+        event.handled = true;
+        event.preventDefault();
+                
+        if (finishHandler)
+            finishHandler(originalValue, replacementString);
+
+        return true;
+    }
+    return false;
+}
+
 /** 
  * @param {Element} element
  * @param {WebInspector.EditingConfig=} config
diff --git a/Source/WebCore/inspector/front-end/UserAgentSupport.js b/Source/WebCore/inspector/front-end/UserAgentSupport.js
index 504752e29..e6082ef51 100644
--- a/Source/WebCore/inspector/front-end/UserAgentSupport.js
+++ b/Source/WebCore/inspector/front-end/UserAgentSupport.js
@@ -37,6 +37,8 @@ WebInspector.UserAgentSupport = function()
         this._deviceMetricsChanged();
     WebInspector.settings.deviceMetrics.addChangeListener(this._deviceMetricsChanged, this);
     WebInspector.settings.deviceFitWindow.addChangeListener(this._deviceMetricsChanged, this);
+    WebInspector.settings.geolocationOverride.addChangeListener(this._geolocationPositionChanged, this);
+    WebInspector.settings.geolocationError.addChangeListener(this._onGeolocationErrorChanged, this);
 }
 
 /**
@@ -163,11 +165,83 @@ WebInspector.UserAgentSupport.DeviceMetrics.prototype = {
     }
 }
 
+WebInspector.UserAgentSupport.GeolocationPosition = function (latitude, longitude)
+{
+    this._latitude = latitude;
+    this._longitude = longitude;
+}
+
+WebInspector.UserAgentSupport.GeolocationPosition.prototype = {
+    /**
+     * @return {string}
+     */
+    toSetting: function()
+    {
+        return (this._latitude || this._latitude == 0) && (this._longitude || this._longitude == 0) ? this._latitude + "@" + this._longitude : "";
+    }
+}
+
+/**
+ * @return {WebInspector.UserAgentSupport.GeolocationPosition}
+ */
+WebInspector.UserAgentSupport.GeolocationPosition.parseSetting = function(value)
+{
+    if (value) {
+        var splitPosition = value.split("@");
+        if (splitPosition.length === 2)
+            return new WebInspector.UserAgentSupport.GeolocationPosition(parseFloat(splitPosition[0]), parseFloat(splitPosition[1]));
+    }
+    return new WebInspector.UserAgentSupport.GeolocationPosition(0, 0);
+}
+
+/**
+ * @return {?WebInspector.UserAgentSupport.GeolocationPosition}
+ */
+WebInspector.UserAgentSupport.GeolocationPosition.parseUserInput = function(latitudeString, longitudeString)
+{
+    function isUserInputValid(value)
+    {
+        if (!value)
+            return true;
+        return /^[-]?[0-9]*[.]?[0-9]*$/.test(value);
+    }
+
+    if (!latitudeString ^ !latitudeString)
+        return null;
+
+    var isLatitudeValid = isUserInputValid(latitudeString);
+    var isLongitudeValid = isUserInputValid(longitudeString);
+
+    if (!isLatitudeValid && !isLongitudeValid)
+        return null;
+
+    var latitude = isLatitudeValid ? parseFloat(latitudeString) : -1;
+    var longitude = isLongitudeValid ? parseFloat(longitudeString) : -1;
+
+    return new WebInspector.UserAgentSupport.GeolocationPosition(latitude, longitude);
+}
+
 WebInspector.UserAgentSupport.prototype = {
     _deviceMetricsChanged: function()
     {
         var metrics = WebInspector.UserAgentSupport.DeviceMetrics.parseSetting(WebInspector.settings.deviceMetrics.get());
         if (metrics.isValid())
             PageAgent.setDeviceMetricsOverride(metrics.width, metrics.height, metrics.fontScaleFactor, WebInspector.settings.deviceFitWindow.get());
+    },
+
+    _geolocationPositionChanged: function(errorType)
+    {
+        var geolocation = WebInspector.UserAgentSupport.GeolocationPosition.parseSetting(WebInspector.settings.geolocationOverride.get());
+        PageAgent.setGeolocationData(geolocation._latitude, geolocation._longitude, 150, typeof errorType === 'string'? errorType : WebInspector.settings.geolocationError.get());
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _onGeolocationErrorChanged: function(event)
+    {
+        this._geolocationPositionChanged(event.data);
+        console.log(event);
     }
-}
\ No newline at end of file
+}
+
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index ca39e0f9d..245fb2ec3 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -247,20 +247,30 @@ WebInspector.WatchExpressionsSection.prototype = {
 
     updateExpression: function(element, value)
     {
-        if (value === null)
-            delete this.watchExpressions[element.property.watchIndex];
+        if (value === null) {
+            var index = element.property.watchIndex;
+            this.watchExpressions.splice(index, 1);
+        }
         else
             this.watchExpressions[element.property.watchIndex] = value;
         this.saveExpressions();
         this.update();
     },
+    
+    _deleteAllExpressions: function()
+    {
+        this.watchExpressions = [];
+        this.saveExpressions();
+        this.update();
+    },
 
     findAddedTreeElement: function()
     {
         var children = this.propertiesTreeOutline.children;
-        for (var i = 0; i < children.length; ++i)
+        for (var i = 0; i < children.length; ++i) {
             if (children[i].property.name === WebInspector.WatchExpressionsSection.NewWatchExpression)
                 return children[i];
+        }
     },
 
     saveExpressions: function()
@@ -348,8 +358,23 @@ WebInspector.WatchExpressionTreeElement.prototype = {
         deleteButton.addStyleClass("enabled-button");
         deleteButton.addStyleClass("delete-button");
         deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+        this.listItemElement.addEventListener("contextmenu", this._contextMenu.bind(this), false);
         this.listItemElement.insertBefore(deleteButton, this.listItemElement.firstChild);
     },
+    
+    _contextMenu: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Delete watch expression"), this._deleteButtonClicked.bind(this));
+        if (this.treeOutline.section.watchExpressions.length > 1)
+            contextMenu.appendItem(WebInspector.UIString("Delete all watch expressions"), this._deleteAllButtonClicked.bind(this));
+        contextMenu.show(event);
+    },
+    
+    _deleteAllButtonClicked: function()
+    {
+        this.treeOutline.section._deleteAllExpressions();
+    },
 
     _deleteButtonClicked: function()
     {
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 8f8221a63..6ec8fe6c9 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -37,9 +37,9 @@
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
     <file>DebuggerModel.js</file>
-    <file>DebuggerResourceBinding.js</file>
     <file>DebuggerScriptMapping.js</file>
     <file>Dialog.js</file>
+    <file>DirectoryContentView.js</file>
     <file>DOMAgent.js</file>
     <file>DOMBreakpointsSidebarPane.js</file>
     <file>DOMExtension.js</file>
@@ -57,8 +57,10 @@
     <file>ExtensionPanel.js</file>
     <file>ExtensionRegistryStub.js</file>
     <file>ExtensionServer.js</file>
+    <file>FileContentView.js</file>
     <file>FileManager.js</file>
     <file>FileSystemModel.js</file>
+    <file>FileSystemView.js</file>
     <file>FilteredItemSelectionDialog.js</file>
     <file>FontView.js</file>
     <file>GoToLineDialog.js</file>
@@ -164,10 +166,10 @@
     <file>TabbedEditorContainer.js</file>
     <file>TabbedPane.js</file>
     <file>TestController.js</file>
+    <file>TextEditor.js</file>
     <file>TextEditorHighlighter.js</file>
     <file>TextEditorModel.js</file>
     <file>TextPrompt.js</file>
-    <file>TextViewer.js</file>
     <file>TimelineFrameController.js</file>
     <file>TimelineManager.js</file>
     <file>TimelineModel.js</file>
@@ -187,6 +189,7 @@
     <file>WatchExpressionsSidebarPane.js</file>
     <file>WorkerManager.js</file>
     <file>WorkersSidebarPane.js</file>
+    <file>Workspace.js</file>
     <file>UglifyJS/parse-js.js</file>
     <file>auditsPanel.css</file>
     <file>dataGrid.css</file>
@@ -212,8 +215,8 @@
     <file>scriptsPanel.css</file>
     <file>splitView.css</file>
     <file>tabbedPane.css</file>
+    <file>textEditor.css</file>
     <file>textPrompt.css</file>
-    <file>textViewer.css</file>
     <file>timelinePanel.css</file>
     <file>Images/applicationCache.png</file>
     <file>Images/back.png</file>
diff --git a/Source/WebCore/inspector/front-end/Workspace.js b/Source/WebCore/inspector/front-end/Workspace.js
new file mode 100644
index 000000000..3dbded6c8
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Workspace.js
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ * @implements {WebInspector.UISourceCodeProvider}
+ * @param {Array.<WebInspector.UISourceCodeProvider>} uiSourceCodeProviders
+ */
+WebInspector.CompositeUISourceCodeProvider = function(uiSourceCodeProviders)
+{
+    WebInspector.Object.call(this);
+    this._uiSourceCodeProviders = [];
+    for (var i = 0; i < uiSourceCodeProviders.length; ++i)
+        this._registerUISourceCodeProvider(uiSourceCodeProviders[i]);
+}
+
+WebInspector.CompositeUISourceCodeProvider.prototype = {
+    /**
+     * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
+     */
+    _registerUISourceCodeProvider: function(uiSourceCodeProvider)
+    {
+        this._uiSourceCodeProviders.push(uiSourceCodeProvider);
+        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, this._handleUISourceCodeAdded, this);
+        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, this._handleUISourceCodeReplaced, this);
+        uiSourceCodeProvider.addEventListener(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, this._handleUISourceCodeRemoved, this);
+    },
+
+    _handleUISourceCodeAdded: function(event)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeAdded, event.data);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _handleUISourceCodeReplaced: function(event)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeReplaced, event.data);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _handleUISourceCodeRemoved: function(event)
+    {
+        this.dispatchEventToListeners(WebInspector.UISourceCodeProvider.Events.UISourceCodeRemoved, event.data);
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCodeProvider>}
+     */
+    uiSourceCodeProviders: function()
+    {
+        return this._uiSourceCodeProviders.slice(0);
+    },
+
+    /**
+     * @param {string} url
+     * @return {?WebInspector.UISourceCode}
+     */
+    uiSourceCodeForURL: function(url)
+    {
+        for (var i = 0; i < this._uiSourceCodeProviders.length; ++i) {
+            var uiSourceCodes = this._uiSourceCodeProviders[i].uiSourceCodes();
+            for (var j = 0; j < uiSourceCodes.length; ++j) {
+                if (uiSourceCodes[j].url === url)
+                    return uiSourceCodes[j];
+            }
+        }
+        return null;
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodes: function()
+    {
+        var result = [];
+        for (var i = 0; i < this._uiSourceCodeProviders.length; ++i) {
+            var uiSourceCodes = this._uiSourceCodeProviders[i].uiSourceCodes();
+            for (var j = 0; j < uiSourceCodes.length; ++j)
+                result.push(uiSourceCodes[j]);
+        }
+        return result;
+    }
+}
+
+WebInspector.CompositeUISourceCodeProvider.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.CompositeUISourceCodeProvider}
+ */
+WebInspector.Workspace = function()
+{
+    var scriptMapping = new WebInspector.DebuggerScriptMapping();
+    var providers = scriptMapping.uiSourceCodeProviders();
+    providers = providers.concat(new WebInspector.StylesUISourceCodeProvider());
+    WebInspector.CompositeUISourceCodeProvider.call(this, providers);
+    
+    new WebInspector.PresentationConsoleMessageHelper(this);
+    
+    WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.MainFrameNavigated, this._reset, this);
+}
+
+WebInspector.Workspace.Events = {
+    WorkspaceReset: "WorkspaceReset"
+}
+
+WebInspector.Workspace.prototype = {
+    /**
+     * @param {WebInspector.UISourceCodeProvider} uiSourceCodeProvider
+     */
+    registerUISourceCodeProvider: function(uiSourceCodeProvider)
+    {
+        this._registerUISourceCodeProvider(uiSourceCodeProvider);
+    },
+
+    _reset: function()
+    {
+        var uiSourceCodeProviders = this.uiSourceCodeProviders();
+        for (var i = 0; i < uiSourceCodeProviders.length; ++i) {
+            uiSourceCodeProviders[i].reset();
+        }
+        this.dispatchEventToListeners(WebInspector.Workspace.Events.WorkspaceReset, null);
+    }
+}
+
+WebInspector.Workspace.prototype.__proto__ = WebInspector.CompositeUISourceCodeProvider.prototype;
+
+/**
+ * @type {?WebInspector.Workspace}
+ */
+WebInspector.workspace = null;
diff --git a/Source/WebCore/inspector/front-end/elementsPanel.css b/Source/WebCore/inspector/front-end/elementsPanel.css
index 6b7455b73..8c9bc3c58 100644
--- a/Source/WebCore/inspector/front-end/elementsPanel.css
+++ b/Source/WebCore/inspector/front-end/elementsPanel.css
@@ -39,6 +39,21 @@
     margin-left: 8px;
 }
 
+#elements-content .elements-gutter-decoration {
+    position: absolute;
+    left: 1px;
+    margin-top: 2px;
+    height: 8px;
+    width: 8px;
+    border-radius: 4px;
+    border: 1px solid orange;
+    background-color: orange;
+}
+
+#elements-content .elements-gutter-decoration.elements-has-decorated-children {
+    opacity: 0.5;
+}
+
 .elements-tree-editor {
     -webkit-user-select: text;
     -webkit-user-modify: read-write-plaintext-only;
diff --git a/Source/WebCore/inspector/front-end/externs.js b/Source/WebCore/inspector/front-end/externs.js
index cfc6ee67f..cbc827153 100644
--- a/Source/WebCore/inspector/front-end/externs.js
+++ b/Source/WebCore/inspector/front-end/externs.js
@@ -147,6 +147,8 @@ WebInspector.addMainEventListeners = function(doc) {}
 
 WebInspector.openResource = function(url, external) {}
 
+WebInspector.showConsole = function() {}
+
 /**
  * @param {string} expression
  * @param {boolean=} showResultOnly
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index ef6f3f31b..d8341b7e1 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -263,63 +263,49 @@ body.detached.platform-mac-snowleopard #toolbar-dropdown {
     border-radius: 5px;
 }
 
-#toolbar-search-item {
-    display: -webkit-box;
-    -webkit-box-orient: horizontal;
-    -webkit-box-align: center;
-    -webkit-box-pack: end;
-}
-
 #search {
     width: 205px;
-    font-size: 16px;
-}
-
-.with-navigation-buttons #search {
-    width: 165px;
+    margin-left: 4px;
+    margin-right: 4px;
+    font-size: 11px;
 }
 
-.toolbar-search-navigation-label {
-    display: none;
+.toolbar-search-navigation {
+    width: 16px;
+    height: 16px;
+    position: relative;
+    top: 4px;
+    margin: 0px 1px;
+    background-repeat: no-repeat;
+    display: inline-block;
+    background-position: 2px 5px;
     border: 1px solid transparent;
-    border-radius: 2px;
-    padding: 3px;
-    margin-left: 2px;
-    width: 18px;
-    height: 18px;
-    float: right;
-}
-
-.with-navigation-buttons .toolbar-search-navigation-label {
-    display: block;
 }
 
-.toolbar-search-navigation-label:hover {
+.toolbar-search-navigation:hover {
     border: 1px solid rgba(120, 120, 120, 0.6);    
 }
 
-.toolbar-search-navigation-icon-prev , .toolbar-search-navigation-icon-next {
-    width: 9px;
-    margin-top: 2px;
-    height: 100%;
-    background-repeat: no-repeat;
-}
-
-.toolbar-search-navigation-icon-prev {
+.toolbar-search-navigation.toolbar-search-navigation-prev {
     background-image: url(Images/searchPrev.png);
 }
 
-.toolbar-search-navigation-icon-next {
+.toolbar-search-navigation.toolbar-search-navigation-next {
     background-image: url(Images/searchNext.png);
 }
 
+.toolbar-search-navigation-hidden {
+    background: none;
+}
+
 body.compact #search {
     font-size: 11px;
 }
 
-#search-results-matches {
+.search-results-matches {
     font-size: 11px;
     text-shadow: rgba(255, 255, 255, 0.5) 0 1px 0;
+    padding-left: 4px;
 }
 
 .toolbar-item.elements .toolbar-icon {
@@ -518,6 +504,19 @@ body.drawer-visible #main-panels {
     z-index: 0;
 }
 
+.long-click-glyph {
+    background-color: rgba(0, 0, 0, 0.75);
+    -webkit-mask-image: url(Images/statusbarButtonGlyphs.png);
+    -webkit-mask-position: -288px -48px;
+    z-index: 1;
+}
+
+.long-click-glyph.shadow {
+    top: 1px;
+    background-color: white !important;
+    z-index: 0;
+}
+
 button.status-bar-item {
     position: relative;
     width: 32px;
@@ -525,7 +524,7 @@ button.status-bar-item {
     background-position: 0 0;
 }
 
-button.status-bar-item:active {
+button.status-bar-item:active, button.status-bar-item.emulate-active {
     background-position: 32px 0 !important;
 }
 
@@ -587,6 +586,18 @@ button.settings-status-bar-item {
     right: 0;
 }
 
+.alternate-status-bar-buttons-bar {
+    position: absolute;
+    width: 31px;
+    bottom: -3px;
+    margin-left: 1px;
+    background: white;
+}
+
+.alternate-status-bar-buttons-bar .status-bar-item {
+    margin-top: -1px;
+}
+
 .settings-status-bar-item .glyph {
     -webkit-mask-position: -160px -24px;
 }
@@ -2402,7 +2413,7 @@ body.platform-mac .soft-context-menu-item-mouse-over {
 }
 
 .search-drawer-header input[type="search"].search-config-search {
-	font-size: 11px;
+    font-size: 11px;
     margin-left: 4px;
     color: #303030;
     position: relative;
@@ -2753,3 +2764,17 @@ body.platform-mac #drawer-status-bar .search-status-bar-progress {
 #console-context {
     max-width: 200px;
 }
+
+.inspector-footer {
+    position: absolute;
+    bottom: 0;
+    left: 0;
+    right: 0;
+    font-size: 11px;
+    padding-left: 7px;
+    padding-bottom: 7px;
+}
+
+.inspector-footer > div {
+    vertical-align: middle;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index dbd7c5a5d..0f165d3e3 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -120,7 +120,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="NetworkPanel.js"></script>
     <script type="text/javascript" src="InjectedFakeWorker.js"></script>
-    <script type="text/javascript" src="TextViewer.js"></script>
+    <script type="text/javascript" src="TextEditor.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="RequestView.js"></script>
@@ -161,7 +161,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="SourceCSSTokenizer.js"></script>
     <script type="text/javascript" src="SourceHTMLTokenizer.js"></script>
     <script type="text/javascript" src="SourceJavaScriptTokenizer.js"></script>
+    <script type="text/javascript" src="DirectoryContentView.js"></script>
+    <script type="text/javascript" src="FileContentView.js"></script>
     <script type="text/javascript" src="FileSystemModel.js"></script>
+    <script type="text/javascript" src="FileSystemView.js"></script>
     <script type="text/javascript" src="FontView.js"></script>
     <script type="text/javascript" src="ImageView.js"></script>
     <script type="text/javascript" src="DatabaseTableView.js"></script>
@@ -186,8 +189,8 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="JavaScriptSource.js"></script>
     <script type="text/javascript" src="Linkifier.js"></script>
     <script type="text/javascript" src="DebuggerScriptMapping.js"></script>
-    <script type="text/javascript" src="DebuggerResourceBinding.js"></script>
     <script type="text/javascript" src="PresentationConsoleMessageHelper.js"></script>
+    <script type="text/javascript" src="Workspace.js"></script>
     <script type="text/javascript" src="BreakpointManager.js"></script>
     <script type="text/javascript" src="ContentProviders.js"></script>
     <script type="text/javascript" src="RawSourceCode.js"></script>
@@ -224,11 +227,6 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
         <div class="toolbar-item close-left"><button id="close-button-left"></button></div>
         <div id="toolbar-controls">
             <div class="toolbar-item"><button id="toolbar-dropdown-arrow" class="toolbar-label">&raquo;</button></div>
-            <div class="toolbar-item hidden" id="search-results-matches"></div>
-            <div class="toolbar-item" id="toolbar-search-item">
-                <input id="search" type="search" incremental results="0">
-                <div id="toolbar-search-navigation-control"></div>
-            </div>
             <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
         </div>
     </div>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index ba164cfa3..59be1f3dd 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -71,6 +71,7 @@ var WebInspector = {
     _createGlobalStatusBarItems: function()
     {
         this._dockToggleButton = new WebInspector.StatusBarButton("", "dock-status-bar-item", 3);
+        this._dockToggleButton.makeLongClickEnabled(this._createDockOptions.bind(this));
         this._dockToggleButton.addEventListener("click", this._toggleAttach.bind(this), false);
         this._updateDockButtonState();
 
@@ -86,6 +87,41 @@ var WebInspector = {
         anchoredStatusBar.appendChild(this.settingsController.statusBarItem);
     },
 
+    _createDockOptions: function()
+    {
+        var alternateDockToggleButton1 = new WebInspector.StatusBarButton("Dock to main window.", "dock-status-bar-item", 3);
+        var alternateDockToggleButton2 = new WebInspector.StatusBarButton("Undock into separate window.", "dock-status-bar-item", 3);
+
+        if (this.attached) {
+            alternateDockToggleButton1.state = WebInspector.settings.dockToRight.get() ? "bottom" : "right";
+            alternateDockToggleButton2.state = "undock";
+        } else {
+            alternateDockToggleButton1.state = WebInspector.settings.dockToRight.get() ? "bottom" : "right";
+            alternateDockToggleButton2.state = WebInspector.settings.dockToRight.get() ? "right" : "bottom";
+        }
+
+        alternateDockToggleButton1.addEventListener("click", onClick.bind(this), false);
+        alternateDockToggleButton2.addEventListener("click", onClick.bind(this), false);
+
+        function onClick(e)
+        {
+            var state = e.target.state;
+            if (state === "undock")
+                this._toggleAttach();
+            else if (state === "right") {
+                if (!this.attached)
+                    this._toggleAttach();
+                WebInspector.settings.dockToRight.set(true);
+            } else if (state === "bottom") {
+                if (!this.attached)
+                    this._toggleAttach();
+                WebInspector.settings.dockToRight.set(false);
+            }
+        }
+
+        return [alternateDockToggleButton1, alternateDockToggleButton2];
+    },
+
     _updateDockButtonState: function()
     {
         if (!this._dockToggleButton)
@@ -225,9 +261,6 @@ var WebInspector = {
         if (WebInspector.toolbar)
             WebInspector.toolbar.compact = x;
 
-        if (WebInspector.searchController)
-            WebInspector.searchController.updateSearchLabel();
-
         if (WebInspector.drawer)
             WebInspector.drawer.resize();
     },
@@ -456,6 +489,8 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     this.openAnchorLocationRegistry = new WebInspector.HandlerRegistry(openAnchorLocationSetting);
     this.openAnchorLocationRegistry.registerHandler(autoselectPanel, function() { return false; });
 
+    this.workspace = new WebInspector.Workspace();
+
     this._createPanels();
     this._createGlobalStatusBarItems();
 
@@ -781,7 +816,7 @@ WebInspector.postDocumentKeyDown = function(event)
     if (event.handled)
         return;
 
-    if (event.keyIdentifier === "U+001B") { // Escape key
+    if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Esc.code) {
         // If drawer is open with some view other than console then close it.
         if (!this._toggleConsoleButton.toggled && WebInspector.drawer.visible)
             this.closeViewInDrawer();
@@ -823,8 +858,11 @@ WebInspector.toggleSearchingForNode = function()
 
 WebInspector.showConsole = function()
 {
-    if (WebInspector._toggleConsoleButton && !WebInspector._toggleConsoleButton.toggled)
+    if (WebInspector._toggleConsoleButton && !WebInspector._toggleConsoleButton.toggled) {
+        if (WebInspector.drawer.visible)
+            this._closePreviousDrawerView();
         WebInspector._toggleConsoleButtonClicked();
+    }
 }
 
 WebInspector.showPanel = function(panel)
diff --git a/Source/WebCore/inspector/front-end/inspectorCommon.css b/Source/WebCore/inspector/front-end/inspectorCommon.css
index 4b283acff..89c84ba07 100644
--- a/Source/WebCore/inspector/front-end/inspectorCommon.css
+++ b/Source/WebCore/inspector/front-end/inspectorCommon.css
@@ -13,6 +13,7 @@ body {
     font-family: Lucida Grande, sans-serif;
     font-size: 10px;
     margin: 0;
+    tab-size: 4;
     -webkit-user-select: none;
 }
 
@@ -115,22 +116,6 @@ iframe.view {
     z-index: 300;
 }
 
-.resources-red-divider {
-    background-color: rgba(255, 0, 0, 0.5);
-}
-
-.resources-blue-divider {
-    background-color: rgba(0, 0, 255, 0.5);
-}
-
-.resources-orange-divider {
-    background-color: rgba(255, 178, 23, 0.5);
-}
-
-.resources-divider.last {
-    background-color: transparent;
-}
-
 .resources-divider-label {
     position: absolute;
     top: 4px;
diff --git a/Source/WebCore/inspector/front-end/networkPanel.css b/Source/WebCore/inspector/front-end/networkPanel.css
index f9c01b40e..a80c61d1e 100644
--- a/Source/WebCore/inspector/front-end/networkPanel.css
+++ b/Source/WebCore/inspector/front-end/networkPanel.css
@@ -280,6 +280,61 @@
     display: block;
 }
 
-.resource-websocket-frame-view {
+.resource-websocket {
     -webkit-user-select: text;
 }
+
+.resource-websocket, .resource-websocket .data-grid {
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    border: none;
+}
+
+.resource-websocket .data-grid .data {
+    background-image: none;
+    font-size: 11px;
+}
+
+.resource-websocket td {
+    padding-top: 3px;
+    padding-bottom: 3px;
+    border-top: 1px solid rgb(240, 240, 240);
+}
+
+.resource-websocket .data-column div {
+    word-break: break-all;
+    white-space: pre-wrap;
+}
+
+.resource-websocket-row-outcoming {
+    background-color: rgb(226, 247, 218);
+}
+
+.resource-websocket-row-outcoming:not(.selected) td {
+    border-right-color: rgb(177, 209, 165);
+}
+
+.resource-websocket-row-outcoming:not(.selected) td, .resource-websocket-row-outcoming:not(.selected) + tr td {
+    border-top-color: rgb(199, 236, 185);
+}
+
+.resource-websocket-row-opcode {
+    background-color: rgb(255, 255, 232);
+    color: rgb(170, 111, 71);
+}
+
+.resource-websocket-row-opcode td {
+    border-color: rgb(211, 187, 171);
+}
+
+.resource-websocket-row-opcode td, .resource-websocket-row-opcode + tr td {
+    border-top-color: rgb(248, 240, 210);
+}
+
+.resource-websocket-row-error {
+    background-color: rgb(255, 237, 237);
+    color: rgb(182, 0, 0);
+}
diff --git a/Source/WebCore/inspector/front-end/textViewer.css b/Source/WebCore/inspector/front-end/textEditor.css
index e10d7110d..5a15f3be9 100644
--- a/Source/WebCore/inspector/front-end/textViewer.css
+++ b/Source/WebCore/inspector/front-end/textEditor.css
@@ -121,10 +121,6 @@
     margin-right: -10px;
 }
 
-.webkit-line-content {
-    padding-left: 2px;
-}
-
 .webkit-breakpoint .webkit-line-number-outer {
     color: white;
     border-width: 0 14px 0px 2px;
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index a86c4e0c0..70965bef2 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -572,7 +572,27 @@
 
 .timeline .resources-event-divider {
     height: 19px;
+    width: 8px;
+    border-left-width: 2px;
+    border-left-style: solid;
     bottom: auto;
+    pointer-events: auto;
+}
+
+.resources-red-divider {
+    border-color: rgba(255, 0, 0, 0.5);
+}
+
+.resources-blue-divider {
+    border-color: rgba(0, 0, 255, 0.5);
+}
+
+.resources-orange-divider {
+    border-color: rgba(255, 178, 23, 0.5);
+}
+
+.resources-divider.last {
+    border-color: transparent;
 }
 
 .timeline.timeline-frame-overview .resources-divider {
@@ -582,6 +602,7 @@
 
 .timeline .resources-event-divider.timeline-frame-divider {
     background-color: rgba(180, 180, 180, 0.8);
+    border-style: none;
     width: 1px;
     height: 100%;
 }
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index 302a7ad28..bf6cb9efd 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -335,7 +335,8 @@ void DocumentLoader::commitData(const char* bytes, size_t length)
             m_frame->document()->setBaseURLOverride(m_archive->mainResource()->url());
 #endif
 
-        frameLoader()->receivedFirstData();
+        if (!frameLoader()->isReplacing())
+            frameLoader()->receivedFirstData();
 
         bool userChosen = true;
         String encoding = overrideEncoding();
@@ -366,7 +367,7 @@ void DocumentLoader::receivedData(const char* data, int length)
 
 void DocumentLoader::setupForReplaceByMIMEType(const String& newMIMEType)
 {
-    if (!m_gotFirstByte)
+    if (!mainResourceData())
         return;
     
     String oldMIMEType = m_response.mimeType();
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index aeb4c696d..56609a675 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -146,7 +146,9 @@ DocumentThreadableLoader::~DocumentThreadableLoader()
 
 void DocumentThreadableLoader::cancel()
 {
-    // Cacnel can re-enter and m_resource might be null here as a result.
+    RefPtr<DocumentThreadableLoader> protect(this);
+
+    // Cancel can re-enter and m_resource might be null here as a result.
     if (m_client && m_resource) {
         ResourceError error(errorDomainWebKitInternal, 0, m_resource->url(), "Load cancelled");
         error.setIsCancellation(true);
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 2c66093f3..b640f0854 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -1438,6 +1438,19 @@ void FrameLoader::reloadWithOverrideEncoding(const String& encoding)
     loadWithDocumentLoader(loader.get(), FrameLoadTypeReload, 0);
 }
 
+void FrameLoader::reloadWithOverrideURL(const KURL& overrideUrl, bool endToEndReload)
+{
+    if (!m_documentLoader)
+        return;
+
+    if (overrideUrl.isEmpty())
+        return;
+
+    ResourceRequest request = m_documentLoader->request();
+    request.setURL(overrideUrl);
+    reloadWithRequest(request, endToEndReload);
+}
+
 void FrameLoader::reload(bool endToEndReload)
 {
     if (!m_documentLoader)
@@ -1448,13 +1461,19 @@ void FrameLoader::reload(bool endToEndReload)
     if (m_documentLoader->request().url().isEmpty())
         return;
 
-    ResourceRequest initialRequest = m_documentLoader->request();
-
     // Replace error-page URL with the URL we were trying to reach.
+    ResourceRequest initialRequest = m_documentLoader->request();
     KURL unreachableURL = m_documentLoader->unreachableURL();
     if (!unreachableURL.isEmpty())
         initialRequest.setURL(unreachableURL);
-    
+
+    reloadWithRequest(initialRequest, endToEndReload);
+}
+
+void FrameLoader::reloadWithRequest(const ResourceRequest& initialRequest, bool endToEndReload)
+{
+    ASSERT(m_documentLoader);
+
     // Create a new document loader for the reload, this will become m_documentLoader eventually,
     // but first it has to be the "policy" document loader, and then the "provisional" document loader.
     RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(initialRequest, defaultSubstituteDataForURL(initialRequest.url()));
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index e5906f69e..880a5a2a4 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -115,6 +115,7 @@ public:
 
     void reload(bool endToEndReload = false);
     void reloadWithOverrideEncoding(const String& overrideEncoding);
+    void reloadWithOverrideURL(const KURL& overrideUrl, bool endToEndReload = false);
 
     void open(CachedFrameBase&);
     void loadItem(HistoryItem*, FrameLoadType);
@@ -344,6 +345,8 @@ private:
     void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
         bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
 
+    void reloadWithRequest(const ResourceRequest&, bool endToEndReload);
+
     bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 
     void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index 57d01134b..8b2204d24 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -352,29 +352,6 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction policy)
     deref(); // balances ref in didReceiveResponse
 }
 
-#if PLATFORM(QT)
-void MainResourceLoader::substituteMIMETypeFromPluginDatabase(const ResourceResponse& r)
-{
-    if (!m_frame->loader()->subframeLoader()->allowPlugins(NotAboutToInstantiatePlugin))
-        return;
-
-    String filename = r.url().lastPathComponent();
-    if (filename.endsWith('/'))
-        return;
-
-    size_t extensionPos = filename.reverseFind('.');
-    if (extensionPos == notFound)
-        return;
-
-    String extension = filename.substring(extensionPos + 1);
-    String mimeType = PluginDatabase::installedPlugins()->MIMETypeForExtension(extension);
-    if (!mimeType.isEmpty()) {
-        ResourceResponse* response = const_cast<ResourceResponse*>(&r);
-        response->setMimeType(mimeType);
-    }
-}
-#endif
-
 void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
 {
     if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForMainResponse(request(), r))
@@ -399,11 +376,6 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     ASSERT(shouldLoadAsEmptyDocument(r.url()) || !defersLoading());
 #endif
 
-#if PLATFORM(QT)
-    if (r.mimeType() == "application/octet-stream")
-        substituteMIMETypeFromPluginDatabase(r);
-#endif
-
     if (m_loadingMultipartContent) {
         frameLoader()->activeDocumentLoader()->setupForReplaceByMIMEType(r.mimeType());
         clearResourceData();
diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
index ade00b54c..3da77bc47 100644
--- a/Source/WebCore/loader/ResourceLoader.cpp
+++ b/Source/WebCore/loader/ResourceLoader.cpp
@@ -288,18 +288,19 @@ void ResourceLoader::willStopBufferingData(const char* data, int length)
 
 void ResourceLoader::didFinishLoading(double finishTime)
 {
-    // If load has been cancelled after finishing (which could happen with a 
-    // JavaScript that changes the window location), do nothing.
+    didFinishLoadingOnePart(finishTime);
+
+    // If the load has been cancelled by a delegate in response to didFinishLoad(), do not release
+    // the resources a second time, they have been released by cancel.
     if (m_cancelled)
         return;
-    ASSERT(!m_reachedTerminalState);
-
-    didFinishLoadingOnePart(finishTime);
     releaseResources();
 }
 
 void ResourceLoader::didFinishLoadingOnePart(double finishTime)
 {
+    // If load has been cancelled after finishing (which could happen with a
+    // JavaScript that changes the window location), do nothing.
     if (m_cancelled)
         return;
     ASSERT(!m_reachedTerminalState);
@@ -425,7 +426,7 @@ void ResourceLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse&
 
 void ResourceLoader::didReceiveData(ResourceHandle*, const char* data, int length, int encodedDataLength)
 {
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier());
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier(), encodedDataLength);
     didReceiveData(data, length, encodedDataLength, false);
     InspectorInstrumentation::didReceiveResourceData(cookie);
 }
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index fb8bb6068..fb31f1baf 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -428,6 +428,17 @@ void CachedImage::decodedSizeChanged(const Image* image, int delta)
     setDecodedSize(decodedSize() + delta);
 }
 
+bool CachedImage::likelyToBeUsedSoon()
+{
+    CachedResourceClientWalker<CachedImageClient> walker(m_clients);
+    while (CachedImageClient* client = walker.next()) {
+        if (client->willRenderImage(this))
+            return true;
+    }
+
+    return false;
+}
+
 void CachedImage::didDraw(const Image* image)
 {
     if (!image || image != m_image)
@@ -445,13 +456,7 @@ bool CachedImage::shouldPauseAnimation(const Image* image)
     if (!image || image != m_image)
         return false;
     
-    CachedResourceClientWalker<CachedImageClient> w(m_clients);
-    while (CachedImageClient* c = w.next()) {
-        if (c->willRenderImage(this))
-            return false;
-    }
-
-    return true;
+    return !likelyToBeUsedSoon();
 }
 
 void CachedImage::animationAdvanced(const Image* image)
diff --git a/Source/WebCore/loader/cache/CachedImage.h b/Source/WebCore/loader/cache/CachedImage.h
index 1ed9ff02c..9e3921174 100644
--- a/Source/WebCore/loader/cache/CachedImage.h
+++ b/Source/WebCore/loader/cache/CachedImage.h
@@ -73,6 +73,8 @@ public:
     virtual void allClientsRemoved();
     virtual void destroyDecodedData();
 
+    virtual bool likelyToBeUsedSoon();
+
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
     virtual void error(CachedResource::Status);
     virtual void setResponse(const ResourceResponse&);
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index e89960018..7fbf73365 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -211,6 +211,9 @@ public:
 
     void setOwningCachedResourceLoader(CachedResourceLoader* cachedResourceLoader) { m_owningCachedResourceLoader = cachedResourceLoader; }
     
+    // MemoryCache does not destroy the decoded data of a CachedResource if the decoded data will be likely used.
+    virtual bool likelyToBeUsedSoon() { return false; }
+
     bool isPreloaded() const { return m_preloadCount; }
     void increasePreloadCount() { ++m_preloadCount; }
     void decreasePreloadCount() { ASSERT(m_preloadCount); --m_preloadCount; }
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.cpp b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
index f03fadb57..f03fadb57 100755..100644
--- a/Source/WebCore/loader/cache/CachedSVGDocument.cpp
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.cpp
diff --git a/Source/WebCore/loader/cache/CachedSVGDocument.h b/Source/WebCore/loader/cache/CachedSVGDocument.h
index b05ef67d1..b05ef67d1 100755..100644
--- a/Source/WebCore/loader/cache/CachedSVGDocument.h
+++ b/Source/WebCore/loader/cache/CachedSVGDocument.h
diff --git a/Source/WebCore/loader/cache/MemoryCache.cpp b/Source/WebCore/loader/cache/MemoryCache.cpp
index eea759331..299d10a70 100644
--- a/Source/WebCore/loader/cache/MemoryCache.cpp
+++ b/Source/WebCore/loader/cache/MemoryCache.cpp
@@ -235,6 +235,12 @@ void MemoryCache::pruneLiveResourcesToSize(unsigned targetSize)
             if (elapsedTime < cMinDelayBeforeLiveDecodedPrune)
                 return;
 
+            // Check to see if the current resource are likely to be used again soon.
+            if (current->likelyToBeUsedSoon()) {
+                current = prev;
+                continue;
+            }
+
             // Destroy our decoded data. This will remove us from 
             // m_liveDecodedResources, and possibly move us to a different LRU 
             // list in m_allResources.
diff --git a/Source/WebCore/make-export-file-generator b/Source/WebCore/make-export-file-generator
index 7ee14c900..c9ff30406 100755
--- a/Source/WebCore/make-export-file-generator
+++ b/Source/WebCore/make-export-file-generator
@@ -36,6 +36,7 @@ end
 TEMPLATE = <<-EOF
 #include "config.h"
 #include <stdio.h>
+#include <wtf/Assertions.h>
 
 int main(int, char**)
 {
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index e878b9eee..13e85219f 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "InspectorInstrumentation.h"
 #include "InspectorValues.h"
+#include "KURL.h"
 #include "PingLoader.h"
 #include "SchemeRegistry.h"
 #include "ScriptCallStack.h"
@@ -550,6 +551,7 @@ public:
     bool allowInlineScript(const String& contextURL, const WTF::OrdinalNumber& contextLine) const;
     bool allowInlineStyle(const String& contextURL, const WTF::OrdinalNumber& contextLine) const;
     bool allowEval(PassRefPtr<ScriptCallStack>) const;
+    bool allowScriptNonce(const String& nonce, const String& contextURL, const WTF::OrdinalNumber& contextLine, const KURL&) const;
 
     bool allowScriptFromSource(const KURL&) const;
     bool allowObjectFromSource(const KURL&) const;
@@ -567,6 +569,7 @@ private:
 
     bool parseDirective(const UChar* begin, const UChar* end, String& name, String& value);
     void parseReportURI(const String& name, const String& value);
+    void parseScriptNonce(const String& name, const String& value);
     void addDirective(const String& name, const String& value);
     void applySandboxPolicy(const String& name, const String& sandboxPolicy);
 
@@ -576,9 +579,11 @@ private:
     void reportViolation(const String& directiveText, const String& consoleMessage, const KURL& blockedURL = KURL(), const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), PassRefPtr<ScriptCallStack> = 0) const;
     void logUnrecognizedDirective(const String& name) const;
     void logDuplicateDirective(const String& name) const;
+    void logInvalidNonce(const String& nonce) const;
     bool checkEval(CSPDirective*) const;
 
     bool checkInlineAndReportViolation(CSPDirective*, const String& consoleMessage, const String& contextURL, const WTF::OrdinalNumber& contextLine) const;
+    bool checkNonceAndReportViolation(const String& nonce, const String& consoleMessage, const String& contextURL, const WTF::OrdinalNumber& contextLine) const;
     bool checkEvalAndReportViolation(CSPDirective*, const String& consoleMessage, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), PassRefPtr<ScriptCallStack> = 0) const;
     bool checkSourceAndReportViolation(CSPDirective*, const KURL&, const String& type) const;
 
@@ -601,6 +606,7 @@ private:
     OwnPtr<CSPDirective> m_connectSrc;
 
     Vector<KURL> m_reportURIs;
+    String m_scriptNonce;
 };
 
 CSPDirectiveList::CSPDirectiveList(ScriptExecutionContext* scriptExecutionContext)
@@ -690,6 +696,12 @@ void CSPDirectiveList::logDuplicateDirective(const String& name) const
     m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message);
 }
 
+void CSPDirectiveList::logInvalidNonce(const String& nonce) const
+{
+    String message = makeString("Ignoring invalid Content Security Policy script nonce: '", nonce, "'.\n");
+    m_scriptExecutionContext->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message);
+}
+
 bool CSPDirectiveList::checkEval(CSPDirective* directive) const
 {
     return !directive || directive->allowEval();
@@ -708,6 +720,14 @@ bool CSPDirectiveList::checkInlineAndReportViolation(CSPDirective* directive, co
     return denyIfEnforcingPolicy();
 }
 
+bool CSPDirectiveList::checkNonceAndReportViolation(const String& nonce, const String& consoleMessage, const String& contextURL, const WTF::OrdinalNumber& contextLine) const
+{
+    if (m_scriptNonce.isEmpty() || nonce.stripWhiteSpace() == m_scriptNonce)
+        return true;
+    reportViolation(m_scriptNonce, consoleMessage + "\"script-nonce " + m_scriptNonce + "\".\n", KURL(), contextURL, contextLine);
+    return denyIfEnforcingPolicy();
+}
+
 bool CSPDirectiveList::checkEvalAndReportViolation(CSPDirective* directive, const String& consoleMessage, const String& contextURL, const WTF::OrdinalNumber& contextLine, PassRefPtr<ScriptCallStack> callStack) const
 {
     if (checkEval(directive))
@@ -728,13 +748,15 @@ bool CSPDirectiveList::checkSourceAndReportViolation(CSPDirective* directive, co
 bool CSPDirectiveList::allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine) const
 {
     DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute JavaScript URL because it violates the following Content Security Policy directive: "));
-    return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, contextURL, contextLine);
+    return (checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, contextURL, contextLine)
+            && checkNonceAndReportViolation(String(), consoleMessage, contextURL, contextLine));
 }
 
 bool CSPDirectiveList::allowInlineEventHandlers(const String& contextURL, const WTF::OrdinalNumber& contextLine) const
 {
     DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline event handler because it violates the following Content Security Policy directive: "));
-    return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, contextURL, contextLine);
+    return (checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, contextURL, contextLine)
+            && checkNonceAndReportViolation(String(), consoleMessage, contextURL, contextLine));
 }
 
 bool CSPDirectiveList::allowInlineScript(const String& contextURL, const WTF::OrdinalNumber& contextLine) const
@@ -755,6 +777,14 @@ bool CSPDirectiveList::allowEval(PassRefPtr<ScriptCallStack> callStack) const
     return checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, String(), WTF::OrdinalNumber::beforeFirst(), callStack);
 }
 
+bool CSPDirectiveList::allowScriptNonce(const String& nonce, const String& contextURL, const WTF::OrdinalNumber& contextLine, const KURL& url) const
+{
+    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute script because it violates the following Content Security Policy directive: "));
+    if (url.isEmpty())
+        return checkNonceAndReportViolation(nonce, consoleMessage, contextURL, contextLine);
+    return checkNonceAndReportViolation(nonce, "Refused to load '" + url.string() + "' because it violates the following Content Security Policy directive: ", contextURL, contextLine);
+}
+
 bool CSPDirectiveList::allowScriptFromSource(const KURL& url) const
 {
     DEFINE_STATIC_LOCAL(String, type, ("script"));
@@ -898,6 +928,36 @@ void CSPDirectiveList::parseReportURI(const String& name, const String& value)
     }
 }
 
+void CSPDirectiveList::parseScriptNonce(const String& name, const String& value)
+{
+    if (!m_scriptNonce.isEmpty()) {
+        logDuplicateDirective(name);
+        return;
+    }
+
+    String nonce;
+    const UChar* position = value.characters();
+    const UChar* end = position + value.length();
+
+    skipWhile<isASCIISpace>(position, end);
+    const UChar* nonceBegin = position;
+    if (position == end) {
+        logInvalidNonce(String());
+        return;
+    }
+    skipWhile<isNotASCIISpace>(position, end);
+    if (nonceBegin < position)
+        nonce = String(nonceBegin, position - nonceBegin);
+
+    // Trim off trailing whitespace: If we're not at the end of the string, log
+    // an error.
+    skipWhile<isASCIISpace>(position, end);
+    if (position < end)
+        logInvalidNonce(value);
+    else
+        m_scriptNonce = nonce;
+}
+
 void CSPDirectiveList::setCSPDirective(const String& name, const String& value, OwnPtr<CSPDirective>& directive)
 {
     if (directive) {
@@ -921,6 +981,9 @@ void CSPDirectiveList::addDirective(const String& name, const String& value)
 {
     DEFINE_STATIC_LOCAL(String, defaultSrc, ("default-src"));
     DEFINE_STATIC_LOCAL(String, scriptSrc, ("script-src"));
+#if ENABLE(CSP_NEXT)
+    DEFINE_STATIC_LOCAL(String, scriptNonce, ("script-nonce"));
+#endif
     DEFINE_STATIC_LOCAL(String, objectSrc, ("object-src"));
     DEFINE_STATIC_LOCAL(String, frameSrc, ("frame-src"));
     DEFINE_STATIC_LOCAL(String, imgSrc, ("img-src"));
@@ -955,6 +1018,10 @@ void CSPDirectiveList::addDirective(const String& name, const String& value)
         applySandboxPolicy(name, value);
     else if (equalIgnoringCase(name, reportURI))
         parseReportURI(name, value);
+#if ENABLE(CSP_NEXT)
+    else if (equalIgnoringCase(name, scriptNonce))
+        parseScriptNonce(name, value);
+#endif
     else
         logUnrecognizedDirective(name);
 }
@@ -978,7 +1045,24 @@ void ContentSecurityPolicy::copyStateFrom(const ContentSecurityPolicy* other)
 
 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType type)
 {
-    m_policies.append(CSPDirectiveList::create(m_scriptExecutionContext, header, type));
+    // RFC2616, section 4.2 specifies that headers appearing multiple times can
+    // be combined with a comma. Walk the header string, and parse each comma
+    // separated chunk as a separate header.
+    const UChar* begin = header.characters();
+    const UChar* position = begin;
+    const UChar* end = begin + header.length();
+    while (position < end) {
+        skipUntil(position, end, ',');
+
+        // header1,header2 OR header1
+        //        ^                  ^
+        m_policies.append(CSPDirectiveList::create(m_scriptExecutionContext, String(begin, position - begin), type));
+
+        // Skip the comma, and begin the next header from the current position.
+        ASSERT(position == end || *position == ',');
+        skipExactly(position, end, ',');
+        begin = position;
+    }
 }
 
 void ContentSecurityPolicy::setOverrideAllowInlineStyle(bool value)
@@ -1016,6 +1100,16 @@ bool isAllowedByAllWithContext(const CSPDirectiveListVector& policies, const Str
     return true;
 }
 
+template<bool (CSPDirectiveList::*allowed)(const String&, const String&, const WTF::OrdinalNumber&, const KURL&) const>
+bool isAllowedByAllWithNonce(const CSPDirectiveListVector& policies, const String& nonce, const String& contextURL, const WTF::OrdinalNumber& contextLine, const KURL& url)
+{
+    for (size_t i = 0; i < policies.size(); ++i) {
+        if (!(policies[i].get()->*allowed)(nonce, contextURL, contextLine, url))
+            return false;
+    }
+    return true;
+}
+
 template<bool (CSPDirectiveList::*allowFromURL)(const KURL&) const>
 bool isAllowedByAllWithURL(const CSPDirectiveListVector& policies, const KURL& url)
 {
@@ -1056,6 +1150,11 @@ bool ContentSecurityPolicy::allowEval(PassRefPtr<ScriptCallStack> callStack) con
     return isAllowedByAllWithCallStack<&CSPDirectiveList::allowEval>(m_policies, callStack);
 }
 
+bool ContentSecurityPolicy::allowScriptNonce(const String& nonce, const String& contextURL, const WTF::OrdinalNumber& contextLine, const KURL& url) const
+{
+    return isAllowedByAllWithNonce<&CSPDirectiveList::allowScriptNonce>(m_policies, nonce, contextURL, contextLine, url);
+}
+
 bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
 {
     return isAllowedByAllWithURL<&CSPDirectiveList::allowScriptFromSource>(m_policies, url);
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index 7ac60d9d7..cb6bead51 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -26,6 +26,7 @@
 #ifndef ContentSecurityPolicy_h
 #define ContentSecurityPolicy_h
 
+#include "KURL.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -40,7 +41,6 @@ namespace WebCore {
 class CSPDirectiveList;
 class ScriptCallStack;
 class ScriptExecutionContext;
-class KURL;
 
 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector;
 
@@ -71,6 +71,7 @@ public:
     bool allowInlineScript(const String& contextURL, const WTF::OrdinalNumber& contextLine) const;
     bool allowInlineStyle(const String& contextURL, const WTF::OrdinalNumber& contextLine) const;
     bool allowEval(PassRefPtr<ScriptCallStack>) const;
+    bool allowScriptNonce(const String& nonce, const String& contextURL, const WTF::OrdinalNumber& contextLine, const KURL& = KURL()) const;
 
     bool allowScriptFromSource(const KURL&) const;
     bool allowObjectFromSource(const KURL&) const;
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 7cf2dbe5b..6e188fdf1 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -543,19 +543,19 @@ void ContextMenuController::createAndAppendSpellingAndGrammarSubMenu(ContextMenu
         contextMenuItemTagCheckSpellingWhileTyping());
     ContextMenuItem grammarWithSpelling(CheckableActionType, ContextMenuItemTagCheckGrammarWithSpelling, 
         contextMenuItemTagCheckGrammarWithSpelling());
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC)
     ContextMenuItem correctSpelling(CheckableActionType, ContextMenuItemTagCorrectSpellingAutomatically, 
         contextMenuItemTagCorrectSpellingAutomatically());
 #endif
 
     appendItem(showSpellingPanel, &spellingAndGrammarMenu);
     appendItem(checkSpelling, &spellingAndGrammarMenu);
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC)
     appendItem(*separatorItem(), &spellingAndGrammarMenu);
 #endif
     appendItem(checkAsYouType, &spellingAndGrammarMenu);
     appendItem(grammarWithSpelling, &spellingAndGrammarMenu);
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC)
     appendItem(correctSpelling, &spellingAndGrammarMenu);
 #endif
 
@@ -648,7 +648,7 @@ void ContextMenuController::createAndAppendTextDirectionSubMenu(ContextMenuItem&
 
 #endif
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC)
 
 void ContextMenuController::createAndAppendSubstitutionsSubMenu(ContextMenuItem& substitutionsMenuItem)
 {
@@ -703,7 +703,7 @@ static bool selectionContainsPossibleWord(Frame* frame)
 }
 
 #if PLATFORM(MAC)
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+#if defined(BUILDING_ON_SNOW_LEOPARD)
 #define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 1
 #else
 #define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 0
@@ -1015,7 +1015,7 @@ void ContextMenuController::populate()
             createAndAppendSpellingAndGrammarSubMenu(SpellingAndGrammarMenuItem);
             appendItem(SpellingAndGrammarMenuItem, m_contextMenu.get());
 #endif
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD)
+#if PLATFORM(MAC)
             ContextMenuItem substitutionsMenuItem(SubmenuType, ContextMenuItemTagSubstitutionsMenu, 
                 contextMenuItemTagSubstitutionsMenu());
             createAndAppendSubstitutionsSubMenu(substitutionsMenuItem);
@@ -1230,13 +1230,11 @@ void ContextMenuController::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagTransformationsMenu:
             break;
         case ContextMenuItemTagShowSubstitutions:
-#ifndef BUILDING_ON_LEOPARD
             if (frame->editor()->substitutionsPanelIsShowing())
                 item.setTitle(contextMenuItemTagShowSubstitutions(false));
             else
                 item.setTitle(contextMenuItemTagShowSubstitutions(true));
             shouldEnable = frame->editor()->canEdit();
-#endif
             break;
         case ContextMenuItemTagMakeUpperCase:
         case ContextMenuItemTagMakeLowerCase:
@@ -1245,34 +1243,22 @@ void ContextMenuController::checkOrEnableIfNeeded(ContextMenuItem& item) const
             shouldEnable = frame->editor()->canEdit();
             break;
         case ContextMenuItemTagCorrectSpellingAutomatically:
-#ifndef BUILDING_ON_LEOPARD
             shouldCheck = frame->editor()->isAutomaticSpellingCorrectionEnabled();
-#endif
             break;
         case ContextMenuItemTagSmartCopyPaste:
-#ifndef BUILDING_ON_LEOPARD
             shouldCheck = frame->editor()->smartInsertDeleteEnabled();
-#endif
             break;
         case ContextMenuItemTagSmartQuotes:
-#ifndef BUILDING_ON_LEOPARD
             shouldCheck = frame->editor()->isAutomaticQuoteSubstitutionEnabled();
-#endif
             break;
         case ContextMenuItemTagSmartDashes:
-#ifndef BUILDING_ON_LEOPARD
             shouldCheck = frame->editor()->isAutomaticDashSubstitutionEnabled();
-#endif
             break;
         case ContextMenuItemTagSmartLinks:
-#ifndef BUILDING_ON_LEOPARD
             shouldCheck = frame->editor()->isAutomaticLinkDetectionEnabled();
-#endif
             break;
         case ContextMenuItemTagTextReplacement:
-#ifndef BUILDING_ON_LEOPARD
             shouldCheck = frame->editor()->isAutomaticTextReplacementEnabled();
-#endif
             break;
         case ContextMenuItemTagStopSpeaking:
             shouldEnable = client() && client()->isSpeaking();
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index b206543b1..986cbd882 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -407,6 +407,7 @@ module window {
         attribute HTMLCanvasElementConstructor HTMLCanvasElement;
         attribute HTMLDListElementConstructor HTMLDListElement;
         attribute [Conditional=DATALIST] HTMLDataListElementConstructor HTMLDataListElement;
+        attribute [Conditional=DIALOG_ELEMENT, V8EnabledPerContext=dialogElement] HTMLDialogElementConstructor HTMLDialogElement;
         attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
         attribute HTMLDivElementConstructor HTMLDivElement;
         attribute HTMLEmbedElementConstructor HTMLEmbedElement;
@@ -778,7 +779,7 @@ module window {
 
         attribute [Conditional=BLOB] DOMURLConstructor webkitURL;
 
-        attribute [Conditional=MUTATION_OBSERVERS] WebKitMutationObserverConstructor WebKitMutationObserver;
+        attribute [Conditional=MUTATION_OBSERVERS] MutationObserverConstructor WebKitMutationObserver;
 
 #endif // defined(LANGUAGE_JAVASCRIPT)
 
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 367ab0443..a0c9afc43 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -496,6 +496,7 @@ static int textDistance(const Position& start, const Position& end)
 
 bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestResults& event)
 {
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
     Node* innerNode = targetNode(event);
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))
         return false;
@@ -1880,7 +1881,12 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 
     bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, targetNode(mev), true, m_clickCount, mouseEvent, false);
 
-    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() != RightButton && targetNode(mev) == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, targetNode(mev), true, m_clickCount, mouseEvent, true);
+    Node* clickTarget = targetNode(mev);
+    if (clickTarget)
+        clickTarget = clickTarget->shadowAncestorNode();
+    Node* adjustedClickNode = m_clickNode ? m_clickNode->shadowAncestorNode() : 0;
+
+    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() != RightButton && clickTarget == adjustedClickNode && dispatchMouseEvent(eventNames().clickEvent, targetNode(mev), true, m_clickCount, mouseEvent, true);
 
     if (m_resizeLayer) {
         m_resizeLayer->setInResizeMode(false);
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index ea57bb4f1..03a779737 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -1047,38 +1047,39 @@ void Frame::notifyChromeClientTouchEventHandlerCountChanged() const
 
 #if !PLATFORM(MAC) && !PLATFORM(WIN)
 struct ScopedFramePaintingState {
-    ScopedFramePaintingState(Frame* theFrame, RenderObject* theRenderer)
-        : frame(theFrame)
-        , renderer(theRenderer)
+    ScopedFramePaintingState(Frame* frame, Node* node)
+        : frame(frame)
+        , node(node)
         , paintBehavior(frame->view()->paintBehavior())
         , backgroundColor(frame->view()->baseBackgroundColor())
     {
+        ASSERT(!node || node->renderer());
+        if (node)
+            node->renderer()->updateDragState(true);
     }
 
     ~ScopedFramePaintingState()
     {
-        if (renderer)
-            renderer->updateDragState(false);
+        if (node && node->renderer())
+            node->renderer()->updateDragState(false);
         frame->view()->setPaintBehavior(paintBehavior);
         frame->view()->setBaseBackgroundColor(backgroundColor);
         frame->view()->setNodeToDraw(0);
     }
 
     Frame* frame;
-    RenderObject* renderer;
+    Node* node;
     PaintBehavior paintBehavior;
     Color backgroundColor;
 };
 
 DragImageRef Frame::nodeImage(Node* node)
 {
-    RenderObject* renderer = node->renderer();
-    if (!renderer)
+    if (!node->renderer())
         return 0;
 
-    const ScopedFramePaintingState state(this, renderer);
+    const ScopedFramePaintingState state(this, node);
 
-    renderer->updateDragState(true);
     m_view->setPaintBehavior(state.paintBehavior | PaintBehaviorFlattenCompositingLayers);
 
     // When generating the drag image for an element, ignore the document background.
@@ -1086,6 +1087,11 @@ DragImageRef Frame::nodeImage(Node* node)
     m_doc->updateLayout();
     m_view->setNodeToDraw(node); // Enable special sub-tree drawing mode.
 
+    // Document::updateLayout may have blown away the original RenderObject.
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+      return 0;
+
     LayoutRect topLevelRect;
     IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index bea7e2813..ddc3c242c 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -87,6 +87,10 @@
 #include "TiledBackingStore.h"
 #endif
 
+#if ENABLE(TEXT_AUTOSIZING)
+#include "TextAutosizer.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -745,6 +749,10 @@ bool FrameView::syncCompositingStateForThisFrame(Frame* rootFrameForSync)
     if (needsLayout())
         return false;
 
+    // If we sync compositing layers and allow the repaint to be deferred, there is time for a
+    // visible flash to occur. Instead, stop the deferred repaint timer and repaint immediately.
+    stopDelayingDeferredRepaints();
+
     root->compositor()->flushPendingLayerChanges(rootFrameForSync == m_frame);
 
     return true;
@@ -1107,6 +1115,11 @@ void FrameView::layout(bool allowSubtree)
             beginDeferredRepaints();
             forceLayoutParentViewIfNeeded();
             root->layout();
+#if ENABLE(TEXT_AUTOSIZING)
+            bool autosized = document->textAutosizer()->processSubtree(root);
+            if (autosized && root->needsLayout())
+                root->layout();
+#endif
             endDeferredRepaints();
             m_inLayout = false;
 
@@ -1440,11 +1453,7 @@ IntPoint FrameView::currentMousePosition() const
 
 bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
 {
-    RenderBlock::PositionedObjectsListHashSet* positionedObjects = 0;
-    if (RenderView* root = rootRenderer(this))
-        positionedObjects = root->positionedObjects();
-
-    if (!positionedObjects || positionedObjects->isEmpty()) {
+    if (!m_fixedObjects || m_fixedObjects->isEmpty()) {
         hostWindow()->scroll(scrollDelta, rectToScroll, clipRect);
         return true;
     }
@@ -1453,16 +1462,28 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
 
     // Get the rects of the fixed objects visible in the rectToScroll
     Region regionToUpdate;
-    RenderBlock::PositionedObjectsListHashSet::const_iterator end = positionedObjects->end();
-    for (RenderBlock::PositionedObjectsListHashSet::const_iterator it = positionedObjects->begin(); it != end; ++it) {
-        RenderBox* renderBox = *it;
-        if (renderBox->style()->position() != FixedPosition)
+    FixedObjectSet::const_iterator end = m_fixedObjects->end();
+    for (FixedObjectSet::const_iterator it = m_fixedObjects->begin(); it != end; ++it) {
+        RenderObject* renderer = *it;
+        if (renderer->style()->position() != FixedPosition)
             continue;
 #if USE(ACCELERATED_COMPOSITING)
-        if (renderBox->isComposited())
+        if (renderer->isComposited())
             continue;
 #endif
-        IntRect updateRect = pixelSnappedIntRect(renderBox->layer()->repaintRectIncludingNonCompositingDescendants());
+    
+        // Fixed items should always have layers.
+        ASSERT(renderer->hasLayer());
+        RenderLayer* layer = toRenderBoxModelObject(renderer)->layer();
+        
+#if ENABLE(CSS_FILTERS)
+        if (layer->hasAncestorWithFilterOutsets()) {
+            // If the fixed layer has a blur/drop-shadow filter applied on at least one of its parents, we cannot 
+            // scroll using the fast path, otherwise the outsets of the filter will be moved around the page.
+            return false;
+        }
+#endif
+        IntRect updateRect = pixelSnappedIntRect(layer->repaintRectIncludingNonCompositingDescendants());
         updateRect = contentsToRootView(updateRect);
         if (!isCompositedContentLayer && clipsRepaints())
             updateRect.intersect(rectToScroll);
@@ -1918,13 +1939,18 @@ void FrameView::startDeferredRepaintTimer(double delay)
 
 void FrameView::checkStopDelayingDeferredRepaints()
 {
-    if (!m_deferredRepaintTimer.isActive())
-        return;
-
     Document* document = m_frame->document();
     if (document && (document->parsing() || document->cachedResourceLoader()->requestCount()))
         return;
+
+    stopDelayingDeferredRepaints();
+}
     
+void FrameView::stopDelayingDeferredRepaints()
+{
+    if (!m_deferredRepaintTimer.isActive())
+        return;
+
     m_deferredRepaintTimer.stop();
 
     doDeferredRepaints();
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 8ccbe8cbe..08ceeffb9 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -209,6 +209,7 @@ public:
     void beginDeferredRepaints();
     void endDeferredRepaints();
     void checkStopDelayingDeferredRepaints();
+    void stopDelayingDeferredRepaints();
     void startDeferredRepaintTimer(double delay);
     void resetDeferredRepaintDelay();
 
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
index dde5d7987..0d5eb89c9 100644
--- a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
@@ -46,6 +46,7 @@ static void initProtocolHandlerWhitelist()
 {
     protocolWhitelist = new HashSet<String>;
     static const char* protocols[] = {
+#if !PLATFORM(BLACKBERRY)
         "irc",
         "mailto",
         "mms",
@@ -56,6 +57,7 @@ static void initProtocolHandlerWhitelist()
         "tel",
         "urn",
         "webcal",
+#endif
     };
     for (size_t i = 0; i < WTF_ARRAY_LENGTH(protocols); ++i)
         protocolWhitelist->add(protocols[i]);
diff --git a/Source/WebCore/page/PointerLockController.cpp b/Source/WebCore/page/PointerLockController.cpp
index 5c70dcf78..c250cb7be 100644
--- a/Source/WebCore/page/PointerLockController.cpp
+++ b/Source/WebCore/page/PointerLockController.cpp
@@ -51,6 +51,11 @@ void PointerLockController::requestPointerLock(Element* target, PassRefPtr<VoidC
     if (!target)
         return;
 
+    if (!target->inDocument()) {
+        enqueueEvent(eventNames().webkitpointerlockerrorEvent, target);
+        return;
+    }
+
     if (isLocked()) {
         // FIXME: Keep enqueueEvent usage. (https://bugs.webkit.org/show_bug.cgi?id=84402)
         enqueueEvent(eventNames().webkitpointerlockchangeEvent, target);
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index edd3d7931..6c3d37337 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -138,7 +138,14 @@ Settings::Settings(Page* page)
     , m_sessionStorageQuota(StorageMap::noQuota)
     , m_editingBehaviorType(editingBehaviorTypeForPlatform())
     , m_maximumHTMLParserDOMTreeDepth(defaultMaximumHTMLParserDOMTreeDepth)
-    , m_fontBoostingEnabled(true)
+#if ENABLE(TEXT_AUTOSIZING)
+#if HACK_FORCE_TEXT_AUTOSIZING_ON_DESKTOP
+    , m_textAutosizingWindowSizeOverride(320, 480)
+    , m_textAutosizingEnabled(true)
+#else
+    , m_textAutosizingEnabled(false)
+#endif
+#endif
     , m_isSpatialNavigationEnabled(false)
     , m_isJavaEnabled(false)
     , m_isJavaEnabledForLocalFiles(true)
@@ -192,6 +199,9 @@ Settings::Settings(Page* page)
 #if ENABLE(CSS_REGIONS)
     , m_cssRegionsEnabled(false)
 #endif
+#if ENABLE(CSS_VARIABLES)
+    , m_cssVariablesEnabled(false)
+#endif
     , m_regionBasedColumnsEnabled(false)
     , m_cssGridLayoutEnabled(false)
     // FIXME: This should really be disabled by default as it makes platforms that don't support the feature download files
@@ -242,9 +252,6 @@ Settings::Settings(Page* page)
 #if ENABLE(SMOOTH_SCROLLING)
     , m_scrollAnimatorEnabled(true)
 #endif
-#if ENABLE(WEB_SOCKETS)
-    , m_useHixie76WebSocketProtocol(false)
-#endif
     , m_mediaPlaybackRequiresUserGesture(false)
     , m_mediaPlaybackAllowsInline(true)
     , m_passwordEchoEnabled(false)
@@ -400,14 +407,25 @@ void Settings::setDefaultFixedFontSize(int defaultFontSize)
     m_page->setNeedsRecalcStyleInAllFrames();
 }
 
-void Settings::setFontBoostingEnabled(bool fontBoostingEnabled)
+#if ENABLE(TEXT_AUTOSIZING)
+void Settings::setTextAutosizingEnabled(bool textAutosizingEnabled)
+{
+    if (m_textAutosizingEnabled == textAutosizingEnabled)
+        return;
+
+    m_textAutosizingEnabled = textAutosizingEnabled;
+    m_page->setNeedsRecalcStyleInAllFrames();
+}
+
+void Settings::setTextAutosizingWindowSizeOverride(const IntSize& textAutosizingWindowSizeOverride)
 {
-    if (m_fontBoostingEnabled == fontBoostingEnabled)
+    if (m_textAutosizingWindowSizeOverride == textAutosizingWindowSizeOverride)
         return;
 
-    m_fontBoostingEnabled = fontBoostingEnabled;
+    m_textAutosizingWindowSizeOverride = textAutosizingWindowSizeOverride;
     m_page->setNeedsRecalcStyleInAllFrames();
 }
+#endif
 
 void Settings::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
 {
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index a464cc86e..3b23d625b 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -36,6 +36,10 @@
 #include <wtf/text/AtomicStringHash.h>
 #include <wtf/unicode/Unicode.h>
 
+#if ENABLE(TEXT_AUTOSIZING)
+#include "IntSize.h"
+#endif
+
 namespace WebCore {
 
     class Page;
@@ -103,8 +107,14 @@ namespace WebCore {
         void setDefaultFixedFontSize(int);
         int defaultFixedFontSize() const { return m_defaultFixedFontSize; }
 
-        void setFontBoostingEnabled(bool);
-        bool fontBoostingEnabled() const { return m_fontBoostingEnabled; }
+#if ENABLE(TEXT_AUTOSIZING)
+        void setTextAutosizingEnabled(bool);
+        bool textAutosizingEnabled() const { return m_textAutosizingEnabled; }
+
+        // Only set by Layout Tests, and only used if textAutosizingEnabled() returns true.
+        void setTextAutosizingWindowSizeOverride(const IntSize&);
+        const IntSize& textAutosizingWindowSizeOverride() const { return m_textAutosizingWindowSizeOverride; }
+#endif
 
         // Unlike areImagesEnabled, this only suppresses the network load of
         // the image URL.  A cached image will still be rendered if requested.
@@ -495,10 +505,6 @@ namespace WebCore {
         void setEnableScrollAnimator(bool flag) { m_scrollAnimatorEnabled = flag; }
         bool scrollAnimatorEnabled() const { return m_scrollAnimatorEnabled; }
 #endif
-#if ENABLE(WEB_SOCKETS)
-        void setUseHixie76WebSocketProtocol(bool flag) { m_useHixie76WebSocketProtocol = flag; }
-        bool useHixie76WebSocketProtocol() { return m_useHixie76WebSocketProtocol; }
-#endif
 
         void setMediaPlaybackRequiresUserGesture(bool flag) { m_mediaPlaybackRequiresUserGesture = flag; };
         bool mediaPlaybackRequiresUserGesture() const { return m_mediaPlaybackRequiresUserGesture; }
@@ -631,7 +637,10 @@ namespace WebCore {
         unsigned m_sessionStorageQuota;
         unsigned m_editingBehaviorType;
         unsigned m_maximumHTMLParserDOMTreeDepth;
-        bool m_fontBoostingEnabled : 1;
+#if ENABLE(TEXT_AUTOSIZING)
+        IntSize m_textAutosizingWindowSizeOverride;
+        bool m_textAutosizingEnabled : 1;
+#endif
         bool m_isSpatialNavigationEnabled : 1;
         bool m_isJavaEnabled : 1;
         bool m_isJavaEnabledForLocalFiles : 1;
@@ -732,9 +741,6 @@ namespace WebCore {
 #if ENABLE(SMOOTH_SCROLLING)
         bool m_scrollAnimatorEnabled : 1;
 #endif
-#if ENABLE(WEB_SOCKETS)
-        bool m_useHixie76WebSocketProtocol : 1;
-#endif
         bool m_mediaPlaybackRequiresUserGesture : 1;
         bool m_mediaPlaybackAllowsInline : 1;
         bool m_passwordEchoEnabled : 1;
diff --git a/Source/WebCore/page/mac/FrameMac.mm b/Source/WebCore/page/mac/FrameMac.mm
index 7b45a395e..31d6649af 100644
--- a/Source/WebCore/page/mac/FrameMac.mm
+++ b/Source/WebCore/page/mac/FrameMac.mm
@@ -157,6 +157,13 @@ NSImage* Frame::snapshotDragImage(Node* node, NSRect* imageRect, NSRect* element
     renderer->updateDragState(true);    // mark dragged nodes (so they pick up the right CSS)
     m_doc->updateLayout();        // forces style recalc - needed since changing the drag state might
                                         // imply new styles, plus JS could have changed other things
+
+
+    // Document::updateLayout may have blown away the original RenderObject.
+    renderer = node->renderer();
+    if (!renderer)
+        return nil;
+
     LayoutRect topLevelRect;
     NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
@@ -175,12 +182,11 @@ NSImage* Frame::snapshotDragImage(Node* node, NSRect* imageRect, NSRect* element
 
 DragImageRef Frame::nodeImage(Node* node)
 {
+    m_doc->updateLayout(); // forces style recalc
+
     RenderObject* renderer = node->renderer();
     if (!renderer)
         return nil;
-
-    m_doc->updateLayout(); // forces style recalc
-
     LayoutRect topLevelRect;
     NSRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
diff --git a/Source/WebCore/page/win/FrameCGWin.cpp b/Source/WebCore/page/win/FrameCGWin.cpp
index ab6a8a57c..b5598826c 100644
--- a/Source/WebCore/page/win/FrameCGWin.cpp
+++ b/Source/WebCore/page/win/FrameCGWin.cpp
@@ -93,6 +93,8 @@ HBITMAP imageFromSelection(Frame* frame, bool forceBlackText)
 
 DragImageRef Frame::nodeImage(Node* node)
 {
+    document()->updateLayout();
+
     RenderObject* renderer = node->renderer();
     if (!renderer)
         return 0;
@@ -100,8 +102,6 @@ DragImageRef Frame::nodeImage(Node* node)
     LayoutRect topLevelRect;
     IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
-    document()->updateLayout();
-
     m_view->setNodeToDraw(node); // invoke special sub-tree drawing mode
     HBITMAP result = imageFromRect(this, paintingRect);
     m_view->setNodeToDraw(0);
diff --git a/Source/WebCore/platform/ContextMenuItem.h b/Source/WebCore/platform/ContextMenuItem.h
index 697379875..9d367446e 100644
--- a/Source/WebCore/platform/ContextMenuItem.h
+++ b/Source/WebCore/platform/ContextMenuItem.h
@@ -134,7 +134,6 @@ namespace WebCore {
         ContextMenuItemTagRightToLeft,
         ContextMenuItemTagPDFSinglePageScrolling,
         ContextMenuItemTagPDFFacingPagesScrolling,
-        ContextMenuItemTagDictationAlternative,
 #if ENABLE(INSPECTOR)
         ContextMenuItemTagInspectElement,
 #endif
@@ -164,6 +163,7 @@ namespace WebCore {
         ContextMenuItemTagEnterVideoFullscreen,
         ContextMenuItemTagMediaPlayPause,
         ContextMenuItemTagMediaMute,
+        ContextMenuItemTagDictationAlternative,
         ContextMenuItemBaseCustomTag = 5000,
         ContextMenuItemCustomTagNoAction = 5998,
         ContextMenuItemLastCustomTag = 5999,
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index b3c259a97..a6b3a675f 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -71,6 +71,10 @@ typedef struct _GFileIOStream GFileIOStream;
 typedef struct _GModule GModule;
 #endif
 
+#if PLATFORM(EFL)
+typedef struct _Eina_Module Eina_Module;
+#endif
+
 namespace WebCore {
 
 // PlatformModule
@@ -78,6 +82,8 @@ namespace WebCore {
 typedef HMODULE PlatformModule;
 #elif PLATFORM(GTK)
 typedef GModule* PlatformModule;
+#elif PLATFORM(EFL)
+typedef Eina_Module* PlatformModule;
 #elif PLATFORM(QT)
 #if defined(Q_WS_MAC)
 typedef CFBundleRef PlatformModule;
diff --git a/Source/WebCore/platform/FractionalLayoutUnit.h b/Source/WebCore/platform/FractionalLayoutUnit.h
index d201e122b..21c526410 100644
--- a/Source/WebCore/platform/FractionalLayoutUnit.h
+++ b/Source/WebCore/platform/FractionalLayoutUnit.h
@@ -86,6 +86,14 @@ public:
 #endif
     FractionalLayoutUnit(const FractionalLayoutUnit& value) { m_value = value.rawValue(); }
 
+    static FractionalLayoutUnit fromFloatCeil(float value)
+    {
+      REPORT_OVERFLOW(isInBounds(value));
+      FractionalLayoutUnit v;
+      v.m_value = ceilf(value * kFixedPointDenominator);
+      return v;
+    }
+
 #if ENABLE(SUBPIXEL_LAYOUT)
     int toInt() const { return m_value / kFixedPointDenominator; }
     float toFloat() const { return static_cast<float>(m_value) / kFixedPointDenominator; }
@@ -153,7 +161,7 @@ public:
         return toInt();
     }
 
-    static float epsilon() { return 1 / kFixedPointDenominator; }
+    static float epsilon() { return 1.0f / kFixedPointDenominator; }
     static const FractionalLayoutUnit max()
     {
         FractionalLayoutUnit m;
@@ -168,15 +176,15 @@ public:
     }
     
 private:
-    bool isInBounds(int value)
+    static bool isInBounds(int value)
     {
         return ::abs(value) <= std::numeric_limits<int>::max() / kFixedPointDenominator;
     }
-    bool isInBounds(unsigned value)
+    static bool isInBounds(unsigned value)
     {
         return value <= static_cast<unsigned>(std::numeric_limits<int>::max()) / kFixedPointDenominator;
     }
-    bool isInBounds(double value)
+    static bool isInBounds(double value)
     {
         return ::fabs(value) <= std::numeric_limits<int>::max() / kFixedPointDenominator;
     }
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index 086f2218d..9d93cc69f 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -201,7 +201,29 @@ Length::Length(PassRefPtr<CalculationValue> calc)
 {
     m_intValue = calcHandles().insert(calc);
 }
+        
+Length Length::blendCalculation(const Length& from, double progress) const
+{
+    if (progress <= 0.0)
+        return from;
+        
+    if (progress >= 1.0)
+        return *this;
+        
+    // FIXME: https://webkit.org/b/90037 - some of these allocations can be eliminated
+    OwnPtr<CalcExpressionNode> startScale = adoptPtr(new CalcExpressionNumber(1.0 - progress));
+    OwnPtr<CalcExpressionNode> startLength = adoptPtr(new CalcExpressionLength(from));
+    OwnPtr<CalcExpressionNode> startNode = adoptPtr(new CalcExpressionBinaryOperation(startScale.release(), startLength.release(), CalcMultiply));
     
+    OwnPtr<CalcExpressionNode> endScale = adoptPtr(new CalcExpressionNumber(progress));
+    OwnPtr<CalcExpressionNode> endLength = adoptPtr(new CalcExpressionLength(*this));
+    OwnPtr<CalcExpressionNode> endNode = adoptPtr(new CalcExpressionBinaryOperation(endScale.release(), endLength.release(), CalcMultiply));
+    
+    OwnPtr<CalcExpressionNode> blend = adoptPtr(new CalcExpressionBinaryOperation(startNode.release(), endNode.release(), CalcAdd));
+        
+    return Length(CalculationValue::create(blend.release(), CalculationRangeAll));
+}
+          
 PassRefPtr<CalculationValue> Length::calculationValue() const
 {
     ASSERT(isCalculated());
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index 1815130a9..7171e3494 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -230,15 +230,14 @@ public:
     Length blend(const Length& from, double progress) const
     {
         // Blend two lengths to produce a new length that is in between them.  Used for animation.
+        if (from.type() == Calculated || type() == Calculated)
+            return blendCalculation(from, progress);
+        
         if (!from.isZero() && !isZero() && from.type() != type())
             return *this;
 
         if (from.isZero() && isZero())
             return *this;
-
-        // FIXME http://webkit.org/b/86160 - Blending doesn't work with calculated expressions
-        if (from.type() == Calculated || type() == Calculated)
-            return *this;
         
         LengthType resultType = type();
         if (isZero())
@@ -293,6 +292,8 @@ private:
             incrementCalculatedRef();
     }
 
+    Length blendCalculation(const Length& from, double progress) const;
+
     int calculationHandle() const
     {
         ASSERT(isCalculated());
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index b140f9c07..9c4bdf3f9 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -244,7 +244,7 @@ String contextMenuItemTagSearchInSpotlight()
 
 String contextMenuItemTagSearchWeb()
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     RetainPtr<CFStringRef> searchProviderName(AdoptCF, wkCopyDefaultSearchProviderDisplayName());
     return formatLocalizedString(WEB_UI_STRING("Search with %@", "Search with search provider context menu item with provider name inserted"), searchProviderName.get());
 #else
diff --git a/Source/WebCore/platform/Logging.cpp b/Source/WebCore/platform/Logging.cpp
index 34637a7cc..d97e1045a 100644
--- a/Source/WebCore/platform/Logging.cpp
+++ b/Source/WebCore/platform/Logging.cpp
@@ -27,6 +27,8 @@
 #include "Logging.h"
 #include "PlatformString.h"
 
+#if !LOG_DISABLED
+
 namespace WebCore {
 
 WTFLogChannel LogNotYetImplemented = { 0x00000001, "WebCoreLogLevel", WTFLogChannelOff };
@@ -63,6 +65,7 @@ WTFLogChannel LogFileAPI =           { 0x10000000, "WebCoreLogLevel", WTFLogChan
 
 WTFLogChannel LogWebAudio =          { 0x20000000, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogCompositing =       { 0x40000000, "WebCoreLogLevel", WTFLogChannelOff };
+WTFLogChannel LogGamepad =           { 0x80000000, "WebCoreLogLevel", WTFLogChannelOff };
 
 
 WTFLogChannel* getChannelFromName(const String& channelName)
@@ -145,7 +148,12 @@ WTFLogChannel* getChannelFromName(const String& channelName)
     if (equalIgnoringCase(channelName, String("Compositing")))
         return &LogCompositing;
 
+    if (equalIgnoringCase(channelName, String("Gamepad")))
+        return &LogGamepad;
+
     return 0;
 }
 
 }
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/platform/Logging.h b/Source/WebCore/platform/Logging.h
index 1af1c04ab..cde0ce851 100644
--- a/Source/WebCore/platform/Logging.h
+++ b/Source/WebCore/platform/Logging.h
@@ -29,6 +29,8 @@
 #include <wtf/Assertions.h>
 #include <wtf/Forward.h>
 
+#if !LOG_DISABLED
+
 #ifndef LOG_CHANNEL_PREFIX
 #define LOG_CHANNEL_PREFIX Log
 #endif
@@ -61,9 +63,12 @@ namespace WebCore {
     extern WTFLogChannel LogFileAPI;
     extern WTFLogChannel LogWebAudio;
     extern WTFLogChannel LogCompositing;
+    extern WTFLogChannel LogGamepad;
 
     void initializeLoggingChannelsIfNecessary();
     WTFLogChannel* getChannelFromName(const String& channelName);
 }
 
+#endif // !LOG_DISABLED
+
 #endif // Logging_h
diff --git a/Source/WebCore/platform/MemoryPressureHandler.cpp b/Source/WebCore/platform/MemoryPressureHandler.cpp
index 982876d05..15e680862 100644
--- a/Source/WebCore/platform/MemoryPressureHandler.cpp
+++ b/Source/WebCore/platform/MemoryPressureHandler.cpp
@@ -42,7 +42,7 @@ MemoryPressureHandler::MemoryPressureHandler()
 {
 }
 
-#if !PLATFORM(MAC) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD) || PLATFORM(IOS)
+#if !PLATFORM(MAC) || defined(BUILDING_ON_SNOW_LEOPARD) || PLATFORM(IOS)
 void MemoryPressureHandler::install() { }
 
 void MemoryPressureHandler::uninstall() { }
diff --git a/Source/WebCore/platform/PlatformScreen.h b/Source/WebCore/platform/PlatformScreen.h
index e723308d3..df989a10b 100644
--- a/Source/WebCore/platform/PlatformScreen.h
+++ b/Source/WebCore/platform/PlatformScreen.h
@@ -53,7 +53,7 @@ namespace WebCore {
     FloatRect screenRect(Widget*);
     FloatRect screenAvailableRect(Widget*);
     // type can be "monitor" or the name of a profile such as "sRGB" or "Adobe RGB".
-    void screenColorProfile(Widget*, const String& type, ColorProfile&);
+    void screenColorProfile(Widget*, ColorProfile&);
 
 #if PLATFORM(MAC)
     NSScreen *screenForWindow(NSWindow *);
diff --git a/Source/WebCore/platform/SuddenTermination.h b/Source/WebCore/platform/SuddenTermination.h
index 810fea731..b66ae1abc 100644
--- a/Source/WebCore/platform/SuddenTermination.h
+++ b/Source/WebCore/platform/SuddenTermination.h
@@ -34,7 +34,7 @@ namespace WebCore {
     void disableSuddenTermination();
     void enableSuddenTermination();
 
-#if (!PLATFORM(MAC) || defined(BUILDING_ON_LEOPARD)) && !PLATFORM(CHROMIUM)
+#if !PLATFORM(MAC) && !PLATFORM(CHROMIUM)
     inline void disableSuddenTermination() { }
     inline void enableSuddenTermination() { }
 #endif
diff --git a/Source/WebCore/platform/audio/AudioFIFO.cpp b/Source/WebCore/platform/audio/AudioFIFO.cpp
new file mode 100644
index 000000000..961814189
--- /dev/null
+++ b/Source/WebCore/platform/audio/AudioFIFO.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioFIFO.h"
+
+namespace WebCore {
+
+AudioFIFO::AudioFIFO(unsigned numberOfChannels, size_t fifoLength)
+    : m_fifoAudioBus(numberOfChannels, fifoLength)
+    , m_fifoLength(fifoLength)
+    , m_framesInFifo(0)
+    , m_readIndex(0)
+    , m_writeIndex(0)
+{
+}
+
+void AudioFIFO::consume(AudioBus* destination, size_t framesToConsume)
+{
+    bool isGood = destination && (framesToConsume <= m_fifoLength) && (framesToConsume <= m_framesInFifo) && (destination->length() >= framesToConsume);
+    ASSERT(isGood);
+    if (!isGood)
+        return;
+
+    // Copy the requested number of samples to the destination.
+
+    size_t part1Length;
+    size_t part2Length;
+    findWrapLengths(m_readIndex, framesToConsume, part1Length, part2Length);
+
+    size_t numberOfChannels = m_fifoAudioBus.numberOfChannels();
+
+    for (size_t channelIndex = 0; channelIndex < numberOfChannels; ++channelIndex) {
+        float* destinationData = destination->channel(channelIndex)->mutableData();
+        const float* sourceData = m_fifoAudioBus.channel(channelIndex)->data();
+
+        bool isCopyGood = ((m_readIndex < m_fifoLength)
+                           && (m_readIndex + part1Length) <= m_fifoLength
+                           && (part1Length <= destination->length())
+                           && (part1Length + part2Length) <= destination->length());
+        ASSERT(isCopyGood);
+        if (!isCopyGood)
+            return;
+
+        memcpy(destinationData, sourceData + m_readIndex, part1Length * sizeof(*sourceData));
+        // Handle wrap around of the FIFO, if needed.
+        if (part2Length)
+            memcpy(destinationData + part1Length, sourceData, part2Length * sizeof(*sourceData));
+    }
+    m_readIndex = updateIndex(m_readIndex, framesToConsume);
+    ASSERT(m_framesInFifo >= framesToConsume);
+    m_framesInFifo -= framesToConsume;
+}
+
+void AudioFIFO::push(const AudioBus* sourceBus)
+{
+    // Copy the sourceBus into the FIFO buffer.
+
+    bool isGood = sourceBus && (m_framesInFifo + sourceBus->length() <= m_fifoLength);
+    if (!isGood)
+        return;
+
+    size_t sourceLength = sourceBus->length();
+    size_t part1Length;
+    size_t part2Length;
+    findWrapLengths(m_writeIndex, sourceLength, part1Length, part2Length);
+
+    size_t numberOfChannels = m_fifoAudioBus.numberOfChannels();
+
+    for (size_t channelIndex = 0; channelIndex < numberOfChannels; ++channelIndex) {
+        float* destination = m_fifoAudioBus.channel(channelIndex)->mutableData();
+        const float* source = sourceBus->channel(channelIndex)->data();
+
+        bool isCopyGood = ((m_writeIndex < m_fifoLength)
+                           && (m_writeIndex + part1Length) <= m_fifoLength
+                           && part2Length < m_fifoLength
+                           && part1Length + part2Length <= sourceLength);
+        ASSERT(isCopyGood);
+        if (!isCopyGood)
+            return;
+
+        memcpy(destination + m_writeIndex, source, part1Length * sizeof(*destination));
+
+        // Handle wrap around of the FIFO, if needed.
+        if (part2Length)
+            memcpy(destination, source + part1Length, part2Length * sizeof(*destination));
+    }
+        
+    m_framesInFifo += sourceLength;
+    ASSERT(m_framesInFifo <= m_fifoLength);
+    m_writeIndex = updateIndex(m_writeIndex, sourceLength);
+}
+
+void AudioFIFO::findWrapLengths(size_t index, size_t size, size_t& part1Length, size_t& part2Length)
+{
+    ASSERT(index < m_fifoLength && size <= m_fifoLength);
+    if (index < m_fifoLength && size <= m_fifoLength) {
+        if (index + size > m_fifoLength) {
+            // Need to wrap. Figure out the length of each piece.
+            part1Length = m_fifoLength - index;
+            part2Length = size - part1Length;
+        } else {
+            // No wrap needed.
+            part1Length = size;
+            part2Length = 0;
+        }
+    } else {
+        // Invalid values for index or size. Set the part lengths to zero so nothing is copied.
+        part1Length = 0;
+        part2Length = 0;
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/AudioFIFO.h b/Source/WebCore/platform/audio/AudioFIFO.h
new file mode 100644
index 000000000..f526f22e6
--- /dev/null
+++ b/Source/WebCore/platform/audio/AudioFIFO.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioFIFO_h
+#define AudioFIFO_h
+
+#include "AudioBus.h"
+
+namespace WebCore {
+
+class AudioFIFO {
+public:
+    // Create a FIFO large enough to hold |fifoLength| frames of data of |numberOfChannels| channels.
+    AudioFIFO(unsigned numberOfChannels, size_t fifoLength);
+
+    // Push the data from the bus into the FIFO.
+    void push(const AudioBus*);
+
+    // Consume |framesToConsume| frames of data from the FIFO and put them in |destination|. The
+    // corresponding frames are removed from the FIFO.
+    void consume(AudioBus* destination, size_t framesToConsume);
+
+    // Number of frames of data that are currently in the FIFO.
+    size_t framesInFifo() const { return m_framesInFifo; }
+
+private:
+    // Update the FIFO index by the step, with appropriate wrapping around the endpoint.
+    int updateIndex(int index, int step) { return (index + step) % m_fifoLength; }
+
+    void findWrapLengths(size_t index, size_t providerSize, size_t& part1Length, size_t& part2Length);
+    
+    // The FIFO itself. In reality, the FIFO is a circular buffer.
+    AudioBus m_fifoAudioBus;
+
+    // The total available space in the FIFO.
+    size_t m_fifoLength;
+
+    // The number of actual elements in the FIFO
+    size_t m_framesInFifo;
+
+    // Where to start reading from the FIFO.
+    size_t m_readIndex;
+
+    // Where to start writing to the FIFO.
+    size_t m_writeIndex;
+};
+
+} // namespace WebCore
+
+#endif // AudioFIFO.h
diff --git a/Source/WebCore/platform/audio/AudioPullFIFO.cpp b/Source/WebCore/platform/audio/AudioPullFIFO.cpp
index 03e89deba..261156709 100644
--- a/Source/WebCore/platform/audio/AudioPullFIFO.cpp
+++ b/Source/WebCore/platform/audio/AudioPullFIFO.cpp
@@ -36,11 +36,7 @@ namespace WebCore {
 
 AudioPullFIFO::AudioPullFIFO(AudioSourceProvider& audioProvider, unsigned numberOfChannels, size_t fifoLength, size_t providerSize)
     : m_provider(audioProvider)
-    , m_fifoAudioBus(numberOfChannels, fifoLength)
-    , m_fifoLength(fifoLength)
-    , m_framesInFifo(0)
-    , m_readIndex(0)
-    , m_writeIndex(0)
+    , m_fifo(numberOfChannels, fifoLength)
     , m_providerSize(providerSize)
     , m_tempBus(numberOfChannels, providerSize)
 {
@@ -48,64 +44,15 @@ AudioPullFIFO::AudioPullFIFO(AudioSourceProvider& audioProvider, unsigned number
 
 void AudioPullFIFO::consume(AudioBus* destination, size_t framesToConsume)
 {
-    bool isGood = destination && (framesToConsume <= m_fifoLength);
-    ASSERT(isGood);
-    if (!isGood)
+    if (!destination)
         return;
 
-    if (framesToConsume > m_framesInFifo) {
+    if (framesToConsume > m_fifo.framesInFifo()) {
         // We don't have enough data in the FIFO to fulfill the request. Ask for more data.
-        fillBuffer(framesToConsume - m_framesInFifo);
+        fillBuffer(framesToConsume - m_fifo.framesInFifo());
     }
 
-    // We have enough data now. Copy the requested number of samples to the destination.
-
-    size_t part1Length;
-    size_t part2Length;
-    findWrapLengths(m_readIndex, framesToConsume, part1Length, part2Length);
-
-    size_t numberOfChannels = m_fifoAudioBus.numberOfChannels();
-
-    for (size_t channelIndex = 0; channelIndex < numberOfChannels; ++channelIndex) {
-        float* destinationData = destination->channel(channelIndex)->mutableData();
-        const float* sourceData = m_fifoAudioBus.channel(channelIndex)->data();
-
-        bool isCopyGood = ((m_readIndex < m_fifoLength)
-                           && (m_readIndex + part1Length) <= m_fifoLength
-                           && (part1Length <= destination->length())
-                           && (part1Length + part2Length) <= destination->length());
-        ASSERT(isCopyGood);
-        if (!isCopyGood)
-            return;
-
-        memcpy(destinationData, sourceData + m_readIndex, part1Length * sizeof(*sourceData));
-        // Handle wrap around of the FIFO, if needed.
-        if (part2Length > 0)
-            memcpy(destinationData + part1Length, sourceData, part2Length * sizeof(*sourceData));
-    }
-    m_readIndex = updateIndex(m_readIndex, framesToConsume);
-    m_framesInFifo -= framesToConsume;
-    ASSERT(m_framesInFifo >= 0);
-}
-
-void AudioPullFIFO::findWrapLengths(size_t index, size_t size, size_t& part1Length, size_t& part2Length)
-{
-    ASSERT(index < m_fifoLength && size <= m_fifoLength);
-    if (index < m_fifoLength && size <= m_fifoLength) {
-        if (index + size > m_fifoLength) {
-            // Need to wrap. Figure out the length of each piece.
-            part1Length = m_fifoLength - index;
-            part2Length = size - part1Length;
-        } else {
-            // No wrap needed.
-            part1Length = size;
-            part2Length = 0;
-        }
-    } else {
-        // Invalid values for index or size. Set the part lengths to zero so nothing is copied.
-        part1Length = 0;
-        part2Length = 0;
-    }
+    m_fifo.consume(destination, framesToConsume);
 }
 
 void AudioPullFIFO::fillBuffer(size_t numberOfFrames)
@@ -117,34 +64,8 @@ void AudioPullFIFO::fillBuffer(size_t numberOfFrames)
     while (framesProvided < numberOfFrames) {
         m_provider.provideInput(&m_tempBus, m_providerSize);
 
-        size_t part1Length;
-        size_t part2Length;
-        findWrapLengths(m_writeIndex, m_providerSize, part1Length, part2Length);
-
-        size_t numberOfChannels = m_fifoAudioBus.numberOfChannels();
-        
-        for (size_t channelIndex = 0; channelIndex < numberOfChannels; ++channelIndex) {
-            float* destination = m_fifoAudioBus.channel(channelIndex)->mutableData();
-            const float* source = m_tempBus.channel(channelIndex)->data();
-
-            bool isCopyGood = (part1Length <= m_providerSize
-                               && (part1Length + part2Length) <= m_providerSize
-                               && (m_writeIndex < m_fifoLength)
-                               && (m_writeIndex + part1Length) <= m_fifoLength
-                               && part2Length < m_fifoLength);
-            ASSERT(isCopyGood);
-            if (!isCopyGood)
-                return;
-
-            memcpy(destination + m_writeIndex, source, part1Length * sizeof(*destination));
-            // Handle wrap around of the FIFO, if needed.
-            if (part2Length > 0)
-                memcpy(destination, source + part1Length, part2Length * sizeof(*destination));
-        }
+        m_fifo.push(&m_tempBus);
 
-        m_framesInFifo += m_providerSize;
-        ASSERT(m_framesInFifo <= m_fifoLength);
-        m_writeIndex = updateIndex(m_writeIndex, m_providerSize);
         framesProvided += m_providerSize;
     }
 }
diff --git a/Source/WebCore/platform/audio/AudioPullFIFO.h b/Source/WebCore/platform/audio/AudioPullFIFO.h
index fac19b9d1..33269ae28 100644
--- a/Source/WebCore/platform/audio/AudioPullFIFO.h
+++ b/Source/WebCore/platform/audio/AudioPullFIFO.h
@@ -30,6 +30,7 @@
 #define AudioPullFIFO_h
 
 #include "AudioBus.h"
+#include "AudioFIFO.h"
 #include "AudioSourceProvider.h"
 
 namespace WebCore {
@@ -52,31 +53,14 @@ public:
     void consume(AudioBus* destination, size_t framesToConsume);
 
 private:
-    // Update the FIFO index by the step, with appropriate wrapping around the endpoint.
-    int updateIndex(int index, int step) { return (index + step) % m_fifoLength; }
-
-    void findWrapLengths(size_t index, size_t providerSize, size_t& part1Length, size_t& part2Length);
-    
     // Fill the FIFO buffer with at least |numberOfFrames| more data.
     void fillBuffer(size_t numberOfFrames);
 
     // The provider of the data in our FIFO.
     AudioSourceProvider& m_provider;
 
-    // The FIFO itself. In reality, the FIFO is a circular buffer.
-    AudioBus m_fifoAudioBus;
-
-    // The total available space in the FIFO.
-    size_t m_fifoLength;
-
-    // The number of actual elements in the FIFO
-    size_t m_framesInFifo;
-
-    // Where to start reading from the FIFO.
-    size_t m_readIndex;
-
-    // Where to start writing to the FIFO.
-    size_t m_writeIndex;
+    // The actual FIFO
+    AudioFIFO m_fifo;
 
     // Number of frames of data that the provider will produce per call.
     unsigned int m_providerSize;
diff --git a/Source/WebCore/platform/blackberry/LoggingBlackBerry.cpp b/Source/WebCore/platform/blackberry/LoggingBlackBerry.cpp
index 994d78ec9..1d665bc92 100644
--- a/Source/WebCore/platform/blackberry/LoggingBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/LoggingBlackBerry.cpp
@@ -19,6 +19,8 @@
 #include "config.h"
 #include "Logging.h"
 
+#if !LOG_DISABLED
+
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
@@ -53,3 +55,5 @@ void initializeLoggingChannelsIfNecessary()
 }
 
 } // namespace WebCore
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp b/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
index ba8e16bf8..44c6d8ec0 100644
--- a/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
@@ -30,107 +30,19 @@
 #include "MIMETypeRegistry.h"
 
 #include "NotImplemented.h"
+#include <BlackBerryPlatformCommonFunctions.h>
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
-struct ExtensionMap {
-    const char* extension;
-    const char* mimeType;
-};
-
-static const ExtensionMap extensionMap[] = {
-    { "bmp", "image/bmp" },
-    { "css", "text/css" },
-    { "gif", "image/gif" },
-    { "html", "text/html" },
-    { "htm", "text/html" },
-    { "ico", "image/x-icon" },
-    { "jpg", "image/jpeg" },
-    { "jpeg", "image/jpeg" },
-    { "js", "application/x-javascript" },
-    { "mng", "video/x-mng" },
-    { "pbm", "image/x-portable-bitmap" },
-    { "pgm", "image/x-portable-graymap" },
-    { "pdf", "application/pdf" },
-    { "png", "image/png" },
-    { "ppm", "image/x-portable-pixmap" },
-    { "rss", "application/rss+xml" },
-    { "svg", "image/svg+xml" },
-    { "svgz", "image/svg+xml" },
-    { "txt", "text/plain" },
-    { "text", "text/plain" },
-    { "tiff", "image/tiff" },
-    { "tif", "image/tiff" },
-    { "xbm", "image/x-xbitmap" },
-    { "xml", "text/xml" },
-    { "xpm", "image/x-xpm" },
-    { "xsl", "text/xsl" },
-    { "xhtml", "application/xhtml+xml" },
-    { "m4a", "audio/m4a" },
-    { "midi", "audio/midi" },
-    { "mid", "audio/mid" },
-    { "mp3", "audio/mp3" },
-    { "wma", "audio/x-ms-wma" },
-    { "3gp", "video/3gpp" },
-    { "3gpp", "video/3gpp" },
-    { "3gpp2", "video/3gpp2" },
-    { "3g2", "video/3gpp2" },
-    { "3gp2", "video/3gpp2" },
-    { "mp4", "video/mp4" },
-    { "m4v", "video/m4v" },
-    { "avi", "video/x-msvideo" },
-    { "mov", "video/quicktime" },
-    { "divx", "video/divx" },
-    { "mpeg", "video/mpeg" },
-    { "sbv", "video/sbv" },
-    { "asf", "video/x-ms-asf" },
-    { "wm", "video/x-ms-wm" },
-    { "wmv", "video/x-ms-wmv" },
-    { "wmx", "video/x-ms-wmx" },
-    { "wav", "audio/x-wav" },
-    { "amr", "audio/amr" },
-    { "aac", "audio/aac" },
-    { "x-gsm", "audio/x-gsm" },
-    { "swf", "application/x-shockwave-flash" },
-    { "m3u8", "application/vnd.apple.mpegurl" },
-    { "m3url", "audio/mpegurl" },
-    { "m3u", "audio/mpegurl" },
-    { "flac", "audio/x-flac" },
-    { "ogg", "audio/ogg" },
-    { "oga", "audio/ogg" },
-    // FIXME: wince also maps ttf and otf to text/plain. Should we do that too?
-    { 0, 0 }
-};
-
 String MIMETypeRegistry::getMIMETypeForExtension(const String& extension)
 {
-    String lowerExtension = extension.lower();
-
-    const ExtensionMap* entry = extensionMap;
-    while (entry->extension) {
-        if (lowerExtension == entry->extension)
-            return entry->mimeType;
-        ++entry;
-    }
-
-    return String();
+    return String(BlackBerry::Platform::getMIMETypeForExtension(extension.lower().utf8().data()).c_str());
 }
 
 String MIMETypeRegistry::getPreferredExtensionForMIMEType(const String& type)
 {
-    if (type.isEmpty())
-        return String();
-
-    String lowerType = type.lower();
-
-    const ExtensionMap* entry = extensionMap;
-    while (entry->mimeType) {
-        if (lowerType == entry->mimeType)
-            return entry->extension;
-        ++entry;
-    }
-
-    return String();
+    return String(BlackBerry::Platform::getPreferredExtensionForMIMEType(type.lower().utf8().data()).c_str());
 }
 
 bool MIMETypeRegistry::isApplicationPluginMIMEType(const String&)
diff --git a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
index 00244acc7..592539cd4 100644
--- a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
@@ -64,7 +64,7 @@ FloatRect screenRect(Widget* widget)
     return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::primaryScreen()->size())));
 }
 
-void screenColorProfile(Widget*, const String&, ColorProfile&)
+void screenColorProfile(Widget*, ColorProfile&)
 {
     notImplemented();
 }
diff --git a/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp b/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp
index a85c08973..46f33dafd 100644
--- a/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp
+++ b/Source/WebCore/platform/chromium/PlatformScreenChromium.cpp
@@ -73,11 +73,11 @@ FloatRect screenAvailableRect(Widget* widget)
     return PlatformSupport::screenAvailableRect(widget);
 }
 
-void screenColorProfile(Widget*, const String& type, ColorProfile& toProfile)
+void screenColorProfile(Widget*, ColorProfile& toProfile)
 {
     // FIXME: Add support for multiple monitors.
     WebKit::WebVector<char> profile;
-    WebKit::Platform::current()->screenColorProfile(WebKit::WebString(type), &profile);
+    WebKit::Platform::current()->screenColorProfile(&profile);
     toProfile.append(profile.data(), profile.size());
 }
 
diff --git a/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp b/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
index eefd154e8..cb259f051 100644
--- a/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
+++ b/Source/WebCore/platform/chromium/support/WebTransformationMatrix.cpp
@@ -422,16 +422,6 @@ TransformationMatrix WebTransformationMatrix::toWebCoreTransform() const
     return m_private;
 }
 
-FloatRect WebTransformationMatrix::mapRect(const FloatRect& rect) const
-{
-    return m_private.mapRect(rect);
-}
-
-IntRect WebTransformationMatrix::mapRect(const IntRect& rect) const
-{
-    return m_private.mapRect(rect);
-}
-
 FloatPoint3D WebTransformationMatrix::mapPoint(const FloatPoint3D& p) const
 {
     return m_private.mapPoint(p);
@@ -447,14 +437,4 @@ IntPoint WebTransformationMatrix::mapPoint(const IntPoint& p) const
     return m_private.mapPoint(p);
 }
 
-FloatQuad WebTransformationMatrix::mapQuad(const FloatQuad& quad) const
-{
-    return m_private.mapQuad(quad);
-}
-
-FloatPoint WebTransformationMatrix::projectPoint(const FloatPoint& p, bool* clamped) const
-{
-    return m_private.projectPoint(p, clamped);
-}
-
 } // namespace WebKit
diff --git a/Source/WebCore/platform/efl/BatteryProviderEfl.cpp b/Source/WebCore/platform/efl/BatteryProviderEfl.cpp
new file mode 100644
index 000000000..c5d030a3d
--- /dev/null
+++ b/Source/WebCore/platform/efl/BatteryProviderEfl.cpp
@@ -0,0 +1,179 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "BatteryProviderEfl.h"
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "BatteryProviderEflClient.h"
+#include "EventNames.h"
+#include <E_Ukit.h>
+#include <limits>
+
+namespace WebCore {
+
+BatteryProviderEfl::BatteryProviderEfl(BatteryProviderEflClient* client)
+    : m_client(client)
+    , m_timer(this, &BatteryProviderEfl::timerFired)
+    , m_batteryStatusRefreshInterval(1.0)
+{
+}
+
+BatteryStatus* BatteryProviderEfl::batteryStatus() const
+{
+    return m_batteryStatus.get();
+}
+
+void BatteryProviderEfl::startUpdating()
+{
+    if (m_timer.isActive())
+        return;
+
+    if (!e_dbus_init())
+        return;
+
+    if (!e_ukit_init()) {
+        e_dbus_shutdown();
+        return;
+    }
+
+    m_timer.startRepeating(m_batteryStatusRefreshInterval);
+}
+
+void BatteryProviderEfl::stopUpdating()
+{
+    m_timer.stop();
+    e_ukit_shutdown();
+    e_dbus_shutdown();
+}
+
+void BatteryProviderEfl::setBatteryStatus(const AtomicString& eventType, PassRefPtr<BatteryStatus> batteryStatus)
+{
+    m_batteryStatus = batteryStatus;
+    m_client->didChangeBatteryStatus(eventType, m_batteryStatus);
+}
+
+void BatteryProviderEfl::timerFired(Timer<BatteryProviderEfl>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_timer);
+    E_DBus_Connection* edbusConnection = e_dbus_bus_get(DBUS_BUS_SYSTEM);
+    if (edbusConnection)
+        e_upower_get_all_devices(edbusConnection, getBatteryStatus, static_cast<void*>(this));
+}
+
+void BatteryProviderEfl::getBatteryStatus(void* data, void* replyData, DBusError* dBusError)
+{
+    E_Ukit_Get_All_Devices_Return* eukitDeviceNames = static_cast<E_Ukit_Get_All_Devices_Return*>(replyData);
+    if (!eukitDeviceNames || !eukitDeviceNames->strings || dbus_error_is_set(dBusError)) {
+         dbus_error_free(dBusError);
+         return;
+    }
+
+    E_DBus_Connection* edbusConnection = e_dbus_bus_get(DBUS_BUS_SYSTEM);
+    Eina_List* list;
+    void* deviceName;
+    EINA_LIST_FOREACH(eukitDeviceNames->strings, list, deviceName)
+        e_upower_get_all_properties(edbusConnection, static_cast<char*>(deviceName), setBatteryClient, data);
+}
+
+void BatteryProviderEfl::setBatteryClient(void* data, void* replyData, DBusError* dBusError)
+{
+    E_Ukit_Get_All_Properties_Return* eukitPropertyNames = static_cast<E_Ukit_Get_All_Properties_Return*>(replyData);
+
+    if (!eukitPropertyNames || dbus_error_is_set(dBusError)) {
+        dbus_error_free(dBusError);
+        return;
+    }
+
+    if (!eukitPropertyNames->properties)
+        return;
+
+    E_Ukit_Property* property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "Type"));
+    if (!property || property->val.u != E_UPOWER_SOURCE_BATTERY)
+        return;
+
+    BatteryProviderEfl* client = static_cast<BatteryProviderEfl*>(data);
+    BatteryStatus* clientBatteryStatus = client->batteryStatus();
+    bool charging = false;
+    bool chargingChanged = false;
+    static unsigned chargingState = 0;
+
+    property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "State"));
+    if (!property)
+        return;
+    if (!clientBatteryStatus || chargingState != property->val.u) {
+        chargingChanged = true;
+        chargingState = property->val.u;
+        (chargingState == E_UPOWER_STATE_FULL || chargingState == E_UPOWER_STATE_CHARGING) ? charging = true : charging = false;
+    } else
+        charging = clientBatteryStatus->charging();
+
+    bool chargingTimeChanged = false;
+    bool dischargingTimeChanged = false;
+    double chargingTime = std::numeric_limits<double>::infinity();
+    double dischargingTime = std::numeric_limits<double>::infinity();
+
+    if (charging) {
+        if (!clientBatteryStatus || clientBatteryStatus->dischargingTime() != std::numeric_limits<double>::infinity())
+            dischargingTimeChanged = true;
+        dischargingTime = std::numeric_limits<double>::infinity();
+        property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "TimeToFull"));
+        if (!property)
+            return;
+        if (!clientBatteryStatus || clientBatteryStatus->chargingTime() != property->val.x)
+            chargingTimeChanged = true;
+        chargingTime = property->val.x;
+    } else {
+        if (!clientBatteryStatus || clientBatteryStatus->chargingTime() != std::numeric_limits<double>::infinity())
+            chargingTimeChanged = true;
+        chargingTime = std::numeric_limits<double>::infinity();
+        property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "TimeToEmpty"));
+        if (!property)
+            return;
+        if (!clientBatteryStatus || clientBatteryStatus->dischargingTime() != property->val.x)
+            dischargingTimeChanged = true;
+        dischargingTime = property->val.x;
+    }
+
+    double level = 0;
+    bool levelChanged = false;
+
+    property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "Percentage"));
+    if (!property)
+        return;
+    if (!clientBatteryStatus || clientBatteryStatus->level() != property->val.d)
+        levelChanged = true;
+    level = property->val.d;
+
+    WTF::RefPtr<BatteryStatus> batteryStatus = BatteryStatus::create(charging, chargingTime, dischargingTime, level);
+    if (chargingChanged)
+        client->setBatteryStatus(eventNames().chargingchangeEvent, batteryStatus);
+    if (chargingTimeChanged)
+        client->setBatteryStatus(eventNames().chargingtimechangeEvent, batteryStatus);
+    if (dischargingTimeChanged)
+        client->setBatteryStatus(eventNames().dischargingtimechangeEvent, batteryStatus);
+    if (levelChanged)
+        client->setBatteryStatus(eventNames().levelchangeEvent, batteryStatus);
+}
+
+}
+
+#endif // BATTERY_STATUS
+
diff --git a/Source/WebCore/platform/efl/BatteryProviderEfl.h b/Source/WebCore/platform/efl/BatteryProviderEfl.h
new file mode 100644
index 000000000..bb4bb7f04
--- /dev/null
+++ b/Source/WebCore/platform/efl/BatteryProviderEfl.h
@@ -0,0 +1,62 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef BatteryProviderEfl_h
+#define BatteryProviderEfl_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "BatteryClient.h"
+#include "BatteryStatus.h"
+#include "Timer.h"
+#include <wtf/text/AtomicString.h>
+
+typedef struct DBusError DBusError;
+
+namespace WebCore {
+
+class BatteryProviderEflClient;
+
+class BatteryProviderEfl {
+public:
+    BatteryProviderEfl(BatteryProviderEflClient*);
+    ~BatteryProviderEfl() { }
+
+    virtual void startUpdating();
+    virtual void stopUpdating();
+
+    void setBatteryStatus(const AtomicString& eventType, PassRefPtr<BatteryStatus>);
+    BatteryStatus* batteryStatus() const;
+
+private:
+    void timerFired(Timer<BatteryProviderEfl>*);
+    static void getBatteryStatus(void* data, void* replyData, DBusError*);
+    static void setBatteryClient(void* data, void* replyData, DBusError*);
+
+    BatteryProviderEflClient* m_client;
+    Timer<BatteryProviderEfl> m_timer;
+    RefPtr<BatteryStatus> m_batteryStatus;
+    const double m_batteryStatusRefreshInterval;
+};
+
+}
+
+#endif // ENABLE(BATTERY_STATUS)
+#endif // BatteryProviderEfl_h
+
diff --git a/Source/WebCore/platform/efl/BatteryProviderEflClient.h b/Source/WebCore/platform/efl/BatteryProviderEflClient.h
new file mode 100644
index 000000000..c3ed8d02c
--- /dev/null
+++ b/Source/WebCore/platform/efl/BatteryProviderEflClient.h
@@ -0,0 +1,40 @@
+/*
+ *  Copyright (C) 2012 Samsung Electronics.  All rights reserved.
+ *  Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef BatteryProviderEflClient_h
+#define BatteryProviderEflClient_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "BatteryStatus.h"
+#include <wtf/text/AtomicString.h>
+
+namespace WebCore {
+
+class BatteryProviderEflClient {
+public:
+    virtual void didChangeBatteryStatus(const AtomicString& eventType, PassRefPtr<BatteryStatus>) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(BATTERY_STATUS)
+
+#endif // BatteryProviderEflClient_h
diff --git a/Source/WebCore/platform/efl/FileSystemEfl.cpp b/Source/WebCore/platform/efl/FileSystemEfl.cpp
index c6bff150a..407882279 100644
--- a/Source/WebCore/platform/efl/FileSystemEfl.cpp
+++ b/Source/WebCore/platform/efl/FileSystemEfl.cpp
@@ -70,7 +70,7 @@ bool unloadModule(PlatformModule module)
     // caution, closing handle will make memory vanish and any remaining
     // timer, idler, threads or any other left-over will crash,
     // maybe just ignore this is a safer solution?
-    return !dlclose(module);
+    return eina_module_free(module);
 }
 
 String homeDirectoryPath()
@@ -91,6 +91,12 @@ Vector<String> listDirectory(const String& path, const String& filter)
     const char *f_name;
 
     Eina_Iterator* it = eina_file_ls(path.utf8().data());
+    // FIXME: Early return if the iterator is null to avoid error messages from eina_iterator_free().
+    // This check can be removed once the magic check on _free() removed in Eina.
+    // http://www.mail-archive.com/enlightenment-devel@lists.sourceforge.net/msg42944.html
+    if (!it)
+        return matchingEntries;
+
     EINA_ITERATOR_FOREACH(it, f_name) {
         if (!fnmatch(cfilter.data(), f_name, 0))
             matchingEntries.append(String::fromUTF8(f_name));
diff --git a/Source/WebCore/platform/efl/GamepadsEfl.cpp b/Source/WebCore/platform/efl/GamepadsEfl.cpp
new file mode 100644
index 000000000..f67ba42e9
--- /dev/null
+++ b/Source/WebCore/platform/efl/GamepadsEfl.cpp
@@ -0,0 +1,244 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Gamepads.h"
+
+#if ENABLE(GAMEPAD)
+
+#include "GamepadDeviceLinux.h"
+#include "GamepadList.h"
+#include "Logging.h"
+#include <Ecore.h>
+#include <Eeze.h>
+#include <Eina.h>
+#include <unistd.h>
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+static const char joystickPrefix[] = "/dev/input/js";
+
+class GamepadDeviceEfl : public GamepadDeviceLinux {
+public:
+    static PassOwnPtr<GamepadDeviceEfl> create(const String& deviceFile)
+    {
+        return adoptPtr(new GamepadDeviceEfl(deviceFile));
+    }
+    ~GamepadDeviceEfl();
+    void resetFdHandler() { m_fdHandler = 0; }
+    const String& deviceFile() const { return m_deviceFile; }
+
+private:
+    GamepadDeviceEfl(const String& deviceFile);
+    static Eina_Bool readCallback(void* userData, Ecore_Fd_Handler*);
+
+    Ecore_Fd_Handler* m_fdHandler;
+    String m_deviceFile;
+};
+
+GamepadDeviceEfl::GamepadDeviceEfl(const String& deviceFile)
+    : GamepadDeviceLinux(deviceFile)
+    , m_fdHandler(0)
+    , m_deviceFile(deviceFile)
+{
+    if (m_fileDescriptor < 0)
+        return;
+
+    m_fdHandler = ecore_main_fd_handler_add(m_fileDescriptor, ECORE_FD_READ, readCallback, this, 0, 0);
+    if (!m_fdHandler)
+        LOG_ERROR("Failed to create the Ecore_Fd_Handler.");
+}
+
+GamepadDeviceEfl::~GamepadDeviceEfl()
+{
+    if (m_fdHandler)
+        ecore_main_fd_handler_del(m_fdHandler);
+}
+
+Eina_Bool GamepadDeviceEfl::readCallback(void* userData, Ecore_Fd_Handler* fdHandler)
+{
+    GamepadDeviceEfl* gamepadDevice = static_cast<GamepadDeviceEfl*>(userData);
+
+    if (ecore_main_fd_handler_active_get(fdHandler, ECORE_FD_ERROR)) {
+        LOG_ERROR("An error occurred while watching the joystick file descriptor at %s, aborting.", gamepadDevice->deviceFile().utf8().data());
+        gamepadDevice->resetFdHandler();
+        return ECORE_CALLBACK_CANCEL;
+    }
+
+    int fdDevice = ecore_main_fd_handler_fd_get(fdHandler);
+    struct js_event event;
+    const ssize_t len = read(fdDevice, &event, sizeof(event));
+
+    if (len <= 0) {
+        LOG_ERROR("Failed to read joystick file descriptor at %s, aborting.", gamepadDevice->deviceFile().utf8().data());
+        gamepadDevice->resetFdHandler();
+        return ECORE_CALLBACK_CANCEL;
+    }
+    if (len != sizeof(event)) {
+        LOG_ERROR("Wrong js_event size read on file descriptor at %s, ignoring.", gamepadDevice->deviceFile().utf8().data());
+        return ECORE_CALLBACK_RENEW;
+    }
+
+    gamepadDevice->updateForEvent(event);
+    return ECORE_CALLBACK_RENEW;
+}
+
+class GamepadsEfl {
+public:
+    GamepadsEfl(size_t length);
+
+    void registerDevice(const String& syspath);
+    void unregisterDevice(const String& syspath);
+
+    void updateGamepadList(GamepadList*);
+
+private:
+    ~GamepadsEfl();
+    static void onGamePadChange(const char* syspath, Eeze_Udev_Event, void* userData, Eeze_Udev_Watch* watcher);
+
+    Vector<OwnPtr<GamepadDeviceEfl> > m_slots;
+    HashMap<String, GamepadDeviceEfl*> m_deviceMap;
+
+    Eeze_Udev_Watch* m_gamepadsWatcher;
+};
+
+void GamepadsEfl::onGamePadChange(const char* syspath, Eeze_Udev_Event event, void* userData, Eeze_Udev_Watch* watcher)
+{
+    GamepadsEfl* gamepadsEfl = static_cast<GamepadsEfl*>(userData);
+
+    switch (event) {
+    case EEZE_UDEV_EVENT_ADD:
+        gamepadsEfl->registerDevice(String::fromUTF8(syspath));
+        break;
+    case EEZE_UDEV_EVENT_REMOVE:
+        gamepadsEfl->unregisterDevice(String::fromUTF8(syspath));
+        break;
+    default:
+        break;
+    }
+}
+
+GamepadsEfl::GamepadsEfl(size_t length)
+    : m_slots(length)
+    , m_gamepadsWatcher(0)
+{
+    if (eeze_init() < 0) {
+        LOG_ERROR("Failed to initialize eeze library.");
+        return;
+    }
+
+    // Watch for gamepads additions / removals.
+    m_gamepadsWatcher = eeze_udev_watch_add(EEZE_UDEV_TYPE_JOYSTICK, (EEZE_UDEV_EVENT_ADD | EEZE_UDEV_EVENT_REMOVE), onGamePadChange, this);
+
+    // List available gamepads.
+    Eina_List* gamepads = eeze_udev_find_by_type(EEZE_UDEV_TYPE_JOYSTICK, 0);
+    void* data;
+    EINA_LIST_FREE(gamepads, data) {
+        char* syspath = static_cast<char*>(data);
+        registerDevice(String::fromUTF8(syspath));
+        eina_stringshare_del(syspath);
+    }
+}
+
+GamepadsEfl::~GamepadsEfl()
+{
+    if (m_gamepadsWatcher)
+        eeze_udev_watch_del(m_gamepadsWatcher);
+    eeze_shutdown();
+}
+
+void GamepadsEfl::registerDevice(const String& syspath)
+{
+    if (m_deviceMap.contains(syspath))
+        return;
+
+    // Make sure it is a valid joystick.
+    const char* deviceFile = eeze_udev_syspath_get_devpath(syspath.utf8().data());
+    if (!deviceFile || !eina_str_has_prefix(deviceFile, joystickPrefix))
+        return;
+
+    LOG(Gamepad, "Registering gamepad at %s", deviceFile);
+
+    const size_t slotCount = m_slots.size();
+    for (size_t index = 0; index < slotCount; ++index) {
+        if (!m_slots[index]) {
+            m_slots[index] = GamepadDeviceEfl::create(String::fromUTF8(deviceFile));
+            LOG(Gamepad, "Gamepad device name is %s", m_slots[index]->id().utf8().data());
+            m_deviceMap.add(syspath, m_slots[index].get());
+            break;
+        }
+    }
+}
+
+void GamepadsEfl::unregisterDevice(const String& syspath)
+{
+    if (!m_deviceMap.contains(syspath))
+        return;
+
+    GamepadDeviceEfl* gamepadDevice = m_deviceMap.take(syspath);
+    LOG(Gamepad, "Unregistering gamepad at %s", gamepadDevice->deviceFile().utf8().data());
+    const size_t index = m_slots.find(gamepadDevice);
+    ASSERT(index != notFound);
+
+    m_slots[index].clear();
+}
+
+void GamepadsEfl::updateGamepadList(GamepadList* into)
+{
+    ASSERT(m_slots.size() == into->length());
+
+    const size_t slotCount = m_slots.size();
+    for (size_t i = 0; i < slotCount; ++i) {
+        if (m_slots[i].get() && m_slots[i]->connected()) {
+            GamepadDeviceEfl* gamepadDevice = m_slots[i].get();
+            RefPtr<Gamepad> gamepad = into->item(i);
+            if (!gamepad)
+                gamepad = Gamepad::create();
+
+            gamepad->index(i);
+            gamepad->id(gamepadDevice->id());
+            gamepad->timestamp(gamepadDevice->timestamp());
+            gamepad->axes(gamepadDevice->axesCount(), gamepadDevice->axesData());
+            gamepad->buttons(gamepadDevice->buttonsCount(), gamepadDevice->buttonsData());
+
+            into->set(i, gamepad);
+        } else
+            into->set(i, 0);
+    }
+}
+
+void sampleGamepads(GamepadList* into)
+{
+    DEFINE_STATIC_LOCAL(GamepadsEfl, gamepadsEfl, (into->length()));
+    gamepadsEfl.updateGamepadList(into);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(GAMEPAD)
diff --git a/Source/WebCore/platform/efl/LanguageEfl.cpp b/Source/WebCore/platform/efl/LanguageEfl.cpp
index 2b0a13dd8..6aeadb4b9 100644
--- a/Source/WebCore/platform/efl/LanguageEfl.cpp
+++ b/Source/WebCore/platform/efl/LanguageEfl.cpp
@@ -43,7 +43,13 @@ static String platformLanguage()
     if (!localeDefault)
         return String("c");
 
-    return String(localeDefault).replace('_', '-');
+    String locale = String(localeDefault);
+    locale.replace('_', '-');
+    size_t position = locale.find('.');
+    if (position != notFound)
+        locale = locale.left(position);
+
+    return locale;
 }
 
 Vector<String> platformUserPreferredLanguages()
diff --git a/Source/WebCore/platform/efl/LoggingEfl.cpp b/Source/WebCore/platform/efl/LoggingEfl.cpp
index bd711484a..79cf004f5 100644
--- a/Source/WebCore/platform/efl/LoggingEfl.cpp
+++ b/Source/WebCore/platform/efl/LoggingEfl.cpp
@@ -23,6 +23,8 @@
 #include "config.h"
 #include "Logging.h"
 
+#if !LOG_DISABLED
+
 #include "PlatformString.h"
 #include <Eina.h>
 
@@ -62,3 +64,5 @@ void initializeLoggingChannelsIfNecessary()
 }
 
 }
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/platform/efl/PlatformScreenEfl.cpp b/Source/WebCore/platform/efl/PlatformScreenEfl.cpp
index 5010f1851..5332c2fbf 100644
--- a/Source/WebCore/platform/efl/PlatformScreenEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformScreenEfl.cpp
@@ -86,6 +86,8 @@ FloatRect screenRect(Widget* widget)
 
     int x, y, w, h;
     Evas* e = widget->evas();
+    if (!e)
+        return FloatRect();
 
     ecore_evas_screen_geometry_get(ecore_evas_ecore_evas_get(e), &x, &y, &w, &h);
 
@@ -98,7 +100,7 @@ FloatRect screenAvailableRect(Widget* widget)
     return screenRect(widget);
 }
 
-void screenColorProfile(Widget*, const String&, ColorProfile&)
+void screenColorProfile(Widget*, ColorProfile&)
 {
     notImplemented();
 }
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index 7d27b96d0..462ee946e 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -82,9 +82,9 @@ void RenderThemeEfl::adjustSizeConstraints(RenderStyle* style, FormType type) co
 {
     const struct ThemePartDesc* desc = m_partDescs + (size_t)type;
 
-    if (style->minWidth().isIntrinsicOrAuto())
+    if (style->minWidth().isIntrinsic())
         style->setMinWidth(desc->min.width());
-    if (style->minHeight().isIntrinsicOrAuto())
+    if (style->minHeight().isIntrinsic())
         style->setMinHeight(desc->min.height());
 
     if (desc->max.width().value() > 0 && style->maxWidth().isIntrinsicOrAuto())
diff --git a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
index c93166659..595d16a4f 100644
--- a/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
+++ b/Source/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "ANGLEWebKitBridge.h"
 #include <wtf/OwnArrayPtr.h>
@@ -117,4 +117,4 @@ bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShad
 
 }
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/BitmapImage.cpp b/Source/WebCore/platform/graphics/BitmapImage.cpp
index 8bc97227f..04528591a 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.cpp
+++ b/Source/WebCore/platform/graphics/BitmapImage.cpp
@@ -263,9 +263,12 @@ String BitmapImage::filenameExtension() const
 size_t BitmapImage::frameCount()
 {
     if (!m_haveFrameCount) {
-        m_haveFrameCount = true;
         m_frameCount = m_source.frameCount();
-        didDecodeProperties();
+        // If decoder is not initialized yet, m_source.frameCount() returns 0.
+        if (m_frameCount) {
+            didDecodeProperties();
+            m_haveFrameCount = true;
+        }
     }
     return m_frameCount;
 }
@@ -319,8 +322,10 @@ NativeImagePtr BitmapImage::nativeImageForCurrentFrame()
 
 bool BitmapImage::frameHasAlphaAtIndex(size_t index)
 {
+    // When a frame has not finished decoding, always mark it as having alpha.
+    // See ImageSource::framehasAlphaAtIndex for explanation of why incomplete images claim to have alpha.
     if (!ensureFrameIsCached(index))
-        return true; // Why does an invalid index mean alpha?
+        return true;
     return m_frames[index].m_hasAlpha;
 }
 
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index 64c81c791..21885cdd4 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -112,7 +112,7 @@ public:
     {
         return adoptRef(new BitmapImage(observer));
     }
-    ~BitmapImage();
+    virtual ~BitmapImage();
     
     virtual bool isBitmapImage() const;
 
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
index b765f4046..38b089268 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
 
@@ -1833,4 +1833,4 @@ unsigned GraphicsContext3D::getChannelBitsByFormat(GC3Denum format)
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index dbd9dfede..51eef09c5 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef GraphicsContext3D_h
@@ -91,14 +91,12 @@ const Platform3DObject NullPlatform3DObject = 0;
 #include <CoreGraphics/CGContext.h>
 #endif
 
-#if PLATFORM(BLACKBERRY)
-#include <GLES2/gl2.h>
-#endif
-
 namespace WebCore {
 class DrawingBuffer;
 class Extensions3D;
-#if PLATFORM(MAC) || PLATFORM(GTK) || PLATFORM(QT) || PLATFORM(EFL)
+#if USE(OPENGL_ES_2)
+class Extensions3DOpenGLES;
+#else
 class Extensions3DOpenGL;
 #endif
 #if PLATFORM(QT)
@@ -924,6 +922,7 @@ public:
     // in particular stencil and antialias, and determine which could or
     // could not be honored based on the capabilities of the OpenGL
     // implementation.
+    void validateDepthStencil(const char* packedDepthStencilExtension);
     void validateAttributes();
 
     // Read rendering results into a pixel array with the same format as the
@@ -955,16 +954,30 @@ public:
     HashMap<Platform3DObject, ShaderSourceEntry> m_shaderSourceMap;
 
     ANGLEWebKitBridge m_compiler;
+#endif
 
+#if PLATFORM(QT) && defined(QT_OPENGL_ES_2)
+    friend class Extensions3DQt;
+    OwnPtr<Extensions3DQt> m_extensions;
+#elif PLATFORM(BLACKBERRY)
+    friend class Extensions3DOpenGLES;
+    OwnPtr<Extensions3DOpenGLES> m_extensions;
+#elif !PLATFORM(CHROMIUM)
     friend class Extensions3DOpenGL;
     OwnPtr<Extensions3DOpenGL> m_extensions;
+#endif
+    friend class Extensions3DOpenGLCommon;
 
     Attributes m_attrs;
     Vector<Vector<float> > m_vertexArray;
 
-    GC3Duint m_texture, m_compositorTexture;
+    GC3Duint m_texture;
+#if !PLATFORM(BLACKBERRY)
+    GC3Duint m_compositorTexture;
+#endif
     GC3Duint m_fbo;
-#if USE(OPENGL_ES_2)
+
+#if !PLATFORM(BLACKBERRY)
     GC3Duint m_depthBuffer;
     GC3Duint m_stencilBuffer;
 #endif
@@ -985,10 +998,11 @@ public:
 
     // Errors raised by synthesizeGLError().
     ListHashSet<GC3Denum> m_syntheticErrors;
-#endif
 
     friend class GraphicsContext3DPrivate;
     OwnPtr<GraphicsContext3DPrivate> m_private;
+
+    bool systemAllowsMultisamplingOnATICards() const;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.cpp b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
index 10d7b7fc8..9a52fb67b 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -509,13 +509,13 @@ int GraphicsLayer::validateTransformOperations(const KeyframeValueList& valueLis
     return firstIndex;
 }
 
-double GraphicsLayer::backingStoreArea() const
+double GraphicsLayer::backingStoreMemoryEstimate() const
 {
     if (!drawsContent())
         return 0;
     
     // Effects of page and device scale are ignored; subclasses should override to take these into account.
-    return static_cast<double>(size().width()) * size().height();
+    return static_cast<double>(4 * size().width()) * size().height();
 }
 
 static void writeIndent(TextStream& ts, int indent)
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index 16c73a483..7939717fa 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -38,51 +38,12 @@
 #include "FloatSize.h"
 #include "GraphicsLayerClient.h"
 #include "IntRect.h"
+#include "PlatformLayer.h"
 #include "TransformationMatrix.h"
 #include "TransformOperations.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
-#if PLATFORM(MAC)
-OBJC_CLASS CALayer;
-typedef CALayer PlatformLayer;
-#elif PLATFORM(WIN)
-typedef struct _CACFLayer PlatformLayer;
-#elif PLATFORM(QT)
-#if USE(TEXTURE_MAPPER)
-namespace WebCore {
-class TextureMapperPlatformLayer;
-typedef TextureMapperPlatformLayer PlatformLayer;
-};
-#else
-QT_BEGIN_NAMESPACE
-class QGraphicsObject;
-QT_END_NAMESPACE
-namespace WebCore {
-typedef QGraphicsObject PlatformLayer;
-}
-#endif
-#elif PLATFORM(CHROMIUM)
-namespace WebCore {
-class LayerChromium;
-typedef LayerChromium PlatformLayer;
-}
-#elif PLATFORM(GTK)
-#if USE(TEXTURE_MAPPER_CAIRO) || USE(TEXTURE_MAPPER_GL)
-namespace WebCore {
-class TextureMapperPlatformLayer;
-typedef TextureMapperPlatformLayer PlatformLayer;
-};
-#elif USE(CLUTTER)
-typedef struct _ClutterActor ClutterActor;
-namespace WebCore {
-typedef ClutterActor PlatformLayer;
-};
-#endif
-#else
-typedef void* PlatformLayer;
-#endif
-
 enum LayerTreeAsTextBehaviorFlags {
     LayerTreeAsTextBehaviorNormal = 0,
     LayerTreeAsTextDebug = 1 << 0, // Dump extra debugging info like layer addresses.
@@ -426,8 +387,8 @@ public:
     // pointers for the layers and timing data will be included in the returned string.
     String layerTreeAsText(LayerTreeAsTextBehavior = LayerTreeAsTextBehaviorNormal) const;
 
-    // Return an estimate of the backing store area (in pixels). May be incorrect for tiled layers.
-    virtual double backingStoreArea() const;
+    // Return an estimate of the backing store memory cost (in bytes). May be incorrect for tiled layers.
+    virtual double backingStoreMemoryEstimate() const;
 
     bool usingTiledLayer() const { return m_usingTiledLayer; }
 
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index 24831ed0a..06ac56757 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -33,7 +33,7 @@
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #if USE(ACCELERATED_COMPOSITING)
-#include "GraphicsLayer.h"
+#include "PlatformLayer.h"
 #endif
 #include "GraphicsTypes.h"
 #include "GraphicsTypes3D.h"
diff --git a/Source/WebCore/platform/graphics/OpenGLESShims.h b/Source/WebCore/platform/graphics/OpenGLESShims.h
new file mode 100644
index 000000000..052af5e45
--- /dev/null
+++ b/Source/WebCore/platform/graphics/OpenGLESShims.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef OpenGLESShims_h
+#define OpenGLESShims_h
+
+#if PLATFORM(BLACKBERRY)
+#define glBindFramebufferEXT glBindFramebuffer
+#define glFramebufferTexture2DEXT glFramebufferTexture2D
+#define glBindRenderbufferEXT glBindRenderbuffer
+#define glRenderbufferStorageEXT glRenderbufferStorage
+#define glFramebufferRenderbufferEXT glFramebufferRenderbuffer
+#define GL_RENDERBUFFER_EXT GL_RENDERBUFFER
+#define GL_STENCIL_ATTACHMENT_EXT GL_STENCIL_ATTACHMENT
+#define glCheckFramebufferStatusEXT glCheckFramebufferStatus
+#define glDeleteFramebuffersEXT glDeleteFramebuffers
+#define glDeleteRenderbuffersEXT glDeleteRenderbuffers
+#define glGenRenderbuffersEXT glGenRenderbuffers
+#define glGenFramebuffersEXT glGenFramebuffers
+#define glGetFramebufferAttachmentParameterivEXT glGetFramebufferAttachmentParameteriv
+#define glGetRenderbufferParameterivEXT glGetRenderbufferParameteriv
+#define glIsRenderbufferEXT glIsRenderbuffer
+#define glIsFramebufferEXT glIsFramebuffer
+#define glGenerateMipmapEXT glGenerateMipmap
+#define GL_COLOR_ATTACHMENT0_EXT GL_COLOR_ATTACHMENT0
+#define GL_DEPTH_ATTACHMENT_EXT GL_DEPTH_ATTACHMENT
+#define GL_FRAMEBUFFER_COMPLETE_EXT GL_FRAMEBUFFER_COMPLETE
+#define GL_FRAMEBUFFER_EXT GL_FRAMEBUFFER
+#define GL_DEPTH24_STENCIL8_EXT GL_DEPTH24_STENCIL8_OES
+#define GL_RGBA8 GL_RGBA8_OES
+#define GL_RGB8 GL_RGB8_OES
+#define GL_READ_FRAMEBUFFER_EXT 0x8CA8
+#define GL_DRAW_FRAMEBUFFER_EXT 0x8CA9
+#define FRAMEBUFFER_INCOMPLETE_MULTISAMPLE_EXT 0x9134
+#define GL_MAX_SAMPLES_EXT 0x8D57
+#endif // PLATFORM(BLACKBERRY)
+
+#endif // OpenGLESShims_h
+
diff --git a/Source/WebCore/platform/graphics/OpenGLShims.cpp b/Source/WebCore/platform/graphics/OpenGLShims.cpp
index a23dc6895..82cc21c6d 100644
--- a/Source/WebCore/platform/graphics/OpenGLShims.cpp
+++ b/Source/WebCore/platform/graphics/OpenGLShims.cpp
@@ -17,7 +17,7 @@
  */
 
 #include "config.h"
-#if ENABLE(WEBGL) || defined(QT_OPENGL_SHIMS)
+#if USE(3D_GRAPHICS) || defined(QT_OPENGL_SHIMS)
 
 #define DISABLE_SHIMS
 #include "OpenGLShims.h"
@@ -227,4 +227,4 @@ bool initializeOpenGLShims()
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/Pattern.h b/Source/WebCore/platform/graphics/Pattern.h
index 5a3c87966..3d5300555 100644
--- a/Source/WebCore/platform/graphics/Pattern.h
+++ b/Source/WebCore/platform/graphics/Pattern.h
@@ -78,6 +78,9 @@ public:
     // Pattern space is an abstract space that maps to the default user space by the transformation 'userSpaceTransformation' 
 #if USE(SKIA)
     PlatformPatternPtr platformPattern(const AffineTransform& userSpaceTransformation);
+#elif PLATFORM(QT)
+    // Qt ignores user space transformation and uses pattern's instead
+    PlatformPatternPtr createPlatformPattern() const;
 #else
     PlatformPatternPtr createPlatformPattern(const AffineTransform& userSpaceTransformation) const;
 #endif
diff --git a/Source/WebCore/platform/graphics/PlatformLayer.h b/Source/WebCore/platform/graphics/PlatformLayer.h
new file mode 100644
index 000000000..6dc0fe5c3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/PlatformLayer.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PlatformLayer_h
+#define PlatformLayer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#if PLATFORM(MAC)
+OBJC_CLASS CALayer;
+typedef CALayer PlatformLayer;
+#elif PLATFORM(WIN)
+typedef struct _CACFLayer PlatformLayer;
+#elif PLATFORM(QT)
+namespace WebCore {
+class TextureMapperPlatformLayer;
+typedef TextureMapperPlatformLayer PlatformLayer;
+};
+#elif PLATFORM(CHROMIUM)
+namespace WebCore {
+class LayerChromium;
+typedef LayerChromium PlatformLayer;
+}
+#elif PLATFORM(GTK)
+#if USE(TEXTURE_MAPPER_CAIRO) || USE(TEXTURE_MAPPER_GL)
+namespace WebCore {
+class TextureMapperPlatformLayer;
+typedef TextureMapperPlatformLayer PlatformLayer;
+};
+#elif USE(CLUTTER)
+typedef struct _ClutterActor ClutterActor;
+namespace WebCore {
+typedef ClutterActor PlatformLayer;
+};
+#endif
+#else
+typedef void* PlatformLayer;
+#endif
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // PlatformLayer_h
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
index 73f0bdfc5..a1f625696 100644
--- a/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
 
@@ -209,5 +209,5 @@ void GraphicsContext3D::setErrorMessageCallback(PassOwnPtr<ErrorMessageCallback>
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
 
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index 083fb7a26..55d479b8a 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -1517,9 +1517,7 @@ void GraphicsLayerCA::updateContentsImage()
 
         // FIXME: maybe only do trilinear if the image is being scaled down,
         // but then what if the layer size changes?
-#ifndef BUILDING_ON_LEOPARD
         m_contentsLayer->setMinificationFilter(PlatformCALayer::Trilinear);
-#endif
         m_contentsLayer->setContents(m_pendingContentsImage.get());
         m_pendingContentsImage = 0;
 
@@ -2392,7 +2390,7 @@ void GraphicsLayerCA::setDebugBorder(const Color& color, float borderWidth)
 FloatSize GraphicsLayerCA::constrainedSize() const
 {
     FloatSize constrainedSize = m_size;
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+#if defined(BUILDING_ON_SNOW_LEOPARD)
     float tileColumns = ceilf(m_size.width() / kTiledLayerTileSize);
     float tileRows = ceilf(m_size.height() / kTiledLayerTileSize);
     double numTiles = tileColumns * tileRows;
@@ -2835,13 +2833,13 @@ void GraphicsLayerCA::noteLayerPropertyChanged(LayerChangeFlags flags)
     m_uncommittedChanges |= flags;
 }
 
-double GraphicsLayerCA::backingStoreArea() const
+double GraphicsLayerCA::backingStoreMemoryEstimate() const
 {
     if (!drawsContent())
         return 0;
     
     // contentsLayer is given to us, so we don't really know anything about its contents.
-    return static_cast<double>(size().width()) * size().height() * m_layer->contentsScale();
+    return static_cast<double>(4 * size().width()) * size().height() * m_layer->contentsScale();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index 4d5f01b9d..d5b4c2c61 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -162,7 +162,7 @@ private:
     virtual void platformCALayerDidCreateTiles(const Vector<FloatRect>& dirtyRects) OVERRIDE;
     virtual float platformCALayerDeviceScaleFactor() OVERRIDE;
 
-    virtual double backingStoreArea() const;
+    virtual double backingStoreMemoryEstimate() const;
 
     void updateOpacityOnLayer();
     
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
index f7f2d52b3..002b7a07a 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
@@ -213,7 +213,7 @@ public:
     void printTree() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if PLATFORM(MAC) && !defined(BUILDING_ON_SNOW_LEOPARD)
     void synchronouslyDisplayTilesInRect(const FloatRect&);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
index cd856692b..c3679d726 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCAAnimationMac.mm
@@ -36,8 +36,6 @@
 #import <QuartzCore/QuartzCore.h>
 #import <wtf/UnusedParam.h>
 
-#define HAVE_MODERN_QUARTZCORE (!defined(BUILDING_ON_LEOPARD))
-
 using namespace WebCore;
 
 // This value must be the same as in PlatformCALayerMac.mm
@@ -75,7 +73,6 @@ static PlatformCAAnimation::FillModeType fromCAFillModeType(NSString* string)
     return PlatformCAAnimation::Forwards;
 }
 
-#if HAVE_MODERN_QUARTZCORE
 static NSString* toCAValueFunctionType(PlatformCAAnimation::ValueFunctionType type)
 {
     switch (type) {
@@ -132,7 +129,6 @@ static PlatformCAAnimation::ValueFunctionType fromCAValueFunctionType(NSString*
 
     return PlatformCAAnimation::NoValueFunction;
 }
-#endif
 
 static CAMediaTimingFunction* toCAMediaTimingFunction(const TimingFunction* timingFunction, bool reverse)
 {
@@ -344,21 +340,13 @@ void PlatformCAAnimation::setAdditive(bool value)
 
 PlatformCAAnimation::ValueFunctionType PlatformCAAnimation::valueFunction() const
 {
-#if HAVE_MODERN_QUARTZCORE
     CAValueFunction* vf = [m_animation.get() valueFunction];
     return fromCAValueFunctionType([vf name]);
-#else
-    return NoValueFunction;
-#endif
 }
 
 void PlatformCAAnimation::setValueFunction(ValueFunctionType value)
 {
-#if HAVE_MODERN_QUARTZCORE
     [m_animation.get() setValueFunction:[CAValueFunction functionWithName:toCAValueFunctionType(value)]];
-#else
-    UNUSED_PARAM(value);
-#endif
 }
 
 void PlatformCAAnimation::setFromValue(float value)
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
index 4c3623a63..3a7ac781f 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
@@ -44,8 +44,6 @@
 #import <wtf/CurrentTime.h>
 #import <wtf/UnusedParam.h>
 
-#define HAVE_MODERN_QUARTZCORE (!defined(BUILDING_ON_LEOPARD))
-
 using std::min;
 using std::max;
 
@@ -95,7 +93,7 @@ static double mediaTimeToCurrentTime(CFTimeInterval t)
 
 @end
 
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
 @interface CATiledLayer(GraphicsLayerCAPrivate)
 - (void)displayInRect:(CGRect)r levelOfDetail:(int)lod options:(NSDictionary *)dict;
 - (BOOL)canDrawConcurrently;
@@ -105,7 +103,7 @@ static double mediaTimeToCurrentTime(CFTimeInterval t)
 
 @interface CALayer(Private)
 - (void)setContentsChanged;
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
 - (void)setAcceleratesDrawing:(BOOL)flag;
 - (BOOL)acceleratesDrawing;
 #endif
@@ -148,7 +146,6 @@ static NSDictionary* nullActionsDictionary()
     return actions;
 }
 
-#if HAVE_MODERN_QUARTZCORE
 static NSString* toCAFilterType(PlatformCALayer::FilterType type)
 {
     switch (type) {
@@ -158,7 +155,6 @@ static NSString* toCAFilterType(PlatformCALayer::FilterType type)
     default: return 0;
     }
 }
-#endif
 
 PassRefPtr<PlatformCALayer> PlatformCALayer::create(LayerType layerType, PlatformCALayerClient* owner)
 {
@@ -460,9 +456,7 @@ FloatPoint3D PlatformCALayer::anchorPoint() const
 {
     CGPoint point = [m_layer.get() anchorPoint];
     float z = 0;
-#if HAVE_MODERN_QUARTZCORE
     z = [m_layer.get() anchorPointZ];
-#endif
     return FloatPoint3D(point.x, point.y, z);
 }
 
@@ -470,9 +464,7 @@ void PlatformCALayer::setAnchorPoint(const FloatPoint3D& value)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     [m_layer.get() setAnchorPoint:CGPointMake(value.x(), value.y())];
-#if HAVE_MODERN_QUARTZCORE
     [m_layer.get() setAnchorPointZ:value.z()];
-#endif
     END_BLOCK_OBJC_EXCEPTIONS
 }
 
@@ -502,28 +494,14 @@ void PlatformCALayer::setSublayerTransform(const TransformationMatrix& value)
 
 TransformationMatrix PlatformCALayer::contentsTransform() const
 {
-#if !HAVE_MODERN_QUARTZCORE
-    if (m_layerType != LayerTypeWebLayer)
-        return TransformationMatrix();
-        
-    return [static_cast<WebLayer*>(m_layer.get()) contentsTransform];
-#else
+    // FIXME: This function can be removed.
     return TransformationMatrix();
-#endif
 }
 
 void PlatformCALayer::setContentsTransform(const TransformationMatrix& value)
 {
-#if !HAVE_MODERN_QUARTZCORE
-    if (m_layerType != LayerTypeWebLayer)
-        return;
-
-    BEGIN_BLOCK_OBJC_EXCEPTIONS
-    [m_layer.get() setContentsTransform:value];
-    END_BLOCK_OBJC_EXCEPTIONS
-#else
+    // FIXME: This function can be removed.
     UNUSED_PARAM(value);
-#endif
 }
 
 bool PlatformCALayer::isHidden() const
@@ -540,22 +518,14 @@ void PlatformCALayer::setHidden(bool value)
 
 bool PlatformCALayer::isGeometryFlipped() const
 {
-#if HAVE_MODERN_QUARTZCORE
     return [m_layer.get() isGeometryFlipped];
-#else
-    return false;
-#endif
 }
 
 void PlatformCALayer::setGeometryFlipped(bool value)
 {
-#if HAVE_MODERN_QUARTZCORE
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     [m_layer.get() setGeometryFlipped:value];
     END_BLOCK_OBJC_EXCEPTIONS
-#else
-    UNUSED_PARAM(value);
-#endif
 }
 
 bool PlatformCALayer::isDoubleSided() const
@@ -584,7 +554,7 @@ void PlatformCALayer::setMasksToBounds(bool value)
 
 bool PlatformCALayer::acceleratesDrawing() const
 {
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     return [m_layer.get() acceleratesDrawing];
 #else
     return false;
@@ -593,7 +563,7 @@ bool PlatformCALayer::acceleratesDrawing() const
 
 void PlatformCALayer::setAcceleratesDrawing(bool acceleratesDrawing)
 {
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     [m_layer.get() setAcceleratesDrawing:acceleratesDrawing];
     END_BLOCK_OBJC_EXCEPTIONS
@@ -628,24 +598,16 @@ void PlatformCALayer::setContentsRect(const FloatRect& value)
 
 void PlatformCALayer::setMinificationFilter(FilterType value)
 {
-#if HAVE_MODERN_QUARTZCORE
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     [m_layer.get() setMinificationFilter:toCAFilterType(value)];
     END_BLOCK_OBJC_EXCEPTIONS
-#else
-    UNUSED_PARAM(value);
-#endif
 }
 
 void PlatformCALayer::setMagnificationFilter(FilterType value)
 {
-#if HAVE_MODERN_QUARTZCORE
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     [m_layer.get() setMagnificationFilter:toCAFilterType(value)];
     END_BLOCK_OBJC_EXCEPTIONS
-#else
-    UNUSED_PARAM(value);
-#endif
 }
 
 Color PlatformCALayer::backgroundColor() const
@@ -948,7 +910,7 @@ void PlatformCALayer::setTimeOffset(CFTimeInterval value)
 
 float PlatformCALayer::contentsScale() const
 {
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     return [m_layer.get() contentsScale];
 #else
     return 1;
@@ -957,7 +919,7 @@ float PlatformCALayer::contentsScale() const
 
 void PlatformCALayer::setContentsScale(float value)
 {
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     [m_layer.get() setContentsScale:value];
     END_BLOCK_OBJC_EXCEPTIONS
@@ -975,7 +937,7 @@ TiledBacking* PlatformCALayer::tiledBacking()
     return [tileCacheLayer tiledBacking];
 }
 
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
 void PlatformCALayer::synchronouslyDisplayTilesInRect(const FloatRect& rect)
 {
     if (m_layerType != LayerTypeWebTiledLayer)
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index 666ea3946..59d8b1f9b 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -36,7 +36,7 @@
 
 using namespace std;
 
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
 @interface CALayer (WebCALayerDetails)
 - (void)setAcceleratesDrawing:(BOOL)flag;
 @end
@@ -64,6 +64,9 @@ TileCache::TileCache(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
     [CATransaction begin];
     [CATransaction setDisableActions:YES];
     [m_tileCacheLayer addSublayer:m_tileContainerLayer.get()];
+#ifndef NDEBUG
+    [m_tileContainerLayer.get() setName:@"TileCache Container Layer"];
+#endif
     [CATransaction commit];
 }
 
@@ -154,7 +157,7 @@ void TileCache::setScale(CGFloat scale)
     if (m_scale == scale && m_deviceScaleFactor == deviceScaleFactor)
         return;
 
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     Vector<FloatRect> dirtyRects;
 
     m_deviceScaleFactor = deviceScaleFactor;
@@ -179,7 +182,7 @@ void TileCache::setScale(CGFloat scale)
 
 void TileCache::setAcceleratesDrawing(bool acceleratesDrawing)
 {
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     if (m_acceleratesDrawing == acceleratesDrawing)
         return;
 
@@ -394,8 +397,11 @@ RetainPtr<WebTileLayer> TileCache::createTileLayer(const IntRect& tileRect)
     [layer.get() setBorderWidth:m_tileDebugBorderWidth];
     [layer.get() setEdgeAntialiasingMask:0];
     [layer.get() setOpaque:YES];
+#ifndef NDEBUG
+    [layer.get() setName:@"Tile"];
+#endif
 
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
     [layer.get() setContentsScale:m_deviceScaleFactor];
     [layer.get() setAcceleratesDrawing:m_acceleratesDrawing];
 #endif
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
index d3e27274b..72ae6fbd4 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
@@ -42,7 +42,9 @@ using namespace WebCore;
 
     // FIXME: The tile size should be configurable.
     _tileCache = TileCache::create(self, IntSize(512, 512));
-
+#ifndef NDEBUG
+    [self setName:@"WebTileCacheLayer"];
+#endif
     return self;
 }
 
diff --git a/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
index 4c590a63b..a4eabe8ab 100644
--- a/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
+#if ENABLE(ACCELERATED_2D_CANVAS) || USE(3D_GRAPHICS)
 
 #include "DrawingBuffer.h"
 
diff --git a/Source/WebCore/platform/graphics/cairo/GLContext.h b/Source/WebCore/platform/graphics/cairo/GLContext.h
index ab82c9a45..c23a46cf1 100644
--- a/Source/WebCore/platform/graphics/cairo/GLContext.h
+++ b/Source/WebCore/platform/graphics/cairo/GLContext.h
@@ -42,7 +42,7 @@ public:
     virtual bool canRenderToDefaultFramebuffer() = 0;
     virtual IntSize defaultFrameBufferSize() = 0;
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
     virtual PlatformGraphicsContext3D platformContext() = 0;
 #endif
 };
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index ac292d375..62da1a16c 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -28,11 +28,12 @@
 #include "config.h"
 #include "GraphicsContext3D.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "Extensions3DOpenGL.h"
 #include "GraphicsContext3DPrivate.h"
 #include "Image.h"
+#include "NotImplemented.h"
 #include "OpenGLShims.h"
 #include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
@@ -146,6 +147,11 @@ GraphicsContext3D::~GraphicsContext3D()
     ::glDeleteFramebuffersEXT(1, &m_fbo);
 }
 
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    notImplemented();
+}
+
 bool GraphicsContext3D::getImageData(Image* image, unsigned int format, unsigned int type, bool premultiplyAlpha, bool ignoreGammaAndColorProfile, Vector<uint8_t>& outputVector)
 {
     if (!image)
@@ -258,4 +264,4 @@ PlatformLayer* GraphicsContext3D::platformLayer() const
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp
index 86b3abb68..7d6629f69 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "GraphicsContext3DPrivate.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "HostWindow.h"
 #include "NotImplemented.h"
@@ -129,4 +129,4 @@ void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper
 
 } // namespace WebCore
 
-#endif // ENABLE_WEBGL
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
index e044b8d9a..50de51f47 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
 
@@ -283,4 +283,4 @@ void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imag
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/cg/ImageCG.cpp b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
index 9dd454120..fed911aeb 100644
--- a/Source/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -229,9 +229,7 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     if (!nativeImageForCurrentFrame())
         return;
 
-    ASSERT(patternTransform.isInvertible());
     if (!patternTransform.isInvertible())
-        // Avoid a hang under CGContextDrawTiledImage on release builds.
         return;
 
     CGContextRef context = ctxt->platformContext();
diff --git a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp
index 42c952f07..69e632b71 100644
--- a/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp
+++ b/Source/WebCore/platform/graphics/chromium/AnimationTranslationUtil.cpp
@@ -122,15 +122,54 @@ WebTransformOperations toWebTransformOperations(const TransformOperations& trans
 }
 
 template <class Value, class Keyframe, class Curve>
-bool appendKeyframe(Curve& curve, double keyTime, const Value* value, PassOwnPtr<CCTimingFunction> timingFunction, const FloatSize&)
+bool appendKeyframe(Curve& curve, double keyTime, const Value* value, const Value* lastValue, PassOwnPtr<CCTimingFunction> timingFunction, const FloatSize&)
 {
     curve.addKeyframe(Keyframe::create(keyTime, value->value(), timingFunction));
     return true;
 }
 
+bool isRotationType(TransformOperation::OperationType transformType)
+{
+    return transformType == TransformOperation::ROTATE
+        || transformType == TransformOperation::ROTATE_X
+        || transformType == TransformOperation::ROTATE_Y
+        || transformType == TransformOperation::ROTATE_Z
+        || transformType == TransformOperation::ROTATE_3D;
+}
+
+bool causesRotationOfAtLeast180Degrees(const TransformAnimationValue* value, const TransformAnimationValue* lastValue)
+{
+    if (!lastValue)
+        return false;
+
+    const TransformOperations& operations = *value->value();
+    const TransformOperations& lastOperations = *lastValue->value();
+
+    // We'll be doing matrix interpolation in this case. No risk of incorrect
+    // rotations here.
+    if (!operations.operationsMatch(lastOperations))
+        return false;
+
+    for (size_t i = 0; i < operations.size(); ++i) {
+        if (!isRotationType(operations.operations()[i]->getOperationType()))
+            continue;
+
+        RotateTransformOperation* rotation = static_cast<RotateTransformOperation*>(operations.operations()[i].get());
+        RotateTransformOperation* lastRotation = static_cast<RotateTransformOperation*>(lastOperations.operations()[i].get());
+
+        if (fabs(rotation->angle() - lastRotation->angle()) >= 180)
+            return true;
+    }
+
+    return false;
+}
+
 template <>
-bool appendKeyframe<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(CCKeyframedTransformAnimationCurve& curve, double keyTime, const TransformAnimationValue* value, PassOwnPtr<CCTimingFunction> timingFunction, const FloatSize& boxSize)
+bool appendKeyframe<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(CCKeyframedTransformAnimationCurve& curve, double keyTime, const TransformAnimationValue* value, const TransformAnimationValue* lastValue, PassOwnPtr<CCTimingFunction> timingFunction, const FloatSize& boxSize)
 {
+    if (causesRotationOfAtLeast180Degrees(value, lastValue))
+        return false;
+
     WebTransformOperations operations = toWebTransformOperations(*value->value(), boxSize);
     if (operations.apply().isInvertible()) {
         curve.addKeyframe(CCTransformKeyframe::create(keyTime, operations, timingFunction));
@@ -159,6 +198,9 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
         size_t index = reverse ? valueList.size() - i - 1 : i;
 
         const Value* originalValue = static_cast<const Value*>(valueList.at(index));
+        const Value* lastOriginalValue = 0;
+        if (valueList.size() > 1 && ((reverse && index + 1 < valueList.size()) || (!reverse && index > 0)))
+            lastOriginalValue = static_cast<const Value*>(valueList.at(reverse ? index + 1 : index - 1));
 
         OwnPtr<CCTimingFunction> timingFunction;
         const TimingFunction* originalTimingFunction = originalValue->timingFunction();
@@ -190,7 +232,7 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
         if (reverse)
             keyTime = duration - keyTime;
 
-        bool addedKeyframe = appendKeyframe<Value, Keyframe, Curve>(*curve, keyTime, originalValue, timingFunction.release(), boxSize);
+        bool addedKeyframe = appendKeyframe<Value, Keyframe, Curve>(*curve, keyTime, originalValue, lastOriginalValue, timingFunction.release(), boxSize);
         if (!addedKeyframe)
             return nullptr;
     }
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp
index f85285f3b..f869c58a2 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.cpp
@@ -33,11 +33,12 @@
 #include "LayerPainterChromium.h"
 #include "PlatformColor.h"
 #include "PlatformContextSkia.h"
+#include "cc/CCGraphicsContext.h"
 #include "skia/ext/platform_canvas.h"
 
 namespace WebCore {
 
-BitmapCanvasLayerTextureUpdater::Texture::Texture(BitmapCanvasLayerTextureUpdater* textureUpdater, PassOwnPtr<ManagedTexture> texture)
+BitmapCanvasLayerTextureUpdater::Texture::Texture(BitmapCanvasLayerTextureUpdater* textureUpdater, PassOwnPtr<CCPrioritizedTexture> texture)
     : LayerTextureUpdater::Texture(texture)
     , m_textureUpdater(textureUpdater)
 {
@@ -68,9 +69,9 @@ BitmapCanvasLayerTextureUpdater::~BitmapCanvasLayerTextureUpdater()
 {
 }
 
-PassOwnPtr<LayerTextureUpdater::Texture> BitmapCanvasLayerTextureUpdater::createTexture(TextureManager* manager)
+PassOwnPtr<LayerTextureUpdater::Texture> BitmapCanvasLayerTextureUpdater::createTexture(CCPrioritizedTextureManager* manager)
 {
-    return adoptPtr(new Texture(this, ManagedTexture::create(manager)));
+    return adoptPtr(new Texture(this, CCPrioritizedTexture::create(manager)));
 }
 
 LayerTextureUpdater::SampledTexelFormat BitmapCanvasLayerTextureUpdater::sampledTexelFormat(GC3Denum textureFormat)
@@ -80,7 +81,7 @@ LayerTextureUpdater::SampledTexelFormat BitmapCanvasLayerTextureUpdater::sampled
             LayerTextureUpdater::SampledTexelFormatRGBA : LayerTextureUpdater::SampledTexelFormatBGRA;
 }
 
-void BitmapCanvasLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsScale, IntRect& resultingOpaqueRect)
+void BitmapCanvasLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect)
 {
     m_texSubImage.setSubImageSize(tileSize);
 
@@ -89,10 +90,10 @@ void BitmapCanvasLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect
         m_canvas = adoptPtr(skia::CreateBitmapCanvas(m_canvasSize.width(), m_canvasSize.height(), m_opaque));
     }
 
-    paintContents(m_canvas.get(), contentRect, contentsScale, resultingOpaqueRect);
+    paintContents(m_canvas.get(), contentRect, contentsWidthScale, contentsHeightScale, resultingOpaqueRect);
 }
 
-void BitmapCanvasLayerTextureUpdater::updateTextureRect(CCGraphicsContext* context, TextureAllocator* allocator, ManagedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
+void BitmapCanvasLayerTextureUpdater::updateTextureRect(CCGraphicsContext* context, TextureAllocator* allocator, CCPrioritizedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
 {
     const SkBitmap& bitmap = m_canvas->getDevice()->accessBitmap(false);
     bitmap.lockPixels();
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h
index 3c95380ce..d97968c03 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapCanvasLayerTextureUpdater.h
@@ -37,6 +37,7 @@ class SkCanvas;
 namespace WebCore {
 
 class LayerPainterChromium;
+class CCGraphicsContext;
 
 // This class rasterizes the contentRect into a skia bitmap canvas. It then updates
 // textures by copying from the canvas into the texture, using MapSubImage if
@@ -45,7 +46,7 @@ class BitmapCanvasLayerTextureUpdater : public CanvasLayerTextureUpdater {
 public:
     class Texture : public LayerTextureUpdater::Texture {
     public:
-        Texture(BitmapCanvasLayerTextureUpdater*, PassOwnPtr<ManagedTexture>);
+        Texture(BitmapCanvasLayerTextureUpdater*, PassOwnPtr<CCPrioritizedTexture>);
         virtual ~Texture();
 
         virtual void updateRect(CCGraphicsContext*, TextureAllocator*, const IntRect& sourceRect, const IntRect& destRect) OVERRIDE;
@@ -59,10 +60,10 @@ public:
     static PassRefPtr<BitmapCanvasLayerTextureUpdater> create(PassOwnPtr<LayerPainterChromium>, bool useMapTexSubImage);
     virtual ~BitmapCanvasLayerTextureUpdater();
 
-    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(TextureManager*);
+    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(CCPrioritizedTextureManager*);
     virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat);
-    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsScale, IntRect& resultingOpaqueRect) OVERRIDE;
-    void updateTextureRect(CCGraphicsContext*, TextureAllocator*, ManagedTexture*, const IntRect& sourceRect, const IntRect& destRect);
+    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect) OVERRIDE;
+    void updateTextureRect(CCGraphicsContext*, TextureAllocator*, CCPrioritizedTexture*, const IntRect& sourceRect, const IntRect& destRect);
 
     virtual void setOpaque(bool) OVERRIDE;
 
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
index 71b390f5b..23cffea94 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
@@ -34,10 +34,11 @@
 #include "PlatformColor.h"
 #include "SkCanvas.h"
 #include "SkDevice.h"
+#include "cc/CCGraphicsContext.h"
 
 namespace WebCore {
 
-BitmapSkPictureCanvasLayerTextureUpdater::Texture::Texture(BitmapSkPictureCanvasLayerTextureUpdater* textureUpdater, PassOwnPtr<ManagedTexture> texture)
+BitmapSkPictureCanvasLayerTextureUpdater::Texture::Texture(BitmapSkPictureCanvasLayerTextureUpdater* textureUpdater, PassOwnPtr<CCPrioritizedTexture> texture)
     : CanvasLayerTextureUpdater::Texture(texture)
     , m_textureUpdater(textureUpdater)
 {
@@ -78,9 +79,9 @@ BitmapSkPictureCanvasLayerTextureUpdater::~BitmapSkPictureCanvasLayerTextureUpda
 {
 }
 
-PassOwnPtr<LayerTextureUpdater::Texture> BitmapSkPictureCanvasLayerTextureUpdater::createTexture(TextureManager* manager)
+PassOwnPtr<LayerTextureUpdater::Texture> BitmapSkPictureCanvasLayerTextureUpdater::createTexture(CCPrioritizedTextureManager* manager)
 {
-    return adoptPtr(new Texture(this, ManagedTexture::create(manager)));
+    return adoptPtr(new Texture(this, CCPrioritizedTexture::create(manager)));
 }
 
 LayerTextureUpdater::SampledTexelFormat BitmapSkPictureCanvasLayerTextureUpdater::sampledTexelFormat(GC3Denum textureFormat)
@@ -90,10 +91,10 @@ LayerTextureUpdater::SampledTexelFormat BitmapSkPictureCanvasLayerTextureUpdater
             LayerTextureUpdater::SampledTexelFormatRGBA : LayerTextureUpdater::SampledTexelFormatBGRA;
 }
 
-void BitmapSkPictureCanvasLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsScale, IntRect& resultingOpaqueRect)
+void BitmapSkPictureCanvasLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect)
 {
     m_texSubImage.setSubImageSize(tileSize);
-    SkPictureCanvasLayerTextureUpdater::prepareToUpdate(contentRect, tileSize, contentsScale, resultingOpaqueRect);
+    SkPictureCanvasLayerTextureUpdater::prepareToUpdate(contentRect, tileSize, contentsWidthScale, contentsHeightScale, resultingOpaqueRect);
 }
 
 void BitmapSkPictureCanvasLayerTextureUpdater::paintContentsRect(SkCanvas* canvas, const IntRect& sourceRect)
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
index 09481d284..787b39937 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
@@ -40,7 +40,7 @@ class BitmapSkPictureCanvasLayerTextureUpdater : public SkPictureCanvasLayerText
 public:
     class Texture : public CanvasLayerTextureUpdater::Texture {
     public:
-        Texture(BitmapSkPictureCanvasLayerTextureUpdater*, PassOwnPtr<ManagedTexture>);
+        Texture(BitmapSkPictureCanvasLayerTextureUpdater*, PassOwnPtr<CCPrioritizedTexture>);
 
         virtual void prepareRect(const IntRect& sourceRect) OVERRIDE;
         virtual void updateRect(CCGraphicsContext*, TextureAllocator*, const IntRect& sourceRect, const IntRect& destRect) OVERRIDE;
@@ -55,9 +55,9 @@ public:
     static PassRefPtr<BitmapSkPictureCanvasLayerTextureUpdater> create(PassOwnPtr<LayerPainterChromium>, bool useMapTexSubImage);
     virtual ~BitmapSkPictureCanvasLayerTextureUpdater();
 
-    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(TextureManager*) OVERRIDE;
+    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(CCPrioritizedTextureManager*) OVERRIDE;
     virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat) OVERRIDE;
-    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsScale, IntRect& resultingOpaqueRect) OVERRIDE;
+    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect) OVERRIDE;
     void paintContentsRect(SkCanvas*, const IntRect& sourceRect);
     void updateTextureRect(CCGraphicsContext*, GC3Denum format, const IntRect& destRect, const uint8_t* pixels);
 
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp
index 530bb2f71..be8484b75 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.cpp
@@ -30,9 +30,8 @@
 
 #include "CanvasLayerTextureUpdater.h"
 
-#include "GraphicsContext.h"
+#include "FloatRect.h"
 #include "LayerPainterChromium.h"
-#include "PlatformContextSkia.h"
 #include "SkCanvas.h"
 #include "SkPaint.h"
 #include "SkRect.h"
@@ -50,31 +49,35 @@ CanvasLayerTextureUpdater::~CanvasLayerTextureUpdater()
 {
 }
 
-void CanvasLayerTextureUpdater::paintContents(SkCanvas* canvas, const IntRect& contentRect, float contentsScale, IntRect& resultingOpaqueRect)
+void CanvasLayerTextureUpdater::paintContents(SkCanvas* canvas, const IntRect& contentRect, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect)
 {
     TRACE_EVENT0("cc", "CanvasLayerTextureUpdater::paintContents");
     canvas->save();
     canvas->translate(WebCoreFloatToSkScalar(-contentRect.x()), WebCoreFloatToSkScalar(-contentRect.y()));
 
-    IntRect scaledContentRect = contentRect;
+    IntRect layerRect = contentRect;
 
-    if (contentsScale != 1.0) {
-        canvas->scale(WebCoreFloatToSkScalar(contentsScale), WebCoreFloatToSkScalar(contentsScale));
+    if (contentsWidthScale != 1 || contentsHeightScale != 1) {
+        canvas->scale(WebCoreFloatToSkScalar(contentsWidthScale), WebCoreFloatToSkScalar(contentsHeightScale));
 
         FloatRect rect = contentRect;
-        rect.scale(1 / contentsScale);
-        scaledContentRect = enclosingIntRect(rect);
+        rect.scale(1 / contentsWidthScale, 1 / contentsHeightScale);
+        layerRect = enclosingIntRect(rect);
     }
 
     SkPaint paint;
     paint.setAntiAlias(false);
     paint.setXfermodeMode(SkXfermode::kClear_Mode);
-    canvas->drawRect(scaledContentRect, paint);
-    canvas->clipRect(scaledContentRect);
+    canvas->drawRect(layerRect, paint);
+    canvas->clipRect(layerRect);
 
-    m_painter->paint(canvas, scaledContentRect, resultingOpaqueRect);
+    FloatRect opaqueLayerRect;
+    m_painter->paint(canvas, layerRect, opaqueLayerRect);
     canvas->restore();
 
+    opaqueLayerRect.scale(contentsWidthScale, contentsHeightScale);
+    resultingOpaqueRect = enclosedIntRect(opaqueLayerRect);
+
     m_contentRect = contentRect;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.h
index c951e93fe..b441e4e74 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerTextureUpdater.h
@@ -47,7 +47,7 @@ public:
 protected:
     explicit CanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
 
-    void paintContents(SkCanvas*, const IntRect& contentRect, float contentsScale, IntRect& resultingOpaqueRect);
+    void paintContents(SkCanvas*, const IntRect& contentRect, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect);
     const IntRect& contentRect() const { return m_contentRect; }
 
 private:
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 05ee55225..078d377d0 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -38,7 +38,6 @@
 #include "BitmapSkPictureCanvasLayerTextureUpdater.h"
 #include "FrameBufferSkPictureCanvasLayerTextureUpdater.h"
 #include "LayerPainterChromium.h"
-#include "PlatformSupport.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCSettings.h"
 #include <public/Platform.h>
@@ -46,31 +45,25 @@
 
 namespace WebCore {
 
-class ContentLayerPainter : public LayerPainterChromium {
-    WTF_MAKE_NONCOPYABLE(ContentLayerPainter);
-public:
-    static PassOwnPtr<ContentLayerPainter> create(ContentLayerDelegate* delegate)
-    {
-        return adoptPtr(new ContentLayerPainter(delegate));
-    }
-
-    virtual void paint(SkCanvas* canvas, const IntRect& contentRect, IntRect& opaque)
-    {
-        double paintStart = currentTime();
-        m_delegate->paintContents(canvas, contentRect, opaque);
-        double paintEnd = currentTime();
-        double pixelsPerSec = (contentRect.width() * contentRect.height()) / (paintEnd - paintStart);
-        WebKit::Platform::current()->histogramCustomCounts("Renderer4.AccelContentPaintDurationMS", (paintEnd - paintStart) * 1000, 0, 120, 30);
-        WebKit::Platform::current()->histogramCustomCounts("Renderer4.AccelContentPaintMegapixPerSecond", pixelsPerSec / 1000000, 10, 210, 30);
-    }
-private:
-    explicit ContentLayerPainter(ContentLayerDelegate* delegate)
-        : m_delegate(delegate)
-    {
-    }
-
-    ContentLayerDelegate* m_delegate;
-};
+ContentLayerPainter::ContentLayerPainter(ContentLayerDelegate* delegate)
+    : m_delegate(delegate)
+{
+}
+
+PassOwnPtr<ContentLayerPainter> ContentLayerPainter::create(ContentLayerDelegate* delegate)
+{
+    return adoptPtr(new ContentLayerPainter(delegate));
+}
+
+void ContentLayerPainter::paint(SkCanvas* canvas, const IntRect& contentRect, FloatRect& opaque)
+{
+    double paintStart = currentTime();
+    m_delegate->paintContents(canvas, contentRect, opaque);
+    double paintEnd = currentTime();
+    double pixelsPerSec = (contentRect.width() * contentRect.height()) / (paintEnd - paintStart);
+    WebKit::Platform::current()->histogramCustomCounts("Renderer4.AccelContentPaintDurationMS", (paintEnd - paintStart) * 1000, 0, 120, 30);
+    WebKit::Platform::current()->histogramCustomCounts("Renderer4.AccelContentPaintMegapixPerSecond", pixelsPerSec / 1000000, 10, 210, 30);
+}
 
 PassRefPtr<ContentLayerChromium> ContentLayerChromium::create(ContentLayerDelegate* delegate)
 {
@@ -92,9 +85,16 @@ bool ContentLayerChromium::drawsContent() const
     return TiledLayerChromium::drawsContent() && m_delegate;
 }
 
-void ContentLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion)
+void ContentLayerChromium::setTexturePriorities(const CCPriorityCalculator& priorityCalc)
 {
+    // Update the tile data before creating all the layer's tiles.
     updateTileSizeAndTilingOption();
+
+    TiledLayerChromium::setTexturePriorities(priorityCalc);
+}
+
+void ContentLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion)
+{
     createTextureUpdaterIfNeeded();
 
     IntRect layerRect;
@@ -108,15 +108,11 @@ void ContentLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTr
     m_needsDisplay = false;
 }
 
-void ContentLayerChromium::idleUpdate(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion)
+bool ContentLayerChromium::needMoreUpdates()
 {
     if (!drawsContent())
-        return;
-
-    const IntRect layerRect = visibleLayerRect();
-    idleUpdateLayerRect(updater, layerRect, occlusion);
-    if (needsIdlePaint(layerRect))
-        setNeedsCommit();
+        return false;
+    return needsIdlePaint(visibleLayerRect());
 }
 
 void ContentLayerChromium::createTextureUpdaterIfNeeded()
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index d72818599..d8ea48565 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -34,24 +34,38 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
+#include "LayerPainterChromium.h"
 #include "TiledLayerChromium.h"
 
 class SkCanvas;
 
 namespace WebCore {
 
-class GraphicsContext;
+class FloatRect;
 class IntRect;
 class LayerTextureUpdater;
 
 class ContentLayerDelegate {
 public:
-    virtual void paintContents(SkCanvas*, const IntRect& clip, IntRect& opaque) = 0;
+    virtual void paintContents(SkCanvas*, const IntRect& clip, FloatRect& opaque) = 0;
 
 protected:
     virtual ~ContentLayerDelegate() { }
 };
 
+class ContentLayerPainter : public LayerPainterChromium {
+    WTF_MAKE_NONCOPYABLE(ContentLayerPainter);
+public:
+    static PassOwnPtr<ContentLayerPainter> create(ContentLayerDelegate*);
+
+    virtual void paint(SkCanvas*, const IntRect& contentRect, FloatRect& opaque) OVERRIDE;
+
+private:
+    explicit ContentLayerPainter(ContentLayerDelegate*);
+
+    ContentLayerDelegate* m_delegate;
+};
+
 // A layer that renders its contents into an SkCanvas.
 class ContentLayerChromium : public TiledLayerChromium {
 public:
@@ -62,8 +76,9 @@ public:
     void clearDelegate() { m_delegate = 0; }
 
     virtual bool drawsContent() const OVERRIDE;
+    virtual void setTexturePriorities(const CCPriorityCalculator&) OVERRIDE;
     virtual void update(CCTextureUpdater&, const CCOcclusionTracker*) OVERRIDE;
-    virtual void idleUpdate(CCTextureUpdater&, const CCOcclusionTracker*) OVERRIDE;
+    virtual bool needMoreUpdates() OVERRIDE;
 
     virtual void setOpaque(bool) OVERRIDE;
 
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
index 743bcc1f7..7e9ac0a6c 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
@@ -40,10 +40,10 @@ namespace WebCore {
 
 static PassOwnPtr<SkCanvas> createAcceleratedCanvas(GraphicsContext3D* context,
                                                     TextureAllocator* allocator,
-                                                    ManagedTexture* texture)
+                                                    CCPrioritizedTexture* texture)
 {
     // Allocate so that we have a valid texture id.
-    texture->allocate(allocator);
+    texture->acquireBackingTexture(allocator);
 
     GrContext* grContext = context->grContext();
     IntSize canvasSize = texture->size();
@@ -58,7 +58,7 @@ static PassOwnPtr<SkCanvas> createAcceleratedCanvas(GraphicsContext3D* context,
     return adoptPtr(new SkCanvas(device.get()));
 }
 
-FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::Texture(FrameBufferSkPictureCanvasLayerTextureUpdater* textureUpdater, PassOwnPtr<ManagedTexture> texture)
+FrameBufferSkPictureCanvasLayerTextureUpdater::Texture::Texture(FrameBufferSkPictureCanvasLayerTextureUpdater* textureUpdater, PassOwnPtr<CCPrioritizedTexture> texture)
     : LayerTextureUpdater::Texture(texture)
     , m_textureUpdater(textureUpdater)
 {
@@ -90,9 +90,9 @@ FrameBufferSkPictureCanvasLayerTextureUpdater::~FrameBufferSkPictureCanvasLayerT
 {
 }
 
-PassOwnPtr<LayerTextureUpdater::Texture> FrameBufferSkPictureCanvasLayerTextureUpdater::createTexture(TextureManager* manager)
+PassOwnPtr<LayerTextureUpdater::Texture> FrameBufferSkPictureCanvasLayerTextureUpdater::createTexture(CCPrioritizedTextureManager* manager)
 {
-    return adoptPtr(new Texture(this, ManagedTexture::create(manager)));
+    return adoptPtr(new Texture(this, CCPrioritizedTexture::create(manager)));
 }
 
 LayerTextureUpdater::SampledTexelFormat FrameBufferSkPictureCanvasLayerTextureUpdater::sampledTexelFormat(GC3Denum textureFormat)
@@ -101,7 +101,7 @@ LayerTextureUpdater::SampledTexelFormat FrameBufferSkPictureCanvasLayerTextureUp
     return LayerTextureUpdater::SampledTexelFormatRGBA;
 }
 
-void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(PassRefPtr<GraphicsContext3D> prpContext, TextureAllocator* allocator, ManagedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
+void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(PassRefPtr<GraphicsContext3D> prpContext, TextureAllocator* allocator, CCPrioritizedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
 {
     RefPtr<GraphicsContext3D> context(prpContext);
 
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
index 1f2f20cce..8f630a922 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
@@ -40,7 +40,7 @@ class FrameBufferSkPictureCanvasLayerTextureUpdater : public SkPictureCanvasLaye
 public:
     class Texture : public LayerTextureUpdater::Texture {
     public:
-        Texture(FrameBufferSkPictureCanvasLayerTextureUpdater*, PassOwnPtr<ManagedTexture>);
+        Texture(FrameBufferSkPictureCanvasLayerTextureUpdater*, PassOwnPtr<CCPrioritizedTexture>);
         virtual ~Texture();
 
         virtual void updateRect(CCGraphicsContext*, TextureAllocator*, const IntRect& sourceRect, const IntRect& destRect) OVERRIDE;
@@ -54,9 +54,9 @@ public:
     static PassRefPtr<FrameBufferSkPictureCanvasLayerTextureUpdater> create(PassOwnPtr<LayerPainterChromium>);
     virtual ~FrameBufferSkPictureCanvasLayerTextureUpdater();
 
-    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(TextureManager*) OVERRIDE;
+    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(CCPrioritizedTextureManager*) OVERRIDE;
     virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat) OVERRIDE;
-    void updateTextureRect(PassRefPtr<GraphicsContext3D>, TextureAllocator*, ManagedTexture*, const IntRect& sourceRect, const IntRect& destRect);
+    void updateTextureRect(PassRefPtr<GraphicsContext3D>, TextureAllocator*, CCPrioritizedTexture*, const IntRect& sourceRect, const IntRect& destRect);
 
 private:
     explicit FrameBufferSkPictureCanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index d37572d93..c21726e9f 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -509,14 +509,6 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 
 bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
 {
-    // Bail early if we have a large rotation.
-    if (values.property() == AnimatedPropertyWebkitTransform) {
-        bool hasRotationOfMoreThan180Degrees = false;
-        validateTransformOperations(values, hasRotationOfMoreThan180Degrees);
-        if (hasRotationOfMoreThan180Degrees)
-            return false;
-    }
-
     primaryLayer().unwrap<LayerChromium>()->setLayerAnimationDelegate(this);
 
     int animationId = mapAnimationNameToId(animationName);
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index 1fb3e4305..14164133d 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -34,7 +34,6 @@
 
 #include "ImageLayerChromium.h"
 
-#include "Image.h"
 #include "LayerTextureSubImage.h"
 #include "LayerTextureUpdater.h"
 #include "ManagedTexture.h"
@@ -47,7 +46,7 @@ class ImageLayerTextureUpdater : public LayerTextureUpdater {
 public:
     class Texture : public LayerTextureUpdater::Texture {
     public:
-        Texture(ImageLayerTextureUpdater* textureUpdater, PassOwnPtr<ManagedTexture> texture)
+        Texture(ImageLayerTextureUpdater* textureUpdater, PassOwnPtr<CCPrioritizedTexture> texture)
             : LayerTextureUpdater::Texture(texture)
             , m_textureUpdater(textureUpdater)
         {
@@ -71,9 +70,9 @@ public:
 
     virtual ~ImageLayerTextureUpdater() { }
 
-    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(TextureManager* manager)
+    virtual PassOwnPtr<LayerTextureUpdater::Texture> createTexture(CCPrioritizedTextureManager* manager)
     {
-        return adoptPtr(new Texture(this, ManagedTexture::create(manager)));
+        return adoptPtr(new Texture(this, CCPrioritizedTexture::create(manager)));
     }
 
     virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat) OVERRIDE
@@ -82,7 +81,7 @@ public:
                 LayerTextureUpdater::SampledTexelFormatRGBA : LayerTextureUpdater::SampledTexelFormatBGRA;
     }
 
-    void updateTextureRect(CCGraphicsContext* context, TextureAllocator* allocator, ManagedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
+    void updateTextureRect(CCGraphicsContext* context, TextureAllocator* allocator, CCPrioritizedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
     {
         texture->bindTexture(context, allocator);
 
@@ -142,6 +141,14 @@ void ImageLayerChromium::setBitmap(const SkBitmap& bitmap)
     setNeedsDisplay();
 }
 
+void ImageLayerChromium::setTexturePriorities(const CCPriorityCalculator& priorityCalc)
+{
+    // Update the tile data before creating all the layer's tiles.
+    updateTileSizeAndTilingOption();
+
+    TiledLayerChromium::setTexturePriorities(priorityCalc);
+}
+
 void ImageLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion)
 {
     createTextureUpdaterIfNeeded();
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
index 988e71eac..adccce620 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
@@ -48,6 +48,7 @@ public:
     virtual ~ImageLayerChromium();
 
     virtual bool drawsContent() const OVERRIDE;
+    virtual void setTexturePriorities(const CCPriorityCalculator&) OVERRIDE;
     virtual void update(CCTextureUpdater&, const CCOcclusionTracker*) OVERRIDE;
     virtual bool needsContentsScale() const OVERRIDE;
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 1a4038a4f..38b856e63 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -33,9 +33,6 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerChromium.h"
 
-#include "NativeImageSkia.h"
-#include "PlatformContextSkia.h"
-#include "RenderLayerBacking.h"
 #include "TextStream.h"
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCAnimationEvents.h"
@@ -44,7 +41,6 @@
 #include "cc/CCLayerImpl.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCSettings.h"
-#include "skia/ext/platform_canvas.h"
 
 using namespace std;
 using WebKit::WebTransformationMatrix;
@@ -70,7 +66,8 @@ LayerChromium::LayerChromium()
     , m_haveWheelEventHandlers(false)
     , m_nonFastScrollableRegionChanged(false)
     , m_anchorPoint(0.5, 0.5)
-    , m_backgroundColor(0, 0, 0, 0)
+    , m_backgroundColor(0)
+    , m_debugBorderColor(0)
     , m_debugBorderWidth(0)
     , m_opacity(1.0)
     , m_anchorPointZ(0)
@@ -281,7 +278,7 @@ void LayerChromium::setAnchorPointZ(float anchorPointZ)
     setNeedsCommit();
 }
 
-void LayerChromium::setBackgroundColor(const Color& backgroundColor)
+void LayerChromium::setBackgroundColor(SkColor backgroundColor)
 {
     if (m_backgroundColor == backgroundColor)
         return;
@@ -601,7 +598,7 @@ PassOwnPtr<CCLayerImpl> LayerChromium::createCCLayerImpl()
     return CCLayerImpl::create(m_layerId);
 }
 
-void LayerChromium::setDebugBorderColor(const Color& color)
+void LayerChromium::setDebugBorderColor(SkColor color)
 {
     m_debugBorderColor = color;
     setNeedsCommit();
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 68c2e317b..e3ceb94d0 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -35,12 +35,12 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "FloatPoint.h"
-#include "GraphicsContext.h"
-#include "PlatformString.h"
 #include "Region.h"
 #include "RenderSurfaceChromium.h"
+#include "SkColor.h"
 #include "cc/CCLayerAnimationController.h"
 #include "cc/CCOcclusionTracker.h"
+#include "cc/CCPrioritizedTexture.h"
 
 #include <public/WebFilterOperations.h>
 #include <public/WebTransformationMatrix.h>
@@ -106,8 +106,8 @@ public:
     void setAnchorPointZ(float);
     float anchorPointZ() const { return m_anchorPointZ; }
 
-    void setBackgroundColor(const Color&);
-    Color backgroundColor() const { return m_backgroundColor; }
+    void setBackgroundColor(SkColor);
+    SkColor backgroundColor() const { return m_backgroundColor; }
 
     // A layer's bounds are in logical, non-page-scaled pixels (however, the
     // root layer's bounds are in physical pixels).
@@ -211,12 +211,12 @@ public:
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() const { return m_isDrawable; }
     virtual void update(CCTextureUpdater&, const CCOcclusionTracker*) { }
-    virtual void idleUpdate(CCTextureUpdater&, const CCOcclusionTracker*) { }
+    virtual bool needMoreUpdates() { return false; }
     virtual void setIsMask(bool) { }
     virtual void bindContentsTexture() { }
     virtual bool needsContentsScale() const { return false; }
 
-    void setDebugBorderColor(const Color&);
+    void setDebugBorderColor(SkColor);
     void setDebugBorderWidth(float);
     void setDebugName(const String&);
 
@@ -263,8 +263,8 @@ public:
 
     CCLayerTreeHost* layerTreeHost() const { return m_layerTreeHost; }
 
-    // Reserve any textures needed for this layer.
-    virtual void reserveTextures() { }
+    // Set the priority of all desired textures in this layer.
+    virtual void setTexturePriorities(const CCPriorityCalculator&) { }
 
     void setAlwaysReserveTextures(bool alwaysReserveTextures) { m_alwaysReserveTextures = alwaysReserveTextures; }
     bool alwaysReserveTextures() const { return m_alwaysReserveTextures; }
@@ -360,8 +360,8 @@ private:
     bool m_nonFastScrollableRegionChanged;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
-    Color m_backgroundColor;
-    Color m_debugBorderColor;
+    SkColor m_backgroundColor;
+    SkColor m_debugBorderColor;
     float m_debugBorderWidth;
     String m_debugName;
     float m_opacity;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerPainterChromium.h b/Source/WebCore/platform/graphics/chromium/LayerPainterChromium.h
index db6a884c1..bc0352e7c 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerPainterChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerPainterChromium.h
@@ -33,12 +33,13 @@ class SkCanvas;
 
 namespace WebCore {
 
+class FloatRect;
 class IntRect;
 
 class LayerPainterChromium {
 public:
     virtual ~LayerPainterChromium() { }
-    virtual void paint(SkCanvas*, const IntRect& contentRect, IntRect& opaque) = 0;
+    virtual void paint(SkCanvas*, const IntRect& contentRect, FloatRect& opaque) = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index ca2d1902a..55b5929a3 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -38,13 +38,11 @@
 #include "FloatQuad.h"
 #include "GeometryBinding.h"
 #include "GrTexture.h"
-#include "ManagedTexture.h"
-#include "NativeImageSkia.h"
 #include "NotImplemented.h"
 #include "PlatformColor.h"
-#include "PlatformContextSkia.h"
 #include "SharedGraphicsContext3D.h"
 #include "SkBitmap.h"
+#include "SkColor.h"
 #include "TextureManager.h"
 #include "ThrottledTextureUploader.h"
 #include "TraceEvent.h"
@@ -58,6 +56,7 @@
 #include "cc/CCRenderPass.h"
 #include "cc/CCRenderPassDrawQuad.h"
 #include "cc/CCRenderSurfaceFilters.h"
+#include "cc/CCScopedTexture.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
 #include "cc/CCSolidColorDrawQuad.h"
@@ -133,10 +132,10 @@ public:
     }
     virtual ~UnthrottledTextureUploader() { }
 
-    virtual bool isBusy() { return false; }
-    virtual void beginUploads() { }
-    virtual void endUploads() { }
-    virtual void uploadTexture(CCGraphicsContext* context, LayerTextureUpdater::Texture* texture, TextureAllocator* allocator, const IntRect sourceRect, const IntRect destRect) { texture->updateRect(context, allocator, sourceRect, destRect); }
+    virtual bool isBusy() OVERRIDE { return false; }
+    virtual void beginUploads() OVERRIDE { }
+    virtual void endUploads() OVERRIDE { }
+    virtual void uploadTexture(CCGraphicsContext* context, LayerTextureUpdater::Texture* texture, TextureAllocator* allocator, const IntRect sourceRect, const IntRect destRect) OVERRIDE { texture->updateRect(context, allocator, sourceRect, destRect); }
 
 protected:
     UnthrottledTextureUploader() { }
@@ -158,13 +157,14 @@ LayerRendererChromium::LayerRendererChromium(CCRendererClient* client,
                                              TextureUploaderOption textureUploaderSetting)
     : CCRenderer(client)
     , m_currentRenderPass(0)
-    , m_currentManagedTexture(0)
+    , m_currentTexture(0)
     , m_offscreenFramebufferId(0)
     , m_sharedGeometryQuad(FloatRect(-0.5f, -0.5f, 1.0f, 1.0f))
     , m_context(context)
     , m_defaultRenderPass(0)
     , m_isViewportChanged(false)
     , m_isFramebufferDiscarded(false)
+    , m_isUsingBindUniform(false)
     , m_visible(true)
     , m_textureUploaderSetting(textureUploaderSetting)
 {
@@ -228,6 +228,8 @@ bool LayerRendererChromium::initialize()
     GLC(m_context, m_context->getIntegerv(GraphicsContext3D::MAX_TEXTURE_SIZE, &m_capabilities.maxTextureSize));
     m_capabilities.bestTextureFormat = PlatformColor::bestTextureFormat(m_context, extensions.contains("GL_EXT_texture_format_BGRA8888"));
 
+    m_isUsingBindUniform = extensions.contains("GL_CHROMIUM_bind_uniform_location");
+
     if (!initializeSharedObjects())
         return false;
 
@@ -272,8 +274,7 @@ void LayerRendererChromium::setVisible(bool visible)
 
 void LayerRendererChromium::releaseRenderPassTextures()
 {
-    if (m_implTextureManager)
-        m_implTextureManager->evictAndDeleteAllTextures(m_implTextureAllocator.get());
+    m_renderPassTextures.clear();
 }
 
 void LayerRendererChromium::viewportChanged()
@@ -310,15 +311,58 @@ void LayerRendererChromium::clearRenderPass(const CCRenderPass* renderPass, cons
     GLC(m_context, m_context->enable(GraphicsContext3D::SCISSOR_TEST));
 }
 
+// static
+IntSize LayerRendererChromium::renderPassTextureSize(const CCRenderPass* pass)
+{
+    return pass->framebufferOutputRect().size();
+}
+
+// static
+GC3Denum LayerRendererChromium::renderPassTextureFormat(const CCRenderPass*)
+{
+    return GraphicsContext3D::RGBA;
+}
 
 void LayerRendererChromium::decideRenderPassAllocationsForFrame(const CCRenderPassList& renderPassesInDrawOrder)
 {
-    // FIXME: Get this memory limit from GPU Memory Manager
-    size_t contentsMemoryUseBytes = m_contentsTextureAllocator->currentMemoryUseBytes();
-    size_t maxLimitBytes = TextureManager::highLimitBytes(viewportSize());
-    size_t memoryLimitBytes = maxLimitBytes - contentsMemoryUseBytes > 0u ? maxLimitBytes - contentsMemoryUseBytes : 0u;
+    HashMap<int, const CCRenderPass*> passesInFrame;
+    for (size_t i = 0; i < renderPassesInDrawOrder.size(); ++i)
+        passesInFrame.set(renderPassesInDrawOrder[i]->id(), renderPassesInDrawOrder[i].get());
+
+    Vector<int> passesToDelete;
+    HashMap<int, OwnPtr<CCScopedTexture> >::const_iterator passIterator;
+    for (passIterator = m_renderPassTextures.begin(); passIterator != m_renderPassTextures.end(); ++passIterator) {
+        const CCRenderPass* renderPassInFrame = passesInFrame.get(passIterator->first);
+        if (!renderPassInFrame) {
+            passesToDelete.append(passIterator->first);
+            continue;
+        }
 
-    m_implTextureManager->setMaxMemoryLimitBytes(memoryLimitBytes);
+        const IntSize& requiredSize = renderPassTextureSize(renderPassInFrame);
+        GC3Denum requiredFormat = renderPassTextureFormat(renderPassInFrame);
+        CCScopedTexture* texture = passIterator->second.get();
+        ASSERT(texture);
+
+        if (texture->id() && (texture->size() != requiredSize || texture->format() != requiredFormat))
+            texture->free();
+    }
+
+    // Delete RenderPass textures from the previous frame that will not be used again.
+    for (size_t i = 0; i < passesToDelete.size(); ++i)
+        m_renderPassTextures.remove(passesToDelete[i]);
+
+    for (size_t i = 0; i < renderPassesInDrawOrder.size(); ++i) {
+        if (!m_renderPassTextures.contains(renderPassesInDrawOrder[i]->id())) {
+            OwnPtr<CCScopedTexture> texture = CCScopedTexture::create(m_implTextureAllocator.get());
+            m_renderPassTextures.set(renderPassesInDrawOrder[i]->id(), texture.release());
+        }
+    }
+}
+
+bool LayerRendererChromium::haveCachedResourcesForRenderPassId(int id) const
+{
+    CCScopedTexture* texture = m_renderPassTextures.get(id);
+    return texture && texture->id();
 }
 
 void LayerRendererChromium::beginDrawingFrame(const CCRenderPass* rootRenderPass)
@@ -332,7 +376,7 @@ void LayerRendererChromium::beginDrawingFrame(const CCRenderPass* rootRenderPass
     if (viewportSize().isEmpty())
         return;
 
-    TRACE_EVENT("LayerRendererChromium::drawLayers", this, 0);
+    TRACE_EVENT0("cc", "LayerRendererChromium::drawLayers");
     if (m_isViewportChanged) {
         // Only reshape when we know we are going to draw. Otherwise, the reshape
         // can leave the window at the wrong size if we never draw and the proper
@@ -461,10 +505,10 @@ void LayerRendererChromium::drawDebugBorderQuad(const CCDebugBorderDrawQuad* qua
     LayerRendererChromium::toGLMatrix(&glMatrix[0], projectionMatrix() * renderMatrix);
     GLC(context(), context()->uniformMatrix4fv(program->vertexShader().matrixLocation(), 1, false, &glMatrix[0]));
 
-    const Color& color = quad->color();
-    float alpha = color.alpha() / 255.0;
+    SkColor color = quad->color();
+    float alpha = SkColorGetA(color) / 255.0;
 
-    GLC(context(), context()->uniform4f(program->fragmentShader().colorLocation(), (color.red() / 255.0) * alpha, (color.green() / 255.0) * alpha, (color.blue() / 255.0) * alpha, alpha));
+    GLC(context(), context()->uniform4f(program->fragmentShader().colorLocation(), (SkColorGetR(color) / 255.0) * alpha, (SkColorGetG(color) / 255.0) * alpha, (SkColorGetB(color) / 255.0) * alpha, alpha));
 
     GLC(context(), context()->lineWidth(quad->width()));
 
@@ -472,7 +516,7 @@ void LayerRendererChromium::drawDebugBorderQuad(const CCDebugBorderDrawQuad* qua
     GLC(context(), context()->drawElements(GraphicsContext3D::LINE_LOOP, 4, GraphicsContext3D::UNSIGNED_SHORT, 6 * sizeof(unsigned short)));
 }
 
-static inline SkBitmap applyFilters(LayerRendererChromium* layerRenderer, const WebKit::WebFilterOperations& filters, ManagedTexture* sourceTexture)
+static inline SkBitmap applyFilters(LayerRendererChromium* layerRenderer, const WebKit::WebFilterOperations& filters, CCScopedTexture* sourceTexture)
 {
     if (filters.isEmpty())
         return SkBitmap();
@@ -483,10 +527,10 @@ static inline SkBitmap applyFilters(LayerRendererChromium* layerRenderer, const
 
     layerRenderer->context()->flush();
 
-    return CCRenderSurfaceFilters::apply(filters, sourceTexture->textureId(), sourceTexture->size(), filterContext.get());
+    return CCRenderSurfaceFilters::apply(filters, sourceTexture->id(), sourceTexture->size(), filterContext.get());
 }
 
-void LayerRendererChromium::drawBackgroundFilters(const CCRenderPassDrawQuad* quad, const WebTransformationMatrix& contentsDeviceTransform)
+PassOwnPtr<CCScopedTexture> LayerRendererChromium::drawBackgroundFilters(const CCRenderPassDrawQuad* quad, const WebTransformationMatrix& contentsDeviceTransform)
 {
     // This method draws a background filter, which applies a filter to any pixels behind the quad and seen through its background.
     // The algorithm works as follows:
@@ -502,15 +546,16 @@ void LayerRendererChromium::drawBackgroundFilters(const CCRenderPassDrawQuad* qu
     //
     // Pixel copies in this algorithm occur at steps 2, 3, 4, and 5.
 
-    CCRenderSurface* drawingSurface = quad->renderPass()->targetSurface();
+    // FIXME: When this algorithm changes, update CCLayerTreeHost::prioritizeTextures() accordingly.
+
     if (quad->backgroundFilters().isEmpty())
-        return;
+        return nullptr;
 
     // FIXME: We only allow background filters on an opaque render surface because other surfaces may contain
     // translucent pixels, and the contents behind those translucent pixels wouldn't have the filter applied.
     if (m_currentRenderPass->hasTransparentBackground())
-        return;
-    ASSERT(!m_currentManagedTexture);
+        return nullptr;
+    ASSERT(!m_currentTexture);
 
     // FIXME: Do a single readback for both the surface and replica and cache the filtered results (once filter textures are not reused).
     IntRect deviceRect = enclosingIntRect(CCMathUtil::mapClippedRect(contentsDeviceTransform, sharedGeometryQuad().boundingBox()));
@@ -522,22 +567,25 @@ void LayerRendererChromium::drawBackgroundFilters(const CCRenderPassDrawQuad* qu
 
     deviceRect.intersect(m_currentRenderPass->framebufferOutputRect());
 
-    OwnPtr<ManagedTexture> deviceBackgroundTexture = ManagedTexture::create(m_implTextureManager.get());
+    OwnPtr<CCScopedTexture> deviceBackgroundTexture = CCScopedTexture::create(m_implTextureAllocator.get());
     if (!getFramebufferTexture(deviceBackgroundTexture.get(), deviceRect))
-        return;
+        return nullptr;
 
     SkBitmap filteredDeviceBackground = applyFilters(this, quad->backgroundFilters(), deviceBackgroundTexture.get());
     if (!filteredDeviceBackground.getTexture())
-        return;
+        return nullptr;
 
     GrTexture* texture = reinterpret_cast<GrTexture*>(filteredDeviceBackground.getTexture());
     int filteredDeviceBackgroundTextureId = texture->getTextureHandle();
 
-    if (!drawingSurface->prepareBackgroundTexture(this))
-        return;
+    OwnPtr<CCScopedTexture> backgroundTexture = CCScopedTexture::create(m_implTextureAllocator.get());
+    if (!backgroundTexture->allocate(quad->quadRect().size(), GraphicsContext3D::RGBA))
+        return nullptr;
 
     const CCRenderPass* targetRenderPass = m_currentRenderPass;
-    if (useManagedTexture(drawingSurface->backgroundTexture(), quad->quadRect())) {
+    bool usingBackgroundTexture = useScopedTexture(backgroundTexture.get(), quad->quadRect());
+
+    if (usingBackgroundTexture) {
         // Copy the readback pixels from device to the background texture for the surface.
         WebTransformationMatrix deviceToFramebufferTransform;
         deviceToFramebufferTransform.translate(quad->quadRect().width() / 2.0, quad->quadRect().height() / 2.0);
@@ -547,17 +595,20 @@ void LayerRendererChromium::drawBackgroundFilters(const CCRenderPassDrawQuad* qu
         deviceToFramebufferTransform.translate(deviceRect.x(), deviceRect.y());
 
         copyTextureToFramebuffer(filteredDeviceBackgroundTextureId, deviceRect.size(), deviceToFramebufferTransform);
-
-        useRenderPass(targetRenderPass);
     }
+
+    useRenderPass(targetRenderPass);
+
+    if (!usingBackgroundTexture)
+        return nullptr;
+    return backgroundTexture.release();
 }
 
 void LayerRendererChromium::drawRenderPassQuad(const CCRenderPassDrawQuad* quad)
 {
-    // The replica is always drawn first, so free after drawing the contents.
-    bool shouldReleaseTextures = !quad->isReplica();
-
-    CCRenderSurface* drawingSurface = quad->renderPass()->targetSurface();
+    CCScopedTexture* contentsTexture = m_renderPassTextures.get(quad->renderPassId());
+    if (!contentsTexture || !contentsTexture->id())
+        return;
 
     WebTransformationMatrix renderTransform = quad->layerTransform();
     // Apply a scaling factor to size the quad from 1x1 to its intended size.
@@ -565,30 +616,29 @@ void LayerRendererChromium::drawRenderPassQuad(const CCRenderPassDrawQuad* quad)
     WebTransformationMatrix contentsDeviceTransform = WebTransformationMatrix(windowMatrix() * projectionMatrix() * renderTransform).to2dTransform();
 
     // Can only draw surface if device matrix is invertible.
-    if (!contentsDeviceTransform.isInvertible() || !drawingSurface->hasValidContentsTexture()) {
-        if (shouldReleaseTextures) {
-            drawingSurface->releaseBackgroundTexture();
-            drawingSurface->releaseContentsTexture();
-        }
+    if (!contentsDeviceTransform.isInvertible())
         return;
-    }
 
-    drawBackgroundFilters(quad, contentsDeviceTransform);
+    OwnPtr<CCScopedTexture> backgroundTexture = drawBackgroundFilters(quad, contentsDeviceTransform);
 
     // FIXME: Cache this value so that we don't have to do it for both the surface and its replica.
     // Apply filters to the contents texture.
-    SkBitmap filterBitmap = applyFilters(this, quad->filters(), drawingSurface->contentsTexture());
-    int contentsTextureId = drawingSurface->contentsTexture()->textureId();
+    SkBitmap filterBitmap = applyFilters(this, quad->filters(), contentsTexture);
+    int contentsTextureId = contentsTexture->id();
     if (filterBitmap.getTexture()) {
         GrTexture* texture = reinterpret_cast<GrTexture*>(filterBitmap.getTexture());
         contentsTextureId = texture->getTextureHandle();
     }
 
     // Draw the background texture if there is one.
-    if (drawingSurface->hasValidBackgroundTexture())
-        copyTextureToFramebuffer(drawingSurface->backgroundTexture()->textureId(), quad->quadRect().size(), quad->layerTransform());
+    if (backgroundTexture) {
+        ASSERT(backgroundTexture->size() == quad->quadRect().size());
+        copyTextureToFramebuffer(backgroundTexture->id(), quad->quadRect().size(), quad->layerTransform());
+    }
 
-    FloatQuad deviceQuad = contentsDeviceTransform.mapQuad(sharedGeometryQuad());
+    bool clipped = false;
+    FloatQuad deviceQuad = CCMathUtil::mapQuad(contentsDeviceTransform, sharedGeometryQuad(), clipped);
+    ASSERT(!clipped);
     CCLayerQuad deviceLayerBounds = CCLayerQuad(FloatQuad(deviceQuad.boundingBox()));
     CCLayerQuad deviceLayerEdges = CCLayerQuad(deviceQuad);
 
@@ -661,16 +711,12 @@ void LayerRendererChromium::drawRenderPassQuad(const CCRenderPassDrawQuad* quad)
         GLC(context(), context()->uniform3fv(shaderEdgeLocation, 8, edge));
     }
 
-    // Map device space quad to surface space.
-    FloatQuad surfaceQuad = contentsDeviceTransform.inverse().mapQuad(deviceLayerEdges.floatQuad());
+    // Map device space quad to surface space. contentsDeviceTransform has no perspective since it was generated with to2dTransform() so we don't need to project.
+    FloatQuad surfaceQuad = CCMathUtil::mapQuad(contentsDeviceTransform.inverse(), deviceLayerEdges.floatQuad(), clipped);
+    ASSERT(!clipped);
 
     drawTexturedQuad(quad->layerTransform(), quad->quadRect().width(), quad->quadRect().height(), quad->opacity(), surfaceQuad,
                      shaderMatrixLocation, shaderAlphaLocation, shaderQuadLocation);
-
-    if (shouldReleaseTextures) {
-        drawingSurface->releaseBackgroundTexture();
-        drawingSurface->releaseContentsTexture();
-    }
 }
 
 void LayerRendererChromium::drawSolidColorQuad(const CCSolidColorDrawQuad* quad)
@@ -683,11 +729,11 @@ void LayerRendererChromium::drawSolidColorQuad(const CCSolidColorDrawQuad* quad)
     WebTransformationMatrix tileTransform = quad->quadTransform();
     tileTransform.translate(tileRect.x() + tileRect.width() / 2.0, tileRect.y() + tileRect.height() / 2.0);
 
-    const Color& color = quad->color();
+    SkColor color = quad->color();
     float opacity = quad->opacity();
-    float alpha = (color.alpha() / 255.0) * opacity;
+    float alpha = (SkColorGetA(color) / 255.0) * opacity;
 
-    GLC(context(), context()->uniform4f(program->fragmentShader().colorLocation(), (color.red() / 255.0) * alpha, (color.green() / 255.0) * alpha, (color.blue() / 255.0) * alpha, alpha));
+    GLC(context(), context()->uniform4f(program->fragmentShader().colorLocation(), (SkColorGetR(color) / 255.0) * alpha, (SkColorGetG(color) / 255.0) * alpha, (SkColorGetB(color) / 255.0) * alpha, alpha));
 
     drawTexturedQuad(tileTransform,
                      tileRect.width(), tileRect.height(), 1.0, FloatQuad(),
@@ -762,6 +808,7 @@ void LayerRendererChromium::drawTileQuad(const CCTileDrawQuad* quad)
 
     bool clipped = false;
     FloatQuad deviceLayerQuad = CCMathUtil::mapQuad(deviceTransform, FloatQuad(quad->layerRect()), clipped);
+    ASSERT(!clipped);
 
     TileProgramUniforms uniforms;
     // For now, we simply skip anti-aliasing with the quad is clipped. This only happens
@@ -846,7 +893,8 @@ void LayerRendererChromium::drawTileQuad(const CCTileDrawQuad* quad)
 
         // Map quad to layer space.
         WebTransformationMatrix inverseDeviceTransform = deviceTransform.inverse();
-        localQuad = inverseDeviceTransform.mapQuad(deviceQuad.floatQuad());
+        localQuad = CCMathUtil::mapQuad(inverseDeviceTransform, deviceQuad.floatQuad(), clipped);
+        ASSERT(!clipped);
     } else {
         // Move fragment shader transform to vertex shader. We can do this while
         // still producing correct results as fragmentTexTransformLocation
@@ -1002,8 +1050,17 @@ void LayerRendererChromium::drawTextureQuad(const CCTextureDrawQuad* quad)
     GLC(context(), context()->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE));
     GLC(context(), context()->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE));
 
-    if (!quad->premultipliedAlpha())
-        GLC(context(), context()->blendFunc(GraphicsContext3D::SRC_ALPHA, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
+    if (!quad->premultipliedAlpha()) {
+        // As it turns out, the premultiplied alpha blending function (ONE, ONE_MINUS_SRC_ALPHA)
+        // will never cause the alpha channel to be set to anything less than 1.0 if it is
+        // initialized to that value! Therefore, premultipliedAlpha being false is the first
+        // situation we can generally see an alpha channel less than 1.0 coming out of the
+        // compositor. This is causing platform differences in some layout tests (see
+        // https://bugs.webkit.org/show_bug.cgi?id=82412), so in this situation, use a separate
+        // blend function for the alpha channel to avoid modifying it. Don't use colorMask for this
+        // as it has performance implications on some platforms.
+        GLC(context(), context()->blendFuncSeparate(GraphicsContext3D::SRC_ALPHA, GraphicsContext3D::ONE_MINUS_SRC_ALPHA, GraphicsContext3D::ZERO, GraphicsContext3D::ONE));
+    }
 
     WebTransformationMatrix quadTransform = quad->quadTransform();
     IntRect quadRect = quad->quadRect();
@@ -1042,8 +1099,10 @@ void LayerRendererChromium::drawIOSurfaceQuad(const CCIOSurfaceDrawQuad* quad)
     GLC(context(), context()->bindTexture(Extensions3D::TEXTURE_RECTANGLE_ARB, 0));
 }
 
-void LayerRendererChromium::drawHeadsUpDisplay(ManagedTexture* hudTexture, const IntSize& hudSize)
+void LayerRendererChromium::drawHeadsUpDisplay(const CCScopedTexture* hudTexture, const IntSize& hudSize)
 {
+    ASSERT(hudTexture->id());
+
     GLC(m_context, m_context->enable(GraphicsContext3D::BLEND));
     GLC(m_context, m_context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
     GLC(m_context, m_context->disable(GraphicsContext3D::SCISSOR_TEST));
@@ -1052,9 +1111,7 @@ void LayerRendererChromium::drawHeadsUpDisplay(ManagedTexture* hudTexture, const
     const HeadsUpDisplayProgram* program = headsUpDisplayProgram();
     ASSERT(program && program->initialized());
     GLC(m_context, m_context->activeTexture(GraphicsContext3D::TEXTURE0));
-    if (!hudTexture->textureId())
-        hudTexture->allocate(m_implTextureAllocator.get());
-    GLC(m_context, m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, hudTexture->textureId()));
+    GLC(m_context, m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, hudTexture->id()));
     GLC(m_context, m_context->useProgram(program->program()));
     GLC(m_context, m_context->uniform1i(program->fragmentShader().samplerLocation(), 0));
 
@@ -1070,9 +1127,6 @@ void LayerRendererChromium::finishDrawingFrame()
 {
     GLC(m_context, m_context->disable(GraphicsContext3D::SCISSOR_TEST));
     GLC(m_context, m_context->disable(GraphicsContext3D::BLEND));
-
-    m_implTextureManager->unprotectAllTextures();
-    m_implTextureManager->deleteEvictedTextures(m_implTextureAllocator.get());
 }
 
 void LayerRendererChromium::toGLMatrix(float* flattened, const WebTransformationMatrix& m)
@@ -1151,7 +1205,7 @@ void LayerRendererChromium::copyTextureToFramebuffer(int textureId, const IntSiz
 
 void LayerRendererChromium::finish()
 {
-    TRACE_EVENT("LayerRendererChromium::finish", this, 0);
+    TRACE_EVENT0("cc", "LayerRendererChromium::finish");
     m_context->finish();
 }
 
@@ -1160,7 +1214,7 @@ bool LayerRendererChromium::swapBuffers(const IntRect& subBuffer)
     ASSERT(m_visible);
     ASSERT(!m_isFramebufferDiscarded);
 
-    TRACE_EVENT("LayerRendererChromium::swapBuffers", this, 0);
+    TRACE_EVENT0("cc", "LayerRendererChromium::swapBuffers");
     // We're done! Time to swapbuffers!
 
     if (m_capabilities.usingPartialSwap) {
@@ -1301,14 +1355,14 @@ void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& re
     }
 }
 
-bool LayerRendererChromium::getFramebufferTexture(ManagedTexture* texture, const IntRect& deviceRect)
+bool LayerRendererChromium::getFramebufferTexture(CCScopedTexture* texture, const IntRect& deviceRect)
 {
-    if (!texture->reserve(deviceRect.size(), GraphicsContext3D::RGB))
+    ASSERT(!texture->id() || (texture->size() == deviceRect.size() && texture->format() == GraphicsContext3D::RGB));
+
+    if (!texture->id() && !texture->allocate(deviceRect.size(), GraphicsContext3D::RGB))
         return false;
 
-    if (!texture->textureId())
-        texture->allocate(m_implTextureAllocator.get());
-    GLC(m_context, m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture->textureId()));
+    GLC(m_context, m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture->id()));
     GLC(m_context, m_context->copyTexImage2D(GraphicsContext3D::TEXTURE_2D, 0, texture->format(),
                                              deviceRect.x(), deviceRect.y(), deviceRect.width(), deviceRect.height(), 0));
     return true;
@@ -1316,13 +1370,13 @@ bool LayerRendererChromium::getFramebufferTexture(ManagedTexture* texture, const
 
 bool LayerRendererChromium::isCurrentRenderPass(const CCRenderPass* renderPass)
 {
-    return m_currentRenderPass == renderPass && !m_currentManagedTexture;
+    return m_currentRenderPass == renderPass && !m_currentTexture;
 }
 
 bool LayerRendererChromium::useRenderPass(const CCRenderPass* renderPass)
 {
     m_currentRenderPass = renderPass;
-    m_currentManagedTexture = 0;
+    m_currentTexture = 0;
 
     if (renderPass == m_defaultRenderPass) {
         GLC(m_context, m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, 0));
@@ -1330,27 +1384,31 @@ bool LayerRendererChromium::useRenderPass(const CCRenderPass* renderPass)
         return true;
     }
 
-    if (!renderPass->targetSurface()->prepareContentsTexture(this))
+    CCScopedTexture* texture = m_renderPassTextures.get(renderPass->id());
+    ASSERT(texture);
+
+    if (!texture->id() && !texture->allocate(renderPassTextureSize(renderPass), renderPassTextureFormat(renderPass)))
         return false;
 
-    return bindFramebufferToTexture(renderPass->targetSurface()->contentsTexture(), renderPass->framebufferOutputRect());
+    return bindFramebufferToTexture(texture, renderPass->framebufferOutputRect());
 }
 
-bool LayerRendererChromium::useManagedTexture(ManagedTexture* texture, const IntRect& viewportRect)
+bool LayerRendererChromium::useScopedTexture(const CCScopedTexture* texture, const IntRect& viewportRect)
 {
+    ASSERT(texture->id());
+
     m_currentRenderPass = 0;
-    m_currentManagedTexture = texture;
+    m_currentTexture = texture;
 
     return bindFramebufferToTexture(texture, viewportRect);
 }
 
-bool LayerRendererChromium::bindFramebufferToTexture(ManagedTexture* texture, const IntRect& framebufferRect)
+bool LayerRendererChromium::bindFramebufferToTexture(const CCScopedTexture* texture, const IntRect& framebufferRect)
 {
-    GLC(m_context, m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_offscreenFramebufferId));
+    ASSERT(texture->id());
 
-    if (!texture->textureId())
-        texture->allocate(m_implTextureAllocator.get());
-    GLC(m_context, m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, texture->textureId(), 0));
+    GLC(m_context, m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_offscreenFramebufferId));
+    GLC(m_context, m_context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, texture->id(), 0));
 
 #if !defined ( NDEBUG )
     if (m_context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
@@ -1407,7 +1465,7 @@ void LayerRendererChromium::setDrawFramebufferRect(const IntRect& drawRect, bool
 
 bool LayerRendererChromium::initializeSharedObjects()
 {
-    TRACE_EVENT("LayerRendererChromium::initializeSharedObjects", this, 0);
+    TRACE_EVENT0("cc", "LayerRendererChromium::initializeSharedObjects");
     makeContextCurrent();
 
     // Create an FBO for doing offscreen rendering.
@@ -1422,16 +1480,13 @@ bool LayerRendererChromium::initializeSharedObjects()
 
     GLC(m_context, m_context->flush());
 
-    m_implTextureManager = TextureManager::create(TextureManager::highLimitBytes(viewportSize()),
-                                                  TextureManager::reclaimLimitBytes(viewportSize()),
-                                                  m_capabilities.maxTextureSize);
-    m_textureCopier = AcceleratedTextureCopier::create(m_context);
+    m_textureCopier = AcceleratedTextureCopier::create(m_context, m_isUsingBindUniform);
     if (m_textureUploaderSetting == ThrottledUploader)
         m_textureUploader = ThrottledTextureUploader::create(m_context);
     else
         m_textureUploader = UnthrottledTextureUploader::create();
-    m_contentsTextureAllocator = TrackingTextureAllocator::create(m_context);
-    m_implTextureAllocator = TrackingTextureAllocator::create(m_context);
+    m_contentsTextureAllocator = TrackingTextureAllocator::create(m_context, m_capabilities.maxTextureSize);
+    m_implTextureAllocator = TrackingTextureAllocator::create(m_context, m_capabilities.maxTextureSize);
     if (m_capabilities.usingTextureUsageHint)
         m_implTextureAllocator->setTextureUsageHint(TrackingTextureAllocator::FramebufferAttachment);
     if (m_capabilities.usingTextureStorageExtension) {
@@ -1447,8 +1502,8 @@ const LayerRendererChromium::TileCheckerboardProgram* LayerRendererChromium::til
     if (!m_tileCheckerboardProgram)
         m_tileCheckerboardProgram = adoptPtr(new TileCheckerboardProgram(m_context));
     if (!m_tileCheckerboardProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::checkerboardProgram::initalize", this, 0);
-        m_tileCheckerboardProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::checkerboardProgram::initalize");
+        m_tileCheckerboardProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_tileCheckerboardProgram.get();
 }
@@ -1458,8 +1513,8 @@ const LayerRendererChromium::SolidColorProgram* LayerRendererChromium::solidColo
     if (!m_solidColorProgram)
         m_solidColorProgram = adoptPtr(new SolidColorProgram(m_context));
     if (!m_solidColorProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::solidColorProgram::initialize", this, 0);
-        m_solidColorProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::solidColorProgram::initialize");
+        m_solidColorProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_solidColorProgram.get();
 }
@@ -1469,8 +1524,8 @@ const LayerRendererChromium::HeadsUpDisplayProgram* LayerRendererChromium::heads
     if (!m_headsUpDisplayProgram)
         m_headsUpDisplayProgram = adoptPtr(new HeadsUpDisplayProgram(m_context));
     if (!m_headsUpDisplayProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::headsUpDisplayProgram::initialize", this, 0);
-        m_headsUpDisplayProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::headsUpDisplayProgram::initialize");
+        m_headsUpDisplayProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_headsUpDisplayProgram.get();
 }
@@ -1479,8 +1534,8 @@ const LayerRendererChromium::RenderPassProgram* LayerRendererChromium::renderPas
 {
     ASSERT(m_renderPassProgram);
     if (!m_renderPassProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::renderPassProgram::initialize", this, 0);
-        m_renderPassProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::renderPassProgram::initialize");
+        m_renderPassProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_renderPassProgram.get();
 }
@@ -1490,8 +1545,8 @@ const LayerRendererChromium::RenderPassProgramAA* LayerRendererChromium::renderP
     if (!m_renderPassProgramAA)
         m_renderPassProgramAA = adoptPtr(new RenderPassProgramAA(m_context));
     if (!m_renderPassProgramAA->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::renderPassProgramAA::initialize", this, 0);
-        m_renderPassProgramAA->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::renderPassProgramAA::initialize");
+        m_renderPassProgramAA->initialize(m_context, m_isUsingBindUniform);
     }
     return m_renderPassProgramAA.get();
 }
@@ -1501,8 +1556,8 @@ const LayerRendererChromium::RenderPassMaskProgram* LayerRendererChromium::rende
     if (!m_renderPassMaskProgram)
         m_renderPassMaskProgram = adoptPtr(new RenderPassMaskProgram(m_context));
     if (!m_renderPassMaskProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::renderPassMaskProgram::initialize", this, 0);
-        m_renderPassMaskProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::renderPassMaskProgram::initialize");
+        m_renderPassMaskProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_renderPassMaskProgram.get();
 }
@@ -1512,8 +1567,8 @@ const LayerRendererChromium::RenderPassMaskProgramAA* LayerRendererChromium::ren
     if (!m_renderPassMaskProgramAA)
         m_renderPassMaskProgramAA = adoptPtr(new RenderPassMaskProgramAA(m_context));
     if (!m_renderPassMaskProgramAA->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::renderPassMaskProgramAA::initialize", this, 0);
-        m_renderPassMaskProgramAA->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::renderPassMaskProgramAA::initialize");
+        m_renderPassMaskProgramAA->initialize(m_context, m_isUsingBindUniform);
     }
     return m_renderPassMaskProgramAA.get();
 }
@@ -1522,8 +1577,8 @@ const LayerRendererChromium::TileProgram* LayerRendererChromium::tileProgram()
 {
     ASSERT(m_tileProgram);
     if (!m_tileProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::tileProgram::initialize", this, 0);
-        m_tileProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::tileProgram::initialize");
+        m_tileProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_tileProgram.get();
 }
@@ -1532,8 +1587,8 @@ const LayerRendererChromium::TileProgramOpaque* LayerRendererChromium::tileProgr
 {
     ASSERT(m_tileProgramOpaque);
     if (!m_tileProgramOpaque->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::tileProgramOpaque::initialize", this, 0);
-        m_tileProgramOpaque->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::tileProgramOpaque::initialize");
+        m_tileProgramOpaque->initialize(m_context, m_isUsingBindUniform);
     }
     return m_tileProgramOpaque.get();
 }
@@ -1543,8 +1598,8 @@ const LayerRendererChromium::TileProgramAA* LayerRendererChromium::tileProgramAA
     if (!m_tileProgramAA)
         m_tileProgramAA = adoptPtr(new TileProgramAA(m_context));
     if (!m_tileProgramAA->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::tileProgramAA::initialize", this, 0);
-        m_tileProgramAA->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::tileProgramAA::initialize");
+        m_tileProgramAA->initialize(m_context, m_isUsingBindUniform);
     }
     return m_tileProgramAA.get();
 }
@@ -1554,8 +1609,8 @@ const LayerRendererChromium::TileProgramSwizzle* LayerRendererChromium::tileProg
     if (!m_tileProgramSwizzle)
         m_tileProgramSwizzle = adoptPtr(new TileProgramSwizzle(m_context));
     if (!m_tileProgramSwizzle->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::tileProgramSwizzle::initialize", this, 0);
-        m_tileProgramSwizzle->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::tileProgramSwizzle::initialize");
+        m_tileProgramSwizzle->initialize(m_context, m_isUsingBindUniform);
     }
     return m_tileProgramSwizzle.get();
 }
@@ -1565,8 +1620,8 @@ const LayerRendererChromium::TileProgramSwizzleOpaque* LayerRendererChromium::ti
     if (!m_tileProgramSwizzleOpaque)
         m_tileProgramSwizzleOpaque = adoptPtr(new TileProgramSwizzleOpaque(m_context));
     if (!m_tileProgramSwizzleOpaque->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::tileProgramSwizzleOpaque::initialize", this, 0);
-        m_tileProgramSwizzleOpaque->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::tileProgramSwizzleOpaque::initialize");
+        m_tileProgramSwizzleOpaque->initialize(m_context, m_isUsingBindUniform);
     }
     return m_tileProgramSwizzleOpaque.get();
 }
@@ -1576,8 +1631,8 @@ const LayerRendererChromium::TileProgramSwizzleAA* LayerRendererChromium::tilePr
     if (!m_tileProgramSwizzleAA)
         m_tileProgramSwizzleAA = adoptPtr(new TileProgramSwizzleAA(m_context));
     if (!m_tileProgramSwizzleAA->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::tileProgramSwizzleAA::initialize", this, 0);
-        m_tileProgramSwizzleAA->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::tileProgramSwizzleAA::initialize");
+        m_tileProgramSwizzleAA->initialize(m_context, m_isUsingBindUniform);
     }
     return m_tileProgramSwizzleAA.get();
 }
@@ -1587,8 +1642,8 @@ const LayerRendererChromium::TextureProgram* LayerRendererChromium::textureProgr
     if (!m_textureProgram)
         m_textureProgram = adoptPtr(new TextureProgram(m_context));
     if (!m_textureProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::textureProgram::initialize", this, 0);
-        m_textureProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::textureProgram::initialize");
+        m_textureProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_textureProgram.get();
 }
@@ -1598,8 +1653,8 @@ const LayerRendererChromium::TextureProgramFlip* LayerRendererChromium::textureP
     if (!m_textureProgramFlip)
         m_textureProgramFlip = adoptPtr(new TextureProgramFlip(m_context));
     if (!m_textureProgramFlip->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::textureProgramFlip::initialize", this, 0);
-        m_textureProgramFlip->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::textureProgramFlip::initialize");
+        m_textureProgramFlip->initialize(m_context, m_isUsingBindUniform);
     }
     return m_textureProgramFlip.get();
 }
@@ -1609,8 +1664,8 @@ const LayerRendererChromium::TextureIOSurfaceProgram* LayerRendererChromium::tex
     if (!m_textureIOSurfaceProgram)
         m_textureIOSurfaceProgram = adoptPtr(new TextureIOSurfaceProgram(m_context));
     if (!m_textureIOSurfaceProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::textureIOSurfaceProgram::initialize", this, 0);
-        m_textureIOSurfaceProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::textureIOSurfaceProgram::initialize");
+        m_textureIOSurfaceProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_textureIOSurfaceProgram.get();
 }
@@ -1620,8 +1675,8 @@ const LayerRendererChromium::VideoYUVProgram* LayerRendererChromium::videoYUVPro
     if (!m_videoYUVProgram)
         m_videoYUVProgram = adoptPtr(new VideoYUVProgram(m_context));
     if (!m_videoYUVProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::videoYUVProgram::initialize", this, 0);
-        m_videoYUVProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::videoYUVProgram::initialize");
+        m_videoYUVProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_videoYUVProgram.get();
 }
@@ -1631,8 +1686,8 @@ const LayerRendererChromium::VideoStreamTextureProgram* LayerRendererChromium::v
     if (!m_videoStreamTextureProgram)
         m_videoStreamTextureProgram = adoptPtr(new VideoStreamTextureProgram(m_context));
     if (!m_videoStreamTextureProgram->initialized()) {
-        TRACE_EVENT("LayerRendererChromium::streamTextureProgram::initialize", this, 0);
-        m_videoStreamTextureProgram->initialize(m_context);
+        TRACE_EVENT0("cc", "LayerRendererChromium::streamTextureProgram::initialize");
+        m_videoStreamTextureProgram->initialize(m_context, m_isUsingBindUniform);
     }
     return m_videoStreamTextureProgram.get();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 34254b00b..6afe66806 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -51,13 +51,13 @@ class CCDebugBorderDrawQuad;
 class CCDrawQuad;
 class CCIOSurfaceDrawQuad;
 class CCRenderPassDrawQuad;
+class CCScopedTexture;
 class CCSolidColorDrawQuad;
 class CCStreamVideoDrawQuad;
 class CCTextureDrawQuad;
 class CCTileDrawQuad;
 class CCYUVVideoDrawQuad;
 class GeometryBinding;
-class ManagedTexture;
 class ScopedEnsureFramebufferAllocation;
 
 // Class that handles drawing of composited render layers using GL.
@@ -80,11 +80,13 @@ public:
     const FloatQuad& sharedGeometryQuad() const { return m_sharedGeometryQuad; }
 
     virtual void decideRenderPassAllocationsForFrame(const CCRenderPassList&) OVERRIDE;
+    virtual bool haveCachedResourcesForRenderPassId(int id) const OVERRIDE;
+
     virtual void beginDrawingFrame(const CCRenderPass* defaultRenderPass) OVERRIDE;
     virtual void drawRenderPass(const CCRenderPass*, const FloatRect& framebufferDamageRect) OVERRIDE;
     virtual void finishDrawingFrame() OVERRIDE;
 
-    virtual void drawHeadsUpDisplay(ManagedTexture*, const IntSize& hudSize) OVERRIDE;
+    virtual void drawHeadsUpDisplay(const CCScopedTexture*, const IntSize& hudSize) OVERRIDE;
 
     // waits for rendering to finish
     virtual void finish() OVERRIDE;
@@ -98,9 +100,8 @@ public:
     const GeometryBinding* sharedGeometry() const { return m_sharedGeometry.get(); }
 
     virtual void getFramebufferPixels(void *pixels, const IntRect&) OVERRIDE;
-    bool getFramebufferTexture(ManagedTexture*, const IntRect& deviceRect);
+    bool getFramebufferTexture(CCScopedTexture*, const IntRect& deviceRect);
 
-    virtual TextureManager* implTextureManager() const OVERRIDE { return m_implTextureManager.get(); }
     virtual TextureCopier* textureCopier() const OVERRIDE { return m_textureCopier.get(); }
     virtual TextureUploader* textureUploader() const OVERRIDE { return m_textureUploader.get(); }
     virtual TextureAllocator* implTextureAllocator() const OVERRIDE { return m_implTextureAllocator.get(); }
@@ -123,13 +124,15 @@ protected:
     bool isFramebufferDiscarded() const { return m_isFramebufferDiscarded; }
     bool initialize();
 
+    void releaseRenderPassTextures();
+
 private:
     static void toGLMatrix(float*, const WebKit::WebTransformationMatrix&);
 
     void drawQuad(const CCDrawQuad*);
     void drawCheckerboardQuad(const CCCheckerboardDrawQuad*);
     void drawDebugBorderQuad(const CCDebugBorderDrawQuad*);
-    void drawBackgroundFilters(const CCRenderPassDrawQuad*, const WebKit::WebTransformationMatrix& deviceTransform);
+    PassOwnPtr<CCScopedTexture> drawBackgroundFilters(const CCRenderPassDrawQuad*, const WebKit::WebTransformationMatrix& deviceTransform);
     void drawRenderPassQuad(const CCRenderPassDrawQuad*);
     void drawSolidColorQuad(const CCSolidColorDrawQuad*);
     void drawStreamVideoQuad(const CCStreamVideoDrawQuad*);
@@ -140,17 +143,15 @@ private:
 
     void setDrawFramebufferRect(const IntRect&, bool flipY);
 
-    // The current drawing target is either a RenderPass or ManagedTexture. Use these functions to switch to a new drawing target.
+    // The current drawing target is either a RenderPass or ScopedTexture. Use these functions to switch to a new drawing target.
     bool useRenderPass(const CCRenderPass*);
-    bool useManagedTexture(ManagedTexture*, const IntRect& viewportRect);
+    bool useScopedTexture(const CCScopedTexture*, const IntRect& viewportRect);
     bool isCurrentRenderPass(const CCRenderPass*);
 
-    bool bindFramebufferToTexture(ManagedTexture*, const IntRect& viewportRect);
+    bool bindFramebufferToTexture(const CCScopedTexture*, const IntRect& viewportRect);
 
     void clearRenderPass(const CCRenderPass*, const FloatRect& framebufferDamageRect);
 
-    void releaseRenderPassTextures();
-
     bool makeContextCurrent();
 
     bool initializeSharedObjects();
@@ -168,10 +169,13 @@ private:
     // WebGraphicsContext3D::WebGraphicsContextLostCallback implementation.
     virtual void onContextLost() OVERRIDE;
 
+    static IntSize renderPassTextureSize(const CCRenderPass*);
+    static GC3Denum renderPassTextureFormat(const CCRenderPass*);
+
     LayerRendererCapabilities m_capabilities;
 
     const CCRenderPass* m_currentRenderPass;
-    ManagedTexture* m_currentManagedTexture;
+    const CCScopedTexture* m_currentTexture;
     unsigned m_offscreenFramebufferId;
 
     OwnPtr<GeometryBinding> m_sharedGeometry;
@@ -257,18 +261,20 @@ private:
     OwnPtr<SolidColorProgram> m_solidColorProgram;
     OwnPtr<HeadsUpDisplayProgram> m_headsUpDisplayProgram;
 
-    OwnPtr<TextureManager> m_implTextureManager;
     OwnPtr<AcceleratedTextureCopier> m_textureCopier;
     OwnPtr<TextureUploader> m_textureUploader;
     OwnPtr<TrackingTextureAllocator> m_contentsTextureAllocator;
     OwnPtr<TrackingTextureAllocator> m_implTextureAllocator;
 
+    HashMap<int, OwnPtr<CCScopedTexture> > m_renderPassTextures;
+
     WebKit::WebGraphicsContext3D* m_context;
 
     const CCRenderPass* m_defaultRenderPass;
 
     bool m_isViewportChanged;
     bool m_isFramebufferDiscarded;
+    bool m_isUsingBindUniform;
     bool m_visible;
     TextureUploaderOption m_textureUploaderSetting;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTextureSubImage.cpp b/Source/WebCore/platform/graphics/chromium/LayerTextureSubImage.cpp
index 4aa9965e7..b87b43d94 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTextureSubImage.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTextureSubImage.cpp
@@ -68,7 +68,7 @@ void LayerTextureSubImage::uploadWithTexSubImage(const uint8_t* image, const Int
                                                  const IntRect& sourceRect, const IntRect& destRect,
                                                  GC3Denum format, CCGraphicsContext* context)
 {
-    TRACE_EVENT("LayerTextureSubImage::uploadWithTexSubImage", this, 0);
+    TRACE_EVENT0("cc", "LayerTextureSubImage::uploadWithTexSubImage");
     if (!m_subImage)
         m_subImage = adoptArrayPtr(new uint8_t[m_subImageSize.width() * m_subImageSize.height() * 4]);
 
@@ -101,7 +101,7 @@ void LayerTextureSubImage::uploadWithMapTexSubImage(const uint8_t* image, const
                                                     const IntRect& sourceRect, const IntRect& destRect,
                                                     GC3Denum format, CCGraphicsContext* context)
 {
-    TRACE_EVENT("LayerTextureSubImage::uploadWithMapTexSubImage", this, 0);
+    TRACE_EVENT0("cc", "LayerTextureSubImage::uploadWithMapTexSubImage");
     WebKit::WebGraphicsContext3D* context3d = context->context3D();
     if (!context3d) {
         // FIXME: Implement this path for software compositing.
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h
index cec8ebcd8..fd8ed883c 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerTextureUpdater.h
@@ -29,8 +29,9 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "ManagedTexture.h"
 #include "GraphicsTypes3D.h"
+#include "cc/CCGraphicsContext.h"
+#include "cc/CCPrioritizedTexture.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
@@ -48,14 +49,15 @@ public:
     public:
         virtual ~Texture() { }
 
-        ManagedTexture* texture() { return m_texture.get(); }
+        CCPrioritizedTexture* texture() { return m_texture.get(); }
+        void swapTextureWith(OwnPtr<CCPrioritizedTexture>& texture) { m_texture.swap(texture); }
         virtual void prepareRect(const IntRect& /* sourceRect */) { }
         virtual void updateRect(CCGraphicsContext*, TextureAllocator*, const IntRect& sourceRect, const IntRect& destRect) = 0;
     protected:
-        explicit Texture(PassOwnPtr<ManagedTexture> texture) : m_texture(texture) { }
+        explicit Texture(PassOwnPtr<CCPrioritizedTexture> texture) : m_texture(texture) { }
 
     private:
-        OwnPtr<ManagedTexture> m_texture;
+        OwnPtr<CCPrioritizedTexture> m_texture;
     };
 
     virtual ~LayerTextureUpdater() { }
@@ -65,7 +67,7 @@ public:
         SampledTexelFormatBGRA,
         SampledTexelFormatInvalid,
     };
-    virtual PassOwnPtr<Texture> createTexture(TextureManager*) = 0;
+    virtual PassOwnPtr<Texture> createTexture(CCPrioritizedTextureManager*) = 0;
     // Returns the format of the texel uploaded by this interface.
     // This format should not be confused by texture internal format.
     // This format specifies the component order in the sampled texel.
@@ -73,7 +75,7 @@ public:
     virtual SampledTexelFormat sampledTexelFormat(GC3Denum textureFormat) = 0;
     // The |resultingOpaqueRect| gives back a region of the layer that was painted opaque. If the layer is marked opaque in the updater,
     // then this region should be ignored in preference for the entire layer's area.
-    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsScale, IntRect& resultingOpaqueRect) { }
+    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect) { }
 
     // Set true by the layer when it is known that the entire output is going to be opaque.
     virtual void setOpaque(bool) { }
diff --git a/Source/WebCore/platform/graphics/chromium/LinkHighlight.cpp b/Source/WebCore/platform/graphics/chromium/LinkHighlight.cpp
index 3bc1e63da..1b2c61e69 100644
--- a/Source/WebCore/platform/graphics/chromium/LinkHighlight.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LinkHighlight.cpp
@@ -92,7 +92,7 @@ ContentLayerChromium* LinkHighlight::contentLayer()
     return m_contentLayer.get();
 }
 
-void LinkHighlight::paintContents(SkCanvas* canvas, const IntRect&, IntRect&)
+void LinkHighlight::paintContents(SkCanvas* canvas, const IntRect&, FloatRect&)
 {
     PlatformContextSkia platformContext(canvas);
     GraphicsContext gc(&platformContext);
diff --git a/Source/WebCore/platform/graphics/chromium/LinkHighlight.h b/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
index 1fbef9ba9..1ccc3ebdf 100644
--- a/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
+++ b/Source/WebCore/platform/graphics/chromium/LinkHighlight.h
@@ -45,7 +45,7 @@ public:
     ContentLayerChromium* contentLayer();
 
     // ContentLayerDelegate implementation.
-    virtual void paintContents(SkCanvas*, const IntRect& clipRect, IntRect& opaque) OVERRIDE;
+    virtual void paintContents(SkCanvas*, const IntRect& clipRect, FloatRect& opaque) OVERRIDE;
 
     // CCLayerAnimationDelegate implementation.
     virtual void notifyAnimationStarted(double time) OVERRIDE;
diff --git a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp
index 04548aecb..a5155e272 100644
--- a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp
+++ b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.cpp
@@ -31,8 +31,10 @@
 #include "GraphicsContext.h"
 #include "IntRect.h"
 #include "PlatformContextSkia.h"
+#include <public/WebFloatRect.h>
 #include <public/WebRect.h>
 
+using WebKit::WebFloatRect;
 using WebKit::WebRect;
 
 namespace WebCore {
@@ -47,7 +49,7 @@ OpaqueRectTrackingContentLayerDelegate::~OpaqueRectTrackingContentLayerDelegate(
 {
 }
 
-void OpaqueRectTrackingContentLayerDelegate::paintContents(SkCanvas* canvas, const WebRect& clip, WebRect& opaque)
+void OpaqueRectTrackingContentLayerDelegate::paintContents(SkCanvas* canvas, const WebRect& clip, WebFloatRect& opaque)
 {
     PlatformContextSkia platformContext(canvas);
     platformContext.setTrackOpaqueRegion(!m_opaque);
@@ -62,8 +64,7 @@ void OpaqueRectTrackingContentLayerDelegate::paintContents(SkCanvas* canvas, con
     // Transform tracked opaque paints back to our layer's content space.
     ASSERT(canvasToContentTransform.isInvertible());
     ASSERT(canvasToContentTransform.preservesAxisAlignment());
-    FloatRect opaqueCanvasRect = platformContext.opaqueRegion().asRect();
-    opaque = enclosedIntRect(canvasToContentTransform.mapRect(opaqueCanvasRect));
+    opaque = canvasToContentTransform.mapRect(platformContext.opaqueRegion().asRect());
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h
index e325b36e1..bb5c2ae96 100644
--- a/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h
+++ b/Source/WebCore/platform/graphics/chromium/OpaqueRectTrackingContentLayerDelegate.h
@@ -55,7 +55,7 @@ public:
     void setOpaque(bool opaque) { m_opaque = opaque; }
 
     // WebKit::WebContentLayerClient implementation.
-    virtual void paintContents(SkCanvas*, const WebKit::WebRect& clip, WebKit::WebRect& opaque) OVERRIDE;
+    virtual void paintContents(SkCanvas*, const WebKit::WebRect& clip, WebKit::WebFloatRect& opaque) OVERRIDE;
 
 private:
     GraphicsContextPainter* m_painter;
diff --git a/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp b/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp
index 6afbb34ae..1abc2186a 100644
--- a/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ProgramBinding.cpp
@@ -34,6 +34,7 @@
 #include "LayerRendererChromium.h"
 #include "TraceEvent.h"
 #include <public/WebGraphicsContext3D.h>
+#include <wtf/text/CString.h>
 
 using WebKit::WebGraphicsContext3D;
 
@@ -41,6 +42,8 @@ namespace WebCore {
 
 ProgramBindingBase::ProgramBindingBase()
     : m_program(0)
+    , m_vertexShaderId(0)
+    , m_fragmentShaderId(0)
     , m_initialized(false)
 {
 }
@@ -49,6 +52,8 @@ ProgramBindingBase::~ProgramBindingBase()
 {
     // If you hit these asserts, you initialized but forgot to call cleanup().
     ASSERT(!m_program);
+    ASSERT(!m_vertexShaderId);
+    ASSERT(!m_fragmentShaderId);
     ASSERT(!m_initialized);
 }
 
@@ -60,10 +65,43 @@ static bool contextLost(WebGraphicsContext3D* context)
 
 void ProgramBindingBase::init(WebGraphicsContext3D* context, const String& vertexShader, const String& fragmentShader)
 {
-    m_program = createShaderProgram(context, vertexShader, fragmentShader);
+    TRACE_EVENT("ProgramBindingBase::init", this, 0);
+    m_vertexShaderId = loadShader(context, GraphicsContext3D::VERTEX_SHADER, vertexShader);
+    if (!m_vertexShaderId) {
+        if (!contextLost(context))
+            LOG_ERROR("Failed to create vertex shader");
+        return;
+    }
+
+    m_fragmentShaderId = loadShader(context, GraphicsContext3D::FRAGMENT_SHADER, fragmentShader);
+    if (!m_fragmentShaderId) {
+        GLC(context, context->deleteShader(m_vertexShaderId));
+        m_vertexShaderId = 0;
+        if (!contextLost(context))
+            LOG_ERROR("Failed to create fragment shader");
+        return;
+    }
+
+    m_program = createShaderProgram(context, m_vertexShaderId, m_fragmentShaderId);
     ASSERT(m_program || contextLost(context));
 }
 
+void ProgramBindingBase::link(WebGraphicsContext3D* context)
+{
+    GLC(context, context->linkProgram(m_program));
+    cleanupShaders(context);
+#ifndef NDEBUG
+    int linked = 0;
+    GLC(context, context->getProgramiv(m_program, GraphicsContext3D::LINK_STATUS, &linked));
+    if (!linked) {
+        if (!contextLost(context))
+            LOG_ERROR("Failed to link shader program");
+        GLC(context, context->deleteProgram(m_program));
+        return;
+    }
+#endif
+}
+
 void ProgramBindingBase::cleanup(WebGraphicsContext3D* context)
 {
     m_initialized = false;
@@ -73,6 +111,8 @@ void ProgramBindingBase::cleanup(WebGraphicsContext3D* context)
     ASSERT(context);
     GLC(context, context->deleteProgram(m_program));
     m_program = 0;
+
+    cleanupShaders(context);
 }
 
 unsigned ProgramBindingBase::loadShader(WebGraphicsContext3D* context, unsigned type, const String& shaderSource)
@@ -94,24 +134,8 @@ unsigned ProgramBindingBase::loadShader(WebGraphicsContext3D* context, unsigned
     return shader;
 }
 
-unsigned ProgramBindingBase::createShaderProgram(WebGraphicsContext3D* context, const String& vertexShaderSource, const String& fragmentShaderSource)
+unsigned ProgramBindingBase::createShaderProgram(WebGraphicsContext3D* context, unsigned vertexShader, unsigned fragmentShader)
 {
-    TRACE_EVENT0("cc", "ProgramBindingBase::createShaderProgram");
-    unsigned vertexShader = loadShader(context, GraphicsContext3D::VERTEX_SHADER, vertexShaderSource);
-    if (!vertexShader) {
-        if (!contextLost(context))
-            LOG_ERROR("Failed to create vertex shader");
-        return 0;
-    }
-
-    unsigned fragmentShader = loadShader(context, GraphicsContext3D::FRAGMENT_SHADER, fragmentShaderSource);
-    if (!fragmentShader) {
-        GLC(context, context->deleteShader(vertexShader));
-        if (!contextLost(context))
-            LOG_ERROR("Failed to create fragment shader");
-        return 0;
-    }
-
     unsigned programObject = context->createProgram();
     if (!programObject) {
         if (!contextLost(context))
@@ -126,23 +150,21 @@ unsigned ProgramBindingBase::createShaderProgram(WebGraphicsContext3D* context,
     GLC(context, context->bindAttribLocation(programObject, GeometryBinding::positionAttribLocation(), "a_position"));
     GLC(context, context->bindAttribLocation(programObject, GeometryBinding::texCoordAttribLocation(), "a_texCoord"));
 
-    GLC(context, context->linkProgram(programObject));
-#ifndef NDEBUG
-    int linked = 0;
-    GLC(context, context->getProgramiv(programObject, GraphicsContext3D::LINK_STATUS, &linked));
-    if (!linked) {
-        if (!contextLost(context))
-            LOG_ERROR("Failed to link shader program");
-        GLC(context, context->deleteProgram(programObject));
-        return 0;
-    }
-#endif
-
-    GLC(context, context->deleteShader(vertexShader));
-    GLC(context, context->deleteShader(fragmentShader));
     return programObject;
 }
 
+void ProgramBindingBase::cleanupShaders(WebGraphicsContext3D* context)
+{
+    if (m_vertexShaderId) {
+        GLC(context, context->deleteShader(m_vertexShaderId));
+        m_vertexShaderId = 0;
+    }
+    if (m_fragmentShaderId) {
+        GLC(context, context->deleteShader(m_fragmentShaderId));
+        m_fragmentShaderId = 0;
+    }
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/ProgramBinding.h b/Source/WebCore/platform/graphics/chromium/ProgramBinding.h
index 39048f903..c2d47dffc 100644
--- a/Source/WebCore/platform/graphics/chromium/ProgramBinding.h
+++ b/Source/WebCore/platform/graphics/chromium/ProgramBinding.h
@@ -42,6 +42,7 @@ public:
     ~ProgramBindingBase();
 
     void init(WebKit::WebGraphicsContext3D*, const String& vertexShader, const String& fragmentShader);
+    void link(WebKit::WebGraphicsContext3D*);
     void cleanup(WebKit::WebGraphicsContext3D*);
 
     unsigned program() const { ASSERT(m_initialized); return m_program; }
@@ -50,9 +51,12 @@ public:
 protected:
 
     unsigned loadShader(WebKit::WebGraphicsContext3D*, unsigned type, const String& shaderSource);
-    unsigned createShaderProgram(WebKit::WebGraphicsContext3D*, const String& vertexShaderSource, const String& fragmentShaderSource);
+    unsigned createShaderProgram(WebKit::WebGraphicsContext3D*, unsigned vertexShader, unsigned fragmentShader);
+    void cleanupShaders(WebKit::WebGraphicsContext3D*);
 
     unsigned m_program;
+    unsigned m_vertexShaderId;
+    unsigned m_fragmentShaderId;
     bool m_initialized;
 };
 
@@ -64,14 +68,24 @@ public:
         ProgramBindingBase::init(context, m_vertexShader.getShaderString(), m_fragmentShader.getShaderString());
     }
 
-    void initialize(WebKit::WebGraphicsContext3D* context)
+    void initialize(WebKit::WebGraphicsContext3D* context, bool usingBindUniform)
     {
         ASSERT(context);
         ASSERT(m_program);
         ASSERT(!m_initialized);
 
-        m_vertexShader.init(context, m_program);
-        m_fragmentShader.init(context, m_program);
+        // Need to bind uniforms before linking
+        if (!usingBindUniform)
+            link(context);
+
+        int baseUniformIndex = 0;
+        m_vertexShader.init(context, m_program, usingBindUniform, &baseUniformIndex);
+        m_fragmentShader.init(context, m_program, usingBindUniform, &baseUniformIndex);
+
+        // Link after binding uniforms
+        if (usingBindUniform)
+            link(context);
+
         m_initialized = true;
     }
 
diff --git a/Source/WebCore/platform/graphics/chromium/RateLimiter.cpp b/Source/WebCore/platform/graphics/chromium/RateLimiter.cpp
index 232f04719..55a190290 100644
--- a/Source/WebCore/platform/graphics/chromium/RateLimiter.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RateLimiter.cpp
@@ -29,10 +29,35 @@
 
 #include "RateLimiter.h"
 #include "TraceEvent.h"
+#include "cc/CCProxy.h"
+#include "cc/CCThread.h"
 #include <public/WebGraphicsContext3D.h>
 
 namespace WebCore {
 
+class RateLimiter::Task : public CCThread::Task {
+public:
+    static PassOwnPtr<Task> create(RateLimiter* rateLimiter)
+    {
+        return adoptPtr(new Task(rateLimiter));
+    }
+    virtual ~Task() { }
+
+private:
+    explicit Task(RateLimiter* rateLimiter)
+        : CCThread::Task(this)
+        , m_rateLimiter(rateLimiter)
+    {
+    }
+
+    virtual void performTask() OVERRIDE
+    {
+        m_rateLimiter->rateLimitContext();
+    }
+
+    RefPtr<RateLimiter> m_rateLimiter;
+};
+
 PassRefPtr<RateLimiter> RateLimiter::create(WebKit::WebGraphicsContext3D* context, RateLimiterClient *client)
 {
     return adoptRef(new RateLimiter(context, client));
@@ -40,7 +65,7 @@ PassRefPtr<RateLimiter> RateLimiter::create(WebKit::WebGraphicsContext3D* contex
 
 RateLimiter::RateLimiter(WebKit::WebGraphicsContext3D* context, RateLimiterClient *client)
     : m_context(context)
-    , m_timer(this, &RateLimiter::rateLimitContext)
+    , m_active(false)
     , m_client(client)
 {
     ASSERT(context);
@@ -52,19 +77,28 @@ RateLimiter::~RateLimiter()
 
 void RateLimiter::start()
 {
-    if (!m_timer.isActive())
-        m_timer.startOneShot(0);
+    if (m_active)
+        return;
+
+    TRACE_EVENT0("cc", "RateLimiter::start");
+    m_active = true;
+    CCProxy::mainThread()->postTask(RateLimiter::Task::create(this));
 }
 
 void RateLimiter::stop()
 {
-    m_timer.stop();
+    TRACE_EVENT0("cc", "RateLimiter::stop");
+    m_client = 0;
 }
 
-void RateLimiter::rateLimitContext(Timer<RateLimiter>*)
+void RateLimiter::rateLimitContext()
 {
+    if (!m_client)
+        return;
+
     TRACE_EVENT0("cc", "RateLimiter::rateLimitContext");
 
+    m_active = false;
     m_client->rateLimit();
     m_context->rateLimitOffscreenContextCHROMIUM();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/RateLimiter.h b/Source/WebCore/platform/graphics/chromium/RateLimiter.h
index b786b90d4..0548fde5e 100644
--- a/Source/WebCore/platform/graphics/chromium/RateLimiter.h
+++ b/Source/WebCore/platform/graphics/chromium/RateLimiter.h
@@ -28,9 +28,8 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "Timer.h"
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
 
 namespace WebKit {
 class WebGraphicsContext3D;
@@ -43,21 +42,29 @@ public:
     virtual void rateLimit() = 0;
 };
 
-// A class containing a timer, which calls rateLimitCHROMIUM on expiry
+// A RateLimiter can be used to make sure that a single context does not dominate all execution time.
+// To use, construct a RateLimiter class around the context and call start() whenever calls are made on the
+// context outside of normal flow control. RateLimiter will block if the context is too far ahead of the
+// compositor.
 class RateLimiter : public RefCounted<RateLimiter> {
 public:
     static PassRefPtr<RateLimiter> create(WebKit::WebGraphicsContext3D*, RateLimiterClient*);
     ~RateLimiter();
 
     void start();
+
+    // Context and client will not be accessed after stop().
     void stop();
 
 private:
     RateLimiter(WebKit::WebGraphicsContext3D*, RateLimiterClient*);
 
+    class Task;
+    friend class Task;
+    void rateLimitContext();
+
     WebKit::WebGraphicsContext3D* m_context;
-    Timer<RateLimiter> m_timer;
-    void rateLimitContext(Timer<RateLimiter>*);
+    bool m_active;
     RateLimiterClient *m_client;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
index a5c4c6082..fb2dd8bc6 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.cpp
@@ -29,7 +29,6 @@
 
 #include "RenderSurfaceChromium.h"
 
-#include "FilterOperations.h"
 #include "LayerChromium.h"
 #include "cc/CCMathUtil.h"
 #include <public/WebTransformationMatrix.h>
@@ -59,9 +58,9 @@ FloatRect RenderSurfaceChromium::drawableContentRect() const
 {
     FloatRect localContentRect(-0.5 * m_contentRect.width(), -0.5 * m_contentRect.height(),
                                m_contentRect.width(), m_contentRect.height());
-    FloatRect drawableContentRect = m_drawTransform.mapRect(localContentRect);
+    FloatRect drawableContentRect = CCMathUtil::mapClippedRect(m_drawTransform, localContentRect);
     if (m_owningLayer->replicaLayer())
-        drawableContentRect.unite(m_replicaDrawTransform.mapRect(localContentRect));
+        drawableContentRect.unite(CCMathUtil::mapClippedRect(m_replicaDrawTransform, localContentRect));
 
     return drawableContentRect;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
index 5e23e9345..56c96a74a 100644
--- a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
@@ -76,12 +76,17 @@ void ScrollbarLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
 
     scrollbarLayer->setScrollbarOverlayStyle(m_scrollbarOverlayStyle);
 
-    if (m_background && m_background->texture()->isReserved())
-        scrollbarLayer->setBackgroundTextureId(m_background->texture()->textureId());
+    if (m_backTrack && m_backTrack->texture()->haveBackingTexture())
+        scrollbarLayer->setBackTrackTextureId(m_backTrack->texture()->textureId());
     else
-        scrollbarLayer->setBackgroundTextureId(0);
+        scrollbarLayer->setBackTrackTextureId(0);
 
-    if (m_thumb && m_thumb->texture()->isReserved())
+    if (m_foreTrack && m_foreTrack->texture()->haveBackingTexture())
+        scrollbarLayer->setForeTrackTextureId(m_foreTrack->texture()->textureId());
+    else
+        scrollbarLayer->setForeTrackTextureId(0);
+
+    if (m_thumb && m_thumb->texture()->haveBackingTexture())
         scrollbarLayer->setThumbTextureId(m_thumb->texture()->textureId());
     else
         scrollbarLayer->setThumbTextureId(0);
@@ -106,12 +111,12 @@ void ScrollbarLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
 class ScrollbarBackgroundPainter : public LayerPainterChromium {
     WTF_MAKE_NONCOPYABLE(ScrollbarBackgroundPainter);
 public:
-    static PassOwnPtr<ScrollbarBackgroundPainter> create(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme)
+    static PassOwnPtr<ScrollbarBackgroundPainter> create(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme, ScrollbarPart trackPart)
     {
-        return adoptPtr(new ScrollbarBackgroundPainter(scrollbar, theme));
+        return adoptPtr(new ScrollbarBackgroundPainter(scrollbar, theme, trackPart));
     }
 
-    virtual void paint(SkCanvas* canvas, const IntRect& contentRect, IntRect&) OVERRIDE
+    virtual void paint(SkCanvas* canvas, const IntRect& contentRect, FloatRect&) OVERRIDE
     {
         PlatformContextSkia platformContext(canvas);
         platformContext.setDrawingToImageBuffer(true);
@@ -138,26 +143,22 @@ public:
         m_theme->paintTrackBackground(&context, m_scrollbar, trackPaintRect);
 
         bool thumbPresent = m_theme->hasThumb(m_scrollbar);
-        if (thumbPresent) {
-            // FIXME: There's no "paint the whole track" part. Drawing both the
-            // BackTrackPart and the ForwardTrackPart in their splitTrack rects
-            // ends up leaving a distinctive line. Painting one part as the
-            // entire track appears to be identical to painting both and
-            // covering up the split between them with the thumb.
-            m_theme->paintTrackPiece(&context, m_scrollbar, trackPaintRect, BackTrackPart);
-        }
+        if (thumbPresent)
+            m_theme->paintTrackPiece(&context, m_scrollbar, trackPaintRect, m_trackPart);
 
         m_theme->paintTickmarks(&context, m_scrollbar, trackPaintRect);
     }
 private:
-    ScrollbarBackgroundPainter(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme)
+    ScrollbarBackgroundPainter(ScrollbarThemeClient* scrollbar, ScrollbarThemeComposite* theme, ScrollbarPart trackPart)
         : m_scrollbar(scrollbar)
         , m_theme(theme)
+        , m_trackPart(trackPart)
     {
     }
 
     ScrollbarThemeClient* m_scrollbar;
     ScrollbarThemeComposite* m_theme;
+    ScrollbarPart m_trackPart;
 };
 
 class ScrollbarThumbPainter : public LayerPainterChromium {
@@ -168,7 +169,7 @@ public:
         return adoptPtr(new ScrollbarThumbPainter(scrollbar, theme));
     }
 
-    virtual void paint(SkCanvas* canvas, const IntRect& contentRect, IntRect& opaque) OVERRIDE
+    virtual void paint(SkCanvas* canvas, const IntRect& contentRect, FloatRect& opaque) OVERRIDE
     {
         PlatformContextSkia platformContext(canvas);
         platformContext.setDrawingToImageBuffer(true);
@@ -193,8 +194,8 @@ private:
 void ScrollbarLayerChromium::setLayerTreeHost(CCLayerTreeHost* host)
 {
     if (!host || host != layerTreeHost()) {
-        m_backgroundUpdater.clear();
-        m_background.clear();
+        m_backTrackUpdater.clear();
+        m_backTrack.clear();
         m_thumbUpdater.clear();
         m_thumb.clear();
     }
@@ -207,10 +208,18 @@ void ScrollbarLayerChromium::createTextureUpdaterIfNeeded()
     bool useMapSubImage = layerTreeHost()->layerRendererCapabilities().usingMapSub;
     m_textureFormat = layerTreeHost()->layerRendererCapabilities().bestTextureFormat;
 
-    if (!m_backgroundUpdater)
-        m_backgroundUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarBackgroundPainter::create(m_scrollbar.get(), theme()), useMapSubImage);
-    if (!m_background)
-        m_background = m_backgroundUpdater->createTexture(layerTreeHost()->contentsTextureManager());
+    if (!m_backTrackUpdater)
+        m_backTrackUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarBackgroundPainter::create(m_scrollbar.get(), theme(), BackTrackPart), useMapSubImage);
+    if (!m_backTrack)
+        m_backTrack = m_backTrackUpdater->createTexture(layerTreeHost()->contentsTextureManager());
+
+    // Only create two-part track if we think the two parts could be different in appearance.
+    if (m_scrollbar->isCustomScrollbar()) {
+        if (!m_foreTrackUpdater)
+            m_foreTrackUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarBackgroundPainter::create(m_scrollbar.get(), theme(), ForwardTrackPart), useMapSubImage);
+        if (!m_foreTrack)
+            m_foreTrack = m_foreTrackUpdater->createTexture(layerTreeHost()->contentsTextureManager());
+    }
 
     if (!m_thumbUpdater)
         m_thumbUpdater = BitmapCanvasLayerTextureUpdater::create(ScrollbarThumbPainter::create(m_scrollbar.get(), theme()), useMapSubImage);
@@ -220,28 +229,49 @@ void ScrollbarLayerChromium::createTextureUpdaterIfNeeded()
 
 void ScrollbarLayerChromium::updatePart(LayerTextureUpdater* painter, LayerTextureUpdater::Texture* texture, const IntRect& rect, CCTextureUpdater& updater)
 {
-    bool textureValid = texture->texture()->isValid(rect.size(), m_textureFormat);
-    // Skip painting and uploading if there are no invalidations.
-    if (textureValid && m_updateRect.isEmpty()) {
-        texture->texture()->reserve(rect.size(), m_textureFormat);
+    // Skip painting and uploading if there are no invalidations and
+    // we already have valid texture data.
+    if (texture->texture()->haveBackingTexture()
+            && texture->texture()->size() == rect.size()
+            && m_updateRect.isEmpty())
         return;
-    }
 
-    // ScrollbarLayerChromium doesn't support partial uploads, so any
-    // invalidation is treated a full layer invalidation.
-    if (layerTreeHost()->bufferedUpdates() && textureValid)
-        layerTreeHost()->deleteTextureAfterCommit(texture->texture()->steal());
-
-    if (!texture->texture()->reserve(rect.size(), m_textureFormat))
+    // We should always have enough memory for UI.
+    ASSERT(texture->texture()->canAcquireBackingTexture());
+    if (!texture->texture()->canAcquireBackingTexture())
         return;
 
     // Paint and upload the entire part.
     IntRect paintedOpaqueRect;
-    painter->prepareToUpdate(rect, rect.size(), 1, paintedOpaqueRect);
+    painter->prepareToUpdate(rect, rect.size(), 1, 1, paintedOpaqueRect);
     texture->prepareRect(rect);
 
     IntRect destRect(IntPoint(), rect.size());
-    updater.appendUpdate(texture, rect, destRect);
+    updater.appendFullUpdate(texture, rect, destRect);
+}
+
+
+void ScrollbarLayerChromium::setTexturePriorities(const CCPriorityCalculator&)
+{
+    if (contentBounds().isEmpty())
+        return;
+
+    createTextureUpdaterIfNeeded();
+
+    bool drawsToRootSurface = !targetRenderSurface()->targetRenderSurface();
+    if (m_backTrack) {
+        m_backTrack->texture()->setDimensions(contentBounds(), m_textureFormat);
+        m_backTrack->texture()->setRequestPriority(CCPriorityCalculator::uiPriority(drawsToRootSurface));
+    }
+    if (m_foreTrack) {
+        m_foreTrack->texture()->setDimensions(contentBounds(), m_textureFormat);
+        m_foreTrack->texture()->setRequestPriority(CCPriorityCalculator::uiPriority(drawsToRootSurface));
+    }
+    if (m_thumb) {
+        IntSize thumbSize = theme()->thumbRect(m_scrollbar.get()).size();
+        m_thumb->texture()->setDimensions(thumbSize, m_textureFormat);
+        m_thumb->texture()->setRequestPriority(CCPriorityCalculator::uiPriority(drawsToRootSurface));
+    }
 }
 
 void ScrollbarLayerChromium::update(CCTextureUpdater& updater, const CCOcclusionTracker*)
@@ -253,7 +283,9 @@ void ScrollbarLayerChromium::update(CCTextureUpdater& updater, const CCOcclusion
 
     IntPoint scrollbarOrigin(m_scrollbar->x(), m_scrollbar->y());
     IntRect contentRect(scrollbarOrigin, contentBounds());
-    updatePart(m_backgroundUpdater.get(), m_background.get(), contentRect, updater);
+    updatePart(m_backTrackUpdater.get(), m_backTrack.get(), contentRect, updater);
+    if (m_foreTrack && m_foreTrackUpdater)
+        updatePart(m_foreTrackUpdater.get(), m_foreTrack.get(), contentRect, updater);
 
     // Consider the thumb to be at the origin when painting.
     IntRect thumbRect = IntRect(IntPoint(), theme()->thumbRect(m_scrollbar.get()).size());
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
index af2215bd0..0a8a2a13b 100644
--- a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
@@ -44,6 +44,7 @@ public:
     static PassRefPtr<ScrollbarLayerChromium> create(Scrollbar*, int scrollLayerId);
 
     // LayerChromium interface
+    virtual void setTexturePriorities(const CCPriorityCalculator&) OVERRIDE;
     virtual void update(CCTextureUpdater&, const CCOcclusionTracker*) OVERRIDE;
     virtual void setLayerTreeHost(CCLayerTreeHost*) OVERRIDE;
     virtual void pushPropertiesTo(CCLayerImpl*) OVERRIDE;
@@ -66,11 +67,13 @@ private:
 
     GC3Denum m_textureFormat;
 
-    RefPtr<LayerTextureUpdater> m_backgroundUpdater;
+    RefPtr<LayerTextureUpdater> m_backTrackUpdater;
+    RefPtr<LayerTextureUpdater> m_foreTrackUpdater;
     RefPtr<LayerTextureUpdater> m_thumbUpdater;
 
     // All the parts of the scrollbar except the thumb
-    OwnPtr<LayerTextureUpdater::Texture> m_background;
+    OwnPtr<LayerTextureUpdater::Texture> m_backTrack;
+    OwnPtr<LayerTextureUpdater::Texture> m_foreTrack;
     OwnPtr<LayerTextureUpdater::Texture> m_thumb;
 
     ScrollbarOverlayStyle m_scrollbarOverlayStyle;
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
index 2a140d1d7..7ee5a21b9 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
@@ -38,14 +38,38 @@ using WebKit::WebGraphicsContext3D;
 
 namespace WebCore {
 
+namespace {
+
+static void getProgramUniformLocations(WebGraphicsContext3D* context, unsigned program, const char** shaderUniforms, size_t count, size_t maxLocations, int* locations, bool usingBindUniform, int* baseUniformIndex)
+{
+    for (size_t uniformIndex = 0; uniformIndex < count; uniformIndex ++) {
+        ASSERT(uniformIndex < maxLocations);
+
+        if (usingBindUniform) {
+            locations[uniformIndex] = (*baseUniformIndex)++;
+            context->bindUniformLocationCHROMIUM(program, locations[uniformIndex], shaderUniforms[uniformIndex]);
+        } else
+            locations[uniformIndex] = context->getUniformLocation(program, shaderUniforms[uniformIndex]);
+    }
+}
+
+}
+
 VertexShaderPosTex::VertexShaderPosTex()
     : m_matrixLocation(-1)
 {
 }
 
-void VertexShaderPosTex::init(WebGraphicsContext3D* context, unsigned program)
+void VertexShaderPosTex::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_matrixLocation = context->getUniformLocation(program, "matrix");
+    static const char* shaderUniforms[] = {
+        "matrix",
+    };
+    int locations[1];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_matrixLocation = locations[0];
     ASSERT(m_matrixLocation != -1);
 }
 
@@ -71,11 +95,20 @@ VertexShaderPosTexYUVStretch::VertexShaderPosTexYUVStretch()
 {
 }
 
-void VertexShaderPosTexYUVStretch::init(WebGraphicsContext3D* context, unsigned program)
+void VertexShaderPosTexYUVStretch::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_matrixLocation = context->getUniformLocation(program, "matrix");
-    m_yWidthScaleFactorLocation = context->getUniformLocation(program, "y_widthScaleFactor");
-    m_uvWidthScaleFactorLocation = context->getUniformLocation(program, "uv_widthScaleFactor");
+    static const char* shaderUniforms[] = {
+        "matrix",
+        "y_widthScaleFactor",
+        "uv_widthScaleFactor",
+    };
+    int locations[3];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_matrixLocation = locations[0];
+    m_yWidthScaleFactorLocation = locations[1];
+    m_uvWidthScaleFactorLocation = locations[2];
     ASSERT(m_matrixLocation != -1 && m_yWidthScaleFactorLocation != -1 && m_uvWidthScaleFactorLocation != -1);
 }
 
@@ -104,9 +137,16 @@ VertexShaderPos::VertexShaderPos()
 {
 }
 
-void VertexShaderPos::init(WebGraphicsContext3D* context, unsigned program)
+void VertexShaderPos::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_matrixLocation = context->getUniformLocation(program, "matrix");
+    static const char* shaderUniforms[] = {
+        "matrix",
+    };
+    int locations[1];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_matrixLocation = locations[0];
     ASSERT(m_matrixLocation != -1);
 }
 
@@ -128,10 +168,18 @@ VertexShaderPosTexTransform::VertexShaderPosTexTransform()
 {
 }
 
-void VertexShaderPosTexTransform::init(WebGraphicsContext3D* context, unsigned program)
+void VertexShaderPosTexTransform::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_matrixLocation = context->getUniformLocation(program, "matrix");
-    m_texTransformLocation = context->getUniformLocation(program, "texTransform");
+    static const char* shaderUniforms[] = {
+        "matrix",
+        "texTransform",
+    };
+    int locations[2];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_matrixLocation = locations[0];
+    m_texTransformLocation = locations[1];
     ASSERT(m_matrixLocation != -1 && m_texTransformLocation != -1);
 }
 
@@ -170,10 +218,18 @@ String VertexShaderPosTexIdentity::getShaderString() const
     );
 }
 
-void VertexShaderQuad::init(WebGraphicsContext3D* context, unsigned program)
+void VertexShaderQuad::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_matrixLocation = context->getUniformLocation(program, "matrix");
-    m_pointLocation = context->getUniformLocation(program, "point");
+    static const char* shaderUniforms[] = {
+        "matrix",
+        "point",
+    };
+    int locations[2];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_matrixLocation = locations[0];
+    m_pointLocation = locations[1];
     ASSERT(m_matrixLocation != -1 && m_pointLocation != -1);
 }
 
@@ -206,11 +262,20 @@ VertexShaderTile::VertexShaderTile()
 {
 }
 
-void VertexShaderTile::init(WebGraphicsContext3D* context, unsigned program)
+void VertexShaderTile::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_matrixLocation = context->getUniformLocation(program, "matrix");
-    m_pointLocation = context->getUniformLocation(program, "point");
-    m_vertexTexTransformLocation = context->getUniformLocation(program, "vertexTexTransform");
+    static const char* shaderUniforms[] = {
+        "matrix",
+        "point",
+        "vertexTexTransform",
+    };
+    int locations[3];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_matrixLocation = locations[0];
+    m_pointLocation = locations[1];
+    m_vertexTexTransformLocation = locations[2];
     ASSERT(m_matrixLocation != -1 && m_pointLocation != -1 && m_vertexTexTransformLocation != -1);
 }
 
@@ -243,10 +308,18 @@ VertexShaderVideoTransform::VertexShaderVideoTransform()
 {
 }
 
-bool VertexShaderVideoTransform::init(WebGraphicsContext3D* context, unsigned program)
+bool VertexShaderVideoTransform::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_matrixLocation = context->getUniformLocation(program, "matrix");
-    m_texMatrixLocation = context->getUniformLocation(program, "texMatrix");
+    static const char* shaderUniforms[] = {
+        "matrix",
+        "texMatrix",
+    };
+    int locations[2];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_matrixLocation = locations[0];
+    m_texMatrixLocation = locations[1];
     return m_matrixLocation != -1 && m_texMatrixLocation != -1;
 }
 
@@ -272,11 +345,18 @@ FragmentTexAlphaBinding::FragmentTexAlphaBinding()
 {
 }
 
-void FragmentTexAlphaBinding::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentTexAlphaBinding::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_samplerLocation = context->getUniformLocation(program, "s_texture");
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
+    static const char* shaderUniforms[] = {
+        "s_texture",
+        "alpha",
+    };
+    int locations[2];
 
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_samplerLocation = locations[0];
+    m_alphaLocation = locations[1];
     ASSERT(m_samplerLocation != -1 && m_alphaLocation != -1);
 }
 
@@ -285,10 +365,16 @@ FragmentTexOpaqueBinding::FragmentTexOpaqueBinding()
 {
 }
 
-void FragmentTexOpaqueBinding::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentTexOpaqueBinding::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_samplerLocation = context->getUniformLocation(program, "s_texture");
+    static const char* shaderUniforms[] = {
+        "s_texture",
+    };
+    int locations[1];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
 
+    m_samplerLocation = locations[0];
     ASSERT(m_samplerLocation != -1);
 }
 
@@ -307,10 +393,16 @@ String FragmentShaderRGBATexFlipAlpha::getShaderString() const
     );
 }
 
-bool FragmentShaderOESImageExternal::init(WebGraphicsContext3D* context, unsigned program)
+bool FragmentShaderOESImageExternal::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_samplerLocation = context->getUniformLocation(program, "s_texture");
+    static const char* shaderUniforms[] = {
+        "s_texture",
+    };
+    int locations[1];
 
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_samplerLocation = locations[0];
     return m_samplerLocation != -1;
 }
 
@@ -437,12 +529,20 @@ FragmentShaderRGBATexAlphaAA::FragmentShaderRGBATexAlphaAA()
 {
 }
 
-void FragmentShaderRGBATexAlphaAA::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentShaderRGBATexAlphaAA::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_samplerLocation = context->getUniformLocation(program, "s_texture");
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
-    m_edgeLocation = context->getUniformLocation(program, "edge");
+    static const char* shaderUniforms[] = {
+        "s_texture",
+        "alpha",
+        "edge",
+    };
+    int locations[3];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
 
+    m_samplerLocation = locations[0];
+    m_alphaLocation = locations[1];
+    m_edgeLocation = locations[2];
     ASSERT(m_samplerLocation != -1 && m_alphaLocation != -1 && m_edgeLocation != -1);
 }
 
@@ -479,13 +579,22 @@ FragmentTexClampAlphaAABinding::FragmentTexClampAlphaAABinding()
 {
 }
 
-void FragmentTexClampAlphaAABinding::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentTexClampAlphaAABinding::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_samplerLocation = context->getUniformLocation(program, "s_texture");
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
-    m_fragmentTexTransformLocation = context->getUniformLocation(program, "fragmentTexTransform");
-    m_edgeLocation = context->getUniformLocation(program, "edge");
+    static const char* shaderUniforms[] = {
+        "s_texture",
+        "alpha",
+        "fragmentTexTransform",
+        "edge",
+    };
+    int locations[4];
 
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_samplerLocation = locations[0];
+    m_alphaLocation = locations[1];
+    m_fragmentTexTransformLocation = locations[2];
+    m_edgeLocation = locations[3];
     ASSERT(m_samplerLocation != -1 && m_alphaLocation != -1 && m_fragmentTexTransformLocation != -1 && m_edgeLocation != -1);
 }
 
@@ -550,11 +659,20 @@ FragmentShaderRGBATexAlphaMask::FragmentShaderRGBATexAlphaMask()
 {
 }
 
-void FragmentShaderRGBATexAlphaMask::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentShaderRGBATexAlphaMask::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_samplerLocation = context->getUniformLocation(program, "s_texture");
-    m_maskSamplerLocation = context->getUniformLocation(program, "s_mask");
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
+    static const char* shaderUniforms[] = {
+        "s_texture",
+        "s_mask",
+        "alpha",
+    };
+    int locations[3];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_samplerLocation = locations[0];
+    m_maskSamplerLocation = locations[1];
+    m_alphaLocation = locations[2];
     ASSERT(m_samplerLocation != -1 && m_maskSamplerLocation != -1 && m_alphaLocation != -1);
 }
 
@@ -583,12 +701,22 @@ FragmentShaderRGBATexAlphaMaskAA::FragmentShaderRGBATexAlphaMaskAA()
 {
 }
 
-void FragmentShaderRGBATexAlphaMaskAA::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentShaderRGBATexAlphaMaskAA::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_samplerLocation = context->getUniformLocation(program, "s_texture");
-    m_maskSamplerLocation = context->getUniformLocation(program, "s_mask");
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
-    m_edgeLocation = context->getUniformLocation(program, "edge");
+    static const char* shaderUniforms[] = {
+        "s_texture",
+        "s_mask",
+        "alpha",
+        "edge",
+    };
+    int locations[4];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_samplerLocation = locations[0];
+    m_maskSamplerLocation = locations[1];
+    m_alphaLocation = locations[2];
+    m_edgeLocation = locations[3];
     ASSERT(m_samplerLocation != -1 && m_maskSamplerLocation != -1 && m_alphaLocation != -1 && m_edgeLocation != -1);
 }
 
@@ -629,14 +757,26 @@ FragmentShaderYUVVideo::FragmentShaderYUVVideo()
 {
 }
 
-void FragmentShaderYUVVideo::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentShaderYUVVideo::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_yTextureLocation = context->getUniformLocation(program, "y_texture");
-    m_uTextureLocation = context->getUniformLocation(program, "u_texture");
-    m_vTextureLocation = context->getUniformLocation(program, "v_texture");
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
-    m_ccMatrixLocation = context->getUniformLocation(program, "cc_matrix");
-    m_yuvAdjLocation = context->getUniformLocation(program, "yuv_adj");
+    static const char* shaderUniforms[] = {
+        "y_texture",
+        "u_texture",
+        "v_texture",
+        "alpha",
+        "cc_matrix",
+        "yuv_adj",
+    };
+    int locations[6];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_yTextureLocation = locations[0];
+    m_uTextureLocation = locations[1];
+    m_vTextureLocation = locations[2];
+    m_alphaLocation = locations[3];
+    m_ccMatrixLocation = locations[4];
+    m_yuvAdjLocation = locations[5];
 
     ASSERT(m_yTextureLocation != -1 && m_uTextureLocation != -1 && m_vTextureLocation != -1
            && m_alphaLocation != -1 && m_ccMatrixLocation != -1 && m_yuvAdjLocation != -1);
@@ -672,9 +812,16 @@ FragmentShaderColor::FragmentShaderColor()
 {
 }
 
-void FragmentShaderColor::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentShaderColor::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_colorLocation = context->getUniformLocation(program, "color");
+    static const char* shaderUniforms[] = {
+        "color",
+    };
+    int locations[1];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_colorLocation = locations[0];
     ASSERT(m_colorLocation != -1);
 }
 
@@ -697,11 +844,20 @@ FragmentShaderCheckerboard::FragmentShaderCheckerboard()
 {
 }
 
-void FragmentShaderCheckerboard::init(WebGraphicsContext3D* context, unsigned program)
+void FragmentShaderCheckerboard::init(WebGraphicsContext3D* context, unsigned program, bool usingBindUniform, int* baseUniformIndex)
 {
-    m_alphaLocation = context->getUniformLocation(program, "alpha");
-    m_texTransformLocation = context->getUniformLocation(program, "texTransform");
-    m_frequencyLocation = context->getUniformLocation(program, "frequency");
+    static const char* shaderUniforms[] = {
+        "alpha",
+        "texTransform",
+        "frequency",
+    };
+    int locations[3];
+
+    getProgramUniformLocations(context, program, shaderUniforms, WTF_ARRAY_LENGTH(shaderUniforms), WTF_ARRAY_LENGTH(locations), locations, usingBindUniform, baseUniformIndex);
+
+    m_alphaLocation = locations[0];
+    m_texTransformLocation = locations[1];
+    m_frequencyLocation = locations[2];
     ASSERT(m_alphaLocation != -1 && m_texTransformLocation != -1 && m_frequencyLocation != -1);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 475b78962..00872e4a4 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -28,8 +28,8 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "PlatformString.h"
 #include "SkColorPriv.h"
+#include <wtf/text/WTFString.h>
 
 namespace WebKit {
 class WebGraphicsContext3D;
@@ -41,7 +41,7 @@ class VertexShaderPosTex {
 public:
     VertexShaderPosTex();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int matrixLocation() const { return m_matrixLocation; }
@@ -54,7 +54,7 @@ class VertexShaderPosTexYUVStretch {
 public:
     VertexShaderPosTexYUVStretch();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int matrixLocation() const { return m_matrixLocation; }
@@ -71,7 +71,7 @@ class VertexShaderPos {
 public:
     VertexShaderPos();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int matrixLocation() const { return m_matrixLocation; }
@@ -82,7 +82,7 @@ private:
 
 class VertexShaderPosTexIdentity {
 public:
-    void init(WebKit::WebGraphicsContext3D*, unsigned program) { }
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex) { }
     String getShaderString() const;
 };
 
@@ -90,7 +90,7 @@ class VertexShaderPosTexTransform {
 public:
     VertexShaderPosTexTransform();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int matrixLocation() const { return m_matrixLocation; }
@@ -105,7 +105,7 @@ class VertexShaderQuad {
 public:
     VertexShaderQuad();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int matrixLocation() const { return m_matrixLocation; }
@@ -120,7 +120,7 @@ class VertexShaderTile {
 public:
     VertexShaderTile();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int matrixLocation() const { return m_matrixLocation; }
@@ -137,7 +137,7 @@ class VertexShaderVideoTransform {
 public:
     VertexShaderVideoTransform();
 
-    bool init(WebKit::WebGraphicsContext3D*, unsigned program);
+    bool init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int matrixLocation() const { return m_matrixLocation; }
@@ -152,7 +152,7 @@ class FragmentTexAlphaBinding {
 public:
     FragmentTexAlphaBinding();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     int alphaLocation() const { return m_alphaLocation; }
     int edgeLocation() const { return -1; }
     int fragmentTexTransformLocation() const { return -1; }
@@ -167,7 +167,7 @@ class FragmentTexOpaqueBinding {
 public:
     FragmentTexOpaqueBinding();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     int alphaLocation() const { return -1; }
     int edgeLocation() const { return -1; }
     int fragmentTexTransformLocation() const { return -1; }
@@ -223,7 +223,7 @@ public:
 class FragmentShaderOESImageExternal : public FragmentTexAlphaBinding {
 public:
     String getShaderString() const;
-    bool init(WebKit::WebGraphicsContext3D*, unsigned program);
+    bool init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
 private:
     int m_samplerLocation;
 };
@@ -232,7 +232,7 @@ class FragmentShaderRGBATexAlphaAA {
 public:
     FragmentShaderRGBATexAlphaAA();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     String getShaderString() const;
 
     int alphaLocation() const { return m_alphaLocation; }
@@ -249,7 +249,7 @@ class FragmentTexClampAlphaAABinding {
 public:
     FragmentTexClampAlphaAABinding();
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     int alphaLocation() const { return m_alphaLocation; }
     int samplerLocation() const { return m_samplerLocation; }
     int fragmentTexTransformLocation() const { return m_fragmentTexTransformLocation; }
@@ -278,7 +278,7 @@ public:
     FragmentShaderRGBATexAlphaMask();
     String getShaderString() const;
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     int alphaLocation() const { return m_alphaLocation; }
     int samplerLocation() const { return m_samplerLocation; }
     int maskSamplerLocation() const { return m_maskSamplerLocation; }
@@ -294,7 +294,7 @@ public:
     FragmentShaderRGBATexAlphaMaskAA();
     String getShaderString() const;
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     int alphaLocation() const { return m_alphaLocation; }
     int samplerLocation() const { return m_samplerLocation; }
     int maskSamplerLocation() const { return m_maskSamplerLocation; }
@@ -312,7 +312,7 @@ public:
     FragmentShaderYUVVideo();
     String getShaderString() const;
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
 
     int yTextureLocation() const { return m_yTextureLocation; }
     int uTextureLocation() const { return m_uTextureLocation; }
@@ -335,7 +335,7 @@ public:
     FragmentShaderColor();
     String getShaderString() const;
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     int colorLocation() const { return m_colorLocation; }
 
 private:
@@ -347,7 +347,7 @@ public:
     FragmentShaderCheckerboard();
     String getShaderString() const;
 
-    void init(WebKit::WebGraphicsContext3D*, unsigned program);
+    void init(WebKit::WebGraphicsContext3D*, unsigned program, bool usingBindUniform, int* baseUniformIndex);
     int alphaLocation() const { return m_alphaLocation; }
     int texTransformLocation() const { return m_texTransformLocation; }
     int frequencyLocation() const { return m_frequencyLocation; }
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
index c1177fbcd..f7bdb6f36 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
@@ -30,9 +30,7 @@
 
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
-#include "GraphicsContext.h"
 #include "LayerPainterChromium.h"
-#include "PlatformContextSkia.h"
 #include "SkCanvas.h"
 #include "TraceEvent.h"
 
@@ -48,16 +46,16 @@ SkPictureCanvasLayerTextureUpdater::~SkPictureCanvasLayerTextureUpdater()
 {
 }
 
-void SkPictureCanvasLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize&, float contentsScale, IntRect& resultingOpaqueRect)
+void SkPictureCanvasLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize&, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect)
 {
     SkCanvas* canvas = m_picture.beginRecording(contentRect.width(), contentRect.height());
-    paintContents(canvas, contentRect, contentsScale, resultingOpaqueRect);
+    paintContents(canvas, contentRect, contentsWidthScale, contentsHeightScale, resultingOpaqueRect);
     m_picture.endRecording();
 }
 
 void SkPictureCanvasLayerTextureUpdater::drawPicture(SkCanvas* canvas)
 {
-    TRACE_EVENT("SkPictureCanvasLayerTextureUpdater::drawPicture", this, 0);
+    TRACE_EVENT0("cc", "SkPictureCanvasLayerTextureUpdater::drawPicture");
     canvas->drawPicture(m_picture);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
index e297e050e..a51f44f59 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
@@ -52,7 +52,7 @@ public:
 protected:
     explicit SkPictureCanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
 
-    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsScale, IntRect& resultingOpaqueRect) OVERRIDE;
+    virtual void prepareToUpdate(const IntRect& contentRect, const IntSize& tileSize, float contentsWidthScale, float contentsHeightScale, IntRect& resultingOpaqueRect) OVERRIDE;
     void drawPicture(SkCanvas*);
 
     bool layerIsOpaque() const { return m_layerIsOpaque; }
diff --git a/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp b/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
index 0f2309068..33243c855 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureCopier.cpp
@@ -34,8 +34,9 @@
 namespace WebCore {
 
 #if USE(ACCELERATED_COMPOSITING)
-AcceleratedTextureCopier::AcceleratedTextureCopier(WebKit::WebGraphicsContext3D* context)
+AcceleratedTextureCopier::AcceleratedTextureCopier(WebKit::WebGraphicsContext3D* context, bool usingBindUniforms)
     : m_context(context)
+    , m_usingBindUniforms(usingBindUniforms)
 {
     ASSERT(m_context);
     GLC(m_context, m_fbo = m_context->createFramebuffer());
@@ -67,7 +68,7 @@ AcceleratedTextureCopier::~AcceleratedTextureCopier()
 
 void AcceleratedTextureCopier::copyTexture(CCGraphicsContext* ccContext, unsigned sourceTextureId, unsigned destTextureId, const IntSize& size)
 {
-    TRACE_EVENT("TextureCopier::copyTexture", this, 0);
+    TRACE_EVENT0("cc", "TextureCopier::copyTexture");
 
     WebKit::WebGraphicsContext3D* context = ccContext->context3D();
     if (!context) {
@@ -90,7 +91,7 @@ void AcceleratedTextureCopier::copyTexture(CCGraphicsContext* ccContext, unsigne
     GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST));
 
     if (!m_blitProgram->initialized())
-        m_blitProgram->initialize(context);
+        m_blitProgram->initialize(context, m_usingBindUniforms);
 
     // TODO: Use EXT_framebuffer_blit if available.
     GLC(context, context->useProgram(m_blitProgram->program()));
diff --git a/Source/WebCore/platform/graphics/chromium/TextureCopier.h b/Source/WebCore/platform/graphics/chromium/TextureCopier.h
index 646189ab6..c2bcd427c 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureCopier.h
+++ b/Source/WebCore/platform/graphics/chromium/TextureCopier.h
@@ -53,16 +53,16 @@ protected:
 class AcceleratedTextureCopier : public TextureCopier {
     WTF_MAKE_NONCOPYABLE(AcceleratedTextureCopier);
 public:
-    static PassOwnPtr<AcceleratedTextureCopier> create(WebKit::WebGraphicsContext3D* context)
+    static PassOwnPtr<AcceleratedTextureCopier> create(WebKit::WebGraphicsContext3D* context, bool usingBindUniforms)
     {
-        return adoptPtr(new AcceleratedTextureCopier(context));
+        return adoptPtr(new AcceleratedTextureCopier(context, usingBindUniforms));
     }
     virtual ~AcceleratedTextureCopier();
 
     virtual void copyTexture(CCGraphicsContext*, unsigned sourceTextureId, unsigned destTextureId, const IntSize&);
 
 protected:
-    explicit AcceleratedTextureCopier(WebKit::WebGraphicsContext3D*);
+    AcceleratedTextureCopier(WebKit::WebGraphicsContext3D*, bool usingBindUniforms);
 
 private:
     typedef ProgramBinding<VertexShaderPosTexIdentity, FragmentShaderRGBATex> BlitProgram;
@@ -71,6 +71,7 @@ private:
     Platform3DObject m_fbo;
     Platform3DObject m_positionBuffer;
     OwnPtr<BlitProgram> m_blitProgram;
+    bool m_usingBindUniforms;
 };
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
index d1f52faeb..485c72228 100644
--- a/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TextureManager.cpp
@@ -195,7 +195,7 @@ void TextureManager::unprotectAllTextures()
 
 void TextureManager::evictTexture(TextureToken token, TextureInfo info)
 {
-    TRACE_EVENT("TextureManager::evictTexture", this, 0);
+    TRACE_EVENT0("cc", "TextureManager::evictTexture");
     removeTexture(token, info);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index 6e052b7fa..5c4bc05ce 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -57,7 +57,7 @@ public:
     }
 
     LayerTextureUpdater::Texture* texture() { return m_texture.get(); }
-    ManagedTexture* managedTexture() { return m_texture->texture(); }
+    CCPrioritizedTexture* managedTexture() { return m_texture->texture(); }
 
     bool isDirty() const { return !dirtyRect.isEmpty(); }
     void copyAndClearDirty()
@@ -220,7 +220,7 @@ void TiledLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
         if (!tile)
             continue;
         tile->isInUseOnImpl = false;
-        if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat)) {
+        if (!tile->managedTexture()->haveBackingTexture()) {
             invalidTiles.append(tile);
             continue;
         }
@@ -234,7 +234,7 @@ void TiledLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
         m_tiler->takeTile((*iter)->i(), (*iter)->j());
 }
 
-TextureManager* TiledLayerChromium::textureManager() const
+CCPrioritizedTextureManager* TiledLayerChromium::textureManager() const
 {
     if (!layerTreeHost())
         return 0;
@@ -262,7 +262,11 @@ UpdatableTile* TiledLayerChromium::tileAt(int i, int j) const
 
 UpdatableTile* TiledLayerChromium::createTile(int i, int j)
 {
+    createTextureUpdaterIfNeeded();
+
     OwnPtr<UpdatableTile> tile(UpdatableTile::create(textureUpdater()->createTexture(textureManager())));
+    tile->managedTexture()->setDimensions(m_tiler->tileSize(), m_textureFormat);
+
     UpdatableTile* addedTile = tile.get();
     m_tiler->addTile(tile.release(), i, j);
 
@@ -279,8 +283,10 @@ UpdatableTile* TiledLayerChromium::createTile(int i, int j)
 
 void TiledLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
+    float contentsWidthScale = static_cast<float>(contentBounds().width()) / bounds().width();
+    float contentsHeightScale = static_cast<float>(contentBounds().height()) / bounds().height();
     FloatRect scaledDirtyRect(dirtyRect);
-    scaledDirtyRect.scale(contentsScale());
+    scaledDirtyRect.scale(contentsWidthScale, contentsHeightScale);
     IntRect dirty = enclosingIntRect(scaledDirtyRect);
     invalidateRect(dirty);
     LayerChromium::setNeedsDisplayRect(dirtyRect);
@@ -318,25 +324,6 @@ void TiledLayerChromium::invalidateRect(const IntRect& layerRect)
     }
 }
 
-void TiledLayerChromium::protectTileTextures(const IntRect& layerRect)
-{
-    if (m_tiler->isEmpty() || layerRect.isEmpty())
-        return;
-
-    int left, top, right, bottom;
-    m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
-
-    for (int j = top; j <= bottom; ++j) {
-        for (int i = left; i <= right; ++i) {
-            UpdatableTile* tile = tileAt(i, j);
-            if (!tile || !tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat))
-                continue;
-
-            tile->managedTexture()->reserve(m_tiler->tileSize(), m_textureFormat);
-        }
-    }
-}
-
 // Returns true if tile is dirty and only part of it needs to be updated.
 bool TiledLayerChromium::tileOnlyNeedsPartialUpdate(UpdatableTile* tile)
 {
@@ -347,7 +334,7 @@ bool TiledLayerChromium::tileOnlyNeedsPartialUpdate(UpdatableTile* tile)
 // we don't modify textures currently used for drawing by the impl thread.
 bool TiledLayerChromium::tileNeedsBufferedUpdate(UpdatableTile* tile)
 {
-    if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat))
+    if (!tile->managedTexture()->haveBackingTexture())
         return false;
 
     if (!tile->isDirty())
@@ -363,6 +350,9 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
 {
     createTextureUpdaterIfNeeded();
 
+    // We shouldn't track any occlusion metrics during idle painting.
+    ASSERT(!idle || !occlusion);
+
     // Create tiles as needed, expanding a dirty rect to contain all
     // the dirty regions currently being drawn. All dirty tiles that are to be painted
     // get their updateRect set to dirtyRect and dirtyRect cleared. This way if
@@ -371,6 +361,7 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             UpdatableTile* tile = tileAt(i, j);
+            ASSERT(tile); // Did setTexturePriorites get skipped?
             if (!tile)
                 tile = createTile(i, j);
 
@@ -378,7 +369,7 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
             if (!m_tiler)
                 CRASH();
 
-            if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat)) {
+            if (!tile->managedTexture()->haveBackingTexture()) {
                 // Sets the dirty rect to a full-sized tile with border texels.
                 tile->dirtyRect = m_tiler->tileRect(tile);
             }
@@ -397,19 +388,11 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
             // any single time through the function.
             tile->updated = true;
 
-            if (layerTreeHost() && layerTreeHost()->bufferedUpdates() && tileNeedsBufferedUpdate(tile)) {
-                // FIXME: Decide if partial update should be allowed based on cost
-                // of update. https://bugs.webkit.org/show_bug.cgi?id=77376
-                if (tileOnlyNeedsPartialUpdate(tile) && layerTreeHost()->requestPartialTextureUpdate())
-                    tile->partialUpdate = true;
-                else {
-                    layerTreeHost()->deleteTextureAfterCommit(tile->managedTexture()->steal());
-                    // Sets the dirty rect to a full-sized tile with border texels.
-                    tile->dirtyRect = m_tiler->tileRect(tile);
-                }
-            }
+            // Always try to get memory for visible textures.
+            if (!idle && !tile->managedTexture()->canAcquireBackingTexture())
+                tile->managedTexture()->requestLate();
 
-            if (!tile->managedTexture()->reserve(m_tiler->tileSize(), m_textureFormat)) {
+            if (!tile->managedTexture()->canAcquireBackingTexture()) {
                 m_skipsIdlePaint = true;
                 if (!idle) {
                     m_skipsDraw = true;
@@ -451,11 +434,11 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
 
     // Calling prepareToUpdate() calls into WebKit to paint, which may have the side
     // effect of disabling compositing, which causes our reference to the texture updater to be deleted.
-    // However, we can't free the memory backing the GraphicsContext until the paint finishes,
+    // However, we can't free the memory backing the SkCanvas until the paint finishes,
     // so we grab a local reference here to hold the updater alive until the paint completes.
     RefPtr<LayerTextureUpdater> protector(textureUpdater());
     IntRect paintedOpaqueRect;
-    textureUpdater()->prepareToUpdate(paintRect, m_tiler->tileSize(), contentsScale(), paintedOpaqueRect);
+    textureUpdater()->prepareToUpdate(paintRect, m_tiler->tileSize(), 1 / widthScale, 1 / heightScale, paintedOpaqueRect);
     m_didPaint = true;
 
     for (int j = top; j <= bottom; ++j) {
@@ -527,36 +510,82 @@ void TiledLayerChromium::updateTiles(bool idle, int left, int top, int right, in
             if (tile->partialUpdate)
                 updater.appendPartialUpdate(tile->texture(), sourceRect, destRect);
             else
-                updater.appendUpdate(tile->texture(), sourceRect, destRect);
+                updater.appendFullUpdate(tile->texture(), sourceRect, destRect);
         }
     }
 }
 
-void TiledLayerChromium::reserveTextures()
+void TiledLayerChromium::setTexturePriorities(const CCPriorityCalculator& priorityCalc)
 {
-    updateBounds();
+    setTexturePrioritiesInRect(priorityCalc, visibleLayerRect());
+}
 
-    const IntRect& layerRect = visibleLayerRect();
-    if (layerRect.isEmpty() || m_tiler->hasEmptyBounds())
-        return;
+void TiledLayerChromium::setTexturePrioritiesInRect(const CCPriorityCalculator& priorityCalc, const IntRect& visibleRect)
+{
+    updateBounds();
+    resetUpdateState();
 
-    int left, top, right, bottom;
-    m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
+    IntRect prepaintRect = idlePaintRect(visibleRect);
+    bool drawsToRootSurface = !targetRenderSurface()->targetRenderSurface();
+
+    // Minimally create the tiles in the desired pre-paint rect.
+    if (!prepaintRect.isEmpty()) {
+        int left, top, right, bottom;
+        m_tiler->layerRectToTileIndices(prepaintRect, left, top, right, bottom);
+        for (int j = top; j <= bottom; ++j)
+            for (int i = left; i <= right; ++i)
+                if (!tileAt(i, j))
+                    createTile(i, j);
+    }
 
-    createTextureUpdaterIfNeeded();
-    for (int j = top; j <= bottom; ++j) {
-        for (int i = left; i <= right; ++i) {
-            UpdatableTile* tile = tileAt(i, j);
-            if (!tile)
-                tile = createTile(i, j);
+    // Create additional textures for double-buffered updates when needed.
+    // These textures must stay alive while the updated textures are incrementally
+    // uploaded, swapped atomically via pushProperties, and finally deleted
+    // after the commit is complete, after which they can be recycled.
+    if (!visibleRect.isEmpty()) {
+        int left, top, right, bottom;
+        m_tiler->layerRectToTileIndices(visibleRect, left, top, right, bottom);
+        for (int j = top; j <= bottom; ++j) {
+            for (int i = left; i <= right; ++i) {
+                UpdatableTile* tile = tileAt(i, j);
+                if (!tile)
+                    tile = createTile(i, j);
+                // We need an additional texture if the tile needs a buffered-update and it's not a partial update.
+                // FIXME: Decide if partial update should be allowed based on cost
+                // of update. https://bugs.webkit.org/show_bug.cgi?id=77376
+                if (!layerTreeHost() || !layerTreeHost()->bufferedUpdates() || !tileNeedsBufferedUpdate(tile))
+                    continue;
+                if (tileOnlyNeedsPartialUpdate(tile) && layerTreeHost()->requestPartialTextureUpdate()) {
+                    tile->partialUpdate = true;
+                    continue;
+                }
 
-            if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat))
                 tile->dirtyRect = m_tiler->tileRect(tile);
-
-            if (!tile->managedTexture()->reserve(m_tiler->tileSize(), m_textureFormat))
-                return;
+                LayerTextureUpdater::Texture* backBuffer = tile->texture();
+                backBuffer->texture()->setRequestPriority(priorityCalc.priorityFromVisibility(true, drawsToRootSurface));
+                OwnPtr<CCPrioritizedTexture> frontBuffer = CCPrioritizedTexture::create(backBuffer->texture()->textureManager(),
+                                                                                        backBuffer->texture()->size(),
+                                                                                        backBuffer->texture()->format());
+                // Swap backBuffer into frontBuffer and add it to delete after commit queue.
+                backBuffer->swapTextureWith(frontBuffer);
+                layerTreeHost()->deleteTextureAfterCommit(frontBuffer.release());
+            }
         }
     }
+
+    // Now set priorities on all tiles.
+    for (CCLayerTilingData::TileMap::const_iterator iter = m_tiler->tiles().begin(); iter != m_tiler->tiles().end(); ++iter) {
+        UpdatableTile* tile = static_cast<UpdatableTile*>(iter->second.get());
+        IntRect tileRect = m_tiler->tileRect(tile);
+        // FIXME: This indicates the "small animated layer" case. This special case
+        // can be removed soon with better priorities, but for now paint these layers after
+        // 512 pixels of pre-painting. Later we can just pass an animating flag etc. to the
+        // calculator and it can take care of this special case if we still need it.
+        if (visibleRect.isEmpty() && !prepaintRect.isEmpty())
+            tile->managedTexture()->setRequestPriority(priorityCalc.priorityFromDistance(512, drawsToRootSurface));
+        else if (!visibleRect.isEmpty())
+            tile->managedTexture()->setRequestPriority(priorityCalc.priorityFromDistance(visibleRect, tileRect, drawsToRootSurface));
+    }
 }
 
 Region TiledLayerChromium::visibleContentOpaqueRegion() const
@@ -577,12 +606,12 @@ void TiledLayerChromium::resetUpdateState()
         if (!tile)
             continue;
         tile->updateRect = IntRect();
-        tile->partialUpdate = false;
         tile->updated = false;
+        tile->partialUpdate = false;
     }
 }
 
-void TiledLayerChromium::updateLayerRect(CCTextureUpdater& updater, const IntRect& layerRect, const CCOcclusionTracker* occlusion)
+void TiledLayerChromium::updateLayerRect(CCTextureUpdater& updater, const IntRect& contentRect, const CCOcclusionTracker* occlusion)
 {
     m_skipsDraw = false;
     m_skipsIdlePaint = false;
@@ -590,44 +619,30 @@ void TiledLayerChromium::updateLayerRect(CCTextureUpdater& updater, const IntRec
 
     updateBounds();
 
-    resetUpdateState();
-
-    if (layerRect.isEmpty() || m_tiler->hasEmptyBounds())
+    if (m_tiler->hasEmptyBounds())
         return;
 
-    int left, top, right, bottom;
-    m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
-
-    updateTiles(false, left, top, right, bottom, updater, occlusion);
-}
+    // Visible painting. Only paint visible tiles if the visible rect isn't empty.
+    if (!contentRect.isEmpty()) {
+        int left, top, right, bottom;
+        m_tiler->layerRectToTileIndices(contentRect, left, top, right, bottom);
+        updateTiles(false, left, top, right, bottom, updater, occlusion);
+    }
 
-void TiledLayerChromium::idleUpdateLayerRect(CCTextureUpdater& updater, const IntRect& layerRect, const CCOcclusionTracker* occlusion)
-{
     // Abort if we have already painted or run out of memory.
     if (m_skipsIdlePaint || m_didPaint)
         return;
 
-    ASSERT(m_tiler);
-
-    updateBounds();
-
-    if (m_tiler->hasEmptyBounds())
-        return;
-
-    IntRect idlePaintLayerRect = idlePaintRect(layerRect);
-    if (idlePaintLayerRect.isEmpty())
+    // If we have already painting everything visible. Do some pre-painting while idle.
+    IntRect idlePaintContentRect = idlePaintRect(contentRect);
+    if (idlePaintContentRect.isEmpty())
         return;
 
-    // Protect any textures in the pre-paint area, as we would steal them from other layers
-    // over time anyhow. This ensures we don't lose tiles in the first rounds of idle painting
-    // that we have already painted.
-    protectTileTextures(idlePaintLayerRect);
-
     int prepaintLeft, prepaintTop, prepaintRight, prepaintBottom;
-    m_tiler->layerRectToTileIndices(idlePaintLayerRect, prepaintLeft, prepaintTop, prepaintRight, prepaintBottom);
+    m_tiler->layerRectToTileIndices(idlePaintContentRect, prepaintLeft, prepaintTop, prepaintRight, prepaintBottom);
 
     // If the layer is not visible, we have nothing to expand from, so instead we prepaint the outer-most set of tiles.
-    if (layerRect.isEmpty()) {
+    if (contentRect.isEmpty()) {
         updateTiles(true, prepaintLeft, prepaintTop, prepaintRight, prepaintTop, updater, 0);
         if (m_didPaint || m_skipsIdlePaint)
             return;
@@ -642,7 +657,7 @@ void TiledLayerChromium::idleUpdateLayerRect(CCTextureUpdater& updater, const In
     }
 
     int left, top, right, bottom;
-    m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
+    m_tiler->layerRectToTileIndices(contentRect, left, top, right, bottom);
 
     // Otherwise, prepaint anything that was occluded but inside the layer's visible region.
     updateTiles(true, left, top, right, bottom, updater, 0);
@@ -678,7 +693,7 @@ void TiledLayerChromium::idleUpdateLayerRect(CCTextureUpdater& updater, const In
     }
 }
 
-bool TiledLayerChromium::needsIdlePaint(const IntRect& layerRect)
+bool TiledLayerChromium::needsIdlePaint(const IntRect& contentRect)
 {
     if (m_skipsIdlePaint)
         return false;
@@ -686,45 +701,54 @@ bool TiledLayerChromium::needsIdlePaint(const IntRect& layerRect)
     if (m_tiler->hasEmptyBounds())
         return false;
 
-    IntRect idlePaintLayerRect = idlePaintRect(layerRect);
-    if (idlePaintLayerRect.isEmpty())
+    IntRect idlePaintContentRect = idlePaintRect(contentRect);
+    if (idlePaintContentRect.isEmpty())
         return false;
 
     int left, top, right, bottom;
-    m_tiler->layerRectToTileIndices(idlePaintLayerRect, left, top, right, bottom);
+    m_tiler->layerRectToTileIndices(idlePaintContentRect, left, top, right, bottom);
+
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
             // If the layerRect is empty, then we are painting the outer-most set of tiles only.
-            if (layerRect.isEmpty() && i != left && i != right && j != top && j != bottom)
+            if (contentRect.isEmpty() && i != left && i != right && j != top && j != bottom)
                 continue;
             UpdatableTile* tile = tileAt(i, j);
-            if (!tile || !tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat) || tile->isDirty())
+            ASSERT(tile); // Did setTexturePriorities get skipped?
+            if (!tile)
+                continue;
+
+            bool updated = tile->updated;
+            bool canAcquire = tile->managedTexture()->canAcquireBackingTexture();
+            bool dirty = tile->isDirty() || !tile->managedTexture()->haveBackingTexture();
+            if (!updated && canAcquire && dirty)
                 return true;
         }
     }
     return false;
 }
 
-IntRect TiledLayerChromium::idlePaintRect(const IntRect& visibleLayerRect)
+IntRect TiledLayerChromium::idlePaintRect(const IntRect& visibleRect)
 {
+    IntRect contentRect(IntPoint::zero(), contentBounds());
+
     // For layers that are animating transforms but not visible at all, we don't know what part
     // of them is going to become visible. For small layers we return the entire layer, for larger
     // ones we avoid prepainting the layer at all.
-    if (visibleLayerRect.isEmpty()) {
+    if (visibleRect.isEmpty()) {
         bool isSmallLayer = m_tiler->numTilesX() <= 9 && m_tiler->numTilesY() <= 9 && m_tiler->numTilesX() * m_tiler->numTilesY() <= 9;
         if ((drawTransformIsAnimating() || screenSpaceTransformIsAnimating()) && isSmallLayer)
-            return IntRect(IntPoint(), contentBounds());
+            return contentRect;
         return IntRect();
     }
 
-    IntRect prepaintRect = visibleLayerRect;
-    // FIXME: This can be made a lot larger if we can:
-    // - reserve memory at a lower priority than for visible content
-    // - only reserve idle paint tiles up to a memory reclaim threshold and
-    // - insure we play nicely with other layers
+    // FIXME: This can be made a lot larger now! We should increase
+    //        this slowly while insuring it doesn't cause any perf issues.
+    IntRect prepaintRect = visibleRect;
     prepaintRect.inflateX(m_tiler->tileSize().width());
-    prepaintRect.inflateY(m_tiler->tileSize().height());
-    prepaintRect.intersect(IntRect(IntPoint::zero(), contentBounds()));
+    prepaintRect.inflateY(m_tiler->tileSize().height() * 2);
+    prepaintRect.intersect(contentRect);
+
     return prepaintRect;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
index d5b64e916..d2ed45c04 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
@@ -56,11 +56,7 @@ public:
 
     virtual void setLayerTreeHost(CCLayerTreeHost*) OVERRIDE;
 
-    // Reserves all existing and valid tile textures to protect them from being
-    // recycled by the texture manager.
-    void protectTileTextures(const IntRect& layerRect);
-
-    virtual void reserveTextures() OVERRIDE;
+    virtual void setTexturePriorities(const CCPriorityCalculator&) OVERRIDE;
 
     virtual Region visibleContentOpaqueRegion() const OVERRIDE;
 
@@ -89,10 +85,7 @@ protected:
     // Prepare data needed to update textures that intersect with layerRect.
     void updateLayerRect(CCTextureUpdater&, const IntRect& layerRect, const CCOcclusionTracker*);
 
-    // Same as above, but this will try to paint additional surrounding content if idle.
-    void idleUpdateLayerRect(CCTextureUpdater&, const IntRect& layerRect, const CCOcclusionTracker*);
-
-    // After preparing an update, returns true if more pre-painting is needed.
+    // After preparing an update, returns true if more painting is needed.
     bool needsIdlePaint(const IntRect& layerRect);
 
     IntRect idlePaintRect(const IntRect& visibleLayerRect);
@@ -100,7 +93,7 @@ protected:
     bool skipsDraw() const { return m_skipsDraw; }
 
     // Virtual for testing
-    virtual TextureManager* textureManager() const;
+    virtual CCPrioritizedTextureManager* textureManager() const;
 
 private:
     virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl() OVERRIDE;
@@ -111,6 +104,8 @@ private:
     bool tileOnlyNeedsPartialUpdate(UpdatableTile*);
     bool tileNeedsBufferedUpdate(UpdatableTile*);
 
+    void setTexturePrioritiesInRect(const CCPriorityCalculator&, const IntRect& visibleLayerRect);
+
     void updateTiles(bool idle, int left, int top, int right, int bottom, CCTextureUpdater&, const CCOcclusionTracker*);
 
     UpdatableTile* tileAt(int, int) const;
diff --git a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp
index 8e586e25a..c589a3c6e 100644
--- a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.cpp
@@ -33,8 +33,9 @@
 
 namespace WebCore {
 
-TrackingTextureAllocator::TrackingTextureAllocator(WebKit::WebGraphicsContext3D* context)
+TrackingTextureAllocator::TrackingTextureAllocator(WebKit::WebGraphicsContext3D* context, int maxTextureSize)
     : m_context(context)
+    , m_maxTextureSize(maxTextureSize)
     , m_currentMemoryUseBytes(0)
     , m_textureUsageHint(Any)
     , m_useTextureStorageExt(false)
@@ -71,6 +72,9 @@ static bool isTextureFormatSupportedForStorage(GC3Denum format)
 
 unsigned TrackingTextureAllocator::createTexture(const IntSize& size, GC3Denum format)
 {
+    if (size.width() > m_maxTextureSize || size.height() > m_maxTextureSize)
+        return 0;
+
     m_currentMemoryUseBytes += TextureManager::memoryUseBytes(size, format);
 
     unsigned textureId = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h
index c10c25721..78ef40d1b 100644
--- a/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h
+++ b/Source/WebCore/platform/graphics/chromium/TrackingTextureAllocator.h
@@ -38,9 +38,9 @@ namespace WebCore {
 class TrackingTextureAllocator : public TextureAllocator {
     WTF_MAKE_NONCOPYABLE(TrackingTextureAllocator);
 public:
-    static PassOwnPtr<TrackingTextureAllocator> create(WebKit::WebGraphicsContext3D* context)
+    static PassOwnPtr<TrackingTextureAllocator> create(WebKit::WebGraphicsContext3D* context, int maxTextureSize)
     {
-        return adoptPtr(new TrackingTextureAllocator(context));
+        return adoptPtr(new TrackingTextureAllocator(context, maxTextureSize));
     }
     virtual ~TrackingTextureAllocator();
 
@@ -56,9 +56,10 @@ public:
     void setUseTextureStorageExt(bool useStorageExt) { m_useTextureStorageExt = useStorageExt; }
 
 protected:
-    explicit TrackingTextureAllocator(WebKit::WebGraphicsContext3D*);
+    TrackingTextureAllocator(WebKit::WebGraphicsContext3D*, int maxTextureSize);
 
     WebKit::WebGraphicsContext3D* m_context;
+    int m_maxTextureSize;
     size_t m_currentMemoryUseBytes;
     TextureUsageHint m_textureUsageHint;
     bool m_useTextureStorageExt;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
index 1dbb59408..da9942663 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
@@ -186,6 +186,7 @@ FloatRect CCDamageTracker::removeRectFromCurrentFrame(int layerID, bool& layerIs
 void CCDamageTracker::saveRectForNextFrame(int layerID, const FloatRect& targetSpaceRect)
 {
     // This layer should not yet exist in next frame's history.
+    ASSERT(layerID > 0);
     ASSERT(m_nextRectHistory->find(layerID) == m_nextRectHistory->end());
     m_nextRectHistory->set(layerID, targetSpaceRect);
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
index 8d6a2ee8d..a86c587af 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
@@ -70,14 +70,7 @@ private:
     // To correctly track exposed regions, two hashtables of rects are maintained.
     // The "current" map is used to compute exposed regions of the current frame, while
     // the "next" map is used to collect layer rects that are used in the next frame.
-    struct RectMapKeyTraits : HashTraits<int> {
-        static const bool emptyValueIsZero = false;
-        static const bool needsDestruction = false;
-        static int emptyValue() { return -1; }
-        static void constructDeletedValue(int& slot) { slot = -2; }
-        static bool isDeletedValue(int value) { return value == -2; }
-    };
-    typedef HashMap<int, FloatRect, DefaultHash<int>::Hash, RectMapKeyTraits> RectMap;
+    typedef HashMap<int, FloatRect> RectMap;
     OwnPtr<RectMap> m_currentRectHistory;
     OwnPtr<RectMap> m_nextRectHistory;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp
index b4a71dc5f..1527c47c5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.cpp
@@ -29,18 +29,18 @@
 
 namespace WebCore {
 
-PassOwnPtr<CCDebugBorderDrawQuad> CCDebugBorderDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const Color& color, int width)
+PassOwnPtr<CCDebugBorderDrawQuad> CCDebugBorderDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color, int width)
 {
     return adoptPtr(new CCDebugBorderDrawQuad(sharedQuadState, quadRect, color, width));
 }
 
-CCDebugBorderDrawQuad::CCDebugBorderDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const Color& color, int width)
+CCDebugBorderDrawQuad::CCDebugBorderDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color, int width)
     : CCDrawQuad(sharedQuadState, CCDrawQuad::DebugBorder, quadRect)
     , m_color(color)
     , m_width(width)
 {
     m_quadOpaque = false;
-    if (m_color.hasAlpha())
+    if (SkColorGetA(m_color) < 255)
         m_needsBlending = true;
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h
index 0226aed76..ea1cf8476 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDebugBorderDrawQuad.h
@@ -26,7 +26,7 @@
 #ifndef CCDebugBorderDrawQuad_h
 #define CCDebugBorderDrawQuad_h
 
-#include "Color.h"
+#include "SkColor.h"
 #include "cc/CCDrawQuad.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -35,15 +35,15 @@ namespace WebCore {
 class CCDebugBorderDrawQuad : public CCDrawQuad {
     WTF_MAKE_NONCOPYABLE(CCDebugBorderDrawQuad);
 public:
-    static PassOwnPtr<CCDebugBorderDrawQuad> create(const CCSharedQuadState*, const IntRect&, const Color&, int width);
+    static PassOwnPtr<CCDebugBorderDrawQuad> create(const CCSharedQuadState*, const IntRect&, SkColor, int width);
 
-    const Color& color() const { return m_color; };
+    SkColor color() const { return m_color; };
     int width() const { return m_width; }
 
 private:
-    CCDebugBorderDrawQuad(const CCSharedQuadState*, const IntRect&, const Color&, int width);
+    CCDebugBorderDrawQuad(const CCSharedQuadState*, const IntRect&, SkColor, int width);
 
-    Color m_color;
+    SkColor m_color;
     int m_width;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.cpp
index 17d5946ec..c6132178e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.cpp
@@ -40,10 +40,10 @@ CCDebugRectHistory::CCDebugRectHistory()
 
 bool CCDebugRectHistory::enabled(const CCLayerTreeSettings& settings)
 {
-    return settings.showPaintRects || settings.showPropertyChangedRects || settings.showSurfaceDamageRects;
+    return settings.showPaintRects || settings.showPropertyChangedRects || settings.showSurfaceDamageRects || settings.showScreenSpaceRects || settings.showReplicaScreenSpaceRects || settings.showOccludingRects;
 }
 
-void CCDebugRectHistory::saveDebugRectsForCurrentFrame(CCLayerImpl* rootLayer, const Vector<CCLayerImpl*>& renderSurfaceLayerList, const CCLayerTreeSettings& settings)
+void CCDebugRectHistory::saveDebugRectsForCurrentFrame(CCLayerImpl* rootLayer, const Vector<CCLayerImpl*>& renderSurfaceLayerList, const Vector<IntRect>& occludingScreenSpaceRects, const CCLayerTreeSettings& settings)
 {
     // For now, clear all rects from previous frames. In the future we may want to store
     // all debug rects for a history of many frames.
@@ -57,6 +57,12 @@ void CCDebugRectHistory::saveDebugRectsForCurrentFrame(CCLayerImpl* rootLayer, c
 
     if (settings.showSurfaceDamageRects)
         saveSurfaceDamageRects(renderSurfaceLayerList);
+
+    if (settings.showScreenSpaceRects)
+        saveScreenSpaceRects(renderSurfaceLayerList);
+
+    if (settings.showOccludingRects)
+        saveOccludingRects(occludingScreenSpaceRects);
 }
 
 
@@ -104,6 +110,26 @@ void CCDebugRectHistory::saveSurfaceDamageRects(const Vector<CCLayerImpl* >& ren
     }
 }
 
+void CCDebugRectHistory::saveScreenSpaceRects(const Vector<CCLayerImpl* >& renderSurfaceLayerList)
+{
+    for (int surfaceIndex = renderSurfaceLayerList.size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
+        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex];
+        CCRenderSurface* renderSurface = renderSurfaceLayer->renderSurface();
+        ASSERT(renderSurface);
+
+        m_debugRects.append(CCDebugRect(ScreenSpaceRectType, CCMathUtil::mapClippedRect(renderSurface->screenSpaceTransform(), renderSurface->contentRect())));
+
+        if (renderSurfaceLayer->replicaLayer())
+            m_debugRects.append(CCDebugRect(ReplicaScreenSpaceRectType, CCMathUtil::mapClippedRect(renderSurface->replicaScreenSpaceTransform(), renderSurface->contentRect())));
+    }
+}
+
+void CCDebugRectHistory::saveOccludingRects(const Vector<IntRect>& occludingRects)
+{
+    for (size_t i = 0; i < occludingRects.size(); ++i)
+        m_debugRects.append(CCDebugRect(OccludingRectType, occludingRects[i]));
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.h b/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.h
index bb3cdb79d..7fd00c3f6 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDebugRectHistory.h
@@ -28,6 +28,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "FloatRect.h"
+#include "IntRect.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
@@ -37,7 +38,7 @@ namespace WebCore {
 class CCLayerImpl;
 struct CCLayerTreeSettings;
 
-// There are currently three types of debug rects:
+// There are currently six types of debug rects:
 //
 // - Paint rects (update rects): regions of a layer that needed to be re-uploaded to the
 //   texture resource; in most cases implying that WebCore had to repaint them, too.
@@ -50,7 +51,13 @@ struct CCLayerTreeSettings;
 //   layers and surfaces that contribute to it. This includes (1) paint rects, (2) property-
 //   changed rects, and (3) newly exposed areas.
 //
-enum DebugRectType { PaintRectType, PropertyChangedRectType, SurfaceDamageRectType };
+// - Screen space rects: this is the region the contents occupy in screen space.
+//
+// - Replica screen space rects: this is the region the replica's contents occupy in screen space.
+//
+// - Occluding rects: these are the regions that contribute to the occluded region.
+//
+enum DebugRectType { PaintRectType, PropertyChangedRectType, SurfaceDamageRectType, ScreenSpaceRectType, ReplicaScreenSpaceRectType, OccludingRectType };
 
 struct CCDebugRect {
     CCDebugRect(DebugRectType newType, FloatRect newRect)
@@ -75,7 +82,7 @@ public:
     bool enabled(const CCLayerTreeSettings&);
 
     // Note: Saving debug rects must happen before layers' change tracking is reset.
-    void saveDebugRectsForCurrentFrame(CCLayerImpl* rootLayer, const Vector<CCLayerImpl*>& renderSurfaceLayerList, const CCLayerTreeSettings&);
+    void saveDebugRectsForCurrentFrame(CCLayerImpl* rootLayer, const Vector<CCLayerImpl*>& renderSurfaceLayerList, const Vector<IntRect>& occludingScreenSpaceRects, const CCLayerTreeSettings&);
 
     const Vector<CCDebugRect>& debugRects() { return m_debugRects; }
 
@@ -85,6 +92,8 @@ private:
     void savePaintRects(CCLayerImpl*);
     void savePropertyChangedRects(const Vector<CCLayerImpl*>& renderSurfaceLayerList);
     void saveSurfaceDamageRects(const Vector<CCLayerImpl* >& renderSurfaceLayerList);
+    void saveScreenSpaceRects(const Vector<CCLayerImpl* >& renderSurfaceLayerList);
+    void saveOccludingRects(const Vector<IntRect>& occludingScreenSpaceRects);
 
     Vector<CCDebugRect> m_debugRects;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
index 3ab393fd9..df7f31554 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateController.cpp
@@ -66,7 +66,7 @@ void CCFrameRateController::setActive(bool active)
 {
     if (m_timeSource->active() == active)
         return;
-    TRACE_EVENT("CCFrameRateController::setActive", 0, (active ? "active" : "inactive"));
+    TRACE_EVENT1("cc", "CCFrameRateController::setActive", "active", active);
     m_timeSource->setActive(active);
 }
 
@@ -81,7 +81,7 @@ void CCFrameRateController::onTimerTick()
 
     // Don't forward the tick if we have too many frames in flight.
     if (m_maxFramesPending && m_numFramesPending >= m_maxFramesPending) {
-        TRACE_EVENT("CCFrameRateController::onTimerTickButMaxFramesPending", 0, 0);
+        TRACE_EVENT0("cc", "CCFrameRateController::onTimerTickButMaxFramesPending");
         return;
     }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
index 43536a421..405885ffb 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
@@ -29,6 +29,7 @@
 #include <public/WebGraphicsContext3D.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index f3d415dcf..731f770c0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -63,7 +63,7 @@ bool CCHeadsUpDisplay::showPlatformLayerTree(const CCLayerTreeSettings& settings
 
 bool CCHeadsUpDisplay::showDebugRects(const CCLayerTreeSettings& settings) const
 {
-    return settings.showPaintRects || settings.showPropertyChangedRects || settings.showSurfaceDamageRects;
+    return settings.showPaintRects || settings.showPropertyChangedRects || settings.showSurfaceDamageRects || settings.showScreenSpaceRects || settings.showReplicaScreenSpaceRects || settings.showOccludingRects;
 }
 
 void CCHeadsUpDisplay::draw(CCLayerTreeHostImpl* layerTreeHostImpl)
@@ -75,20 +75,20 @@ void CCHeadsUpDisplay::draw(CCLayerTreeHostImpl* layerTreeHostImpl)
         return;
     }
     if (!m_hudTexture)
-        m_hudTexture = ManagedTexture::create(layerRenderer->implTextureManager());
+        m_hudTexture = CCScopedTexture::create(layerRenderer->implTextureAllocator());
 
     const CCLayerTreeSettings& settings = layerTreeHostImpl->settings();
     // Use a fullscreen texture only if we need to...
     IntSize hudSize;
     if (showPlatformLayerTree(settings) || showDebugRects(settings)) {
-        hudSize.setWidth(min(2048, layerTreeHostImpl->viewportSize().width()));
-        hudSize.setHeight(min(2048, layerTreeHostImpl->viewportSize().height()));
+        hudSize.setWidth(min(2048, layerTreeHostImpl->deviceViewportSize().width()));
+        hudSize.setHeight(min(2048, layerTreeHostImpl->deviceViewportSize().height()));
     } else {
         hudSize.setWidth(512);
         hudSize.setHeight(128);
     }
 
-    if (!m_hudTexture->reserve(hudSize, GraphicsContext3D::RGBA))
+    if (!m_hudTexture->id() && !m_hudTexture->allocate(hudSize, GraphicsContext3D::RGBA))
         return;
 
     // Render pixels into the texture.
@@ -104,7 +104,7 @@ void CCHeadsUpDisplay::draw(CCLayerTreeHostImpl* layerTreeHostImpl)
     {
         PlatformCanvas::AutoLocker locker(&canvas);
 
-        m_hudTexture->bindTexture(layerTreeHostImpl->context(), layerRenderer->implTextureAllocator());
+        GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_hudTexture->id()));
         bool uploadedViaMap = false;
         if (layerRenderer->capabilities().usingMapSub) {
             uint8_t* pixelDest = static_cast<uint8_t*>(context->mapTexSubImage2DCHROMIUM(GraphicsContext3D::TEXTURE_2D, 0, 0, 0, hudSize.width(), hudSize.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, Extensions3DChromium::WRITE_ONLY));
@@ -122,8 +122,6 @@ void CCHeadsUpDisplay::draw(CCLayerTreeHostImpl* layerTreeHostImpl)
     }
 
     layerRenderer->drawHeadsUpDisplay(m_hudTexture.get(), hudSize);
-
-    m_hudTexture->unreserve();
 }
 
 void CCHeadsUpDisplay::drawHudContents(GraphicsContext* context, CCLayerTreeHostImpl* layerTreeHostImpl, const CCLayerTreeSettings& settings, const IntSize& hudSize)
@@ -244,6 +242,27 @@ void CCHeadsUpDisplay::drawDebugRects(GraphicsContext* context, CCDebugRectHisto
             context->fillRect(debugRects[i].rect, Color(200, 100, 0, 30), ColorSpaceDeviceRGB);
             context->strokeRect(debugRects[i].rect, 2.0);
         }
+
+        if (debugRects[i].type == ReplicaScreenSpaceRectType) {
+            // Screen space rects in green.
+            context->setStrokeColor(Color(100, 200, 0, 255), ColorSpaceDeviceRGB);
+            context->fillRect(debugRects[i].rect, Color(100, 200, 0, 30), ColorSpaceDeviceRGB);
+            context->strokeRect(debugRects[i].rect, 2.0);
+        }
+
+        if (debugRects[i].type == ScreenSpaceRectType) {
+            // Screen space rects in purple.
+            context->setStrokeColor(Color(100, 0, 200, 255), ColorSpaceDeviceRGB);
+            context->fillRect(debugRects[i].rect, Color(100, 0, 200, 10), ColorSpaceDeviceRGB);
+            context->strokeRect(debugRects[i].rect, 2.0);
+        }
+
+        if (debugRects[i].type == OccludingRectType) {
+            // Occluding rects in a reddish color.
+            context->setStrokeColor(Color(200, 0, 100, 255), ColorSpaceDeviceRGB);
+            context->fillRect(debugRects[i].rect, Color(200, 0, 100, 10), ColorSpaceDeviceRGB);
+            context->strokeRect(debugRects[i].rect, 2.0);
+        }
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
index c505a2086..266bf51e1 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
@@ -27,8 +27,8 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "ManagedTexture.h"
 #include "cc/CCFontAtlas.h"
+#include "cc/CCScopedTexture.h"
 
 namespace WebCore {
 
@@ -36,6 +36,7 @@ class CCDebugRectHistory;
 class CCFrameRateCounter;
 class CCLayerTreeHostImpl;
 class GraphicsContext;
+class TexureAllocator;
 
 struct CCLayerTreeSettings;
 
@@ -66,7 +67,7 @@ private:
     bool showPlatformLayerTree(const CCLayerTreeSettings&) const;
     bool showDebugRects(const CCLayerTreeSettings&) const;
 
-    OwnPtr<ManagedTexture> m_hudTexture;
+    OwnPtr<CCScopedTexture> m_hudTexture;
     OwnPtr<CCFontAtlas> m_fontAtlas;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
index 02ed80f1e..bd3e6e60c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
@@ -26,7 +26,6 @@
 
 #include "cc/CCLayerAnimationController.h"
 
-#include "GraphicsLayer.h" // for KeyframeValueList
 #include "cc/CCActiveAnimation.h"
 #include "cc/CCKeyframedAnimationCurve.h"
 #include <public/WebTransformationMatrix.h>
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index a3ab4f3b4..44772156d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -54,6 +54,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_scrollable(false)
     , m_shouldScrollOnMainThread(false)
     , m_haveWheelEventHandlers(false)
+    , m_backgroundColor(0)
     , m_doubleSided(true)
     , m_layerPropertyChanged(false)
     , m_layerSurfacePropertyChanged(false)
@@ -74,7 +75,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_drawDepth(0)
     , m_drawOpacity(0)
     , m_drawOpacityIsAnimating(false)
-    , m_debugBorderColor(0, 0, 0, 0)
+    , m_debugBorderColor(0)
     , m_debugBorderWidth(0)
     , m_drawTransformIsAnimating(false)
     , m_screenSpaceTransformIsAnimating(false)
@@ -84,7 +85,7 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_layerAnimationController(CCLayerAnimationController::create(this))
 {
     ASSERT(CCProxy::isImplThread());
-    ASSERT(m_layerId >= 0);
+    ASSERT(m_layerId > 0);
 }
 
 CCLayerImpl::~CCLayerImpl()
@@ -230,7 +231,7 @@ const IntRect CCLayerImpl::getDrawRect() const
     // Form the matrix used by the shader to map the corners of the layer's
     // bounds into the view space.
     FloatRect layerRect(-0.5 * bounds().width(), -0.5 * bounds().height(), bounds().width(), bounds().height());
-    IntRect mappedRect = enclosingIntRect(drawTransform().mapRect(layerRect));
+    IntRect mappedRect = enclosingIntRect(CCMathUtil::mapClippedRect(drawTransform(), layerRect));
     return mappedRect;
 }
 
@@ -440,7 +441,7 @@ void CCLayerImpl::setAnchorPointZ(float anchorPointZ)
     noteLayerPropertyChangedForSubtree();
 }
 
-void CCLayerImpl::setBackgroundColor(const Color& backgroundColor)
+void CCLayerImpl::setBackgroundColor(SkColor backgroundColor)
 {
     if (m_backgroundColor == backgroundColor)
         return;
@@ -541,7 +542,7 @@ bool CCLayerImpl::transformIsAnimating() const
     return m_layerAnimationController->isAnimatingProperty(CCActiveAnimation::Transform);
 }
 
-void CCLayerImpl::setDebugBorderColor(Color debugBorderColor)
+void CCLayerImpl::setDebugBorderColor(SkColor debugBorderColor)
 {
     if (m_debugBorderColor == debugBorderColor)
         return;
@@ -561,7 +562,7 @@ void CCLayerImpl::setDebugBorderWidth(float debugBorderWidth)
 
 bool CCLayerImpl::hasDebugBorders() const
 {
-    return debugBorderColor().alpha() && debugBorderWidth() > 0;
+    return SkColorGetA(m_debugBorderColor) && debugBorderWidth() > 0;
 }
 
 void CCLayerImpl::setContentBounds(const IntSize& contentBounds)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index c735b919d..00a351b22 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -26,10 +26,10 @@
 #ifndef CCLayerImpl_h
 #define CCLayerImpl_h
 
-#include "Color.h"
 #include "FloatRect.h"
 #include "IntRect.h"
 #include "Region.h"
+#include "SkColor.h"
 #include "TextStream.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerAnimationController.h"
@@ -111,8 +111,8 @@ public:
     void setAnchorPointZ(float);
     float anchorPointZ() const { return m_anchorPointZ; }
 
-    void setBackgroundColor(const Color&);
-    Color backgroundColor() const { return m_backgroundColor; }
+    void setBackgroundColor(SkColor);
+    SkColor backgroundColor() const { return m_backgroundColor; }
 
     void setFilters(const WebKit::WebFilterOperations&);
     const WebKit::WebFilterOperations& filters() const { return m_filters; }
@@ -154,8 +154,8 @@ public:
     const WebKit::WebTransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
 
     // Debug layer border - visual effect only, do not change geometry/clipping/etc.
-    void setDebugBorderColor(Color);
-    Color debugBorderColor() const { return m_debugBorderColor; }
+    void setDebugBorderColor(SkColor);
+    SkColor debugBorderColor() const { return m_debugBorderColor; }
     void setDebugBorderWidth(float);
     float debugBorderWidth() const { return m_debugBorderWidth; }
     bool hasDebugBorders() const;
@@ -317,7 +317,7 @@ private:
     bool m_shouldScrollOnMainThread;
     bool m_haveWheelEventHandlers;
     Region m_nonFastScrollableRegion;
-    Color m_backgroundColor;
+    SkColor m_backgroundColor;
 
     // Whether the "back" of this layer should draw.
     bool m_doubleSided;
@@ -371,7 +371,7 @@ private:
     bool m_drawOpacityIsAnimating;
 
     // Debug borders.
-    Color m_debugBorderColor;
+    SkColor m_debugBorderColor;
     float m_debugBorderWidth;
 
     // Debug layer name.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 351112bd5..414b20526 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -85,8 +85,8 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCLayerTre
     , m_pageScaleFactor(1)
     , m_minPageScaleFactor(1)
     , m_maxPageScaleFactor(1)
-    , m_triggerIdlePaints(true)
-    , m_backgroundColor(Color::white)
+    , m_triggerIdleUpdates(true)
+    , m_backgroundColor(SK_ColorWHITE)
     , m_hasTransparentBackground(false)
     , m_partialTextureUpdateRequests(0)
 {
@@ -96,7 +96,7 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCLayerTre
 
 bool CCLayerTreeHost::initialize()
 {
-    TRACE_EVENT("CCLayerTreeHost::initialize", this, 0);
+    TRACE_EVENT0("cc", "CCLayerTreeHost::initialize");
 
     if (CCProxy::hasImplThread())
         m_proxy = CCThreadProxy::create(this);
@@ -122,11 +122,14 @@ bool CCLayerTreeHost::initialize()
 CCLayerTreeHost::~CCLayerTreeHost()
 {
     ASSERT(CCProxy::isMainThread());
-    TRACE_EVENT("CCLayerTreeHost::~CCLayerTreeHost", this, 0);
+    TRACE_EVENT0("cc", "CCLayerTreeHost::~CCLayerTreeHost");
     ASSERT(m_proxy);
     m_proxy->stop();
     m_proxy.clear();
     numLayerTreeInstances--;
+    RateLimiterMap::iterator it = m_rateLimiters.begin();
+    if (it != m_rateLimiters.end())
+        it->second->stop();
 }
 
 void CCLayerTreeHost::setSurfaceReady()
@@ -136,7 +139,7 @@ void CCLayerTreeHost::setSurfaceReady()
 
 void CCLayerTreeHost::initializeLayerRenderer()
 {
-    TRACE_EVENT("CCLayerTreeHost::initializeLayerRenderer", this, 0);
+    TRACE_EVENT0("cc", "CCLayerTreeHost::initializeLayerRenderer");
     if (!m_proxy->initializeLayerRenderer()) {
         // Uh oh, better tell the client that we can't do anything with this context.
         m_client->didRecreateContext(false);
@@ -149,7 +152,7 @@ void CCLayerTreeHost::initializeLayerRenderer()
     // Update m_settings based on partial update capability.
     m_settings.maxPartialTextureUpdates = min(m_settings.maxPartialTextureUpdates, m_proxy->maxPartialTextureUpdates());
 
-    m_contentsTextureManager = TextureManager::create(0, 0, m_proxy->layerRendererCapabilities().maxTextureSize);
+    m_contentsTextureManager = CCPrioritizedTextureManager::create(0, m_proxy->layerRendererCapabilities().maxTextureSize);
 
     m_layerRendererInitialized = true;
 
@@ -198,7 +201,7 @@ void CCLayerTreeHost::deleteContentsTexturesOnImplThread(TextureAllocator* alloc
 {
     ASSERT(CCProxy::isImplThread());
     if (m_layerRendererInitialized)
-        m_contentsTextureManager->evictAndDeleteAllTextures(allocator);
+        m_contentsTextureManager->clearAllMemory(allocator);
 }
 
 void CCLayerTreeHost::acquireLayerTextures()
@@ -225,10 +228,9 @@ void CCLayerTreeHost::layout()
 void CCLayerTreeHost::beginCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
 {
     ASSERT(CCProxy::isImplThread());
-    TRACE_EVENT("CCLayerTreeHost::commitTo", this, 0);
+    TRACE_EVENT0("cc", "CCLayerTreeHost::commitTo");
 
-    m_contentsTextureManager->reduceMemoryToLimit(m_contentsTextureManager->preferredMemoryLimitBytes());
-    m_contentsTextureManager->deleteEvictedTextures(hostImpl->contentsTextureAllocator());
+    m_contentsTextureManager->reduceMemory(hostImpl->contentsTextureAllocator());
 }
 
 // This function commits the CCLayerTreeHost to an impl tree. When modifying
@@ -260,7 +262,6 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
 void CCLayerTreeHost::commitComplete()
 {
     m_deleteTextureAfterCommitList.clear();
-    m_contentsTextureManager->unprotectAllTextures();
     m_client->didCommit();
 }
 
@@ -278,7 +279,7 @@ PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHost::createLayerTreeHostImpl(CCLayer
 
 void CCLayerTreeHost::didLoseContext()
 {
-    TRACE_EVENT("CCLayerTreeHost::didLoseContext", 0, this);
+    TRACE_EVENT0("cc", "CCLayerTreeHost::didLoseContext");
     ASSERT(CCProxy::isMainThread());
     m_contextLost = true;
     m_numFailedRecreateAttempts = 0;
@@ -287,9 +288,9 @@ void CCLayerTreeHost::didLoseContext()
 
 bool CCLayerTreeHost::compositeAndReadback(void *pixels, const IntRect& rect)
 {
-    m_triggerIdlePaints = false;
+    m_triggerIdleUpdates = false;
     bool ret = m_proxy->compositeAndReadback(pixels, rect);
-    m_triggerIdlePaints = true;
+    m_triggerIdleUpdates = true;
     return ret;
 }
 
@@ -395,7 +396,7 @@ void CCLayerTreeHost::evictAllContentTextures()
 {
     ASSERT(CCProxy::isMainThread());
     ASSERT(m_contentsTextureManager.get());
-    m_contentsTextureManager->evictAndRemoveAllDeletedTextures();
+    m_contentsTextureManager->allBackingTexturesWereDeleted();
 }
 
 void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
@@ -410,7 +411,7 @@ void CCLayerTreeHost::loseContext(int numTimes)
     m_proxy->loseContext();
 }
 
-TextureManager* CCLayerTreeHost::contentsTextureManager() const
+CCPrioritizedTextureManager* CCLayerTreeHost::contentsTextureManager() const
 {
     return m_contentsTextureManager.get();
 }
@@ -442,10 +443,10 @@ bool CCLayerTreeHost::initializeLayerRendererIfNeeded()
 }
 
 
-void CCLayerTreeHost::updateLayers(CCTextureUpdater& updater, size_t contentsMemoryLimitBytes)
+void CCLayerTreeHost::updateLayers(CCTextureUpdater& updater, size_t memoryAllocationLimitBytes)
 {
     ASSERT(m_layerRendererInitialized);
-    ASSERT(contentsMemoryLimitBytes);
+    ASSERT(memoryAllocationLimitBytes);
 
     if (!rootLayer())
         return;
@@ -453,14 +454,14 @@ void CCLayerTreeHost::updateLayers(CCTextureUpdater& updater, size_t contentsMem
     if (viewportSize().isEmpty())
         return;
 
-    m_contentsTextureManager->setMemoryAllocationLimitBytes(contentsMemoryLimitBytes);
+    m_contentsTextureManager->setMaxMemoryLimitBytes(memoryAllocationLimitBytes);
 
     updateLayers(rootLayer(), updater);
 }
 
 void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& updater)
 {
-    TRACE_EVENT("CCLayerTreeHost::updateLayers", this, 0);
+    TRACE_EVENT0("cc", "CCLayerTreeHost::updateLayers");
 
     if (!rootLayer->renderSurface())
         rootLayer->createRenderSurface();
@@ -476,7 +477,7 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& u
     rootRenderSurface->clearLayerList();
 
     {
-        TRACE_EVENT("CCLayerTreeHost::updateLayers::calcDrawEtc", this, 0);
+        TRACE_EVENT0("cc", "CCLayerTreeHost::updateLayers::calcDrawEtc");
         WebTransformationMatrix identityMatrix;
         WebTransformationMatrix deviceScaleTransform;
         deviceScaleTransform.scale(m_deviceScaleFactor);
@@ -489,73 +490,88 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& u
     // Reset partial texture update requests.
     m_partialTextureUpdateRequests = 0;
 
-    reserveTextures(updateList);
-
-    paintLayerContents(updateList, PaintVisible, updater);
-    if (!m_triggerIdlePaints)
-        return;
-
-    size_t preferredLimitBytes = m_contentsTextureManager->preferredMemoryLimitBytes();
-    size_t maxLimitBytes = m_contentsTextureManager->maxMemoryLimitBytes();
-    m_contentsTextureManager->reduceMemoryToLimit(preferredLimitBytes);
-    if (m_contentsTextureManager->currentMemoryUseBytes() >= preferredLimitBytes)
-        return;
+    prioritizeTextures(updateList);
 
-    // Idle painting should fail when we hit the preferred memory limit,
-    // otherwise it will always push us towards the maximum limit.
-    m_contentsTextureManager->setMaxMemoryLimitBytes(preferredLimitBytes);
-    // The second (idle) paint will be a no-op in layers where painting already occured above.
-    paintLayerContents(updateList, PaintIdle, updater);
-    m_contentsTextureManager->setMaxMemoryLimitBytes(maxLimitBytes);
+    bool needMoreUpdates = paintLayerContents(updateList, updater);
+    if (m_triggerIdleUpdates && needMoreUpdates)
+        setNeedsCommit();
 
     for (size_t i = 0; i < updateList.size(); ++i)
         updateList[i]->clearRenderSurface();
 }
 
-void CCLayerTreeHost::reserveTextures(const LayerList& updateList)
+void CCLayerTreeHost::prioritizeTextures(const LayerList& updateList)
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
     typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
+    m_contentsTextureManager->clearPriorities();
+
+    CCPriorityCalculator calculator;
     CCLayerIteratorType end = CCLayerIteratorType::end(&updateList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&updateList); it != end; ++it) {
-        if (!it.representsItself() || !it->alwaysReserveTextures())
+        if (it.representsItself())
+            it->setTexturePriorities(calculator);
+        else if (it.representsTargetRenderSurface()) {
+            if (it->maskLayer())
+                it->maskLayer()->setTexturePriorities(calculator);
+            if (it->replicaLayer() && it->replicaLayer()->maskLayer())
+                it->replicaLayer()->maskLayer()->setTexturePriorities(calculator);
+        }
+    }
+
+    size_t readbackBytes = 0;
+    size_t maxBackgroundTextureBytes = 0;
+    size_t contentsTextureBytes = 0;
+
+    // Start iteration at 1 to skip the root surface as it does not have a texture cost.
+    for (size_t i = 1; i < updateList.size(); ++i) {
+        LayerChromium* renderSurfaceLayer = updateList[i].get();
+        RenderSurfaceChromium* renderSurface = renderSurfaceLayer->renderSurface();
+
+        size_t bytes = TextureManager::memoryUseBytes(renderSurface->contentRect().size(), GraphicsContext3D::RGBA);
+        contentsTextureBytes += bytes;
+
+        if (renderSurface->backgroundFilters().isEmpty())
             continue;
-        it->reserveTextures();
+
+        if (bytes > maxBackgroundTextureBytes)
+            maxBackgroundTextureBytes = bytes;
+        if (!readbackBytes)
+            readbackBytes = TextureManager::memoryUseBytes(m_deviceViewportSize, GraphicsContext3D::RGBA);
     }
-}
+    size_t renderSurfacesBytes = readbackBytes + maxBackgroundTextureBytes + contentsTextureBytes;
 
-// static
-void CCLayerTreeHost::update(LayerChromium* layer, PaintType paintType, CCTextureUpdater& updater, const CCOcclusionTracker* occlusion)
-{
-    ASSERT(layer);
-    ASSERT(PaintVisible == paintType || PaintIdle == paintType);
-    if (PaintVisible == paintType)
-        layer->update(updater, occlusion);
-    else
-        layer->idleUpdate(updater, occlusion);
+    m_contentsTextureManager->prioritizeTextures(renderSurfacesBytes);
 }
 
-void CCLayerTreeHost::paintMasksForRenderSurface(LayerChromium* renderSurfaceLayer, PaintType paintType, CCTextureUpdater& updater)
+bool CCLayerTreeHost::paintMasksForRenderSurface(LayerChromium* renderSurfaceLayer, CCTextureUpdater& updater)
 {
     // Note: Masks and replicas only exist for layers that own render surfaces. If we reach this point
     // in code, we already know that at least something will be drawn into this render surface, so the
     // mask and replica should be painted.
 
+    bool needMoreUpdates = false;
     LayerChromium* maskLayer = renderSurfaceLayer->maskLayer();
-    if (maskLayer)
-        update(maskLayer, paintType, updater, 0);
+    if (maskLayer) {
+        maskLayer->update(updater, 0);
+        needMoreUpdates |= maskLayer->needMoreUpdates();
+    }
 
     LayerChromium* replicaMaskLayer = renderSurfaceLayer->replicaLayer() ? renderSurfaceLayer->replicaLayer()->maskLayer() : 0;
-    if (replicaMaskLayer)
-        update(replicaMaskLayer, paintType, updater, 0);
+    if (replicaMaskLayer) {
+        replicaMaskLayer->update(updater, 0);
+        needMoreUpdates |= replicaMaskLayer->needMoreUpdates();
+    }
+    return needMoreUpdates;
 }
 
-void CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList, PaintType paintType, CCTextureUpdater& updater)
+bool CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList, CCTextureUpdater& updater)
 {
     // Use FrontToBack to allow for testing occlusion and performing culling during the tree walk.
     typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
 
+    bool needMoreUpdates = false;
     bool recordMetricsForFrame = true; // FIXME: In the future, disable this when about:tracing is off.
     CCOcclusionTracker occlusionTracker(IntRect(IntPoint(), deviceViewportSize()), recordMetricsForFrame);
     occlusionTracker.setMinimumTrackingSize(CCOcclusionTracker::preferredMinimumTrackingSize());
@@ -566,16 +582,21 @@ void CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList
 
         if (it.representsTargetRenderSurface()) {
             ASSERT(it->renderSurface()->drawOpacity() || it->renderSurface()->drawOpacityIsAnimating());
-            paintMasksForRenderSurface(*it, paintType, updater);
+            needMoreUpdates |= paintMasksForRenderSurface(*it, updater);
         } else if (it.representsItself()) {
             ASSERT(!it->bounds().isEmpty());
-            update(*it, paintType, updater, &occlusionTracker);
+            it->update(updater, &occlusionTracker);
+            needMoreUpdates |= it->needMoreUpdates();
         }
 
         occlusionTracker.leaveLayer(it);
     }
 
+    occlusionTracker.overdrawMetrics().didUseContentsTextureMemoryBytes(m_contentsTextureManager->memoryAboveCutoffBytes());
+    occlusionTracker.overdrawMetrics().didUseRenderSurfaceTextureMemoryBytes(m_contentsTextureManager->memoryForRenderSurfacesBytes());
     occlusionTracker.overdrawMetrics().recordMetrics(this);
+
+    return needMoreUpdates;
 }
 
 static LayerChromium* findFirstScrollableLayer(LayerChromium* layer)
@@ -662,7 +683,7 @@ bool CCLayerTreeHost::requestPartialTextureUpdate()
     return true;
 }
 
-void CCLayerTreeHost::deleteTextureAfterCommit(PassOwnPtr<ManagedTexture> texture)
+void CCLayerTreeHost::deleteTextureAfterCommit(PassOwnPtr<CCPrioritizedTexture> texture)
 {
     m_deleteTextureAfterCommitList.append(texture);
 }
@@ -683,7 +704,7 @@ void CCLayerTreeHost::animateLayers(double monotonicTime)
     if (!CCSettings::acceleratedAnimationEnabled() || !m_needsAnimateLayers)
         return;
 
-    TRACE_EVENT("CCLayerTreeHostImpl::animateLayers", this, 0);
+    TRACE_EVENT0("cc", "CCLayerTreeHostImpl::animateLayers");
     m_needsAnimateLayers = animateLayersRecursive(m_rootLayer.get(), monotonicTime);
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index 23ac33140..c2143eae5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -25,15 +25,19 @@
 #ifndef CCLayerTreeHost_h
 #define CCLayerTreeHost_h
 
-#include "Color.h"
 #include "GraphicsContext3D.h"
 #include "GraphicsTypes3D.h"
 #include "IntRect.h"
 #include "RateLimiter.h"
+#include "SkColor.h"
 #include "cc/CCAnimationEvents.h"
+#include "cc/CCGraphicsContext.h"
+#include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCOcclusionTracker.h"
+#include "cc/CCPrioritizedTextureManager.h"
 #include "cc/CCProxy.h"
 
+
 #include <limits>
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
@@ -50,7 +54,7 @@ class CCTextureUpdater;
 class ManagedTexture;
 class Region;
 class TextureAllocator;
-class TextureManager;
+class CCPrioritizedTextureManager;
 struct CCRenderingStats;
 struct CCScrollAndScaleSet;
 
@@ -85,6 +89,9 @@ struct CCLayerTreeSettings {
             , showPaintRects(false)
             , showPropertyChangedRects(false)
             , showSurfaceDamageRects(false)
+            , showScreenSpaceRects(false)
+            , showReplicaScreenSpaceRects(false)
+            , showOccludingRects(false)
             , refreshRate(0)
             , maxPartialTextureUpdates(std::numeric_limits<size_t>::max())
             , defaultTileSize(IntSize(256, 256))
@@ -98,6 +105,9 @@ struct CCLayerTreeSettings {
     bool showPaintRects;
     bool showPropertyChangedRects;
     bool showSurfaceDamageRects;
+    bool showScreenSpaceRects;
+    bool showReplicaScreenSpaceRects;
+    bool showOccludingRects;
     double refreshRate;
     size_t maxPartialTextureUpdates;
     IntSize defaultTileSize;
@@ -226,11 +236,11 @@ public:
 
     void setPageScaleFactorAndLimits(float pageScaleFactor, float minPageScaleFactor, float maxPageScaleFactor);
 
-    void setBackgroundColor(const Color& color) { m_backgroundColor = color; }
+    void setBackgroundColor(SkColor color) { m_backgroundColor = color; }
 
     void setHasTransparentBackground(bool transparent) { m_hasTransparentBackground = transparent; }
 
-    TextureManager* contentsTextureManager() const;
+    CCPrioritizedTextureManager* contentsTextureManager() const;
 
     // This will cause contents texture manager to evict all textures, but
     // without deleting them. This happens after all content textures have
@@ -253,7 +263,7 @@ public:
 
     bool bufferedUpdates();
     bool requestPartialTextureUpdate();
-    void deleteTextureAfterCommit(PassOwnPtr<ManagedTexture>);
+    void deleteTextureAfterCommit(PassOwnPtr<CCPrioritizedTexture>);
 
     void setDeviceScaleFactor(float);
     float deviceScaleFactor() const { return m_deviceScaleFactor; }
@@ -264,18 +274,17 @@ protected:
 
 private:
     typedef Vector<RefPtr<LayerChromium> > LayerList;
-    typedef Vector<OwnPtr<ManagedTexture> > TextureList;
+    typedef Vector<OwnPtr<CCPrioritizedTexture> > TextureList;
 
     void initializeLayerRenderer();
 
-    enum PaintType { PaintVisible, PaintIdle };
-    static void update(LayerChromium*, PaintType, CCTextureUpdater&, const CCOcclusionTracker*);
-    void paintLayerContents(const LayerList&, PaintType, CCTextureUpdater&);
-    void paintMasksForRenderSurface(LayerChromium*, PaintType, CCTextureUpdater&);
+    static void update(LayerChromium*, CCTextureUpdater&, const CCOcclusionTracker*);
+    bool paintLayerContents(const LayerList&, CCTextureUpdater&);
+    bool paintMasksForRenderSurface(LayerChromium*, CCTextureUpdater&);
 
     void updateLayers(LayerChromium*, CCTextureUpdater&);
-    // Pre-reserve textures for any layer marked "always reserve textures"
-    void reserveTextures(const LayerList&);
+
+    void prioritizeTextures(const LayerList& updateList);
 
     void animateLayers(double monotonicTime);
     bool animateLayersRecursive(LayerChromium* current, double monotonicTime);
@@ -298,7 +307,7 @@ private:
     int m_numFailedRecreateAttempts;
 
     RefPtr<LayerChromium> m_rootLayer;
-    OwnPtr<TextureManager> m_contentsTextureManager;
+    OwnPtr<CCPrioritizedTextureManager> m_contentsTextureManager;
 
     CCLayerTreeSettings m_settings;
 
@@ -313,8 +322,9 @@ private:
 
     float m_pageScaleFactor;
     float m_minPageScaleFactor, m_maxPageScaleFactor;
-    bool m_triggerIdlePaints;
-    Color m_backgroundColor;
+    bool m_triggerIdleUpdates;
+
+    SkColor m_backgroundColor;
     bool m_hasTransparentBackground;
 
     TextureList m_deleteTextureAfterCommitList;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index c59707a4b..51ae04802 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -188,19 +188,6 @@ static bool isScaleOrTranslation(const WebTransformationMatrix& m)
            && m.m44();
 }
 
-static inline bool layerOpacityIsOpaque(CCLayerImpl* layer)
-{
-    return layer->opacity() == 1;
-}
-
-static inline bool layerOpacityIsOpaque(LayerChromium* layer)
-{
-    // If the opacity is being animated then the opacity on the main thread is unreliable
-    // (since the impl thread may be using a different opacity), so it should not be trusted.
-    // In particular, it should not be treated as opaque.
-    return layer->opacity() == 1 && !layer->opacityIsAnimating();
-}
-
 static inline bool transformToParentIsKnown(CCLayerImpl*)
 {
     return true;
@@ -303,16 +290,11 @@ static bool subtreeShouldRenderToSeparateSurface(LayerType* layer, bool axisAlig
         return true;
 
     // If the layer clips its descendants but it is not axis-aligned with respect to its parent.
-    // On the main thread, when the transform is being animated, it is treated as unknown and we
-    // always error on the side of making a render surface, to let us consider descendents as
-    // not animating relative to their target to aid culling.
-    if (layer->masksToBounds() && (!axisAlignedWithRespectToParent || !transformToParentIsKnown(layer)) && descendantDrawsContent)
+    if (layer->masksToBounds() && !axisAlignedWithRespectToParent && descendantDrawsContent)
         return true;
 
     // If the layer has opacity != 1 and does not have a preserves-3d transform style.
-    // On the main thread, when opacity is being animated, it is treated as neither 1
-    // nor 0.
-    if (!layerOpacityIsOpaque(layer) && !layer->preserves3D() && descendantDrawsContent)
+    if (layer->opacity() != 1 && !layer->preserves3D() && descendantDrawsContent)
         return true;
 
     return false;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index 1dca36a60..26a09e70f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -129,6 +129,7 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCLayerTreeSettings& settings, CC
     , m_sentPageScaleDelta(1)
     , m_minPageScale(0)
     , m_maxPageScale(0)
+    , m_backgroundColor(0)
     , m_hasTransparentBackground(false)
     , m_needsAnimateLayers(false)
     , m_pinchGestureActive(false)
@@ -154,6 +155,7 @@ void CCLayerTreeHostImpl::beginCommit()
 
 void CCLayerTreeHostImpl::commitComplete()
 {
+    TRACE_EVENT0("cc", "CCLayerTreeHostImpl::commitComplete");
     // Recompute max scroll position; must be after layer content bounds are
     // updated.
     updateMaxScrollPosition();
@@ -162,14 +164,22 @@ void CCLayerTreeHostImpl::commitComplete()
 
 bool CCLayerTreeHostImpl::canDraw()
 {
-    if (!m_rootLayerImpl)
+    if (!m_rootLayerImpl) {
+        TRACE_EVENT_INSTANT0("cc", "CCLayerTreeHostImpl::canDraw no root layer");
         return false;
-    if (viewportSize().isEmpty())
+    }
+    if (viewportSize().isEmpty()) {
+        TRACE_EVENT_INSTANT0("cc", "CCLayerTreeHostImpl::canDraw empty viewport");
         return false;
-    if (!m_layerRenderer)
+    }
+    if (!m_layerRenderer) {
+        TRACE_EVENT_INSTANT0("cc", "CCLayerTreeHostImpl::canDraw no layerRenderer");
         return false;
-    if (m_contentsTexturesWerePurgedSinceLastCommit)
+    }
+    if (m_contentsTexturesWerePurgedSinceLastCommit) {
+        TRACE_EVENT_INSTANT0("cc", "CCLayerTreeHostImpl::canDraw contents textures purged");
         return false;
+    }
     return true;
 }
 
@@ -285,7 +295,10 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(FrameData& frame)
         CCLayerImpl* renderSurfaceLayer = (*frame.renderSurfaceLayerList)[surfaceIndex];
         CCRenderSurface* renderSurface = renderSurfaceLayer->renderSurface();
 
-        OwnPtr<CCRenderPass> pass = CCRenderPass::create(renderSurface);
+        // FIXME: Make this unique across all CCLayerTreeHostImpls.
+        int globalRenderPassId = renderSurfaceLayer->id();
+
+        OwnPtr<CCRenderPass> pass = CCRenderPass::create(renderSurface, globalRenderPassId);
         surfacePassMap.add(renderSurface, pass.get());
         frame.renderPasses.append(pass.release());
     }
@@ -294,6 +307,9 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(FrameData& frame)
     CCOcclusionTrackerImpl occlusionTracker(enclosingIntRect(m_rootScissorRect), recordMetricsForFrame);
     occlusionTracker.setMinimumTrackingSize(CCOcclusionTrackerImpl::preferredMinimumTrackingSize());
 
+    if (settings().showOccludingRects)
+        occlusionTracker.setOccludingScreenSpaceRectsContainer(&frame.occludingScreenSpaceRects);
+
     // Add quads to the Render passes in FrontToBack order to allow for testing occlusion and performing culling during the tree walk.
     typedef CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
 
@@ -337,8 +353,9 @@ bool CCLayerTreeHostImpl::calculateRenderPasses(FrameData& frame)
     if (drawFrame)
         occlusionTracker.overdrawMetrics().recordMetrics(this);
 
+    removeRenderPasses(CullRenderPassesWithNoQuads(), frame);
     m_layerRenderer->decideRenderPassAllocationsForFrame(frame.renderPasses);
-    removePassesWithCachedTextures(frame.renderPasses, frame.skippedPasses);
+    removeRenderPasses(CullRenderPassesWithCachedTextures(*m_layerRenderer), frame);
 
     return drawFrame;
 }
@@ -389,6 +406,7 @@ IntSize CCLayerTreeHostImpl::contentSize() const
     return m_rootScrollLayerImpl->children()[0]->contentBounds();
 }
 
+// static
 void CCLayerTreeHostImpl::removeRenderPassesRecursive(CCRenderPassList& passes, size_t bottomPass, const CCRenderPass* firstToRemove, CCRenderPassList& skippedPasses)
 {
     size_t removeIndex = passes.find(firstToRemove);
@@ -418,10 +436,41 @@ void CCLayerTreeHostImpl::removeRenderPassesRecursive(CCRenderPassList& passes,
     skippedPasses.append(removedPass.release());
 }
 
-void CCLayerTreeHostImpl::removePassesWithCachedTextures(CCRenderPassList& passes, CCRenderPassList& skippedPasses)
+bool CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures::shouldRemoveRenderPass(const CCRenderPassList&, const CCRenderPassDrawQuad& quad) const
+{
+    return quad.contentsChangedSinceLastFrame().isEmpty() && m_renderer.haveCachedResourcesForRenderPassId(quad.renderPassId());
+}
+
+bool CCLayerTreeHostImpl::CullRenderPassesWithNoQuads::shouldRemoveRenderPass(const CCRenderPassList& passList, const CCRenderPassDrawQuad& quad) const
 {
-    for (int passIndex = passes.size() - 1; passIndex >= 0; --passIndex) {
-        CCRenderPass* currentPass = passes[passIndex].get();
+    size_t passIndex = passList.find(quad.renderPass());
+    ASSERT(passIndex != notFound);
+
+    // If any quad or RenderPass draws into this RenderPass, then keep it.
+    const CCQuadList& quadList = passList[passIndex]->quadList();
+    for (CCQuadList::constBackToFrontIterator quadListIterator = quadList.backToFrontBegin(); quadListIterator != quadList.backToFrontEnd(); ++quadListIterator) {
+        CCDrawQuad* currentQuad = quadListIterator->get();
+
+        if (currentQuad->material() != CCDrawQuad::RenderPass)
+            return false;
+
+        const CCRenderPassDrawQuad* quadInPass = static_cast<CCRenderPassDrawQuad*>(currentQuad);
+        if (passList.contains(quadInPass->renderPass()))
+            return false;
+    }
+    return true;
+}
+
+// Defined for linking tests.
+template void CCLayerTreeHostImpl::removeRenderPasses<CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures>(CullRenderPassesWithCachedTextures, FrameData&);
+template void CCLayerTreeHostImpl::removeRenderPasses<CCLayerTreeHostImpl::CullRenderPassesWithNoQuads>(CullRenderPassesWithNoQuads, FrameData&);
+
+// static
+template<typename RenderPassCuller>
+void CCLayerTreeHostImpl::removeRenderPasses(RenderPassCuller culler, FrameData& frame)
+{
+    for (size_t it = culler.renderPassListBegin(frame.renderPasses); it != culler.renderPassListEnd(frame.renderPasses); it = culler.renderPassListNext(it)) {
+        CCRenderPass* currentPass = frame.renderPasses[it].get();
         const CCQuadList& quadList = currentPass->quadList();
         CCQuadList::constBackToFrontIterator quadListIterator = quadList.backToFrontBegin();
 
@@ -432,23 +481,18 @@ void CCLayerTreeHostImpl::removePassesWithCachedTextures(CCRenderPassList& passe
                 continue;
 
             CCRenderPassDrawQuad* renderPassQuad = static_cast<CCRenderPassDrawQuad*>(currentQuad);
-            CCRenderSurface* targetSurface = renderPassQuad->renderPass()->targetSurface();
-
-            if (targetSurface->contentsChanged() || !targetSurface->hasCachedContentsTexture())
+            if (!culler.shouldRemoveRenderPass(frame.renderPasses, *renderPassQuad))
                 continue;
 
-            // Reserve the texture immediately. We do not need to pass in layer renderer
-            // since the texture already exists, just needs to be reserved.
-            if (!targetSurface->prepareContentsTexture(0))
-                continue;
-
-            // We are changing the vector in the middle of reverse iteration.
-            // We are guaranteed that any data from iterator to the end will not change.
-            // Capture the iterator position from the end, and restore it after the change.
-            int positionFromEnd = passes.size() - passIndex;
-            removeRenderPassesRecursive(passes, passIndex, renderPassQuad->renderPass(), skippedPasses);
-            passIndex = passes.size() - positionFromEnd;
-            ASSERT(passIndex >= 0);
+            // We are changing the vector in the middle of iteration. Because we
+            // delete render passes that draw into the current pass, we are
+            // guaranteed that any data from the iterator to the end will not
+            // change. So, capture the iterator position from the end of the
+            // list, and restore it after the change.
+            int positionFromEnd = frame.renderPasses.size() - it;
+            removeRenderPassesRecursive(frame.renderPasses, it, renderPassQuad->renderPass(), frame.skippedPasses);
+            it = frame.renderPasses.size() - positionFromEnd;
+            ASSERT(it >= 0);
         }
     }
 }
@@ -474,6 +518,7 @@ void CCLayerTreeHostImpl::releaseContentsTextures()
 {
     contentsTextureAllocator()->deleteAllTextures();
     m_contentsTexturesWerePurgedSinceLastCommit = true;
+    m_client->setNeedsCommitOnImplThread();
 }
 
 void CCLayerTreeHostImpl::setMemoryAllocationLimitBytes(size_t bytes)
@@ -512,7 +557,7 @@ void CCLayerTreeHostImpl::drawLayers(const FrameData& frame)
     }
 
     if (m_debugRectHistory->enabled(settings()))
-        m_debugRectHistory->saveDebugRectsForCurrentFrame(m_rootLayerImpl.get(), *frame.renderSurfaceLayerList, settings());
+        m_debugRectHistory->saveDebugRectsForCurrentFrame(m_rootLayerImpl.get(), *frame.renderSurfaceLayerList, frame.occludingScreenSpaceRects, settings());
 
     if (m_headsUpDisplay->enabled(settings()))
         m_headsUpDisplay->draw(this);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index 726037f17..49f2fc62b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -25,7 +25,7 @@
 #ifndef CCLayerTreeHostImpl_h
 #define CCLayerTreeHostImpl_h
 
-#include "Color.h"
+#include "SkColor.h"
 #include "cc/CCAnimationEvents.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerSorter.h"
@@ -42,9 +42,10 @@ class CCDebugRectHistory;
 class CCFontAtlas;
 class CCFrameRateCounter;
 class CCHeadsUpDisplay;
-class CCPageScaleAnimation;
 class CCLayerImpl;
 class CCLayerTreeHostImplTimeSourceAdapter;
+class CCPageScaleAnimation;
+class CCRenderPassDrawQuad;
 class LayerRendererChromium;
 class TextureAllocator;
 struct LayerRendererCapabilities;
@@ -82,6 +83,7 @@ public:
     virtual void scheduleAnimation();
 
     struct FrameData {
+        Vector<IntRect> occludingScreenSpaceRects;
         CCRenderPassList renderPasses;
         CCRenderPassList skippedPasses;
         CCLayerList* renderSurfaceLayerList;
@@ -162,8 +164,8 @@ public:
 
     void startPageScaleAnimation(const IntSize& tragetPosition, bool useAnchor, float scale, double durationSec);
 
-    const Color& backgroundColor() const { return m_backgroundColor; }
-    void setBackgroundColor(const Color& color) { m_backgroundColor = color; }
+    SkColor backgroundColor() const { return m_backgroundColor; }
+    void setBackgroundColor(SkColor color) { m_backgroundColor = color; }
 
     bool hasTransparentBackground() const { return m_hasTransparentBackground; }
     void setHasTransparentBackground(bool transparent) { m_hasTransparentBackground = transparent; }
@@ -176,8 +178,35 @@ public:
     CCFrameRateCounter* fpsCounter() const { return m_fpsCounter.get(); }
     CCDebugRectHistory* debugRectHistory() const { return m_debugRectHistory.get(); }
 
-    // Removes all render passes for which we have cached textures, and which did not change their content.
-    static void removePassesWithCachedTextures(CCRenderPassList& passes, CCRenderPassList& skippedPasses);
+    class CullRenderPassesWithCachedTextures {
+    public:
+        bool shouldRemoveRenderPass(const CCRenderPassList&, const CCRenderPassDrawQuad&) const;
+
+        // Iterates from the root first, in order to remove the surfaces closest
+        // to the root with cached textures, and all surfaces that draw into
+        // them.
+        size_t renderPassListBegin(const CCRenderPassList& list) const { return list.size() - 1; }
+        size_t renderPassListEnd(const CCRenderPassList&) const { return 0 - 1; }
+        size_t renderPassListNext(size_t it) const { return it - 1; }
+
+        CullRenderPassesWithCachedTextures(CCRenderer& renderer) : m_renderer(renderer) { }
+    private:
+        CCRenderer& m_renderer;
+    };
+
+    class CullRenderPassesWithNoQuads {
+    public:
+        bool shouldRemoveRenderPass(const CCRenderPassList&, const CCRenderPassDrawQuad&) const;
+
+        // Iterates in draw order, so that when a surface is removed, and its
+        // target becomes empty, then its target can be removed also.
+        size_t renderPassListBegin(const CCRenderPassList&) const { return 0; }
+        size_t renderPassListEnd(const CCRenderPassList& list) const { return list.size(); }
+        size_t renderPassListNext(size_t it) const { return it + 1; }
+    };
+
+    template<typename RenderPassCuller>
+    static void removeRenderPasses(RenderPassCuller, FrameData&);
 
 protected:
     CCLayerTreeHostImpl(const CCLayerTreeSettings&, CCLayerTreeHostImplClient*);
@@ -245,7 +274,7 @@ private:
     float m_sentPageScaleDelta;
     float m_minPageScale, m_maxPageScale;
 
-    Color m_backgroundColor;
+    SkColor m_backgroundColor;
     bool m_hasTransparentBackground;
 
     // If this is true, it is necessary to traverse the layer tree ticking the animators.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp
index 8471b3e6a..007e74d49 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCMathUtil.cpp
@@ -278,13 +278,13 @@ FloatQuad CCMathUtil::projectQuad(const WebTransformationMatrix& transform, cons
 {
     FloatQuad projectedQuad;
     bool clippedPoint;
-    projectedQuad.setP1(transform.projectPoint(q.p1(), &clippedPoint));
+    projectedQuad.setP1(projectPoint(transform, q.p1(), clippedPoint));
     clipped = clippedPoint;
-    projectedQuad.setP2(transform.projectPoint(q.p2(), &clippedPoint));
+    projectedQuad.setP2(projectPoint(transform, q.p2(), clippedPoint));
     clipped |= clippedPoint;
-    projectedQuad.setP3(transform.projectPoint(q.p3(), &clippedPoint));
+    projectedQuad.setP3(projectPoint(transform, q.p3(), clippedPoint));
     clipped |= clippedPoint;
-    projectedQuad.setP4(transform.projectPoint(q.p4(), &clippedPoint));
+    projectedQuad.setP4(projectPoint(transform, q.p4(), clippedPoint));
     clipped |= clippedPoint;
 
     return projectedQuad;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
index 4836eb528..b49ff9083 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -45,6 +45,7 @@ template<typename LayerType, typename RenderSurfaceType>
 CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, bool recordMetricsForFrame)
     : m_scissorRectInScreenSpace(scissorRectInScreenSpace)
     , m_overdrawMetrics(CCOverdrawMetrics::create(recordMetricsForFrame))
+    , m_occludingScreenSpaceRects(0)
 {
 }
 
@@ -150,9 +151,9 @@ static inline Region transformSurfaceOpaqueRegion(const RenderSurfaceType* surfa
     Region transformedRegion;
 
     Vector<IntRect> rects = region.rects();
-    // Clipping has been verified above, so mapRect will give correct results.
     for (size_t i = 0; i < rects.size(); ++i) {
-        IntRect transformedRect = enclosedIntRect(transform.mapRect(FloatRect(rects[i])));
+        // We've already checked for clipping in the mapQuad call above, these calls should not clip anything further.
+        IntRect transformedRect = enclosedIntRect(CCMathUtil::mapClippedRect(transform, FloatRect(rects[i])));
         if (!surface->clipRect().isEmpty())
             transformedRect.intersect(surface->clipRect());
         transformedRegion.unite(transformedRect);
@@ -307,7 +308,7 @@ static inline WebTransformationMatrix contentToTargetSurfaceTransform(const Laye
 
 // FIXME: Remove usePaintTracking when paint tracking is on for paint culling.
 template<typename LayerType>
-static inline void addOcclusionBehindLayer(Region& region, const LayerType* layer, const WebTransformationMatrix& transform, const Region& opaqueContents, const IntRect& scissorRect, const IntSize& minimumTrackingSize)
+static inline void addOcclusionBehindLayer(Region& region, const LayerType* layer, const WebTransformationMatrix& transform, const Region& opaqueContents, const IntRect& scissorRect, const IntSize& minimumTrackingSize, Vector<IntRect>* occludingScreenSpaceRects)
 {
     ASSERT(layer->visibleLayerRect().contains(opaqueContents.bounds()));
 
@@ -318,12 +319,15 @@ static inline void addOcclusionBehindLayer(Region& region, const LayerType* laye
         return;
 
     Vector<IntRect> contentRects = opaqueContents.rects();
-    // We verify that the possible bounds of this region are not clipped above, so we can use mapRect() safely here.
     for (size_t i = 0; i < contentRects.size(); ++i) {
-        IntRect transformedRect = enclosedIntRect(transform.mapRect(FloatRect(contentRects[i])));
+        // We've already checked for clipping in the mapQuad call above, these calls should not clip anything further.
+        IntRect transformedRect = enclosedIntRect(CCMathUtil::mapClippedRect(transform, FloatRect(contentRects[i])));
         transformedRect.intersect(scissorRect);
-        if (transformedRect.width() >= minimumTrackingSize.width() || transformedRect.height() >= minimumTrackingSize.height())
+        if (transformedRect.width() >= minimumTrackingSize.width() || transformedRect.height() >= minimumTrackingSize.height()) {
+            if (occludingScreenSpaceRects)
+                occludingScreenSpaceRects->append(transformedRect);
             region.unite(transformedRect);
+        }
     }
 }
 
@@ -347,7 +351,7 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
 
     IntRect scissorInTarget = layerScissorRectInTargetSurface(layer);
     if (layerTransformsToTargetKnown(layer))
-        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInTarget, layer, contentToTargetSurfaceTransform<LayerType>(layer), opaqueContents, scissorInTarget, m_minimumTrackingSize);
+        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInTarget, layer, contentToTargetSurfaceTransform<LayerType>(layer), opaqueContents, scissorInTarget, m_minimumTrackingSize, 0);
 
     // We must clip the occlusion within the layer's scissorInTarget within screen space as well. If the scissor rect can't be moved to screen space and
     // remain rectilinear, then we don't add any occlusion in screen space.
@@ -360,7 +364,7 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
         if (clipped || !scissorInScreenQuad.isRectilinear())
             return;
         IntRect scissorInScreenRect = intersection(m_scissorRectInScreenSpace, enclosedIntRect(scissorInScreenQuad.boundingBox()));
-        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInScreen, layer, contentToScreenSpaceTransform<LayerType>(layer), opaqueContents, scissorInScreenRect, m_minimumTrackingSize);
+        addOcclusionBehindLayer<LayerType>(m_stack.last().occlusionInScreen, layer, contentToScreenSpaceTransform<LayerType>(layer), opaqueContents, scissorInScreenRect, m_minimumTrackingSize, m_occludingScreenSpaceRects);
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
index 19e533536..027fab71d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
@@ -72,6 +72,9 @@ public:
 
     static IntSize preferredMinimumTrackingSize() { return IntSize(160, 160); }
 
+    // The following is used for visualization purposes.
+    void setOccludingScreenSpaceRectsContainer(Vector<IntRect>* rects) { m_occludingScreenSpaceRects = rects; }
+
 protected:
     struct StackObject {
         StackObject() : surface(0) { }
@@ -111,6 +114,9 @@ private:
     IntRect m_scissorRectInScreenSpace;
     OwnPtr<CCOverdrawMetrics> m_overdrawMetrics;
     IntSize m_minimumTrackingSize;
+
+    // This is used for visualizing the occlusion tracking process.
+    Vector<IntRect>* m_occludingScreenSpaceRects;
 };
 
 typedef CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium> CCOcclusionTracker;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.cpp
index 0cc2fa5ec..c5b6f3ae7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.cpp
@@ -33,6 +33,7 @@
 #include "TraceEvent.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostImpl.h"
+#include "cc/CCMathUtil.h"
 #include <public/Platform.h>
 #include <public/WebTransformationMatrix.h>
 
@@ -46,6 +47,8 @@ CCOverdrawMetrics::CCOverdrawMetrics(bool recordMetricsForFrame)
     , m_pixelsUploadedOpaque(0)
     , m_pixelsUploadedTranslucent(0)
     , m_tilesCulledForUpload(0)
+    , m_contentsTextureUseBytes(0)
+    , m_renderSurfaceTextureUseBytes(0)
     , m_pixelsDrawnOpaque(0)
     , m_pixelsDrawnTranslucent(0)
     , m_pixelsCulledForDrawing(0)
@@ -57,13 +60,25 @@ static inline float wedgeProduct(const FloatPoint& p1, const FloatPoint& p2)
     return p1.x() * p2.y() - p1.y() * p2.x();
 }
 
-// Computes area of quads that are possibly non-rectangular. Can be easily extended to polygons.
-static inline float quadArea(const FloatQuad& quad)
+// Calculates area of an arbitrary convex polygon with up to 8 points.
+static inline float polygonArea(const FloatPoint points[8], int numPoints)
 {
-    return fabs(0.5 * (wedgeProduct(quad.p1(), quad.p2()) +
-                       wedgeProduct(quad.p2(), quad.p3()) +
-                       wedgeProduct(quad.p3(), quad.p4()) +
-                       wedgeProduct(quad.p4(), quad.p1())));
+    if (numPoints < 3)
+        return 0;
+
+    float area = 0;
+    for (int i = 0; i < numPoints; ++i)
+        area += wedgeProduct(points[i], points[(i+1)%numPoints]);
+    return fabs(0.5f * area);
+}
+
+// Takes a given quad, maps it by the given transformation, and gives the area of the resulting polygon.
+static inline float areaOfMappedQuad(const WebTransformationMatrix& transform, const FloatQuad& quad)
+{
+    FloatPoint clippedQuad[8];
+    int numVerticesInClippedQuad = 0;
+    CCMathUtil::mapClippedQuad(transform, quad, clippedQuad, numVerticesInClippedQuad);
+    return polygonArea(clippedQuad, numVerticesInClippedQuad);
 }
 
 void CCOverdrawMetrics::didPaint(const IntRect& paintedRect)
@@ -85,20 +100,36 @@ void CCOverdrawMetrics::didUpload(const WebTransformationMatrix& transformToTarg
     if (!m_recordMetricsForFrame)
         return;
 
-    float uploadArea = quadArea(transformToTarget.mapQuad(FloatQuad(uploadRect)));
-    float uploadOpaqueArea = quadArea(transformToTarget.mapQuad(FloatQuad(intersection(opaqueRect, uploadRect))));
+    float uploadArea = areaOfMappedQuad(transformToTarget, FloatQuad(uploadRect));
+    float uploadOpaqueArea = areaOfMappedQuad(transformToTarget, FloatQuad(intersection(opaqueRect, uploadRect)));
 
     m_pixelsUploadedOpaque += uploadOpaqueArea;
     m_pixelsUploadedTranslucent += uploadArea - uploadOpaqueArea;
 }
 
+void CCOverdrawMetrics::didUseContentsTextureMemoryBytes(size_t contentsTextureUseBytes)
+{
+    if (!m_recordMetricsForFrame)
+        return;
+
+    m_contentsTextureUseBytes += contentsTextureUseBytes;
+}
+
+void CCOverdrawMetrics::didUseRenderSurfaceTextureMemoryBytes(size_t renderSurfaceUseBytes)
+{
+    if (!m_recordMetricsForFrame)
+        return;
+
+    m_renderSurfaceTextureUseBytes += renderSurfaceUseBytes;
+}
+
 void CCOverdrawMetrics::didCullForDrawing(const WebTransformationMatrix& transformToTarget, const IntRect& beforeCullRect, const IntRect& afterCullRect)
 {
     if (!m_recordMetricsForFrame)
         return;
 
-    float beforeCullArea = quadArea(transformToTarget.mapQuad(FloatQuad(beforeCullRect)));
-    float afterCullArea = quadArea(transformToTarget.mapQuad(FloatQuad(afterCullRect)));
+    float beforeCullArea = areaOfMappedQuad(transformToTarget, FloatQuad(beforeCullRect));
+    float afterCullArea = areaOfMappedQuad(transformToTarget, FloatQuad(afterCullRect));
 
     m_pixelsCulledForDrawing += beforeCullArea - afterCullArea;
 }
@@ -108,8 +139,8 @@ void CCOverdrawMetrics::didDraw(const WebTransformationMatrix& transformToTarget
     if (!m_recordMetricsForFrame)
         return;
 
-    float afterCullArea = quadArea(transformToTarget.mapQuad(FloatQuad(afterCullRect)));
-    float afterCullOpaqueArea = quadArea(transformToTarget.mapQuad(FloatQuad(intersection(opaqueRect, afterCullRect))));
+    float afterCullArea = areaOfMappedQuad(transformToTarget, FloatQuad(afterCullRect));
+    float afterCullOpaqueArea = areaOfMappedQuad(transformToTarget, FloatQuad(intersection(opaqueRect, afterCullRect)));
 
     m_pixelsDrawnOpaque += afterCullOpaqueArea;
     m_pixelsDrawnTranslucent += afterCullArea - afterCullOpaqueArea;
@@ -134,6 +165,8 @@ void CCOverdrawMetrics::recordMetricsInternal(MetricsType metricsType, const Lay
     float normalization = 1000.f / (layerTreeHost->deviceViewportSize().width() * layerTreeHost->deviceViewportSize().height());
     // This gives approximately 100x the percentage of tiles to fill the viewport once, if all tiles were 256x256.
     float tileNormalization = 10000.f / (layerTreeHost->deviceViewportSize().width() / 256.f * layerTreeHost->deviceViewportSize().height() / 256.f);
+    // This gives approximately 10x the percentage of bytes to fill the viewport once, assuming 4 bytes per pixel.
+    float byteNormalization = normalization / 4;
 
     switch (metricsType) {
     case DrawingToScreen:
@@ -151,6 +184,10 @@ void CCOverdrawMetrics::recordMetricsInternal(MetricsType metricsType, const Lay
         WebKit::Platform::current()->histogramCustomCounts("Renderer4.pixelCountOpaque_Upload", static_cast<int>(normalization * m_pixelsUploadedOpaque), 100, 1000000, 50);
         WebKit::Platform::current()->histogramCustomCounts("Renderer4.pixelCountTranslucent_Upload", static_cast<int>(normalization * m_pixelsUploadedTranslucent), 100, 1000000, 50);
         WebKit::Platform::current()->histogramCustomCounts("Renderer4.tileCountCulled_Upload", static_cast<int>(tileNormalization * m_tilesCulledForUpload), 100, 10000000, 50);
+        WebKit::Platform::current()->histogramCustomCounts("Renderer4.renderSurfaceTextureBytes_ViewportScaled", static_cast<int>(byteNormalization * m_renderSurfaceTextureUseBytes), 10, 1000000, 50);
+        WebKit::Platform::current()->histogramCustomCounts("Renderer4.renderSurfaceTextureBytes_Unscaled", static_cast<int>(m_renderSurfaceTextureUseBytes / 1000), 1000, 100000000, 50);
+        WebKit::Platform::current()->histogramCustomCounts("Renderer4.contentsTextureBytes_ViewportScaled", static_cast<int>(byteNormalization * m_contentsTextureUseBytes), 10, 1000000, 50);
+        WebKit::Platform::current()->histogramCustomCounts("Renderer4.contentsTextureBytes_Unscaled", static_cast<int>(m_contentsTextureUseBytes / 1000), 1000, 100000000, 50);
 
         {
             TRACE_COUNTER_ID1("cc", "UploadTilesCulled", layerTreeHost, m_tilesCulledForUpload);
@@ -160,6 +197,10 @@ void CCOverdrawMetrics::recordMetricsInternal(MetricsType metricsType, const Lay
             // This must be in a different scope than the TRACE_EVENT2 above.
             TRACE_EVENT1("cc", "CCOverdrawPaintMetrics", "PixelsPainted", m_pixelsPainted);
         }
+        {
+            // This must be in a different scope than the TRACE_EVENTs above.
+            TRACE_EVENT2("cc", "CCOverdrawPaintMetrics", "ContentsTextureBytes", m_contentsTextureUseBytes, "RenderSurfaceTextureBytes", m_renderSurfaceTextureUseBytes);
+        }
         break;
     }
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.h b/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.h
index 715f5e151..f0dab0e93 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOverdrawMetrics.h
@@ -49,6 +49,10 @@ public:
     void didCullTileForUpload();
     // Records pixels that were uploaded to texture memory.
     void didUpload(const WebKit::WebTransformationMatrix& transformToTarget, const IntRect& uploadRect, const IntRect& opaqueRect);
+    // Record contents texture(s) behind present using the given number of bytes.
+    void didUseContentsTextureMemoryBytes(size_t contentsTextureUseBytes);
+    // Record RenderSurface texture(s) being present using the given number of bytes.
+    void didUseRenderSurfaceTextureMemoryBytes(size_t renderSurfaceUseBytes);
 
     // These methods are used for saving metrics during draw.
 
@@ -93,6 +97,10 @@ private:
     float m_pixelsUploadedTranslucent;
     // Count of tiles that were invalidated but not uploaded.
     int m_tilesCulledForUpload;
+    // Count the number of bytes in contents textures.
+    unsigned long long m_contentsTextureUseBytes;
+    // Count the number of bytes in RenderSurface textures.
+    unsigned long long m_renderSurfaceTextureUseBytes;
 
     // These values are used for saving metrics during draw.
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTexture.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTexture.cpp
new file mode 100644
index 000000000..d8cc17485
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTexture.cpp
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CCPrioritizedTexture.h"
+
+#include "CCPrioritizedTextureManager.h"
+#include "CCPriorityCalculator.h"
+#include "LayerRendererChromium.h"
+#include <algorithm>
+
+using namespace std;
+
+namespace WebCore {
+
+CCPrioritizedTexture::CCPrioritizedTexture(CCPrioritizedTextureManager* manager, IntSize size, GC3Denum format)
+    : m_size(size)
+    , m_format(format)
+    , m_memorySizeBytes(0)
+    , m_priority(CCPriorityCalculator::lowestPriority())
+    , m_isAbovePriorityCutoff(false)
+    , m_currentBacking(0)
+    , m_manager(0)
+{
+    // m_manager is set in registerTexture() so validity can be checked.
+    ASSERT(format || size.isEmpty());
+    if (format)
+        m_memorySizeBytes = TextureManager::memoryUseBytes(size, format);
+    if (manager)
+        manager->registerTexture(this);
+}
+
+CCPrioritizedTexture::~CCPrioritizedTexture()
+{
+    if (m_manager)
+        m_manager->unregisterTexture(this);
+}
+
+void CCPrioritizedTexture::setTextureManager(CCPrioritizedTextureManager* manager)
+{
+    if (m_manager == manager)
+        return;
+    if (m_manager)
+        m_manager->unregisterTexture(this);
+    if (manager)
+        manager->registerTexture(this);
+}
+
+void CCPrioritizedTexture::setDimensions(IntSize size, GC3Denum format)
+{
+    if (m_format != format || m_size != size) {
+        m_isAbovePriorityCutoff = false;
+        m_format = format;
+        m_size = size;
+        m_memorySizeBytes = TextureManager::memoryUseBytes(size, format);
+        ASSERT(m_manager || !m_currentBacking);
+        if (m_manager)
+            m_manager->returnBackingTexture(this);
+    }
+}
+
+bool CCPrioritizedTexture::requestLate()
+{
+    if (!m_manager)
+        return false;
+    return m_manager->requestLate(this);
+}
+
+void CCPrioritizedTexture::acquireBackingTexture(TextureAllocator* allocator)
+{
+    ASSERT(m_isAbovePriorityCutoff);
+    if (m_isAbovePriorityCutoff)
+        m_manager->acquireBackingTextureIfNeeded(this, allocator);
+}
+
+unsigned CCPrioritizedTexture::textureId()
+{
+    if (m_currentBacking)
+        return m_currentBacking->textureId();
+    return 0;
+}
+
+void CCPrioritizedTexture::bindTexture(CCGraphicsContext* context, TextureAllocator* allocator)
+{
+    ASSERT(m_isAbovePriorityCutoff);
+    if (m_isAbovePriorityCutoff)
+        acquireBackingTexture(allocator);
+    ASSERT(m_currentBacking);
+    WebKit::WebGraphicsContext3D* context3d = context->context3D();
+    if (!context3d) {
+        // FIXME: Implement this path for software compositing.
+        return;
+    }
+    context3d->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId());
+}
+
+void CCPrioritizedTexture::framebufferTexture2D(CCGraphicsContext* context, TextureAllocator* allocator)
+{
+    ASSERT(m_isAbovePriorityCutoff);
+    if (m_isAbovePriorityCutoff)
+        acquireBackingTexture(allocator);
+    ASSERT(m_currentBacking);
+    WebKit::WebGraphicsContext3D* context3d = context->context3D();
+    if (!context3d) {
+        // FIXME: Implement this path for software compositing.
+        return;
+    }
+    context3d->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, textureId(), 0);
+}
+
+void CCPrioritizedTexture::setCurrentBacking(CCPrioritizedTexture::Backing* backing)
+{
+    if (m_currentBacking == backing)
+        return;
+    m_currentBacking = backing;
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTexture.h b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTexture.h
new file mode 100644
index 000000000..9ea2fb1e4
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTexture.h
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCPrioritizedTexture_h
+#define CCPrioritizedTexture_h
+
+#include "CCPriorityCalculator.h"
+#include "GraphicsContext3D.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "TextureManager.h"
+
+namespace WebCore {
+
+class CCPrioritizedTextureManager;
+class CCPriorityCalculator;
+class CCGraphicsContext;
+
+class CCPrioritizedTexture {
+    WTF_MAKE_NONCOPYABLE(CCPrioritizedTexture);
+public:
+    static PassOwnPtr<CCPrioritizedTexture> create(CCPrioritizedTextureManager* manager, IntSize size, GC3Denum format)
+    {
+        return adoptPtr(new CCPrioritizedTexture(manager, size, format));
+    }
+    static PassOwnPtr<CCPrioritizedTexture> create(CCPrioritizedTextureManager* manager)
+    {
+        return adoptPtr(new CCPrioritizedTexture(manager, IntSize(), 0));
+    }
+    ~CCPrioritizedTexture();
+
+    // Texture properties. Changing these causes the backing texture to be lost.
+    // Setting these to the same value is a no-op.
+    void setTextureManager(CCPrioritizedTextureManager*);
+    CCPrioritizedTextureManager* textureManager() { return m_manager; }
+    void setDimensions(IntSize, GC3Denum format);
+    GC3Denum format() const { return m_format; }
+    IntSize size() const { return m_size; }
+    size_t memorySizeBytes() const { return m_memorySizeBytes; }
+
+    // Set priority for the requested texture. 
+    void setRequestPriority(int priority) { m_priority = priority; }
+    int requestPriority() const { return m_priority; }
+
+    // After CCPrioritizedTexture::prioritizeTextures() is called, this returns
+    // if the the request succeeded and this texture can be acquired for use.
+    bool canAcquireBackingTexture() const { return m_isAbovePriorityCutoff; }
+
+    // This returns whether we still have a backing texture. This can continue
+    // to be true even after canAquireBackingTexture() becomes false. In this
+    // case the texture can be used but shouldn't be updated since it will get
+    // taken away "soon".
+    bool haveBackingTexture() const { return !!currentBacking(); }
+
+    // If canAquireBackingTexture() is true acquireBackingTexture() will acquire
+    // a backing texture for use. Call this whenever the texture is actually needed.
+    void acquireBackingTexture(TextureAllocator*);
+
+    // FIXME: Request late is really a hack for when we are totally out of memory
+    //        (all textures are visible) but we can still squeeze into the limit
+    //        by not painting occluded textures. In this case the manager
+    //        refuses all visible textures and requestLate() will enable
+    //        canAquireBackingTexture() on a call-order basis. We might want to
+    //        just remove this in the future (carefully) and just make sure we don't
+    //        regress OOMs situations.
+    bool requestLate();
+
+    // These functions will aquire the texture if possible. If neither haveBackingTexture()
+    // nor canAquireBackingTexture() is true, an ID of zero will be used/returned.
+    void bindTexture(CCGraphicsContext*, TextureAllocator*);
+    void framebufferTexture2D(CCGraphicsContext*, TextureAllocator*);
+    unsigned textureId();
+
+private:
+    friend class CCPrioritizedTextureManager;
+
+    class Backing {
+        WTF_MAKE_NONCOPYABLE(Backing);
+    public:
+        IntSize size() const { return m_size; }
+        GC3Denum format() const { return m_format; }
+        size_t memorySizeBytes() const { return m_memorySizeBytes; }
+        unsigned textureId() const { return m_textureId; }
+        CCPrioritizedTexture* currentTexture() const { return m_currentTexture; }
+        void setCurrentTexture(CCPrioritizedTexture* current) { m_currentTexture = current; }
+
+    private:
+        friend class CCPrioritizedTextureManager;
+
+        Backing(IntSize size, GC3Denum format, unsigned textureId)
+            : m_size(size)
+            , m_format(format)
+            , m_memorySizeBytes(TextureManager::memoryUseBytes(size, format))
+            , m_textureId(textureId)
+            , m_priority(CCPriorityCalculator::lowestPriority())
+            , m_currentTexture(0) { }
+        ~Backing() { ASSERT(!m_currentTexture); }
+
+        IntSize m_size;
+        GC3Denum m_format;
+        size_t m_memorySizeBytes;
+        unsigned m_textureId;
+        int m_priority;
+        CCPrioritizedTexture* m_currentTexture;
+    };
+
+    CCPrioritizedTexture(CCPrioritizedTextureManager*, IntSize, GC3Denum format);
+
+    bool isAbovePriorityCutoff() { return m_isAbovePriorityCutoff; }
+    void setAbovePriorityCutoff(bool isAbovePriorityCutoff) { m_isAbovePriorityCutoff = isAbovePriorityCutoff; }
+    void setManagerInternal(CCPrioritizedTextureManager* manager) { m_manager = manager; }
+
+    Backing* currentBacking() const { return m_currentBacking; }
+    void setCurrentBacking(Backing*);
+
+    IntSize m_size;
+    GC3Denum m_format;
+    size_t m_memorySizeBytes;
+
+    size_t m_priority;
+    bool m_isAbovePriorityCutoff;
+
+    Backing* m_currentBacking;
+    CCPrioritizedTextureManager* m_manager;
+};
+
+} // WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp
new file mode 100644
index 000000000..5af53df04
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.cpp
@@ -0,0 +1,380 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CCPrioritizedTextureManager.h"
+
+#include "CCPrioritizedTexture.h"
+#include "CCPriorityCalculator.h"
+#include "LayerRendererChromium.h"
+#include "TraceEvent.h"
+#include <algorithm>
+
+using namespace std;
+
+namespace WebCore {
+
+CCPrioritizedTextureManager::CCPrioritizedTextureManager(size_t maxMemoryLimitBytes, int)
+    : m_maxMemoryLimitBytes(maxMemoryLimitBytes)
+    , m_memoryUseBytes(0)
+    , m_memoryAboveCutoffBytes(0)
+    , m_memoryAvailableBytes(0)
+{
+}
+
+CCPrioritizedTextureManager::~CCPrioritizedTextureManager()
+{
+    while (m_textures.size() > 0)
+        unregisterTexture(*m_textures.begin());
+
+    // Each remaining backing is a leaked opengl texture. We don't have the allocator
+    // to delete the textures at this time so clearMemory() needs to be called before this.
+    while (m_backings.size() > 0)
+        destroyBacking(*m_backings.begin(), 0);
+}
+
+void CCPrioritizedTextureManager::prioritizeTextures(size_t renderSurfacesMemoryBytes)
+{
+    TRACE_EVENT0("cc", "CCPrioritizedTextureManager::prioritizeTextures");
+
+#if !ASSERT_DISABLED
+    assertInvariants();
+#endif
+
+    // Sorting textures in this function could be replaced by a slightly
+    // modified O(n) quick-select to partition textures rather than
+    // sort them (if performance of the sort becomes an issue).
+
+    TextureVector& sortedTextures = m_tempTextureVector;
+    BackingVector& sortedBackings = m_tempBackingVector;
+    sortedTextures.clear();
+    sortedBackings.clear();
+
+    // Copy all textures into a vector and sort them.
+    for (TextureSet::iterator it = m_textures.begin(); it != m_textures.end(); ++it)
+        sortedTextures.append(*it);
+    std::sort(sortedTextures.begin(), sortedTextures.end(), compareTextures);
+
+    m_memoryAvailableBytes = m_maxMemoryLimitBytes;
+    m_priorityCutoff = CCPriorityCalculator::lowestPriority();
+    bool reservedRenderSurfaces = false;
+    size_t memoryBytes = 0;
+    for (TextureVector::iterator it = sortedTextures.begin(); it != sortedTextures.end(); ++it) {
+        if ((*it)->requestPriority() == CCPriorityCalculator::lowestPriority())
+            break;
+
+        // FIXME: We can make placeholder objects similar to textures to represent the render surface memory request.
+        if (!reservedRenderSurfaces && CCPriorityCalculator::priorityIsLower((*it)->requestPriority(), CCPriorityCalculator::renderSurfacePriority())) {
+            size_t newMemoryBytes = memoryBytes + renderSurfacesMemoryBytes;
+            if (newMemoryBytes > m_memoryAvailableBytes) {
+                m_priorityCutoff = (*it)->requestPriority();
+                m_memoryAvailableBytes = memoryBytes;
+                break;
+            }
+            m_memoryAvailableBytes -= renderSurfacesMemoryBytes;
+            reservedRenderSurfaces = true;
+        }
+
+        size_t newMemoryBytes = memoryBytes + (*it)->memorySizeBytes();
+        if (newMemoryBytes > m_memoryAvailableBytes) {
+            m_priorityCutoff = (*it)->requestPriority();
+            break;
+        }
+
+        memoryBytes = newMemoryBytes;
+    }
+
+    // Only allow textures if they are higher than the cutoff. All textures
+    // of the same priority are accepted or rejected together, rather than
+    // being partially allowed randomly.
+    m_memoryAboveCutoffBytes = 0;
+    for (TextureVector::iterator it = sortedTextures.begin(); it != sortedTextures.end(); ++it) {
+        bool isAbovePriorityCutoff = CCPriorityCalculator::priorityIsHigher((*it)->requestPriority(), m_priorityCutoff);
+        (*it)->setAbovePriorityCutoff(isAbovePriorityCutoff);
+        if (isAbovePriorityCutoff)
+            m_memoryAboveCutoffBytes += (*it)->memorySizeBytes();
+    }
+    ASSERT(m_memoryAboveCutoffBytes <= m_memoryAvailableBytes);
+
+    // Put backings in eviction/recycling order.
+    for (BackingSet::iterator it = m_backings.begin(); it != m_backings.end(); ++it)
+        sortedBackings.append(*it);
+    std::sort(sortedBackings.begin(), sortedBackings.end(), compareBackings);
+
+    for (BackingVector::iterator it = sortedBackings.begin(); it != sortedBackings.end(); ++it) {
+        m_backings.remove(*it);
+        m_backings.add(*it);
+    }
+
+    sortedTextures.clear();
+    sortedBackings.clear();
+
+#if !ASSERT_DISABLED
+    assertInvariants();
+    ASSERT(memoryAboveCutoffBytes() <= maxMemoryLimitBytes());
+#endif
+}
+
+void CCPrioritizedTextureManager::clearPriorities()
+{
+    for (TextureSet::iterator it = m_textures.begin(); it != m_textures.end(); ++it) {
+        // FIXME: We should remove this and just set all priorities to
+        //        CCPriorityCalculator::lowestPriority() once we have priorities
+        //        for all textures (we can't currently calculate distances for
+        //        off-screen textures).
+        (*it)->setRequestPriority(CCPriorityCalculator::lingeringPriority((*it)->requestPriority()));
+    }
+}
+
+bool CCPrioritizedTextureManager::requestLate(CCPrioritizedTexture* texture)
+{
+    // This is already above cutoff, so don't double count it's memory below.
+    if (texture->isAbovePriorityCutoff())
+        return true;
+
+    if (CCPriorityCalculator::priorityIsLower(texture->requestPriority(), m_priorityCutoff))
+        return false;
+
+    size_t newMemoryBytes = m_memoryAboveCutoffBytes + texture->memorySizeBytes();
+    if (newMemoryBytes > m_memoryAvailableBytes)
+        return false;
+
+    m_memoryAboveCutoffBytes = newMemoryBytes;
+    texture->setAbovePriorityCutoff(true);
+    if (texture->currentBacking()) {
+        m_backings.remove(texture->currentBacking());
+        m_backings.add(texture->currentBacking());
+    }
+    return true;
+}
+
+void CCPrioritizedTextureManager::acquireBackingTextureIfNeeded(CCPrioritizedTexture* texture, TextureAllocator* allocator)
+{
+    ASSERT(texture->isAbovePriorityCutoff());
+    if (texture->currentBacking() || !texture->isAbovePriorityCutoff())
+        return;
+
+    // Find a backing below, by either recycling or allocating.
+    CCPrioritizedTexture::Backing* backing = 0;
+
+    // First try to recycle
+    for (BackingSet::iterator it = m_backings.begin(); it != m_backings.end(); ++it) {
+        if ((*it)->currentTexture() && (*it)->currentTexture()->isAbovePriorityCutoff())
+            break;
+        if ((*it)->size() == texture->size() && (*it)->format() == texture->format()) {
+            backing = (*it);
+            break;
+        }
+    }
+
+    // Otherwise reduce memory and just allocate a new backing texures.
+    if (!backing) {
+        reduceMemory(m_memoryAvailableBytes - texture->memorySizeBytes(), allocator);
+        backing = createBacking(texture->size(), texture->format(), allocator);
+    }
+
+    // Move the used backing texture to the end of the eviction list.
+    if (backing->currentTexture())
+        unlink(backing->currentTexture(), backing);
+    link(texture, backing);
+    m_backings.remove(backing);
+    m_backings.add(backing);
+}
+
+void CCPrioritizedTextureManager::reduceMemory(size_t limitBytes, TextureAllocator* allocator)
+{
+    if (memoryUseBytes() <= limitBytes)
+        return;
+    // Destroy backings until we are below the limit,
+    // or until all backings remaining are above the cutoff.
+    while (memoryUseBytes() > limitBytes && m_backings.size() > 0) {
+        BackingSet::iterator it = m_backings.begin();
+        if ((*it)->currentTexture() && (*it)->currentTexture()->isAbovePriorityCutoff())
+            break;
+        destroyBacking((*it), allocator);
+    }
+}
+
+void CCPrioritizedTextureManager::reduceMemory(TextureAllocator* allocator)
+{
+    reduceMemory(m_memoryAvailableBytes, allocator);
+    ASSERT(memoryUseBytes() <= maxMemoryLimitBytes());
+
+    // We currently collect backings from deleted textures for later recycling.
+    // However, if we do that forever we will always use the max limit even if
+    // we really need very little memory. This should probably be solved by reducing the
+    // limit externally, but until then this just does some "clean up" of unused
+    // backing textures (any more than 10%).
+    size_t wastedMemory = 0;
+    for (BackingSet::iterator it = m_backings.begin(); it != m_backings.end(); ++it) {
+        if ((*it)->currentTexture())
+            break;
+        wastedMemory += (*it)->memorySizeBytes();
+    }
+    size_t tenPercentOfMemory = m_memoryAvailableBytes / 10;
+    if (wastedMemory <= tenPercentOfMemory)
+        return;
+    reduceMemory(memoryUseBytes() - (wastedMemory - tenPercentOfMemory), allocator);
+}
+
+void CCPrioritizedTextureManager::clearAllMemory(TextureAllocator* allocator)
+{
+    // Unlink and destroy all backing textures.
+    while (m_backings.size() > 0) {
+        BackingSet::iterator it = m_backings.begin();
+        if ((*it)->currentTexture())
+            unlink((*it)->currentTexture(), (*it));
+        destroyBacking((*it), allocator);
+    }
+}
+
+void CCPrioritizedTextureManager::allBackingTexturesWereDeleted()
+{
+    // Same as clearAllMemory, except all our textures were already
+    // deleted externally, so we don't delete them. Passing no
+    // allocator results in leaking the (now invalid) texture ids.
+    clearAllMemory(0);
+}
+
+void CCPrioritizedTextureManager::unlink(CCPrioritizedTexture* texture, CCPrioritizedTexture::Backing* backing)
+{
+    ASSERT(texture && backing);
+    ASSERT(texture->currentBacking() == backing);
+    ASSERT(backing->currentTexture() == texture);
+
+    texture->setCurrentBacking(0);
+    backing->setCurrentTexture(0);
+}
+
+void CCPrioritizedTextureManager::link(CCPrioritizedTexture* texture, CCPrioritizedTexture::Backing* backing)
+{
+    ASSERT(texture && backing);
+    ASSERT(!texture->currentBacking());
+    ASSERT(!backing->currentTexture());
+
+    texture->setCurrentBacking(backing);
+    backing->setCurrentTexture(texture);
+}
+
+
+void CCPrioritizedTextureManager::registerTexture(CCPrioritizedTexture* texture)
+{
+    ASSERT(texture);
+    ASSERT(!texture->textureManager());
+    ASSERT(!texture->currentBacking());
+    ASSERT(m_textures.find(texture) == m_textures.end());
+
+    texture->setManagerInternal(this);
+    m_textures.add(texture);
+
+}
+
+void CCPrioritizedTextureManager::unregisterTexture(CCPrioritizedTexture* texture)
+{
+    ASSERT(texture);
+    ASSERT(m_textures.find(texture) != m_textures.end());
+
+    returnBackingTexture(texture);
+    texture->setManagerInternal(0);
+    m_textures.remove(texture);
+    texture->setAbovePriorityCutoff(false);
+}
+
+
+void CCPrioritizedTextureManager::returnBackingTexture(CCPrioritizedTexture* texture)
+{
+    if (texture->currentBacking()) {
+        // Move the backing texture to the front for eviction/recycling and unlink it.
+        m_backings.remove(texture->currentBacking());
+        m_backings.insertBefore(m_backings.begin(), texture->currentBacking());
+        unlink(texture, texture->currentBacking());
+    }
+}
+
+CCPrioritizedTexture::Backing* CCPrioritizedTextureManager::createBacking(IntSize size, GC3Denum format, TextureAllocator* allocator)
+{
+    ASSERT(allocator);
+
+    unsigned textureId = allocator->createTexture(size, format);
+    CCPrioritizedTexture::Backing* backing = new CCPrioritizedTexture::Backing(size, format, textureId);
+    m_memoryUseBytes += backing->memorySizeBytes();
+    // Put backing texture at the front for eviction, since it isn't in use yet.
+    m_backings.insertBefore(m_backings.begin(), backing);
+    return backing;
+}
+
+void CCPrioritizedTextureManager::destroyBacking(CCPrioritizedTexture::Backing* backing, TextureAllocator* allocator)
+{
+    ASSERT(backing);
+    ASSERT(!backing->currentTexture() || !backing->currentTexture()->isAbovePriorityCutoff());
+    ASSERT(m_backings.find(backing) != m_backings.end());
+
+    if (allocator)
+        allocator->deleteTexture(backing->textureId(), backing->size(), backing->format());
+    if (backing->currentTexture())
+        unlink(backing->currentTexture(), backing);
+    m_memoryUseBytes -= backing->memorySizeBytes();
+    m_backings.remove(backing);
+
+    delete backing;
+}
+
+
+#if !ASSERT_DISABLED
+void CCPrioritizedTextureManager::assertInvariants()
+{
+    // If we hit any of these asserts, there is a bug in this class. To see
+    // where the bug is, call this function at the beginning and end of
+    // every public function.
+
+    // Backings/textures must be doubly-linked and only to other backings/textures in this manager.
+    for (BackingSet::iterator it = m_backings.begin(); it != m_backings.end(); ++it) {
+        if ((*it)->currentTexture()) {
+            ASSERT(m_textures.find((*it)->currentTexture()) != m_textures.end());
+            ASSERT((*it)->currentTexture()->currentBacking() == (*it));
+        }
+    }
+    for (TextureSet::iterator it = m_textures.begin(); it != m_textures.end(); ++it) {
+        if ((*it)->currentBacking()) {
+            ASSERT(m_backings.find((*it)->currentBacking()) != m_backings.end());
+            ASSERT((*it)->currentBacking()->currentTexture() == (*it));
+        }
+    }
+
+    // At all times, backings that can be evicted must always come before
+    // backings that can't be evicted in the backing texture list (otherwise
+    // reduceMemory will not find all textures available for eviction/recycling).
+    bool reachedProtected = false;
+    for (BackingSet::iterator it = m_backings.begin(); it != m_backings.end(); ++it) {
+        if ((*it)->currentTexture() && (*it)->currentTexture()->isAbovePriorityCutoff())
+            reachedProtected = true;
+        if (reachedProtected)
+            ASSERT((*it)->currentTexture() && (*it)->currentTexture()->isAbovePriorityCutoff());
+    }
+}
+#endif
+
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.h b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.h
new file mode 100644
index 000000000..3c70b2b2a
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPrioritizedTextureManager.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCPrioritizedTextureManager_h
+#define CCPrioritizedTextureManager_h
+
+#include "CCPrioritizedTexture.h"
+#include "CCPriorityCalculator.h"
+#include "GraphicsContext3D.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "TextureManager.h"
+
+namespace WebCore {
+
+class CCPrioritizedTexture;
+class CCPriorityCalculator;
+
+class CCPrioritizedTextureManager {
+    WTF_MAKE_NONCOPYABLE(CCPrioritizedTextureManager);
+public:
+    static PassOwnPtr<CCPrioritizedTextureManager> create(size_t maxMemoryLimitBytes, int maxTextureSize)
+    {
+        return adoptPtr(new CCPrioritizedTextureManager(maxMemoryLimitBytes, maxTextureSize));
+    }
+    PassOwnPtr<CCPrioritizedTexture> createTexture(IntSize size, GC3Denum format)
+    {
+        return adoptPtr(new CCPrioritizedTexture(this, size, format));
+    }
+    ~CCPrioritizedTextureManager();
+
+    // memoryUseBytes() describes the number of bytes used by existing allocated textures.
+    // memoryAboveCutoffBytes() describes the number of bytes that would be used if all
+    // textures that are above the cutoff were allocated.
+    // memoryUseBytes() <= memoryAboveCutoffBytes() should always be true.
+    size_t memoryUseBytes() const { return m_memoryUseBytes; }
+    size_t memoryAboveCutoffBytes() const { return m_memoryAboveCutoffBytes; }
+    size_t memoryForRenderSurfacesBytes() const { return m_maxMemoryLimitBytes - m_memoryAvailableBytes; }
+
+    void setMaxMemoryLimitBytes(size_t bytes) { m_maxMemoryLimitBytes = bytes; }
+    size_t maxMemoryLimitBytes() const { return m_maxMemoryLimitBytes; }
+
+    void prioritizeTextures(size_t renderSurfacesMemoryBytes);
+    void clearPriorities();
+
+    bool requestLate(CCPrioritizedTexture*);
+
+    void reduceMemory(TextureAllocator*);
+    void clearAllMemory(TextureAllocator*);
+    void allBackingTexturesWereDeleted();
+
+    void acquireBackingTextureIfNeeded(CCPrioritizedTexture*, TextureAllocator*);
+
+    void registerTexture(CCPrioritizedTexture*);
+    void unregisterTexture(CCPrioritizedTexture*);
+    void returnBackingTexture(CCPrioritizedTexture*);
+
+#if !ASSERT_DISABLED
+    void assertInvariants();
+#endif
+
+private:
+    // Compare textures. Highest priority first.
+    static inline bool compareTextures(CCPrioritizedTexture* a, CCPrioritizedTexture* b)
+    {
+        if (a->requestPriority() == b->requestPriority())
+            return a < b;
+        return CCPriorityCalculator::priorityIsHigher(a->requestPriority(), b->requestPriority());
+    }
+    // Compare backings. Lowest priority first.
+    static inline bool compareBackings(CCPrioritizedTexture::Backing* a, CCPrioritizedTexture::Backing* b)
+    {
+        int priorityA = a->currentTexture() ? a->currentTexture()->requestPriority() : CCPriorityCalculator::lowestPriority();
+        int priorityB = b->currentTexture() ? b->currentTexture()->requestPriority() : CCPriorityCalculator::lowestPriority();
+        if (priorityA == priorityB)
+            return a < b;
+        return CCPriorityCalculator::priorityIsLower(priorityA, priorityB);
+    }
+
+    CCPrioritizedTextureManager(size_t maxMemoryLimitBytes, int maxTextureSize);
+
+    void reduceMemory(size_t limit, TextureAllocator*);
+
+    void link(CCPrioritizedTexture*, CCPrioritizedTexture::Backing*);
+    void unlink(CCPrioritizedTexture*, CCPrioritizedTexture::Backing*);
+
+    CCPrioritizedTexture::Backing* createBacking(IntSize, GC3Denum format, TextureAllocator*);
+    void destroyBacking(CCPrioritizedTexture::Backing*, TextureAllocator*);
+
+    size_t m_maxMemoryLimitBytes;
+    unsigned m_priorityCutoff;
+    size_t m_memoryUseBytes;
+    size_t m_memoryAboveCutoffBytes;
+    size_t m_memoryAvailableBytes;
+
+    typedef HashSet<CCPrioritizedTexture*> TextureSet;
+    typedef ListHashSet<CCPrioritizedTexture::Backing*> BackingSet;
+    typedef Vector<CCPrioritizedTexture*> TextureVector;
+    typedef Vector<CCPrioritizedTexture::Backing*> BackingVector;
+
+    TextureSet m_textures;
+    BackingSet m_backings;
+
+    TextureVector m_tempTextureVector;
+    BackingVector m_tempBackingVector;
+};
+
+} // WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.cpp
new file mode 100644
index 000000000..90084043d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2012, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "CCPriorityCalculator.h"
+
+#include "LayerRendererChromium.h"
+
+using namespace std;
+
+namespace WebCore {
+
+// static
+int CCPriorityCalculator::uiPriority(bool drawsToRootSurface)
+{
+    return drawsToRootSurface ? -1 : 2;
+}
+
+// static
+int CCPriorityCalculator::visiblePriority(bool drawsToRootSurface)
+{
+    return drawsToRootSurface ? 0 : 3;
+}
+
+// static
+int CCPriorityCalculator::renderSurfacePriority()
+{
+    return 1;
+}
+
+// static
+int CCPriorityCalculator::lingeringPriority(int previousPriority)
+{
+    // FIXME: We should remove this once we have priorities for all
+    //        textures (we can't currently calculate distances for
+    //        off-screen textures).
+    int lingeringPriority = 1000000;
+    return min(numeric_limits<int>::max() - 1,
+               max(lingeringPriority, previousPriority)) + 1;
+}
+
+namespace {
+unsigned manhattanDistance(const IntRect& a, const IntRect& b)
+{
+    IntRect c = unionRect(a, b);
+    int x = max(0, c.width() - a.width() - b.width() + 1);
+    int y = max(0, c.height() - a.height() - b.height() + 1);
+    return (x + y);
+}
+}
+
+int CCPriorityCalculator::priorityFromDistance(const IntRect& visibleRect, const IntRect& textureRect, bool drawsToRootSurface) const
+{
+    unsigned distance = manhattanDistance(visibleRect, textureRect);
+    if (!distance)
+        return visiblePriority(drawsToRootSurface);
+    return visiblePriority(false) + distance;
+}
+
+int CCPriorityCalculator::priorityFromDistance(unsigned pixels, bool drawsToRootSurface) const
+{
+    if (!pixels)
+        return visiblePriority(drawsToRootSurface);
+    return visiblePriority(false) + pixels;
+}
+
+int CCPriorityCalculator::priorityFromVisibility(bool visible, bool drawsToRootSurface) const
+{
+    return visible ? visiblePriority(drawsToRootSurface) : lowestPriority();
+}
+
+} // WebCore
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.h b/Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.h
new file mode 100644
index 000000000..68a225be0
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPriorityCalculator.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCPriorityCalculator_h
+#define CCPriorityCalculator_h
+
+#include "GraphicsContext3D.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "TextureManager.h"
+
+namespace WebCore {
+
+class CCPriorityCalculator {
+public:
+    static int uiPriority(bool drawsToRootSurface);
+    static int visiblePriority(bool drawsToRootSurface);
+    static int renderSurfacePriority();
+    static int lingeringPriority(int previousPriority);
+    int priorityFromDistance(const IntRect& visibleRect, const IntRect& textureRect, bool drawsToRootSurface) const;
+    int priorityFromDistance(unsigned pixels, bool drawsToRootSurface) const;
+    int priorityFromVisibility(bool visible, bool drawsToRootSurface) const;
+
+    static inline int highestPriority() { return std::numeric_limits<int>::min(); }
+    static inline int lowestPriority() { return std::numeric_limits<int>::max(); }
+    static inline bool priorityIsLower(int a, int b) { return a > b; }
+    static inline bool priorityIsHigher(int a, int b) { return a < b; }
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
index 63b8fb8bf..da8980295 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
@@ -30,6 +30,7 @@
 #include "cc/CCQuadCuller.h"
 
 #include "Region.h"
+#include "SkColor.h"
 #include "cc/CCDebugBorderDrawQuad.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCOverdrawMetrics.h"
@@ -65,7 +66,7 @@ static inline bool appendQuadInternal(PassOwnPtr<CCDrawQuad> passDrawQuad, const
 
     if (keepQuad) {
         if (createDebugBorderQuads && !drawQuad->isDebugQuad() && drawQuad->quadVisibleRect() != drawQuad->quadRect()) {
-            Color borderColor = Color(debugTileBorderColorRed, debugTileBorderColorGreen, debugTileBorderColorBlue, debugTileBorderAlpha);
+            SkColor borderColor = SkColorSetARGB(debugTileBorderAlpha, debugTileBorderColorRed, debugTileBorderColorGreen, debugTileBorderColorBlue);
             quadList.append(CCDebugBorderDrawQuad::create(drawQuad->sharedQuadState(), drawQuad->quadVisibleRect(), borderColor, debugTileBorderWidth));
         }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
index a55feb85c..90a6ee60a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
@@ -27,8 +27,8 @@
 
 #include "cc/CCRenderPass.h"
 
-#include "Color.h"
 #include "cc/CCLayerImpl.h"
+#include "cc/CCMathUtil.h"
 #include "cc/CCQuadCuller.h"
 #include "cc/CCSharedQuadState.h"
 #include "cc/CCSolidColorDrawQuad.h"
@@ -37,17 +37,19 @@ using WebKit::WebTransformationMatrix;
 
 namespace WebCore {
 
-PassOwnPtr<CCRenderPass> CCRenderPass::create(CCRenderSurface* targetSurface)
+PassOwnPtr<CCRenderPass> CCRenderPass::create(CCRenderSurface* targetSurface, int id)
 {
-    return adoptPtr(new CCRenderPass(targetSurface));
+    return adoptPtr(new CCRenderPass(targetSurface, id));
 }
 
-CCRenderPass::CCRenderPass(CCRenderSurface* targetSurface)
-    : m_targetSurface(targetSurface)
+CCRenderPass::CCRenderPass(CCRenderSurface* targetSurface, int id)
+    : m_id(id)
+    , m_targetSurface(targetSurface)
     , m_framebufferOutputRect(targetSurface->contentRect())
     , m_hasTransparentBackground(true)
 {
-    ASSERT(m_targetSurface);
+    ASSERT(targetSurface);
+    ASSERT(id > 0);
 }
 
 void CCRenderPass::appendQuadsForLayer(CCLayerImpl* layer, CCOcclusionTrackerImpl* occlusionTracker, bool& hadMissingTiles)
@@ -83,9 +85,9 @@ void CCRenderPass::appendQuadsForRenderSurfaceLayer(CCLayerImpl* layer, const CC
     m_sharedQuadStateList.append(replicaSharedQuadState.release());
 }
 
-void CCRenderPass::appendQuadsToFillScreen(CCLayerImpl* rootLayer, const Color& screenBackgroundColor, const CCOcclusionTrackerImpl& occlusionTracker)
+void CCRenderPass::appendQuadsToFillScreen(CCLayerImpl* rootLayer, SkColor screenBackgroundColor, const CCOcclusionTrackerImpl& occlusionTracker)
 {
-    if (!rootLayer || !screenBackgroundColor.isValid())
+    if (!rootLayer || !screenBackgroundColor)
         return;
 
     Region fillRegion = occlusionTracker.computeVisibleRegionInScreen();
@@ -96,7 +98,8 @@ void CCRenderPass::appendQuadsToFillScreen(CCLayerImpl* rootLayer, const Color&
     WebTransformationMatrix transformToLayerSpace = rootLayer->screenSpaceTransform().inverse();
     Vector<IntRect> fillRects = fillRegion.rects();
     for (size_t i = 0; i < fillRects.size(); ++i) {
-        IntRect layerRect = transformToLayerSpace.mapRect(fillRects[i]);
+        // The root layer transform is composed of translations and scales only, no perspective, so mapping is sufficient.
+        IntRect layerRect = CCMathUtil::mapClippedRect(transformToLayerSpace, fillRects[i]);
         m_quadList.append(CCSolidColorDrawQuad::create(sharedQuadState.get(), layerRect, screenBackgroundColor));
     }
     m_sharedQuadStateList.append(sharedQuadState.release());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
index 6ce35fe8a..47ae2f747 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
@@ -26,6 +26,7 @@
 #ifndef CCRenderPass_h
 #define CCRenderPass_h
 
+#include "SkColor.h"
 #include "cc/CCOcclusionTracker.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
@@ -36,7 +37,6 @@ class CCDrawQuad;
 class CCLayerImpl;
 class CCRenderSurface;
 class CCSharedQuadState;
-class Color;
 
 // A list of CCDrawQuad objects, sorted internally in front-to-back order.
 class CCQuadList : public Vector<OwnPtr<CCDrawQuad> > {
@@ -53,14 +53,17 @@ public:
 class CCRenderPass {
     WTF_MAKE_NONCOPYABLE(CCRenderPass);
 public:
-    static PassOwnPtr<CCRenderPass> create(CCRenderSurface*);
+    static PassOwnPtr<CCRenderPass> create(CCRenderSurface*, int id);
 
     void appendQuadsForLayer(CCLayerImpl*, CCOcclusionTrackerImpl*, bool& hadMissingTiles);
     void appendQuadsForRenderSurfaceLayer(CCLayerImpl*, const CCRenderPass* contributingRenderPass, CCOcclusionTrackerImpl*);
-    void appendQuadsToFillScreen(CCLayerImpl* rootLayer, const Color& screenBackgroundColor, const CCOcclusionTrackerImpl&);
+    void appendQuadsToFillScreen(CCLayerImpl* rootLayer, SkColor screenBackgroundColor, const CCOcclusionTrackerImpl&);
 
     const CCQuadList& quadList() const { return m_quadList; }
+
+    int id() const { return m_id; }
     CCRenderSurface* targetSurface() const { return m_targetSurface; }
+
     // This denotes the bounds in physical pixels of the output generated by this RenderPass.
     const IntRect& framebufferOutputRect() const { return m_framebufferOutputRect; }
 
@@ -68,8 +71,9 @@ public:
     void setHasTransparentBackground(bool transparent) { m_hasTransparentBackground = transparent; }
 
 protected:
-    explicit CCRenderPass(CCRenderSurface*);
+    CCRenderPass(CCRenderSurface*, int id);
 
+    int m_id;
     CCRenderSurface* m_targetSurface;
     CCQuadList m_quadList;
     IntRect m_framebufferOutputRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp
index 8dc4ff66a..75bd761d1 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.cpp
@@ -27,20 +27,24 @@
 
 #include "cc/CCRenderPassDrawQuad.h"
 
+#include "cc/CCRenderPass.h"
+
 namespace WebCore {
 
-PassOwnPtr<CCRenderPassDrawQuad> CCRenderPassDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCRenderPass* renderPass, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId)
+PassOwnPtr<CCRenderPassDrawQuad> CCRenderPassDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCRenderPass* renderPass, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId, const IntRect& contentsChangedSinceLastFrame)
 {
-    return adoptPtr(new CCRenderPassDrawQuad(sharedQuadState, quadRect, renderPass, isReplica, filters, backgroundFilters, maskTextureId));
+    return adoptPtr(new CCRenderPassDrawQuad(sharedQuadState, quadRect, renderPass, isReplica, filters, backgroundFilters, maskTextureId, contentsChangedSinceLastFrame));
 }
 
-CCRenderPassDrawQuad::CCRenderPassDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCRenderPass* renderPass, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId)
+CCRenderPassDrawQuad::CCRenderPassDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const CCRenderPass* renderPass, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId, const IntRect& contentsChangedSinceLastFrame)
     : CCDrawQuad(sharedQuadState, CCDrawQuad::RenderPass, quadRect)
     , m_renderPass(renderPass)
+    , m_renderPassId(renderPass->id())
     , m_isReplica(isReplica)
     , m_filters(filters)
     , m_backgroundFilters(backgroundFilters)
     , m_maskTextureId(maskTextureId)
+    , m_contentsChangedSinceLastFrame(contentsChangedSinceLastFrame)
 {
     ASSERT(m_renderPass);
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h
index 3cc6f2607..b63a76446 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPassDrawQuad.h
@@ -37,23 +37,27 @@ class CCRenderPass;
 class CCRenderPassDrawQuad : public CCDrawQuad {
     WTF_MAKE_NONCOPYABLE(CCRenderPassDrawQuad);
 public:
-    static PassOwnPtr<CCRenderPassDrawQuad> create(const CCSharedQuadState*, const IntRect&, const CCRenderPass*, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId);
+    static PassOwnPtr<CCRenderPassDrawQuad> create(const CCSharedQuadState*, const IntRect&, const CCRenderPass*, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId, const IntRect& contentsChangedSinceLastFrame);
 
     const CCRenderPass* renderPass() const { return m_renderPass; }
+    int renderPassId() const { return m_renderPassId; }
     bool isReplica() const { return m_isReplica; }
     unsigned maskTextureId() const { return m_maskTextureId; }
+    const IntRect& contentsChangedSinceLastFrame() const { return m_contentsChangedSinceLastFrame; }
 
     const WebKit::WebFilterOperations& filters() const { return m_filters; }
     const WebKit::WebFilterOperations& backgroundFilters() const { return m_backgroundFilters; }
 
 private:
-    CCRenderPassDrawQuad(const CCSharedQuadState*, const IntRect&, const CCRenderPass*, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId);
+    CCRenderPassDrawQuad(const CCSharedQuadState*, const IntRect&, const CCRenderPass*, bool isReplica, const WebKit::WebFilterOperations& filters, const WebKit::WebFilterOperations& backgroundFilters, unsigned maskTextureId, const IntRect& contentsChangedSinceLastFrame);
 
     const CCRenderPass* m_renderPass;
+    int m_renderPassId;
     bool m_isReplica;
     WebKit::WebFilterOperations m_filters;
     WebKit::WebFilterOperations m_backgroundFilters;
     unsigned m_maskTextureId;
+    IntRect m_contentsChangedSinceLastFrame;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
index 1cdad22e4..d3a85d2da 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
@@ -31,7 +31,6 @@
 
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
-#include "ManagedTexture.h"
 #include "TextStream.h"
 #include "cc/CCDamageTracker.h"
 #include "cc/CCDebugBorderDrawQuad.h"
@@ -78,82 +77,13 @@ FloatRect CCRenderSurface::drawableContentRect() const
 {
     FloatRect localContentRect(-0.5 * m_contentRect.width(), -0.5 * m_contentRect.height(),
                                m_contentRect.width(), m_contentRect.height());
-    FloatRect drawableContentRect = m_drawTransform.mapRect(localContentRect);
+    FloatRect drawableContentRect = CCMathUtil::mapClippedRect(m_drawTransform, localContentRect);
     if (hasReplica())
-        drawableContentRect.unite(m_replicaDrawTransform.mapRect(localContentRect));
+        drawableContentRect.unite(CCMathUtil::mapClippedRect(m_replicaDrawTransform, localContentRect));
 
     return drawableContentRect;
 }
 
-bool CCRenderSurface::prepareContentsTexture(LayerRendererChromium* layerRenderer)
-{
-    // FIXME: This method should be separated into two: one to reserve an
-    // existing surface, and one to create a new one. That way we will not
-    // need to pass null layerRenderer.
-    if (layerRenderer) {
-        TextureManager* textureManager = layerRenderer->implTextureManager();
-
-        if (!m_contentsTexture)
-            m_contentsTexture = ManagedTexture::create(textureManager);
-    }
-
-    if (!m_contentsTexture)
-        return false;
-
-    if (m_contentsTexture->isReserved())
-        return true;
-
-    if (!m_contentsTexture->reserve(m_contentRect.size(), GraphicsContext3D::RGBA))
-        return false;
-
-    return true;
-}
-
-void CCRenderSurface::releaseContentsTexture()
-{
-    if (!m_contentsTexture || !m_contentsTexture->isReserved())
-        return;
-    m_contentsTexture->unreserve();
-}
-
-bool CCRenderSurface::hasValidContentsTexture() const
-{
-    return m_contentsTexture && m_contentsTexture->isReserved() && m_contentsTexture->isValid(m_contentRect.size(), GraphicsContext3D::RGBA);
-}
-
-bool CCRenderSurface::hasCachedContentsTexture() const
-{
-    return m_contentsTexture && m_contentsTexture->isValid(m_contentRect.size(), GraphicsContext3D::RGBA);
-}
-
-bool CCRenderSurface::prepareBackgroundTexture(LayerRendererChromium* layerRenderer)
-{
-    TextureManager* textureManager = layerRenderer->implTextureManager();
-
-    if (!m_backgroundTexture)
-        m_backgroundTexture = ManagedTexture::create(textureManager);
-
-    if (m_backgroundTexture->isReserved())
-        return true;
-
-    if (!m_backgroundTexture->reserve(m_contentRect.size(), GraphicsContext3D::RGBA))
-        return false;
-
-    return true;
-}
-
-void CCRenderSurface::releaseBackgroundTexture()
-{
-    if (!m_backgroundTexture || !m_backgroundTexture->isReserved())
-        return;
-    m_backgroundTexture->unreserve();
-}
-
-bool CCRenderSurface::hasValidBackgroundTexture() const
-{
-    return m_backgroundTexture && m_backgroundTexture->isReserved() && m_backgroundTexture->isValid(m_contentRect.size(), GraphicsContext3D::RGBA);
-}
-
 String CCRenderSurface::name() const
 {
     return String::format("RenderSurface(id=%i,owner=%s)", m_owningLayer->id(), m_owningLayer->debugName().utf8().data());
@@ -281,7 +211,7 @@ void CCRenderSurface::appendQuads(CCQuadCuller& quadList, CCSharedQuadState* sha
         int red = forReplica ? debugReplicaBorderColorRed : debugSurfaceBorderColorRed;
         int green = forReplica ?  debugReplicaBorderColorGreen : debugSurfaceBorderColorGreen;
         int blue = forReplica ? debugReplicaBorderColorBlue : debugSurfaceBorderColorBlue;
-        Color color(red, green, blue, debugSurfaceBorderAlpha);
+        SkColor color = SkColorSetARGB(debugSurfaceBorderAlpha, red, green, blue);
         quadList.appendSurface(CCDebugBorderDrawQuad::create(sharedQuadState, contentRect(), color, debugSurfaceBorderWidth));
     }
 
@@ -302,8 +232,9 @@ void CCRenderSurface::appendQuads(CCQuadCuller& quadList, CCSharedQuadState* sha
     }
 
     int maskTextureId = maskLayer ? maskLayer->contentsTextureId() : 0;
+    IntRect contentsChangedSinceLastFrame = contentsChanged() ? m_contentRect : IntRect();
 
-    quadList.appendSurface(CCRenderPassDrawQuad::create(sharedQuadState, contentRect(), renderPass, forReplica, filters(), backgroundFilters(), maskTextureId));
+    quadList.appendSurface(CCRenderPassDrawQuad::create(sharedQuadState, contentRect(), renderPass, forReplica, filters(), backgroundFilters(), maskTextureId, contentsChangedSinceLastFrame));
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index cdd7a7b59..894ea5aea 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -31,10 +31,10 @@
 
 #include "FloatRect.h"
 #include "IntRect.h"
-#include "TextureManager.h"
 #include <public/WebFilterOperations.h>
 #include <public/WebTransformationMatrix.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -44,7 +44,7 @@ class CCRenderPass;
 class CCSharedQuadState;
 class CCLayerImpl;
 class LayerRendererChromium;
-class ManagedTexture;
+class TextStream;
 
 class CCRenderSurface {
     WTF_MAKE_NONCOPYABLE(CCRenderSurface);
@@ -52,15 +52,6 @@ public:
     explicit CCRenderSurface(CCLayerImpl*);
     virtual ~CCRenderSurface();
 
-    virtual bool prepareContentsTexture(LayerRendererChromium*);
-    void releaseContentsTexture();
-    bool hasValidContentsTexture() const;
-    virtual bool hasCachedContentsTexture() const;
-
-    bool prepareBackgroundTexture(LayerRendererChromium*);
-    void releaseBackgroundTexture();
-    bool hasValidBackgroundTexture() const;
-
     String name() const;
     void dumpSurface(TextStream&, int indent) const;
 
@@ -114,7 +105,7 @@ public:
     void setScissorRect(const IntRect& scissorRect) { m_scissorRect = scissorRect; }
     const IntRect& scissorRect() const { return m_scissorRect; }
 
-    virtual bool contentsChanged() const;
+    bool contentsChanged() const;
 
     void setContentRect(const IntRect&);
     const IntRect& contentRect() const { return m_contentRect; }
@@ -122,9 +113,6 @@ public:
     void clearLayerList() { m_layerList.clear(); }
     Vector<CCLayerImpl*>& layerList() { return m_layerList; }
 
-    ManagedTexture* contentsTexture() const { return m_contentsTexture.get(); }
-    ManagedTexture* backgroundTexture() const { return m_backgroundTexture.get(); }
-
     int owningLayerId() const;
     CCRenderSurface* targetRenderSurface() const;
 
@@ -153,9 +141,6 @@ private:
     IntRect m_contentRect;
     bool m_surfacePropertyChanged;
 
-    OwnPtr<ManagedTexture> m_contentsTexture;
-    OwnPtr<ManagedTexture> m_backgroundTexture;
-
     float m_drawOpacity;
     bool m_drawOpacityIsAnimating;
     WebKit::WebTransformationMatrix m_drawTransform;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
index 30e4bff9b..2f031bf21 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurfaceFilters.cpp
@@ -29,8 +29,8 @@
 
 #include "cc/CCRenderSurfaceFilters.h"
 
+#include "FloatSize.h"
 #include "GraphicsContext3D.h"
-#include "LengthFunctions.h"
 #include "SkBlurImageFilter.h"
 #include "SkCanvas.h"
 #include "SkColorMatrixFilter.h"
@@ -38,6 +38,7 @@
 #include "SkGrTexturePixelRef.h"
 #include <public/WebFilterOperation.h>
 #include <public/WebFilterOperations.h>
+#include <wtf/MathExtras.h>
 
 namespace {
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
index abad02bb7..ded0efdc3 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderer.h
@@ -35,6 +35,7 @@
 
 namespace WebCore {
 
+class CCScopedTexture;
 class TextureAllocator;
 class TextureCopier;
 class TextureManager;
@@ -72,11 +73,13 @@ public:
     const WebKit::WebTransformationMatrix& windowMatrix() const { return m_windowMatrix; }
 
     virtual void decideRenderPassAllocationsForFrame(const CCRenderPassList&) = 0;
+    virtual bool haveCachedResourcesForRenderPassId(int) const = 0;
+
     virtual void beginDrawingFrame(const CCRenderPass* defaultRenderPass) = 0;
     virtual void drawRenderPass(const CCRenderPass*, const FloatRect& rootScissorRectInCurrentPass) = 0;
     virtual void finishDrawingFrame() = 0;
 
-    virtual void drawHeadsUpDisplay(ManagedTexture*, const IntSize& hudSize) = 0;
+    virtual void drawHeadsUpDisplay(const CCScopedTexture*, const IntSize& hudSize) = 0;
 
     // waits for rendering to finish
     virtual void finish() = 0;
@@ -87,7 +90,6 @@ public:
 
     virtual void getFramebufferPixels(void *pixels, const IntRect&) = 0;
 
-    virtual TextureManager* implTextureManager() const = 0;
     virtual TextureCopier* textureCopier() const = 0;
     virtual TextureUploader* textureUploader() const = 0;
     virtual TextureAllocator* implTextureAllocator() const = 0;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
index d8355bd36..6f865c9cd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
@@ -159,6 +159,7 @@ void CCScheduler::processScheduledActions()
     do {
         action = nextAction();
         m_stateMachine.updateState(action);
+        TRACE_EVENT1("cc", "CCScheduler::processScheduledActions()", "action", action);
 
         switch (action) {
         case CCSchedulerStateMachine::ACTION_NONE:
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScopedTexture.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScopedTexture.cpp
new file mode 100644
index 000000000..80f831541
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScopedTexture.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCScopedTexture.h"
+
+#include "TextureManager.h" // For TextureAllocator
+
+namespace WebCore {
+
+CCScopedTexture::CCScopedTexture(TextureAllocator* allocator)
+    : m_allocator(allocator)
+{
+    ASSERT(m_allocator);
+}
+
+CCScopedTexture::~CCScopedTexture()
+{
+    free();
+}
+
+bool CCScopedTexture::allocate(const IntSize& size, GC3Denum format)
+{
+    ASSERT(!id());
+    ASSERT(!size.isEmpty());
+
+    setDimensions(size, format);
+    setId(m_allocator->createTexture(size, format));
+
+#if !ASSERT_DISABLED
+    m_allocateThreadIdentifier = WTF::currentThread();
+#endif
+
+    return id();
+}
+
+void CCScopedTexture::free()
+{
+    if (id()) {
+        ASSERT(m_allocateThreadIdentifier == WTF::currentThread());
+        m_allocator->deleteTexture(id(), size(), format());
+    }
+    setId(0);
+}
+
+void CCScopedTexture::leak()
+{
+    setId(0);
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScopedTexture.h b/Source/WebCore/platform/graphics/chromium/cc/CCScopedTexture.h
new file mode 100644
index 000000000..5a3c4e964
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScopedTexture.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCScopedTexture_h
+#define CCScopedTexture_h
+
+#include "cc/CCTexture.h"
+
+#if !ASSERT_DISABLED
+#include <wtf/MainThread.h>
+#endif
+
+namespace WebCore {
+
+class TextureAllocator;
+
+class CCScopedTexture : protected CCTexture {
+    WTF_MAKE_NONCOPYABLE(CCScopedTexture);
+public:
+    static PassOwnPtr<CCScopedTexture> create(TextureAllocator* allocator) { return adoptPtr(new CCScopedTexture(allocator)); }
+    virtual ~CCScopedTexture();
+
+    using CCTexture::id;
+    using CCTexture::size;
+    using CCTexture::format;
+    using CCTexture::bytes;
+
+    bool allocate(const IntSize&, GC3Denum format);
+    void free();
+    void leak();
+
+protected:
+    explicit CCScopedTexture(TextureAllocator*);
+
+private:
+    TextureAllocator* m_allocator;
+
+#if !ASSERT_DISABLED
+    ThreadIdentifier m_allocateThreadIdentifier;
+#endif
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
index a22ef5d26..f38fbda01 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
@@ -45,11 +45,23 @@ CCScrollbarLayerImpl::CCScrollbarLayerImpl(int id)
     : CCLayerImpl(id)
     , m_scrollLayer(0)
     , m_scrollbar(this)
-    , m_backgroundTextureId(0)
+    , m_backTrackTextureId(0)
+    , m_foreTrackTextureId(0)
     , m_thumbTextureId(0)
 {
 }
 
+namespace {
+
+FloatRect toUVRect(const IntRect& r, const IntRect& bounds)
+{
+    ASSERT(bounds.contains(r));
+    return FloatRect(static_cast<float>(r.x()) / bounds.width(), static_cast<float>(r.y()) / bounds.height(),
+                     static_cast<float>(r.width()) / bounds.width(), static_cast<float>(r.height()) / bounds.height());
+}
+
+}
+
 void CCScrollbarLayerImpl::appendQuads(CCQuadCuller& quadList, const CCSharedQuadState* sharedQuadState, bool&)
 {
     ScrollbarThemeComposite* theme = static_cast<ScrollbarThemeComposite*>(ScrollbarTheme::theme());
@@ -57,24 +69,33 @@ void CCScrollbarLayerImpl::appendQuads(CCQuadCuller& quadList, const CCSharedQua
         return;
 
     bool premultipledAlpha = false;
-    FloatRect uvRect(0, 0, 1, 1);
     bool flipped = false;
+    FloatRect uvRect(0, 0, 1, 1);
+    IntRect boundsRect(IntPoint(), contentBounds());
+
+    IntRect thumbRect, backTrackRect, foreTrackRect;
+    theme->splitTrack(&m_scrollbar, theme->trackRect(&m_scrollbar), backTrackRect, thumbRect, foreTrackRect);
 
-    IntRect thumbRect = theme->thumbRect(&m_scrollbar);
-    thumbRect.move(-m_scrollbar.x(), -m_scrollbar.y());
     if (m_thumbTextureId && theme->hasThumb(&m_scrollbar) && !thumbRect.isEmpty()) {
         OwnPtr<CCTextureDrawQuad> quad = CCTextureDrawQuad::create(sharedQuadState, thumbRect, m_thumbTextureId, premultipledAlpha, uvRect, flipped);
         quad->setNeedsBlending();
         quadList.append(quad.release());
     }
 
-    if (!m_backgroundTextureId)
+    if (!m_backTrackTextureId)
         return;
 
-    IntRect backgroundRect(IntPoint(), contentBounds());
-    quadList.append(CCTextureDrawQuad::create(sharedQuadState, backgroundRect, m_backgroundTextureId, premultipledAlpha, uvRect, flipped));
+    // We only paint the track in two parts if we were given a texture for the forward track part.
+    if (m_foreTrackTextureId && !foreTrackRect.isEmpty())
+        quadList.append(CCTextureDrawQuad::create(sharedQuadState, foreTrackRect, m_foreTrackTextureId, premultipledAlpha, toUVRect(foreTrackRect, boundsRect), flipped));
+
+    // Order matters here: since the back track texture is being drawn to the entire contents rect, we must append it after the thumb and
+    // fore track quads. The back track texture contains (and displays) the buttons.
+    if (!boundsRect.isEmpty())
+        quadList.append(CCTextureDrawQuad::create(sharedQuadState, boundsRect, m_backTrackTextureId, premultipledAlpha, uvRect, flipped));
 }
 
+
 int CCScrollbarLayerImpl::CCScrollbar::x() const
 {
     return frameRect().x();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
index 98d553446..ece2b9571 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
@@ -33,7 +33,6 @@
 
 namespace WebCore {
 
-class GraphicsContext;
 class ScrollView;
 
 class CCScrollbarLayerImpl : public CCLayerImpl {
@@ -54,7 +53,8 @@ public:
 
     void setEnabled(bool enabled) { m_enabled = enabled; }
 
-    void setBackgroundTextureId(unsigned id) { m_backgroundTextureId = id; }
+    void setBackTrackTextureId(unsigned id) { m_backTrackTextureId = id; }
+    void setForeTrackTextureId(unsigned id) { m_foreTrackTextureId = id; }
     void setThumbTextureId(unsigned id) { m_thumbTextureId = id; }
 
     CCLayerImpl* scrollLayer() const { return m_scrollLayer; }
@@ -124,7 +124,8 @@ private:
     };
     CCScrollbar m_scrollbar;
 
-    unsigned m_backgroundTextureId;
+    unsigned m_backTrackTextureId;
+    unsigned m_foreTrackTextureId;
     unsigned m_thumbTextureId;
 
     ScrollbarOverlayStyle m_scrollbarOverlayStyle;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp
index 536b39867..5e0681ff5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSharedQuadState.cpp
@@ -27,6 +27,8 @@
 
 #include "cc/CCSharedQuadState.h"
 
+#include "cc/CCMathUtil.h"
+
 using WebKit::WebTransformationMatrix;
 
 namespace WebCore {
@@ -50,8 +52,9 @@ bool CCSharedQuadState::isLayerAxisAlignedIntRect() const
 {
     // Note: this doesn't consider window or projection matrices.
     // Assume that they're orthonormal and have integer scales and translations.
-    FloatQuad quad = quadTransform().mapQuad(FloatQuad(layerRect()));
-    return quad.isRectilinear() && quad.boundingBox().isExpressibleAsIntRect();
+    bool clipped = false;
+    FloatQuad quad = CCMathUtil::mapQuad(quadTransform(), FloatQuad(layerRect()), clipped);
+    return !clipped && quad.isRectilinear() && quad.boundingBox().isExpressibleAsIntRect();
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index d69e4bc45..678efdff0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -52,7 +52,7 @@ CCSingleThreadProxy::CCSingleThreadProxy(CCLayerTreeHost* layerTreeHost)
     , m_layerRendererInitialized(false)
     , m_nextFrameIsNewlyCommittedFrame(false)
 {
-    TRACE_EVENT("CCSingleThreadProxy::CCSingleThreadProxy", this, 0);
+    TRACE_EVENT0("cc", "CCSingleThreadProxy::CCSingleThreadProxy");
     ASSERT(CCProxy::isMainThread());
 }
 
@@ -64,14 +64,14 @@ void CCSingleThreadProxy::start()
 
 CCSingleThreadProxy::~CCSingleThreadProxy()
 {
-    TRACE_EVENT("CCSingleThreadProxy::~CCSingleThreadProxy", this, 0);
+    TRACE_EVENT0("cc", "CCSingleThreadProxy::~CCSingleThreadProxy");
     ASSERT(CCProxy::isMainThread());
     ASSERT(!m_layerTreeHostImpl && !m_layerTreeHost); // make sure stop() got called.
 }
 
 bool CCSingleThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect)
 {
-    TRACE_EVENT("CCSingleThreadProxy::compositeAndReadback", this, 0);
+    TRACE_EVENT0("cc", "CCSingleThreadProxy::compositeAndReadback");
     ASSERT(CCProxy::isMainThread());
 
     if (!commitAndComposite())
@@ -255,7 +255,7 @@ void CCSingleThreadProxy::didAddAnimation()
 
 void CCSingleThreadProxy::stop()
 {
-    TRACE_EVENT("CCSingleThreadProxy::stop", this, 0);
+    TRACE_EVENT0("cc", "CCSingleThreadProxy::stop");
     ASSERT(CCProxy::isMainThread());
     {
         DebugScopedSetMainThreadBlocked mainThreadBlocked;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp
index 7f6f98113..8668369b6 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.cpp
@@ -29,16 +29,16 @@
 
 namespace WebCore {
 
-PassOwnPtr<CCSolidColorDrawQuad> CCSolidColorDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const Color& color)
+PassOwnPtr<CCSolidColorDrawQuad> CCSolidColorDrawQuad::create(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color)
 {
     return adoptPtr(new CCSolidColorDrawQuad(sharedQuadState, quadRect, color));
 }
 
-CCSolidColorDrawQuad::CCSolidColorDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, const Color& color)
+CCSolidColorDrawQuad::CCSolidColorDrawQuad(const CCSharedQuadState* sharedQuadState, const IntRect& quadRect, SkColor color)
     : CCDrawQuad(sharedQuadState, CCDrawQuad::SolidColor, quadRect)
     , m_color(color)
 {
-    if (m_color.hasAlpha())
+    if (SkColorGetA(m_color) < 255)
         m_quadOpaque = false;
     else
         m_opaqueRect = quadRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h
index d020df684..83ea34066 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorDrawQuad.h
@@ -26,7 +26,7 @@
 #ifndef CCSolidColorDrawQuad_h
 #define CCSolidColorDrawQuad_h
 
-#include "Color.h"
+#include "SkColor.h"
 #include "cc/CCDrawQuad.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -35,14 +35,14 @@ namespace WebCore {
 class CCSolidColorDrawQuad : public CCDrawQuad {
     WTF_MAKE_NONCOPYABLE(CCSolidColorDrawQuad);
 public:
-    static PassOwnPtr<CCSolidColorDrawQuad> create(const CCSharedQuadState*, const IntRect&, const Color&);
+    static PassOwnPtr<CCSolidColorDrawQuad> create(const CCSharedQuadState*, const IntRect&, SkColor);
 
-    const Color& color() const { return m_color; };
+    SkColor color() const { return m_color; };
 
 private:
-    CCSolidColorDrawQuad(const CCSharedQuadState*, const IntRect&, const Color&);
+    CCSolidColorDrawQuad(const CCSharedQuadState*, const IntRect&, SkColor);
 
-    Color m_color;
+    SkColor m_color;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTexture.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTexture.cpp
new file mode 100644
index 000000000..a48e2d0f9
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTexture.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCTexture.h"
+
+namespace WebCore {
+
+void CCTexture::setDimensions(const IntSize& size, GC3Denum format)
+{
+    m_size = size;
+    m_format = format;
+}
+
+size_t CCTexture::bytes() const
+{
+    if (m_size.isEmpty())
+        return 0u;
+
+    return memorySizeBytes(m_size, m_format);
+}
+
+size_t CCTexture::memorySizeBytes(const IntSize& size, GC3Denum format)
+{
+    unsigned int componentsPerPixel;
+    unsigned int bytesPerComponent;
+    if (!GraphicsContext3D::computeFormatAndTypeParameters(format, GraphicsContext3D::UNSIGNED_BYTE, &componentsPerPixel, &bytesPerComponent)) {
+        ASSERT_NOT_REACHED();
+        return 0u;
+    }
+    return componentsPerPixel * bytesPerComponent * size.width() * size.height();
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTexture.h b/Source/WebCore/platform/graphics/chromium/cc/CCTexture.h
new file mode 100644
index 000000000..a29610469
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTexture.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCTexture_h
+#define CCTexture_h
+
+#include "GraphicsContext3D.h"
+#include "IntSize.h"
+#include "cc/CCTexture.h"
+
+namespace WebCore {
+
+class CCTexture {
+public:
+    CCTexture() : m_id(0) { }
+
+    unsigned id() const { return m_id; }
+    const IntSize& size() const { return m_size; }
+    GC3Denum format() const { return m_format; }
+
+    void setId(unsigned id) { m_id = id; }
+    void setDimensions(const IntSize&, GC3Denum format);
+
+    size_t bytes() const;
+
+    static size_t memorySizeBytes(const IntSize&, GC3Denum format);
+
+private:
+    unsigned m_id;
+    IntSize m_size;
+    GC3Denum m_format;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
index c3299939b..3190d82ff 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
@@ -29,6 +29,7 @@
 
 #include "cc/CCTextureUpdater.h"
 
+#include "CCPrioritizedTexture.h"
 #include "GraphicsContext3D.h"
 #include "LayerTextureUpdater.h"
 #include "TextureCopier.h"
@@ -58,9 +59,9 @@ void CCTextureUpdater::appendUpdate(LayerTextureUpdater::Texture* texture, const
     entries.append(entry);
 }
 
-void CCTextureUpdater::appendUpdate(LayerTextureUpdater::Texture* texture, const IntRect& sourceRect, const IntRect& destRect)
+void CCTextureUpdater::appendFullUpdate(LayerTextureUpdater::Texture* texture, const IntRect& sourceRect, const IntRect& destRect)
 {
-    appendUpdate(texture, sourceRect, destRect, m_entries);
+    appendUpdate(texture, sourceRect, destRect, m_fullEntries);
 }
 
 void CCTextureUpdater::appendPartialUpdate(LayerTextureUpdater::Texture* texture, const IntRect& sourceRect, const IntRect& destRect)
@@ -79,26 +80,26 @@ void CCTextureUpdater::appendCopy(unsigned sourceTexture, unsigned destTexture,
 
 bool CCTextureUpdater::hasMoreUpdates() const
 {
-    return m_entries.size() || m_partialEntries.size() || m_copyEntries.size();
+    return m_fullEntries.size() || m_partialEntries.size() || m_copyEntries.size();
 }
 
 void CCTextureUpdater::update(CCGraphicsContext* context, TextureAllocator* allocator, TextureCopier* copier, TextureUploader* uploader, size_t count)
 {
     size_t index;
 
-    if (m_entries.size() || m_partialEntries.size()) {
+    if (m_fullEntries.size() || m_partialEntries.size()) {
         if (uploader->isBusy())
             return;
 
         uploader->beginUploads();
 
-        size_t maxIndex = min(m_entryIndex + count, m_entries.size());
+        size_t maxIndex = min(m_entryIndex + count, m_fullEntries.size());
         for (index = m_entryIndex; index < maxIndex; ++index) {
-            UpdateEntry& entry = m_entries[index];
+            UpdateEntry& entry = m_fullEntries[index];
             uploader->uploadTexture(context, entry.texture, allocator, entry.sourceRect, entry.destRect);
         }
 
-        bool moreUploads = maxIndex < m_entries.size();
+        bool moreUploads = maxIndex < m_fullEntries.size();
 
         ASSERT(m_partialEntries.size() <= count);
         // We need another update batch if the number of updates remaining
@@ -142,7 +143,7 @@ void CCTextureUpdater::update(CCGraphicsContext* context, TextureAllocator* allo
 void CCTextureUpdater::clear()
 {
     m_entryIndex = 0;
-    m_entries.clear();
+    m_fullEntries.clear();
     m_partialEntries.clear();
     m_copyEntries.clear();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h
index 0f139f385..8a437942b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.h
@@ -41,7 +41,7 @@ public:
     CCTextureUpdater();
     ~CCTextureUpdater();
 
-    void appendUpdate(LayerTextureUpdater::Texture*, const IntRect& sourceRect, const IntRect& destRect);
+    void appendFullUpdate(LayerTextureUpdater::Texture*, const IntRect& sourceRect, const IntRect& destRect);
     void appendPartialUpdate(LayerTextureUpdater::Texture*, const IntRect& sourceRect, const IntRect& destRect);
     void appendCopy(unsigned sourceTexture, unsigned destTexture, const IntSize&);
 
@@ -68,7 +68,7 @@ private:
     static void appendUpdate(LayerTextureUpdater::Texture*, const IntRect& sourceRect, const IntRect& destRect, Vector<UpdateEntry>&);
 
     size_t m_entryIndex;
-    Vector<UpdateEntry> m_entries;
+    Vector<UpdateEntry> m_fullEntries;
     Vector<UpdateEntry> m_partialEntries;
     Vector<CopyEntry> m_copyEntries;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 382274746..9973a974b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -89,25 +89,25 @@ CCThreadProxy::CCThreadProxy(CCLayerTreeHost* layerTreeHost)
     , m_textureAcquisitionCompletionEventOnImplThread(0)
     , m_nextFrameIsNewlyCommittedFrameOnImplThread(false)
 {
-    TRACE_EVENT("CCThreadProxy::CCThreadProxy", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::CCThreadProxy");
     ASSERT(isMainThread());
 }
 
 CCThreadProxy::~CCThreadProxy()
 {
-    TRACE_EVENT("CCThreadProxy::~CCThreadProxy", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::~CCThreadProxy");
     ASSERT(isMainThread());
     ASSERT(!m_started);
 }
 
 bool CCThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect)
 {
-    TRACE_EVENT("CCThreadPRoxy::compositeAndReadback", this, 0);
+    TRACE_EVENT0("cc", "CCThreadPRoxy::compositeAndReadback");
     ASSERT(isMainThread());
     ASSERT(m_layerTreeHost);
 
     if (!m_layerTreeHost->initializeLayerRendererIfNeeded()) {
-        TRACE_EVENT("compositeAndReadback_EarlyOut_LR_Uninitialized", this, 0);
+        TRACE_EVENT0("cc", "compositeAndReadback_EarlyOut_LR_Uninitialized");
         return false;
     }
 
@@ -175,7 +175,7 @@ bool CCThreadProxy::isStarted() const
 
 bool CCThreadProxy::initializeContext()
 {
-    TRACE_EVENT("CCThreadProxy::initializeContext", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::initializeContext");
     OwnPtr<CCGraphicsContext> context = m_layerTreeHost->createContext();
     if (!context)
         return false;
@@ -215,7 +215,7 @@ void CCThreadProxy::setVisibleOnImplThread(CCCompletionEvent* completion, bool v
 
 bool CCThreadProxy::initializeLayerRenderer()
 {
-    TRACE_EVENT("CCThreadProxy::initializeLayerRenderer", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::initializeLayerRenderer");
     // Make a blocking call to initializeLayerRendererOnImplThread. The results of that call
     // are pushed into the initializeSucceeded and capabilities local variables.
     CCCompletionEvent completion;
@@ -299,7 +299,7 @@ void CCThreadProxy::setNeedsAnimate()
     if (m_animateRequested)
         return;
 
-    TRACE_EVENT("CCThreadProxy::setNeedsAnimate", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::setNeedsAnimate");
     m_animateRequested = true;
     setNeedsCommit();
 }
@@ -310,7 +310,7 @@ void CCThreadProxy::setNeedsCommit()
     if (m_commitRequested)
         return;
 
-    TRACE_EVENT("CCThreadProxy::setNeedsCommit", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::setNeedsCommit");
     m_commitRequested = true;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsCommitOnImplThread));
 }
@@ -325,7 +325,7 @@ void CCThreadProxy::didLoseContextOnImplThread()
 void CCThreadProxy::onSwapBuffersCompleteOnImplThread()
 {
     ASSERT(isImplThread());
-    TRACE_EVENT("CCThreadProxy::onSwapBuffersCompleteOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::onSwapBuffersCompleteOnImplThread");
     m_schedulerOnImplThread->didSwapBuffersComplete();
     m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::didCompleteSwapBuffers));
 }
@@ -333,14 +333,14 @@ void CCThreadProxy::onSwapBuffersCompleteOnImplThread()
 void CCThreadProxy::setNeedsCommitOnImplThread()
 {
     ASSERT(isImplThread());
-    TRACE_EVENT("CCThreadProxy::setNeedsCommitOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::setNeedsCommitOnImplThread");
     m_schedulerOnImplThread->setNeedsCommit();
 }
 
 void CCThreadProxy::setNeedsForcedCommitOnImplThread()
 {
     ASSERT(isImplThread());
-    TRACE_EVENT("CCThreadProxy::setNeedsForcedCommitOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::setNeedsForcedCommitOnImplThread");
     m_schedulerOnImplThread->setNeedsCommit();
     m_schedulerOnImplThread->setNeedsForcedCommit();
 }
@@ -348,14 +348,14 @@ void CCThreadProxy::setNeedsForcedCommitOnImplThread()
 void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
     ASSERT(isImplThread());
-    TRACE_EVENT("CCThreadProxy::postAnimationEventsToMainThreadOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::postAnimationEventsToMainThreadOnImplThread");
     m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events, wallClockTime));
 }
 
 void CCThreadProxy::setNeedsRedraw()
 {
     ASSERT(isMainThread());
-    TRACE_EVENT("CCThreadProxy::setNeedsRedraw", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::setNeedsRedraw");
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setFullRootLayerDamageOnImplThread));
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsRedrawOnImplThread));
 }
@@ -369,7 +369,7 @@ bool CCThreadProxy::commitRequested() const
 void CCThreadProxy::setNeedsRedrawOnImplThread()
 {
     ASSERT(isImplThread());
-    TRACE_EVENT("CCThreadProxy::setNeedsRedrawOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::setNeedsRedrawOnImplThread");
     m_schedulerOnImplThread->setNeedsRedraw();
 }
 
@@ -387,7 +387,7 @@ void CCThreadProxy::start()
 
 void CCThreadProxy::stop()
 {
-    TRACE_EVENT("CCThreadProxy::stop", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::stop");
     ASSERT(isMainThread());
     ASSERT(m_started);
 
@@ -424,7 +424,7 @@ void CCThreadProxy::forceSerializeOnSwapBuffersOnImplThread(CCCompletionEvent* c
 
 void CCThreadProxy::finishAllRenderingOnImplThread(CCCompletionEvent* completion)
 {
-    TRACE_EVENT("CCThreadProxy::finishAllRenderingOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::finishAllRenderingOnImplThread");
     ASSERT(isImplThread());
     m_layerTreeHostImpl->finishAllRendering();
     completion->signal();
@@ -541,7 +541,7 @@ void CCThreadProxy::beginFrame()
     // point of view, but asynchronously performed on the impl thread,
     // coordinated by the CCScheduler.
     {
-        TRACE_EVENT("commit", this, 0);
+        TRACE_EVENT0("cc", "commit");
         DebugScopedSetMainThreadBlocked mainThreadBlocked;
 
         CCCompletionEvent completion;
@@ -555,7 +555,7 @@ void CCThreadProxy::beginFrame()
 
 void CCThreadProxy::beginFrameCompleteOnImplThread(CCCompletionEvent* completion)
 {
-    TRACE_EVENT("CCThreadProxy::beginFrameCompleteOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::beginFrameCompleteOnImplThread");
     ASSERT(!m_commitCompletionEventOnImplThread);
     ASSERT(isImplThread());
     ASSERT(m_schedulerOnImplThread);
@@ -598,14 +598,14 @@ bool CCThreadProxy::canDraw()
 
 void CCThreadProxy::scheduledActionUpdateMoreResources()
 {
-    TRACE_EVENT("CCThreadProxy::scheduledActionUpdateMoreResources", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::scheduledActionUpdateMoreResources");
     ASSERT(m_currentTextureUpdaterOnImplThread);
     m_currentTextureUpdaterOnImplThread->update(m_layerTreeHostImpl->context(), m_layerTreeHostImpl->contentsTextureAllocator(), m_layerTreeHostImpl->layerRenderer()->textureCopier(), m_layerTreeHostImpl->layerRenderer()->textureUploader(), textureUpdatesPerFrame);
 }
 
 void CCThreadProxy::scheduledActionCommit()
 {
-    TRACE_EVENT("CCThreadProxy::scheduledActionCommit", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::scheduledActionCommit");
     ASSERT(isImplThread());
     ASSERT(m_currentTextureUpdaterOnImplThread);
     ASSERT(!m_currentTextureUpdaterOnImplThread->hasMoreUpdates());
@@ -637,7 +637,7 @@ void CCThreadProxy::scheduledActionBeginContextRecreation()
 
 CCScheduledActionDrawAndSwapResult CCThreadProxy::scheduledActionDrawAndSwapInternal(bool forcedDraw)
 {
-    TRACE_EVENT("CCThreadProxy::scheduledActionDrawAndSwap", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::scheduledActionDrawAndSwap");
     CCScheduledActionDrawAndSwapResult result;
     result.didDraw = false;
     result.didSwap = false;
@@ -707,7 +707,7 @@ void CCThreadProxy::acquireLayerTextures()
     if (m_texturesAcquired)
         return;
 
-    TRACE_EVENT("CCThreadProxy::acquireLayerTextures", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::acquireLayerTextures");
     CCCompletionEvent completion;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::acquireLayerTexturesForMainThreadOnImplThread, AllowCrossThreadAccess(&completion)));
     completion.wait(); // Block until it is safe to write to layer textures from the main thread.
@@ -808,7 +808,7 @@ void CCThreadProxy::tryToRecreateContext()
 
 void CCThreadProxy::initializeImplOnImplThread(CCCompletionEvent* completion)
 {
-    TRACE_EVENT("CCThreadProxy::initializeImplOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::initializeImplOnImplThread");
     ASSERT(isImplThread());
     m_layerTreeHostImpl = m_layerTreeHost->createLayerTreeHostImpl(this);
     const double displayRefreshInterval = 1.0 / 60.0;
@@ -824,14 +824,14 @@ void CCThreadProxy::initializeImplOnImplThread(CCCompletionEvent* completion)
 
 void CCThreadProxy::initializeContextOnImplThread(CCGraphicsContext* context)
 {
-    TRACE_EVENT("CCThreadProxy::initializeContextOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::initializeContextOnImplThread");
     ASSERT(isImplThread());
     m_contextBeforeInitializationOnImplThread = adoptPtr(context);
 }
 
 void CCThreadProxy::initializeLayerRendererOnImplThread(CCCompletionEvent* completion, bool* initializeSucceeded, LayerRendererCapabilities* capabilities)
 {
-    TRACE_EVENT("CCThreadProxy::initializeLayerRendererOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::initializeLayerRendererOnImplThread");
     ASSERT(isImplThread());
     ASSERT(m_contextBeforeInitializationOnImplThread);
     *initializeSucceeded = m_layerTreeHostImpl->initializeLayerRenderer(m_contextBeforeInitializationOnImplThread.release(), textureUploader);
@@ -846,7 +846,7 @@ void CCThreadProxy::initializeLayerRendererOnImplThread(CCCompletionEvent* compl
 
 void CCThreadProxy::layerTreeHostClosedOnImplThread(CCCompletionEvent* completion)
 {
-    TRACE_EVENT("CCThreadProxy::layerTreeHostClosedOnImplThread", this, 0);
+    TRACE_EVENT0("cc", "CCThreadProxy::layerTreeHostClosedOnImplThread");
     ASSERT(isImplThread());
     if (!m_layerTreeHostImpl->contentsTexturesWerePurgedSinceLastCommit())
         m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
index 984c3b7be..564e3696b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
@@ -29,6 +29,8 @@
 
 #include "cc/CCTiledLayerImpl.h"
 
+#include "GraphicsContext3D.h"
+#include "SkColor.h"
 #include "TextStream.h"
 #include "cc/CCCheckerboardDrawQuad.h"
 #include "cc/CCDebugBorderDrawQuad.h"
@@ -153,12 +155,12 @@ void CCTiledLayerImpl::appendQuads(CCQuadCuller& quadList, const CCSharedQuadSta
             for (int i = left; i <= right; ++i) {
                 DrawableTile* tile = tileAt(i, j);
                 IntRect tileRect = m_tiler->tileBounds(i, j);
-                Color borderColor;
+                SkColor borderColor;
 
                 if (m_skipsDraw || !tile || !tile->textureId())
-                    borderColor = Color(debugTileBorderMissingTileColorRed, debugTileBorderMissingTileColorGreen, debugTileBorderMissingTileColorBlue, debugTileBorderAlpha);
+                    borderColor = SkColorSetARGB(debugTileBorderAlpha, debugTileBorderMissingTileColorRed, debugTileBorderMissingTileColorGreen, debugTileBorderMissingTileColorBlue);
                 else
-                    borderColor = Color(debugTileBorderColorRed, debugTileBorderColorGreen, debugTileBorderColorBlue, debugTileBorderAlpha);
+                    borderColor = SkColorSetARGB(debugTileBorderAlpha, debugTileBorderColorRed, debugTileBorderColorGreen, debugTileBorderColorBlue);
                 quadList.append(CCDebugBorderDrawQuad::create(sharedQuadState, tileRect, borderColor, debugTileBorderWidth));
             }
         }
@@ -219,7 +221,7 @@ void CCTiledLayerImpl::setTilingData(const CCLayerTilingData& tiler)
     *m_tiler = tiler;
 }
 
-void CCTiledLayerImpl::pushTileProperties(int i, int j, Platform3DObject textureId, const IntRect& opaqueRect)
+void CCTiledLayerImpl::pushTileProperties(int i, int j, unsigned textureId, const IntRect& opaqueRect)
 {
     DrawableTile* tile = tileAt(i, j);
     if (!tile)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
index 131a32fce..4c82cdc8c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
@@ -50,7 +50,7 @@ public:
 
     void setSkipsDraw(bool skipsDraw) { m_skipsDraw = skipsDraw; }
     void setTilingData(const CCLayerTilingData& tiler);
-    void pushTileProperties(int, int, Platform3DObject textureId, const IntRect& opaqueRect);
+    void pushTileProperties(int, int, unsigned textureId, const IntRect& opaqueRect);
 
     void setContentsSwizzled(bool contentsSwizzled) { m_contentsSwizzled = contentsSwizzled; }
     bool contentsSwizzled() const { return m_contentsSwizzled; }
diff --git a/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp b/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp
index af99700c9..b52ab8dd2 100644
--- a/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp
+++ b/Source/WebCore/platform/graphics/clutter/DrawingBufferClutter.cpp
@@ -31,7 +31,7 @@
 
 #include "config.h"
 
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
+#if ENABLE(ACCELERATED_2D_CANVAS) || USE(3D_GRAPHICS)
 
 #include "DrawingBuffer.h"
 
diff --git a/Source/WebCore/platform/graphics/clutter/GraphicsContext3DClutter.cpp b/Source/WebCore/platform/graphics/clutter/GraphicsContext3DClutter.cpp
index ca0ffdc2b..4b4b0e39d 100644
--- a/Source/WebCore/platform/graphics/clutter/GraphicsContext3DClutter.cpp
+++ b/Source/WebCore/platform/graphics/clutter/GraphicsContext3DClutter.cpp
@@ -29,7 +29,7 @@
 #include "config.h"
 #include "GraphicsContext3D.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "Extensions3DOpenGL.h"
 #include "GraphicsContext3DPrivate.h"
@@ -56,6 +56,11 @@ GraphicsContext3D::~GraphicsContext3D()
     notImplemented();
 }
 
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    notImplemented();
+}
+
 bool GraphicsContext3D::getImageData(Image* image, unsigned int format, unsigned int type, bool premultiplyAlpha, bool ignoreGammaAndColorProfile, Vector<uint8_t>& outputVector)
 {
     notImplemented();
@@ -100,4 +105,4 @@ PlatformLayer* GraphicsContext3D::platformLayer() const
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/clutter/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/clutter/GraphicsContext3DPrivate.cpp
index cad170fb0..2aebb65e6 100644
--- a/Source/WebCore/platform/graphics/clutter/GraphicsContext3DPrivate.cpp
+++ b/Source/WebCore/platform/graphics/clutter/GraphicsContext3DPrivate.cpp
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "GraphicsContext3DPrivate.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "HostWindow.h"
 #include "NotImplemented.h"
@@ -61,4 +61,4 @@ void GraphicsContext3DPrivate::paintToGraphicsLayerActor(ClutterActor*, const Fl
 
 } // namespace WebCore
 
-#endif // ENABLE_WEBGL
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
index 6a37ebc10..2f5c96ae9 100644
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
+#if USE(3D_GRAPHICS) || USE(ACCELERATED_COMPOSITING)
 
 #include "GraphicsContext3DPrivate.h"
 
@@ -857,4 +857,4 @@ bool GraphicsContext3D::isResourceSafe()
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
index e51ddc1b4..345507fd3 100644
--- a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
+#if USE(3D_GRAPHICS) || USE(ACCELERATED_COMPOSITING)
 
 #include "GraphicsContext3DPrivate.h"
 
@@ -1121,4 +1121,4 @@ Extensions3D* GraphicsContext3DPrivate::getExtensions()
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
+#endif // USE(3D_GRAPHICS) || USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
index c5771739d..9ab5e570d 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.cpp
@@ -29,7 +29,7 @@
 
 #include "config.h"
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include "CustomFilterCompiledProgram.h"
  
 #include "GraphicsContext3D.h"
@@ -87,6 +87,8 @@ CustomFilterCompiledProgram::CustomFilterCompiledProgram(GraphicsContext3D* cont
     , m_contentSamplerLocation(-1)
     , m_isInitialized(false)
 {
+    m_context->makeContextCurrent();
+    
     Platform3DObject vertexShader = compileShader(GraphicsContext3D::VERTEX_SHADER, m_vertexShaderString);
     if (!vertexShader)
         return;
@@ -171,9 +173,11 @@ int CustomFilterCompiledProgram::uniformLocationByName(const String& name)
     
 CustomFilterCompiledProgram::~CustomFilterCompiledProgram()
 {
-    if (m_program)
+    if (m_program) {
+        m_context->makeContextCurrent();
         m_context->deleteProgram(m_program);
+    }
 }
 
 } // namespace WebCore
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
index b0c449c3b..6057efe24 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterCompiledProgram.h
@@ -30,7 +30,7 @@
 #ifndef CustomFilterCompiledProgram_h
 #define CustomFilterCompiledProgram_h
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
 #include "GraphicsTypes3D.h"
 #include <wtf/RefCounted.h>
@@ -104,6 +104,6 @@ private:
 
 }
 
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
 #endif
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp
index 0bf749f81..455ae40c9 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.cpp
@@ -29,7 +29,7 @@
 
 #include "config.h"
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include "CustomFilterGlobalContext.h"
 
 #include "GraphicsContext3D.h"
@@ -53,10 +53,12 @@ void CustomFilterGlobalContext::prepareContextIfNeeded(HostWindow* hostWindow)
     attributes.preserveDrawingBuffer = true;
     attributes.premultipliedAlpha = false;
     m_context = GraphicsContext3D::create(attributes, hostWindow, GraphicsContext3D::RenderOffscreen);
-
+    if (!m_context)
+        return;
+    m_context->makeContextCurrent();
     m_context->enable(GraphicsContext3D::DEPTH_TEST);
 }
 
 } // namespace WebCore
 
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h
index 3f38ba93d..aba003581 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterGlobalContext.h
@@ -30,7 +30,7 @@
 #ifndef CustomFilterGlobalContext_h
 #define CustomFilterGlobalContext_h
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -53,6 +53,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
 #endif // CustomFilterGlobalContext_h
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
index c3a986815..e014f0a06 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
@@ -29,7 +29,7 @@
 
 #include "config.h"
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include "CustomFilterMesh.h"
 #include "GraphicsContext3D.h"
 
@@ -245,6 +245,8 @@ CustomFilterMesh::CustomFilterMesh(GraphicsContext3D* context, unsigned columns,
     m_indicesCount = generator.indicesCount();
     m_bytesPerVertex = generator.floatsPerVertex() * sizeof(float);    
 
+    m_context->makeContextCurrent();
+
     m_verticesBufferObject = m_context->createBuffer();
     m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_verticesBufferObject);
     m_context->bufferData(GraphicsContext3D::ARRAY_BUFFER, generator.vertices().size() * sizeof(float), generator.vertices().data(), GraphicsContext3D::STATIC_DRAW);
@@ -256,11 +258,12 @@ CustomFilterMesh::CustomFilterMesh(GraphicsContext3D* context, unsigned columns,
 
 CustomFilterMesh::~CustomFilterMesh()
 {
+    m_context->makeContextCurrent();
     m_context->deleteBuffer(m_verticesBufferObject);
     m_context->deleteBuffer(m_elementsBufferObject);
 }
 
 } // namespace WebCore
 
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
index 46f37f361..e3c7a6bac 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
@@ -30,7 +30,7 @@
 #ifndef CustomFilterMesh_h
 #define CustomFilterMesh_h
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
 #include "CustomFilterOperation.h"
 #include "FloatRect.h"
@@ -75,6 +75,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
 #endif // CustomFilterMesh_h
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
index fe43640c6..60cff22e7 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
@@ -35,7 +35,7 @@
 #include "CustomFilterCompiledProgram.h"
 #include "CustomFilterProgramClient.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 #include "GraphicsContext3D.h"
 #endif
 
@@ -80,7 +80,7 @@ void CustomFilterProgram::notifyClients()
         iter->first->notifyCustomFilterProgramLoaded(this);
 }
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 PassRefPtr<CustomFilterCompiledProgram> CustomFilterProgram::compileProgramWithContext(GraphicsContext3D* context)
 {
     ASSERT(isLoaded());
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
index 12292a100..221606676 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
@@ -53,7 +53,7 @@ public:
     void addClient(CustomFilterProgramClient*);
     void removeClient(CustomFilterProgramClient*);
     
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
     PassRefPtr<CustomFilterCompiledProgram> compileProgramWithContext(GraphicsContext3D*);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
index ac05941cd..36d06d32b 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
@@ -29,7 +29,7 @@
 
 #include "config.h"
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 #include "FECustomFilter.h"
 
 #include "CustomFilterCompiledProgram.h"
@@ -103,6 +103,9 @@ FECustomFilter::~FECustomFilter()
 
 void FECustomFilter::deleteRenderBuffers()
 {
+    if (!m_context)
+        return;
+    m_context->makeContextCurrent();
     if (m_frameBuffer) {
         m_context->deleteFramebuffer(m_frameBuffer);
         m_frameBuffer = 0;
@@ -129,8 +132,9 @@ void FECustomFilter::platformApplySoftware()
     
     IntSize newContextSize(effectDrawingRect.size());
     bool hadContext = m_context;
-    if (!m_context)
-        initializeContext();
+    if (!m_context && !initializeContext())
+        return;
+    m_context->makeContextCurrent();
     
     if (!hadContext || m_contextSize != newContextSize)
         resizeContext(newContextSize);
@@ -157,11 +161,13 @@ void FECustomFilter::platformApplySoftware()
     m_context->readPixels(0, 0, newContextSize.width(), newContextSize.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, dstPixelArray->data());
 }
 
-void FECustomFilter::initializeContext()
+bool FECustomFilter::initializeContext()
 {
     ASSERT(!m_context.get());
-    ASSERT(m_globalContext->context());
     m_context = m_globalContext->context();
+    if (!m_context)
+        return false;
+    m_context->makeContextCurrent();
     
     // FIXME: The shader and the mesh can be shared across multiple elements when possible.
     // Sharing the shader means it's no need to analyze / compile and upload to GPU again.
@@ -174,6 +180,7 @@ void FECustomFilter::initializeContext()
     m_mesh = CustomFilterMesh::create(m_context.get(), m_meshColumns, m_meshRows, 
                                       FloatRect(0, 0, 1, 1),
                                       m_meshType);
+    return true;
 }
 
 void FECustomFilter::resizeContext(const IntSize& newContextSize)
@@ -303,4 +310,4 @@ TextStream& FECustomFilter::externalRepresentation(TextStream& ts, int indent) c
 
 } // namespace WebCore
 
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.h b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
index 3c731abcc..b7f93698e 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.h
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
@@ -30,7 +30,7 @@
 #ifndef FECustomFilter_h
 #define FECustomFilter_h
 
-#if ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#if ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
 #include "CustomFilterOperation.h"
 #include "Filter.h"
@@ -72,7 +72,7 @@ private:
                    CustomFilterOperation::MeshType);
     ~FECustomFilter();
     
-    void initializeContext();
+    bool initializeContext();
     void deleteRenderBuffers();
     void resizeContext(const IntSize& newContextSize);
     void bindVertexAttribute(int attributeLocation, unsigned size, unsigned& offset);
@@ -103,6 +103,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(CSS_SHADERS) && ENABLE(WEBGL)
+#endif // ENABLE(CSS_SHADERS) && USE(3D_GRAPHICS)
 
 #endif // FECustomFilter_h
diff --git a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
index 6f2277681..1950ee9e3 100644
--- a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -120,13 +120,27 @@ inline void FEGaussianBlur::platformApplyGeneric(Uint8ClampedArray* srcPixelArra
     for (int i = 0; i < 3; ++i) {
         if (kernelSizeX) {
             kernelPosition(i, kernelSizeX, dxLeft, dxRight);
+#if HAVE(ARM_NEON_INTRINSICS)
+            if (!isAlphaImage())
+                boxBlurNEON(src, dst, kernelSizeX, dxLeft, dxRight, 4, stride, paintSize.width(), paintSize.height());
+            else
+                boxBlur(src, dst, kernelSizeX, dxLeft, dxRight, 4, stride, paintSize.width(), paintSize.height(), true);
+#else
             boxBlur(src, dst, kernelSizeX, dxLeft, dxRight, 4, stride, paintSize.width(), paintSize.height(), isAlphaImage());
+#endif
             swap(src, dst);
         }
 
         if (kernelSizeY) {
             kernelPosition(i, kernelSizeY, dyLeft, dyRight);
+#if HAVE(ARM_NEON_INTRINSICS)
+            if (!isAlphaImage())
+                boxBlurNEON(src, dst, kernelSizeY, dyLeft, dyRight, stride, 4, paintSize.height(), paintSize.width());
+            else
+                boxBlur(src, dst, kernelSizeY, dyLeft, dyRight, stride, 4, paintSize.height(), paintSize.width(), true);
+#else
             boxBlur(src, dst, kernelSizeY, dyLeft, dyRight, stride, 4, paintSize.height(), paintSize.width(), isAlphaImage());
+#endif
             swap(src, dst);
         }
     }
@@ -142,13 +156,8 @@ inline void FEGaussianBlur::platformApplyGeneric(Uint8ClampedArray* srcPixelArra
 void FEGaussianBlur::platformApplyWorker(PlatformApplyParameters* parameters)
 {
     IntSize paintSize(parameters->width, parameters->height);
-#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
-    parameters->filter->platformApplyNeon(parameters->srcPixelArray.get(), parameters->dstPixelArray.get(),
-        parameters->kernelSizeX, parameters->kernelSizeY, paintSize);
-#else
     parameters->filter->platformApplyGeneric(parameters->srcPixelArray.get(), parameters->dstPixelArray.get(),
         parameters->kernelSizeX, parameters->kernelSizeY, paintSize);
-#endif
 }
 
 inline void FEGaussianBlur::platformApply(Uint8ClampedArray* srcPixelArray, Uint8ClampedArray* tmpPixelArray, unsigned kernelSizeX, unsigned kernelSizeY, IntSize& paintSize)
@@ -221,11 +230,7 @@ inline void FEGaussianBlur::platformApply(Uint8ClampedArray* srcPixelArray, Uint
     }
 
     // The selection here eventually should happen dynamically on some platforms.
-#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
-    platformApplyNeon(srcPixelArray, tmpPixelArray, kernelSizeX, kernelSizeY, paintSize);
-#else
     platformApplyGeneric(srcPixelArray, tmpPixelArray, kernelSizeX, kernelSizeY, paintSize);
-#endif
 }
 
 void FEGaussianBlur::calculateUnscaledKernelSize(unsigned& kernelSizeX, unsigned& kernelSizeY, float stdX, float stdY)
diff --git a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h
index c3db1f150..7b3bdce29 100644
--- a/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h
+++ b/Source/WebCore/platform/graphics/filters/FEGaussianBlur.h
@@ -73,7 +73,6 @@ private:
     inline void platformApply(Uint8ClampedArray* srcPixelArray, Uint8ClampedArray* tmpPixelArray, unsigned kernelSizeX, unsigned kernelSizeY, IntSize& paintSize);
 
     inline void platformApplyGeneric(Uint8ClampedArray* srcPixelArray, Uint8ClampedArray* tmpPixelArray, unsigned kernelSizeX, unsigned kernelSizeY, IntSize& paintSize);
-    inline void platformApplyNeon(Uint8ClampedArray* srcPixelArray, Uint8ClampedArray* tmpPixelArray, unsigned kernelSizeX, unsigned kernelSizeY, IntSize& paintSize);
 #if USE(SKIA)
     virtual bool platformApplySkia();
 #endif
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperation.h b/Source/WebCore/platform/graphics/filters/FilterOperation.h
index 255f64048..b8796e802 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperation.h
@@ -33,7 +33,7 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/text/AtomicString.h>
+#include <wtf/text/WTFString.h>
 
 // Annoyingly, wingdi.h #defines this.
 #ifdef PASSTHROUGH
@@ -147,21 +147,25 @@ private:
 
 class ReferenceFilterOperation : public FilterOperation {
 public:
-    static PassRefPtr<ReferenceFilterOperation> create(const AtomicString& reference, OperationType type)
+    static PassRefPtr<ReferenceFilterOperation> create(const String& url, const String& fragment, OperationType type)
     {
-        return adoptRef(new ReferenceFilterOperation(reference, type));
+        return adoptRef(new ReferenceFilterOperation(url, fragment, type));
     }
 
     virtual PassRefPtr<FilterOperation> clone() const
     {
-        // AtomicString is thread-hostile, so we can't be cloned.
+        // Unimplemented
         return 0;
     }
 
     virtual bool affectsOpacity() const { return true; }
     virtual bool movesPixels() const { return true; }
 
-    const AtomicString& reference() const { return m_reference; }
+    const String& url() const { return m_url; }
+    const String& fragment() const { return m_fragment; }
+
+    void* data() const { return m_data; }
+    void setData(void* data) { m_data = data; }
 
 private:
 
@@ -170,16 +174,20 @@ private:
         if (!isSameType(o))
             return false;
         const ReferenceFilterOperation* other = static_cast<const ReferenceFilterOperation*>(&o);
-        return m_reference == other->m_reference;
+        return m_url == other->m_url;
     }
 
-    ReferenceFilterOperation(const AtomicString& reference, OperationType type)
+    ReferenceFilterOperation(const String& url, const String& fragment, OperationType type)
         : FilterOperation(type)
-        , m_reference(reference)
+        , m_url(url)
+        , m_fragment(fragment)
+        , m_data(0)
     {
     }
 
-    AtomicString m_reference;
+    String m_url;
+    String m_fragment;
+    void* m_data;
 };
 
 // GRAYSCALE, SEPIA, SATURATE and HUE_ROTATE are variations on a basic color matrix effect.
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
index 821bc6e67..c4b876593 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterOperations.cpp
@@ -98,6 +98,15 @@ bool FilterOperations::hasCustomFilter() const
 }
 #endif
 
+bool FilterOperations::hasReferenceFilter() const
+{
+    for (size_t i = 0; i < m_operations.size(); ++i) {
+        if (m_operations.at(i)->getOperationType() == FilterOperation::REFERENCE)
+            return true;
+    }
+    return false;
+}
+
 bool FilterOperations::hasOutsets() const
 {
     for (size_t i = 0; i < m_operations.size(); ++i) {
diff --git a/Source/WebCore/platform/graphics/filters/FilterOperations.h b/Source/WebCore/platform/graphics/filters/FilterOperations.h
index be1b0a623..beb649b89 100644
--- a/Source/WebCore/platform/graphics/filters/FilterOperations.h
+++ b/Source/WebCore/platform/graphics/filters/FilterOperations.h
@@ -72,6 +72,7 @@ public:
 #if ENABLE(CSS_SHADERS)
     bool hasCustomFilter() const;
 #endif
+    bool hasReferenceFilter() const;
 private:
     Vector<RefPtr<FilterOperation> > m_operations;
 };
diff --git a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp b/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp
deleted file mode 100644
index 300369801..000000000
--- a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.cpp
+++ /dev/null
@@ -1,338 +0,0 @@
-/*
- * Copyright (C) 2011 University of Szeged
- * Copyright (C) 2011 Zoltan Herczeg
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "FEGaussianBlurNEON.h"
-
-#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
-
-#include <wtf/Alignment.h>
-
-namespace WebCore {
-
-static WTF_ALIGNED(unsigned char, s_FEGaussianBlurConstantsForNeon[], 16) = {
-    // Mapping from NEON to ARM registers.
-    0, 4,  8,  12, 16, 16, 16, 16
-};
-
-unsigned char* feGaussianBlurConstantsForNeon()
-{
-    return s_FEGaussianBlurConstantsForNeon;
-}
-
-#define ASSTRING(str) #str
-#define TOSTRING(value) ASSTRING(value)
-
-#define STRIDE_OFFSET TOSTRING(0)
-#define STRIDE_WIDTH_OFFSET TOSTRING(4)
-#define STRIDE_LINE_OFFSET TOSTRING(8)
-#define STRIDE_LINE_WIDTH_OFFSET TOSTRING(12)
-#define REMAINING_STRIDES_OFFSET TOSTRING(16)
-#define DISTANCE_LEFT_OFFSET TOSTRING(20)
-#define DISTANCE_RIGHT_OFFSET TOSTRING(24)
-#define INVERTED_KERNEL_SIZE_OFFSET TOSTRING(28)
-#define PAINTING_CONSTANTS_OFFSET TOSTRING(32)
-#define NL "\n"
-
-// Register allocation.
-#define SOURCE_R                "r0"
-#define DESTINATION_R           "r1"
-#define LEFT_R                  "r2"
-#define RIGHT_R                 "r3"
-#define SOURCE_END_R            "r4"
-#define DESTINATION_END_R       "r5"
-#define STRIDE_R                "r6"
-#define STRIDE_WIDTH_R          "r7"
-#define STRIDE_LINE_R           "r8"
-#define SOURCE_LINE_END_R       "r10"
-#define DISTANCE_LEFT_R         "r11"
-#define DISTANCE_RIGHT_R        "r12"
-#define MAX_KERNEL_SIZE_R       "lr"
-
-// Alternate names.
-#define INIT_INVERTED_KERNEL_SIZE_R SOURCE_END_R
-#define INIT_PAINTING_CONSTANTS_R DESTINATION_END_R
-#define INIT_SUM_R LEFT_R
-#define REMAINING_STRIDES_R SOURCE_LINE_END_R
-
-#define INVERTED_KERNEL_SIZE_Q  "q0"
-#define SUM_Q                   "q1"
-#define PIXEL_Q                 "q2"
-#define PIXEL_D0                "d4"
-#define PIXEL_D1                "d5"
-#define PIXEL_D00               "d4[0]"
-#define PIXEL_D01               "d4[1]"
-#define PIXEL_S1                "s9"
-#define PIXEL_D10               "d5[0]"
-#define PIXEL_S2                "s10"
-#define PIXEL_D11               "d5[1]"
-#define REMAINING_STRIDES_S0    "s12"
-
-#define REMAP_NEON_ARM_Q        "d16"
-
-asm ( // NOLINT
-".globl " TOSTRING(neonDrawAllChannelGaussianBlur) NL
-TOSTRING(neonDrawAllChannelGaussianBlur) ":" NL
-    "stmdb sp!, {r4-r8, r10, r11, lr}" NL
-    "ldr " STRIDE_R ", [r2, #" STRIDE_OFFSET "]" NL
-    "ldr " STRIDE_WIDTH_R ", [r2, #" STRIDE_WIDTH_OFFSET "]" NL
-    "ldr " DISTANCE_LEFT_R ", [r2, #" DISTANCE_LEFT_OFFSET "]" NL
-    "ldr " DISTANCE_RIGHT_R ", [r2, #" DISTANCE_RIGHT_OFFSET "]" NL
-    "ldr " STRIDE_LINE_R ", [r2, #" STRIDE_LINE_OFFSET "]" NL
-    "ldr " SOURCE_LINE_END_R ", [r2, #" STRIDE_LINE_WIDTH_OFFSET "]" NL
-    "ldr " INIT_INVERTED_KERNEL_SIZE_R ", [r2, #" INVERTED_KERNEL_SIZE_OFFSET "]" NL
-    "ldr " INIT_PAINTING_CONSTANTS_R ", [r2, #" PAINTING_CONSTANTS_OFFSET "]" NL
-
-    // Initialize locals.
-    "mul " DISTANCE_LEFT_R ", " DISTANCE_LEFT_R ", " STRIDE_R NL
-    "mul " DISTANCE_RIGHT_R ", " DISTANCE_RIGHT_R ", " STRIDE_R NL
-    "mov " MAX_KERNEL_SIZE_R ", " DISTANCE_RIGHT_R NL
-    "cmp " MAX_KERNEL_SIZE_R ", " STRIDE_WIDTH_R NL
-    "movcs " MAX_KERNEL_SIZE_R ", " STRIDE_WIDTH_R NL
-    "add " SOURCE_LINE_END_R ", " SOURCE_LINE_END_R ", " SOURCE_R NL
-    "vdup.f32 " INVERTED_KERNEL_SIZE_Q ", " INIT_INVERTED_KERNEL_SIZE_R NL
-    "vld1.f32 { " REMAP_NEON_ARM_Q " }, [" INIT_PAINTING_CONSTANTS_R "]!" NL
-
-".allChannelMainLoop:" NL
-
-    // Initialize the sum variable.
-    "vmov.u32 " SUM_Q ", #0" NL
-    "mov " INIT_SUM_R ", " SOURCE_R NL
-    "add " SOURCE_END_R ", " SOURCE_R ", " MAX_KERNEL_SIZE_R NL
-    "cmp " INIT_SUM_R ", " SOURCE_END_R NL
-    "bcs .allChannelInitSumDone" NL
-".allChannelInitSum:" NL
-    "vld1.u32 " PIXEL_D00 ", [" INIT_SUM_R "], " STRIDE_R NL
-    "vmovl.u8 " PIXEL_Q ", " PIXEL_D0 NL
-    "vmovl.u16 " PIXEL_Q ", " PIXEL_D0 NL
-    "vadd.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-    "cmp " INIT_SUM_R ", " SOURCE_END_R NL
-    "bcc .allChannelInitSum" NL
-".allChannelInitSumDone:" NL
-
-    // Blurring.
-    "add " SOURCE_END_R ", " SOURCE_R ", " STRIDE_WIDTH_R NL
-    "add " DESTINATION_END_R ", " DESTINATION_R ", " STRIDE_WIDTH_R NL
-    "sub " LEFT_R ", " SOURCE_R ", " DISTANCE_LEFT_R NL
-    "add " RIGHT_R ", " SOURCE_R ", " DISTANCE_RIGHT_R NL
-
-".allChannelBlur:" NL
-    "vcvt.f32.u32 " PIXEL_Q ", " SUM_Q NL
-    "vmul.f32 " PIXEL_Q ", " PIXEL_Q ", " INVERTED_KERNEL_SIZE_Q NL
-    "vcvt.u32.f32 " PIXEL_Q ", " PIXEL_Q NL
-    "vtbl.8 " PIXEL_D0 ", {" PIXEL_D0 "-" PIXEL_D1 "}, " REMAP_NEON_ARM_Q NL
-    "vst1.u32 " PIXEL_D00 ", [" DESTINATION_R "], " STRIDE_R NL
-
-    "cmp " LEFT_R ", " SOURCE_R NL
-    "bcc .allChannelSkipLeft" NL
-    "vld1.u32 " PIXEL_D00 ", [" LEFT_R "]" NL
-    "vmovl.u8 " PIXEL_Q ", " PIXEL_D0 NL
-    "vmovl.u16 " PIXEL_Q ", " PIXEL_D0 NL
-    "vsub.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-".allChannelSkipLeft: " NL
-
-    "cmp " RIGHT_R ", " SOURCE_END_R NL
-    "bcs .allChannelSkipRight" NL
-    "vld1.u32 " PIXEL_D00 ", [" RIGHT_R "]" NL
-    "vmovl.u8 " PIXEL_Q ", " PIXEL_D0 NL
-    "vmovl.u16 " PIXEL_Q ", " PIXEL_D0 NL
-    "vadd.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-".allChannelSkipRight: " NL
-
-    "add " LEFT_R ", " LEFT_R ", " STRIDE_R NL
-    "add " RIGHT_R ", " RIGHT_R ", " STRIDE_R NL
-    "cmp " DESTINATION_R ", " DESTINATION_END_R NL
-    "bcc .allChannelBlur" NL
-    "sub " DESTINATION_R ", " DESTINATION_R ", " STRIDE_WIDTH_R NL
-
-    "add " SOURCE_R ", " SOURCE_R ", " STRIDE_LINE_R NL
-    "add " DESTINATION_R ", " DESTINATION_R ", " STRIDE_LINE_R NL
-    "cmp " SOURCE_R ", " SOURCE_LINE_END_R NL
-    "bcc .allChannelMainLoop" NL
-
-    "ldmia sp!, {r4-r8, r10, r11, pc}" NL
-); // NOLINT
-
-#define DATA_TRANSFER4(command, base) \
-    command " " PIXEL_D00 ", [" base "], " STRIDE_LINE_R NL \
-    command " " PIXEL_D01 ", [" base "], " STRIDE_LINE_R NL \
-    command " " PIXEL_D10 ", [" base "], " STRIDE_LINE_R NL \
-    command " " PIXEL_D11 ", [" base "], " STRIDE_LINE_R NL \
-    "sub " base ", " base ", " STRIDE_LINE_R ", lsl #2" NL
-
-// The number of reads depend on REMAINING_STRIDES_R, but it is always >= 1 and <= 3
-#define CONDITIONAL_DATA_TRANSFER4(command1, command2, base) \
-    command1 " " PIXEL_D00 ", [" base "], " STRIDE_LINE_R NL \
-    "cmp " REMAINING_STRIDES_R ", #2" NL \
-    command2 "cs " PIXEL_S1 ", [" base "]" NL \
-    "add " base ", " base ", " STRIDE_LINE_R NL \
-    "cmp " REMAINING_STRIDES_R ", #3" NL \
-    command2 "cs " PIXEL_S2 ", [" base "]" NL \
-    "sub " base ", " base ", " STRIDE_LINE_R ", lsl #1" NL
-
-asm ( // NOLINT
-".globl " TOSTRING(neonDrawAlphaChannelGaussianBlur) NL
-TOSTRING(neonDrawAlphaChannelGaussianBlur) ":" NL
-    "stmdb sp!, {r4-r8, r10, r11, lr}" NL
-    "ldr " STRIDE_R ", [r2, #" STRIDE_OFFSET "]" NL
-    "ldr " STRIDE_WIDTH_R ", [r2, #" STRIDE_WIDTH_OFFSET "]" NL
-    "ldr " DISTANCE_LEFT_R ", [r2, #" DISTANCE_LEFT_OFFSET "]" NL
-    "ldr " DISTANCE_RIGHT_R ", [r2, #" DISTANCE_RIGHT_OFFSET "]" NL
-    "ldr " STRIDE_LINE_R ", [r2, #" STRIDE_LINE_OFFSET "]" NL
-    "ldr " SOURCE_LINE_END_R ", [r2, #" STRIDE_LINE_WIDTH_OFFSET "]" NL
-    "ldr " INIT_INVERTED_KERNEL_SIZE_R ", [r2, #" INVERTED_KERNEL_SIZE_OFFSET "]" NL
-    "vldr.u32 " REMAINING_STRIDES_S0 ", [r2, #" REMAINING_STRIDES_OFFSET "]" NL
-
-    // Initialize locals.
-    "mul " DISTANCE_LEFT_R ", " DISTANCE_LEFT_R ", " STRIDE_R NL
-    "mul " DISTANCE_RIGHT_R ", " DISTANCE_RIGHT_R ", " STRIDE_R NL
-    "mov " MAX_KERNEL_SIZE_R ", " DISTANCE_RIGHT_R NL
-    "cmp " MAX_KERNEL_SIZE_R ", " STRIDE_WIDTH_R NL
-    "movcs " MAX_KERNEL_SIZE_R ", " STRIDE_WIDTH_R NL
-    "add " SOURCE_LINE_END_R ", " SOURCE_LINE_END_R ", " SOURCE_R NL
-    "vdup.f32 " INVERTED_KERNEL_SIZE_Q ", " INIT_INVERTED_KERNEL_SIZE_R NL
-    "cmp " SOURCE_LINE_END_R ", " SOURCE_R NL
-    "beq .alphaChannelEarlyLeave" NL
-
-    // Processing 4 strides parallelly.
-
-".alphaChannelMainLoop:" NL
-
-    // Initialize the sum variable.
-    "vmov.u32 " SUM_Q ", #0" NL
-    "mov " INIT_SUM_R ", " SOURCE_R NL
-    "add " SOURCE_END_R ", " SOURCE_R ", " MAX_KERNEL_SIZE_R NL
-    "cmp " INIT_SUM_R ", " SOURCE_END_R NL
-    "bcs .alphaChannelInitSumDone" NL
-".alphaChannelInitSum:" NL
-    DATA_TRANSFER4("vld1.u32", INIT_SUM_R)
-    "vshr.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    "vadd.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-    "add " INIT_SUM_R ", " INIT_SUM_R ", " STRIDE_R NL
-    "cmp " INIT_SUM_R ", " SOURCE_END_R NL
-    "bcc .alphaChannelInitSum" NL
-".alphaChannelInitSumDone:" NL
-
-    // Blurring.
-    "add " SOURCE_END_R ", " SOURCE_R ", " STRIDE_WIDTH_R NL
-    "add " DESTINATION_END_R ", " DESTINATION_R ", " STRIDE_WIDTH_R NL
-    "sub " LEFT_R ", " SOURCE_R ", " DISTANCE_LEFT_R NL
-    "add " RIGHT_R ", " SOURCE_R ", " DISTANCE_RIGHT_R NL
-
-".alphaChannelBlur:" NL
-    "vcvt.f32.u32 " PIXEL_Q ", " SUM_Q NL
-    "vmul.f32 " PIXEL_Q ", " PIXEL_Q ", " INVERTED_KERNEL_SIZE_Q NL
-    "vcvt.u32.f32 " PIXEL_Q ", " PIXEL_Q NL
-    "vshl.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    DATA_TRANSFER4("vst1.u32", DESTINATION_R)
-
-    "cmp " LEFT_R ", " SOURCE_R NL
-    "bcc .alphaChannelSkipLeft" NL
-    DATA_TRANSFER4("vld1.u32", LEFT_R)
-    "vshr.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    "vsub.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-".alphaChannelSkipLeft: " NL
-
-    "cmp " RIGHT_R ", " SOURCE_END_R NL
-    "bcs .alphaChannelSkipRight" NL
-    DATA_TRANSFER4("vld1.u32", RIGHT_R)
-    "vshr.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    "vadd.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-".alphaChannelSkipRight: " NL
-
-    "add " DESTINATION_R ", " DESTINATION_R ", " STRIDE_R NL
-    "add " LEFT_R ", " LEFT_R ", " STRIDE_R NL
-    "add " RIGHT_R ", " RIGHT_R ", " STRIDE_R NL
-    "cmp " DESTINATION_R ", " DESTINATION_END_R NL
-    "bcc .alphaChannelBlur" NL
-    "sub " DESTINATION_R ", " DESTINATION_R ", " STRIDE_WIDTH_R NL
-
-    "add " SOURCE_R ", " SOURCE_R ", " STRIDE_LINE_R ", lsl #2" NL
-    "add " DESTINATION_R ", " DESTINATION_R ", " STRIDE_LINE_R ", lsl #2" NL
-    "cmp " SOURCE_R ", " SOURCE_LINE_END_R NL
-    "bcc .alphaChannelMainLoop" NL
-
-    // Processing the remaining strides (0 - 3).
-".alphaChannelEarlyLeave:" NL
-    "vmov.u32 " REMAINING_STRIDES_R ", " REMAINING_STRIDES_S0 NL
-    // Early return for 0 strides.
-    "cmp " REMAINING_STRIDES_R ", #0" NL
-    "ldmeqia sp!, {r4-r8, r10, r11, pc}" NL
-
-    // Initialize the sum variable.
-    "vmov.u32 " SUM_Q ", #0" NL
-    "mov " INIT_SUM_R ", " SOURCE_R NL
-    "add " SOURCE_END_R ", " SOURCE_R ", " MAX_KERNEL_SIZE_R NL
-    "cmp " INIT_SUM_R ", " SOURCE_END_R NL
-    "bcs .alphaChannelSecondInitSumDone" NL
-".alphaChannelSecondInitSum:" NL
-    CONDITIONAL_DATA_TRANSFER4("vld1.u32", "vldr", INIT_SUM_R)
-    "vshr.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    "vadd.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-    "add " INIT_SUM_R ", " INIT_SUM_R ", " STRIDE_R NL
-    "cmp " INIT_SUM_R ", " SOURCE_END_R NL
-    "bcc .alphaChannelSecondInitSum" NL
-".alphaChannelSecondInitSumDone:" NL
-
-    // Blurring.
-    "add " SOURCE_END_R ", " SOURCE_R ", " STRIDE_WIDTH_R NL
-    "add " DESTINATION_END_R ", " DESTINATION_R ", " STRIDE_WIDTH_R NL
-    "sub " LEFT_R ", " SOURCE_R ", " DISTANCE_LEFT_R NL
-    "add " RIGHT_R ", " SOURCE_R ", " DISTANCE_RIGHT_R NL
-
-".alphaChannelSecondBlur:" NL
-    "vcvt.f32.u32 " PIXEL_Q ", " SUM_Q NL
-    "vmul.f32 " PIXEL_Q ", " PIXEL_Q ", " INVERTED_KERNEL_SIZE_Q NL
-    "vcvt.u32.f32 " PIXEL_Q ", " PIXEL_Q NL
-    "vshl.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    CONDITIONAL_DATA_TRANSFER4("vst1.u32", "vstr", DESTINATION_R)
-
-    "cmp " LEFT_R ", " SOURCE_R NL
-    "bcc .alphaChannelSecondSkipLeft" NL
-    CONDITIONAL_DATA_TRANSFER4("vld1.u32", "vldr", LEFT_R)
-    "vshr.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    "vsub.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-".alphaChannelSecondSkipLeft: " NL
-
-    "cmp " RIGHT_R ", " SOURCE_END_R NL
-    "bcs .alphaChannelSecondSkipRight" NL
-    CONDITIONAL_DATA_TRANSFER4("vld1.u32", "vldr", RIGHT_R)
-    "vshr.u32 " PIXEL_Q ", " PIXEL_Q ", #24" NL
-    "vadd.u32 " SUM_Q ", " SUM_Q ", " PIXEL_Q NL
-".alphaChannelSecondSkipRight: " NL
-
-    "add " DESTINATION_R ", " DESTINATION_R ", " STRIDE_R NL
-    "add " LEFT_R ", " LEFT_R ", " STRIDE_R NL
-    "add " RIGHT_R ", " RIGHT_R ", " STRIDE_R NL
-    "cmp " DESTINATION_R ", " DESTINATION_END_R NL
-    "bcc .alphaChannelSecondBlur" NL
-
-    "ldmia sp!, {r4-r8, r10, r11, pc}" NL
-); // NOLINT
-
-} // namespace WebCore
-
-#endif // CPU(ARM_NEON) && COMPILER(GCC)
diff --git a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h b/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h
index a2fb0bd44..93b46cfd3 100644
--- a/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h
+++ b/Source/WebCore/platform/graphics/filters/arm/FEGaussianBlurNEON.h
@@ -29,88 +29,51 @@
 
 #include <wtf/Platform.h>
 
-#if CPU(ARM_NEON) && CPU(ARM_TRADITIONAL) && COMPILER(GCC)
+#if ENABLE(FILTERS) && HAVE(ARM_NEON_INTRINSICS)
 
 #include "FEGaussianBlur.h"
+#include "NEONHelpers.h"
 
 namespace WebCore {
 
-struct FEGaussianBlurPaintingDataForNeon {
-    int stride;
-    int strideWidth;
-    int strideLine;
-    int strideLineWidth;
-    int remainingStrides;
-    int distanceLeft;
-    int distanceRight;
-    float invertedKernelSize;
-    unsigned char* paintingConstants;
-};
-
-unsigned char* feGaussianBlurConstantsForNeon();
-
-extern "C" {
-void neonDrawAllChannelGaussianBlur(unsigned char* source, unsigned char* destination, FEGaussianBlurPaintingDataForNeon*);
-void neonDrawAlphaChannelGaussianBlur(unsigned char* source, unsigned char* destination, FEGaussianBlurPaintingDataForNeon*);
-}
-
-inline void FEGaussianBlur::platformApplyNeon(Uint8ClampedArray* srcPixelArray, Uint8ClampedArray* tmpPixelArray, unsigned kernelSizeX, unsigned kernelSizeY, IntSize& paintSize)
+inline void boxBlurNEON(Uint8ClampedArray* srcPixelArray, Uint8ClampedArray* dstPixelArray,
+                    unsigned dx, int dxLeft, int dxRight, int stride, int strideLine, int effectWidth, int effectHeight)
 {
-    const int widthMultipliedByFour = 4 * paintSize.width();
-    FEGaussianBlurPaintingDataForNeon argumentsX = {
-        4,
-        widthMultipliedByFour,
-        widthMultipliedByFour,
-        (isAlphaImage() ? ((paintSize.height() >> 2) << 2) : paintSize.height()) * widthMultipliedByFour,
-        isAlphaImage() ? (paintSize.height() & 0x3) : 0,
-        0,
-        0,
-        0,
-        isAlphaImage() ? 0 : feGaussianBlurConstantsForNeon()
-    };
-    FEGaussianBlurPaintingDataForNeon argumentsY = {
-        widthMultipliedByFour,
-        widthMultipliedByFour * paintSize.height(),
-        4,
-        (isAlphaImage() ? ((paintSize.width() >> 2) << 2) : paintSize.width()) * 4,
-        isAlphaImage() ? (paintSize.width() & 0x3) : 0,
-        0,
-        0,
-        0,
-        isAlphaImage() ? 0 : feGaussianBlurConstantsForNeon()
-    };
+    uint32_t* sourcePixel = reinterpret_cast<uint32_t*>(srcPixelArray->data());
+    uint32_t* destinationPixel = reinterpret_cast<uint32_t*>(dstPixelArray->data());
+
+    float32x4_t deltaX = vdupq_n_f32(1.0 / dx);
+    int pixelLine = strideLine / 4;
 
-    for (int i = 0; i < 3; ++i) {
-        if (kernelSizeX) {
-            kernelPosition(i, kernelSizeX, argumentsX.distanceLeft, argumentsX.distanceRight);
-            argumentsX.invertedKernelSize = 1 / static_cast<float>(kernelSizeX);
-            if (isAlphaImage())
-                neonDrawAlphaChannelGaussianBlur(srcPixelArray->data(), tmpPixelArray->data(), &argumentsX);
-            else
-                neonDrawAllChannelGaussianBlur(srcPixelArray->data(), tmpPixelArray->data(), &argumentsX);
-        } else {
-            Uint8ClampedArray* auxPixelArray = tmpPixelArray;
-            tmpPixelArray = srcPixelArray;
-            srcPixelArray = auxPixelArray;
+    for (int y = 0; y < effectHeight; ++y) {
+        int line = y * pixelLine;
+        float32x4_t sum = vdupq_n_f32(0);
+        // Fill the kernel
+        int maxKernelSize = std::min(dxRight, effectWidth);
+        for (int i = 0; i < maxKernelSize; ++i) {
+            float32x4_t sourcePixelAsFloat = loadRGBA8AsFloat(sourcePixel + line + i);
+            sum = vaddq_f32(sum, sourcePixelAsFloat);
         }
 
-        if (kernelSizeY) {
-            kernelPosition(i, kernelSizeY, argumentsY.distanceLeft, argumentsY.distanceRight);
-            argumentsY.invertedKernelSize = 1 / static_cast<float>(kernelSizeY);
-            if (isAlphaImage())
-                neonDrawAlphaChannelGaussianBlur(tmpPixelArray->data(), srcPixelArray->data(), &argumentsY);
-            else
-                neonDrawAllChannelGaussianBlur(tmpPixelArray->data(), srcPixelArray->data(), &argumentsY);
-        } else {
-            Uint8ClampedArray* auxPixelArray = tmpPixelArray;
-            tmpPixelArray = srcPixelArray;
-            srcPixelArray = auxPixelArray;
+        // Blurring
+        for (int x = 0; x < effectWidth; ++x) {
+            int pixelOffset = line + x;
+            float32x4_t result = vmulq_f32(sum, deltaX);
+            storeFloatAsRGBA8(result, destinationPixel+pixelOffset);
+            if (x >= dxLeft) {
+                float32x4_t sourcePixelAsFloat = loadRGBA8AsFloat(sourcePixel + pixelOffset - dxLeft);
+                sum = vsubq_f32(sum, sourcePixelAsFloat);
+            }
+            if (x + dxRight < effectWidth) {
+                float32x4_t sourcePixelAsFloat = loadRGBA8AsFloat(sourcePixel + pixelOffset + dxRight);
+                sum = vaddq_f32(sum, sourcePixelAsFloat);
+            }
         }
     }
 }
 
 } // namespace WebCore
 
-#endif // CPU(ARM_NEON) && COMPILER(GCC)
+#endif // ENABLE(FILTERS) && HAVE(ARM_NEON_INTRINSICS)
 
 #endif // FEGaussianBlurNEON_h
diff --git a/Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h b/Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h
new file mode 100644
index 000000000..78a32418e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 University of Szeged
+ * Copyright (C) 2012 Gabor Rapcsanyi
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NEONHelpers_h
+#define NEONHelpers_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(FILTERS) && HAVE(ARM_NEON_INTRINSICS)
+
+#include <arm_neon.h>
+
+namespace WebCore {
+
+inline float32x4_t loadRGBA8AsFloat(uint32_t* source)
+{
+    uint32x2_t temporary1 = vset_lane_u32(*source, temporary1, 0);
+    uint16x4_t temporary2 = vget_low_u16(vmovl_u8(vreinterpret_u8_u32(temporary1)));
+    return vcvtq_f32_u32(vmovl_u16(temporary2));
+}
+
+inline void storeFloatAsRGBA8(float32x4_t data, uint32_t* destination)
+{
+    uint16x4_t temporary1 = vmovn_u32(vcvtq_u32_f32(data));
+    uint8x8_t temporary2 = vmovn_u16(vcombine_u16(temporary1, temporary1));
+    *destination = vget_lane_u32(vreinterpret_u32_u8(temporary2), 0);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILTERS) && HAVE(ARM_NEON_INTRINSICS)
+
+#endif // NEONHelpers_h
diff --git a/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp b/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp
index 194a5aae5..9496fc91a 100644
--- a/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp
+++ b/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp
@@ -311,7 +311,7 @@ void GLContextGLX::swapBuffers()
         glXSwapBuffers(sharedDisplay(), m_window);
 }
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 PlatformGraphicsContext3D GLContextGLX::platformContext()
 {
     return m_context;
@@ -320,4 +320,4 @@ PlatformGraphicsContext3D GLContextGLX::platformContext()
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL) || && USE(TEXTURE_MAPPER_GL)
+#endif // USE(GLX)
diff --git a/Source/WebCore/platform/graphics/glx/GLContextGLX.h b/Source/WebCore/platform/graphics/glx/GLContextGLX.h
index 118edd41d..5e8c61ce4 100644
--- a/Source/WebCore/platform/graphics/glx/GLContextGLX.h
+++ b/Source/WebCore/platform/graphics/glx/GLContextGLX.h
@@ -48,7 +48,7 @@ public:
     virtual bool canRenderToDefaultFramebuffer();
     virtual IntSize defaultFrameBufferSize();
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
     virtual PlatformGraphicsContext3D platformContext();
 #endif
 
diff --git a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
index c58c3c6a7..fe51104f0 100644
--- a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
+++ b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
+#if ENABLE(ACCELERATED_2D_CANVAS) || USE(3D_GRAPHICS)
 
 #include "DrawingBuffer.h"
 
diff --git a/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm b/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
index 5154fd715..40dc2a51e 100644
--- a/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
+++ b/Source/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
+#if ENABLE(ACCELERATED_2D_CANVAS) || USE(3D_GRAPHICS)
 
 #include "DrawingBuffer.h"
 
diff --git a/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp b/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp
index 23d28b2fa..17a59a418 100644
--- a/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/gpu/qt/DrawingBufferQt.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "DrawingBuffer.h"
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index e9d1bc119..f2b86b27e 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -495,6 +495,9 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     if (!hasVideo())
         return IntSize();
 
+    if (!m_videoSize.isEmpty())
+        return m_videoSize;
+
     GstCaps* caps = webkitGstGetPadCaps(m_videoSinkPad.get());
     if (!caps)
         return IntSize();
@@ -542,7 +545,8 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     }
 
     LOG_VERBOSE(Media, "Natural size: %" G_GUINT64_FORMAT "x%" G_GUINT64_FORMAT, width, height);
-    return IntSize(static_cast<int>(width), static_cast<int>(height));
+    m_videoSize = IntSize(static_cast<int>(width), static_cast<int>(height));
+    return m_videoSize;
 }
 
 void MediaPlayerPrivateGStreamer::videoChanged()
@@ -561,6 +565,9 @@ void MediaPlayerPrivateGStreamer::notifyPlayerOfVideo()
         g_object_get(m_playBin, "n-video", &videoTracks, NULL);
 
     m_hasVideo = videoTracks > 0;
+
+    m_videoSize = IntSize();
+
     m_player->mediaPlayerClient()->mediaPlayerEngineUpdated(m_player);
 }
 
@@ -1719,9 +1726,13 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
             g_object_set(m_fpsSink, "silent", TRUE , NULL);
 
             // Turn off text overlay unless logging is enabled.
+#if LOG_DISABLED
+            g_object_set(m_fpsSink, "text-overlay", FALSE , NULL);
+#else
             WTFLogChannel* channel = getChannelFromName("Media");
             if (channel->state != WTFLogChannelOn)
                 g_object_set(m_fpsSink, "text-overlay", FALSE , NULL);
+#endif // LOG_DISABLED
 
             if (g_object_class_find_property(G_OBJECT_GET_CLASS(m_fpsSink), "video-sink")) {
                 g_object_set(m_fpsSink, "video-sink", m_webkitVideoSink, NULL);
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index 506942c2b..9e277ccf2 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -194,6 +194,7 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             guint m_videoTimerHandler;
             GRefPtr<GstElement> m_webkitAudioSink;
             GRefPtr<GstPad> m_videoSinkPad;
+            mutable IntSize m_videoSize;
     };
 }
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
index ba46c7f02..9191d9df6 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
@@ -80,6 +80,11 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     m_item.string = m_normalizedBuffer.get();
     m_item.stringLength = m_normalizedBufferLength;
 
+#if OS(ANDROID)
+    // Kerning does not currently work on Android.
+    m_item.shaperFlags = HB_ShaperFlag_NoKerning;
+#endif
+
     reset(startingX);
     m_startingY = startingY;
 
@@ -209,29 +214,41 @@ const FontPlatformData* ComplexTextController::getComplexFontPlatformData()
     case HB_Script_Arabic:
         fallbackScript = kArabic_FallbackScript;
         break;
+    case HB_Script_Armenian:
+        fallbackScript = kArmenian_FallbackScript;
+        break;
+    case HB_Script_Bengali:
+        fallbackScript = kBengali_FallbackScript;
+        break;
+    case HB_Script_Devanagari:
+        fallbackScript = kDevanagari_FallbackScript;
+        break;
+    case HB_Script_Georgian:
+        fallbackScript = kGeorgian_FallbackScript;
+        break;
     case HB_Script_Hebrew:
         if (m_font->fontDescription().weight() >= FontWeightBold)
             fallbackScript = kHebrewBold_FallbackScript;
         else
             fallbackScript = kHebrewRegular_FallbackScript;
         break;
-    case HB_Script_Thai:
-        fallbackScript = kThai_FallbackScript;
-        break;
-    case HB_Script_Armenian:
-        fallbackScript = kArmenian_FallbackScript;
+    case HB_Script_Kannada:
+        fallbackScript = kKannada_FallbackScript;
         break;
-    case HB_Script_Georgian:
-        fallbackScript = kGeorgian_FallbackScript;
+    case HB_Script_Malayalam:
+        fallbackScript = kMalayalam_FallbackScript;
         break;
-    case HB_Script_Devanagari:
-        fallbackScript = kDevanagari_FallbackScript;
+    case HB_Script_Tamil:
+        if (m_font->fontDescription().weight() >= FontWeightBold)
+            fallbackScript = kTamilBold_FallbackScript;
+        else
+            fallbackScript = kTamilRegular_FallbackScript;
         break;
-    case HB_Script_Bengali:
-        fallbackScript = kBengali_FallbackScript;
+    case HB_Script_Telugu:
+        fallbackScript = kTelugu_FallbackScript;
         break;
-    case HB_Script_Tamil:
-        fallbackScript = kTamil_FallbackScript;
+    case HB_Script_Thai:
+        fallbackScript = kThai_FallbackScript;
         break;
     default:
         return 0;
diff --git a/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
index 9370f676b..cc8efeb43 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/FontHarfBuzz.cpp
@@ -31,11 +31,16 @@
 #include "config.h"
 #include "Font.h"
 
+#if USE(HARFBUZZ_NG)
+#include "HarfBuzzShaper.h"
+#else
 #include "ComplexTextControllerHarfBuzz.h"
+#include "HarfBuzzSkia.h"
+#endif
+
 #include "FloatRect.h"
 #include "GlyphBuffer.h"
 #include "GraphicsContext.h"
-#include "HarfBuzzSkia.h"
 #include "NotImplemented.h"
 #include "PlatformContextSkia.h"
 #include "SimpleFontData.h"
@@ -158,7 +163,6 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
     if (!run.length())
         return;
 
-    SkCanvas* canvas = gc->platformContext()->canvas();
     TextDrawingModeFlags textMode = gc->platformContext()->getTextDrawingMode();
     bool fill = textMode & TextModeFill;
     bool stroke = (textMode & TextModeStroke)
@@ -178,6 +182,14 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
         setupForTextPainting(&strokePaint, gc->strokeColor().rgb());
     }
 
+#if USE(HARFBUZZ_NG)
+    GlyphBuffer glyphBuffer;
+    HarfBuzzShaper shaper(this, run);
+    if (!shaper.shape(&glyphBuffer))
+        return;
+    drawGlyphBuffer(gc, run, glyphBuffer, point);
+#else
+    SkCanvas* canvas = gc->platformContext()->canvas();
     ComplexTextController controller(this, run, point.x(), point.y());
     if (run.rtl())
         controller.setupForRTL();
@@ -201,6 +213,7 @@ void Font::drawComplexText(GraphicsContext* gc, const TextRun& run,
             canvas->drawPosText(controller.glyphs() + fromGlyph, glyphLength << 1, controller.positions() + fromGlyph, strokePaint);
         }
     }
+#endif
 }
 
 void Font::drawEmphasisMarksForComplexText(GraphicsContext* /* context */, const TextRun& /* run */, const AtomicString& /* mark */, const FloatPoint& /* point */, int /* from */, int /* to */) const
@@ -210,8 +223,15 @@ void Font::drawEmphasisMarksForComplexText(GraphicsContext* /* context */, const
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */, GlyphOverflow* /* glyphOverflow */) const
 {
+#if USE(HARFBUZZ_NG)
+    HarfBuzzShaper shaper(this, run);
+    if (!shaper.shape())
+        return 0;
+    return shaper.totalWidth();
+#else
     ComplexTextController controller(this, run, 0, 0);
     return controller.widthOfFullRun();
+#endif
 }
 
 // Return the code point index for the given |x| offset into the text run.
@@ -222,12 +242,19 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat,
     // to Font::offsetForPosition(). Bug http://webkit.org/b/40673 tracks fixing this problem.
     int targetX = static_cast<int>(xFloat);
 
+#if USE(HARFBUZZ_NG)
+    HarfBuzzShaper shaper(this, run);
+    if (!shaper.shape())
+        return 0;
+    return shaper.offsetForPosition(targetX);
+#else
     // (Mac code ignores includePartialGlyphs, and they don't know what it's
     // supposed to do, so we just ignore it as well.)
     ComplexTextController controller(this, run, 0, 0);
     if (run.rtl())
         controller.setupForRTL();
     return controller.offsetForPosition(targetX);
+#endif
 }
 
 // Return the rectangle for selecting the given range of code-points in the TextRun.
@@ -235,10 +262,17 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run,
                                             const FloatPoint& point, int height,
                                             int from, int to) const
 {
+#if USE(HARFBUZZ_NG)
+    HarfBuzzShaper shaper(this, run);
+    if (!shaper.shape())
+        return FloatRect();
+    return shaper.selectionRect(point, height, from, to);
+#else
     ComplexTextController controller(this, run, 0, 0);
     if (run.rtl())
         controller.setupForRTL();
     return controller.selectionRect(point, height, from, to);
+#endif
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp b/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp
index 54df77063..695531cc1 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.cpp
@@ -251,6 +251,15 @@ bool FontPlatformData::isFixedPitch() const
     return false;
 }
 
+#if USE(HARFBUZZ_NG)
+HarfBuzzFace* FontPlatformData::harfbuzzFace() const
+{
+    if (!m_harfbuzzFace)
+        m_harfbuzzFace = HarfBuzzFace::create(const_cast<FontPlatformData*>(this), uniqueID());
+
+    return m_harfbuzzFace.get();
+}
+#else
 HarfbuzzFace* FontPlatformData::harfbuzzFace() const
 {
     if (!m_harfbuzzFace)
@@ -258,21 +267,10 @@ HarfbuzzFace* FontPlatformData::harfbuzzFace() const
 
     return m_harfbuzzFace.get();
 }
+#endif
 
 void FontPlatformData::querySystemForRenderStyle()
 {
-    if (!m_family.length()) {
-        // We don't have a family for this, probably because it's a webfont. We
-        // set all the values to 'no preference' and take the system defaults.
-        m_style.useBitmaps = FontRenderStyle::NoPreference;
-        m_style.useAutoHint = FontRenderStyle::NoPreference;
-        m_style.useHinting = FontRenderStyle::NoPreference;
-        m_style.useAntiAlias = FontRenderStyle::NoPreference;
-        m_style.useSubpixelRendering = FontRenderStyle::NoPreference;
-        m_style.useSubpixelPositioning = FontRenderStyle::NoPreference;
-        return;
-    }
-
     PlatformSupport::getRenderStyleForStrike(m_family.data(), (((int)m_textSize) << 2) | (m_typeface->style() & 3), &m_style);
 }
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h b/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h
index 246a7a49c..b4423f400 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h
+++ b/Source/WebCore/platform/graphics/harfbuzz/FontPlatformDataHarfBuzz.h
@@ -33,7 +33,11 @@
 
 #include "FontOrientation.h"
 #include "FontRenderStyle.h"
+#if USE(HARFBUZZ_NG)
+#include "HarfBuzzFace.h"
+#else
 #include "HarfBuzzSkia.h"
+#endif
 #include "SkPaint.h"
 #include "TextOrientation.h"
 #include <wtf/Forward.h>
@@ -128,7 +132,12 @@ public:
     String description() const;
 #endif
 
+#if USE(HARFBUZZ_NG)
+    // FIXME: Rename this like "harfbuzzNGFace()" because difference is too subtle.
+    HarfBuzzFace* harfbuzzFace() const;
+#else
     HarfbuzzFace* harfbuzzFace() const;
+#endif
 
     // -------------------------------------------------------------------------
     // Global font preferences...
@@ -153,7 +162,11 @@ private:
     FontOrientation m_orientation;
     TextOrientation m_textOrientation;
     FontRenderStyle m_style;
+#if USE(HARFBUZZ_NG)
+    mutable RefPtr<HarfBuzzFace> m_harfbuzzFace;
+#else
     mutable RefPtr<HarfbuzzFace> m_harfbuzzFace;
+#endif
 
     SkTypeface* hashTableDeletedFontValue() const { return reinterpret_cast<SkTypeface*>(-1); }
 };
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp
index 6209e704b..966589db9 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceCoreText.cpp
@@ -109,8 +109,10 @@ static void releaseTableData(void* userData)
 static hb_blob_t* harfbuzzCoreTextGetTable(hb_face_t* face, hb_tag_t tag, void* userData)
 {
     FontPlatformData* platformData = reinterpret_cast<FontPlatformData*>(userData);
-    CTFontRef ctFont = platformData->ctFont();
-    CFDataRef cfData = CTFontCopyTable(ctFont, tag, kCTFontTableOptionNoOptions);
+    // It seems that CTFontCopyTable of MacOSX10.5 sdk doesn't work for
+    // OpenType layout tables(GDEF, GSUB, GPOS). Use CGFontCopyTableForTag instead.
+    CGFontRef cgFont = platformData->cgFont();
+    CFDataRef cfData = CGFontCopyTableForTag(cgFont, tag);
     if (!cfData)
         return 0;
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp
new file mode 100644
index 000000000..f29bdb91d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzFaceSkia.cpp
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HarfBuzzFace.h"
+
+#include "FontPlatformData.h"
+#include "GlyphBuffer.h"
+#include "HarfBuzzShaper.h"
+#include "SimpleFontData.h"
+#include "SkFontHost.h"
+#include "SkPaint.h"
+#include "SkPath.h"
+#include "SkPoint.h"
+#include "SkRect.h"
+#include "SkUtils.h"
+
+#include "hb.h"
+
+namespace WebCore {
+
+// Our implementation of the callbacks which Harfbuzz requires by using Skia
+// calls. See the Harfbuzz source for references about what these callbacks do.
+
+static hb_position_t SkiaScalarToHarfbuzzPosition(SkScalar value)
+{
+    return SkScalarToFixed(value);
+}
+
+static void SkiaGetGlyphWidthAndExtents(SkPaint* paint, hb_codepoint_t codepoint, hb_position_t* width, hb_glyph_extents_t* extents)
+{
+    if (codepoint > 0xFFFF)
+        return;
+    paint->setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+
+    SkScalar skWidth;
+    SkRect skBounds;
+    uint16_t glyph = codepoint;
+
+    paint->getTextWidths(&glyph, sizeof(glyph), &skWidth, &skBounds);
+    if (width)
+        *width = SkiaScalarToHarfbuzzPosition(skWidth);
+    if (extents) {
+        extents->x_bearing = SkiaScalarToHarfbuzzPosition(skBounds.fLeft);
+        // The extents are unused in harfbuzz now so we're unsure whether a negation is needed here. Revisit when we're sure.
+        extents->y_bearing = SkiaScalarToHarfbuzzPosition(skBounds.fTop);
+        extents->width = SkiaScalarToHarfbuzzPosition(skBounds.width());
+        extents->height = SkiaScalarToHarfbuzzPosition(skBounds.height());
+    }
+}
+
+static hb_bool_t harfbuzzGetGlyph(hb_font_t* hbFont, void* fontData, hb_codepoint_t unicode, hb_codepoint_t variationSelector, hb_codepoint_t* glyph, void* userData)
+{
+    SkPaint* paint = reinterpret_cast<SkPaint*>(fontData);
+
+    paint->setTextEncoding(SkPaint::kUTF16_TextEncoding);
+    uint16_t text[4];
+    size_t length = SkUTF16_FromUnichar(unicode, text);
+    uint16_t glyph16;
+    paint->textToGlyphs(text, length, &glyph16);
+    *glyph = glyph16;
+    return !!*glyph;
+}
+
+static hb_position_t harfbuzzGetGlyphHorizontalAdvance(hb_font_t* hbFont, void* fontData, hb_codepoint_t glyph, void* userData)
+{
+    SkPaint* paint = reinterpret_cast<SkPaint*>(fontData);
+    hb_position_t advance = 0;
+
+    SkiaGetGlyphWidthAndExtents(paint, glyph, &advance, 0);
+    return advance;
+}
+
+static hb_bool_t harfbuzzGetGlyphHorizontalOrigin(hb_font_t* hbFont, void* fontData, hb_codepoint_t glyph, hb_position_t* x, hb_position_t* y, void* userData)
+{
+    // Just return true, following the way that Harfbuzz-FreeType
+    // implementation does.
+    return true;
+}
+
+static hb_bool_t harfbuzzGetGlyphExtents(hb_font_t* hbFont, void* fontData, hb_codepoint_t glyph, hb_glyph_extents_t* extents, void* userData)
+{
+    SkPaint* paint = reinterpret_cast<SkPaint*>(fontData);
+
+    SkiaGetGlyphWidthAndExtents(paint, glyph, 0, extents);
+    return true;
+}
+
+static hb_font_funcs_t* harfbuzzSkiaGetFontFuncs()
+{
+    static hb_font_funcs_t* harfbuzzSkiaFontFuncs = 0;
+
+    // We don't set callback functions which we can't support.
+    // Harfbuzz will use the fallback implementation if they aren't set.
+    if (!harfbuzzSkiaFontFuncs) {
+        harfbuzzSkiaFontFuncs = hb_font_funcs_create();
+        hb_font_funcs_set_glyph_func(harfbuzzSkiaFontFuncs, harfbuzzGetGlyph, 0, 0);
+        hb_font_funcs_set_glyph_h_advance_func(harfbuzzSkiaFontFuncs, harfbuzzGetGlyphHorizontalAdvance, 0, 0);
+        hb_font_funcs_set_glyph_h_origin_func(harfbuzzSkiaFontFuncs, harfbuzzGetGlyphHorizontalOrigin, 0, 0);
+        hb_font_funcs_set_glyph_extents_func(harfbuzzSkiaFontFuncs, harfbuzzGetGlyphExtents, 0, 0);
+        hb_font_funcs_make_immutable(harfbuzzSkiaFontFuncs);
+    }
+    return harfbuzzSkiaFontFuncs;
+}
+
+static hb_blob_t* harfbuzzSkiaGetTable(hb_face_t* face, hb_tag_t tag, void* userData)
+{
+    FontPlatformData* font = reinterpret_cast<FontPlatformData*>(userData);
+
+    const size_t tableSize = SkFontHost::GetTableSize(font->uniqueID(), tag);
+    if (!tableSize)
+        return 0;
+
+    char* buffer = reinterpret_cast<char*>(fastMalloc(tableSize));
+    if (!buffer)
+        return 0;
+    size_t actualSize = SkFontHost::GetTableData(font->uniqueID(), tag, 0, tableSize, buffer);
+    if (tableSize != actualSize) {
+        fastFree(buffer);
+        return 0;
+    }
+
+    return hb_blob_create(const_cast<char*>(buffer), tableSize,
+                          HB_MEMORY_MODE_WRITABLE, buffer, fastFree);
+}
+
+static void destroyPaint(void* userData)
+{
+    SkPaint* paint = reinterpret_cast<SkPaint*>(userData);
+    delete paint;
+}
+
+hb_face_t* HarfBuzzFace::createFace()
+{
+    hb_face_t* face = hb_face_create_for_tables(harfbuzzSkiaGetTable, m_platformData, 0);
+    ASSERT(face);
+    return face;
+}
+
+hb_font_t* HarfBuzzFace::createFont()
+{
+    hb_font_t* font = hb_font_create(m_face);
+    SkPaint* paint = new SkPaint;
+    m_platformData->setupPaint(paint);
+    hb_font_set_funcs(font, harfbuzzSkiaGetFontFuncs(), paint, destroyPaint);
+    float size = m_platformData->size();
+    if (floorf(size) == size)
+        hb_font_set_ppem(font, size, size);
+    int scale = SkiaScalarToHarfbuzzPosition(size);
+    hb_font_set_scale(font, scale, scale);
+    hb_font_make_immutable(font);
+    return font;
+}
+
+GlyphBufferAdvance HarfBuzzShaper::createGlyphBufferAdvance(float width, float height)
+{
+    return GlyphBufferAdvance(width, height);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
index 6614adbde..a9324d37f 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
@@ -208,7 +208,7 @@ static bool advanceByCombiningCharacterSequence(const UChar*& iterator, const UC
         UChar32 nextCharacter;
         int markLength = 0;
         U16_NEXT(iterator, markLength, end - iterator, nextCharacter);
-        if (!(U_GET_GC_MASK(nextCharacter) & U_GC_M_MASK) && nextCharacter != zeroWidthJoiner && nextCharacter != zeroWidthNonJoiner)
+        if (!(U_GET_GC_MASK(nextCharacter) & U_GC_M_MASK))
             break;
         markCount += markLength;
         iterator += markLength;
@@ -284,13 +284,17 @@ void ComplexTextController::collectComplexTextRuns()
         }
 
         nextIsMissingGlyph = false;
+        if (baseCharacter == zeroWidthJoiner)
+            nextFontData = fontData;
 #if !PLATFORM(WX)
-        nextFontData = m_font.fontDataForCombiningCharacterSequence(cp + index, curr - cp - index, nextIsSmallCaps ? SmallCapsVariant : NormalVariant);
-        if (!nextFontData) {
-            if (markCount)
-                nextFontData = systemFallbackFontData();
-            else
-                nextIsMissingGlyph = true;
+        else {
+            nextFontData = m_font.fontDataForCombiningCharacterSequence(cp + index, curr - cp - index, nextIsSmallCaps ? SmallCapsVariant : NormalVariant);
+            if (!nextFontData) {
+                if (markCount)
+                    nextFontData = systemFallbackFontData();
+                else
+                    nextIsMissingGlyph = true;
+            }
         }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
index 98a53f9f1..45a6691b8 100644
--- a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
@@ -68,11 +68,14 @@ bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned b
         }
     } else if (!fontData->platformData().isCompositeFontReference() && ((fontData->platformData().widthVariant() == RegularWidth) ? wkGetVerticalGlyphsForCharacters(fontData->platformData().ctFont(), buffer, glyphs.data(), bufferLength)
                : CTFontGetGlyphsForCharacters(fontData->platformData().ctFont(), buffer, glyphs.data(), bufferLength))) {
+        // When buffer consists of surrogate pairs, wkGetVerticalGlyphsForCharacters and CTFontGetGlyphsForCharacters
+        // place the glyphs at indices corresponding to the first character of each pair.
+        unsigned glyphStep = bufferLength / length;
         for (unsigned i = 0; i < length; ++i) {
-            if (!glyphs[i])
+            if (!glyphs[i * glyphStep])
                 setGlyphDataForIndex(offset + i, 0, 0);
             else {
-                setGlyphDataForIndex(offset + i, glyphs[i], fontData);
+                setGlyphDataForIndex(offset + i, glyphs[i * glyphStep], fontData);
                 haveGlyphs = true;
             }
         }
diff --git a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
index cd01522ef..d042c660c 100644
--- a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
+++ b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
 
@@ -282,6 +282,12 @@ void GraphicsContext3D::setErrorMessageCallback(PassOwnPtr<ErrorMessageCallback>
 {
 }
 
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    makeContextCurrent();
+    notImplemented();
+}
+
 }
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm b/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
index b5ee110e2..9736e74dc 100644
--- a/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
@@ -50,6 +50,11 @@ using namespace WebCore;
     return YES;
 }
 
++ (unsigned int)prefetchedTiles
+{
+    return 2;
+}
+
 // Disable default animations
 - (id<CAAction>)actionForKey:(NSString *)key
 {
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index 4aa341c32..9319ff8d3 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "Extensions3DOpenGL.h"
 
@@ -42,8 +42,7 @@
 namespace WebCore {
 
 Extensions3DOpenGL::Extensions3DOpenGL(GraphicsContext3D* context)
-    : m_initializedAvailableExtensions(false)
-    , m_context(context)
+    : Extensions3DOpenGLCommon(context)
 {
 }
 
@@ -51,91 +50,6 @@ Extensions3DOpenGL::~Extensions3DOpenGL()
 {
 }
 
-bool Extensions3DOpenGL::supports(const String& name)
-{
-    // Note on support for BGRA:
-    //
-    // For OpenGL ES2.0, requires checking for
-    // GL_EXT_texture_format_BGRA8888 and GL_EXT_read_format_bgra.
-    // For desktop GL, BGRA has been supported since OpenGL 1.2.
-    //
-    // However, note that the GL ES2 extension requires the
-    // internalFormat to glTexImage2D() be GL_BGRA, while desktop GL
-    // will not accept GL_BGRA (must be GL_RGBA), so this must be
-    // checked on each platform. Desktop GL offers neither
-    // GL_EXT_texture_format_BGRA8888 or GL_EXT_read_format_bgra, so
-    // treat them as unsupported here.
-    if (!m_initializedAvailableExtensions) {
-        String extensionsString(reinterpret_cast<const char*>(::glGetString(GL_EXTENSIONS)));
-        Vector<String> availableExtensions;
-        extensionsString.split(" ", availableExtensions);
-        for (size_t i = 0; i < availableExtensions.size(); ++i)
-            m_availableExtensions.add(availableExtensions[i]);
-        m_initializedAvailableExtensions = true;
-    }
-    
-    // GL_ANGLE_framebuffer_blit and GL_ANGLE_framebuffer_multisample are "fake". They are implemented using other
-    // extensions. In particular GL_EXT_framebuffer_blit and GL_EXT_framebuffer_multisample
-    if (name == "GL_ANGLE_framebuffer_blit")
-        return m_availableExtensions.contains("GL_EXT_framebuffer_blit");
-    if (name == "GL_ANGLE_framebuffer_multisample")
-        return m_availableExtensions.contains("GL_EXT_framebuffer_multisample");
-
-    // Desktop GL always supports GL_OES_rgb8_rgba8.
-    if (name == "GL_OES_rgb8_rgba8")
-        return true;
-
-    // If GL_ARB_texture_float is available then we report GL_OES_texture_float and
-    // GL_OES_texture_half_float as available.
-    if (name == "GL_OES_texture_float" || name == "GL_OES_texture_half_float")
-        return m_availableExtensions.contains("GL_ARB_texture_float");
-    
-    // GL_OES_vertex_array_object
-    if (name == "GL_OES_vertex_array_object")
-        return m_availableExtensions.contains("GL_APPLE_vertex_array_object");
-
-    // Desktop GL always supports the standard derivative functions
-    if (name == "GL_OES_standard_derivatives")
-        return true;
-
-    if (name == "GL_EXT_texture_filter_anisotropic")
-        return m_availableExtensions.contains("GL_EXT_texture_filter_anisotropic");
-
-    return m_availableExtensions.contains(name);
-}
-
-void Extensions3DOpenGL::ensureEnabled(const String& name)
-{
-#if PLATFORM(MAC) || PLATFORM(QT) || PLATFORM(GTK)
-    if (name == "GL_OES_standard_derivatives") {
-        // Enable support in ANGLE (if not enabled already)
-        ANGLEWebKitBridge& compiler = m_context->m_compiler;
-        ShBuiltInResources ANGLEResources = compiler.getResources();
-        if (!ANGLEResources.OES_standard_derivatives) {
-            ANGLEResources.OES_standard_derivatives = 1;
-            compiler.setResources(ANGLEResources);
-        }
-    }
-#else
-    ASSERT_UNUSED(name, supports(name));
-#endif
-}
-
-bool Extensions3DOpenGL::isEnabled(const String& name)
-{
-#if PLATFORM(MAC) || PLATFORM(QT) || PLATFORM(GTK)
-    if (name == "GL_OES_standard_derivatives") {
-        ANGLEWebKitBridge& compiler = m_context->m_compiler;
-        return compiler.getResources().OES_standard_derivatives;
-    }
-#endif
-    return supports(name);
-}
-
-int Extensions3DOpenGL::getGraphicsResetStatusARB()
-{
-    return GraphicsContext3D::NO_ERROR;
-}
 
 void Extensions3DOpenGL::blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter)
 {
@@ -194,19 +108,49 @@ void Extensions3DOpenGL::bindVertexArrayOES(Platform3DObject array)
 #endif
 }
 
-String Extensions3DOpenGL::getTranslatedShaderSourceANGLE(Platform3DObject shader)
-{
-    UNUSED_PARAM(shader);
-    return "";
-    // FIXME: implement this function and add GL_ANGLE_translated_shader_source in supports().
-}
-
 void Extensions3DOpenGL::copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum)
 {
     // FIXME: implement this function and add GL_CHROMIUM_copy_texture in supports().
     return;
 }
 
+bool Extensions3DOpenGL::supportsExtension(const String& name)
+{
+    // GL_ANGLE_framebuffer_blit and GL_ANGLE_framebuffer_multisample are "fake". They are implemented using other
+    // extensions. In particular GL_EXT_framebuffer_blit and GL_EXT_framebuffer_multisample
+    if (name == "GL_ANGLE_framebuffer_blit")
+        return m_availableExtensions.contains("GL_EXT_framebuffer_blit");
+    if (name == "GL_ANGLE_framebuffer_multisample")
+        return m_availableExtensions.contains("GL_EXT_framebuffer_multisample");
+
+    // Desktop GL always supports GL_OES_rgb8_rgba8.
+    if (name == "GL_OES_rgb8_rgba8")
+        return true;
+
+    // If GL_ARB_texture_float is available then we report GL_OES_texture_float and
+    // GL_OES_texture_half_float as available.
+    if (name == "GL_OES_texture_float" || name == "GL_OES_texture_half_float")
+        return m_availableExtensions.contains("GL_ARB_texture_float");
+
+    // GL_OES_vertex_array_object
+    if (name == "GL_OES_vertex_array_object")
+        return m_availableExtensions.contains("GL_APPLE_vertex_array_object");
+
+    // Desktop GL always supports the standard derivative functions
+    if (name == "GL_OES_standard_derivatives")
+        return true;
+
+    if (name == "GL_EXT_texture_filter_anisotropic")
+        return m_availableExtensions.contains("GL_EXT_texture_filter_anisotropic");
+
+    return m_availableExtensions.contains(name);
+}
+
+String Extensions3DOpenGL::getExtensions()
+{
+    return String(reinterpret_cast<const char*>(::glGetString(GL_EXTENSIONS)));
+}
+
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
index 2b2d30a09..72eff9218 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.h
@@ -26,7 +26,7 @@
 #ifndef Extensions3DOpenGL_h
 #define Extensions3DOpenGL_h
 
-#include "Extensions3D.h"
+#include "Extensions3DOpenGLCommon.h"
 
 #include "GraphicsContext3D.h"
 #include <wtf/HashSet.h>
@@ -34,15 +34,11 @@
 
 namespace WebCore {
 
-class Extensions3DOpenGL : public Extensions3D {
+class Extensions3DOpenGL : public Extensions3DOpenGLCommon {
 public:
     virtual ~Extensions3DOpenGL();
 
     // Extensions3D methods.
-    virtual bool supports(const String&);
-    virtual void ensureEnabled(const String&);
-    virtual bool isEnabled(const String&);
-    virtual int getGraphicsResetStatusARB();
     virtual void blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter);
     virtual void renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height);
     
@@ -50,19 +46,15 @@ public:
     virtual void deleteVertexArrayOES(Platform3DObject);
     virtual GC3Dboolean isVertexArrayOES(Platform3DObject);
     virtual void bindVertexArrayOES(Platform3DObject);
-    virtual String getTranslatedShaderSourceANGLE(Platform3DObject);
     virtual void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum);
 
-private:
+protected:
     // This class only needs to be instantiated by GraphicsContext3D implementations.
     friend class GraphicsContext3D;
     Extensions3DOpenGL(GraphicsContext3D*);
 
-    bool m_initializedAvailableExtensions;
-    HashSet<String> m_availableExtensions;
-    
-    // Weak pointer back to GraphicsContext3D
-    GraphicsContext3D* m_context;
+    virtual bool supportsExtension(const WTF::String&);
+    virtual String getExtensions();
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
new file mode 100644
index 000000000..57723560c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.cpp
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEBGL)
+#include "Extensions3DOpenGLCommon.h"
+
+#include "ANGLEWebKitBridge.h"
+#include "GraphicsContext3D.h"
+
+#if PLATFORM(BLACKBERRY)
+#include <BlackBerryPlatformLog.h>
+#endif
+
+#if USE(OPENGL_ES_2)
+#include "OpenGLESShims.h"
+#include <GLES2/gl2.h>
+#include <GLES2/gl2ext.h>
+#elif PLATFORM(MAC)
+#include <OpenGL/gl.h>
+#elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
+#include "OpenGLShims.h"
+#endif
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+Extensions3DOpenGLCommon::Extensions3DOpenGLCommon(GraphicsContext3D* context)
+    : m_initializedAvailableExtensions(false)
+    , m_context(context)
+{
+}
+
+Extensions3DOpenGLCommon::~Extensions3DOpenGLCommon()
+{
+}
+
+bool Extensions3DOpenGLCommon::supports(const String& name)
+{
+    if (!m_initializedAvailableExtensions)
+        initializeAvailableExtensions();
+
+    return supportsExtension(name);
+}
+
+void Extensions3DOpenGLCommon::ensureEnabled(const String& name)
+{
+    if (name == "GL_OES_standard_derivatives") {
+        // Enable support in ANGLE (if not enabled already)
+        ANGLEWebKitBridge& compiler = m_context->m_compiler;
+        ShBuiltInResources ANGLEResources = compiler.getResources();
+        if (!ANGLEResources.OES_standard_derivatives) {
+            ANGLEResources.OES_standard_derivatives = 1;
+            compiler.setResources(ANGLEResources);
+        }
+    }
+}
+
+bool Extensions3DOpenGLCommon::isEnabled(const String& name)
+{
+    if (name == "GL_OES_standard_derivatives") {
+        ANGLEWebKitBridge& compiler = m_context->m_compiler;
+        return compiler.getResources().OES_standard_derivatives;
+    }
+    return supports(name);
+}
+
+int Extensions3DOpenGLCommon::getGraphicsResetStatusARB()
+{
+    return GraphicsContext3D::NO_ERROR;
+}
+
+String Extensions3DOpenGLCommon::getTranslatedShaderSourceANGLE(Platform3DObject shader)
+{
+    ASSERT(shader);
+    int GLshaderType;
+    ANGLEShaderType shaderType;
+
+    ANGLEWebKitBridge& compiler = m_context->m_compiler;
+
+    m_context->getShaderiv(shader, GraphicsContext3D::SHADER_TYPE, &GLshaderType);
+
+    if (GLshaderType == GraphicsContext3D::VERTEX_SHADER)
+        shaderType = SHADER_TYPE_VERTEX;
+    else if (GLshaderType == GraphicsContext3D::FRAGMENT_SHADER)
+        shaderType = SHADER_TYPE_FRAGMENT;
+    else
+        return ""; // Invalid shader type.
+
+    HashMap<Platform3DObject, GraphicsContext3D::ShaderSourceEntry>::iterator result = m_context->m_shaderSourceMap.find(shader);
+
+    if (result == m_context->m_shaderSourceMap.end())
+        return "";
+
+    GraphicsContext3D::ShaderSourceEntry& entry = result->second;
+
+    String translatedShaderSource;
+    String shaderInfoLog;
+
+    bool isValid = compiler.validateShaderSource(entry.source.utf8().data(), shaderType, translatedShaderSource, shaderInfoLog);
+
+    entry.log = shaderInfoLog;
+    entry.isValid = isValid;
+
+    if (!isValid)
+        return "";
+
+    return translatedShaderSource;
+}
+
+void Extensions3DOpenGLCommon::initializeAvailableExtensions()
+{
+    String extensionsString = getExtensions();
+    Vector<String> availableExtensions;
+    extensionsString.split(" ", availableExtensions);
+    for (size_t i = 0; i < availableExtensions.size(); ++i)
+        m_availableExtensions.add(availableExtensions[i]);
+    m_initializedAvailableExtensions = true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.h b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h
index d9bd748bf..2796d6fc9 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.h
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLCommon.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,37 +24,49 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef Extensions3DQt_h
-#define Extensions3DQt_h
+#ifndef Extensions3DOpenGLCommon_h
+#define Extensions3DOpenGLCommon_h
 
 #include "Extensions3D.h"
 
+#include "GraphicsContext3D.h"
+#include <wtf/HashSet.h>
+#include <wtf/text/StringHash.h>
+
 namespace WebCore {
 
-class Extensions3DQt : public Extensions3D {
+class Extensions3DOpenGLCommon : public Extensions3D {
 public:
-    virtual ~Extensions3DQt();
+    virtual ~Extensions3DOpenGLCommon();
 
     // Extensions3D methods.
     virtual bool supports(const String&);
     virtual void ensureEnabled(const String&);
     virtual bool isEnabled(const String&);
     virtual int getGraphicsResetStatusARB();
-    virtual void blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter);
-    virtual void renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height);
-    virtual Platform3DObject createVertexArrayOES();
-    virtual void deleteVertexArrayOES(Platform3DObject);
-    virtual GC3Dboolean isVertexArrayOES(Platform3DObject);
-    virtual void bindVertexArrayOES(Platform3DObject);
+
+    virtual Platform3DObject createVertexArrayOES() = 0;
+    virtual void deleteVertexArrayOES(Platform3DObject) = 0;
+    virtual GC3Dboolean isVertexArrayOES(Platform3DObject) = 0;
+    virtual void bindVertexArrayOES(Platform3DObject) = 0;
+
     virtual String getTranslatedShaderSourceANGLE(Platform3DObject);
-    virtual void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum);
 
-private:
-    // This class only needs to be instantiated by GraphicsContext3D implementations.
-    friend class GraphicsContext3D;
-    Extensions3DQt();
+protected:
+    Extensions3DOpenGLCommon(GraphicsContext3D*);
+
+    virtual bool supportsExtension(const String&) = 0;
+    virtual String getExtensions() = 0;
+
+    virtual void initializeAvailableExtensions();
+
+    bool m_initializedAvailableExtensions;
+    HashSet<String> m_availableExtensions;
+
+    // Weak pointer back to GraphicsContext3D
+    GraphicsContext3D* m_context;
 };
 
 } // namespace WebCore
 
-#endif // Extensions3DQt_h
+#endif // Extensions3DOpenGLCommon_h
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.cpp
new file mode 100644
index 000000000..e21f559ad
--- /dev/null
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.cpp
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(WEBGL)
+#include "Extensions3DOpenGLES.h"
+
+#include "GraphicsContext3D.h"
+#include <EGL/egl.h>
+#include <wtf/Vector.h>
+
+
+namespace WebCore {
+
+Extensions3DOpenGLES::Extensions3DOpenGLES(GraphicsContext3D* context)
+    : Extensions3DOpenGLCommon(context)
+    , m_supportsOESvertexArrayObject(false)
+    , m_supportsIMGMultisampledRenderToTexture(false)
+    , m_glFramebufferTexture2DMultisampleIMG(0)
+    , m_glRenderbufferStorageMultisampleIMG(0)
+    , m_glBindVertexArrayOES(0)
+    , m_glDeleteVertexArraysOES(0)
+    , m_glGenVertexArraysOES(0)
+    , m_glIsVertexArrayOES(0)
+{
+}
+
+Extensions3DOpenGLES::~Extensions3DOpenGLES()
+{
+}
+
+void Extensions3DOpenGLES::framebufferTexture2DMultisampleIMG(unsigned long target, unsigned long attachment, unsigned long textarget, unsigned int texture, int level, unsigned long samples)
+{
+    if (m_glFramebufferTexture2DMultisampleIMG)
+        m_glFramebufferTexture2DMultisampleIMG(target, attachment, textarget, texture, level, samples);
+    else
+        m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+void Extensions3DOpenGLES::renderbufferStorageMultisampleIMG(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    if (m_glRenderbufferStorageMultisampleIMG)
+        m_glRenderbufferStorageMultisampleIMG(target, samples, internalformat, width, height);
+    else
+        m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+Platform3DObject Extensions3DOpenGLES::createVertexArrayOES()
+{
+    m_context->makeContextCurrent();
+    if (m_glGenVertexArraysOES) {
+        GLuint array = 0;
+        m_glGenVertexArraysOES(1, &array);
+        return array;
+    }
+
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+    return 0;
+}
+
+void Extensions3DOpenGLES::deleteVertexArrayOES(Platform3DObject array)
+{
+    if (!array)
+        return;
+
+    m_context->makeContextCurrent();
+    if (m_glDeleteVertexArraysOES)
+        m_glDeleteVertexArraysOES(1, &array);
+    else
+        m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+GC3Dboolean Extensions3DOpenGLES::isVertexArrayOES(Platform3DObject array)
+{
+    if (!array)
+        return GL_FALSE;
+
+    m_context->makeContextCurrent();
+    if (m_glIsVertexArrayOES)
+        return m_glIsVertexArrayOES(array);
+
+    m_context->synthesizeGLError(GL_INVALID_OPERATION);
+    return false;
+}
+
+void Extensions3DOpenGLES::bindVertexArrayOES(Platform3DObject array)
+{
+    if (!array)
+        return;
+
+    m_context->makeContextCurrent();
+    if (m_glBindVertexArrayOES)
+        m_glBindVertexArrayOES(array);
+    else
+        m_context->synthesizeGLError(GL_INVALID_OPERATION);
+}
+
+
+bool Extensions3DOpenGLES::supportsExtension(const String& name)
+{
+    if (m_availableExtensions.contains(name)) {
+        if (name == "GL_OES_vertex_array_object" && !m_supportsOESvertexArrayObject) {
+            m_glBindVertexArrayOES = reinterpret_cast<PFNGLBINDVERTEXARRAYOESPROC>(eglGetProcAddress("glBindVertexArrayOES"));
+            m_glGenVertexArraysOES = reinterpret_cast<PFNGLGENVERTEXARRAYSOESPROC>(eglGetProcAddress("glGenVertexArraysOES"));
+            m_glDeleteVertexArraysOES = reinterpret_cast<PFNGLDELETEVERTEXARRAYSOESPROC>(eglGetProcAddress("glDeleteVertexArraysOES"));
+            m_glIsVertexArrayOES = reinterpret_cast<PFNGLISVERTEXARRAYOESPROC>(eglGetProcAddress("glIsVertexArrayOES"));
+            m_supportsOESvertexArrayObject = true;
+        } else if (name == "GL_IMG_multisampled_render_to_texture" && !m_supportsIMGMultisampledRenderToTexture) {
+            m_glFramebufferTexture2DMultisampleIMG = reinterpret_cast<PFNGLFRAMEBUFFERTEXTURE2DMULTISAMPLEIMGPROC>(eglGetProcAddress("glFramebufferTexture2DMultisampleIMG"));
+            m_glRenderbufferStorageMultisampleIMG = reinterpret_cast<PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMGPROC>(eglGetProcAddress("glRenderbufferStorageMultisampleIMG"));
+            m_supportsIMGMultisampledRenderToTexture = true;
+        }
+        return true;
+    }
+
+    return false;
+}
+
+String Extensions3DOpenGLES::getExtensions()
+{
+    return String(reinterpret_cast<const char*>(::glGetString(GL_EXTENSIONS)));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.h b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.h
new file mode 100644
index 000000000..3c460f9e2
--- /dev/null
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGLES.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Extensions3DOpenGLES_h
+#define Extensions3DOpenGLES_h
+
+#include "Extensions3DOpenGLCommon.h"
+
+#include <GLES2/gl2.h>
+#include <GLES2/gl2ext.h>
+
+namespace WebCore {
+
+class Extensions3DOpenGLES : public Extensions3DOpenGLCommon {
+public:
+    virtual ~Extensions3DOpenGLES();
+
+    virtual void framebufferTexture2DMultisampleIMG(unsigned long target, unsigned long attachment, unsigned long textarget, unsigned int texture, int level, unsigned long samples);
+    virtual void renderbufferStorageMultisampleIMG(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height);
+
+    virtual Platform3DObject createVertexArrayOES();
+    virtual void deleteVertexArrayOES(Platform3DObject);
+    virtual GC3Dboolean isVertexArrayOES(Platform3DObject);
+    virtual void bindVertexArrayOES(Platform3DObject);
+
+protected:
+    // This class only needs to be instantiated by GraphicsContext3D implementations.
+    friend class GraphicsContext3D;
+    Extensions3DOpenGLES(GraphicsContext3D*);
+
+    virtual bool supportsExtension(const String&);
+    virtual String getExtensions();
+
+    bool m_supportsOESvertexArrayObject;
+    bool m_supportsIMGMultisampledRenderToTexture;
+
+    PFNGLFRAMEBUFFERTEXTURE2DMULTISAMPLEIMGPROC m_glFramebufferTexture2DMultisampleIMG;
+    PFNGLRENDERBUFFERSTORAGEMULTISAMPLEIMGPROC m_glRenderbufferStorageMultisampleIMG;
+    PFNGLBINDVERTEXARRAYOESPROC m_glBindVertexArrayOES;
+    PFNGLDELETEVERTEXARRAYSOESPROC m_glDeleteVertexArraysOES;
+    PFNGLGENVERTEXARRAYSOESPROC m_glGenVertexArraysOES;
+    PFNGLISVERTEXARRAYOESPROC m_glIsVertexArrayOES;
+};
+
+} // namespace WebCore
+
+#endif // Extensions3DOpenGLES_h
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index 3f47b6e21..6753444f8 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
 
@@ -34,6 +35,12 @@
 #include "IntSize.h"
 #include "NotImplemented.h"
 
+#include <algorithm>
+#include <cstring>
+#include <wtf/MainThread.h>
+#include <wtf/UnusedParam.h>
+#include <wtf/text/CString.h>
+
 #if PLATFORM(MAC)
 #include <OpenGL/gl.h>
 #elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
@@ -47,6 +54,24 @@ void GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary(int x, int y, int
     ::glReadPixels(x, y, width, height, GL_BGRA, GL_UNSIGNED_INT_8_8_8_8_REV, pixels);
 }
 
+void GraphicsContext3D::validateAttributes()
+{
+    Extensions3D* extensions = getExtensions();
+    validateDepthStencil("GL_EXT_packed_depth_stencil");
+    if (m_attrs.antialias) {
+        bool isValidVendor = true;
+        // Currently in Mac we only turn on antialias if vendor is NVIDIA,
+        // or if ATI and on 10.7.2 and above.
+        const char* vendor = reinterpret_cast<const char*>(::glGetString(GL_VENDOR));
+        if (!vendor || (!std::strstr(vendor, "NVIDIA") && !(std::strstr(vendor, "ATI") && systemAllowsMultisamplingOnATICards())))
+            isValidVendor = false;
+        if (!isValidVendor || !extensions->supports("GL_ANGLE_framebuffer_multisample") || isGLES2Compliant())
+            m_attrs.antialias = false;
+        else
+            extensions->ensureEnabled("GL_ANGLE_framebuffer_multisample");
+    }
+}
+
 bool GraphicsContext3D::reshapeFBOs(const IntSize& size)
 {
     const int width = size.width();
@@ -256,6 +281,49 @@ void GraphicsContext3D::clearDepth(GC3Dclampf depth)
     ::glClearDepth(depth);
 }
 
+bool GraphicsContext3D::systemAllowsMultisamplingOnATICards() const
+{
+#if PLATFORM(MAC)
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    return true;
+#else
+    ASSERT(isMainThread());
+    static SInt32 version;
+    if (!version) {
+        if (Gestalt(gestaltSystemVersion, &version) != noErr)
+            return false;
+    }
+    // See https://bugs.webkit.org/show_bug.cgi?id=77922 for more details
+    return version >= 0x1072;
+#endif // SNOW_LEOPARD and LION
+#else
+    return false;
+#endif // PLATFORM(MAC)
+}
+
+Extensions3D* GraphicsContext3D::getExtensions()
+{
+    if (!m_extensions)
+        m_extensions = adoptPtr(new Extensions3DOpenGL(this));
+    return m_extensions.get();
+}
+
+void GraphicsContext3D::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data)
+{
+    // FIXME: remove the two glFlush calls when the driver bug is fixed, i.e.,
+    // all previous rendering calls should be done before reading pixels.
+    makeContextCurrent();
+    ::glFlush();
+    if (m_attrs.antialias && m_boundFBO == m_multisampleFBO) {
+        resolveMultisamplingIfNecessary(IntRect(x, y, width, height));
+        ::glBindFramebufferEXT(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+        ::glFlush();
+    }
+    ::glReadPixels(x, y, width, height, format, type, data);
+    if (m_attrs.antialias && m_boundFBO == m_multisampleFBO)
+        ::glBindFramebufferEXT(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO);
+}
+
 }
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
index 429fc51c9..9a7f4250d 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  * Copyright (C) 2012 ChangSeok Oh <shivamidow@gmail.com>
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,11 +28,16 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
 
+#include "CanvasRenderingContext.h"
+#if USE(OPENGL_ES_2)
+#include "Extensions3DOpenGLES.h"
+#else
 #include "Extensions3DOpenGL.h"
+#endif
 #include "GraphicsContext.h"
 #include "ImageBuffer.h"
 #include "ImageData.h"
@@ -49,39 +56,24 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
-#if PLATFORM(MAC)
+#if USE(OPENGL_ES_2)
+#include "OpenGLESShims.h"
+#elif PLATFORM(MAC)
 #include <OpenGL/gl.h>
 #elif PLATFORM(GTK) || PLATFORM(EFL) || PLATFORM(QT)
 #include "OpenGLShims.h"
 #endif
 
-namespace WebCore {
+#if PLATFORM(BLACKBERRY)
+#include <BlackBerryPlatformLog.h>
+#endif
 
-static bool systemAllowsMultisamplingOnATICards()
-{
-#if PLATFORM(MAC)
-#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
-    return true;
-#else
-    ASSERT(isMainThread());
-    static SInt32 version;
-    if (!version) {
-        if (Gestalt(gestaltSystemVersion, &version) != noErr)
-            return false;
-    }
-    // See https://bugs.webkit.org/show_bug.cgi?id=77922 for more details
-    return version >= 0x1072;
-#endif // SNOW_LEOPARD and LION
-#else
-    return false;
-#endif // PLATFORM(MAC)
-}
+namespace WebCore {
 
-void GraphicsContext3D::validateAttributes()
+void GraphicsContext3D::validateDepthStencil(const char* packedDepthStencilExtension)
 {
     Extensions3D* extensions = getExtensions();
     if (m_attrs.stencil) {
-        const char* packedDepthStencilExtension = isGLES2Compliant() ? "GL_OES_packed_depth_stencil" : "GL_EXT_packed_depth_stencil";
         if (extensions->supports(packedDepthStencilExtension)) {
             extensions->ensureEnabled(packedDepthStencilExtension);
             // Force depth if stencil is true.
@@ -439,36 +431,11 @@ void GraphicsContext3D::compileShader(Platform3DObject shader)
     ASSERT(shader);
     makeContextCurrent();
 
-    int GLshaderType;
-    ANGLEShaderType shaderType;
-
-    glGetShaderiv(shader, SHADER_TYPE, &GLshaderType);
-    
-    if (GLshaderType == VERTEX_SHADER)
-        shaderType = SHADER_TYPE_VERTEX;
-    else if (GLshaderType == FRAGMENT_SHADER)
-        shaderType = SHADER_TYPE_FRAGMENT;
-    else
-        return; // Invalid shader type.
-
-    HashMap<Platform3DObject, ShaderSourceEntry>::iterator result = m_shaderSourceMap.find(shader);
+    String translatedShaderSource = m_extensions->getTranslatedShaderSourceANGLE(shader);
 
-    if (result == m_shaderSourceMap.end())
+    if (!translatedShaderSource.length())
         return;
 
-    ShaderSourceEntry& entry = result->second;
-
-    String translatedShaderSource;
-    String shaderInfoLog;
-
-    bool isValid = m_compiler.validateShaderSource(entry.source.utf8().data(), shaderType, translatedShaderSource, shaderInfoLog);
-
-    entry.log = shaderInfoLog;
-    entry.isValid = isValid;
-
-    if (!isValid)
-        return; // Shader didn't validate, don't move forward with compiling translated source.
-
     int translatedShaderLength = translatedShaderSource.length();
 
     const CString& translatedShaderCString = translatedShaderSource.utf8();
@@ -790,29 +757,6 @@ void GraphicsContext3D::polygonOffset(GC3Dfloat factor, GC3Dfloat units)
     ::glPolygonOffset(factor, units);
 }
 
-void GraphicsContext3D::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data)
-{
-    // FIXME: remove the two glFlush calls when the driver bug is fixed, i.e.,
-    // all previous rendering calls should be done before reading pixels.
-    makeContextCurrent();
-    ::glFlush();
-    if (m_attrs.antialias && m_boundFBO == m_multisampleFBO) {
-        resolveMultisamplingIfNecessary(IntRect(x, y, width, height));
-        ::glBindFramebufferEXT(GraphicsContext3D::FRAMEBUFFER, m_fbo);
-        ::glFlush();
-    }
-    ::glReadPixels(x, y, width, height, format, type, data);
-    if (m_attrs.antialias && m_boundFBO == m_multisampleFBO)
-        ::glBindFramebufferEXT(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO);
-}
-
-void GraphicsContext3D::releaseShaderCompiler()
-{
-    // FIXME: This is not implemented on desktop OpenGL. We need to have ifdefs for the different GL variants.
-    makeContextCurrent();
-    notImplemented();
-}
-
 void GraphicsContext3D::sampleCoverage(GC3Dclampf value, GC3Dboolean invert)
 {
     makeContextCurrent();
@@ -1386,13 +1330,6 @@ bool GraphicsContext3D::layerComposited() const
     return m_layerComposited;
 }
 
-Extensions3D* GraphicsContext3D::getExtensions()
-{
-    if (!m_extensions)
-        m_extensions = adoptPtr(new Extensions3DOpenGL(this));
-    return m_extensions.get();
-}
-
 }
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp
index b1bd1dc56..e4ac6876e 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  * Copyright (C) 2012 ChangSeok Oh <shivamidow@gmail.com>
+ * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,96 +28,89 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
-
-#include "Extensions3DOpenGL.h"
+#include "Extensions3DOpenGLES.h"
 #include "IntRect.h"
 #include "IntSize.h"
+#include "LayerWebKitThread.h"
 #include "NotImplemented.h"
-
-#if PLATFORM(GTK) || PLATFORM(QT)
-#include "OpenGLShims.h"
-#endif
+#include "OpenGLESShims.h"
 
 namespace WebCore {
 
-void GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary(int x, int y, int width, int height, unsigned char* pixels)
+void GraphicsContext3D::releaseShaderCompiler()
 {
-    const int totalBytes = m_currentWidth * m_currentHeight * 4;
-    ::glReadPixels(x, y, width, height, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
-    for (int i = 0; i < totalBytes; i += 4)
-        std::swap(pixels[i], pixels[i + 2]); // Convert to BGRA.
+    makeContextCurrent();
+    ::glReleaseShaderCompiler();
 }
 
-bool GraphicsContext3D::reshapeFBOs(const IntSize& size)
+void GraphicsContext3D::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data)
 {
-    const int width = size.width();
-    const int height = size.height();
-    GLuint colorFormat = 0, pixelDataType = 0;
-    if (m_attrs.alpha) {
-        m_internalColorFormat = GL_RGBA;
-        colorFormat = GL_RGBA;
-        pixelDataType = GL_UNSIGNED_BYTE;
-    } else {
-        m_internalColorFormat = GL_RGB;
-        colorFormat = GL_RGB;
-        pixelDataType = GL_UNSIGNED_SHORT_5_6_5;
+    // Currently only format=RGBA, type=UNSIGNED_BYTE is supported by the specification: http://www.khronos.org/registry/webgl/specs/latest/
+    // If this ever changes, this code will need to be updated.
+
+    // Calculate the strides of our data and canvas
+    unsigned int formatSize = 4; // RGBA UNSIGNED_BYTE
+    unsigned int dataStride = width * formatSize;
+    unsigned int canvasStride = m_currentWidth * formatSize;
+
+    // If we are using a pack alignment of 8, then we need to align our strides to 8 byte boundaries
+    // See: http://en.wikipedia.org/wiki/Data_structure_alignment (computing padding)
+    int packAlignment;
+    glGetIntegerv(GL_PACK_ALIGNMENT, &packAlignment);
+    if (8 == packAlignment) {
+        dataStride = (dataStride + 7) & ~7;
+        canvasStride = (canvasStride + 7) & ~7;
     }
 
-    // We don't allow the logic where stencil is required and depth is not.
-    // See GraphicsContext3D::validateAttributes.
-    bool supportPackedDepthStencilBuffer = (m_attrs.stencil || m_attrs.depth) && getExtensions()->supports("GL_OES_packed_depth_stencil");
+    unsigned char* canvasData = new unsigned char[canvasStride * m_currentHeight];
+    ::glReadPixels(0, 0, m_currentWidth, m_currentHeight, format, type, canvasData);
 
-    // Resize regular FBO.
-    bool mustRestoreFBO = false;
-    if (m_boundFBO != m_fbo) {
-        mustRestoreFBO = true;
-        ::glBindFramebufferEXT(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+    // If we failed to read our canvas data due to a GL error, don't continue
+    int error = glGetError();
+    if (GL_NO_ERROR != error) {
+        synthesizeGLError(error);
+        return;
     }
 
-    ::glBindTexture(GL_TEXTURE_2D, m_texture);
-    ::glTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, width, height, 0, colorFormat, pixelDataType, 0);
-    ::glFramebufferTexture2DEXT(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_texture, 0);
-
-    ::glBindTexture(GL_TEXTURE_2D, m_compositorTexture);
-    ::glTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, width, height, 0, colorFormat, GL_UNSIGNED_BYTE, 0);
-    ::glBindTexture(GL_TEXTURE_2D, 0);
-
-    // We don't support antialiasing yet. See GraphicsContext3D::validateAttributes.
-    ASSERT(!m_attrs.antialias);
-
-    if (m_attrs.stencil || m_attrs.depth) {
-        // Use a 24 bit depth buffer where we know we have it.
-        if (supportPackedDepthStencilBuffer) {
-            ::glBindTexture(GL_TEXTURE_2D, m_depthStencilBuffer);
-            ::glTexImage2D(GL_TEXTURE_2D, 0, GraphicsContext3D::DEPTH_STENCIL, width, height, 0, GraphicsContext3D::DEPTH_STENCIL, GraphicsContext3D::UNSIGNED_INT_24_8, 0);
-            if (m_attrs.stencil)
-                ::glFramebufferTexture2D(GL_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_TEXTURE_2D, m_depthStencilBuffer, 0);
-            if (m_attrs.depth)
-                ::glFramebufferTexture2D(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, GL_TEXTURE_2D, m_depthStencilBuffer, 0);
-            ::glBindTexture(GL_TEXTURE_2D, 0);
-        } else {
-            if (m_attrs.stencil) {
-                ::glBindRenderbufferEXT(GraphicsContext3D::RENDERBUFFER, m_stencilBuffer);
-                ::glRenderbufferStorageEXT(GraphicsContext3D::RENDERBUFFER, GL_STENCIL_INDEX8, width, height);
-                ::glFramebufferRenderbufferEXT(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::STENCIL_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_stencilBuffer);
-            }
-            if (m_attrs.depth) {
-                ::glBindRenderbufferEXT(GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
-                ::glRenderbufferStorageEXT(GraphicsContext3D::RENDERBUFFER, GL_DEPTH_COMPONENT16, width, height);
-                ::glFramebufferRenderbufferEXT(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
-            }
-            ::glBindRenderbufferEXT(GraphicsContext3D::RENDERBUFFER, 0);
-        }
-    }
-    if (glCheckFramebufferStatusEXT(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
-        // FIXME: cleanup
-        notImplemented();
+    // Clear our data in case some of it lies outside the bounds of our canvas
+    // TODO: don't do this if all of the data lies inside the bounds of the canvas
+    memset(data, 0, dataStride * height);
+
+    // Calculate the intersection of our canvas and data bounds
+    IntRect dataRect(x, y, width, height);
+    IntRect canvasRect(0, 0, m_currentWidth, m_currentHeight);
+    IntRect nonZeroDataRect = intersection(dataRect, canvasRect);
+
+    unsigned int xDataOffset = x < 0 ? -x * formatSize : 0;
+    unsigned int yDataOffset = y < 0 ? -y * dataStride : 0;
+    unsigned int xCanvasOffset = nonZeroDataRect.x() * formatSize;
+    unsigned int yCanvasOffset = nonZeroDataRect.y() * canvasStride;
+    unsigned char* dst = static_cast<unsigned char*>(data) + xDataOffset + yDataOffset;
+    unsigned char* src = canvasData + xCanvasOffset + yCanvasOffset;
+    for (int row = 0; row < nonZeroDataRect.height(); row++) {
+        memcpy(dst, src, nonZeroDataRect.width() * formatSize);
+        dst += dataStride;
+        src += canvasStride;
     }
 
-    return mustRestoreFBO;
+    delete [] canvasData;
+    ::glReadPixels(x, y, width, height, format, type, data);
+
+    if (m_attrs.antialias && m_boundFBO == m_multisampleFBO)
+        ::glBindFramebufferEXT(GraphicsContext3D::FRAMEBUFFER, m_multisampleFBO);
+}
+
+void GraphicsContext3D::readPixelsAndConvertToBGRAIfNecessary(int x, int y, int width, int height, unsigned char* pixels)
+{
+    ::glReadPixels(x, y, width, height, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+    int totalBytes = width * height * 4;
+    if (isGLES2Compliant()) {
+        for (int i = 0; i < totalBytes; i += 4)
+            std::swap(pixels[i], pixels[i + 2]); // Convert to BGRA.
+    }
 }
 
 void GraphicsContext3D::resolveMultisamplingIfNecessary(const IntRect& rect)
@@ -156,6 +151,17 @@ bool GraphicsContext3D::texImage2D(GC3Denum target, GC3Dint level, GC3Denum inte
     return true;
 }
 
+void GraphicsContext3D::validateAttributes()
+{
+    validateDepthStencil("GL_OES_packed_depth_stencil");
+
+    if (m_attrs.antialias) {
+        Extensions3D* extensions = getExtensions();
+        if (!extensions->supports("GL_IMG_multisampled_render_to_texture"))
+            m_attrs.antialias = false;
+    }
+}
+
 void GraphicsContext3D::depthRange(GC3Dclampf zNear, GC3Dclampf zFar)
 {
     makeContextCurrent();
@@ -168,6 +174,19 @@ void GraphicsContext3D::clearDepth(GC3Dclampf depth)
     ::glClearDepthf(depth);
 }
 
-} // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+Extensions3D* GraphicsContext3D::getExtensions()
+{
+    if (!m_extensions)
+        m_extensions = adoptPtr(new Extensions3DOpenGLES(this));
+    return m_extensions.get();
+}
+
+bool GraphicsContext3D::systemAllowsMultisamplingOnATICards() const
+{
+    return false; // not applicable
+}
+
+}
+
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
deleted file mode 100644
index 593e63e9a..000000000
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#if ENABLE(WEBGL)
-
-#include "Extensions3DQt.h"
-
-#include "GraphicsContext3D.h"
-#include "OpenGLShims.h"
-
-namespace WebCore {
-
-Extensions3DQt::Extensions3DQt()
-{
-}
-
-Extensions3DQt::~Extensions3DQt()
-{
-}
-
-bool Extensions3DQt::supports(const String&)
-{
-    return false;
-}
-
-void Extensions3DQt::ensureEnabled(const String& name)
-{
-    ASSERT(supports(name));
-}
-
-bool Extensions3DQt::isEnabled(const String& name)
-{
-    return supports(name);
-}
-
-int Extensions3DQt::getGraphicsResetStatusARB()
-{
-    return GraphicsContext3D::NO_ERROR;
-}
-
-void Extensions3DQt::blitFramebuffer(long srcX0, long srcY0, long srcX1, long srcY1, long dstX0, long dstY0, long dstX1, long dstY1, unsigned long mask, unsigned long filter)
-{
-}
-
-void Extensions3DQt::renderbufferStorageMultisample(unsigned long target, unsigned long samples, unsigned long internalformat, unsigned long width, unsigned long height)
-{
-}
-
-Platform3DObject Extensions3DQt::createVertexArrayOES()
-{
-    return 0;
-}
-
-void Extensions3DQt::deleteVertexArrayOES(Platform3DObject)
-{
-}
-
-GC3Dboolean Extensions3DQt::isVertexArrayOES(Platform3DObject)
-{
-    return GL_FALSE;
-}
-
-void Extensions3DQt::bindVertexArrayOES(Platform3DObject)
-{
-}
-
-String Extensions3DQt::getTranslatedShaderSourceANGLE(Platform3DObject shader)
-{
-    return "";
-}
-
-void Extensions3DQt::copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum)
-{
-    return;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/qt/FontQt.cpp b/Source/WebCore/platform/graphics/qt/FontQt.cpp
index b55f0b7b1..ef9902271 100644
--- a/Source/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontQt.cpp
@@ -81,8 +81,7 @@ static QPen fillPenForContext(GraphicsContext* ctx)
     }
 
     if (ctx->fillPattern()) {
-        AffineTransform affine;
-        return QPen(QBrush(ctx->fillPattern()->createPlatformPattern(affine)), 0);
+        return QPen(QBrush(ctx->fillPattern()->createPlatformPattern()), 0);
     }
 
     return QPen(QColor(ctx->fillColor()), 0);
@@ -97,8 +96,7 @@ static QPen strokePenForContext(GraphicsContext* ctx)
     }
 
     if (ctx->strokePattern()) {
-        AffineTransform affine;
-        QBrush brush(ctx->strokePattern()->createPlatformPattern(affine));
+        QBrush brush(ctx->strokePattern()->createPlatformPattern());
         return QPen(brush, ctx->strokeThickness());
     }
 
diff --git a/Source/WebCore/platform/graphics/qt/FontQt4.cpp b/Source/WebCore/platform/graphics/qt/FontQt4.cpp
index b021f9c64..232b8ffb4 100644
--- a/Source/WebCore/platform/graphics/qt/FontQt4.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontQt4.cpp
@@ -83,8 +83,7 @@ static QPen fillPenForContext(GraphicsContext* ctx)
     }
 
     if (ctx->fillPattern()) {
-        AffineTransform affine;
-        return QPen(QBrush(ctx->fillPattern()->createPlatformPattern(affine)), 0);
+        return QPen(QBrush(ctx->fillPattern()->createPlatformPattern()), 0);
     }
 
     return QPen(QColor(ctx->fillColor()));
@@ -99,8 +98,7 @@ static QPen strokePenForContext(GraphicsContext* ctx)
     }
 
     if (ctx->strokePattern()) {
-        AffineTransform affine;
-        QBrush brush(ctx->strokePattern()->createPlatformPattern(affine));
+        QBrush brush(ctx->strokePattern()->createPlatformPattern());
         return QPen(brush, ctx->strokeThickness());
     }
 
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 7be2c5e05..c7191e35b 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -17,15 +17,11 @@
 */
 
 #include "config.h"
-
 #include "GraphicsContext3D.h"
 
-#include "WebGLObject.h"
-#include "CanvasRenderingContext.h"
 #include "Extensions3DOpenGL.h"
 #include "GraphicsContext.h"
 #include "GraphicsSurface.h"
-#include "HTMLCanvasElement.h"
 #include "HostWindow.h"
 #include "ImageBuffer.h"
 #include "ImageData.h"
@@ -40,11 +36,11 @@
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TEXTURE_MAPPER_GL)
+#if USE(TEXTURE_MAPPER_GL)
 #include <texmap/TextureMapperGL.h>
 #endif
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 namespace WebCore {
 
@@ -57,7 +53,7 @@ typedef char GLchar;
 #endif
 
 class GraphicsContext3DPrivate
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
         : public TextureMapperPlatformLayer
 #endif
 {
@@ -65,7 +61,7 @@ public:
     GraphicsContext3DPrivate(GraphicsContext3D*, HostWindow*);
     ~GraphicsContext3DPrivate();
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
     virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask);
 #endif
 #if USE(GRAPHICS_SURFACE)
@@ -98,6 +94,13 @@ bool GraphicsContext3D::isGLES2Compliant() const
 #endif
 }
 
+#if !USE(OPENGL_ES_2)
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    notImplemented();
+}
+#endif
+
 GraphicsContext3DPrivate::GraphicsContext3DPrivate(GraphicsContext3D* context, HostWindow* hostWindow)
     : m_context(context)
     , m_hostWindow(hostWindow)
@@ -153,7 +156,7 @@ static inline quint32 swapBgrToRgb(quint32 pixel)
     return ((pixel << 16) & 0xff0000) | ((pixel >> 16) & 0xff) | (pixel & 0xff00ff00);
 }
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture* mask)
 {
     blitMultisampleFramebufferAndRestoreContext();
@@ -505,6 +508,9 @@ bool GraphicsContext3D::getImageData(Image* image,
 
     AlphaOp alphaOp = AlphaDoNothing;
     switch (qtImage.format()) {
+    case QImage::Format_RGB32:
+        // For opaque images, we should not premultiply or unmultiply alpha.
+        break;
     case QImage::Format_ARGB32:
         if (premultiplyAlpha)
             alphaOp = AlphaDoPremultiply;
@@ -526,7 +532,7 @@ bool GraphicsContext3D::getImageData(Image* image,
 
     outputVector.resize(packedSize);
 
-    return packPixels(qtImage.bits(), SourceFormatBGRA8, image->width(), image->height(), 0, format, type, alphaOp, outputVector.data());
+    return packPixels(qtImage.constBits(), SourceFormatBGRA8, image->width(), image->height(), 0, format, type, alphaOp, outputVector.data());
 }
 
 void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
@@ -539,4 +545,4 @@ void GraphicsContext3D::setErrorMessageCallback(PassOwnPtr<ErrorMessageCallback>
 
 }
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 074e7dffd..c034f64b3 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -507,8 +507,7 @@ void GraphicsContext::fillPath(const Path& path)
             if (shadowContext) {
                 QPainter* shadowPainter = shadowContext->platformContext();
                 if (m_state.fillPattern) {
-                    AffineTransform affine;
-                    shadowPainter->fillPath(platformPath, QBrush(m_state.fillPattern->createPlatformPattern(affine)));
+                    shadowPainter->fillPath(platformPath, QBrush(m_state.fillPattern->createPlatformPattern()));
                 } else if (m_state.fillGradient) {
                     QBrush brush(*m_state.fillGradient->platformGradient());
                     brush.setTransform(m_state.fillGradient->gradientSpaceTransform());
@@ -528,8 +527,7 @@ void GraphicsContext::fillPath(const Path& path)
         }
     }
     if (m_state.fillPattern) {
-        AffineTransform affine;
-        p->fillPath(platformPath, QBrush(m_state.fillPattern->createPlatformPattern(affine)));
+        p->fillPath(platformPath, QBrush(m_state.fillPattern->createPlatformPattern()));
     } else if (m_state.fillGradient) {
         QBrush brush(*m_state.fillGradient->platformGradient());
         brush.setTransform(m_state.fillGradient->gradientSpaceTransform());
@@ -590,8 +588,7 @@ void GraphicsContext::strokePath(const Path& path)
     }
 
     if (m_state.strokePattern) {
-        AffineTransform affine;
-        QBrush brush = m_state.strokePattern->createPlatformPattern(affine);
+        QBrush brush = m_state.strokePattern->createPlatformPattern();
         fillPathStroke(p, pathStroker, platformPath, brush);
     } else if (m_state.strokeGradient) {
         QBrush brush(*m_state.strokeGradient->platformGradient());
@@ -605,8 +602,7 @@ static inline void drawRepeatPattern(QPainter* p, PassRefPtr<Pattern> pattern, c
 {
     ASSERT(pattern);
 
-    AffineTransform affine;
-    const QBrush brush = pattern->createPlatformPattern(affine);
+    const QBrush brush = pattern->createPlatformPattern();
     if (brush.style() != Qt::TexturePattern)
         return;
 
@@ -703,28 +699,19 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorS
     if (paintingDisabled() || !color.isValid())
         return;
 
-    m_data->solidColor.setColor(color);
+    QRectF platformRect(rect);
     QPainter* p = m_data->p();
-    QRectF normalizedRect = rect.normalized();
-
     if (hasShadow()) {
         ShadowBlur* shadow = shadowBlur();
         if (shadow->mustUseShadowBlur(this)) {
-            GraphicsContext* shadowContext = shadow->beginShadowLayer(this, normalizedRect);
-            if (shadowContext) {
-                QPainter* shadowPainter = shadowContext->platformContext();
-                shadowPainter->setCompositionMode(QPainter::CompositionMode_Source);
-                shadowPainter->fillRect(normalizedRect, m_state.shadowColor);
-                shadow->endShadowLayer(this);
-            }
+            shadow->drawRectShadow(this, platformRect, RoundedRect::Radii());
         } else {
             QColor shadowColor = m_state.shadowColor;
             shadowColor.setAlphaF(shadowColor.alphaF() * p->brush().color().alphaF());
-            p->fillRect(normalizedRect.translated(QPointF(m_state.shadowOffset.width(), m_state.shadowOffset.height())), shadowColor);
+            p->fillRect(platformRect.translated(QPointF(m_state.shadowOffset.width(), m_state.shadowOffset.height())), shadowColor);
         }
     }
-
-    p->fillRect(normalizedRect, m_data->solidColor);
+    p->fillRect(platformRect, QColor(color));
 }
 
 void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
@@ -738,13 +725,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
     if (hasShadow()) {
         ShadowBlur* shadow = shadowBlur();
         if (shadow->mustUseShadowBlur(this)) {
-            GraphicsContext* shadowContext = shadow->beginShadowLayer(this, rect);
-            if (shadowContext) {
-                QPainter* shadowPainter = shadowContext->platformContext();
-                shadowPainter->setCompositionMode(QPainter::CompositionMode_Source);
-                shadowPainter->fillPath(path.platformPath(), QColor(m_state.shadowColor));
-                shadow->endShadowLayer(this);
-            }
+            shadow->drawRectShadow(this, rect, RoundedRect::Radii(topLeft, topRight, bottomLeft, bottomRight));
         } else {
             const QPointF shadowOffset(m_state.shadowOffset.width(), m_state.shadowOffset.height());
             p->translate(shadowOffset);
@@ -1045,7 +1026,10 @@ void GraphicsContext::pushTransparencyLayerInternal(const QRect &rect, qreal opa
 {
     QPainter* p = m_data->p();
 
-    QRect deviceClip = p->transform().mapRect(rect);
+    QTransform deviceTransform = p->transform();
+    QRect deviceClip = deviceTransform.mapRect(rect);
+
+    alphaMask = alphaMask.transformed(deviceTransform);
     if (alphaMask.width() != deviceClip.width() || alphaMask.height() != deviceClip.height())
         alphaMask = alphaMask.scaled(deviceClip.width(), deviceClip.height());
 
@@ -1334,7 +1318,7 @@ void GraphicsContext::setCTM(const AffineTransform& transform)
     m_data->p()->setWorldTransform(transform);
 }
 
-#if ENABLE(3D_RENDERING) && USE(TEXTURE_MAPPER)
+#if ENABLE(3D_RENDERING)
 TransformationMatrix GraphicsContext::get3DTransform() const
 {
     if (paintingDisabled())
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
deleted file mode 100644
index effaaf096..000000000
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
+++ /dev/null
@@ -1,1786 +0,0 @@
-/*
-    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "GraphicsLayerQt.h"
-
-#if !defined(QT_NO_GRAPHICSVIEW)
-
-#include "FloatRect.h"
-#include "GraphicsContext.h"
-#include "Image.h"
-#include "TranslateTransformOperation.h"
-#include "UnitBezier.h"
-#include <qgraphicseffect.h>
-#include <qgraphicsitem.h>
-#include <qgraphicsscene.h>
-#include <qgraphicsview.h>
-#include <qgraphicswidget.h>
-#include <qstyleoption.h>
-#include <QtCore/qabstractanimation.h>
-#include <QtCore/qdatetime.h>
-#include <QtCore/qdebug.h>
-#include <QtCore/qmetaobject.h>
-#include <QtCore/qset.h>
-#include <QtCore/qtimer.h>
-#include <QtGui/qcolor.h>
-#include <QtGui/qpainter.h>
-#include <QtGui/qpixmap.h>
-#include <QtGui/qpixmapcache.h>
-#include <wtf/CurrentTime.h>
-#include <wtf/RefCounted.h>
-
-#if USE(TILED_BACKING_STORE)
-#include "TiledBackingStore.h"
-#include "TiledBackingStoreClient.h"
-
-// The minimum width/height for tiling. We use the same value as the Windows implementation.
-#define GRAPHICS_LAYER_TILING_THRESHOLD 2000
-#endif
-
-#define QT_DEBUG_RECACHE 0
-#define QT_DEBUG_CACHEDUMP 0
-
-#define QT_DEBUG_FPS 0
-
-namespace WebCore {
-
-static const int gMinimumPixmapCacheLimit = 2048;
-
-#ifndef QT_NO_GRAPHICSEFFECT
-class MaskEffectQt : public QGraphicsEffect {
-public:
-    MaskEffectQt(QObject* parent, QGraphicsItem* maskLayer)
-        : QGraphicsEffect(parent)
-        , m_maskLayer(maskLayer)
-    {
-    }
-
-    void draw(QPainter* painter)
-    {
-        // This is a modified clone of QGraphicsOpacityEffect.
-        // It's more efficient to do it this way because:
-        // (a) We don't need the QBrush abstraction - we always end up using QGraphicsItem::paint
-        //     from the mask layer.
-        // (b) QGraphicsOpacityEffect detaches the pixmap, which is inefficient on OpenGL.
-        const QSize maskSize = sourceBoundingRect().toAlignedRect().size();
-        if (!maskSize.isValid() || maskSize.isEmpty()) {
-            drawSource(painter);
-            return;
-        }
-        QPixmap maskPixmap(maskSize);
-
-        // We need to do this so the pixmap would have hasAlpha().
-        maskPixmap.fill(Qt::transparent);
-        QPainter maskPainter(&maskPixmap);
-        QStyleOptionGraphicsItem option;
-        option.exposedRect = option.rect = maskPixmap.rect();
-        maskPainter.setRenderHints(painter->renderHints(), true);
-        m_maskLayer->paint(&maskPainter, &option, 0);
-        maskPainter.end();
-
-        QPoint offset;
-        QPixmap srcPixmap = sourcePixmap(Qt::LogicalCoordinates, &offset, QGraphicsEffect::NoPad);
-
-        // We have to use another intermediate pixmap, to make sure the mask applies only to this item
-        // and doesn't modify pixels already painted into this paint-device.
-        QPixmap pixmap(srcPixmap.size());
-        pixmap.fill(Qt::transparent);
-
-        if (pixmap.isNull())
-            return;
-
-        QPainter pixmapPainter(&pixmap);
-
-        pixmapPainter.setRenderHints(painter->renderHints());
-        pixmapPainter.setCompositionMode(QPainter::CompositionMode_Source);
-
-        // We use drawPixmap rather than detaching, because it's more efficient on OpenGL.
-        pixmapPainter.drawPixmap(0, 0, srcPixmap);
-        pixmapPainter.setCompositionMode(QPainter::CompositionMode_DestinationIn);
-        pixmapPainter.drawPixmap(0, 0, maskPixmap);
-
-        pixmapPainter.end();
-        painter->drawPixmap(offset, pixmap);
-    }
-
-    QGraphicsItem* m_maskLayer;
-};
-#endif // QT_NO_GRAPHICSEFFECT
-
-class GraphicsLayerQtImpl : public QGraphicsObject
-#if USE(TILED_BACKING_STORE)
-                          , public virtual TiledBackingStoreClient
-#endif
-{
-    Q_OBJECT
-
-public:
-    // This set of flags help us defer which properties of the layer have been
-    // modified by the compositor, so we can know what to look for in the next flush.
-    enum ChangeMask {
-        NoChanges =                 0,
-
-        ParentChange =              (1L << 0),
-        ChildrenChange =            (1L << 1),
-        MaskLayerChange =           (1L << 2),
-        PositionChange =            (1L << 3),
-
-        AnchorPointChange =         (1L << 4),
-        SizeChange  =               (1L << 5),
-        TransformChange =           (1L << 6),
-        ContentChange =             (1L << 7),
-
-        ContentsOrientationChange = (1L << 8),
-        OpacityChange =             (1L << 9),
-        ContentsRectChange =        (1L << 10),
-
-        Preserves3DChange =         (1L << 11),
-        MasksToBoundsChange =       (1L << 12),
-        DrawsContentChange =        (1L << 13),
-        ContentsOpaqueChange =      (1L << 14),
-
-        BackfaceVisibilityChange =  (1L << 15),
-        ChildrenTransformChange =   (1L << 16),
-        DisplayChange =             (1L << 17),
-        BackgroundColorChange =     (1L << 18),
-
-        DistributesOpacityChange =  (1L << 19)
-    };
-
-    // The compositor lets us special-case images and colors, so we try to do so.
-    enum StaticContentType { HTMLContentType, PixmapContentType, ColorContentType, MediaContentType, Canvas3DContentType};
-
-    const GraphicsLayerQtImpl* rootLayer() const;
-
-    GraphicsLayerQtImpl(GraphicsLayerQt* newLayer);
-    virtual ~GraphicsLayerQtImpl();
-
-    // reimps from QGraphicsItem
-    virtual QPainterPath opaqueArea() const;
-    virtual QRectF boundingRect() const;
-    virtual void paint(QPainter*, const QStyleOptionGraphicsItem*, QWidget*);
-
-    // We manage transforms ourselves because transform-origin acts differently in webkit and in Qt,
-    // and we need it as a fallback in case we encounter an un-invertible matrix.
-    void setBaseTransform(const TransformationMatrix&);
-    void updateTransform();
-
-    // let the compositor-API tell us which properties were changed
-    void notifyChange(ChangeMask);
-
-    // Actual rendering of the web-content into a QPixmap:
-    // We prefer to use our own caching because it gives us a higher level of granularity than
-    // QGraphicsItem cache modes - Sometimes we need to cache the contents even though the item
-    // needs to be updated, e.g. when the background-color is changed.
-    // TODO: investigate if QGraphicsItem caching can be improved to support that out of the box.
-    QPixmap recache(const QRegion&);
-
-    // Called when the compositor is ready for us to show the changes on screen.
-    // This is called indirectly from ChromeClientQt::setNeedsOneShotDrawingSynchronization
-    // (meaning the sync would happen together with the next draw) or
-    // ChromeClientQt::scheduleCompositingLayerSync (meaning the sync will happen ASAP)
-    void flushChanges(bool recursive = true, bool forceTransformUpdate = false);
-
-#if USE(TILED_BACKING_STORE)
-    // reimplementations from TiledBackingStoreClient
-    virtual void tiledBackingStorePaintBegin();
-    virtual void tiledBackingStorePaint(GraphicsContext*, const IntRect&);
-    virtual void tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea);
-    virtual IntRect tiledBackingStoreContentsRect();
-    virtual IntRect tiledBackingStoreVisibleRect();
-    virtual Color tiledBackingStoreBackgroundColor() const;
-#endif
-
-    static bool allowAcceleratedCompositingCache() { return QPixmapCache::cacheLimit() > gMinimumPixmapCacheLimit; }
-
-    void drawLayerContent(QPainter*, const QRect&);
-
-public slots:
-    // We need to notify the client (ie. the layer compositor) when the animation actually starts.
-    void notifyAnimationStarted();
-
-    // We notify WebCore of a layer changed asynchronously; otherwise we end up calling flushChanges too often.
-    void notifySyncRequired();
-
-signals:
-    // Optimization: Avoid using QTimer::singleShot().
-    void notifyAnimationStartedAsync();
-
-public:
-    GraphicsLayerQt* m_layer;
-
-    TransformationMatrix m_baseTransform;
-    TransformationMatrix m_transformRelativeToRootLayer;
-    bool m_transformAnimationRunning;
-    bool m_opacityAnimationRunning;
-    bool m_blockNotifySyncRequired;
-#ifndef QT_NO_GRAPHICSEFFECT
-    QWeakPointer<MaskEffectQt> m_maskEffect;
-#endif
-
-    struct ContentData {
-        QPixmap pixmap;
-        QRegion regionToUpdate;
-        bool updateAll;
-
-        QColor contentsBackgroundColor;
-        QColor backgroundColor;
-
-        QWeakPointer<QGraphicsObject> mediaLayer;
-        StaticContentType contentType;
-
-        float opacity;
-
-        ContentData()
-            : updateAll(false)
-            , contentType(HTMLContentType)
-            , opacity(1.f)
-        {
-        }
-
-    };
-
-    ContentData m_pendingContent;
-    ContentData m_currentContent;
-
-    int m_changeMask;
-
-#if USE(TILED_BACKING_STORE)
-    TiledBackingStore* m_tiledBackingStore;
-#endif
-
-    QSizeF m_size;
-    struct {
-        QPixmapCache::Key key;
-        QSizeF size;
-    } m_backingStore;
-#ifndef QT_NO_ANIMATION
-    QList<QWeakPointer<QAbstractAnimation> > m_animations;
-#endif
-    QTimer m_suspendTimer;
-
-    struct State {
-        GraphicsLayer* maskLayer;
-        FloatPoint pos;
-        FloatPoint3D anchorPoint;
-        FloatSize size;
-        TransformationMatrix transform;
-        TransformationMatrix childrenTransform;
-        Color backgroundColor;
-        Color currentColor;
-        GraphicsLayer::CompositingCoordinatesOrientation contentsOrientation;
-        float opacity;
-        QRect contentsRect;
-
-        bool preserves3D: 1;
-        bool masksToBounds: 1;
-        bool drawsContent: 1;
-        bool contentsOpaque: 1;
-        bool backfaceVisibility: 1;
-        bool distributeOpacity: 1;
-        bool align: 2;
-
-        State()
-            : maskLayer(0)
-            , contentsOrientation(GraphicsLayer::CompositingCoordinatesTopDown)
-            , opacity(1.f)
-            , preserves3D(false)
-            , masksToBounds(false)
-            , drawsContent(false)
-            , contentsOpaque(false)
-            , backfaceVisibility(true)
-            , distributeOpacity(false)
-        {
-        }
-    } m_state;
-
-#ifndef QT_NO_ANIMATION
-    friend class AnimationQtBase;
-#endif
-};
-
-inline GraphicsLayerQtImpl* toGraphicsLayerQtImpl(QGraphicsItem* item)
-{
-    ASSERT(item);
-    return qobject_cast<GraphicsLayerQtImpl*>(item->toGraphicsObject());
-}
-
-inline GraphicsLayerQtImpl* toGraphicsLayerQtImpl(QGraphicsObject* item)
-{
-    return qobject_cast<GraphicsLayerQtImpl*>(item);
-}
-
-GraphicsLayerQtImpl::GraphicsLayerQtImpl(GraphicsLayerQt* newLayer)
-    : QGraphicsObject(0)
-    , m_layer(newLayer)
-    , m_transformAnimationRunning(false)
-    , m_opacityAnimationRunning(false)
-    , m_blockNotifySyncRequired(false)
-    , m_changeMask(NoChanges)
-#if USE(TILED_BACKING_STORE)
-    , m_tiledBackingStore(0)
-#endif
-{
-    // We use graphics-view for compositing-only, not for interactivity.
-    setAcceptedMouseButtons(Qt::NoButton);
-
-    // We need to have the item enabled, or else wheel events are not passed to the parent class
-    // implementation of wheelEvent, where they are ignored and passed to the item below.
-    setEnabled(true);
-
-    connect(this, SIGNAL(notifyAnimationStartedAsync()), this, SLOT(notifyAnimationStarted()), Qt::QueuedConnection);
-}
-
-GraphicsLayerQtImpl::~GraphicsLayerQtImpl()
-{
-    // The compositor manages lifecycle of item, so we do not want the graphicsview system to delete
-    // our items automatically.
-    const QList<QGraphicsItem*> children = childItems();
-    QList<QGraphicsItem*>::const_iterator cit;
-    for (cit = children.constBegin(); cit != children.constEnd(); ++cit) {
-        if (QGraphicsItem* item = *cit) {
-            if (scene())
-                scene()->removeItem(item);
-            item->setParentItem(0);
-        }
-    }
-#if USE(TILED_BACKING_STORE)
-    delete m_tiledBackingStore;
-#endif
-#ifndef QT_NO_ANIMATION
-    // We do, however, own the animations.
-    QList<QWeakPointer<QAbstractAnimation> >::iterator it;
-    for (it = m_animations.begin(); it != m_animations.end(); ++it)
-        if (QAbstractAnimation* anim = it->data())
-            delete anim;
-#endif
-}
-
-const GraphicsLayerQtImpl* GraphicsLayerQtImpl::rootLayer() const
-{
-    if (const GraphicsLayerQtImpl* parent = toGraphicsLayerQtImpl(parentObject()))
-        return parent->rootLayer();
-    return this;
-}
-
-
-void GraphicsLayerQtImpl::drawLayerContent(QPainter* painter, const QRect& clipRect)
-{
-    painter->setClipRect(clipRect, Qt::IntersectClip);
-    painter->setCompositionMode(QPainter::CompositionMode_SourceOver);
-    GraphicsContext gc(painter);
-    m_layer->paintGraphicsLayerContents(gc, clipRect);
-}
-
-QPixmap GraphicsLayerQtImpl::recache(const QRegion& regionToUpdate)
-{
-    if (!m_layer->drawsContent() || m_size.isEmpty() || !m_size.isValid())
-        return QPixmap();
-
-#if USE(TILED_BACKING_STORE)
-    const bool requiresTiling = (m_state.drawsContent && m_currentContent.contentType == HTMLContentType) && (m_size.width() > GRAPHICS_LAYER_TILING_THRESHOLD || m_size.height() > GRAPHICS_LAYER_TILING_THRESHOLD);
-    if (requiresTiling && !m_tiledBackingStore) {
-        m_tiledBackingStore = new TiledBackingStore(this);
-        m_tiledBackingStore->setTileCreationDelay(0);
-        setFlag(ItemUsesExtendedStyleOption, true);
-    } else if (!requiresTiling && m_tiledBackingStore) {
-        delete m_tiledBackingStore;
-        m_tiledBackingStore = 0;
-        setFlag(ItemUsesExtendedStyleOption, false);
-    }
-
-    if (m_tiledBackingStore) {
-        m_tiledBackingStore->adjustVisibleRect();
-        const QVector<QRect> rects = regionToUpdate.rects();
-        for (int i = 0; i < rects.size(); ++i)
-           m_tiledBackingStore->invalidate(rects[i]);
-        return QPixmap();
-    }
-#endif
-
-    QPixmap pixmap;
-    QRegion region = regionToUpdate;
-    if (QPixmapCache::find(m_backingStore.key, &pixmap)) {
-        if (region.isEmpty())
-            return pixmap;
-        QPixmapCache::remove(m_backingStore.key); // Remove the reference to the pixmap in the cache to avoid a detach.
-    }
-
-    {
-        bool erased = false;
-
-        // If the pixmap is not in the cache or the view has grown since last cached.
-        if (pixmap.isNull() || m_size != m_backingStore.size) {
-#if QT_DEBUG_RECACHE
-            if (pixmap.isNull())
-                qDebug() << "CacheMiss" << this << m_size;
-#endif
-            bool fill = true;
-            QRegion newRegion;
-            QPixmap oldPixmap = pixmap;
-
-            // If the pixmap is two small to hold the view contents we enlarge, otherwise just use the old (large) pixmap.
-            if (pixmap.width() < m_size.width() || pixmap.height() < m_size.height()) {
-#if QT_DEBUG_RECACHE
-                qDebug() << "CacheGrow" << this << m_size;
-#endif
-                pixmap = QPixmap(m_size.toSize());
-                pixmap.fill(Qt::transparent);
-                newRegion = QRegion(0, 0, m_size.width(), m_size.height());
-            }
-
-#if 1
-            // Blit the contents of oldPixmap back into the cached pixmap as we are just adding new pixels.
-            if (!oldPixmap.isNull()) {
-                const QRegion cleanRegion = (QRegion(0, 0, m_size.width(), m_size.height())
-                                             & QRegion(0, 0, m_backingStore.size.width(), m_backingStore.size.height())) - regionToUpdate;
-                if (!cleanRegion.isEmpty()) {
-#if QT_DEBUG_RECACHE
-                    qDebug() << "CacheBlit" << this << cleanRegion;
-#endif
-                    const QRect cleanBounds(cleanRegion.boundingRect());
-                    QPainter painter(&pixmap);
-                    painter.setCompositionMode(QPainter::CompositionMode_Source);
-                    painter.drawPixmap(cleanBounds.topLeft(), oldPixmap, cleanBounds);
-                    newRegion -= cleanRegion;
-                    fill = false; // We cannot just fill the pixmap.
-                }
-                oldPixmap = QPixmap();
-            }
-#endif
-            region += newRegion;
-            if (fill && !region.isEmpty()) { // Clear the entire pixmap with the background.
-#if QT_DEBUG_RECACHE
-                qDebug() << "CacheErase" << this << m_size << background;
-#endif
-                erased = true;
-                pixmap.fill(Qt::transparent);
-            }
-        }
-        region &= QRegion(0, 0, m_size.width(), m_size.height());
-
-        // If we have something to draw its time to erase it and render the contents.
-        if (!region.isEmpty()) {
-#if QT_DEBUG_CACHEDUMP
-            static int recacheCount = 0;
-            ++recacheCount;
-            qDebug() << "**** CACHEDUMP" << recacheCount << this << m_layer << region << m_size;
-            pixmap.save(QString().sprintf("/tmp/%05d_A.png", recacheCount), "PNG");
-#endif
-
-            QPainter painter(&pixmap);
-            GraphicsContext gc(&painter);
-
-            painter.setClipRegion(region);
-
-            if (!erased) { // Erase the area in cache that we're drawing into.
-                painter.setCompositionMode(QPainter::CompositionMode_Clear);
-                painter.fillRect(region.boundingRect(), Qt::transparent);
-
-#if QT_DEBUG_CACHEDUMP
-                qDebug() << "**** CACHEDUMP" << recacheCount << this << m_layer << region << m_size;
-                pixmap.save(QString().sprintf("/tmp/%05d_B.png", recacheCount), "PNG");
-#endif
-            }
-
-            // Render the actual contents into the cache.
-            painter.setCompositionMode(QPainter::CompositionMode_SourceOver);
-            m_layer->paintGraphicsLayerContents(gc, region.boundingRect());
-            painter.end();
-
-#if QT_DEBUG_CACHEDUMP
-            qDebug() << "**** CACHEDUMP" << recacheCount << this << m_layer << region << m_size;
-            pixmap.save(QString().sprintf("/tmp/%05d_C.png", recacheCount), "PNG");
-#endif
-        }
-        m_backingStore.size = m_size; // Store the used size of the pixmap.
-    }
-
-    // Finally insert into the cache and allow a reference there.
-    m_backingStore.key = QPixmapCache::insert(pixmap);
-    return pixmap;
-}
-
-void GraphicsLayerQtImpl::updateTransform()
-{
-    if (!m_transformAnimationRunning)
-        m_baseTransform = m_layer->transform();
-
-    TransformationMatrix localTransform;
-
-    GraphicsLayerQtImpl* parent = toGraphicsLayerQtImpl(parentObject());
-
-    // WebCore has relative-to-size originPoint, where as the QGraphicsView has a pixel originPoint.
-    // Thus, we need to convert here as we have to manage this outselves due to the fact that the
-    // transformOrigin of the graphicsview is imcompatible.
-    const qreal originX = m_state.anchorPoint.x() * m_size.width();
-    const qreal originY = m_state.anchorPoint.y() * m_size.height();
-
-    // We ignore QGraphicsItem::pos completely, and use transforms only, due to the fact that we
-    // have to maintain that ourselves for 3D.
-    localTransform
-            .translate3d(originX + m_state.pos.x(), originY + m_state.pos.y(), m_state.anchorPoint.z())
-            .multiply(m_baseTransform)
-            .translate3d(-originX, -originY, -m_state.anchorPoint.z());
-
-    // This is the actual 3D transform of this item, with the ancestors' transform baked in.
-    m_transformRelativeToRootLayer = TransformationMatrix(parent ? parent->m_transformRelativeToRootLayer : TransformationMatrix())
-                                         .multiply(localTransform);
-
-    // Now we have enough information to determine if the layer is facing backwards.
-    if (!m_state.backfaceVisibility && m_transformRelativeToRootLayer.inverse().m33() < 0) {
-        setVisible(false);
-        // No point in making extra calculations for invisible elements.
-        return;
-    }
-
-    // The item is front-facing or backface-visibility is on.
-    setVisible(true);
-
-    // Flatten to 2D-space of this item if it doesn't preserve 3D.
-    if (!m_state.preserves3D) {
-        m_transformRelativeToRootLayer.setM13(0);
-        m_transformRelativeToRootLayer.setM23(0);
-        m_transformRelativeToRootLayer.setM31(0);
-        m_transformRelativeToRootLayer.setM32(0);
-        m_transformRelativeToRootLayer.setM33(1);
-        m_transformRelativeToRootLayer.setM34(0);
-        m_transformRelativeToRootLayer.setM43(0);
-    }
-
-    // Apply perspective for the use of this item's children. Perspective is always applied from the item's
-    // center.
-    if (!m_state.childrenTransform.isIdentity()) {
-        m_transformRelativeToRootLayer
-            .translate(m_size.width() / 2, m_size.height() /2)
-            .multiply(m_state.childrenTransform)
-            .translate(-m_size.width() / 2, -m_size.height() /2);
-    }
-
-    bool inverseOk = true;
-    // Use QTransform::inverse to extrapolate the relative transform of this item, based on the parent's
-    // transform relative to the root layer and the desired transform for this item relative to the root layer.
-    const QTransform parentTransform = parent ? parent->itemTransform(rootLayer()) : QTransform();
-    const QTransform transform2D = QTransform(m_transformRelativeToRootLayer) * parentTransform.inverted(&inverseOk);
-
-    // In rare cases the transformation cannot be inversed - in that case we don't apply the transformation at
-    // all, otherwise we'd flicker. FIXME: This should be amended when Qt moves to a real 3D scene-graph.
-    if (!inverseOk)
-        return;
-
-    setTransform(transform2D);
-
-    const QList<QGraphicsItem*> children = childItems();
-    QList<QGraphicsItem*>::const_iterator it;
-    for (it = children.constBegin(); it != children.constEnd(); ++it)
-        if (GraphicsLayerQtImpl* layer= toGraphicsLayerQtImpl(*it))
-            layer->updateTransform();
-}
-
-void GraphicsLayerQtImpl::setBaseTransform(const TransformationMatrix& baseTransform)
-{
-    m_baseTransform = baseTransform;
-    updateTransform();
-}
-
-QPainterPath GraphicsLayerQtImpl::opaqueArea() const
-{
-    QPainterPath painterPath;
-
-    // We try out best to return the opaque area, maybe it will help graphics-view render less items.
-    if (m_currentContent.backgroundColor.isValid() && m_currentContent.backgroundColor.alpha() == 0xff)
-        painterPath.addRect(boundingRect());
-    else {
-        if (m_state.contentsOpaque
-            || (m_currentContent.contentType == ColorContentType && m_currentContent.contentsBackgroundColor.alpha() == 0xff)
-            || (m_currentContent.contentType == MediaContentType)
-            || (m_currentContent.contentType == PixmapContentType && !m_currentContent.pixmap.hasAlpha())) {
-            painterPath.addRect(m_state.contentsRect);
-        }
-    }
-    return painterPath;
-}
-
-QRectF GraphicsLayerQtImpl::boundingRect() const
-{
-    return QRectF(QPointF(0, 0), QSizeF(m_size));
-}
-
-void GraphicsLayerQtImpl::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget)
-{
-#if USE(TILED_BACKING_STORE)
-    // FIXME: There's currently no Qt API to know if a new region of an item is exposed outside of the paint event.
-    // Suggested for Qt: http://bugreports.qt.nokia.com/browse/QTBUG-14877.
-    if (m_tiledBackingStore)
-        m_tiledBackingStore->adjustVisibleRect();
-#endif
-
-    if (m_currentContent.backgroundColor.isValid())
-        painter->fillRect(option->exposedRect, QColor(m_currentContent.backgroundColor));
-
-    switch (m_currentContent.contentType) {
-    case HTMLContentType:
-        if (m_state.drawsContent) {
-            if (!allowAcceleratedCompositingCache())
-                drawLayerContent(painter, option->exposedRect.toRect());
-            else {
-                QPixmap backingStore;
-                // We might need to recache, in case we try to paint and the cache was purged (e.g. if it was full).
-                if (!QPixmapCache::find(m_backingStore.key, &backingStore) || backingStore.size() != m_size.toSize())
-                    backingStore = recache(QRegion(m_state.contentsRect));
-                painter->drawPixmap(0, 0, backingStore);
-            }
-        }
-        break;
-    case PixmapContentType:
-        painter->drawPixmap(m_state.contentsRect, m_currentContent.pixmap);
-        break;
-    case ColorContentType:
-        painter->fillRect(m_state.contentsRect, m_currentContent.contentsBackgroundColor);
-        break;
-    case MediaContentType:
-        // we don't need to paint anything: we have a QGraphicsItem from the media element
-        break;
-    }
-}
-
-void GraphicsLayerQtImpl::notifySyncRequired()
-{
-    m_blockNotifySyncRequired = false;
-
-    if (m_layer->client())
-        m_layer->client()->notifySyncRequired(m_layer);
-}
-
-void GraphicsLayerQtImpl::notifyChange(ChangeMask changeMask)
-{
-    m_changeMask |= changeMask;
-
-    if (m_blockNotifySyncRequired)
-        return;
-
-    static QMetaMethod syncMethod = staticMetaObject.method(staticMetaObject.indexOfMethod("notifySyncRequired()"));
-    syncMethod.invoke(this, Qt::QueuedConnection);
-
-    m_blockNotifySyncRequired = true;
-}
-
-void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform)
-{
-    // This is the bulk of the work. understanding what the compositor is trying to achieve, what
-    // graphicsview can do, and trying to find a sane common-ground.
-    if (!m_layer || m_changeMask == NoChanges)
-        goto afterLayerChanges;
-
-    if (m_changeMask & ParentChange) {
-        // The WebCore compositor manages item ownership. We have to make sure graphicsview doesn't
-        // try to snatch that ownership.
-        if (!m_layer->parent() && !parentItem())
-            setParentItem(0);
-        else if (m_layer && m_layer->parent() && m_layer->parent()->platformLayer() != parentItem())
-            setParentItem(m_layer->parent()->platformLayer());
-    }
-
-    if (m_changeMask & ChildrenChange) {
-        // We basically do an XOR operation on the list of current children and the list of wanted
-        // children, and remove/add.
-        QSet<QGraphicsItem*> newChildren;
-        const Vector<GraphicsLayer*> newChildrenVector = (m_layer->children());
-        newChildren.reserve(newChildrenVector.size());
-
-        for (size_t i = 0; i < newChildrenVector.size(); ++i)
-            newChildren.insert(newChildrenVector[i]->platformLayer());
-
-        const QSet<QGraphicsItem*> currentChildren = childItems().toSet();
-        const QSet<QGraphicsItem*> childrenToAdd = newChildren - currentChildren;
-        const QSet<QGraphicsItem*> childrenToRemove = currentChildren - newChildren;
-
-        QSet<QGraphicsItem*>::const_iterator it;
-        for (it = childrenToAdd.constBegin(); it != childrenToAdd.constEnd(); ++it) {
-             if (QGraphicsItem* w = *it)
-                w->setParentItem(this);
-        }
-
-        QSet<QGraphicsItem*>::const_iterator rit;
-        for (rit = childrenToRemove.constBegin(); rit != childrenToRemove.constEnd(); ++rit) {
-             if (GraphicsLayerQtImpl* w = toGraphicsLayerQtImpl(*rit))
-                w->setParentItem(0);
-        }
-
-        // Children are ordered by z-value, let graphicsview know.
-        for (size_t i = 0; i < newChildrenVector.size(); ++i) {
-            if (newChildrenVector[i]->platformLayer())
-                newChildrenVector[i]->platformLayer()->setZValue(i);
-        }
-    }
-
-    if (m_changeMask & MaskLayerChange) {
-        // We can't paint here, because we don't know if the mask layer itself is ready... we'll have
-        // to wait till this layer tries to paint.
-        setFlag(ItemClipsChildrenToShape, m_layer->maskLayer() || m_layer->masksToBounds());
-#ifndef QT_NO_GRAPHICSEFFECT
-        setGraphicsEffect(0);
-        if (m_layer->maskLayer()) {
-            if (GraphicsLayerQtImpl* mask = toGraphicsLayerQtImpl(m_layer->maskLayer()->platformLayer())) {
-                mask->m_maskEffect = new MaskEffectQt(this, mask);
-                setGraphicsEffect(mask->m_maskEffect.data());
-            }
-        }
-#endif
-    }
-
-    if (m_changeMask & SizeChange) {
-        if (m_layer->size() != m_state.size) {
-            prepareGeometryChange();
-            m_size = QSizeF(m_layer->size().width(), m_layer->size().height());
-        }
-    }
-
-    // FIXME: This is a hack, due to a probable QGraphicsScene bug when rapidly modifying the perspective
-    // but without this line we get graphic artifacts.
-    if ((m_changeMask & ChildrenTransformChange) && m_state.childrenTransform != m_layer->childrenTransform())
-        if (scene())
-            scene()->update();
-
-    if (m_changeMask & (ChildrenTransformChange | Preserves3DChange | TransformChange | AnchorPointChange | SizeChange | BackfaceVisibilityChange | PositionChange | ParentChange)) {
-        // Due to the differences between the way WebCore handles transforms and the way Qt handles transforms,
-        // all these elements affect the transforms of all the descendants.
-        forceUpdateTransform = true;
-    }
-
-    if (m_changeMask & (ContentChange | DrawsContentChange | MaskLayerChange)) {
-        switch (m_pendingContent.contentType) {
-        case PixmapContentType:
-            update();
-            setFlag(ItemHasNoContents, false);
-            break;
-
-        case MediaContentType:
-            setFlag(ItemHasNoContents, true);
-            m_pendingContent.mediaLayer.data()->setParentItem(this);
-            break;
-
-        case ColorContentType:
-            if (m_pendingContent.contentType != m_currentContent.contentType
-                || m_pendingContent.contentsBackgroundColor != m_currentContent.contentsBackgroundColor)
-                update();
-            m_state.drawsContent = false;
-            setFlag(ItemHasNoContents, false);
-
-            // Only use ItemUsesExtendedStyleOption for HTML content as colors don't gain much from that.
-            setFlag(QGraphicsItem::ItemUsesExtendedStyleOption, false);
-            break;
-
-        case HTMLContentType:
-            if (m_pendingContent.contentType != m_currentContent.contentType)
-                update();
-            else if (!m_state.drawsContent && m_layer->drawsContent())
-                update();
-
-            setFlag(ItemHasNoContents, !m_layer->drawsContent());
-            break;
-        }
-    }
-
-    if ((m_changeMask & OpacityChange) && m_state.opacity != m_layer->opacity() && !m_opacityAnimationRunning)
-        setOpacity(m_layer->opacity());
-
-    if (m_changeMask & ContentsRectChange) {
-        const QRect rect(m_layer->contentsRect());
-        if (m_state.contentsRect != rect) {
-            m_state.contentsRect = rect;
-            if (m_pendingContent.mediaLayer) {
-                QGraphicsWidget* widget = qobject_cast<QGraphicsWidget*>(m_pendingContent.mediaLayer.data());
-                if (widget)
-                    widget->setGeometry(rect);
-            }
-            update();
-        }
-    }
-
-    if ((m_changeMask & MasksToBoundsChange) && m_state.masksToBounds != m_layer->masksToBounds()) {
-        setFlag(QGraphicsItem::ItemClipsToShape, m_layer->masksToBounds());
-        setFlag(QGraphicsItem::ItemClipsChildrenToShape, m_layer->masksToBounds());
-    }
-
-    if ((m_changeMask & ContentsOpaqueChange) && m_state.contentsOpaque != m_layer->contentsOpaque())
-        prepareGeometryChange();
-
-#ifndef QT_NO_GRAPHICSEFFECT
-    if (m_maskEffect)
-        m_maskEffect.data()->update();
-    else
-#endif
-    if (m_changeMask & DisplayChange) {
-#ifndef QT_GRAPHICS_LAYER_NO_RECACHE_ON_DISPLAY_CHANGE
-        // Recache now: all the content is ready and we don't want to wait until the paint event.
-        // We only need to do this for HTML content, there's no point in caching directly composited
-        // content like images or solid rectangles.
-        if (m_pendingContent.contentType == HTMLContentType && allowAcceleratedCompositingCache())
-            recache(m_pendingContent.regionToUpdate);
-#endif
-        update(m_pendingContent.regionToUpdate.boundingRect());
-        m_pendingContent.regionToUpdate = QRegion();
-    }
-
-    if ((m_changeMask & BackgroundColorChange)
-        && (m_pendingContent.backgroundColor != m_currentContent.backgroundColor))
-        update();
-
-    m_state.maskLayer = m_layer->maskLayer();
-    m_state.pos = m_layer->position();
-    m_state.anchorPoint = m_layer->anchorPoint();
-    m_state.size = m_layer->size();
-    m_state.transform = m_layer->transform();
-    m_state.contentsOrientation =m_layer->contentsOrientation();
-    m_state.opacity = m_layer->opacity();
-    m_state.contentsRect = m_layer->contentsRect();
-    m_state.preserves3D = m_layer->preserves3D();
-    m_state.masksToBounds = m_layer->masksToBounds();
-    m_state.drawsContent = m_layer->drawsContent();
-    m_state.contentsOpaque = m_layer->contentsOpaque();
-    m_state.backfaceVisibility = m_layer->backfaceVisibility();
-    m_state.childrenTransform = m_layer->childrenTransform();
-    m_currentContent.pixmap = m_pendingContent.pixmap;
-    m_currentContent.contentType = m_pendingContent.contentType;
-    m_currentContent.mediaLayer = m_pendingContent.mediaLayer;
-    m_currentContent.backgroundColor = m_pendingContent.backgroundColor;
-    m_currentContent.contentsBackgroundColor = m_pendingContent.contentsBackgroundColor;
-    m_pendingContent.regionToUpdate = QRegion();
-    m_changeMask = NoChanges;
-
-afterLayerChanges:
-    if (forceUpdateTransform)
-        updateTransform();
-
-    if (!recursive)
-        return;
-
-    QList<QGraphicsItem*> children = childItems();
-    if (m_state.maskLayer)
-        children.append(m_state.maskLayer->platformLayer());
-
-    QList<QGraphicsItem*>::const_iterator it;
-    for (it = children.constBegin(); it != children.constEnd(); ++it) {
-        if (QGraphicsItem* item = *it) {
-            if (GraphicsLayerQtImpl* layer = toGraphicsLayerQtImpl(item))
-                layer->flushChanges(true, forceUpdateTransform);
-        }
-    }
-}
-
-#if USE(TILED_BACKING_STORE)
-/* \reimp (TiledBackingStoreClient.h)
-*/
-void GraphicsLayerQtImpl::tiledBackingStorePaintBegin()
-{
-}
-
-/* \reimp (TiledBackingStoreClient.h)
-*/
-void GraphicsLayerQtImpl::tiledBackingStorePaint(GraphicsContext* gc,  const IntRect& rect)
-{
-    m_layer->paintGraphicsLayerContents(*gc, rect);
-}
-
-/* \reimp (TiledBackingStoreClient.h)
-*/
-void GraphicsLayerQtImpl::tiledBackingStorePaintEnd(const Vector<IntRect>& paintedArea)
-{
-    for (int i = 0; i < paintedArea.size(); ++i)
-        update(QRectF(paintedArea[i]));
-}
-
-/* \reimp (TiledBackingStoreClient.h)
-*/
-IntRect GraphicsLayerQtImpl::tiledBackingStoreContentsRect()
-{
-    return m_layer->contentsRect();
-}
-
-/* \reimp (TiledBackingStoreClient.h)
-*/
-Color GraphicsLayerQtImpl::tiledBackingStoreBackgroundColor() const
-{
-    if (m_currentContent.contentType == PixmapContentType && !m_currentContent.pixmap.hasAlphaChannel())
-        return Color(0, 0, 0);
-    // We return a transparent color so that the tiles initialize with alpha.
-    return Color(0, 0, 0, 0);
-}
-
-IntRect GraphicsLayerQtImpl::tiledBackingStoreVisibleRect()
-{
-    const QGraphicsView* view = scene()->views().isEmpty() ? 0 : scene()->views().first();
-    if (!view)
-        return mapFromScene(scene()->sceneRect()).boundingRect().toAlignedRect();
-
-    // All we get is the viewport's visible region. We have to map it to the scene and then to item coordinates.
-    return mapFromScene(view->mapToScene(view->viewport()->visibleRegion().boundingRect()).boundingRect()).boundingRect().toAlignedRect();
-}
-#endif
-
-void GraphicsLayerQtImpl::notifyAnimationStarted()
-{
-    // WebCore notifies javascript when the animation starts. Here we're letting it know.
-    m_layer->client()->notifyAnimationStarted(m_layer, /* DOM time */ WTF::currentTime());
-}
-
-GraphicsLayerQt::GraphicsLayerQt(GraphicsLayerClient* client)
-    : GraphicsLayer(client)
-    , m_impl(adoptPtr(new GraphicsLayerQtImpl(this)))
-{
-}
-
-GraphicsLayerQt::~GraphicsLayerQt()
-{
-    // Do cleanup while we can still safely call methods on the derived class.
-    willBeDestroyed();
-}
-
-void GraphicsLayerQt::willBeDestroyed()
-{
-    m_impl = nullptr;
-    GraphicsLayer::willBeDestroyed();
-}
-
-// This is the hook for WebCore compositor to know that Qt implements compositing with GraphicsLayerQt.
-PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
-{
-    return adoptPtr(new GraphicsLayerQt(client));
-}
-
-/* \reimp (GraphicsLayer.h): The current size might change, thus we need to update the whole display.
-*/
-void GraphicsLayerQt::setNeedsDisplay()
-{
-    m_impl->m_pendingContent.regionToUpdate = QRegion(QRect(QPoint(0, 0), QSize(size().width(), size().height())));
-    m_impl->notifyChange(GraphicsLayerQtImpl::DisplayChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setNeedsDisplayInRect(const FloatRect& rect)
-{
-    m_impl->m_pendingContent.regionToUpdate |= QRectF(rect).toAlignedRect();
-    m_impl->notifyChange(GraphicsLayerQtImpl::DisplayChange);
-}
-
-void GraphicsLayerQt::setContentsNeedsDisplay()
-{
-    switch (m_impl->m_pendingContent.contentType) {
-    case GraphicsLayerQtImpl::MediaContentType:
-        if (!m_impl->m_pendingContent.mediaLayer)
-            return;
-        m_impl->m_pendingContent.mediaLayer.data()->update();
-        break;
-    default:
-        setNeedsDisplay();
-        break;
-    }
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setName(const String& name)
-{
-    m_impl->setObjectName(name);
-    GraphicsLayer::setName(name);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setParent(GraphicsLayer* layer)
-{
-    m_impl->notifyChange(GraphicsLayerQtImpl::ParentChange);
-    GraphicsLayer::setParent(layer);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-bool GraphicsLayerQt::setChildren(const Vector<GraphicsLayer*>& children)
-{
-    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
-    return GraphicsLayer::setChildren(children);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::addChild(GraphicsLayer* layer)
-{
-    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
-    GraphicsLayer::addChild(layer);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::addChildAtIndex(GraphicsLayer* layer, int index)
-{
-    GraphicsLayer::addChildAtIndex(layer, index);
-    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
-{
-     GraphicsLayer::addChildAbove(layer, sibling);
-     m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
-{
-
-    GraphicsLayer::addChildBelow(layer, sibling);
-    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-bool GraphicsLayerQt::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
-{
-    if (GraphicsLayer::replaceChild(oldChild, newChild)) {
-        m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenChange);
-        return true;
-    }
-
-    return false;
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::removeFromParent()
-{
-    if (parent())
-        m_impl->notifyChange(GraphicsLayerQtImpl::ParentChange);
-    GraphicsLayer::removeFromParent();
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setMaskLayer(GraphicsLayer* value)
-{
-    if (value == maskLayer())
-        return;
-    GraphicsLayer::setMaskLayer(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::MaskLayerChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setPosition(const FloatPoint& value)
-{
-    if (value == position())
-        return;
-    GraphicsLayer::setPosition(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::PositionChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setAnchorPoint(const FloatPoint3D& value)
-{
-    if (value == anchorPoint())
-        return;
-    GraphicsLayer::setAnchorPoint(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::AnchorPointChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setSize(const FloatSize& value)
-{
-    if (value == size())
-        return;
-    GraphicsLayer::setSize(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::SizeChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setTransform(const TransformationMatrix& value)
-{
-    if (value == transform())
-        return;
-    GraphicsLayer::setTransform(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::TransformChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setChildrenTransform(const TransformationMatrix& value)
-{
-    if (value == childrenTransform())
-        return;
-    GraphicsLayer::setChildrenTransform(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::ChildrenTransformChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setPreserves3D(bool value)
-{
-    if (value == preserves3D())
-        return;
-    GraphicsLayer::setPreserves3D(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::Preserves3DChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setMasksToBounds(bool value)
-{
-    if (value == masksToBounds())
-        return;
-    GraphicsLayer::setMasksToBounds(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::MasksToBoundsChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setDrawsContent(bool value)
-{
-    if (value == drawsContent())
-        return;
-    m_impl->notifyChange(GraphicsLayerQtImpl::DrawsContentChange);
-    GraphicsLayer::setDrawsContent(value);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setBackgroundColor(const Color& value)
-{
-    if (value == m_impl->m_pendingContent.backgroundColor)
-        return;
-    m_impl->m_pendingContent.backgroundColor = value;
-    GraphicsLayer::setBackgroundColor(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::BackgroundColorChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::clearBackgroundColor()
-{
-    if (!m_impl->m_pendingContent.backgroundColor.isValid())
-        return;
-    m_impl->m_pendingContent.backgroundColor = QColor();
-    GraphicsLayer::clearBackgroundColor();
-    m_impl->notifyChange(GraphicsLayerQtImpl::BackgroundColorChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setContentsOpaque(bool value)
-{
-    if (value == contentsOpaque())
-        return;
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentsOpaqueChange);
-    GraphicsLayer::setContentsOpaque(value);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setBackfaceVisibility(bool value)
-{
-    if (value == backfaceVisibility())
-        return;
-    GraphicsLayer::setBackfaceVisibility(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::BackfaceVisibilityChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setOpacity(float value)
-{
-    if (value == opacity())
-        return;
-    GraphicsLayer::setOpacity(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::OpacityChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setContentsRect(const IntRect& value)
-{
-    if (value == contentsRect())
-        return;
-    GraphicsLayer::setContentsRect(value);
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentsRectChange);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setContentsToImage(Image* image)
-{
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
-    m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::HTMLContentType;
-    GraphicsLayer::setContentsToImage(image);
-    if (image) {
-        QPixmap* pxm = image->nativeImageForCurrentFrame();
-        if (pxm) {
-            m_impl->m_pendingContent.pixmap = *pxm;
-            m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::PixmapContentType;
-            return;
-        }
-    }
-    m_impl->m_pendingContent.pixmap = QPixmap();
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setContentsToBackgroundColor(const Color& color)
-{
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
-    m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::ColorContentType;
-    m_impl->m_pendingContent.contentsBackgroundColor = QColor(color);
-    GraphicsLayer::setContentsToBackgroundColor(color);
-}
-
-void GraphicsLayerQt::setContentsToMedia(PlatformLayer* media)
-{
-    if (media) {
-        m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::MediaContentType;
-        m_impl->m_pendingContent.mediaLayer = media->toGraphicsObject();
-    } else
-        m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::HTMLContentType;
-
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
-    GraphicsLayer::setContentsToMedia(media);
-}
-
-void GraphicsLayerQt::setContentsToCanvas(PlatformLayer* canvas)
-{
-    setContentsToMedia(canvas);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::setContentsOrientation(CompositingCoordinatesOrientation orientation)
-{
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentsOrientationChange);
-    GraphicsLayer::setContentsOrientation(orientation);
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::distributeOpacity(float o)
-{
-    m_impl->notifyChange(GraphicsLayerQtImpl::OpacityChange);
-    m_impl->m_state.distributeOpacity = true;
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-float GraphicsLayerQt::accumulatedOpacity() const
-{
-    return m_impl->effectiveOpacity();
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::syncCompositingState(const FloatRect&)
-{
-    m_impl->flushChanges();
-    GraphicsLayer::syncCompositingState();
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-void GraphicsLayerQt::syncCompositingStateForThisLayerOnly()
-{
-    // We can't call flushChanges recursively here
-    m_impl->flushChanges(false);
-    GraphicsLayer::syncCompositingStateForThisLayerOnly();
-}
-
-/* \reimp (GraphicsLayer.h)
-*/
-PlatformLayer* GraphicsLayerQt::platformLayer() const
-{
-    return m_impl.get();
-}
-
-// Now we start dealing with WebCore animations translated to Qt animations
-
-template <typename T>
-struct KeyframeValueQt {
-    const TimingFunction* timingFunction;
-    T value;
-};
-
-/* Copied from AnimationBase.cpp
-*/
-static inline double solveEpsilon(double duration)
-{
-    return 1.0 / (200.0 * duration);
-}
-
-static inline double solveCubicBezierFunction(qreal p1x, qreal p1y, qreal p2x, qreal p2y, double t, double duration)
-{
-    UnitBezier bezier(p1x, p1y, p2x, p2y);
-    return bezier.solve(t, solveEpsilon(duration));
-}
-
-static inline double solveStepsFunction(int numSteps, bool stepAtStart, double t)
-{
-    if (stepAtStart)
-        return qMin(1.0, (floor(numSteps * t) + 1) / numSteps);
-    return floor(numSteps * t) / numSteps;
-}
-
-static inline qreal applyTimingFunction(const TimingFunction* timingFunction, qreal progress, double duration)
-{
-    // We want the timing function to be as close as possible to what the web-developer intended, so
-    // we're using the same function used by WebCore when compositing is disabled. Using easing-curves
-    // would probably work for some of the cases, but wouldn't really buy us anything as we'd have to
-    // convert the bezier function back to an easing curve.
-
-    if (timingFunction->isCubicBezierTimingFunction()) {
-        const CubicBezierTimingFunction* ctf = static_cast<const CubicBezierTimingFunction*>(timingFunction);
-        return solveCubicBezierFunction(ctf->x1(),
-                                        ctf->y1(),
-                                        ctf->x2(),
-                                        ctf->y2(),
-                                        double(progress), double(duration) / 1000);
-    } else if (timingFunction->isStepsTimingFunction()) {
-        const StepsTimingFunction* stf = static_cast<const StepsTimingFunction*>(timingFunction);
-        return solveStepsFunction(stf->numberOfSteps(), stf->stepAtStart(), double(progress));
-    } else
-        return progress;
-}
-
-// Helper functions to safely get a value out of WebCore's AnimationValue*.
-
-#ifndef QT_NO_ANIMATION
-static void webkitAnimationToQtAnimationValue(const AnimationValue* animationValue, TransformOperations& transformOperations)
-{
-    transformOperations = TransformOperations();
-    if (!animationValue)
-        return;
-
-    if (const TransformOperations* ops = static_cast<const TransformAnimationValue*>(animationValue)->value())
-        transformOperations = *ops;
-}
-
-static void webkitAnimationToQtAnimationValue(const AnimationValue* animationValue, qreal& realValue)
-{
-    realValue = animationValue ? static_cast<const FloatAnimationValue*>(animationValue)->value() : 0;
-}
-
-// We put a bit of the functionality in a base class to allow casting and to save some code size.
-
-class AnimationQtBase : public QAbstractAnimation {
-public:
-    AnimationQtBase(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString & name)
-        : QAbstractAnimation(0)
-        , m_layer(layer)
-        , m_boxSize(boxSize)
-        , m_duration(anim->duration() * 1000)
-        , m_isAlternate(anim->direction() == Animation::AnimationDirectionAlternate)
-        , m_webkitPropertyID(values.property())
-        , m_webkitAnimation(anim)
-        , m_keyframesName(name)
-        , m_fillsForwards(false)
-    {
-    }
-
-
-    virtual AnimatedPropertyID animatedProperty() const = 0;
-
-    virtual void updateState(QAbstractAnimation::State newState, QAbstractAnimation::State oldState)
-    {
-        QAbstractAnimation::updateState(newState, oldState);
-
-        // For some reason we have do this asynchronously - or the animation won't work.
-        if (newState == Running && oldState == Stopped && m_layer.data())
-            m_layer.data()->notifyAnimationStartedAsync();
-    }
-
-    virtual int duration() const { return m_duration; }
-
-    QWeakPointer<GraphicsLayerQtImpl> m_layer;
-    IntSize m_boxSize;
-    int m_duration;
-    bool m_isAlternate;
-    AnimatedPropertyID m_webkitPropertyID;
-
-    // We might need this in case the same animation is added again (i.e. resumed by WebCore).
-    const Animation* m_webkitAnimation;
-    QString m_keyframesName;
-    bool m_fillsForwards;
-};
-
-// We'd rather have a templatized QAbstractAnimation than QPropertyAnimation / QVariantAnimation;
-// Since we know the types that we're dealing with, the QObject/QProperty/QVariant abstraction
-// buys us very little in this case, for too much overhead.
-template <typename T>
-class AnimationQt : public AnimationQtBase {
-
-public:
-    AnimationQt(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString & name)
-        : AnimationQtBase(layer, values, boxSize, anim, name)
-    {
-        // Copying those WebCore structures is not trivial, we have to do it like this.
-        for (size_t i = 0; i < values.size(); ++i) {
-            const AnimationValue* animationValue = values.at(i);
-            KeyframeValueQt<T> keyframeValue;
-            if (animationValue->timingFunction())
-                keyframeValue.timingFunction = animationValue->timingFunction();
-            else
-                keyframeValue.timingFunction = anim->timingFunction().get();
-            webkitAnimationToQtAnimationValue(animationValue, keyframeValue.value);
-            m_keyframeValues[animationValue->keyTime()] = keyframeValue;
-        }
-    }
-
-protected:
-
-    // This is the part that differs between animated properties.
-    virtual void applyFrame(const T& fromValue, const T& toValue, qreal progress) = 0;
-
-    virtual void updateState(QAbstractAnimation::State newState, QAbstractAnimation::State oldState)
-    {
-#if QT_DEBUG_FPS
-        if (newState == Running && oldState == Stopped) {
-            qDebug("Animation Started!");
-            m_fps.frames = 0;
-            m_fps.duration.start();
-        } else if (newState == Stopped && oldState == Running) {
-            const int duration = m_fps.duration.elapsed();
-            qDebug("Animation Ended! %dms [%f FPS]", duration,
-                    (1000 / (((float)duration) / m_fps.frames)));
-        }
-#endif
-        AnimationQtBase::updateState(newState, oldState);
-    }
-
-    virtual void updateCurrentTime(int currentTime)
-    {
-        if (!m_layer)
-            return;
-
-        qreal progress = qreal(currentLoopTime()) / duration();
-
-        if (m_isAlternate && currentLoop()%2)
-            progress = 1-progress;
-
-        if (m_keyframeValues.isEmpty())
-            return;
-
-        // Find the current from-to keyframes in our little map.
-        typename QMap<qreal, KeyframeValueQt<T> >::iterator it = m_keyframeValues.find(progress);
-
-        // We didn't find an exact match, we try the closest match (lower bound).
-        if (it == m_keyframeValues.end())
-            it = m_keyframeValues.lowerBound(progress)-1;
-
-        // We didn't find any match; use the first keyframe.
-        if (it == m_keyframeValues.end())
-            it = m_keyframeValues.begin();
-
-        typename QMap<qreal, KeyframeValueQt<T> >::iterator it2 = it + 1;
-        if (it2 == m_keyframeValues.end())
-            it2 = it;
-        const KeyframeValueQt<T>& fromKeyframe = it.value();
-        const KeyframeValueQt<T>& toKeyframe = it2.value();
-
-        const TimingFunction* timingFunc = fromKeyframe.timingFunction;
-        const T& fromValue = fromKeyframe.value;
-        const T& toValue = toKeyframe.value;
-
-        // Now we have a source keyframe, origin keyframe and a timing function.
-        // We can now process the progress and apply the frame.
-        progress = (!progress || progress == 1 || it.key() == it2.key()) ?
-            progress : applyTimingFunction(timingFunc, (progress - it.key()) / (it2.key() - it.key()), duration());
-        applyFrame(fromValue, toValue, progress);
-#if QT_DEBUG_FPS
-        ++m_fps.frames;
-#endif
-    }
-
-    QMap<qreal, KeyframeValueQt<T> > m_keyframeValues;
-#if QT_DEBUG_FPS
-    struct {
-        QTime duration;
-        int frames;
-    } m_fps;
-#endif
-};
-
-class TransformAnimationQt : public AnimationQt<TransformOperations> {
-public:
-    TransformAnimationQt(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString & name)
-        : AnimationQt<TransformOperations>(layer, values, boxSize, anim, name)
-    {
-    }
-
-    ~TransformAnimationQt()
-    {
-        if (m_fillsForwards)
-            setCurrentTime(1);
-    }
-
-    virtual AnimatedPropertyID animatedProperty() const { return AnimatedPropertyWebkitTransform; }
-
-    // The idea is that we let WebCore manage the transform operations and Qt just manage the
-    // animation heartbeat and the bottom-line QTransform. We gain performance, not by using
-    // Transform instead of TransformationMatrix, but by proper caching of items that are
-    // expensive for WebCore to render. We want the rest to be as close to WebCore's idea as possible.
-    virtual void applyFrame(const TransformOperations& sourceOperations, const TransformOperations& targetOperations, qreal progress)
-    {
-        TransformationMatrix transformMatrix;
-
-        bool validTransformLists = true;
-        const int sourceOperationCount = sourceOperations.size();
-        if (sourceOperationCount) {
-            if (targetOperations.size() != sourceOperationCount)
-                validTransformLists = false;
-            else {
-                for (size_t j = 0; j < sourceOperationCount && validTransformLists; ++j) {
-                    if (!sourceOperations.operations()[j]->isSameType(*targetOperations.operations()[j]))
-                        validTransformLists = false;
-                }
-            }
-        }
-
-        if (validTransformLists) {
-            for (size_t i = 0; i < targetOperations.size(); ++i)
-                targetOperations.operations()[i]->blend(sourceOperations.at(i), progress)->apply(transformMatrix, m_boxSize);
-        } else {
-            targetOperations.apply(m_boxSize, transformMatrix);
-            transformMatrix.blend(m_sourceMatrix, progress);
-        }
-
-        m_layer.data()->m_layer->setTransform(transformMatrix);
-        // We force the actual opacity change, otherwise it would be ignored because of the animation.
-        m_layer.data()->setBaseTransform(transformMatrix);
-    }
-
-    virtual void updateState(QAbstractAnimation::State newState, QAbstractAnimation::State oldState)
-    {
-        AnimationQt<TransformOperations>::updateState(newState, oldState);
-        if (!m_layer)
-            return;
-
-        m_layer.data()->flushChanges(true);
-
-        // To increase FPS, we use a less accurate caching mechanism while animation is going on
-        // this is a UX choice that should probably be customizable.
-        if (newState == QAbstractAnimation::Running) {
-            m_sourceMatrix = m_layer.data()->m_layer->transform();
-            m_layer.data()->m_transformAnimationRunning = true;
-        } else if (newState == QAbstractAnimation::Stopped) {
-            // We update the transform back to the default. This already takes fill-modes into account.
-            m_layer.data()->m_transformAnimationRunning = false;
-            if (m_layer && m_layer.data()->m_layer)
-                m_layer.data()->setBaseTransform(m_layer.data()->m_layer->transform());
-        }
-    }
-
-    TransformationMatrix m_sourceMatrix;
-};
-
-class OpacityAnimationQt : public AnimationQt<qreal> {
-public:
-    OpacityAnimationQt(GraphicsLayerQtImpl* layer, const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const QString& name)
-         : AnimationQt<qreal>(layer, values, boxSize, anim, name)
-    {
-    }
-
-    ~OpacityAnimationQt()
-    {
-        if (m_fillsForwards)
-            setCurrentTime(1);
-    }
-
-    virtual AnimatedPropertyID animatedProperty() const { return AnimatedPropertyOpacity; }
-
-    virtual void applyFrame(const qreal& fromValue, const qreal& toValue, qreal progress)
-    {
-        qreal opacity = qBound(qreal(0), fromValue + (toValue - fromValue) * progress, qreal(1));
-
-        // FIXME: This is a hack, due to a probable QGraphicsScene bug.
-        // Without this the opacity change doesn't always have immediate effect.
-        if (m_layer.data()->scene() && !m_layer.data()->opacity() && opacity)
-            m_layer.data()->scene()->update();
-
-        m_layer.data()->m_layer->setOpacity(opacity);
-        // We force the actual opacity change, otherwise it would be ignored because of the animation.
-        m_layer.data()->setOpacity(opacity);
-    }
-
-    virtual void updateState(QAbstractAnimation::State newState, QAbstractAnimation::State oldState)
-    {
-        AnimationQt<qreal>::updateState(newState, oldState);
-
-        if (m_layer)
-            m_layer.data()->m_opacityAnimationRunning = (newState == QAbstractAnimation::Running);
-
-        // If stopped, we update the opacity back to the default. This already takes fill-modes into account.
-        if (newState == Stopped)
-            if (m_layer && m_layer.data()->m_layer)
-                m_layer.data()->setOpacity(m_layer.data()->m_layer->opacity());
-
-    }
-};
-
-bool GraphicsLayerQt::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* anim, const String& keyframesName, double timeOffset)
-{
-    if (!anim->duration() || !anim->iterationCount())
-        return false;
-
-    AnimationQtBase* newAnim = 0;
-
-    // Fixed: we might already have the Qt animation object associated with this WebCore::Animation object.
-    QList<QWeakPointer<QAbstractAnimation> >::iterator it;
-    for (it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
-        if (*it) {
-            AnimationQtBase* curAnimation = static_cast<AnimationQtBase*>(it->data());
-            if (curAnimation && curAnimation->m_webkitAnimation == anim
-                && values.property() == curAnimation->animatedProperty()) {
-                newAnim = curAnimation;
-                break;
-            }
-        }
-    }
-
-    if (!newAnim) {
-        switch (values.property()) {
-        case AnimatedPropertyOpacity:
-            newAnim = new OpacityAnimationQt(m_impl.get(), values, boxSize, anim, keyframesName);
-            break;
-        case AnimatedPropertyWebkitTransform:
-            newAnim = new TransformAnimationQt(m_impl.get(), values, boxSize, anim, keyframesName);
-            break;
-        default:
-            return false;
-        }
-
-        // We make sure WebCore::Animation and QAnimation are on the same terms.
-        newAnim->setLoopCount(anim->iterationCount());
-        newAnim->m_fillsForwards = anim->fillsForwards();
-        m_impl->m_animations.append(QWeakPointer<QAbstractAnimation>(newAnim));
-        QObject::connect(&m_impl->m_suspendTimer, SIGNAL(timeout()), newAnim, SLOT(resume()));
-    }
-
-    // Flush now to avoid flicker.
-    m_impl->flushChanges(false);
-
-    // Qhen fill-mode is backwards/both, we set the value to 0 before the delay takes place.
-    if (anim->fillsBackwards())
-        newAnim->setCurrentTime(0);
-
-    newAnim->start();
-
-    // We synchronize the animation's clock to WebCore's timeOffset.
-    newAnim->setCurrentTime(timeOffset * 1000);
-
-    // We don't need to manage the animation object's lifecycle:
-    // WebCore would call removeAnimations when it's time to delete.
-
-    return true;
-}
-
-void GraphicsLayerQt::removeAnimationsForProperty(AnimatedPropertyID id)
-{
-    QList<QWeakPointer<QAbstractAnimation> >::iterator it;
-    for (it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
-        if (!(*it))
-            continue;
-
-        AnimationQtBase* anim = static_cast<AnimationQtBase*>(it->data());
-        if (anim && anim->m_webkitPropertyID == id) {
-            // We need to stop the animation right away, or it might flicker before it's deleted.
-            anim->stop();
-            anim->deleteLater();
-            it = m_impl->m_animations.erase(it);
-            --it;
-        }
-    }
-}
-
-void GraphicsLayerQt::removeAnimationsForKeyframes(const String& name)
-{
-    QList<QWeakPointer<QAbstractAnimation> >::iterator it;
-    for (it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
-        if (!(*it))
-            continue;
-
-        AnimationQtBase* anim = static_cast<AnimationQtBase*>(it->data());
-        if (anim && anim->m_keyframesName == QString(name)) {
-            // We need to stop the animation right away, or it might flicker before it's deleted.
-            anim->stop();
-            anim->deleteLater();
-            it = m_impl->m_animations.erase(it);
-            --it;
-        }
-    }
-}
-
-void GraphicsLayerQt::pauseAnimation(const String& name, double timeOffset)
-{
-    QList<QWeakPointer<QAbstractAnimation> >::iterator it;
-    for (it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
-        if (!(*it))
-            continue;
-
-        AnimationQtBase* anim = static_cast<AnimationQtBase*>(it->data());
-        if (anim && anim->m_keyframesName == QString(name)) {
-            // we synchronize the animation's clock to WebCore's timeOffset
-            anim->setCurrentTime(timeOffset * 1000);
-            anim->pause();
-        }
-    }
-}
-
-void GraphicsLayerQt::suspendAnimations(double time)
-{
-    if (m_impl->m_suspendTimer.isActive()) {
-        m_impl->m_suspendTimer.stop();
-        m_impl->m_suspendTimer.start(time * 1000);
-    } else {
-        QList<QWeakPointer<QAbstractAnimation> >::iterator it;
-        for (it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
-            if (QAbstractAnimation* anim = it->data())
-                anim->pause();
-        }
-    }
-}
-
-void GraphicsLayerQt::resumeAnimations()
-{
-    if (m_impl->m_suspendTimer.isActive()) {
-        m_impl->m_suspendTimer.stop();
-        QList<QWeakPointer<QAbstractAnimation> >::iterator it;
-        for (it = m_impl->m_animations.begin(); it != m_impl->m_animations.end(); ++it) {
-            if (QAbstractAnimation* anim = it->data())
-                anim->resume();
-        }
-    }
-}
-
-#endif // QT_NO_ANIMATION
-}
-
-#include <GraphicsLayerQt.moc>
-
-
-#endif // QT_NO_GRAPHICSVIEW
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
deleted file mode 100644
index ea2bdae68..000000000
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
-    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef GraphicsLayerQt_h
-#define GraphicsLayerQt_h
-
-#include "GraphicsLayer.h"
-#include "GraphicsLayerClient.h"
-
-#if !defined(QT_NO_GRAPHICSVIEW)
-
-namespace WebCore {
-
-class GraphicsLayerQtImpl;
-
-class GraphicsLayerQt : public GraphicsLayer {
-    friend class GraphicsLayerQtImpl;
-
-public:
-    GraphicsLayerQt(GraphicsLayerClient*);
-    virtual ~GraphicsLayerQt();
-
-    // reimps from GraphicsLayer.h
-    virtual PlatformLayer* platformLayer() const;
-    virtual void setNeedsDisplay();
-    virtual void setNeedsDisplayInRect(const FloatRect&);
-    virtual void setParent(GraphicsLayer* layer);
-    virtual void setName(const String& name);
-    virtual bool setChildren(const Vector<GraphicsLayer*>&);
-    virtual void addChild(GraphicsLayer*);
-    virtual void addChildAtIndex(GraphicsLayer*, int index);
-    virtual void addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling);
-    virtual void addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling);
-    virtual bool replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild);
-    virtual void removeFromParent();
-    virtual void setMaskLayer(GraphicsLayer* layer);
-    virtual void setPosition(const FloatPoint& p);
-    virtual void setAnchorPoint(const FloatPoint3D& p);
-    virtual void setSize(const FloatSize& size);
-    virtual void setTransform(const TransformationMatrix& t);
-    virtual void setChildrenTransform(const TransformationMatrix& t);
-    virtual void setPreserves3D(bool b);
-    virtual void setMasksToBounds(bool b);
-    virtual void setDrawsContent(bool b);
-    virtual void setBackgroundColor(const Color&);
-    virtual void clearBackgroundColor();
-    virtual void setContentsOpaque(bool b);
-    virtual void setBackfaceVisibility(bool b);
-    virtual void setOpacity(float opacity);
-    virtual void setContentsRect(const IntRect& r);
-#ifndef QT_NO_ANIMATION
-    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String& keyframesName, double timeOffset);
-    virtual void removeAnimationsForProperty(AnimatedPropertyID);
-    virtual void removeAnimationsForKeyframes(const String& keyframesName);
-    virtual void pauseAnimation(const String& keyframesName, double timeOffset);
-    virtual void suspendAnimations(double time);
-    virtual void resumeAnimations();
-#endif // QT_NO_ANIMATION
-    virtual void setContentsToImage(Image*);
-    virtual void setContentsNeedsDisplay();
-    virtual void setContentsToMedia(PlatformLayer*);
-    virtual void setContentsToCanvas(PlatformLayer*);
-    virtual void setContentsToBackgroundColor(const Color&);
-    virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation);
-    virtual void distributeOpacity(float);
-    virtual float accumulatedOpacity() const;
-    virtual void syncCompositingState(const FloatRect&);
-    virtual void syncCompositingStateForThisLayerOnly();
-
-private:
-    virtual void willBeDestroyed();
-
-    OwnPtr<GraphicsLayerQtImpl> m_impl;
-};
-
-}
-#endif
-#endif // GraphicsLayerQt_h
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index 794bc1036..5ad418c23 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -52,7 +52,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 #include "texmap/TextureMapper.h"
 #endif
 
@@ -613,7 +613,7 @@ void MediaPlayerPrivateQt::repaint()
 
 }
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 void MediaPlayerPrivateQt::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture*) const
 {
         GraphicsContext* context = textureMapper->graphicsContext();
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
index a129e5de5..0e2cf0b92 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
@@ -31,14 +31,14 @@ class QGraphicsVideoItem;
 class QGraphicsScene;
 QT_END_NAMESPACE
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 #include "TextureMapper.h"
 #endif
 
 namespace WebCore {
 
 class MediaPlayerPrivateQt : public QObject, public MediaPlayerPrivateInterface
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
         , public TextureMapperPlatformLayer
 #endif
 {
@@ -101,7 +101,6 @@ public:
     bool supportsFullscreen() const { return true; }
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(TEXTURE_MAPPER)
     // whether accelerated rendering is supported by the media engine for the current media.
     virtual bool supportsAcceleratedRendering() const { return false; }
     // called when the rendering system flips the into or out of accelerated rendering mode.
@@ -109,11 +108,6 @@ public:
     // Const-casting here is safe, since all of TextureMapperPlatformLayer's functions are const.g
     virtual PlatformLayer* platformLayer() const { return 0; }
     virtual void paintToTextureMapper(TextureMapper*, const FloatRect& targetRect, const TransformationMatrix&, float opacity, BitmapTexture* mask) const;
-#else
-    virtual bool supportsAcceleratedRendering() const { return false; }
-    virtual void acceleratedRenderingStateChanged() { }
-    virtual PlatformLayer* platformLayer() const { return 0; }
-#endif
 #endif
 
     virtual PlatformMedia platformMedia() const;
diff --git a/Source/WebCore/platform/graphics/qt/PatternQt.cpp b/Source/WebCore/platform/graphics/qt/PatternQt.cpp
index af7b12858..7aae62599 100644
--- a/Source/WebCore/platform/graphics/qt/PatternQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/PatternQt.cpp
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-QBrush Pattern::createPlatformPattern(const AffineTransform&) const
+QBrush Pattern::createPlatformPattern() const
 {
     QPixmap* pixmap = tileImage()->nativeImageForCurrentFrame();
     if (!pixmap)
diff --git a/Source/WebCore/platform/graphics/qt/StillImageQt.h b/Source/WebCore/platform/graphics/qt/StillImageQt.h
index 368266a39..26df4714e 100644
--- a/Source/WebCore/platform/graphics/qt/StillImageQt.h
+++ b/Source/WebCore/platform/graphics/qt/StillImageQt.h
@@ -58,7 +58,7 @@ namespace WebCore {
     private:
         StillImage(const QPixmap& pixmap);
         StillImage(const QPixmap* pixmap);
-        ~StillImage();
+        virtual ~StillImage();
         
         const QPixmap* m_pixmap;
         bool m_ownsPixmap;
diff --git a/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp b/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
index 66882cf4a..d18e53ed9 100644
--- a/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
@@ -32,21 +32,31 @@
 #include "GlyphPageTreeNode.h"
 
 #include "Font.h"
+#if !USE(HARFBUZZ_NG)
 #include "HarfBuzzSkia.h"
+#else
+#include "NotImplemented.h"
+#endif
 #include "SimpleFontData.h"
 
 #include "SkTemplates.h"
 #include "SkPaint.h"
 #include "SkUtils.h"
 
+#if !USE(HARFBUZZ_NG)
 extern "C" {
 #include "harfbuzz-shaper.h"
 }
+#endif
 
 namespace WebCore {
 
 static int substituteWithVerticalGlyphs(const SimpleFontData* fontData, uint16_t* glyphs, unsigned bufferLength)
 {
+#if USE(HARFBUZZ_NG)
+    notImplemented();
+    return 0xFFFF;
+#else
     HB_FaceRec_* hbFace = fontData->platformData().harfbuzzFace()->face();
     if (!hbFace->gsub) {
         // if there is no GSUB table, treat it as not covered
@@ -73,6 +83,7 @@ static int substituteWithVerticalGlyphs(const SimpleFontData* fontData, uint16_t
             glyphs[i] = static_cast<Glyph>(buffer->out_string[i].gindex);
     }
     return error;
+#endif
 }
 
 bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData)
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
index 019037c45..17ad83d8f 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 
 #include "GraphicsContext3D.h"
 
@@ -92,4 +92,4 @@ bool GraphicsContext3D::getImageData(Image* image,
 
 } // namespace WebCore
 
-#endif // ENABLE(WEBGL)
+#endif // USE(3D_GRAPHICS)
diff --git a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
index 81dfa3aa1..6a4bcb0a3 100644
--- a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -251,9 +251,18 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
     ResamplingMode resampling;
     if (platformContext->isAccelerated())
         resampling = RESAMPLE_LINEAR;
-    else
-        resampling = platformContext->printing() ? RESAMPLE_NONE :
-            computeResamplingMode(platformContext, bitmap, srcRect.width(), srcRect.height(), SkScalarToFloat(destRect.width()), SkScalarToFloat(destRect.height()));
+    else if (platformContext->printing())
+        resampling = RESAMPLE_NONE;
+    else {
+        // Take into account scale applied to the canvas when computing sampling mode (e.g. CSS scale or page scale).
+        SkRect destRectTarget = destRect;
+        if (!(canvas->getTotalMatrix().getType() & (SkMatrix::kAffine_Mask | SkMatrix::kPerspective_Mask)))
+            canvas->getTotalMatrix().mapRect(&destRectTarget, destRect);
+
+        resampling = computeResamplingMode(platformContext, bitmap, srcRect.width(), srcRect.height(),
+                                           SkScalarToFloat(destRectTarget.width()), SkScalarToFloat(destRectTarget.height()));
+    }
+
     if (resampling == RESAMPLE_NONE) {
       // FIXME: This is to not break tests (it results in the filter bitmap flag
       // being set to true). We need to decide if we respect RESAMPLE_NONE
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index c9decdeee..403e5492b 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -26,10 +26,6 @@
 #include "Image.h"
 #include "TextureMapperLayer.h"
 
-#if ENABLE(WEBGL)
-#include "GraphicsContext3D.h"
-#endif
-
 namespace WebCore {
 
 class TextureMapperLayer;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index f1da4243f..7793f70ad 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -112,8 +112,18 @@ public:
     static PassOwnPtr<TextureMapper> create(AccelerationMode newMode = SoftwareMode);
     virtual ~TextureMapper() { }
 
+    enum ExposedEdges {
+        NoEdges = 0,
+        LeftEdge = 1 << 0,
+        RightEdge = 1 << 1,
+        TopEdge = 1 << 2,
+        BottomEdge = 1 << 3,
+        AllEdges = LeftEdge | RightEdge | TopEdge | BottomEdge,
+    };
+
     virtual void drawBorder(const Color&, float borderWidth, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) = 0;
-    virtual void drawTexture(const BitmapTexture&, const FloatRect& target, const TransformationMatrix& modelViewMatrix = TransformationMatrix(), float opacity = 1.0f, const BitmapTexture* maskTexture = 0) = 0;
+    virtual void drawRepaintCounter(int value, int pointSize, const FloatPoint&, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) = 0;
+    virtual void drawTexture(const BitmapTexture&, const FloatRect& target, const TransformationMatrix& modelViewMatrix = TransformationMatrix(), float opacity = 1.0f, const BitmapTexture* maskTexture = 0, unsigned exposedEdges = AllEdges) = 0;
 
     // makes a surface the target for the following drawTexture calls.
     virtual void bindSurface(BitmapTexture* surface) = 0;
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
index 3f4ec6e94..efa659f84 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.cpp
@@ -87,10 +87,10 @@ void TextureMapperTile::updateContents(TextureMapper* textureMapper, Image* imag
     m_texture->updateContents(image, targetRect, sourceOffset);
 }
 
-void TextureMapperTile::paint(TextureMapper* textureMapper, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
+void TextureMapperTile::paint(TextureMapper* textureMapper, const TransformationMatrix& transform, float opacity, BitmapTexture* mask, const unsigned exposedEdges)
 {
     if (texture().get())
-        textureMapper->drawTexture(*texture().get(), rect(), transform, opacity, mask);
+        textureMapper->drawTexture(*texture().get(), rect(), transform, opacity, mask, exposedEdges);
 }
 
 TextureMapperTiledBackingStore::TextureMapperTiledBackingStore()
@@ -107,13 +107,27 @@ void TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded(TextureMapp
     m_image.clear();
 }
 
+unsigned TextureMapperBackingStore::calculateExposedTileEdges(const FloatRect& totalRect, const FloatRect& tileRect)
+{
+    unsigned exposedEdges = TextureMapper::NoEdges;
+    if (!tileRect.x())
+        exposedEdges |= TextureMapper::LeftEdge;
+    if (!tileRect.y())
+        exposedEdges |= TextureMapper::TopEdge;
+    if (tileRect.width() + tileRect.x() >= totalRect.width())
+        exposedEdges |= TextureMapper::RightEdge;
+    if (tileRect.height() + tileRect.y() >= totalRect.height())
+        exposedEdges |= TextureMapper::BottomEdge;
+    return exposedEdges;
+}
+
 void TextureMapperTiledBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
 {
     updateContentsFromImageIfNeeded(textureMapper);
     TransformationMatrix adjustedTransform = transform;
     adjustedTransform.multiply(TransformationMatrix::rectToRect(rect(), targetRect));
     for (size_t i = 0; i < m_tiles.size(); ++i) {
-        m_tiles[i].paint(textureMapper, adjustedTransform, opacity, mask);
+        m_tiles[i].paint(textureMapper, adjustedTransform, opacity, mask, calculateExposedTileEdges(rect(), m_tiles[i].rect()));
         if (m_drawsDebugBorders)
             textureMapper->drawBorder(m_debugBorderColor, m_debugBorderWidth, m_tiles[i].rect(), adjustedTransform);
     }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
index 95abe5340..0f71c45b0 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperBackingStore.h
@@ -39,6 +39,9 @@ public:
     virtual PassRefPtr<BitmapTexture> texture() const = 0;
     virtual void paintToTextureMapper(TextureMapper*, const FloatRect&, const TransformationMatrix&, float, BitmapTexture*) = 0;
     virtual ~TextureMapperBackingStore() { }
+
+protected:
+    static unsigned calculateExposedTileEdges(const FloatRect& totalRect, const FloatRect& tileRect);
 };
 
 #if USE(GRAPHICS_SURFACE)
@@ -82,7 +85,7 @@ public:
     inline void setRect(const FloatRect& rect) { m_rect = rect; }
 
     void updateContents(TextureMapper*, Image*, const IntRect&);
-    virtual void paint(TextureMapper*, const TransformationMatrix&, float, BitmapTexture*);
+    virtual void paint(TextureMapper*, const TransformationMatrix&, float, BitmapTexture*, const unsigned exposedEdges);
     virtual ~TextureMapperTile() { }
 
     TextureMapperTile(const FloatRect& rect)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index 6db7d6f0d..cca2e27ec 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -24,6 +24,7 @@
 #include "GraphicsContext.h"
 #include "GraphicsContext3D.h"
 #include "Image.h"
+#include "NotImplemented.h"
 #include "TextureMapperShaderManager.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
@@ -236,6 +237,7 @@ TextureMapperGL::TextureMapperGL()
     : TextureMapper(OpenGLMode)
     , m_data(new TextureMapperGLData)
     , m_context(0)
+    , m_enableEdgeDistanceAntialiasing(false)
 {
 }
 
@@ -304,19 +306,24 @@ void TextureMapperGL::endPainting()
 #endif
 }
 
-void TextureMapperGL::drawRect(const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, TextureMapperShaderProgram* shaderProgram, GLenum drawingMode, bool needsBlending)
+void TextureMapperGL::drawQuad(const DrawQuad& quadToDraw, const TransformationMatrix& modelViewMatrix, TextureMapperShaderProgram* shaderProgram, GLenum drawingMode, bool needsBlending)
 {
     GL_CMD(glEnableVertexAttribArray(shaderProgram->vertexAttrib()));
     GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0));
-    const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(shaderProgram->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect));
+
+    const GLfloat quad[] = {
+        quadToDraw.targetRectMappedToUnitSquare.p1().x(), quadToDraw.targetRectMappedToUnitSquare.p1().y(),
+        quadToDraw.targetRectMappedToUnitSquare.p2().x(), quadToDraw.targetRectMappedToUnitSquare.p2().y(),
+        quadToDraw.targetRectMappedToUnitSquare.p3().x(), quadToDraw.targetRectMappedToUnitSquare.p3().y(),
+        quadToDraw.targetRectMappedToUnitSquare.p4().x(), quadToDraw.targetRectMappedToUnitSquare.p4().y()
+    };
+    GL_CMD(glVertexAttribPointer(shaderProgram->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, quad));
 
     TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
-            targetRect.width(), 0, 0, 0,
-            0, targetRect.height(), 0, 0,
+            quadToDraw.originalTargetRect.width(), 0, 0, 0,
+            0, quadToDraw.originalTargetRect.height(), 0, 0,
             0, 0, 1, 0,
-            targetRect.x(), targetRect.y(), 0, 1));
-
+            quadToDraw.originalTargetRect.x(), quadToDraw.originalTargetRect.y(), 0, 1));
     const GLfloat m4[] = {
         matrix.m11(), matrix.m12(), matrix.m13(), matrix.m14(),
         matrix.m21(), matrix.m22(), matrix.m23(), matrix.m24(),
@@ -351,10 +358,42 @@ void TextureMapperGL::drawBorder(const Color& color, float width, const FloatRec
                        alpha));
     GL_CMD(glLineWidth(width));
 
-    drawRect(targetRect, modelViewMatrix, program.get(), GL_LINE_LOOP, color.hasAlpha());
+    drawQuad(targetRect, modelViewMatrix, program.get(), GL_LINE_LOOP, color.hasAlpha());
+}
+
+void TextureMapperGL::drawRepaintCounter(int value, int pointSize, const FloatPoint& targetPoint, const TransformationMatrix& modelViewMatrix)
+{
+#if PLATFORM(QT)
+    QString counterString = QString::number(value);
+
+    QFont font(QString::fromLatin1("Monospace"), pointSize, QFont::Bold);
+    font.setStyleHint(QFont::TypeWriter);
+
+    QFontMetrics fontMetrics(font);
+    int width = fontMetrics.width(counterString) + 4;
+    int height = fontMetrics.height();
+
+    IntSize size(width, height);
+    IntRect sourceRect(IntPoint::zero(), size);
+    IntRect targetRect(roundedIntPoint(targetPoint), size);
+
+    QImage image(size, QImage::Format_ARGB32_Premultiplied);
+    QPainter painter(&image);
+    painter.fillRect(sourceRect, Qt::blue); // Since we won't swap R+B for speed, this will paint red.
+    painter.setFont(font);
+    painter.setPen(Qt::white);
+    painter.drawText(2, height * 0.85, counterString);
+
+    RefPtr<BitmapTexture> texture = acquireTextureFromPool(size);
+    const uchar* bits = image.bits();
+    texture->updateContents(bits, sourceRect, IntPoint::zero(), image.bytesPerLine());
+    drawTexture(*texture, targetRect, modelViewMatrix, 1.0f, 0, AllEdges);
+#else
+    notImplemented();
+#endif
 }
 
-void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, const BitmapTexture* mask)
+void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, const BitmapTexture* mask, unsigned exposedEdges)
 {
     if (!texture.isValid())
         return;
@@ -363,7 +402,7 @@ void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect&
         return;
 
     const BitmapTextureGL& textureGL = static_cast<const BitmapTextureGL&>(texture);
-    drawTexture(textureGL.id(), textureGL.isOpaque() ? 0 : SupportsBlending, textureGL.size(), targetRect, matrix, opacity, mask);
+    drawTexture(textureGL.id(), textureGL.isOpaque() ? 0 : SupportsBlending, textureGL.size(), targetRect, matrix, opacity, mask, exposedEdges);
 }
 
 #if defined(GL_ARB_texture_rectangle)
@@ -382,6 +421,7 @@ void TextureMapperGL::drawTextureRectangleARB(uint32_t texture, Flags flags, con
     GL_CMD(glUniform1i(program->sourceTextureLocation(), 0));
 
     GL_CMD(glUniform1f(program->flipLocation(), !!(flags & ShouldFlipTexture)));
+    GL_CMD(glUniform2f(program->textureSizeLocation(), textureSize.width(), textureSize.height()));
 
     if (TextureMapperShaderProgram::isValidUniformLocation(program->opacityLocation()))
         GL_CMD(glUniform1f(program->opacityLocation(), opacity));
@@ -395,12 +435,16 @@ void TextureMapperGL::drawTextureRectangleARB(uint32_t texture, Flags flags, con
     }
 
     bool needsBlending = (flags & SupportsBlending) || opacity < 0.99 || maskTexture;
-    drawRect(targetRect, modelViewMatrix, program.get(), GL_TRIANGLE_FAN, needsBlending);
+    drawQuad(targetRect, modelViewMatrix, program.get(), GL_TRIANGLE_FAN, needsBlending);
 }
 #endif // defined(GL_ARB_texture_rectangle) 
 
-void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const IntSize& textureSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
+void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const IntSize& /* textureSize */, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture, unsigned exposedEdges)
 {
+    bool needsAntiliaing = m_enableEdgeDistanceAntialiasing && !modelViewMatrix.isIntegerTranslation();
+    if (needsAntiliaing && drawTextureWithAntialiasing(texture, flags, targetRect, modelViewMatrix, opacity, maskTexture, exposedEdges))
+       return;
+
     RefPtr<TextureMapperShaderProgram> program;
     if (maskTexture)
         program = data().sharedGLData().textureMapperShaderManager.getShaderProgram(TextureMapperShaderManager::OpacityAndMask);
@@ -408,6 +452,142 @@ void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const IntSize&
         program = data().sharedGLData().textureMapperShaderManager.getShaderProgram(TextureMapperShaderManager::Simple);
     GL_CMD(glUseProgram(program->id()));
 
+    drawTexturedQuadWithProgram(program.get(), texture, flags, targetRect, modelViewMatrix, opacity, maskTexture);
+}
+
+static TransformationMatrix viewportMatrix()
+{
+    GLint viewport[4];
+    GL_CMD(glGetIntegerv(GL_VIEWPORT, viewport));
+
+    TransformationMatrix matrix;
+    matrix.translate3d(viewport[0], viewport[1], 0);
+    matrix.scale3d(viewport[2], viewport[3], 0);
+
+    // Map x, y and z to unit square from OpenGL normalized device
+    // coordinates which are -1 to 1 on every axis.
+    matrix.translate3d(0.5, 0.5, 0.5);
+    matrix.scale3d(0.5, 0.5, 0.5);
+
+    return matrix;
+}
+
+static void scaleLineEquationCoeffecientsToOptimizeDistanceCalculation(float* coeffecients)
+{
+    // In the fragment shader we want to calculate the distance from this
+    // line to a point (p), which is given by the formula:
+    // (A*p.x + B*p.y + C) / sqrt (a^2 + b^2)
+    // We can do a small amount of precalculation here to reduce the
+    // amount of math in the shader by scaling the coeffecients now.
+    float scale = 1.0 / FloatPoint(coeffecients[0], coeffecients[1]).length();
+    coeffecients[0] = coeffecients[0] * scale;
+    coeffecients[1] = coeffecients[1] * scale;
+    coeffecients[2] = coeffecients[2] * scale;
+}
+
+static void getStandardEquationCoeffecientsForLine(const FloatPoint& p1, const FloatPoint& p2, float* coeffecients)
+{
+    // Given two points, the standard equation of a line (Ax + By + C = 0)
+    // can be calculated via the formula:
+    // (p1.y – p2.y)x + (p1.x – p2.x)y + ((p1.x*p2.y) – (p2.x*p1.y)) = 0
+    coeffecients[0] = p1.y() - p2.y();
+    coeffecients[1] = p2.x() - p1.x();
+    coeffecients[2] = p1.x() * p2.y() - p2.x() * p1.y();
+    scaleLineEquationCoeffecientsToOptimizeDistanceCalculation(coeffecients);
+}
+
+static void quadToEdgeArray(const FloatQuad& quad, float* edgeArray)
+{
+    if (quad.isCounterclockwise()) {
+        getStandardEquationCoeffecientsForLine(quad.p4(), quad.p3(), edgeArray);
+        getStandardEquationCoeffecientsForLine(quad.p3(), quad.p2(), edgeArray + 3);
+        getStandardEquationCoeffecientsForLine(quad.p2(), quad.p1(), edgeArray + 6);
+        getStandardEquationCoeffecientsForLine(quad.p1(), quad.p4(), edgeArray + 9);
+        return;
+    }
+    getStandardEquationCoeffecientsForLine(quad.p4(), quad.p1(), edgeArray);
+    getStandardEquationCoeffecientsForLine(quad.p1(), quad.p2(), edgeArray + 3);
+    getStandardEquationCoeffecientsForLine(quad.p2(), quad.p3(), edgeArray + 6);
+    getStandardEquationCoeffecientsForLine(quad.p3(), quad.p4(), edgeArray + 9);
+}
+
+static FloatSize scaledVectorDifference(const FloatPoint& point1, const FloatPoint& point2, float scale)
+{
+    FloatSize vector = point1 - point2;
+    if (vector.diagonalLengthSquared())
+        vector.scale(1.0 / vector.diagonalLength());
+
+    vector.scale(scale);
+    return vector;
+}
+
+static FloatQuad inflateQuad(const FloatQuad& quad, float distance)
+{
+    FloatQuad expandedQuad = quad;
+    expandedQuad.setP1(expandedQuad.p1() + scaledVectorDifference(quad.p1(), quad.p2(), distance));
+    expandedQuad.setP4(expandedQuad.p4() + scaledVectorDifference(quad.p4(), quad.p3(), distance));
+
+    expandedQuad.setP1(expandedQuad.p1() + scaledVectorDifference(quad.p1(), quad.p4(), distance));
+    expandedQuad.setP2(expandedQuad.p2() + scaledVectorDifference(quad.p2(), quad.p3(), distance));
+
+    expandedQuad.setP2(expandedQuad.p2() + scaledVectorDifference(quad.p2(), quad.p1(), distance));
+    expandedQuad.setP3(expandedQuad.p3() + scaledVectorDifference(quad.p3(), quad.p4(), distance));
+
+    expandedQuad.setP3(expandedQuad.p3() + scaledVectorDifference(quad.p3(), quad.p2(), distance));
+    expandedQuad.setP4(expandedQuad.p4() + scaledVectorDifference(quad.p4(), quad.p1(), distance));
+
+    return expandedQuad;
+}
+
+bool TextureMapperGL::drawTextureWithAntialiasing(uint32_t texture, Flags flags, const FloatRect& originalTargetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture, unsigned exposedEdges)
+{
+    // The antialiasing path does not support mask textures at the moment.
+    if (maskTexture)
+        return false;
+
+    // For now we punt on rendering tiled layers with antialiasing. It's quite hard
+    // to render them without seams.
+    if (exposedEdges != AllEdges)
+        return false;
+
+    // The goal here is render a slightly larger (0.75 pixels in screen space) quad and to
+    // gradually taper off the alpha values to do a simple version of edge distance
+    // antialiasing. Note here that we are also including the viewport matrix (which
+    // translates from normalized device coordinates to screen coordinates), because these
+    // values are consumed in the fragment shader, which works in screen coordinates.
+    TransformationMatrix screenSpaceTransform = viewportMatrix().multiply(TransformationMatrix(data().projectionMatrix)).multiply(modelViewMatrix).to2dTransform();
+    if (!screenSpaceTransform.isInvertible())
+        return false;
+    FloatQuad quadInScreenSpace = screenSpaceTransform.mapQuad(originalTargetRect);
+
+    const float inflationDistance = 0.75;
+    FloatQuad expandedQuadInScreenSpace = inflateQuad(quadInScreenSpace, inflationDistance);
+
+    // In the non-antialiased case the vertices passed are the unit rectangle and double
+    // as the texture coordinates (0,0 1,0, 1,1 and 0,1). Here we map the expanded quad
+    // coordinates in screen space back to the original rect's texture coordinates.
+    // This has the effect of slightly increasing the size of the original quad's geometry
+    // in the vertex shader.
+    FloatQuad expandedQuadInTextureCoordinates = screenSpaceTransform.inverse().mapQuad(expandedQuadInScreenSpace);
+    expandedQuadInTextureCoordinates.move(-originalTargetRect.x(), -originalTargetRect.y());
+    expandedQuadInTextureCoordinates.scale(1 / originalTargetRect.width(), 1 / originalTargetRect.height());
+
+    // We prepare both the expanded quad for the fragment shader as well as the rectangular bounding
+    // box of that quad, as that seems necessary to properly antialias backfacing quads.
+    float targetQuadEdges[24];
+    quadToEdgeArray(expandedQuadInScreenSpace, targetQuadEdges);
+    quadToEdgeArray(inflateQuad(quadInScreenSpace.boundingBox(),  inflationDistance), targetQuadEdges + 12);
+
+    RefPtr<TextureMapperShaderProgramAntialiasingNoMask> program = data().sharedGLData().textureMapperShaderManager.antialiasingNoMaskProgram();
+    GL_CMD(glUseProgram(program->id()));
+    GL_CMD(glUniform3fv(program->expandedQuadEdgesInScreenSpaceLocation(), 8, targetQuadEdges));
+
+    drawTexturedQuadWithProgram(program.get(), texture, flags, DrawQuad(originalTargetRect, expandedQuadInTextureCoordinates), modelViewMatrix, opacity, 0 /* maskTexture */);
+    return true;
+}
+
+void TextureMapperGL::drawTexturedQuadWithProgram(TextureMapperShaderProgram* program, uint32_t texture, Flags flags, const DrawQuad& quadToDraw, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
+{
     GL_CMD(glEnableVertexAttribArray(program->vertexAttrib()));
     GL_CMD(glActiveTexture(GL_TEXTURE0));
     GL_CMD(glBindTexture(GL_TEXTURE_2D, texture));
@@ -427,7 +607,7 @@ void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const IntSize&
     }
 
     bool needsBlending = (flags & SupportsBlending) || opacity < 0.99 || maskTexture;
-    drawRect(targetRect, modelViewMatrix, program.get(), GL_TRIANGLE_FAN, needsBlending);
+    drawQuad(quadToDraw, modelViewMatrix, program, GL_TRIANGLE_FAN, needsBlending);
 }
 
 bool BitmapTextureGL::canReuseWith(const IntSize& contentsSize, Flags)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
index e75bb08b4..076e65f73 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
@@ -50,11 +50,14 @@ public:
 
     // TextureMapper implementation
     virtual void drawBorder(const Color&, float borderWidth, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) OVERRIDE;
-    virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture) OVERRIDE;
-    virtual void drawTexture(uint32_t texture, Flags, const IntSize& textureSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture);
+    virtual void drawRepaintCounter(int value, int pointSize, const FloatPoint&, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) OVERRIDE;
+    virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture, unsigned exposedEdges) OVERRIDE;
+    virtual void drawTexture(uint32_t texture, Flags, const IntSize& textureSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture, unsigned exposedEdges = AllEdges);
+
 #if defined(GL_ARB_texture_rectangle)
     virtual void drawTextureRectangleARB(uint32_t texture, Flags, const IntSize& textureSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture);
 #endif
+
     virtual void bindSurface(BitmapTexture* surface) OVERRIDE;
     virtual void beginClip(const TransformationMatrix&, const FloatRect&) OVERRIDE;
     virtual void beginPainting(PaintFlags = 0) OVERRIDE;
@@ -69,6 +72,7 @@ public:
     void drawFiltered(const BitmapTexture& sourceTexture, const BitmapTexture& contentTexture, const FilterOperation&, int pass);
 #endif
 
+    void setEnableEdgeDistanceAntialiasing(bool enabled) { m_enableEdgeDistanceAntialiasing = enabled; }
 
 private:
 
@@ -94,7 +98,21 @@ private:
         Vector<ClipState> clipStack;
     };
 
-    void drawRect(const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, TextureMapperShaderProgram*, GLenum drawingMode, bool needsBlending);
+    struct DrawQuad {
+        DrawQuad(const FloatRect& originalTargetRect, const FloatQuad& targetRectMappedToUnitSquare = FloatRect(FloatPoint(), FloatSize(1, 1)))
+            : originalTargetRect(originalTargetRect)
+            , targetRectMappedToUnitSquare(targetRectMappedToUnitSquare)
+        {
+        }
+
+        FloatRect originalTargetRect;
+        FloatQuad targetRectMappedToUnitSquare;
+    };
+
+    bool drawTextureWithAntialiasing(uint32_t texture, Flags, const FloatRect& originalTargetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture, unsigned exposedEdges);
+    void drawTexturedQuadWithProgram(TextureMapperShaderProgram*, uint32_t texture, Flags, const DrawQuad&, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture);
+    void drawQuad(const DrawQuad&, const TransformationMatrix& modelViewMatrix, TextureMapperShaderProgram*, GLenum drawingMode, bool needsBlending);
+
     bool beginScissorClip(const TransformationMatrix&, const FloatRect&);
     void bindDefaultSurface();
     ClipStack& clipStack();
@@ -102,6 +120,8 @@ private:
     TextureMapperGLData* m_data;
     GraphicsContext* m_context;
     ClipStack m_clipStack;
+    bool m_enableEdgeDistanceAntialiasing;
+
     friend class BitmapTextureGL;
 };
 
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
index 79470b393..d5019e6a6 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.cpp
@@ -82,7 +82,7 @@ void TextureMapperImageBuffer::beginClip(const TransformationMatrix& matrix, con
 #endif
 }
 
-void TextureMapperImageBuffer::drawTexture(const BitmapTexture& texture, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, const BitmapTexture* maskTexture)
+void TextureMapperImageBuffer::drawTexture(const BitmapTexture& texture, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, const BitmapTexture* maskTexture, unsigned /* exposedEdges */)
 {
     GraphicsContext* context = currentContext();
     if (!context)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
index ebcba4b08..4e2c69154 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
@@ -52,7 +52,8 @@ public:
 
     // TextureMapper implementation
     virtual void drawBorder(const Color& color, float borderWidth, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) OVERRIDE { };
-    virtual void drawTexture(const BitmapTexture&, const FloatRect& targetRect, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture) OVERRIDE;
+    virtual void drawRepaintCounter(int value, int pointSize, const FloatPoint&, const TransformationMatrix& modelViewMatrix = TransformationMatrix()) OVERRIDE { };
+    virtual void drawTexture(const BitmapTexture&, const FloatRect& targetRect, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture, unsigned exposedEdges) OVERRIDE;
     virtual void beginClip(const TransformationMatrix&, const FloatRect&) OVERRIDE;
     virtual void bindSurface(BitmapTexture* surface) OVERRIDE { m_currentSurface = surface;}
     virtual void endClip() OVERRIDE { graphicsContext()->restore(); }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
index fd4bf2f7a..cdd495201 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
@@ -31,6 +31,7 @@
 
 #if USE(CAIRO)
 #include "CairoUtilities.h"
+#include <wtf/text/CString.h>
 #endif
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
index b165df670..0fbdbe95c 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
@@ -1,6 +1,7 @@
 /*
  Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
  Copyright (C) 2012 Igalia S.L.
+ Copyright (C) 2011 Google Inc. All rights reserved.
 
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Library General Public
@@ -105,14 +106,53 @@ static const char* fragmentShaderSourceSimple =
         }
     );
 
+static const char* fragmentShaderSourceAntialiasingNoMask =
+    FRAGMENT_SHADER(
+        uniform sampler2D s_source;
+        varying highp vec2 v_sourceTexCoord;
+        uniform lowp float u_opacity;
+        uniform vec3 u_expandedQuadEdgesInScreenSpace[8];
+        void main()
+        {
+            vec4 sampledColor = texture2D(s_source, clamp(v_sourceTexCoord, 0.0, 1.0));
+            vec3 pos = vec3(gl_FragCoord.xy, 1);
+
+            // The data passed in u_expandedQuadEdgesInScreenSpace is merely the
+            // pre-scaled coeffecients of the line equations describing the four edges
+            // of the expanded quad in screen space and the rectangular bounding box
+            // of the expanded quad.
+            //
+            // We are doing a simple distance calculation here according to the formula:
+            // (A*p.x + B*p.y + C) / sqrt(A^2 + B^2) = distance from line to p
+            // Note that A, B and C have already been scaled by 1 / sqrt(A^2 + B^2).
+            float a0 = clamp(dot(u_expandedQuadEdgesInScreenSpace[0], pos), 0.0, 1.0);
+            float a1 = clamp(dot(u_expandedQuadEdgesInScreenSpace[1], pos), 0.0, 1.0);
+            float a2 = clamp(dot(u_expandedQuadEdgesInScreenSpace[2], pos), 0.0, 1.0);
+            float a3 = clamp(dot(u_expandedQuadEdgesInScreenSpace[3], pos), 0.0, 1.0);
+            float a4 = clamp(dot(u_expandedQuadEdgesInScreenSpace[4], pos), 0.0, 1.0);
+            float a5 = clamp(dot(u_expandedQuadEdgesInScreenSpace[5], pos), 0.0, 1.0);
+            float a6 = clamp(dot(u_expandedQuadEdgesInScreenSpace[6], pos), 0.0, 1.0);
+            float a7 = clamp(dot(u_expandedQuadEdgesInScreenSpace[7], pos), 0.0, 1.0);
+
+            // Now we want to reduce the alpha value of the fragment if it is close to the
+            // edges of the expanded quad (or rectangular bounding box -- which seems to be
+            // important for backfacing quads). Note that we are combining the contribution
+            // from the (top || bottom) and (left || right) edge by simply multiplying. This follows
+            // the approach described at: http://http.developer.nvidia.com/GPUGems2/gpugems2_chapter22.html,
+            // in this case without using Gaussian weights.
+            gl_FragColor = sampledColor * u_opacity * min(min(a0, a2) * min(a1, a3), min(a4, a6) * min(a5, a7));
+        }
+    );
+
 static const char* fragmentShaderSourceRectSimple =
     FRAGMENT_SHADER(
         uniform sampler2DRect s_source;
+        uniform lowp vec2 u_textureSize;
         uniform lowp float u_opacity;
         varying highp vec2 v_sourceTexCoord;
         void main(void)
         {
-            lowp vec4 color = texture2DRect(s_source, v_sourceTexCoord);
+            lowp vec4 color = texture2DRect(s_source, u_textureSize * v_sourceTexCoord);
             gl_FragColor = vec4(color.rgb * u_opacity, color.a * u_opacity);
         }
     );
@@ -155,6 +195,11 @@ PassRefPtr<TextureMapperShaderProgramSolidColor> TextureMapperShaderManager::sol
     return static_pointer_cast<TextureMapperShaderProgramSolidColor>(getShaderProgram(SolidColor));
 }
 
+PassRefPtr<TextureMapperShaderProgramAntialiasingNoMask> TextureMapperShaderManager::antialiasingNoMaskProgram()
+{
+    return static_pointer_cast<TextureMapperShaderProgramAntialiasingNoMask>(getShaderProgram(AntialiasingNoMask));
+}
+
 PassRefPtr<TextureMapperShaderProgram> TextureMapperShaderManager::getShaderProgram(ShaderType shaderType)
 {
     RefPtr<TextureMapperShaderProgram> program;
@@ -172,6 +217,9 @@ PassRefPtr<TextureMapperShaderProgram> TextureMapperShaderManager::getShaderProg
     case RectSimple:
         program = TextureMapperShaderProgramRectSimple::create();
         break;
+    case AntialiasingNoMask:
+        program = TextureMapperShaderProgramAntialiasingNoMask::create();
+        break;
     case OpacityAndMask:
         program = TextureMapperShaderProgramOpacityAndMask::create();
         break;
@@ -195,6 +243,7 @@ TextureMapperShaderProgram::TextureMapperShaderProgram(const char* vertexShaderS
     , m_fragmentShader(0)
     , m_matrixLocation(-1)
     , m_flipLocation(-1)
+    , m_textureSizeLocation(-1)
     , m_sourceTextureLocation(-1)
     , m_opacityLocation(-1)
     , m_maskTextureLocation(-1)
@@ -214,11 +263,13 @@ void TextureMapperShaderProgram::initializeProgram()
     GLuint programID = glCreateProgram();
     glCompileShader(vertexShader);
     glCompileShader(fragmentShader);
+
     glAttachShader(programID, vertexShader);
     glAttachShader(programID, fragmentShader);
     glLinkProgram(programID);
 
     m_vertexAttrib = glGetAttribLocation(programID, "a_vertex");
+
     m_id = programID;
     m_vertexShader = vertexShader;
     m_fragmentShader = fragmentShader;
@@ -265,8 +316,9 @@ TextureMapperShaderProgramRectSimple::TextureMapperShaderProgramRectSimple()
     : TextureMapperShaderProgram(vertexShaderSourceSimple, fragmentShaderSourceRectSimple)
 {
     initializeProgram();
-    getUniformLocation(m_flipLocation, "u_flip");
     getUniformLocation(m_matrixLocation, "u_matrix");
+    getUniformLocation(m_flipLocation, "u_flip");
+    getUniformLocation(m_textureSizeLocation, "u_textureSize");
     getUniformLocation(m_sourceTextureLocation, "s_source");
     getUniformLocation(m_opacityLocation, "u_opacity");
 }
@@ -293,6 +345,17 @@ TextureMapperShaderProgramRectOpacityAndMask::TextureMapperShaderProgramRectOpac
     getUniformLocation(m_opacityLocation, "u_opacity");
 }
 
+TextureMapperShaderProgramAntialiasingNoMask::TextureMapperShaderProgramAntialiasingNoMask()
+    : TextureMapperShaderProgram(vertexShaderSourceSimple, fragmentShaderSourceAntialiasingNoMask)
+{
+    initializeProgram();
+    getUniformLocation(m_matrixLocation, "u_matrix");
+    getUniformLocation(m_sourceTextureLocation, "s_source");
+    getUniformLocation(m_opacityLocation, "u_opacity");
+    getUniformLocation(m_expandedQuadEdgesInScreenSpaceLocation, "u_expandedQuadEdgesInScreenSpace");
+    getUniformLocation(m_flipLocation, "u_flip");
+}
+
 TextureMapperShaderManager::TextureMapperShaderManager()
 {
     ASSERT(initializeOpenGLShims());
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
index 8bbb30a45..785498e7f 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
@@ -53,6 +53,7 @@ public:
     virtual void prepare(float opacity, const BitmapTexture*) { }
     GLint matrixLocation() const { return m_matrixLocation; }
     GLint flipLocation() const { return m_flipLocation; }
+    GLint textureSizeLocation() const { return m_textureSizeLocation; }
     GLint sourceTextureLocation() const { return m_sourceTextureLocation; }
     GLint maskTextureLocation() const { return m_maskTextureLocation; }
     GLint opacityLocation() const { return m_opacityLocation; }
@@ -72,6 +73,7 @@ protected:
     GLuint m_fragmentShader;
     GLint m_matrixLocation;
     GLint m_flipLocation;
+    GLint m_textureSizeLocation;
     GLint m_sourceTextureLocation;
     GLint m_opacityLocation;
     GLint m_maskTextureLocation;
@@ -175,11 +177,29 @@ private:
     GLint m_colorLocation;
 };
 
+class TextureMapperShaderProgramAntialiasingNoMask : public TextureMapperShaderProgram {
+public:
+    static PassRefPtr<TextureMapperShaderProgramAntialiasingNoMask> create()
+    {
+        return adoptRef(new TextureMapperShaderProgramAntialiasingNoMask());
+    }
+
+    GLint expandedQuadVerticesInTextureCoordinatesLocation() { return m_expandedQuadVerticesInTextureCordinatesLocation; }
+    GLint expandedQuadEdgesInScreenSpaceLocation() { return m_expandedQuadEdgesInScreenSpaceLocation; }
+
+private:
+    TextureMapperShaderProgramAntialiasingNoMask();
+
+    GLint m_expandedQuadVerticesInTextureCordinatesLocation;
+    GLint m_expandedQuadEdgesInScreenSpaceLocation;
+};
+
 class TextureMapperShaderManager {
 public:
     enum ShaderType {
         Invalid = 0, // HashMaps do not like 0 as a key.
         Simple,
+        AntialiasingNoMask,
         RectSimple,
         OpacityAndMask,
         RectOpacityAndMask,
@@ -196,6 +216,7 @@ public:
 
     PassRefPtr<TextureMapperShaderProgram> getShaderProgram(ShaderType);
     PassRefPtr<TextureMapperShaderProgramSolidColor> solidColorProgram();
+    PassRefPtr<TextureMapperShaderProgramAntialiasingNoMask> antialiasingNoMaskProgram();
 
 private:
     typedef HashMap<ShaderType, RefPtr<TextureMapperShaderProgram>, DefaultHash<int>::Hash, HashTraits<int> > TextureMapperShaderProgramMap;
diff --git a/Source/WebCore/platform/gtk/ContextMenuGtk.cpp b/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
index 62a7eecd2..8916525db 100644
--- a/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
+++ b/Source/WebCore/platform/gtk/ContextMenuGtk.cpp
@@ -23,8 +23,9 @@
 
 #include "ContextMenu.h"
 
-#include <wtf/gobject/GOwnPtr.h>
 #include <gtk/gtk.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/gobject/GRefPtr.h>
 
 namespace WebCore {
 
@@ -48,10 +49,14 @@ void ContextMenu::appendItem(ContextMenuItem& item)
 {
     ASSERT(m_platformDescription);
 
-    GtkMenuItem* platformItem = item.releasePlatformDescription();
+    GRefPtr<GtkWidget> platformItem = GTK_WIDGET(item.releasePlatformDescription());
     ASSERT(platformItem);
-    gtk_menu_shell_append(GTK_MENU_SHELL(m_platformDescription), GTK_WIDGET(platformItem));
-    gtk_widget_show(GTK_WIDGET(platformItem));
+
+    if (GtkWidget* parent = gtk_widget_get_parent(platformItem.get()))
+        gtk_container_remove(GTK_CONTAINER(parent), platformItem.get());
+
+    gtk_menu_shell_append(GTK_MENU_SHELL(m_platformDescription), platformItem.get());
+    gtk_widget_show(platformItem.get());
 }
 
 void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
diff --git a/Source/WebCore/platform/gtk/ContextMenuItemGtk.cpp b/Source/WebCore/platform/gtk/ContextMenuItemGtk.cpp
index 68ae5a5de..d70b5be6b 100644
--- a/Source/WebCore/platform/gtk/ContextMenuItemGtk.cpp
+++ b/Source/WebCore/platform/gtk/ContextMenuItemGtk.cpp
@@ -144,6 +144,17 @@ static PlatformMenuItemDescription createPlatformMenuItemDescription(ContextMenu
 ContextMenuItem::ContextMenuItem(PlatformMenuItemDescription item)
     : m_platformDescription(item)
 {
+    // Don't show accel labels in context menu items.
+    GtkAction* action = gtkAction();
+    if (!action)
+        return;
+
+    if (!gtk_action_get_accel_path(action))
+        return;
+
+    GtkWidget* child = gtk_bin_get_child(GTK_BIN(item));
+    if (GTK_IS_ACCEL_LABEL(child))
+        gtk_accel_label_set_accel_closure(GTK_ACCEL_LABEL(child), 0);
 }
 
 ContextMenuItem::ContextMenuItem(ContextMenu* subMenu)
diff --git a/Source/WebCore/platform/gtk/GamepadsGtk.cpp b/Source/WebCore/platform/gtk/GamepadsGtk.cpp
new file mode 100644
index 000000000..f8a73f4e6
--- /dev/null
+++ b/Source/WebCore/platform/gtk/GamepadsGtk.cpp
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2012 Zan Dobersek <zandobersek@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "Gamepads.h"
+
+#if ENABLE(GAMEPAD)
+
+#include "GamepadDeviceLinux.h"
+#include "GamepadList.h"
+#include "Logging.h"
+#include <gio/gunixinputstream.h>
+#include <gudev/gudev.h>
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/gobject/GRefPtr.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class GamepadDeviceGtk : public GamepadDeviceLinux {
+public:
+    static PassOwnPtr<GamepadDeviceGtk> create(String deviceFile)
+    {
+        return adoptPtr(new GamepadDeviceGtk(deviceFile));
+    }
+    ~GamepadDeviceGtk();
+
+private:
+    GamepadDeviceGtk(String deviceFile);
+
+    static gboolean readCallback(GObject* pollableStream, gpointer data);
+    GRefPtr<GInputStream> m_inputStream;
+    GRefPtr<GSource> m_source;
+};
+
+GamepadDeviceGtk::GamepadDeviceGtk(String deviceFile)
+    : GamepadDeviceLinux(deviceFile)
+{
+    if (m_fileDescriptor == -1)
+        return;
+
+    m_inputStream = adoptGRef(g_unix_input_stream_new(m_fileDescriptor, FALSE));
+    m_source = adoptGRef(g_pollable_input_stream_create_source(G_POLLABLE_INPUT_STREAM(m_inputStream.get()), 0));
+    g_source_set_callback(m_source.get(), reinterpret_cast<GSourceFunc>(readCallback), this, 0);
+    g_source_attach(m_source.get(), 0);
+}
+
+GamepadDeviceGtk::~GamepadDeviceGtk()
+{
+    if (m_source)
+        g_source_destroy(m_source.get());
+}
+
+gboolean GamepadDeviceGtk::readCallback(GObject* pollableStream, gpointer data)
+{
+    GamepadDeviceGtk* gamepadDevice = reinterpret_cast<GamepadDeviceGtk*>(data);
+    GOwnPtr<GError> error;
+    struct js_event event;
+
+    gssize len = g_pollable_input_stream_read_nonblocking(G_POLLABLE_INPUT_STREAM(pollableStream),
+                                                          &event, sizeof(event), 0, &error.outPtr());
+
+    // FIXME: Properly log the error.
+    // In the case of G_IO_ERROR_WOULD_BLOCK error return TRUE to wait until
+    // the source becomes readable again and FALSE otherwise.
+    if (error)
+        return g_error_matches(error.get(), G_IO_ERROR, G_IO_ERROR_WOULD_BLOCK);
+
+    ASSERT(len == sizeof(event));
+    gamepadDevice->updateForEvent(event);
+    return TRUE;
+}
+
+class GamepadsGtk {
+public:
+    GamepadsGtk(unsigned length);
+
+    void registerDevice(String deviceFile);
+    void unregisterDevice(String deviceFile);
+
+    void updateGamepadList(GamepadList*);
+
+private:
+    ~GamepadsGtk();
+    static void onUEventCallback(GUdevClient*, gchar* action, GUdevDevice*, gpointer data);
+    static gboolean isGamepadDevice(GUdevDevice*);
+
+    Vector<OwnPtr<GamepadDeviceGtk> > m_slots;
+    HashMap<String, GamepadDeviceGtk*> m_deviceMap;
+
+    GRefPtr<GUdevClient> m_gudevClient;
+};
+
+GamepadsGtk::GamepadsGtk(unsigned length)
+    : m_slots(length)
+{
+    static const char* subsystems[] = { "input", 0 };
+    m_gudevClient = adoptGRef(g_udev_client_new(subsystems));
+    g_signal_connect(m_gudevClient.get(), "uevent", G_CALLBACK(onUEventCallback), this);
+
+    GOwnPtr<GList> devicesList(g_udev_client_query_by_subsystem(m_gudevClient.get(), subsystems[0]));
+    for (GList* listItem = devicesList.get(); listItem; listItem = g_list_next(listItem)) {
+        GUdevDevice* device = G_UDEV_DEVICE(listItem->data);
+        String deviceFile = String::fromUTF8(g_udev_device_get_device_file(device));
+        if (isGamepadDevice(device))
+            registerDevice(deviceFile);
+        g_object_unref(device);
+    }
+}
+
+GamepadsGtk::~GamepadsGtk()
+{
+    g_signal_handlers_disconnect_matched(m_gudevClient.get(), G_SIGNAL_MATCH_DATA, 0, 0, 0, 0, this);
+}
+
+void GamepadsGtk::registerDevice(String deviceFile)
+{
+    LOG(Gamepad, "GamepadsGtk::registerDevice %s", deviceFile.ascii().data());
+    ASSERT(!m_deviceMap.contains(deviceFile));
+
+    for (unsigned index = 0; index < m_slots.size(); index++) {
+        if (!m_slots[index]) {
+            m_slots[index] = GamepadDeviceGtk::create(deviceFile);
+            m_deviceMap.add(deviceFile, m_slots[index].get());
+            break;
+        }
+    }
+}
+
+void GamepadsGtk::unregisterDevice(String deviceFile)
+{
+    LOG(Gamepad, "GamepadsGtk::unregisterDevice %s", deviceFile.ascii().data());
+    ASSERT(m_deviceMap.contains(deviceFile));
+
+    GamepadDeviceGtk* gamepadDevice = m_deviceMap.take(deviceFile);
+    size_t index = m_slots.find(gamepadDevice);
+    ASSERT(index != notFound);
+
+    m_slots[index].clear();
+}
+
+void GamepadsGtk::updateGamepadList(GamepadList* into)
+{
+    ASSERT(m_slots.size() == into->length());
+
+    for (unsigned i = 0; i < m_slots.size(); i++) {
+        if (m_slots[i].get() && m_slots[i]->connected()) {
+            GamepadDeviceGtk* gamepadDevice = m_slots[i].get();
+            RefPtr<Gamepad> gamepad = into->item(i);
+            if (!gamepad)
+                gamepad = Gamepad::create();
+
+            gamepad->index(i);
+            gamepad->id(gamepadDevice->id());
+            gamepad->timestamp(gamepadDevice->timestamp());
+            gamepad->axes(gamepadDevice->axesCount(), gamepadDevice->axesData());
+            gamepad->buttons(gamepadDevice->buttonsCount(), gamepadDevice->buttonsData());
+
+            into->set(i, gamepad);
+        } else
+            into->set(i, 0);
+    }
+}
+
+void GamepadsGtk::onUEventCallback(GUdevClient* udevClient, gchar* action, GUdevDevice* device, gpointer data)
+{
+    if (!isGamepadDevice(device))
+        return;
+
+    GamepadsGtk* gamepadsGtk = reinterpret_cast<GamepadsGtk*>(data);
+    String deviceFile = String::fromUTF8(g_udev_device_get_device_file(device));
+
+    if (!g_strcmp0(action, "add"))
+        gamepadsGtk->registerDevice(deviceFile);
+    else if (!g_strcmp0(action, "remove"))
+        gamepadsGtk->unregisterDevice(deviceFile);
+}
+
+gboolean GamepadsGtk::isGamepadDevice(GUdevDevice* device)
+{
+    const gchar* deviceFile = g_udev_device_get_device_file(device);
+    const gchar* sysfsPath = g_udev_device_get_sysfs_path(device);
+    if (!deviceFile || !sysfsPath)
+        return FALSE;
+
+    if (!g_udev_device_has_property(device, "ID_INPUT") || !g_udev_device_has_property(device, "ID_INPUT_JOYSTICK"))
+        return FALSE;
+
+    return g_str_has_prefix(deviceFile, "/dev/input/js");
+}
+
+void sampleGamepads(GamepadList* into)
+{
+    DEFINE_STATIC_LOCAL(GamepadsGtk, gamepadsGtk, (into->length()));
+    gamepadsGtk.updateGamepadList(into);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(GAMEPAD)
diff --git a/Source/WebCore/platform/gtk/LoggingGtk.cpp b/Source/WebCore/platform/gtk/LoggingGtk.cpp
index 588ed7cf7..f16a1b24c 100644
--- a/Source/WebCore/platform/gtk/LoggingGtk.cpp
+++ b/Source/WebCore/platform/gtk/LoggingGtk.cpp
@@ -20,8 +20,10 @@
 
 #include "config.h"
 #include "Logging.h"
-#include "PlatformString.h"
 
+#if !LOG_DISABLED
+
+#include "PlatformString.h"
 #include <glib.h>
 #include <string.h>
 
@@ -62,3 +64,5 @@ void initializeLoggingChannelsIfNecessary()
 }
 
 } // namespace WebCore
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/platform/gtk/PlatformScreenGtk.cpp b/Source/WebCore/platform/gtk/PlatformScreenGtk.cpp
index 4b6c1c1a9..5762a8fc7 100644
--- a/Source/WebCore/platform/gtk/PlatformScreenGtk.cpp
+++ b/Source/WebCore/platform/gtk/PlatformScreenGtk.cpp
@@ -137,7 +137,7 @@ FloatRect screenAvailableRect(Widget* widget)
 
 }
 
-void screenColorProfile(Widget*, const String&, ColorProfile&)
+void screenColorProfile(Widget*, ColorProfile&)
 {
     notImplemented();
 }
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index f05e219a2..2eb4f2bad 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -238,10 +238,11 @@ bool RenderThemeGtk::paintTextArea(RenderObject* o, const PaintInfo& i, const In
 static void paintGdkPixbuf(GraphicsContext* context, const GdkPixbuf* icon, const IntRect& iconRect)
 {
     IntSize iconSize(gdk_pixbuf_get_width(icon), gdk_pixbuf_get_height(icon));
+    GRefPtr<GdkPixbuf> scaledIcon;
     if (iconRect.size() != iconSize) {
         // We could use cairo_scale() here but cairo/pixman downscale quality is quite bad.
-        GRefPtr<GdkPixbuf> scaledIcon = gdk_pixbuf_scale_simple(icon, iconRect.width(), iconRect.height(),
-                                                                GDK_INTERP_BILINEAR);
+        scaledIcon = adoptGRef(gdk_pixbuf_scale_simple(icon, iconRect.width(), iconRect.height(),
+                                                       GDK_INTERP_BILINEAR));
         icon = scaledIcon.get();
     }
 
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 2611be900..760ac93f8 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -315,7 +315,7 @@ namespace WebCore {
 #else
                 // FIXME: add support for multiple monitors.
                 ColorProfile profile;
-                screenColorProfile(0, "monitor", profile);
+                screenColorProfile(0, profile);
                 if (!profile.isEmpty())
                     outputDeviceProfile = qcms_profile_from_memory(profile.data(), profile.size());
 #endif
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index ec8de28a4..91f1236b3 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -86,13 +86,17 @@ inline J_COLOR_SPACE rgbOutputColorSpace() { return JCS_RGB; }
 inline bool colorSpaceHasAlpha(J_COLOR_SPACE) { return false; }
 #endif
 
-#if OS(ANDROID)
+#if USE(LOW_QUALITY_IMAGE_NO_JPEG_DITHERING)
 inline J_DCT_METHOD dctMethod() { return JDCT_IFAST; }
 inline J_DITHER_MODE ditherMode() { return JDITHER_NONE; }
-inline bool doFancyUpsampling() { return false; }
 #else
 inline J_DCT_METHOD dctMethod() { return JDCT_ISLOW; }
 inline J_DITHER_MODE ditherMode() { return JDITHER_FS; }
+#endif
+
+#if USE(LOW_QUALITY_IMAGE_NO_JPEG_FANCY_UPSAMPLING)
+inline bool doFancyUpsampling() { return false; }
+#else
 inline bool doFancyUpsampling() { return true; }
 #endif
 
diff --git a/Source/WebCore/platform/linux/GamepadDeviceLinux.cpp b/Source/WebCore/platform/linux/GamepadDeviceLinux.cpp
new file mode 100644
index 000000000..c25bc1b5d
--- /dev/null
+++ b/Source/WebCore/platform/linux/GamepadDeviceLinux.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2012 Zan Dobersek <zandobersek@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "GamepadDeviceLinux.h"
+
+#if ENABLE(GAMEPAD)
+
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+GamepadDeviceLinux::GamepadDeviceLinux(String deviceFile)
+    : m_fileDescriptor(-1)
+    , m_connected(false)
+    , m_lastTimestamp(0)
+{
+    // FIXME: Log errors when returning early.
+    m_fileDescriptor = open(deviceFile.utf8().data(), O_RDONLY | O_NONBLOCK);
+    if (m_fileDescriptor == -1)
+        return;
+
+    char deviceName[1024];
+    if (ioctl(m_fileDescriptor, JSIOCGNAME(sizeof(deviceName)), deviceName) < 0)
+        return;
+    m_deviceName = String(deviceName).simplifyWhiteSpace();
+
+    uint8_t numberOfAxes;
+    uint8_t numberOfButtons;
+    if (ioctl(m_fileDescriptor, JSIOCGAXES, &numberOfAxes) < 0 || ioctl(m_fileDescriptor, JSIOCGBUTTONS, &numberOfButtons) < 0)
+        return;
+    m_axes.fill(0.0, numberOfAxes);
+    m_buttons.fill(0.0, numberOfButtons);
+}
+
+GamepadDeviceLinux::~GamepadDeviceLinux()
+{
+    if (m_fileDescriptor != -1)
+        close(m_fileDescriptor);
+}
+
+void GamepadDeviceLinux::updateForEvent(struct js_event event)
+{
+    if (!(event.type & JS_EVENT_AXIS || event.type & JS_EVENT_BUTTON))
+        return;
+
+    // Mark the device as connected only if it is not yet connected, the event is not an initialization
+    // and the value is not 0 (indicating a genuine interaction with the device).
+    if (!m_connected && !(event.type & JS_EVENT_INIT) && event.value)
+        m_connected = true;
+
+    if (event.type & JS_EVENT_AXIS)
+        m_axes[event.number] = normalizeAxisValue(event.value);
+    else if (event.type & JS_EVENT_BUTTON)
+        m_buttons[event.number] = normalizeButtonValue(event.value);
+
+    m_lastTimestamp = event.time;
+}
+
+float GamepadDeviceLinux::normalizeAxisValue(short value)
+{
+    // Normalize from range [-32767, 32767] into range [-1.0, 1.0]
+    return value / 32767.0f;
+}
+
+float GamepadDeviceLinux::normalizeButtonValue(short value)
+{
+    // Normalize from range [0, 1] into range [0.0, 1.0]
+    return value / 1.0f;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(GAMEPAD)
diff --git a/Source/WebCore/platform/linux/GamepadDeviceLinux.h b/Source/WebCore/platform/linux/GamepadDeviceLinux.h
new file mode 100644
index 000000000..d485e83a9
--- /dev/null
+++ b/Source/WebCore/platform/linux/GamepadDeviceLinux.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2012 Zan Dobersek <zandobersek@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef GamepadDeviceLinux_h
+#define GamepadDeviceLinux_h
+
+#if ENABLE(GAMEPAD)
+
+#include <linux/joystick.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class GamepadDeviceLinux {
+public:
+    bool connected() { return m_connected; };
+
+    String id() { return m_deviceName; }
+    unsigned long long timestamp() { return m_lastTimestamp; }
+
+    unsigned axesCount() { return m_axes.size(); }
+    float* axesData() { return m_axes.data(); }
+
+    unsigned buttonsCount() { return m_buttons.size(); }
+    float* buttonsData() { return m_buttons.data(); }
+
+protected:
+    GamepadDeviceLinux(String deviceFile);
+    ~GamepadDeviceLinux();
+
+    void updateForEvent(struct js_event);
+    int m_fileDescriptor;
+
+private:
+    float normalizeAxisValue(short value);
+    float normalizeButtonValue(short value);
+
+    bool m_connected;
+    String m_deviceName;
+    unsigned long long m_lastTimestamp;
+
+    Vector<float> m_axes;
+    Vector<float> m_buttons;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(GAMEPAD)
+
+#endif // GamepadDeviceLinux_h
diff --git a/Source/WebCore/platform/mac/LoggingMac.mm b/Source/WebCore/platform/mac/LoggingMac.mm
index 4c9b30351..fa007ec2d 100644
--- a/Source/WebCore/platform/mac/LoggingMac.mm
+++ b/Source/WebCore/platform/mac/LoggingMac.mm
@@ -27,6 +27,8 @@
 
 #include "Logging.h"
 
+#if !LOG_DISABLED
+
 namespace WebCore {
 
 static inline void initializeWithUserDefault(WTFLogChannel& channel)
@@ -77,3 +79,5 @@ void initializeLoggingChannelsIfNecessary()
 }
 
 }
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index c1ec63551..604aa7fae 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -368,6 +368,9 @@ String Pasteboard::plainText(Frame* frame)
     
 static PassRefPtr<DocumentFragment> documentFragmentWithImageResource(Frame* frame, PassRefPtr<ArchiveResource> resource)
 {
+    if (!resource)
+        return 0;
+    
     if (DocumentLoader* loader = frame->loader()->documentLoader())
         loader->addArchiveResource(resource.get());
 
diff --git a/Source/WebCore/platform/mac/PlatformScreenMac.mm b/Source/WebCore/platform/mac/PlatformScreenMac.mm
index 273ff78d6..203418b87 100644
--- a/Source/WebCore/platform/mac/PlatformScreenMac.mm
+++ b/Source/WebCore/platform/mac/PlatformScreenMac.mm
@@ -76,7 +76,7 @@ FloatRect screenAvailableRect(Widget* widget)
     return toUserSpace([screenForWindow(window) visibleFrame], window);
 }
 
-void screenColorProfile(Widget*, const String&, ColorProfile&)
+void screenColorProfile(Widget*, ColorProfile&)
 {
     notImplemented();
 }
diff --git a/Source/WebCore/platform/mac/PopupMenuMac.mm b/Source/WebCore/platform/mac/PopupMenuMac.mm
index 46077814c..855784470 100644
--- a/Source/WebCore/platform/mac/PopupMenuMac.mm
+++ b/Source/WebCore/platform/mac/PopupMenuMac.mm
@@ -119,6 +119,9 @@ void PopupMenuMac::populate()
             [m_popup.get() addItemWithTitle:@""];
             NSMenuItem *menuItem = [m_popup.get() lastItem];
             [menuItem setAttributedTitle:string];
+            // We set the title as well as the attributed title here. The attributed title will be displayed in the menu,
+            // but typeahead will use the non-attributed string that doesn't contain any leading or trailing whitespace.
+            [menuItem setTitle:[[string string] stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]]];
             [menuItem setEnabled:client()->itemIsEnabled(i)];
             [menuItem setToolTip:client()->itemToolTip(i)];
             [string release];
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
index 2fe336f74..323719bd6 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -27,6 +27,7 @@
 #include "ScrollbarThemeMac.h"
 
 #include "ImageBuffer.h"
+#include "GraphicsLayer.h"
 #include "LocalCurrentGraphicsContext.h"
 #include "NSScrollerImpDetails.h"
 #include "PlatformMouseEvent.h"
diff --git a/Source/WebCore/platform/mediastream/MediaStreamCenter.cpp b/Source/WebCore/platform/mediastream/MediaStreamCenter.cpp
index 9dd4bb176..f4f9822de 100644
--- a/Source/WebCore/platform/mediastream/MediaStreamCenter.cpp
+++ b/Source/WebCore/platform/mediastream/MediaStreamCenter.cpp
@@ -56,6 +56,20 @@ void MediaStreamCenter::endLocalMediaStream(MediaStreamDescriptor* streamDescrip
         streamDescriptor->setEnded();
 }
 
+void MediaStreamCenter::addMediaStreamTrack(MediaStreamDescriptor* streamDescriptor, MediaStreamComponent* component)
+{
+    MediaStreamDescriptorOwner* owner = streamDescriptor->owner();
+    if (owner)
+        owner->addTrack(component);
+}
+
+void MediaStreamCenter::removeMediaStreamTrack(MediaStreamDescriptor* streamDescriptor, MediaStreamComponent* component)
+{
+    MediaStreamDescriptorOwner* owner = streamDescriptor->owner();
+    if (owner)
+        owner->removeTrack(component);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/mediastream/MediaStreamCenter.h b/Source/WebCore/platform/mediastream/MediaStreamCenter.h
index b3278c734..c8a51deb8 100644
--- a/Source/WebCore/platform/mediastream/MediaStreamCenter.h
+++ b/Source/WebCore/platform/mediastream/MediaStreamCenter.h
@@ -57,9 +57,10 @@ public:
 
     // Calls from the DOM objects to notify the platform
     virtual void didSetMediaStreamTrackEnabled(MediaStreamDescriptor*, MediaStreamComponent*) = 0;
+    virtual void didAddMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*) = 0;
+    virtual void didRemoveMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*) = 0;
     virtual void didStopLocalMediaStream(MediaStreamDescriptor*) = 0;
     virtual void didCreateMediaStream(MediaStreamDescriptor*) = 0;
-
     virtual String constructSDP(IceCandidateDescriptor*) = 0;
     virtual String constructSDP(SessionDescriptionDescriptor*) = 0;
 
@@ -67,6 +68,8 @@ protected:
     MediaStreamCenter();
 
     void endLocalMediaStream(MediaStreamDescriptor*);
+    void addMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*);
+    void removeMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mediastream/MediaStreamDescriptor.h b/Source/WebCore/platform/mediastream/MediaStreamDescriptor.h
index 46332af31..c6061052d 100644
--- a/Source/WebCore/platform/mediastream/MediaStreamDescriptor.h
+++ b/Source/WebCore/platform/mediastream/MediaStreamDescriptor.h
@@ -45,6 +45,8 @@ public:
     virtual ~MediaStreamDescriptorOwner() { }
 
     virtual void streamEnded() = 0;
+    virtual void addTrack(MediaStreamComponent*) = 0;
+    virtual void removeTrack(MediaStreamComponent*) = 0;
 };
 
 class MediaStreamDescriptor : public RefCounted<MediaStreamDescriptor> {
diff --git a/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.cpp b/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.cpp
index 1317d2d83..3c82f5f8b 100644
--- a/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.cpp
+++ b/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.cpp
@@ -83,6 +83,14 @@ void MediaStreamCenterChromium::didSetMediaStreamTrackEnabled(MediaStreamDescrip
     }
 }
 
+void MediaStreamCenterChromium::didAddMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*)
+{
+}
+
+void MediaStreamCenterChromium::didRemoveMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*)
+{
+}
+
 void MediaStreamCenterChromium::didStopLocalMediaStream(MediaStreamDescriptor* stream)
 {
     if (m_private)
@@ -115,6 +123,16 @@ void MediaStreamCenterChromium::stopLocalMediaStream(const WebKit::WebMediaStrea
     endLocalMediaStream(stream);
 }
 
+void MediaStreamCenterChromium::addMediaStreamTrack(const WebKit::WebMediaStreamDescriptor& stream, const WebKit::WebMediaStreamComponent& component)
+{
+    MediaStreamCenter::addMediaStreamTrack(stream, component);
+}
+
+void MediaStreamCenterChromium::removeMediaStreamTrack(const WebKit::WebMediaStreamDescriptor& stream, const WebKit::WebMediaStreamComponent& component)
+{
+    MediaStreamCenter::removeMediaStreamTrack(stream, component);
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.h b/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.h
index d284a86fa..e3fff8af4 100644
--- a/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.h
+++ b/Source/WebCore/platform/mediastream/chromium/MediaStreamCenterChromium.h
@@ -42,6 +42,7 @@
 
 namespace WebKit {
 class WebMediaStreamCenter;
+class WebMediaStreamComponent;
 class WebMediaStreamDescriptor;
 }
 
@@ -61,6 +62,8 @@ public:
     // MediaStreamCenter
     virtual void queryMediaStreamSources(PassRefPtr<MediaStreamSourcesQueryClient>) OVERRIDE;
     virtual void didSetMediaStreamTrackEnabled(MediaStreamDescriptor*, MediaStreamComponent*) OVERRIDE;
+    virtual void didAddMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*) OVERRIDE;
+    virtual void didRemoveMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*) OVERRIDE;
     virtual void didStopLocalMediaStream(MediaStreamDescriptor*) OVERRIDE;
     virtual void didCreateMediaStream(MediaStreamDescriptor*) OVERRIDE;
     virtual String constructSDP(IceCandidateDescriptor*) OVERRIDE;
@@ -68,6 +71,8 @@ public:
 
     // WebKit::WebMediaStreamCenterClient
     virtual void stopLocalMediaStream(const WebKit::WebMediaStreamDescriptor&) OVERRIDE;
+    virtual void addMediaStreamTrack(const WebKit::WebMediaStreamDescriptor&, const WebKit::WebMediaStreamComponent&) OVERRIDE;
+    virtual void removeMediaStreamTrack(const WebKit::WebMediaStreamDescriptor&, const WebKit::WebMediaStreamComponent&) OVERRIDE;
 
 private:
     OwnPtr<WebKit::WebMediaStreamCenter> m_private;
diff --git a/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp b/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp
index fe8bb460d..dc483ff3b 100644
--- a/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp
+++ b/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.cpp
@@ -68,6 +68,14 @@ void MediaStreamCenterGStreamer::didSetMediaStreamTrackEnabled(MediaStreamDescri
 {
 }
 
+void MediaStreamCenterGStreamer::didAddMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*)
+{
+}
+
+void MediaStreamCenterGStreamer::didRemoveMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*)
+{
+}
+
 void MediaStreamCenterGStreamer::didStopLocalMediaStream(MediaStreamDescriptor*)
 {
 }
diff --git a/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h b/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h
index 1564e33bd..7641fb58e 100644
--- a/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h
+++ b/Source/WebCore/platform/mediastream/gstreamer/MediaStreamCenterGStreamer.h
@@ -55,6 +55,8 @@ public:
     // MediaStreamCenter
     virtual void queryMediaStreamSources(PassRefPtr<MediaStreamSourcesQueryClient>) OVERRIDE;
     virtual void didSetMediaStreamTrackEnabled(MediaStreamDescriptor*, MediaStreamComponent*) OVERRIDE;
+    virtual void didAddMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*) OVERRIDE;
+    virtual void didRemoveMediaStreamTrack(MediaStreamDescriptor*, MediaStreamComponent*) OVERRIDE;
     virtual void didStopLocalMediaStream(MediaStreamDescriptor*) OVERRIDE;
     virtual void didCreateMediaStream(MediaStreamDescriptor*) OVERRIDE;
     virtual String constructSDP(IceCandidateDescriptor*) OVERRIDE;
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index 1c22bb493..c64fdc8aa 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -625,12 +625,12 @@ void NetworkJob::sendResponseIfNeeded()
         mimeType = "application/x-ftp-directory";
     else if (mimeType.isNull())
         mimeType = extractMIMETypeFromMediaType(m_contentType);
-    if (mimeType.isNull()) {
-        if (m_dataReceived)
-            mimeType = MIMETypeRegistry::getMIMETypeForPath(urlFilename);
-        else
-            // For empty content, we shouldn't download.
-            mimeType = "text/plain";
+    if (mimeType.isNull())
+        mimeType = MIMETypeRegistry::getMIMETypeForPath(urlFilename);
+    if (!m_dataReceived && mimeType == "application/octet-stream") {
+        // For empty content, if can't guess its mimetype from filename, we manually
+        // set the mimetype to "text/plain" in case it goes to download.
+        mimeType = "text/plain";
     }
     m_response.setMimeType(mimeType);
 
diff --git a/Source/WebCore/platform/network/blackberry/ResourceRequest.h b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
index fdd9db28a..1b0f958f8 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceRequest.h
+++ b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
@@ -107,7 +107,7 @@ public:
     bool mustHandleInternally() const { return m_mustHandleInternally; }
 
     void initializePlatformRequest(BlackBerry::Platform::NetworkRequest&, bool cookiesEnabled, bool isInitial = false, bool isRedirect = false) const;
-    void setForceDownload(bool forceDownload) { m_forceDownload = true; }
+    void setForceDownload(bool forceDownload) { m_forceDownload = forceDownload; }
     bool forceDownload() const { return m_forceDownload; }
     void setSuggestedSaveName(const String& name) { m_suggestedSaveName = name; }
     String suggestedSaveName() const { return m_suggestedSaveName; }
diff --git a/Source/WebCore/platform/network/mac/UTIUtilities.h b/Source/WebCore/platform/network/mac/UTIUtilities.h
new file mode 100644
index 000000000..b3787edd7
--- /dev/null
+++ b/Source/WebCore/platform/network/mac/UTIUtilities.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef UTIUtilities_h
+#define UTIUtilities_h
+
+#import <wtf/RetainPtr.h>
+
+namespace WebCore {
+RetainPtr<CFStringRef> mimeTypeFromUTITree(CFStringRef uti);
+}
+
+#endif // UTIUtilities_h
diff --git a/Source/WebCore/platform/network/mac/UTIUtilities.mm b/Source/WebCore/platform/network/mac/UTIUtilities.mm
new file mode 100644
index 000000000..9cdc0d629
--- /dev/null
+++ b/Source/WebCore/platform/network/mac/UTIUtilities.mm
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "UTIUtilities.h"
+
+#if PLATFORM(IOS)
+#import "SoftLinking.h"
+#import <MobileCoreServices/MobileCoreServices.h>
+
+SOFT_LINK_FRAMEWORK(MobileCoreServices)
+
+SOFT_LINK(MobileCoreServices, UTTypeCopyDeclaration, CFDictionaryRef, (CFStringRef inUTI), (inUTI))
+SOFT_LINK(MobileCoreServices, UTTypeCopyPreferredTagWithClass, CFStringRef, (CFStringRef inUTI, CFStringRef inTagClass), (inUTI, inTagClass))
+
+SOFT_LINK_CONSTANT(MobileCoreServices, kUTTypeConformsToKey, CFStringRef)
+SOFT_LINK_CONSTANT(MobileCoreServices, kUTTagClassMIMEType, CFStringRef)
+
+#define kUTTagClassMIMEType getkUTTagClassMIMEType()
+#define kUTTypeConformsToKey getkUTTypeConformsToKey()
+#endif
+
+namespace WebCore {
+
+RetainPtr<CFStringRef> mimeTypeFromUTITree(CFStringRef uti)
+{
+    // Check if this UTI has a MIME type.
+    RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(uti, kUTTagClassMIMEType));
+    if (mimeType)
+        return mimeType.get();
+
+    // If not, walk the ancestory of this UTI via its "ConformsTo" tags and return the first MIME type we find.
+    RetainPtr<CFDictionaryRef> decl(AdoptCF, UTTypeCopyDeclaration(uti));
+    if (!decl)
+        return nil;
+    CFTypeRef value = CFDictionaryGetValue(decl.get(), kUTTypeConformsToKey);
+    if (!value)
+        return nil;
+    CFTypeID typeID = CFGetTypeID(value);
+
+    if (typeID == CFStringGetTypeID())
+        return mimeTypeFromUTITree((CFStringRef)value);
+
+    if (typeID == CFArrayGetTypeID()) {
+        CFArrayRef newTypes = (CFArrayRef)value;
+        CFIndex count = CFArrayGetCount(newTypes);
+        for (CFIndex i = 0; i < count; ++i) {
+        CFTypeRef object = CFArrayGetValueAtIndex(newTypes, i);
+        if (CFGetTypeID(object) != CFStringGetTypeID())
+            continue;
+
+        if (RetainPtr<CFStringRef> mimeType = mimeTypeFromUTITree((CFStringRef)object))
+            return mimeType;
+        }
+    }
+
+    return nil;
+}
+
+}
diff --git a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
index 09604929c..be2e2767f 100644
--- a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
+++ b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
@@ -30,6 +30,7 @@
 #import "WebCoreURLResponse.h"
 
 #import "MIMETypeRegistry.h"
+#import "UTIUtilities.h"
 #import "WebCoreSystemInterface.h"
 #import <wtf/Assertions.h>
 #import <wtf/RetainPtr.h>
@@ -447,41 +448,6 @@ static CFDictionaryRef createExtensionToMIMETypeMap()
     return CFDictionaryCreate(kCFAllocatorDefault, (const void**)&keys, (const void**)&values, sizeof(keys)/sizeof(CFStringRef), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 }
 
-static RetainPtr<CFStringRef> mimeTypeFromUTITree(CFStringRef uti)
-{
-    // Check if this UTI has a MIME type.
-    RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(uti, kUTTagClassMIMEType));
-    if (mimeType)
-        return mimeType.get();
-    
-    // If not, walk the ancestory of this UTI via its "ConformsTo" tags and return the first MIME type we find.
-    RetainPtr<CFDictionaryRef> decl(AdoptCF, UTTypeCopyDeclaration(uti));
-    if (!decl)
-        return nil;
-    CFTypeRef value = CFDictionaryGetValue(decl.get(), kUTTypeConformsToKey);
-    if (!value)
-        return nil;
-    CFTypeID typeID = CFGetTypeID(value);
-    
-    if (typeID == CFStringGetTypeID())
-        return mimeTypeFromUTITree((CFStringRef)value);
-
-    if (typeID == CFArrayGetTypeID()) {
-        CFArrayRef newTypes = (CFArrayRef)value;
-        CFIndex count = CFArrayGetCount(newTypes);
-        for (CFIndex i = 0; i < count; ++i) {
-            CFTypeRef object = CFArrayGetValueAtIndex(newTypes, i);
-            if (CFGetTypeID(object) != CFStringGetTypeID())
-                continue;
-
-            if (RetainPtr<CFStringRef> mimeType = mimeTypeFromUTITree((CFStringRef)object))
-                return mimeType;
-        }
-    }
-    
-    return nil;
-}
-
 void adjustMIMETypeIfNecessary(CFURLResponseRef cfResponse)
 {
     RetainPtr<CFStringRef> result = wkGetCFURLResponseMIMEType(cfResponse);
diff --git a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
index c6e9bce57..cea115699 100644
--- a/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
+++ b/Source/WebCore/platform/network/soup/CookieJarSoup.cpp
@@ -162,11 +162,9 @@ bool getRawCookies(const Document* document, const KURL& url, Vector<Cookie>& ra
         GOwnPtr<SoupCookie> cookie(static_cast<SoupCookie*>(iter->data));
         if (!soup_cookie_applies_to_uri(cookie.get(), uri.get()))
             continue;
-        // FIXME: we are currently passing false always for session because there's no API to know
-        // whether SoupCookieJar is persistent or not. We could probably add soup_cookie_jar_is_persistent().
         rawCookies.append(Cookie(String::fromUTF8(cookie->name), String::fromUTF8(cookie->value), String::fromUTF8(cookie->domain),
                                  String::fromUTF8(cookie->path), static_cast<double>(soup_date_to_time_t(cookie->expires)) * 1000,
-                                 cookie->http_only, cookie->secure, false));
+                                 cookie->http_only, cookie->secure, soup_cookie_jar_is_persistent(jar)));
     }
 
     return true;
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 10c6fa985..60e4e1532 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -88,7 +88,7 @@ public:
         loadingSynchronousRequest = true;
         GRefPtr<GMainContext> innerMainContext = adoptGRef(g_main_context_new());
         g_main_context_push_thread_default(innerMainContext.get());
-        m_mainLoop = g_main_loop_new(innerMainContext.get(), false);
+        m_mainLoop = adoptGRef(g_main_loop_new(innerMainContext.get(), false));
 
         adjustMaxConnections(1);
     }
@@ -200,11 +200,13 @@ static void ensureSessionIsInitialized(SoupSession* session)
             setSoupCookieJar(jar);
     }
 
+#if !LOG_DISABLED
     if (!soup_session_get_feature(session, SOUP_TYPE_LOGGER) && LogNetwork.state == WTFLogChannelOn) {
         SoupLogger* logger = soup_logger_new(static_cast<SoupLoggerLogLevel>(SOUP_LOGGER_LOG_BODY), -1);
         soup_session_add_feature(session, SOUP_SESSION_FEATURE(logger));
         g_object_unref(logger);
     }
+#endif // !LOG_DISABLED
 
     if (!soup_session_get_feature(session, SOUP_TYPE_REQUESTER)) {
         SoupRequester* requester = soup_requester_new();
diff --git a/Source/WebCore/platform/qt/LoggingQt.cpp b/Source/WebCore/platform/qt/LoggingQt.cpp
index a9346de81..8089e9453 100644
--- a/Source/WebCore/platform/qt/LoggingQt.cpp
+++ b/Source/WebCore/platform/qt/LoggingQt.cpp
@@ -20,6 +20,8 @@
 #include "config.h"
 #include "Logging.h"
 
+#if !LOG_DISABLED
+
 #include "PlatformString.h"
 #include <QDebug>
 #include <QStringList>
@@ -54,3 +56,5 @@ void initializeLoggingChannelsIfNecessary()
 }
 
 } // namespace WebCore
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/platform/qt/PlatformScreenQt.cpp b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
index 564176422..cf381ee68 100644
--- a/Source/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/Source/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -143,7 +143,7 @@ FloatRect screenAvailableRect(Widget* widget)
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
-void screenColorProfile(Widget*, const String&, ColorProfile&)
+void screenColorProfile(Widget*, ColorProfile&)
 {
     notImplemented();
 }
diff --git a/Source/WebCore/platform/qt/QWebPageClient.h b/Source/WebCore/platform/qt/QWebPageClient.h
index 6c9a1ae6c..078999dc2 100644
--- a/Source/WebCore/platform/qt/QWebPageClient.h
+++ b/Source/WebCore/platform/qt/QWebPageClient.h
@@ -34,7 +34,7 @@
 #include <GraphicsLayer.h>
 #endif
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 #include <GraphicsContext3D.h>
 #endif
 
@@ -106,7 +106,7 @@ public:
 
     virtual void setWidgetVisible(WebCore::Widget*, bool visible) = 0;
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
     virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
                                                  PlatformGraphicsSurface3D*) = 0;
 #endif
diff --git a/Source/WebCore/platform/text/DateTimeFormat.cpp b/Source/WebCore/platform/text/DateTimeFormat.cpp
new file mode 100644
index 000000000..6de7fdcde
--- /dev/null
+++ b/Source/WebCore/platform/text/DateTimeFormat.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateTimeFormat.h"
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include <wtf/ASCIICType.h>
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+static const DateTimeFormat::FieldType lowerCaseToFieldTypeMap[26] = {
+    DateTimeFormat::FieldTypePeriod, // a
+    DateTimeFormat::FieldTypeInvalid, // b
+    DateTimeFormat::FieldTypeLocalDayOfWeekStandAlon, // c
+    DateTimeFormat::FieldTypeDayOfMonth, // d
+    DateTimeFormat::FieldTypeLocalDayOfWeek, // e
+    DateTimeFormat::FieldTypeInvalid, // f
+    DateTimeFormat::FieldTypeModifiedJulianDay, // g
+    DateTimeFormat::FieldTypeHour12, // h
+    DateTimeFormat::FieldTypeInvalid, // i
+    DateTimeFormat::FieldTypeInvalid, // j
+    DateTimeFormat::FieldTypeHour24, // k
+    DateTimeFormat::FieldTypeInvalid, // l
+    DateTimeFormat::FieldTypeMinute, // m
+    DateTimeFormat::FieldTypeInvalid, // n
+    DateTimeFormat::FieldTypeInvalid, // o
+    DateTimeFormat::FieldTypeInvalid, // p
+    DateTimeFormat::FieldTypeQuaterStandAlone, // q
+    DateTimeFormat::FieldTypeInvalid, // r
+    DateTimeFormat::FieldTypeSecond, // s
+    DateTimeFormat::FieldTypeInvalid, // t
+    DateTimeFormat::FieldTypeExtendedYear, // u
+    DateTimeFormat::FieldTypeNonLocationZone, // v
+    DateTimeFormat::FieldTypeWeekOfMonth, // w
+    DateTimeFormat::FieldTypeInvalid, // x
+    DateTimeFormat::FieldTypeYear, // y
+    DateTimeFormat::FieldTypeZone, // z
+};
+
+static const DateTimeFormat::FieldType upperCaseToFieldTypeMap[26] = {
+    DateTimeFormat::FieldTypeMillisecondsInDay, // A
+    DateTimeFormat::FieldTypeInvalid, // B
+    DateTimeFormat::FieldTypeInvalid, // C
+    DateTimeFormat::FieldTypeDayOfYear, // D
+    DateTimeFormat::FieldTypeDayOfWeek, // E
+    DateTimeFormat::FieldTypeDayOfWeekInMonth, // F
+    DateTimeFormat::FieldTypeEra, // G
+    DateTimeFormat::FieldTypeHour23, // H
+    DateTimeFormat::FieldTypeInvalid, // I
+    DateTimeFormat::FieldTypeInvalid, // J
+    DateTimeFormat::FieldTypeHour11, // K
+    DateTimeFormat::FieldTypeMonthStandAlone, // L
+    DateTimeFormat::FieldTypeMonth, // M
+    DateTimeFormat::FieldTypeInvalid, // N
+    DateTimeFormat::FieldTypeInvalid, // O
+    DateTimeFormat::FieldTypeInvalid, // P
+    DateTimeFormat::FieldTypeQuater, // Q
+    DateTimeFormat::FieldTypeInvalid, // R
+    DateTimeFormat::FieldTypeFractionalSecond, // S
+    DateTimeFormat::FieldTypeInvalid, // T
+    DateTimeFormat::FieldTypeInvalid, // U
+    DateTimeFormat::FieldTypeInvalid, // V
+    DateTimeFormat::FieldTypeWeekOfYear, // W
+    DateTimeFormat::FieldTypeInvalid, // X
+    DateTimeFormat::FieldTypeYearOfWeekOfYear, // Y
+    DateTimeFormat::FieldTypeRFC822Zone, // Z
+};
+
+static DateTimeFormat::FieldType mapCharacterToFieldType(const UChar ch)
+{
+    if (isASCIIUpper(ch))
+        return upperCaseToFieldTypeMap[ch - 'A'];
+
+    if (isASCIILower(ch))
+        return lowerCaseToFieldTypeMap[ch - 'a'];
+
+    return DateTimeFormat::FieldTypeLiteral;
+}
+
+bool DateTimeFormat::parse(const String& source, TokenHandler& tokenHandler)
+{
+    enum State {
+        StateInQuote,
+        StateInQuoteQuote,
+        StateLiteral,
+        StateQuote,
+        StateSymbol,
+    } state = StateLiteral;
+
+    FieldType fieldType = FieldTypeLiteral;
+    StringBuilder literalBuffer;
+    int fieldCounter = 0;
+
+    for (unsigned int index = 0; index < source.length(); ++index) {
+        const UChar ch = source[index];
+        switch (state) {
+        case StateInQuote:
+            if (ch == '\'') {
+                state = StateInQuoteQuote;
+                break;
+            }
+
+            literalBuffer.append(ch);
+            break;
+
+        case StateInQuoteQuote:
+            if (ch == '\'') {
+                literalBuffer.append('\'');
+                state = StateInQuote;
+                break;
+            }
+
+            fieldType = mapCharacterToFieldType(ch);
+            if (fieldType == FieldTypeInvalid)
+                return false;
+
+            if (fieldType == FieldTypeLiteral) {
+                literalBuffer.append(ch);
+                state = StateLiteral;
+                break;
+            }
+
+            if (literalBuffer.length()) {
+                tokenHandler.visitLiteral(literalBuffer.toString());
+                literalBuffer.clear();
+            }
+
+            fieldCounter = 1;
+            state = StateSymbol;
+            break;
+
+        case StateLiteral:
+            if (ch == '\'') {
+                state = StateQuote;
+                break;
+            }
+
+            fieldType = mapCharacterToFieldType(ch);
+            if (fieldType == FieldTypeInvalid)
+                return false;
+
+            if (fieldType == FieldTypeLiteral) {
+                literalBuffer.append(ch);
+                break;
+            }
+
+            if (literalBuffer.length()) {
+                tokenHandler.visitLiteral(literalBuffer.toString());
+                literalBuffer.clear();
+            }
+
+            fieldCounter = 1;
+            state = StateSymbol;
+            break;
+
+        case StateQuote:
+            literalBuffer.append(ch);
+            state = ch == '\'' ? StateLiteral : StateInQuote;
+            break;
+
+        case StateSymbol: {
+            ASSERT(fieldType != FieldTypeInvalid);
+            ASSERT(fieldType != FieldTypeLiteral);
+            ASSERT(literalBuffer.isEmpty());
+
+            FieldType fieldType2 = mapCharacterToFieldType(ch);
+            if (fieldType2 == FieldTypeInvalid)
+                return false;
+
+            if (fieldType == fieldType2) {
+                ++fieldCounter;
+                break;
+            }
+
+            tokenHandler.visitField(fieldType, fieldCounter);
+
+            if (fieldType2 == FieldTypeLiteral) {
+                if (ch == '\'')
+                    state = StateQuote;
+                else {
+                    literalBuffer.append(ch);
+                    state = StateLiteral;
+                }
+                break;
+            }
+
+            fieldCounter = 1;
+            fieldType = fieldType2;
+            break;
+        }
+        }
+    }
+
+    ASSERT(fieldType != FieldTypeInvalid);
+
+    switch (state) {
+    case StateLiteral:
+    case StateInQuoteQuote:
+        if (literalBuffer.length())
+            tokenHandler.visitLiteral(literalBuffer.toString());
+        return true;
+
+    case StateQuote:
+    case StateInQuote:
+        if (literalBuffer.length())
+            tokenHandler.visitLiteral(literalBuffer.toString());
+        return false;
+
+    case StateSymbol:
+        ASSERT(fieldType != FieldTypeLiteral);
+        ASSERT(!literalBuffer.length());
+        tokenHandler.visitField(fieldType, fieldCounter);
+        return true;
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/text/DateTimeFormat.h b/Source/WebCore/platform/text/DateTimeFormat.h
new file mode 100644
index 000000000..e7d539f2b
--- /dev/null
+++ b/Source/WebCore/platform/text/DateTimeFormat.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#ifndef DateTimeFormat_h
+#define DateTimeFormat_h
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+// DateTimeFormat parses date time format defined in Unicode Technical
+// standard 35, Locale Data Markup Language (LDML)[1].
+// [1] LDML http://unicode.org/reports/tr35/tr35-6.html#Date_Format_Patterns
+class DateTimeFormat {
+public:
+    enum FieldType {
+        FieldTypeInvalid,
+        FieldTypeLiteral,
+
+        // Era: AD
+        FieldTypeEra = 'G',
+
+        // Year: 1996
+        FieldTypeYear = 'y',
+        FieldTypeYearOfWeekOfYear = 'Y',
+        FieldTypeExtendedYear = 'u',
+
+        // Quater: Q2
+        FieldTypeQuater = 'Q',
+        FieldTypeQuaterStandAlone = 'q',
+
+        // Month: September
+        FieldTypeMonth = 'M',
+        FieldTypeMonthStandAlone = 'L',
+
+        // Week: 42
+        FieldTypeWeekOfYear = 'W',
+        FieldTypeWeekOfMonth = 'w',
+
+        // Day: 12
+        FieldTypeDayOfMonth = 'd',
+        FieldTypeDayOfYear = 'D',
+        FieldTypeDayOfWeekInMonth = 'F',
+        FieldTypeModifiedJulianDay = 'g',
+
+        // Week Day: Tuesday
+        FieldTypeDayOfWeek = 'E',
+        FieldTypeLocalDayOfWeek = 'e',
+        FieldTypeLocalDayOfWeekStandAlon = 'c',
+
+        // Period: AM or PM
+        FieldTypePeriod = 'a',
+
+        // Hour: 7
+        FieldTypeHour12 = 'h',
+        FieldTypeHour23 = 'H',
+        FieldTypeHour11 = 'K',
+        FieldTypeHour24 = 'k',
+
+        // Minute: 59
+        FieldTypeMinute = 'm',
+
+        // Second: 12
+        FieldTypeSecond = 's',
+        FieldTypeFractionalSecond = 'S',
+        FieldTypeMillisecondsInDay = 'A',
+
+        // Zone: PDT
+        FieldTypeZone = 'z',
+        FieldTypeRFC822Zone = 'Z',
+        FieldTypeNonLocationZone = 'v',
+    };
+
+    class TokenHandler {
+    public:
+        virtual ~TokenHandler() { }
+        virtual void visitField(FieldType, int numberOfPatternCharacters) = 0;
+        virtual void visitLiteral(const String&) = 0;
+    };
+
+    // Returns true if succeeded, false if failed.
+    static bool parse(const String&, TokenHandler&);
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // DateTimeFormat_h
diff --git a/Source/WebCore/platform/text/LocaleICU.cpp b/Source/WebCore/platform/text/LocaleICU.cpp
index f6b4ef80f..51ba4aa35 100644
--- a/Source/WebCore/platform/text/LocaleICU.cpp
+++ b/Source/WebCore/platform/text/LocaleICU.cpp
@@ -51,6 +51,11 @@ LocaleICU::LocaleICU(const char* locale)
 #if ENABLE(CALENDAR_PICKER)
     , m_firstDayOfWeek(0)
 #endif
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    , m_mediumTimeFormat(0)
+    , m_shortTimeFormat(0)
+    , m_didCreateTimeFormat(false)
+#endif
 {
 }
 
@@ -317,7 +322,7 @@ String LocaleICU::formatLocalizedDate(const DateComponents& dateComponents)
     return String::adopt(buffer);
 }
 
-#if ENABLE(CALENDAR_PICKER)
+#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
 static String getDateFormatPattern(const UDateFormat* dateFormat)
 {
     if (!dateFormat)
@@ -334,7 +339,9 @@ static String getDateFormatPattern(const UDateFormat* dateFormat)
         return emptyString();
     return String::adopt(buffer);
 }
+#endif
 
+#if ENABLE(CALENDAR_PICKER)
 static inline bool isICUYearSymbol(UChar letter)
 {
     return letter == 'y' || letter == 'Y';
@@ -493,5 +500,63 @@ unsigned LocaleICU::firstDayOfWeek()
 }
 #endif
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+
+String LocaleICU::localizedDecimalSeparator()
+{
+    initializeDecimalFormat();
+    return m_decimalSymbols[DecimalSeparatorIndex];
+}
+
+static PassOwnPtr<Vector<String> > createFallbackAMPMLabels()
+{
+    OwnPtr<Vector<String> > labels = adoptPtr(new Vector<String>());
+    labels->reserveCapacity(2);
+    labels->append("AM");
+    labels->append("PM");
+    return labels.release();
+}
+
+void LocaleICU::initializeDateTimeFormat()
+{
+    if (m_didCreateTimeFormat)
+        return;
+
+    // We assume ICU medium time pattern and short time pattern are compatible
+    // with LDML, because ICU specific pattern character "V" doesn't appear
+    // in both medium and short time pattern.
+    m_mediumTimeFormat = openDateFormat(UDAT_MEDIUM, UDAT_NONE);
+    m_localizedTimeFormatText = getDateFormatPattern(m_mediumTimeFormat);
+
+    m_shortTimeFormat = openDateFormat(UDAT_SHORT, UDAT_NONE);
+    m_localizedShortTimeFormatText = getDateFormatPattern(m_shortTimeFormat);
+
+    m_timeAMPMLabels = createLabelVector(m_mediumTimeFormat, UDAT_AM_PMS, UCAL_AM, 2);
+    if (!m_timeAMPMLabels)
+        m_timeAMPMLabels = createFallbackAMPMLabels();
+
+    m_didCreateTimeFormat = true;
+}
+
+String LocaleICU::localizedTimeFormatText()
+{
+    initializeDateTimeFormat();
+    return m_localizedTimeFormatText;
+}
+
+String LocaleICU::localizedShortTimeFormatText()
+{
+    initializeDateTimeFormat();
+    return m_localizedShortTimeFormatText;
+}
+
+const Vector<String>& LocaleICU::timeAMPMLabels()
+{
+    initializeDateTimeFormat();
+    return *m_timeAMPMLabels;
+}
+
+#endif
+
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/text/LocaleICU.h b/Source/WebCore/platform/text/LocaleICU.h
index 8c9b39e73..08667806d 100644
--- a/Source/WebCore/platform/text/LocaleICU.h
+++ b/Source/WebCore/platform/text/LocaleICU.h
@@ -52,6 +52,9 @@ public:
     // For LocalizedNumber
     String convertToLocalizedNumber(const String&);
     String convertFromLocalizedNumber(const String&);
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String localizedDecimalSeparator();
+#endif
 
     // For LocalizedDate
     double parseLocalizedDate(const String&);
@@ -64,6 +67,12 @@ public:
     unsigned firstDayOfWeek();
 #endif
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String localizedTimeFormatText();
+    String localizedShortTimeFormatText();
+    const Vector<String>& timeAMPMLabels();
+#endif
+
 private:
     static PassOwnPtr<LocaleICU> createForCurrentLocale();
     explicit LocaleICU(const char*);
@@ -79,10 +88,17 @@ private:
 
 #if ENABLE(CALENDAR_PICKER)
     void initializeLocalizedDateFormatText();
-    PassOwnPtr<Vector<String> > createLabelVector(const UDateFormat*, UDateFormatSymbolType, int32_t startIndex, int32_t size);
     void initializeCalendar();
 #endif
 
+#if ENABLE(CALENDAR_PICKER) || ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    PassOwnPtr<Vector<String> > createLabelVector(const UDateFormat*, UDateFormatSymbolType, int32_t startIndex, int32_t size);
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    void initializeDateTimeFormat();
+#endif
+
     CString m_locale;
     UNumberFormat* m_numberFormat;
     UDateFormat* m_shortDateFormat;
@@ -106,6 +122,15 @@ private:
     OwnPtr<Vector<String> > m_weekDayShortLabels;
     unsigned m_firstDayOfWeek;
 #endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    UDateFormat* m_mediumTimeFormat;
+    UDateFormat* m_shortTimeFormat;
+    String m_localizedTimeFormatText;
+    String m_localizedShortTimeFormatText;
+    OwnPtr<Vector<String> > m_timeAMPMLabels;
+    bool m_didCreateTimeFormat;
+#endif
 };
 
 }
diff --git a/Source/WebCore/platform/text/LocaleWin.cpp b/Source/WebCore/platform/text/LocaleWin.cpp
index 82f927551..be6685747 100644
--- a/Source/WebCore/platform/text/LocaleWin.cpp
+++ b/Source/WebCore/platform/text/LocaleWin.cpp
@@ -32,6 +32,9 @@
 #include "LocaleWin.h"
 
 #include "DateComponents.h"
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include "DateTimeFormat.h"
+#endif
 #include "LocalizedStrings.h"
 #include <limits>
 #include <windows.h>
@@ -590,4 +593,81 @@ const Vector<String>& LocaleWin::weekDayShortLabels()
 }
 #endif
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+static DateTimeFormat::FieldType mapCharacterToDateTimeFieldType(UChar ch)
+{
+    switch (ch) {
+    case 'h':
+        return DateTimeFormat::FieldTypeHour12;
+
+    case 'H':
+        return DateTimeFormat::FieldTypeHour23;
+
+    case 'm':
+        return DateTimeFormat::FieldTypeMinute;
+
+    case 's':
+        return DateTimeFormat::FieldTypeSecond;
+
+    case 't':
+        return DateTimeFormat::FieldTypePeriod;
+
+    default:
+        return DateTimeFormat::FieldTypeLiteral;
+    }
+}
+
+// This class used for converting Windows time pattern format[1] into LDML[2]
+// time format string.
+// [1] http://msdn.microsoft.com/en-us/library/windows/desktop/dd318148(v=vs.85).aspx
+// [2] LDML http://unicode.org/reports/tr35/tr35-6.html#Date_Format_Patterns
+static String convertWindowsTimeFormatToLDML(const String& windowsTimeFormat)
+{
+    StringBuilder builder;
+    int counter = 0;
+    DateTimeFormat::FieldType lastFieldType = DateTimeFormat::FieldTypeLiteral;
+    for (unsigned index = 0; index < windowsTimeFormat.length(); ++index) {
+        UChar const ch = windowsTimeFormat[index];
+        DateTimeFormat::FieldType fieldType = mapCharacterToDateTimeFieldType(ch);
+        if (fieldType == DateTimeFormat::FieldTypeLiteral)
+            builder.append(ch);
+        else if (fieldType == lastFieldType) {
+            ++counter;
+            if (counter == 2 && lastFieldType != DateTimeFormat::FieldTypePeriod)
+                builder.append(static_cast<UChar>(lastFieldType));
+        } else {
+            if (lastFieldType != DateTimeFormat::FieldTypeLiteral)
+                builder.append(static_cast<UChar>(lastFieldType));
+            builder.append(static_cast<UChar>(fieldType));
+            counter = 1;
+        }
+        lastFieldType = fieldType;
+    }
+    return builder.toString();
+}
+
+String LocaleWin::timeFormatText()
+{
+    if (m_timeFormatText.isEmpty())
+        m_timeFormatText = convertWindowsTimeFormatToLDML(getLocaleInfoString(LOCALE_STIMEFORMAT));
+    return m_timeFormatText;
+}
+
+// Note: To make XP/Vista and Windows 7/later same behavior, we don't use
+// LOCALE_SSHORTTIME.
+String LocaleWin::shortTimeFormatText()
+{
+    return timeFormatText();
+}
+
+const Vector<String>& LocaleWin::timeAMPMLabels()
+{
+    if (m_timeAMPMLabels.isEmpty()) {
+        m_timeAMPMLabels.append(getLocaleInfoString(LOCALE_S1159));
+        m_timeAMPMLabels.append(getLocaleInfoString(LOCALE_S2359));
+    }
+    return m_timeAMPMLabels;
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/text/LocaleWin.h b/Source/WebCore/platform/text/LocaleWin.h
index 6a75c9945..6f4fd8bb8 100644
--- a/Source/WebCore/platform/text/LocaleWin.h
+++ b/Source/WebCore/platform/text/LocaleWin.h
@@ -34,6 +34,7 @@
 #include <windows.h>
 #include <wtf/Forward.h>
 #include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -54,6 +55,12 @@ public:
     unsigned firstDayOfWeek() { return m_firstDayOfWeek; }
 #endif
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String timeFormatText();
+    String shortTimeFormatText();
+    const Vector<String>& timeAMPMLabels();
+#endif
+
     // For testing.
     double parseDate(const String& format, int baseYear, const String& input);
     String formatDate(const String& format, int baseYear, int year, int month, int day);
@@ -81,7 +88,10 @@ private:
     Vector<String> m_weekDayShortLabels;
     unsigned m_firstDayOfWeek;
 #endif
-
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String m_timeFormatText;
+    Vector<String> m_timeAMPMLabels;
+#endif
 };
 
 }
diff --git a/Source/WebCore/platform/text/LocalizedDate.h b/Source/WebCore/platform/text/LocalizedDate.h
index 4db5eac8e..ab6854e53 100644
--- a/Source/WebCore/platform/text/LocalizedDate.h
+++ b/Source/WebCore/platform/text/LocalizedDate.h
@@ -60,6 +60,22 @@ const Vector<String>& weekDayShortLabels();
 
 // The first day of a week. 0 is Sunday, and 6 is Saturday.
 unsigned firstDayOfWeek();
+
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+// Returns time format in Unicode TR35 LDML[1] containing hour, minute, and
+// second with optional period(AM/PM), e.g. "h:mm:ss a"
+// [1] LDML http://unicode.org/reports/tr35/tr35-6.html#Date_Format_Patterns
+String localizedTimeFormatText();
+
+// Returns time format in Unicode TR35 LDML containing hour, and minute
+// with optional period(AM/PM), e.g. "h:mm a"
+// Note: Some platforms return same value as localizedTimeFormatText().
+String localizedShortTimeFormatText();
+
+// Returns localized period field(AM/PM) strings.
+const Vector<String>& timeAMPMLabels();
 #endif
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/text/LocalizedDateICU.cpp b/Source/WebCore/platform/text/LocalizedDateICU.cpp
index 10cb6f132..19d6d1581 100644
--- a/Source/WebCore/platform/text/LocalizedDateICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedDateICU.cpp
@@ -92,4 +92,21 @@ unsigned firstDayOfWeek()
 }
 #endif
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+String localizedTimeFormatText()
+{
+    return LocaleICU::currentLocale()->localizedTimeFormatText();
+}
+
+String localizedShortTimeFormatText()
+{
+    return LocaleICU::currentLocale()->localizedShortTimeFormatText();
+}
+
+const Vector<String>& timeAMPMLabels()
+{
+    return LocaleICU::currentLocale()->timeAMPMLabels();
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/text/LocalizedDateWin.cpp b/Source/WebCore/platform/text/LocalizedDateWin.cpp
index bd8f367f3..51c7330a0 100644
--- a/Source/WebCore/platform/text/LocalizedDateWin.cpp
+++ b/Source/WebCore/platform/text/LocalizedDateWin.cpp
@@ -92,4 +92,21 @@ unsigned firstDayOfWeek()
 }
 #endif
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+String localizedTimeFormatText()
+{
+    return LocaleWin::currentLocale()->timeFormatText();
+}
+
+String localizedShortTimeFormatText()
+{
+    return LocaleWin::currentLocale()->shortTimeFormatText();
+}
+
+const Vector<String>& timeAMPMLabels()
+{
+    return LocaleWin::currentLocale()->timeAMPMLabels();
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/text/LocalizedNumber.h b/Source/WebCore/platform/text/LocalizedNumber.h
index 350dac0db..8703b74f4 100644
--- a/Source/WebCore/platform/text/LocalizedNumber.h
+++ b/Source/WebCore/platform/text/LocalizedNumber.h
@@ -50,6 +50,12 @@ String convertToLocalizedNumber(const String&, unsigned fractionDigits);
 // responsible to check the format of the resultant string.
 String convertFromLocalizedNumber(const String&);
 
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+// Returns localized decimal separator, e.g. "." for English, "," for French.
+String localizedDecimalSeparator();
+#endif
+
 } // namespace WebCore
 
 #endif // LocalizedNumber_h
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.cpp b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
index d8a3f98bf..3288746f9 100644
--- a/Source/WebCore/platform/text/LocalizedNumberICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
@@ -45,4 +45,12 @@ String convertFromLocalizedNumber(const String& localizedNumberString)
     return LocaleICU::currentLocale()->convertFromLocalizedNumber(localizedNumberString);
 }
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+
+String localizedDecimalSeparator()
+{
+    return LocaleICU::currentLocale()->localizedDecimalSeparator();
+}
+
+#endif
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/LocalizedNumberNone.cpp b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
index a1400855d..d40ff2421 100644
--- a/Source/WebCore/platform/text/LocalizedNumberNone.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
@@ -47,4 +47,13 @@ String convertFromLocalizedNumber(const String& localizedNumberString)
     return localizedNumberString;
 }
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+
+UChar localizedDecimalSeparator()
+{
+    return '.';
+}
+
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/SegmentedString.cpp b/Source/WebCore/platform/text/SegmentedString.cpp
index 591e24941..63373ba7a 100644
--- a/Source/WebCore/platform/text/SegmentedString.cpp
+++ b/Source/WebCore/platform/text/SegmentedString.cpp
@@ -184,7 +184,7 @@ void SegmentedString::advanceSubstring()
 
 String SegmentedString::toString() const
 {
-    String result;
+    StringBuilder result;
     if (m_pushedChar1) {
         result.append(m_pushedChar1);
         if (m_pushedChar2)
@@ -197,7 +197,7 @@ String SegmentedString::toString() const
         for (; it != e; ++it)
             it->appendTo(result);
     }
-    return result;
+    return result.toString();
 }
 
 void SegmentedString::advance(unsigned count, UChar* consumedCharacters)
@@ -222,14 +222,13 @@ void SegmentedString::advanceSlowCase()
     m_currentChar = m_pushedChar1 ? &m_pushedChar1 : m_currentString.m_current;
 }
 
-void SegmentedString::advanceSlowCase(int& lineNumber)
+void SegmentedString::advanceAndUpdateLineNumberSlowCase()
 {
     if (m_pushedChar1) {
         m_pushedChar1 = m_pushedChar2;
         m_pushedChar2 = 0;
     } else if (m_currentString.m_current) {
         if (*m_currentString.m_current++ == '\n' && m_currentString.doNotExcludeLineNumbers()) {
-            ++lineNumber;
             ++m_currentLine;
             // Plus 1 because numberOfCharactersConsumed value hasn't incremented yet; it does with m_length decrement below.
             m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
diff --git a/Source/WebCore/platform/text/SegmentedString.h b/Source/WebCore/platform/text/SegmentedString.h
index 446218388..777a65e7a 100644
--- a/Source/WebCore/platform/text/SegmentedString.h
+++ b/Source/WebCore/platform/text/SegmentedString.h
@@ -22,6 +22,7 @@
 
 #include "PlatformString.h"
 #include <wtf/Deque.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/TextPosition.h>
 
 namespace WebCore {
@@ -54,15 +55,12 @@ public:
 
     int numberOfCharactersConsumed() const { return m_string.length() - m_length; }
 
-    void appendTo(String& str) const
+    void appendTo(StringBuilder& builder) const
     {
-        if (m_string.characters() == m_current) {
-            if (str.isEmpty())
-                str = m_string;
-            else
-                str.append(m_string);
-        } else
-            str.append(String(m_current, m_length));
+        if (m_string.characters() == m_current)
+            builder.append(m_string);
+        else
+            builder.append(String(m_current, m_length));
     }
 
 public:
@@ -159,12 +157,11 @@ public:
         advance();
     }
 
-    void advancePastNewline(int& lineNumber)
+    void advancePastNewlineAndUpdateLineNumber()
     {
         ASSERT(*current() == '\n');
         if (!m_pushedChar1 && m_currentString.m_length > 1) {
             int newLineFlag = m_currentString.doNotExcludeLineNumbers();
-            lineNumber += newLineFlag;
             m_currentLine += newLineFlag;
             if (newLineFlag)
                 m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
@@ -172,7 +169,7 @@ public:
             m_currentChar = ++m_currentString.m_current;
             return;
         }
-        advanceSlowCase(lineNumber);
+        advanceAndUpdateLineNumberSlowCase();
     }
     
     void advancePastNonNewline()
@@ -186,11 +183,10 @@ public:
         advanceSlowCase();
     }
     
-    void advance(int& lineNumber)
+    void advanceAndUpdateLineNumber()
     {
         if (!m_pushedChar1 && m_currentString.m_length > 1) {
             int newLineFlag = (*m_currentString.m_current == '\n') & m_currentString.doNotExcludeLineNumbers();
-            lineNumber += newLineFlag;
             m_currentLine += newLineFlag;
             if (newLineFlag)
                 m_numberOfCharactersConsumedPriorToCurrentLine = numberOfCharactersConsumed() + 1;
@@ -198,7 +194,7 @@ public:
             m_currentChar = ++m_currentString.m_current;
             return;
         }
-        advanceSlowCase(lineNumber);
+        advanceAndUpdateLineNumberSlowCase();
     }
 
     // Writes the consumed characters into consumedCharacters, which must
@@ -236,7 +232,7 @@ private:
     void prepend(const SegmentedSubstring&);
 
     void advanceSlowCase();
-    void advanceSlowCase(int& lineNumber);
+    void advanceAndUpdateLineNumberSlowCase();
     void advanceSubstring();
     const UChar* current() const { return m_currentChar; }
 
diff --git a/Source/WebKit/chromium/public/WebScrollbarClient.h b/Source/WebCore/platform/text/mac/LocaleMac.h
index d19b29b47..6f1365f79 100644
--- a/Source/WebKit/chromium/public/WebScrollbarClient.h
+++ b/Source/WebCore/platform/text/mac/LocaleMac.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,23 +28,61 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebScrollbarClient_h
-#define WebScrollbarClient_h
+#ifndef LocaleMac_h
+#define LocaleMac_h
 
-namespace WebKit {
+#include <wtf/Forward.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
 
-class WebScrollbar;
-struct WebRect;
-template <typename T> class WebVector;
+OBJC_CLASS NSDateFormatter;
+OBJC_CLASS NSLocale;
 
-class WebScrollbarClient {
+namespace WebCore {
+
+class DateComponents;
+
+class LocaleMac {
 public:
-    virtual void valueChanged(WebScrollbar*) = 0;
-    virtual void overlayChanged(WebScrollbar*) = 0;
-    virtual void invalidateScrollbarRect(WebScrollbar*, const WebRect&) = 0;
-    virtual void getTickmarks(WebScrollbar*, WebVector<WebRect>*) const = 0;
-};
+    static PassOwnPtr<LocaleMac> create(const String&);
+    static LocaleMac* currentLocale();
+    ~LocaleMac();
+    double parseDate(const String&);
+    String formatDate(const DateComponents&);
+
+#if ENABLE(CALENDAR_PICKER)
+    String dateFormatText();
+    const Vector<String>& monthLabels();
+    const Vector<String>& weekDayShortLabels();
+    unsigned firstDayOfWeek();
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String timeFormatText();
+    String shortTimeFormatText();
+    const Vector<String>& timeAMPMLabels();
+#endif
+
+private:
+    explicit LocaleMac(const String&);
+    NSDateFormatter *createShortDateFormatter();
+
+    RetainPtr<NSLocale> m_locale;
+#if ENABLE(CALENDAR_PICKER)
+    String m_localizedDateFormatText;
+    Vector<String> m_monthLabels;
+    Vector<String> m_weekDayShortLabels;
+#endif
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    NSDateFormatter *createTimeFormatter();
+    NSDateFormatter *createShortTimeFormatter();
 
-} // namespace WebKit
+    String m_localizedTimeFormatText;
+    String m_localizedShortTimeFormatText;
+    Vector<String> m_timeAMPMLabels;
+#endif
+};
 
+}
 #endif
diff --git a/Source/WebCore/platform/text/mac/LocalizedDateMac.mm b/Source/WebCore/platform/text/mac/LocaleMac.mm
index 08876f9d3..219e95c84 100644
--- a/Source/WebCore/platform/text/mac/LocalizedDateMac.mm
+++ b/Source/WebCore/platform/text/mac/LocaleMac.mm
@@ -29,12 +29,14 @@
  */
 
 #include "config.h"
-#include "LocalizedDate.h"
+#include "LocaleMac.h"
 
 #import <Foundation/NSDateFormatter.h>
+#import <Foundation/NSLocale.h>
+#include "LocalizedDate.h"
 #include "LocalizedStrings.h"
-#include <limits>
 #include <wtf/DateMath.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/text/StringBuilder.h>
 
@@ -42,54 +44,56 @@ using namespace std;
 
 namespace WebCore {
 
-static NSDateFormatter *createShortDateFormatter()
+static NSDateFormatter* createDateTimeFormatter(NSLocale* locale, NSDateFormatterStyle dateStyle, NSDateFormatterStyle timeStyle)
 {
     NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
-    [formatter setDateStyle:NSDateFormatterShortStyle];
-    [formatter setTimeStyle:NSDateFormatterNoStyle];
+    [formatter setLocale:locale];
+    [formatter setDateStyle:dateStyle];
+    [formatter setTimeStyle:timeStyle];
     [formatter setTimeZone:[NSTimeZone timeZoneWithAbbreviation:@"UTC"]];
     [formatter setCalendar:[[NSCalendar alloc] initWithCalendarIdentifier:NSGregorianCalendar]];
     return formatter;
 }
 
-double parseLocalizedDate(const String& input, DateComponents::Type type)
+LocaleMac::LocaleMac(const String& localeIdentifier)
+    : m_locale([[NSLocale alloc] initWithLocaleIdentifier:localeIdentifier])
 {
-    switch (type) {
-    case DateComponents::Date: {
-        RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortDateFormatter());
-        NSDate *date = [formatter.get() dateFromString:input];
-        if (!date)
-            break;
-        return [date timeIntervalSince1970] * msPerSecond;
-    }
-    case DateComponents::DateTime:
-    case DateComponents::DateTimeLocal:
-    case DateComponents::Month:
-    case DateComponents::Time:
-    case DateComponents::Week:
-    case DateComponents::Invalid:
-        break;
-    }
-    return numeric_limits<double>::quiet_NaN();
 }
 
-String formatLocalizedDate(const DateComponents& dateComponents)
+LocaleMac::~LocaleMac()
 {
-    switch (dateComponents.type()) {
-    case DateComponents::Date: {
-        RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortDateFormatter());
-        NSTimeInterval interval = dateComponents.millisecondsSinceEpoch() / msPerSecond;
-        return String([formatter.get() stringFromDate:[NSDate dateWithTimeIntervalSince1970:interval]]);
-    }
-    case DateComponents::DateTime:
-    case DateComponents::DateTimeLocal:
-    case DateComponents::Month:
-    case DateComponents::Time:
-    case DateComponents::Week:
-    case DateComponents::Invalid:
-        break;
-    }
-    return String();
+}
+
+PassOwnPtr<LocaleMac> LocaleMac::create(const String& localeIdentifier)
+{
+    return adoptPtr(new LocaleMac(localeIdentifier));
+}
+
+LocaleMac* LocaleMac::currentLocale()
+{
+    static LocaleMac* currentLocale = LocaleMac::create([[NSLocale currentLocale] localeIdentifier]).leakPtr();
+    return currentLocale;
+}
+
+NSDateFormatter* LocaleMac::createShortDateFormatter()
+{
+    return createDateTimeFormatter(m_locale.get(), NSDateFormatterShortStyle, NSDateFormatterNoStyle);
+}
+
+double LocaleMac::parseDate(const String& input)
+{
+    RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortDateFormatter());
+    NSDate *date = [formatter.get() dateFromString:input];
+    if (!date)
+        return std::numeric_limits<double>::quiet_NaN();
+    return [date timeIntervalSince1970] * msPerSecond;
+}
+
+String LocaleMac::formatDate(const DateComponents& dateComponents)
+{
+    RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortDateFormatter());
+    NSTimeInterval interval = dateComponents.millisecondsSinceEpoch() / msPerSecond;
+    return String([formatter.get() stringFromDate:[NSDate dateWithTimeIntervalSince1970:interval]]);
 }
 
 #if ENABLE(CALENDAR_PICKER)
@@ -140,57 +144,55 @@ static String localizeDateFormat(const String& format)
     return buffer.toString();
 }
 
-String localizedDateFormatText()
+String LocaleMac::dateFormatText()
 {
-    DEFINE_STATIC_LOCAL(String, text, ());
-    if (!text.isEmpty())
-        return text;
+    if (!m_localizedDateFormatText.isEmpty())
+        return m_localizedDateFormatText;
     RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortDateFormatter());
-    text = localizeDateFormat(String([formatter.get() dateFormat]));
-    return text;
+    m_localizedDateFormatText = localizeDateFormat(String([formatter.get() dateFormat]));
+    return  m_localizedDateFormatText;
 }
 
-const Vector<String>& monthLabels()
+const Vector<String>& LocaleMac::monthLabels()
 {
-    DEFINE_STATIC_LOCAL(Vector<String>, labels, ());
-    if (!labels.isEmpty())
-        return labels;
-    labels.reserveCapacity(12);
+    if (!m_monthLabels.isEmpty())
+        return m_monthLabels;
+    m_monthLabels.reserveCapacity(12);
     RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortDateFormatter());
     NSArray *array = [formatter.get() monthSymbols];
     if ([array count] == 12) {
         for (unsigned i = 0; i < 12; ++i)
-            labels.append(String([array objectAtIndex:i]));
-        return labels;
+            m_monthLabels.append(String([array objectAtIndex:i]));
+        return m_monthLabels;
     }
     for (unsigned i = 0; i < WTF_ARRAY_LENGTH(WTF::monthFullName); ++i)
-        labels.append(WTF::monthFullName[i]);
-    return labels;
+        m_monthLabels.append(WTF::monthFullName[i]);
+    return m_monthLabels;
 }
 
-const Vector<String>& weekDayShortLabels()
+const Vector<String>& LocaleMac::weekDayShortLabels()
 {
-    DEFINE_STATIC_LOCAL(Vector<String>, labels, ());
-    if (!labels.isEmpty())
-        return labels;
-    labels.reserveCapacity(7);
+    if (!m_weekDayShortLabels.isEmpty())
+        return m_weekDayShortLabels;
+    m_weekDayShortLabels.reserveCapacity(7);
     RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortDateFormatter());
     NSArray *array = [formatter.get() shortWeekdaySymbols];
     if ([array count] == 7) {
         for (unsigned i = 0; i < 7; ++i)
-            labels.append(String([array objectAtIndex:i]));
-        return labels;
+            m_weekDayShortLabels.append(String([array objectAtIndex:i]));
+        return m_weekDayShortLabels;
     }
     for (unsigned i = 0; i < WTF_ARRAY_LENGTH(WTF::weekdayName); ++i) {
         // weekdayName starts with Monday.
-        labels.append(WTF::weekdayName[(i + 6) % 7]);
+        m_weekDayShortLabels.append(WTF::weekdayName[(i + 6) % 7]);
     }
-    return labels;
+    return m_weekDayShortLabels;
 }
 
-unsigned firstDayOfWeek()
+unsigned LocaleMac::firstDayOfWeek()
 {
     RetainPtr<NSCalendar> calendar(AdoptNS, [[NSCalendar alloc] initWithCalendarIdentifier:NSGregorianCalendar]);
+    [calendar.get() setLocale:m_locale.get()];
     // The document for NSCalendar - firstWeekday doesn't have an explanation of
     // firstWeekday value. We can guess it by the document of NSDateComponents -
     // weekDay, so it can be 1 through 7 and 1 is Sunday.
@@ -198,4 +200,44 @@ unsigned firstDayOfWeek()
 }
 #endif
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+NSDateFormatter* LocaleMac::createTimeFormatter()
+{
+    return createDateTimeFormatter(m_locale.get(), NSDateFormatterNoStyle, NSDateFormatterMediumStyle);
+}
+
+NSDateFormatter* LocaleMac::createShortTimeFormatter()
+{
+    return createDateTimeFormatter(m_locale.get(), NSDateFormatterNoStyle, NSDateFormatterShortStyle);
+}
+
+String LocaleMac::timeFormatText()
+{
+    if (!m_localizedTimeFormatText.isEmpty())
+        return m_localizedTimeFormatText;
+    RetainPtr<NSDateFormatter> formatter(AdoptNS, createTimeFormatter());
+    m_localizedTimeFormatText = String([formatter.get() dateFormat]);
+    return m_localizedTimeFormatText;
+}
+
+String LocaleMac::shortTimeFormatText()
+{
+    if (!m_localizedShortTimeFormatText.isEmpty())
+        return m_localizedShortTimeFormatText;
+    RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortTimeFormatter());
+    m_localizedShortTimeFormatText = String([formatter.get() dateFormat]);
+    return m_localizedShortTimeFormatText;
+}
+
+const Vector<String>& LocaleMac::timeAMPMLabels()
+{
+    if (!m_timeAMPMLabels.isEmpty())
+        return m_timeAMPMLabels;
+    m_timeAMPMLabels.reserveCapacity(2);
+    RetainPtr<NSDateFormatter> formatter(AdoptNS, createShortTimeFormatter());
+    m_timeAMPMLabels.append(String([formatter.get() AMSymbol]));
+    m_timeAMPMLabels.append(String([formatter.get() PMSymbol]));
+    return m_timeAMPMLabels;
+}
+#endif
 }
diff --git a/Source/WebCore/platform/text/mac/LocalizedDateMac.cpp b/Source/WebCore/platform/text/mac/LocalizedDateMac.cpp
new file mode 100644
index 000000000..9597fa081
--- /dev/null
+++ b/Source/WebCore/platform/text/mac/LocalizedDateMac.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedDate.h"
+
+#include "LocaleMac.h"
+#include <limits>
+
+using namespace std;
+
+namespace WebCore {
+
+double parseLocalizedDate(const String& input, DateComponents::Type type)
+{
+    switch (type) {
+    case DateComponents::Date:
+        return LocaleMac::currentLocale()->parseDate(input);
+    case DateComponents::DateTime:
+    case DateComponents::DateTimeLocal:
+    case DateComponents::Month:
+    case DateComponents::Time:
+    case DateComponents::Week:
+    case DateComponents::Invalid:
+        break;
+    }
+    return numeric_limits<double>::quiet_NaN();
+}
+
+String formatLocalizedDate(const DateComponents& dateComponents)
+{
+    switch (dateComponents.type()) {
+    case DateComponents::Date:
+        return LocaleMac::currentLocale()->formatDate(dateComponents);
+    case DateComponents::DateTime:
+    case DateComponents::DateTimeLocal:
+    case DateComponents::Month:
+    case DateComponents::Time:
+    case DateComponents::Week:
+    case DateComponents::Invalid:
+        break;
+    }
+    return String();
+}
+
+#if ENABLE(CALENDAR_PICKER)
+String localizedDateFormatText()
+{
+    return LocaleMac::currentLocale()->dateFormatText();
+}
+
+const Vector<String>& monthLabels()
+{
+    return LocaleMac::currentLocale()->monthLabels();
+}
+
+const Vector<String>& weekDayShortLabels()
+{
+    return LocaleMac::currentLocale()->weekDayShortLabels();
+}
+
+unsigned firstDayOfWeek()
+{
+    return LocaleMac::currentLocale()->firstDayOfWeek();
+}
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+String localizedTimeFormatText()
+{
+    return LocaleMac::currentLocale()->timeFormatText();
+}
+
+String localizedShortTimeFormatText()
+{
+    return LocaleMac::currentLocale()->shortTimeFormatText();
+}
+
+const Vector<String>& timeAMPMLabels()
+{
+    return LocaleMac::currentLocale()->timeAMPMLabels();
+}
+#endif
+
+}
diff --git a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
index 031362b2b..26ebf3d8e 100644
--- a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
+++ b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
@@ -116,5 +116,15 @@ String convertFromLocalizedNumber(const String& localizedNumberString)
     return String(numberToString(doubleValue, buffer));
 }
 
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+
+String localizedDecimalSeparator()
+{
+    RetainPtr<NSNumberFormatter> formatter = numberFormatterForDisplay();
+    return String([formatter.get() decimalSeparator]);
+}
+
+#endif
+
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/win/LoggingWin.cpp b/Source/WebCore/platform/win/LoggingWin.cpp
index 0b0afada7..6d353ed92 100644
--- a/Source/WebCore/platform/win/LoggingWin.cpp
+++ b/Source/WebCore/platform/win/LoggingWin.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "Logging.h"
 
+#if !LOG_DISABLED
+
 #include "PlatformString.h"
 #include <windows.h>
 #include <wtf/OwnArrayPtr.h>
@@ -102,3 +104,5 @@ void initializeLoggingChannelsIfNecessary()
 }
 
 } // namespace WebCore
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/platform/win/PlatformScreenWin.cpp b/Source/WebCore/platform/win/PlatformScreenWin.cpp
index e1bbf5968..21bf23c63 100644
--- a/Source/WebCore/platform/win/PlatformScreenWin.cpp
+++ b/Source/WebCore/platform/win/PlatformScreenWin.cpp
@@ -118,7 +118,7 @@ FloatRect screenAvailableRect(Widget* widget)
     return monitorInfo.rcWork;
 }
 
-void screenColorProfile(Widget*, const String&, ColorProfile&)
+void screenColorProfile(Widget*, ColorProfile&)
 {
     notImplemented();
 }
diff --git a/Source/WebCore/platform/wx/LoggingWx.cpp b/Source/WebCore/platform/wx/LoggingWx.cpp
index 94893e91e..86a47ac16 100644
--- a/Source/WebCore/platform/wx/LoggingWx.cpp
+++ b/Source/WebCore/platform/wx/LoggingWx.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "Logging.h"
 
+#if !LOG_DISABLED
+
 #include "PlatformString.h"
 #include <wtf/Vector.h>
 #include <wtf/text/CString.h>
@@ -62,3 +64,5 @@ void initializeLoggingChannelsIfNecessary()
 }
 
 }
+
+#endif // !LOG_DISABLED
diff --git a/Source/WebCore/plugins/PluginView.cpp b/Source/WebCore/plugins/PluginView.cpp
index d37573e67..0d6857f25 100644
--- a/Source/WebCore/plugins/PluginView.cpp
+++ b/Source/WebCore/plugins/PluginView.cpp
@@ -240,7 +240,7 @@ bool PluginView::start()
     {
         PluginView::setCurrentPluginView(this);
 #if USE(JSC)
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
         setCallingPlugin(true);
         npErr = m_plugin->pluginFuncs()->newp((NPMIMEType)m_mimeType.utf8().data(), m_instance, m_mode, m_paramCount, m_paramNames, m_paramValues, NULL);
@@ -330,7 +330,7 @@ void PluginView::stop()
     m_isStarted = false;
 
 #if USE(JSC)
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
@@ -446,7 +446,7 @@ void PluginView::performRequest(PluginRequest* request)
             if (request->sendNotification()) {
                 PluginView::setCurrentPluginView(this);
 #if USE(JSC)
-                JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+                JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
                 setCallingPlugin(true);
                 m_plugin->pluginFuncs()->urlnotify(m_instance, requestURL.string().utf8().data(), NPRES_DONE, request->notifyData());
@@ -736,7 +736,7 @@ NPObject* PluginView::npObject()
     {
         PluginView::setCurrentPluginView(this);
 #if USE(JSC)
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
         setCallingPlugin(true);
         npErr = m_plugin->pluginFuncs()->getvalue(m_instance, NPPVpluginScriptableNPObject, &object);
@@ -1492,7 +1492,7 @@ void PluginView::privateBrowsingStateChanged(bool privateBrowsingEnabled)
 
     PluginView::setCurrentPluginView(this);
 #if USE(JSC)
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
     setCallingPlugin(true);
     NPBool value = privateBrowsingEnabled;
diff --git a/Source/WebCore/plugins/blackberry/PluginViewBlackBerry.cpp b/Source/WebCore/plugins/blackberry/PluginViewBlackBerry.cpp
index b62933d31..2cc96d5e2 100644
--- a/Source/WebCore/plugins/blackberry/PluginViewBlackBerry.cpp
+++ b/Source/WebCore/plugins/blackberry/PluginViewBlackBerry.cpp
@@ -403,7 +403,7 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
         return false;
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
 
     bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
@@ -970,7 +970,7 @@ void PluginView::setNPWindowIfNeeded()
         ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->windowGroup = window->windowGroup();
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
 
     // FIXME: Passing zoomFactor to setwindow make windowed plugin scale incorrectly.
@@ -1220,7 +1220,7 @@ bool PluginView::platformStart()
 
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         setCallingPlugin(true);
         m_plugin->pluginFuncs()->getvalue(m_instance, NPPVpluginNeedsXEmbed, &m_needsXEmbed);
         setCallingPlugin(false);
@@ -1301,7 +1301,7 @@ void PluginView::getWindowInfo(Vector<PluginWindowInfo>& windowList)
     void* valPtr = 0;
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
     m_plugin->pluginFuncs()->getvalue(m_instance, NPPVpluginScreenWindow, &valPtr);
     setCallingPlugin(false);
diff --git a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
index 7b950d30a..35b1e7d31 100644
--- a/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
+++ b/Source/WebCore/plugins/efl/PluginPackageEfl.cpp
@@ -111,33 +111,35 @@ uint16_t PluginPackage::NPVersion() const
 
 bool PluginPackage::load()
 {
-    char* errmsg;
-
     if (m_isLoaded) {
-        m_loadCount++;
+        ++m_loadCount;
         return true;
     }
 
-    m_module = dlopen(m_path.utf8().data(), RTLD_LAZY | RTLD_LOCAL);
-    if ((errmsg = dlerror())) {
-        EINA_LOG_WARN("%s not loaded: %s", m_path.utf8().data(), errmsg);
+    m_module = eina_module_new(m_path.utf8().data());
+    if (!m_module) {
+        EINA_LOG_WARN("%s not loaded: eina_module_new() failed", m_path.utf8().data());
+        return false;
+    }
+    if (!eina_module_load(m_module)) {
+        const char* errorMessage = eina_error_msg_get(eina_error_get());
+        EINA_LOG_WARN("%s not loaded: %s", m_path.utf8().data(), errorMessage ? errorMessage : "None");
         return false;
     }
 
     m_isLoaded = true;
 
-    NP_InitializeFuncPtr initialize;
     NPError err;
 
-    initialize = reinterpret_cast<NP_InitializeFuncPtr>(dlsym(m_module, "NP_Initialize"));
-    if ((errmsg = dlerror())) {
-        EINA_LOG_ERR("Could not get symbol NP_Initialize: %s", errmsg);
+    NP_InitializeFuncPtr initialize = reinterpret_cast<NP_InitializeFuncPtr>(eina_module_symbol_get(m_module, "NP_Initialize"));
+    if (!initialize) {
+        EINA_LOG_ERR("Could not get symbol NP_Initialize");
         goto abort;
     }
 
-    m_NPP_Shutdown = reinterpret_cast<NPP_ShutdownProcPtr>(dlsym(m_module, "NP_Shutdown"));
-    if ((errmsg = dlerror())) {
-        EINA_LOG_ERR("Could not get symbol NP_Shutdown: %s", errmsg);
+    m_NPP_Shutdown = reinterpret_cast<NPP_ShutdownProcPtr>(eina_module_symbol_get(m_module, "NP_Shutdown"));
+    if (!m_NPP_Shutdown) {
+        EINA_LOG_ERR("Could not get symbol NP_Shutdown");
         goto abort;
     }
 
@@ -154,7 +156,7 @@ bool PluginPackage::load()
     if (err != NPERR_NO_ERROR)
         goto abort;
 
-    m_loadCount++;
+    ++m_loadCount;
     return true;
 
 abort:
diff --git a/Source/WebCore/plugins/efl/PluginViewEfl.cpp b/Source/WebCore/plugins/efl/PluginViewEfl.cpp
index 86ea2009c..4ab2ff6f3 100644
--- a/Source/WebCore/plugins/efl/PluginViewEfl.cpp
+++ b/Source/WebCore/plugins/efl/PluginViewEfl.cpp
@@ -56,7 +56,7 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
         return false;
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(false);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
 
     bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
diff --git a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
index 6c0d0b349..926a7d92d 100644
--- a/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginPackageGtk.cpp
@@ -42,7 +42,6 @@ namespace WebCore {
 
 bool PluginPackage::fetchInfo()
 {
-#if defined(XP_UNIX)
     if (!load())
         return false;
 
@@ -97,13 +96,8 @@ bool PluginPackage::fetchInfo()
     g_strfreev(mimeDescs);
 
     return true;
-#else
-    notImplemented();
-    return false;
-#endif
 }
 
-#if defined(XP_UNIX)
 static int webkitgtkXError(Display* xdisplay, XErrorEvent* error)
 {
     gchar errorMessage[64];
@@ -117,7 +111,6 @@ static int webkitgtkXError(Display* xdisplay, XErrorEvent* error)
               error->request_code, error->minor_code);
     return 0;
 }
-#endif
 
 static bool moduleMixesGtkSymbols(GModule* module)
 {
@@ -167,14 +160,12 @@ bool PluginPackage::load()
 
     m_isLoaded = true;
 
-#if defined(XP_UNIX)
     if (!g_strcmp0(baseName.get(), "libflashplayer.so")) {
         // Flash plugin can produce X errors that are handled by the GDK X error handler, which
         // exits the process. Since we don't want to crash due to flash bugs, we install a
         // custom error handler to show a warning when a X error happens without aborting.
         XSetErrorHandler(webkitgtkXError);
     }
-#endif
 
     NP_InitializeFuncPtr NP_Initialize = 0;
     m_NPP_Shutdown = 0;
@@ -192,11 +183,7 @@ bool PluginPackage::load()
 
     initializeBrowserFuncs();
 
-#if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
-#else
-    npErr = NP_Initialize(&m_browserFuncs);
-#endif
     if (npErr != NPERR_NO_ERROR)
         goto abort;
 
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index 93bd3db03..6844eecc5 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -70,7 +70,6 @@
 #endif
 #include <gtk/gtk.h>
 
-#if defined(XP_UNIX)
 #define String XtStringType
 #include "RefPtrCairo.h"
 #include "gtk2xtbin.h"
@@ -79,11 +78,6 @@
 #include <X11/extensions/Xrender.h>
 #include <cairo/cairo-xlib.h>
 #include <gdk/gdkx.h>
-#elif defined(GDK_WINDOWING_WIN32)
-#include "PluginMessageThrottlerWin.h"
-#include <gdk/gdkwin32.h>
-#undef String
-#endif
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -106,7 +100,7 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
         return false;
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
 
     bool accepted = !m_plugin->pluginFuncs()->event(m_instance, &event);
@@ -116,14 +110,12 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
     return accepted;
 }
 
-#if defined(XP_UNIX)
 static Window getRootWindow(Frame* parentFrame)
 {
     GtkWidget* parentWidget = parentFrame->view()->hostWindow()->platformPageClient();
     GdkScreen* gscreen = gtk_widget_get_screen(parentWidget);
     return GDK_WINDOW_XWINDOW(gdk_screen_get_root_window(gscreen));
 }
-#endif
 
 void PluginView::updatePluginWidget()
 {
@@ -146,7 +138,6 @@ void PluginView::updatePluginWidget()
     if (m_status != PluginStatusLoadedSuccessfully)
         return;
 
-#if defined(XP_UNIX)
     if (!m_isWindowed && !m_windowRect.isEmpty()) {
         Display* display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
         if (m_drawable)
@@ -157,7 +148,6 @@ void PluginView::updatePluginWidget()
                                    ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth);
         XSync(display, false); // make sure that the server knows about the Drawable
     }
-#endif
 
     setNPWindowIfNeeded();
 }
@@ -197,7 +187,6 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (m_isWindowed)
         return;
 
-#if defined(XP_UNIX)
     if (!m_drawable)
         return;
 
@@ -271,12 +260,11 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     cairo_paint(cr);
 
     cairo_restore(cr);
-#endif // defined(XP_UNIX)
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
 {
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 
     if (!m_isStarted || m_status != PluginStatusLoadedSuccessfully)
         return;
@@ -285,7 +273,6 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
         return;
 
     NPEvent xEvent;
-#if defined(XP_UNIX)
     initXEvent(&xEvent);
     GdkEventKey* gdkEvent = event->keyEvent()->gdkEventKey();
 
@@ -305,13 +292,11 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     xEvent.xkey.y = 0;
     xEvent.xkey.x_root = 0;
     xEvent.xkey.y_root = 0;
-#endif
 
     if (dispatchNPEvent(xEvent))
         event->setDefaultHandled();
 }
 
-#if defined(XP_UNIX)
 static unsigned int inputEventState(MouseEvent* event)
 {
     unsigned int state = 0;
@@ -402,11 +387,10 @@ static void setXCrossingEventSpecificFields(XEvent* xEvent, MouseEvent* event, c
     xcrossing.same_screen = true;
     xcrossing.focus = false;
 }
-#endif
 
 void PluginView::handleMouseEvent(MouseEvent* event)
 {
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 
     if (!m_isStarted || m_status != PluginStatusLoadedSuccessfully)
         return;
@@ -421,7 +405,6 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     }
 
     NPEvent xEvent;
-#if defined(XP_UNIX)
     initXEvent(&xEvent);
 
     IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
@@ -440,13 +423,11 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     }
     else
         return;
-#endif
 
     if (dispatchNPEvent(xEvent))
         event->setDefaultHandled();
 }
 
-#if defined(XP_UNIX)
 void PluginView::handleFocusInEvent()
 {
     if (!m_isStarted || m_status != PluginStatusLoadedSuccessfully)
@@ -478,7 +459,6 @@ void PluginView::handleFocusOutEvent()
 
     dispatchNPEvent(npEvent);
 }
-#endif
 
 void PluginView::setParent(ScrollView* parent)
 {
@@ -535,7 +515,7 @@ void PluginView::setNPWindowIfNeeded()
     }
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
     m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
     setCallingPlugin(false);
@@ -544,14 +524,12 @@ void PluginView::setNPWindowIfNeeded()
     if (!m_isWindowed)
         return;
 
-#if defined(XP_UNIX)
     // GtkXtBin will call gtk_widget_size_allocate, so we don't need to do it here.
     if (!m_needsXEmbed) {
         gtk_xtbin_set_position(GTK_XTBIN(platformPluginWidget()), m_windowRect.x(), m_windowRect.y());
         gtk_xtbin_resize(platformPluginWidget(), m_windowRect.width(), m_windowRect.height());
         return;
     }
-#endif
 
     m_delayedAllocation = m_windowRect;
     updateWidgetAllocationAndClip();
@@ -647,20 +625,12 @@ bool PluginView::platformGetValueStatic(NPNVariable variable, void* value, NPErr
 {
     switch (variable) {
     case NPNVToolkit:
-#if defined(XP_UNIX)
         *static_cast<uint32_t*>(value) = 2;
-#else
-        *static_cast<uint32_t*>(value) = 0;
-#endif
         *result = NPERR_NO_ERROR;
         return true;
 
     case NPNVSupportsXEmbedBool:
-#if defined(XP_UNIX)
         *static_cast<NPBool*>(value) = true;
-#else
-        *static_cast<NPBool*>(value) = false;
-#endif
         *result = NPERR_NO_ERROR;
         return true;
 
@@ -670,11 +640,7 @@ bool PluginView::platformGetValueStatic(NPNVariable variable, void* value, NPErr
         return true;
 
     case NPNVSupportsWindowless:
-#if defined(XP_UNIX)
         *static_cast<NPBool*>(value) = true;
-#else
-        *static_cast<NPBool*>(value) = false;
-#endif
         *result = NPERR_NO_ERROR;
         return true;
 
@@ -687,18 +653,13 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
 {
     switch (variable) {
     case NPNVxDisplay:
-#if defined(XP_UNIX)
         if (m_needsXEmbed)
             *(void **)value = (void *)GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
         else
             *(void **)value = (void *)GTK_XTBIN(platformPluginWidget())->xtclient.xtdisplay;
         *result = NPERR_NO_ERROR;
-#else
-        *result = NPERR_GENERIC_ERROR;
-#endif
         return true;
 
-#if defined(XP_UNIX)
     case NPNVxtAppContext:
         if (!m_needsXEmbed) {
             *(void **)value = XtDisplayToApplicationContext (GTK_XTBIN(platformPluginWidget())->xtclient.xtdisplay);
@@ -707,20 +668,15 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
         } else
             *result = NPERR_GENERIC_ERROR;
         return true;
-#endif
 
         case NPNVnetscapeWindow: {
             GdkWindow* gdkWindow = gtk_widget_get_window(m_parentFrame->view()->hostWindow()->platformPageClient());
-#if defined(XP_UNIX)
             GdkWindow* toplevelWindow = gdk_window_get_toplevel(gdkWindow);
             if (!toplevelWindow) {
                 *result = NPERR_GENERIC_ERROR;
                 return true;
             }
             *static_cast<Window*>(value) = GDK_WINDOW_XWINDOW(toplevelWindow);
-#elif defined(GDK_WINDOWING_WIN32)
-            *static_cast<HGDIOBJ*>(value) = GDK_WINDOW_HWND(gdkWindow);
-#endif
             *result = NPERR_NO_ERROR;
             return true;
         }
@@ -765,7 +721,6 @@ void PluginView::forceRedraw()
         gtk_widget_queue_draw(m_parentFrame->view()->hostWindow()->platformPageClient());
 }
 
-#ifndef GDK_WINDOWING_WIN32
 static Display* getPluginDisplay()
 {
     // The plugin toolkit might have a different X connection open.  Since we're
@@ -773,15 +728,9 @@ static Display* getPluginDisplay()
     // plugins, so we can return that.  We might want to add other implementations here
     // later.
 
-#if defined(XP_UNIX)
     return GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
-#else
-    return 0;
-#endif
 }
-#endif
 
-#if defined(XP_UNIX)
 static void getVisualAndColormap(int depth, Visual** visual, Colormap* colormap)
 {
     *visual = 0;
@@ -818,7 +767,6 @@ static void getVisualAndColormap(int depth, Visual** visual, Colormap* colormap)
     if (*visual)
         *colormap = XCreateColormap(display, GDK_ROOT_WINDOW(), *visual, AllocNone);
 }
-#endif
 
 gboolean PluginView::plugRemovedCallback(GtkSocket* socket, PluginView* view)
 {
@@ -839,20 +787,17 @@ bool PluginView::platformStart()
     ASSERT(m_isStarted);
     ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
-#if defined(XP_UNIX)
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         setCallingPlugin(true);
         m_plugin->pluginFuncs()->getvalue(m_instance, NPPVpluginNeedsXEmbed, &m_needsXEmbed);
         setCallingPlugin(false);
         PluginView::setCurrentPluginView(0);
     }
-#endif
 
     if (m_isWindowed) {
         GtkWidget* pageClient = m_parentFrame->view()->hostWindow()->platformPageClient();
-#if defined(XP_UNIX)
         if (m_needsXEmbed) {
             // If our parent is not anchored the startup process will
             // fail miserably for XEmbed plugins a bit later on when
@@ -868,31 +813,18 @@ bool PluginView::platformStart()
             g_signal_connect(platformPluginWidget(), "plug-removed", G_CALLBACK(PluginView::plugRemovedCallback), this);
         } else
             setPlatformWidget(gtk_xtbin_new(pageClient, 0));
-#else
-#if OS(WINDOWS) && !defined(GTK_API_VERSION_2)
-        setPlatformWidget(0);
-#else
-        setPlatformWidget(gtk_socket_new());
-#endif
-        gtk_container_add(GTK_CONTAINER(pageClient), platformPluginWidget());
-#endif
     } else {
         setPlatformWidget(0);
-#if defined(XP_UNIX)
         m_pluginDisplay = getPluginDisplay();
-#endif
     }
 
     show();
 
-#if defined(XP_UNIX)
         NPSetWindowCallbackStruct* ws = new NPSetWindowCallbackStruct();
         ws->type = 0;
-#endif
 
     if (m_isWindowed) {
         m_npWindow.type = NPWindowTypeWindow;
-#if defined(XP_UNIX)
         if (m_needsXEmbed) {
             GtkWidget* widget = platformPluginWidget();
             gtk_widget_realize(widget);
@@ -910,14 +842,10 @@ bool PluginView::platformStart()
             ws->colormap = GTK_XTBIN(platformPluginWidget())->xtclient.xtcolormap;
         }
         XFlush (ws->display);
-#elif defined(GDK_WINDOWING_WIN32)
-        m_npWindow.window = (void*)GDK_WINDOW_HWND(gtk_widget_get_window(platformPluginWidget()));
-#endif
     } else {
         m_npWindow.type = NPWindowTypeDrawable;
         m_npWindow.window = 0; // Not used?
 
-#if defined(XP_UNIX)
         GdkScreen* gscreen = gdk_screen_get_default();
         GdkVisual* gvisual = gdk_screen_get_system_visual(gscreen);
 
@@ -939,16 +867,9 @@ bool PluginView::platformStart()
         m_npWindow.y = 0;
         m_npWindow.width = -1;
         m_npWindow.height = -1;
-#else
-        notImplemented();
-        m_status = PluginStatusCanNotLoadPlugin;
-        return false;
-#endif
     }
 
-#if defined(XP_UNIX)
     m_npWindow.ws_info = ws;
-#endif
 
     // TODO remove in favor of null events, like mac port?
     if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall)))
@@ -959,12 +880,10 @@ bool PluginView::platformStart()
 
 void PluginView::platformDestroy()
 {
-#if defined(XP_UNIX)
     if (m_drawable) {
         XFreePixmap(GDK_DISPLAY_XDISPLAY(gdk_display_get_default()), m_drawable);
         m_drawable = 0;
     }
-#endif
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/plugins/mac/PluginViewMac.mm b/Source/WebCore/plugins/mac/PluginViewMac.mm
index 2d9d68699..785a74df0 100644
--- a/Source/WebCore/plugins/mac/PluginViewMac.mm
+++ b/Source/WebCore/plugins/mac/PluginViewMac.mm
@@ -426,7 +426,7 @@ void PluginView::setNPWindowIfNeeded()
             m_npWindow.clipRect.right - m_npWindow.clipRect.left, m_npWindow.clipRect.bottom - m_npWindow.clipRect.top);
 
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
     m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
     setCallingPlugin(false);
@@ -772,7 +772,7 @@ Point PluginView::mousePosForPlugin(MouseEvent* event) const
 bool PluginView::dispatchNPEvent(NPEvent& event)
 {
     PluginView::setCurrentPluginView(this);
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
 
     bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index eda0504c2..891d42b97 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -142,31 +142,6 @@ QWebPageClient* PluginView::platformPageClient() const
     return hostWindow->platformPageClient();
 }
 
-#if !HAVE(QT5) && USE(ACCELERATED_COMPOSITING)
-// Qt's GraphicsLayer (GraphicsLayerQt) requires layers to be QGraphicsWidgets
-class PluginGraphicsLayerQt : public QGraphicsWidget {
-public:
-    PluginGraphicsLayerQt(PluginView* view) : m_view(view) { }
-    ~PluginGraphicsLayerQt() { }
-
-    void paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget = 0)
-    {
-        Q_UNUSED(widget);
-        m_view->paintUsingXPixmap(painter, option->exposedRect.toRect());
-    }
-
-private:
-    PluginView* m_view;
-};
-
-bool PluginView::shouldUseAcceleratedCompositing() const
-{
-    return m_parentFrame->page()->chrome()->client()->allowsAcceleratedCompositing()
-           && m_parentFrame->page()->settings()
-           && m_parentFrame->page()->settings()->acceleratedCompositingEnabled();
-}
-#endif
-
 void PluginView::updatePluginWidget()
 {
     if (!parent())
@@ -373,7 +348,7 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
 
     PluginView::setCurrentPluginView(this);
 #if USE(JSC)
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
     setCallingPlugin(true);
     bool accepted = !m_plugin->pluginFuncs()->event(m_instance, &event);
@@ -687,7 +662,7 @@ void PluginView::setNPWindowIfNeeded()
 
     PluginView::setCurrentPluginView(this);
 #if USE(JSC)
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
     setCallingPlugin(true);
     m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
@@ -801,13 +776,6 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
-#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
-    if (m_platformLayer) {
-        m_platformLayer->update(QRectF(rect));
-        return;
-    }
-#endif
-
 #if !HAVE(QT5) // Windowed mode is not supported with Qt5 yet.
     if (m_isWindowed) {
         if (platformWidget()) {
@@ -949,7 +917,7 @@ bool PluginView::platformStart()
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
 #if USE(JSC)
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 #endif
         setCallingPlugin(true);
         m_plugin->pluginFuncs()->getvalue(m_instance, NPPVpluginNeedsXEmbed, &m_needsXEmbed);
@@ -973,14 +941,6 @@ bool PluginView::platformStart()
     {
         setPlatformWidget(0);
         m_pluginDisplay = getPluginDisplay();
-
-#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
-        if (shouldUseAcceleratedCompositing()) {
-            m_platformLayer = adoptPtr(new PluginGraphicsLayerQt(this));
-            // Trigger layer computation in RenderLayerCompositor
-            m_element->setNeedsStyleRecalc(SyntheticStyleChange);
-        }
-#endif
     }
 
     // If the width and the height are not zero we show the PluginView.
diff --git a/Source/WebCore/plugins/win/PluginViewWin.cpp b/Source/WebCore/plugins/win/PluginViewWin.cpp
index d4dc9b92c..adfd2d36b 100644
--- a/Source/WebCore/plugins/win/PluginViewWin.cpp
+++ b/Source/WebCore/plugins/win/PluginViewWin.cpp
@@ -537,7 +537,7 @@ bool PluginView::dispatchNPEvent(NPEvent& npEvent)
         shouldPop = true;
     }
 
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     setCallingPlugin(true);
     bool accepted = !m_plugin->pluginFuncs()->event(m_instance, &npEvent);
     setCallingPlugin(false);
@@ -648,7 +648,15 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     }
 
     ASSERT(parent()->isFrameView());
+
+    // In the GTK port we draw in an offscreen buffer and don't want to use the window
+    // coordinates.
+#if PLATFORM(GTK)
+    IntRect rectInWindow(rect);
+    rectInWindow.intersect(frameRect());
+#else
     IntRect rectInWindow = static_cast<FrameView*>(parent())->contentsToWindow(frameRect());
+#endif
     LocalWindowsContext windowsContext(context, rectInWindow, m_isTransparent);
 
     // On Safari/Windows without transparency layers the GraphicsContext returns the HDC
@@ -688,7 +696,7 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     } else
         return;
 
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     if (dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 }
@@ -758,7 +766,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     } else
         return;
 
-    JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+    JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
     // FIXME: Consider back porting the http://webkit.org/b/58108 fix here.
     if (dispatchNPEvent(npEvent))
         event->setDefaultHandled();
@@ -832,7 +840,13 @@ void PluginView::setNPWindowRect(const IntRect& rect)
     m_npWindow.clipRect.right = r.width();
     m_npWindow.clipRect.bottom = r.height();
 #else
+    // In the GTK port we draw in an offscreen buffer and don't want to use the window
+    // coordinates.
+# if PLATFORM(GTK)
+    IntPoint p = rect.location();
+# else
     IntPoint p = static_cast<FrameView*>(parent())->contentsToWindow(rect.location());
+# endif
     m_npWindow.x = p.x();
     m_npWindow.y = p.y();
 
@@ -846,7 +860,7 @@ void PluginView::setNPWindowRect(const IntRect& rect)
     m_npWindow.clipRect.top = 0;
 
     if (m_plugin->pluginFuncs()->setwindow) {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         setCallingPlugin(true);
         m_plugin->pluginFuncs()->setwindow(m_instance, &m_npWindow);
         setCallingPlugin(false);
diff --git a/Source/WebCore/rendering/AutoTableLayout.cpp b/Source/WebCore/rendering/AutoTableLayout.cpp
index 019b11d53..37df7bfbb 100644
--- a/Source/WebCore/rendering/AutoTableLayout.cpp
+++ b/Source/WebCore/rendering/AutoTableLayout.cpp
@@ -59,18 +59,19 @@ void AutoTableLayout::recalcColumn(unsigned effCol)
                 RenderTableSection::CellStruct current = section->cellAt(i, effCol);
                 RenderTableCell* cell = current.primaryCell();
                 
-                bool cellHasContent = cell && !current.inColSpan && (cell->firstChild() || cell->style()->hasBorder() || cell->style()->hasPadding());
-                if (cellHasContent)
-                    columnLayout.emptyCellsOnly = false;
-                    
                 if (current.inColSpan || !cell)
                     continue;
 
+                bool cellHasContent = cell->firstChild() || cell->style()->hasBorder() || cell->style()->hasPadding();
+                if (cellHasContent)
+                    columnLayout.emptyCellsOnly = false;
+
+                // A cell originates in this column. Ensure we have
+                // a min/max width of at least 1px for this column now.
+                columnLayout.minLogicalWidth = max<int>(columnLayout.minLogicalWidth, cellHasContent ? 1 : 0);
+                columnLayout.maxLogicalWidth = max<int>(columnLayout.maxLogicalWidth, 1);
+
                 if (cell->colSpan() == 1) {
-                    // A cell originates in this column.  Ensure we have
-                    // a min/max width of at least 1px for this column now.
-                    columnLayout.minLogicalWidth = max<int>(columnLayout.minLogicalWidth, cellHasContent ? 1 : 0);
-                    columnLayout.maxLogicalWidth = max<int>(columnLayout.maxLogicalWidth, 1);
                     if (cell->preferredLogicalWidthsDirty())
                         cell->computePreferredLogicalWidths();
                     columnLayout.minLogicalWidth = max<int>(cell->minPreferredLogicalWidth(), columnLayout.minLogicalWidth);
@@ -79,22 +80,25 @@ void AutoTableLayout::recalcColumn(unsigned effCol)
                         maxContributor = cell;
                     }
 
+                    // All browsers implement a size limit on the cell's max width. 
+                    // Our limit is based on KHTML's representation that used 16 bits widths.
+                    // FIXME: Other browsers have a lower limit for the cell's max width. 
+                    const int cCellMaxWidth = 32760;
                     Length cellLogicalWidth = cell->styleOrColLogicalWidth();
-                    // FIXME: What is this arbitrary value?
-                    if (cellLogicalWidth.value() > 32760)
-                        cellLogicalWidth.setValue(32760);
+                    if (cellLogicalWidth.value() > cCellMaxWidth)
+                        cellLogicalWidth.setValue(cCellMaxWidth);
                     if (cellLogicalWidth.isNegative())
                         cellLogicalWidth.setValue(0);
                     switch (cellLogicalWidth.type()) {
                     case Fixed:
                         // ignore width=0
-                        if (cellLogicalWidth.value() > 0 && columnLayout.logicalWidth.type() != Percent) {
+                        if (cellLogicalWidth.isPositive() && !columnLayout.logicalWidth.isPercent()) {
                             int logicalWidth = cell->computeBorderBoxLogicalWidth(cellLogicalWidth.value());
                             if (columnLayout.logicalWidth.isFixed()) {
                                 // Nav/IE weirdness
-                                if ((logicalWidth > columnLayout.logicalWidth.value()) ||
-                                    ((columnLayout.logicalWidth.value() == logicalWidth) && (maxContributor == cell))) {
-                                    columnLayout.logicalWidth.setValue(logicalWidth);
+                                if ((logicalWidth > columnLayout.logicalWidth.value()) 
+                                    || ((columnLayout.logicalWidth.value() == logicalWidth) && (maxContributor == cell))) {
+                                    columnLayout.logicalWidth.setValue(Fixed, logicalWidth);
                                     fixedContributor = cell;
                                 }
                             } else {
@@ -111,16 +115,13 @@ void AutoTableLayout::recalcColumn(unsigned effCol)
                     case Relative:
                         // FIXME: Need to understand this case and whether it makes sense to compare values
                         // which are not necessarily of the same type.
-                        if (cellLogicalWidth.isAuto() || (cellLogicalWidth.isRelative() && cellLogicalWidth.value() > columnLayout.logicalWidth.value()))
+                        if (cellLogicalWidth.value() > columnLayout.logicalWidth.value())
                             columnLayout.logicalWidth = cellLogicalWidth;
                     default:
                         break;
                     }
                 } else if (!effCol || section->primaryCellAt(i, effCol - 1) != cell) {
-                    // This spanning cell originates in this column.  Ensure we have
-                    // a min/max width of at least 1px for this column now.
-                    columnLayout.minLogicalWidth = max<int>(columnLayout.minLogicalWidth, cellHasContent ? 1 : 0);
-                    columnLayout.maxLogicalWidth = max<int>(columnLayout.maxLogicalWidth, 1);
+                    // This spanning cell originates in this column. Insert the cell into spanning cells list.
                     insertSpanCell(cell);
                 }
             }
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.cpp b/Source/WebCore/rendering/FilterEffectRenderer.cpp
index ebf6b7ee6..11cf5f571 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.cpp
+++ b/Source/WebCore/rendering/FilterEffectRenderer.cpp
@@ -50,6 +50,13 @@
 #include "Settings.h"
 #endif
 
+#if ENABLE(SVG)
+#include "CachedSVGDocument.h"
+#include "SVGElement.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
+#include "SourceAlpha.h"
+#endif
+
 namespace WebCore {
 
 static inline void endMatrixRow(Vector<float>& parameters)
@@ -108,6 +115,56 @@ GraphicsContext* FilterEffectRenderer::inputContext()
     return sourceImage() ? sourceImage()->context() : 0;
 }
 
+PassRefPtr<FilterEffect> FilterEffectRenderer::buildReferenceFilter(Document* document, PassRefPtr<FilterEffect> previousEffect, ReferenceFilterOperation* op)
+{
+#if ENABLE(SVG)
+    CachedSVGDocument* cachedSVGDocument = static_cast<CachedSVGDocument*>(op->data());
+
+    // If we have an SVG document, this is an external reference. Otherwise
+    // we look up the referenced node in the current document.
+    if (cachedSVGDocument)
+        document = cachedSVGDocument->document();
+
+    if (!document)
+        return 0;
+
+    Element* filter = document->getElementById(op->fragment());
+    if (!filter)
+        return 0;
+
+    RefPtr<FilterEffect> effect;
+
+    // FIXME: Figure out what to do with SourceAlpha. Right now, we're
+    // using the alpha of the original input layer, which is obviously
+    // wrong. We should probably be extracting the alpha from the 
+    // previousEffect, but this requires some more processing.  
+    // This may need a spec clarification.
+    RefPtr<SVGFilterBuilder> builder = SVGFilterBuilder::create(previousEffect, SourceAlpha::create(this));
+
+    for (Node* node = filter->firstChild(); node; node = node->nextSibling()) {
+        if (!node->isSVGElement())
+            continue;
+
+        SVGElement* element = static_cast<SVGElement*>(node);
+        if (!element->isFilterEffect())
+            continue;
+
+        SVGFilterPrimitiveStandardAttributes* effectElement = static_cast<SVGFilterPrimitiveStandardAttributes*>(element);
+
+        effect = effectElement->build(builder.get(), this);
+        if (!effect)
+            continue;
+
+        effectElement->setStandardAttributes(effect.get());
+        builder->add(effectElement->result(), effect);
+        m_effects.append(effect);
+    }
+    return effect;
+#else
+    return 0;
+#endif
+}
+
 bool FilterEffectRenderer::build(Document* document, const FilterOperations& operations)
 {
 #if !ENABLE(CSS_SHADERS) || !ENABLE(WEBGL)
@@ -122,14 +179,13 @@ bool FilterEffectRenderer::build(Document* document, const FilterOperations& ope
         operations.getOutsets(m_topOutset, m_rightOutset, m_bottomOutset, m_leftOutset);
     m_effects.clear();
 
-    RefPtr<FilterEffect> previousEffect;
+    RefPtr<FilterEffect> previousEffect = m_sourceGraphic;
     for (size_t i = 0; i < operations.operations().size(); ++i) {
         RefPtr<FilterEffect> effect;
         FilterOperation* filterOperation = operations.operations().at(i).get();
         switch (filterOperation->getOperationType()) {
         case FilterOperation::REFERENCE: {
-            // FIXME: Not yet implemented.
-            // https://bugs.webkit.org/show_bug.cgi?id=72443
+            effect = buildReferenceFilter(document, previousEffect, static_cast<ReferenceFilterOperation*>(filterOperation));
             break;
         }
         case FilterOperation::GRAYSCALE: {
@@ -291,18 +347,18 @@ bool FilterEffectRenderer::build(Document* document, const FilterOperations& ope
             // Unlike SVG, filters applied here should not clip to their primitive subregions.
             effect->setClipsToBounds(false);
             
-            if (previousEffect)
+            if (filterOperation->getOperationType() != FilterOperation::REFERENCE) {
                 effect->inputEffects().append(previousEffect);
-            m_effects.append(effect);
+                m_effects.append(effect);
+            }
             previousEffect = effect.release();
         }
     }
 
     // If we didn't make any effects, tell our caller we are not valid
-    if (!previousEffect)
+    if (!m_effects.size())
         return false;
 
-    m_effects.first()->inputEffects().append(m_sourceGraphic);
     setMaxEffectRects(m_sourceDrawingRegion);
     
     return true;
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.h b/Source/WebCore/rendering/FilterEffectRenderer.h
index c6266f628..0db987b3c 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.h
+++ b/Source/WebCore/rendering/FilterEffectRenderer.h
@@ -100,6 +100,7 @@ public:
     ImageBuffer* output() const { return lastEffect()->asImageBuffer(); }
 
     bool build(Document*, const FilterOperations&);
+    PassRefPtr<FilterEffect> buildReferenceFilter(Document*, PassRefPtr<FilterEffect> previousEffect, ReferenceFilterOperation*);
     bool updateBackingStoreRect(const FloatRect& filterRect);
     void allocateBackingStoreIfNeeded();
     void clearIntermediateResults();
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index a88820529..0edab2c33 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -207,7 +207,7 @@ public:
 
     float width() const { return isHorizontal() ? logicalWidth() : logicalHeight(); }
     float height() const { return isHorizontal() ? logicalHeight() : logicalWidth(); }
-    FloatSize size() const { return IntSize(width(), height()); }
+    FloatSize size() const { return FloatSize(width(), height()); }
     float right() const { return left() + width(); }
     float bottom() const { return top() + height(); }
 
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index fdb1c0384..030b18711 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -2033,7 +2033,7 @@ LayoutUnit RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo
     RenderObject* prev = child->previousSibling();
     if (prev && prev->isBlockFlow() && !prev->isFloatingOrOutOfFlowPositioned()) {
         RenderBlock* block = toRenderBlock(prev);
-        if (block->containsFloats() && block->lowestFloatLogicalBottom() > logicalTop) 
+        if (block->containsFloats() && !block->avoidsFloats() && (block->logicalTop() + block->lowestFloatLogicalBottom()) > logicalTop) 
             addOverhangingFloats(block, false);
     }
 
@@ -2071,10 +2071,10 @@ LayoutUnit RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& margin
         
         // Adjust our height such that we are ready to be collapsed with subsequent siblings (or the bottom
         // of the parent block).
-        setLogicalHeight(child->y() - max(ZERO_LAYOUT_UNIT, marginInfo.margin()));
+        setLogicalHeight(child->logicalTop() - max(ZERO_LAYOUT_UNIT, marginInfo.margin()));
     } else
         // Increase our height by the amount we had to clear.
-        setLogicalHeight(height() + heightIncrease);
+        setLogicalHeight(logicalHeight() + heightIncrease);
     
     if (marginInfo.canCollapseWithMarginBefore()) {
         // We can no longer collapse with the top of the block since a clear
@@ -2089,14 +2089,60 @@ LayoutUnit RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& margin
     return yPos + heightIncrease;
 }
 
+void RenderBlock::marginBeforeEstimateForChild(RenderBox* child, LayoutUnit& positiveMarginBefore, LayoutUnit& negativeMarginBefore) const
+{
+    // FIXME: We could get even more quirks mode cases right if we dealt with quirk containers.
+    // FIXME: We should deal with the margin-collapse-* style extensions that prevent collapsing and that discard margins.
+    LayoutUnit beforeChildMargin = marginBeforeForChild(child);
+    positiveMarginBefore = max(positiveMarginBefore, beforeChildMargin);
+    negativeMarginBefore = max(negativeMarginBefore, -beforeChildMargin);
+
+    if (!child->isRenderBlock())
+        return;
+    
+    RenderBlock* childBlock = toRenderBlock(child);
+    if (childBlock->childrenInline() || childBlock->isWritingModeRoot())
+        return;
+
+    MarginInfo childMarginInfo(childBlock, childBlock->borderBefore() + childBlock->paddingBefore(), childBlock->borderAfter() + childBlock->paddingAfter());
+    if (!childMarginInfo.canCollapseMarginBeforeWithChildren())
+        return;
+
+    RenderBox* grandchildBox = childBlock->firstChildBox();
+    for ( ; grandchildBox; grandchildBox = grandchildBox->nextSiblingBox()) {
+        if (!grandchildBox->isFloatingOrOutOfFlowPositioned())
+            break;
+    }
+    
+    // Give up if there is clearance on the box, since it probably won't collapse into us.
+    if (!grandchildBox || grandchildBox->style()->clear() != CNONE)
+        return;
+
+    // Collapse the margin of the grandchild box with our own to produce an estimate.
+    childBlock->marginBeforeEstimateForChild(grandchildBox, positiveMarginBefore, negativeMarginBefore);
+}
+
 LayoutUnit RenderBlock::estimateLogicalTopPosition(RenderBox* child, const MarginInfo& marginInfo, LayoutUnit& estimateWithoutPagination)
 {
     // FIXME: We need to eliminate the estimation of vertical position, because when it's wrong we sometimes trigger a pathological
     // relayout if there are intruding floats.
     LayoutUnit logicalTopEstimate = logicalHeight();
     if (!marginInfo.canCollapseWithMarginBefore()) {
-        LayoutUnit childMarginBefore = child->selfNeedsLayout() ? marginBeforeForChild(child) : collapsedMarginBeforeForChild(child);
-        logicalTopEstimate += max(marginInfo.margin(), childMarginBefore);
+        LayoutUnit positiveMarginBefore = ZERO_LAYOUT_UNIT;
+        LayoutUnit negativeMarginBefore = ZERO_LAYOUT_UNIT;
+        if (child->selfNeedsLayout()) {
+            // Try to do a basic estimation of how the collapse is going to go.
+            marginBeforeEstimateForChild(child, positiveMarginBefore, negativeMarginBefore);
+        } else {
+            // Use the cached collapsed margin values from a previous layout. Most of the time they
+            // will be right.
+            MarginValues marginValues = marginValuesForChild(child);
+            positiveMarginBefore = max(positiveMarginBefore, marginValues.positiveMarginBefore());
+            negativeMarginBefore = max(negativeMarginBefore, marginValues.negativeMarginBefore());
+        }
+
+        // Collapse the result with our current margins.
+        logicalTopEstimate += max(marginInfo.positiveMargin(), positiveMarginBefore) - max(marginInfo.negativeMargin(), negativeMarginBefore);
     }
 
     // Adjust logicalTopEstimate down to the next page if the margins are so large that we don't fit on the current
@@ -2137,7 +2183,8 @@ LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const Re
     if (region)
         blockOffset = max(blockOffset, blockOffset + (region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage));
 
-    LayoutUnit startOff = startOffsetForLine(blockOffset, false, region, offsetFromLogicalTopOfFirstPage);
+    LayoutUnit startOff = startOffsetForLine(blockOffset, false, region, offsetFromLogicalTopOfFirstPage, logicalHeightForChild(child));
+
     if (style()->textAlign() != WEBKIT_CENTER && !child->style()->marginStartUsing(style()).isAuto()) {
         if (childMarginStart < 0)
             startOff += childMarginStart;
@@ -3961,27 +4008,48 @@ void RenderBlock::clearPercentHeightDescendantsFrom(RenderBox* parent)
     }
 }
 
+static bool rangesIntersect(int floatTop, int floatBottom, int objectTop, int objectBottom)
+{
+    if (objectTop >= floatBottom || objectBottom < floatTop)
+        return false;
+
+    // The top of the object overlaps the float
+    if (objectTop >= floatTop)
+        return true;
+
+    // The object encloses the float
+    if (objectTop < floatTop && objectBottom > floatBottom)
+        return true;
+
+    // The bottom of the object overlaps the float
+    if (objectBottom > objectTop && objectBottom > floatTop && objectBottom <= floatBottom)
+        return true;
+
+    return false;
+}
+
 template <RenderBlock::FloatingObject::Type FloatTypeValue>
 inline void RenderBlock::FloatIntervalSearchAdapter<FloatTypeValue>::collectIfNeeded(const IntervalType& interval) const
 {
     const FloatingObject* r = interval.data();
-    if (r->type() == FloatTypeValue && interval.low() <= m_value && m_value < interval.high()) {
-        // All the objects returned from the tree should be already placed.
-        ASSERT(r->isPlaced() && m_renderer->pixelSnappedLogicalTopForFloat(r) <= m_value && m_renderer->pixelSnappedLogicalBottomForFloat(r) > m_value);
+    if (r->type() != FloatTypeValue || !rangesIntersect(interval.low(), interval.high(), m_lowValue, m_highValue))
+        return;
 
-        if (FloatTypeValue == FloatingObject::FloatLeft 
-            && m_renderer->logicalRightForFloat(r) > m_offset) {
-            m_offset = m_renderer->logicalRightForFloat(r);
-            if (m_heightRemaining)
-                *m_heightRemaining = m_renderer->logicalBottomForFloat(r) - m_value;
-        }
+    // All the objects returned from the tree should be already placed.
+    ASSERT(r->isPlaced() && rangesIntersect(m_renderer->pixelSnappedLogicalTopForFloat(r), m_renderer->pixelSnappedLogicalBottomForFloat(r), m_lowValue, m_highValue));
 
-        if (FloatTypeValue == FloatingObject::FloatRight
-            && m_renderer->logicalLeftForFloat(r) < m_offset) {
-            m_offset = m_renderer->logicalLeftForFloat(r);
-            if (m_heightRemaining)
-                *m_heightRemaining = m_renderer->logicalBottomForFloat(r) - m_value;
-        }
+    if (FloatTypeValue == FloatingObject::FloatLeft 
+        && m_renderer->logicalRightForFloat(r) > m_offset) {
+        m_offset = m_renderer->logicalRightForFloat(r);
+        if (m_heightRemaining)
+            *m_heightRemaining = m_renderer->logicalBottomForFloat(r) - m_lowValue;
+    }
+
+    if (FloatTypeValue == FloatingObject::FloatRight
+        && m_renderer->logicalLeftForFloat(r) < m_offset) {
+        m_offset = m_renderer->logicalLeftForFloat(r);
+        if (m_heightRemaining)
+            *m_heightRemaining = m_renderer->logicalBottomForFloat(r) - m_lowValue;
     }
 }
 
@@ -4015,14 +4083,14 @@ LayoutUnit RenderBlock::logicalRightOffsetForContent(RenderRegion* region, Layou
     return logicalRightOffset - (logicalWidth() - (isHorizontalWritingMode() ? boxRect.maxX() : boxRect.maxY()));
 }
 
-LayoutUnit RenderBlock::logicalLeftOffsetForLine(LayoutUnit logicalTop, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* heightRemaining) const
+LayoutUnit RenderBlock::logicalLeftOffsetForLine(LayoutUnit logicalTop, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* heightRemaining, LayoutUnit logicalHeight) const
 {
     LayoutUnit left = fixedOffset;
     if (m_floatingObjects && m_floatingObjects->hasLeftObjects()) {
         if (heightRemaining)
             *heightRemaining = 1;
 
-        FloatIntervalSearchAdapter<FloatingObject::FloatLeft> adapter(this, roundToInt(logicalTop), left, heightRemaining);
+        FloatIntervalSearchAdapter<FloatingObject::FloatLeft> adapter(this, roundToInt(logicalTop), roundToInt(logicalTop + logicalHeight), left, heightRemaining);
         m_floatingObjects->placedFloatsTree().allOverlapsWithAdapter(adapter);
     }
 
@@ -4062,7 +4130,7 @@ LayoutUnit RenderBlock::logicalLeftOffsetForLine(LayoutUnit logicalTop, LayoutUn
     return left;
 }
 
-LayoutUnit RenderBlock::logicalRightOffsetForLine(LayoutUnit logicalTop, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* heightRemaining) const
+LayoutUnit RenderBlock::logicalRightOffsetForLine(LayoutUnit logicalTop, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* heightRemaining, LayoutUnit logicalHeight) const
 {
     LayoutUnit right = fixedOffset;
     if (m_floatingObjects && m_floatingObjects->hasRightObjects()) {
@@ -4070,7 +4138,7 @@ LayoutUnit RenderBlock::logicalRightOffsetForLine(LayoutUnit logicalTop, LayoutU
             *heightRemaining = 1;
 
         LayoutUnit rightFloatOffset = fixedOffset;
-        FloatIntervalSearchAdapter<FloatingObject::FloatRight> adapter(this, roundToInt(logicalTop), rightFloatOffset, heightRemaining);
+        FloatIntervalSearchAdapter<FloatingObject::FloatRight> adapter(this, roundToInt(logicalTop), roundToInt(logicalTop + logicalHeight), rightFloatOffset, heightRemaining);
         m_floatingObjects->placedFloatsTree().allOverlapsWithAdapter(adapter);
         right = min(right, rightFloatOffset);
     }
@@ -4511,7 +4579,7 @@ LayoutUnit RenderBlock::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
     if (!result && child->avoidsFloats()) {
         LayoutUnit newLogicalTop = logicalTop;
         while (true) {
-            LayoutUnit availableLogicalWidthAtNewLogicalTopOffset = availableLogicalWidthForLine(newLogicalTop, false);
+            LayoutUnit availableLogicalWidthAtNewLogicalTopOffset = availableLogicalWidthForLine(newLogicalTop, false, logicalHeightForChild(child));
             if (availableLogicalWidthAtNewLogicalTopOffset == availableLogicalWidthForContent(newLogicalTop))
                 return newLogicalTop - logicalTop;
 
@@ -5083,6 +5151,13 @@ bool RenderBlock::relayoutForPagination(bool hasSpecifiedPageLogicalHeight, Layo
     if (!hasColumns())
         return false;
 
+    OwnPtr<RenderOverflow> savedOverflow = m_overflow.release();
+    if (childrenInline())
+        addOverflowFromInlineChildren();
+    else
+        addOverflowFromBlockChildren();
+    LayoutUnit layoutOverflowLogicalBottom = (isHorizontalWritingMode() ? layoutOverflowRect().maxY() : layoutOverflowRect().maxX()) - borderBefore() - paddingBefore();
+
     // FIXME: We don't balance properly at all in the presence of forced page breaks.  We need to understand what
     // the distance between forced page breaks is so that we can avoid making the minimum column height too tall.
     ColumnInfo* colInfo = columnInfo();
@@ -5095,12 +5170,12 @@ bool RenderBlock::relayoutForPagination(bool hasSpecifiedPageLogicalHeight, Layo
             // maximum page break distance.
             if (!pageLogicalHeight) {
                 LayoutUnit distanceBetweenBreaks = max<LayoutUnit>(colInfo->maximumDistanceBetweenForcedBreaks(),
-                                                                   view()->layoutState()->pageLogicalOffset(this, borderBefore() + paddingBefore() + contentLogicalHeight()) - colInfo->forcedBreakOffset());
+                                                                   view()->layoutState()->pageLogicalOffset(this, borderBefore() + paddingBefore() + layoutOverflowLogicalBottom) - colInfo->forcedBreakOffset());
                 columnHeight = max(colInfo->minimumColumnHeight(), distanceBetweenBreaks);
             }
-        } else if (contentLogicalHeight() > boundedMultiply(pageLogicalHeight, desiredColumnCount)) {
+        } else if (layoutOverflowLogicalBottom > boundedMultiply(pageLogicalHeight, desiredColumnCount)) {
             // Now that we know the intrinsic height of the columns, we have to rebalance them.
-            columnHeight = max<LayoutUnit>(colInfo->minimumColumnHeight(), ceilf((float)contentLogicalHeight() / desiredColumnCount));
+            columnHeight = max<LayoutUnit>(colInfo->minimumColumnHeight(), ceilf((float)layoutOverflowLogicalBottom / desiredColumnCount));
         }
         
         if (columnHeight && columnHeight != pageLogicalHeight) {
@@ -5110,14 +5185,15 @@ bool RenderBlock::relayoutForPagination(bool hasSpecifiedPageLogicalHeight, Layo
             return true;
         }
     } 
-    
+
     if (pageLogicalHeight)
-        colInfo->setColumnCountAndHeight(ceilf((float)contentLogicalHeight() / pageLogicalHeight), pageLogicalHeight);
+        colInfo->setColumnCountAndHeight(ceilf((float)layoutOverflowLogicalBottom / pageLogicalHeight), pageLogicalHeight);
 
     if (columnCount(colInfo)) {
         setLogicalHeight(borderBefore() + paddingBefore() + colInfo->columnHeight() + borderAfter() + paddingAfter() + scrollbarLogicalHeight());
         m_overflow.clear();
-    }
+    } else
+        m_overflow = savedOverflow.release();
     
     return false;
 }
@@ -5490,7 +5566,7 @@ static inline void stripTrailingSpace(float& inlineMax, float& inlineMin,
 
 static inline void updatePreferredWidth(LayoutUnit& preferredWidth, float& result)
 {
-    LayoutUnit snappedResult = ceilf(result);
+    LayoutUnit snappedResult = LayoutUnit::fromFloatCeil(result);
     preferredWidth = max(snappedResult, preferredWidth);
 }
 
@@ -7035,7 +7111,7 @@ LayoutUnit RenderBlock::collapsedMarginAfterForChild(const  RenderBox* child) co
     return marginAfterForChild(child);
 }
 
-RenderBlock::MarginValues RenderBlock::marginValuesForChild(RenderBox* child)
+RenderBlock::MarginValues RenderBlock::marginValuesForChild(RenderBox* child) const
 {
     LayoutUnit childBeforePositive = 0;
     LayoutUnit childBeforeNegative = 0;
@@ -7275,6 +7351,16 @@ RenderBlock* RenderBlock::createAnonymousColumnSpanWithParentRenderer(const Rend
 }
 
 #ifndef NDEBUG
+void RenderBlock::checkPositionedObjectsNeedLayout()
+{
+    if (PositionedObjectsListHashSet* positionedObjects = this->positionedObjects()) {
+        PositionedObjectsListHashSet::const_iterator end = positionedObjects->end();
+        for (PositionedObjectsListHashSet::const_iterator it = positionedObjects->begin(); it != end; ++it) {
+            RenderBox* currBox = *it;
+            ASSERT(!currBox->needsLayout());
+        }
+    }
+}
 
 void RenderBlock::showLineTreeAndMark(const InlineBox* markedBox1, const char* markedLabel1, const InlineBox* markedBox2, const char* markedLabel2, const RenderObject* obj) const
 {
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 81a6ed740..123617104 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -131,62 +131,62 @@ public:
 
     // Versions that can compute line offsets with the region and page offset passed in. Used for speed to avoid having to
     // compute the region all over again when you already know it.
-    LayoutUnit availableLogicalWidthForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const
+    LayoutUnit availableLogicalWidthForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage, LayoutUnit logicalHeight = 0) const
     {
-        return max(ZERO_LAYOUT_UNIT, logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage)
-            - logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage));
+        return max(ZERO_LAYOUT_UNIT, logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage, logicalHeight)
+            - logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage, logicalHeight));
     }
-    LayoutUnit logicalRightOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const 
+    LayoutUnit logicalRightOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage, LayoutUnit logicalHeight = 0) const 
     {
-        return logicalRightOffsetForLine(position, logicalRightOffsetForContent(region, offsetFromLogicalTopOfFirstPage), firstLine);
+        return logicalRightOffsetForLine(position, logicalRightOffsetForContent(region, offsetFromLogicalTopOfFirstPage), firstLine, 0, logicalHeight);
     }
-    LayoutUnit logicalLeftOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const 
+    LayoutUnit logicalLeftOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage, LayoutUnit logicalHeight = 0) const 
     {
-        return logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(region, offsetFromLogicalTopOfFirstPage), firstLine);
+        return logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(region, offsetFromLogicalTopOfFirstPage), firstLine, 0, logicalHeight);
     }
-    LayoutUnit startOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const
+    LayoutUnit startOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage, LayoutUnit logicalHeight = 0) const
     {
-        return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage)
-            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage);
+        return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage, logicalHeight)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage, logicalHeight);
     }
-    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage) const
+    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage, LayoutUnit logicalHeight = 0) const
     {
-        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage)
-            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage);
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage, logicalHeight)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, region, offsetFromLogicalTopOfFirstPage, logicalHeight);
     }
 
-    LayoutUnit availableLogicalWidthForLine(LayoutUnit position, bool firstLine) const
+    LayoutUnit availableLogicalWidthForLine(LayoutUnit position, bool firstLine, LayoutUnit logicalHeight = 0) const
     {
-        return availableLogicalWidthForLine(position, firstLine, regionAtBlockOffset(position), offsetFromLogicalTopOfFirstPage());
+        return availableLogicalWidthForLine(position, firstLine, regionAtBlockOffset(position), offsetFromLogicalTopOfFirstPage(), logicalHeight);
     }
-    LayoutUnit logicalRightOffsetForLine(LayoutUnit position, bool firstLine) const 
+    LayoutUnit logicalRightOffsetForLine(LayoutUnit position, bool firstLine, LayoutUnit logicalHeight = 0) const 
     {
-        return logicalRightOffsetForLine(position, logicalRightOffsetForContent(position), firstLine, 0);
+        return logicalRightOffsetForLine(position, logicalRightOffsetForContent(position), firstLine, 0, logicalHeight);
     }
-    LayoutUnit logicalLeftOffsetForLine(LayoutUnit position, bool firstLine) const 
+    LayoutUnit logicalLeftOffsetForLine(LayoutUnit position, bool firstLine, LayoutUnit logicalHeight = 0) const 
     {
-        return logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(position), firstLine, 0);
+        return logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(position), firstLine, 0, logicalHeight);
     }
-    LayoutUnit pixelSnappedLogicalLeftOffsetForLine(LayoutUnit position, bool firstLine) const 
+    LayoutUnit pixelSnappedLogicalLeftOffsetForLine(LayoutUnit position, bool firstLine, LayoutUnit logicalHeight = 0) const 
     {
-        return roundToInt(logicalLeftOffsetForLine(position, firstLine));
+        return roundToInt(logicalLeftOffsetForLine(position, firstLine, logicalHeight));
     }
-    LayoutUnit pixelSnappedLogicalRightOffsetForLine(LayoutUnit position, bool firstLine) const 
+    LayoutUnit pixelSnappedLogicalRightOffsetForLine(LayoutUnit position, bool firstLine, LayoutUnit logicalHeight = 0) const 
     {
         // FIXME: Multicolumn layouts break carrying over subpixel values to the logical right offset because the lines may be shifted
         // by a subpixel value for all but the first column. This can lead to the actual pixel snapped width of the column being off
         // by one pixel when rendered versus layed out, which can result in the line being clipped. For now, we have to floor.
-        return floorToInt(logicalRightOffsetForLine(position, firstLine));
+        return floorToInt(logicalRightOffsetForLine(position, firstLine, logicalHeight));
     }
-    LayoutUnit startOffsetForLine(LayoutUnit position, bool firstLine) const
+    LayoutUnit startOffsetForLine(LayoutUnit position, bool firstLine, LayoutUnit logicalHeight = 0) const
     {
-        return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine)
-            : logicalWidth() - logicalRightOffsetForLine(position, firstLine);
+        return style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, logicalHeight)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, logicalHeight);
     }
-    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine) const
+    LayoutUnit endOffsetForLine(LayoutUnit position, bool firstLine, LayoutUnit logicalHeight = 0) const
     {
-        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine)
-            : logicalWidth() - logicalRightOffsetForLine(position, firstLine);
+        return !style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(position, firstLine, logicalHeight)
+            : logicalWidth() - logicalRightOffsetForLine(position, firstLine, logicalHeight);
     }
 
     LayoutUnit startAlignedOffsetForLine(RenderBox* child, LayoutUnit position, bool firstLine);
@@ -331,7 +331,7 @@ public:
         LayoutUnit m_positiveMarginAfter;
         LayoutUnit m_negativeMarginAfter;
     };
-    MarginValues marginValuesForChild(RenderBox* child);
+    MarginValues marginValuesForChild(RenderBox* child) const;
 
     virtual void scrollbarsChanged(bool /*horizontalScrollbarChanged*/, bool /*verticalScrollbarChanged*/) { };
 
@@ -384,6 +384,7 @@ public:
     bool runInIsPlacedIntoSiblingBlock(RenderObject* runIn);
 
 #ifndef NDEBUG
+    void checkPositionedObjectsNeedLayout();
     void showLineTreeAndMark(const InlineBox* = 0, const char* = 0, const InlineBox* = 0, const char* = 0, const RenderObject* = 0) const;
 #endif
 
@@ -414,8 +415,8 @@ protected:
     virtual void paint(PaintInfo&, const LayoutPoint&);
     virtual void paintObject(PaintInfo&, const LayoutPoint&);
    
-    LayoutUnit logicalRightOffsetForLine(LayoutUnit position, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* logicalHeightRemaining = 0) const;
-    LayoutUnit logicalLeftOffsetForLine(LayoutUnit position, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* logicalHeightRemaining = 0) const;
+    LayoutUnit logicalRightOffsetForLine(LayoutUnit position, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* logicalHeightRemaining = 0, LayoutUnit logicalHeight = 0) const;
+    LayoutUnit logicalLeftOffsetForLine(LayoutUnit position, LayoutUnit fixedOffset, bool applyTextIndent, LayoutUnit* logicalHeightRemaining = 0, LayoutUnit logicalHeight = 0) const;
 
     virtual ETextAlign textAlignmentForLine(bool endsWithSoftBreak) const;
     virtual void adjustInlineDirectionLineBounds(int /* expansionOpportunityCount */, float& /* logicalLeft */, float& /* logicalWidth */) const { }
@@ -920,6 +921,7 @@ private:
     LayoutUnit collapseMargins(RenderBox* child, MarginInfo&);
     LayoutUnit clearFloatsIfNeeded(RenderBox* child, MarginInfo&, LayoutUnit oldTopPosMargin, LayoutUnit oldTopNegMargin, LayoutUnit yPos);
     LayoutUnit estimateLogicalTopPosition(RenderBox* child, const MarginInfo&, LayoutUnit& estimateWithoutPagination);
+    void marginBeforeEstimateForChild(RenderBox* child, LayoutUnit& positiveMarginBefore, LayoutUnit& negativeMarginBefore) const;
     void determineLogicalLeftPositionForChild(RenderBox* child);
     void handleAfterSideOfBlock(LayoutUnit top, LayoutUnit bottom, MarginInfo&);
     void setCollapsedBottomMargin(const MarginInfo&);
@@ -999,21 +1001,23 @@ protected:
     public:
         typedef FloatingObjectInterval IntervalType;
         
-        FloatIntervalSearchAdapter(const RenderBlock* renderer, int value, LayoutUnit& offset, LayoutUnit* heightRemaining)
+        FloatIntervalSearchAdapter(const RenderBlock* renderer, int lowValue, int highValue, LayoutUnit& offset, LayoutUnit* heightRemaining)
             : m_renderer(renderer)
-            , m_value(value)
+            , m_lowValue(lowValue)
+            , m_highValue(highValue)
             , m_offset(offset)
             , m_heightRemaining(heightRemaining)
         {
         }
         
-        inline int lowValue() const { return m_value; }
-        inline int highValue() const { return m_value; }
+        inline int lowValue() const { return m_lowValue; }
+        inline int highValue() const { return m_highValue; }
         void collectIfNeeded(const IntervalType&) const;
 
     private:
         const RenderBlock* m_renderer;
-        int m_value;
+        int m_lowValue;
+        int m_highValue;
         LayoutUnit& m_offset;
         LayoutUnit* m_heightRemaining;
     };
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index b1ce61101..088c14cbb 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -112,11 +112,26 @@ private:
     bool m_isFirstLine;
 };
 
+static LayoutUnit logicalHeightForLine(RenderBlock* block)
+{
+    InlineFlowBox* lineBox = block->firstRootBox();
+    LayoutUnit logicalHeight = 0;
+    if (!lineBox)
+        return logicalHeight;
+
+    if (lineBox->firstChild() && lineBox->firstChild()->renderer() && lineBox->firstChild()->renderer()->isRenderBlock())
+        logicalHeight = toRenderBlock(lineBox->firstChild()->renderer())->logicalHeight();
+    else
+        logicalHeight = lineBox->height();
+    return logicalHeight;
+}
+
 inline void LineWidth::updateAvailableWidth()
 {
     LayoutUnit height = m_block->logicalHeight();
-    m_left = m_block->logicalLeftOffsetForLine(height, m_isFirstLine);
-    m_right = m_block->logicalRightOffsetForLine(height, m_isFirstLine);
+    LayoutUnit logicalHeight = logicalHeightForLine(m_block);
+    m_left = m_block->logicalLeftOffsetForLine(height, m_isFirstLine, logicalHeight);
+    m_right = m_block->logicalRightOffsetForLine(height, m_isFirstLine, logicalHeight);
 
     computeAvailableWidthFromLeftAndRight();
 }
@@ -751,8 +766,10 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                                                          GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache& verticalPositionCache)
 {
     ETextAlign textAlign = textAlignmentForLine(!reachedEnd && !lineBox->endsWithBreak());
-    float logicalLeft = pixelSnappedLogicalLeftOffsetForLine(logicalHeight(), lineInfo.isFirstLine());
-    float availableLogicalWidth = pixelSnappedLogicalRightOffsetForLine(logicalHeight(), lineInfo.isFirstLine()) - logicalLeft;
+    
+    LayoutUnit lineLogicalHeight = logicalHeightForLine(this);
+    float logicalLeft = pixelSnappedLogicalLeftOffsetForLine(logicalHeight(), lineInfo.isFirstLine(), lineLogicalHeight);
+    float availableLogicalWidth = pixelSnappedLogicalRightOffsetForLine(logicalHeight(), lineInfo.isFirstLine(), lineLogicalHeight) - logicalLeft;
 
     bool needsWordSpacing = false;
     float totalLogicalWidth = lineBox->getFlowSpacingLogicalWidth();
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index 524082e26..b64be4e8d 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -702,11 +702,13 @@ void RenderBox::clearOverrideSize()
 
 LayoutUnit RenderBox::overrideLogicalContentWidth() const
 {
+    // FIXME: This should probably be returning contentLogicalWidth instead of contentWidth.
     return hasOverrideWidth() ? gOverrideWidthMap->get(this) : contentWidth();
 }
 
 LayoutUnit RenderBox::overrideLogicalContentHeight() const
 {
+    // FIXME: This should probably be returning contentLogicalHeight instead of contentHeight.
     return hasOverrideHeight() ? gOverrideHeightMap->get(this) : contentHeight();
 }
 
@@ -1176,6 +1178,7 @@ LayoutUnit RenderBox::shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStar
     }
 
     LayoutUnit result = cb->availableLogicalWidthForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock) - childMarginStart - childMarginEnd;
+    result = max(result, minPreferredLogicalWidth()); // Don't shrink below our minimum preferred logical width.
 
     // We need to see if margins on either the start side or the end side can contain the floats in question. If they can,
     // then just using the line width is inaccurate. In the case where a float completely fits, we don't need to use the line
@@ -1236,7 +1239,7 @@ LayoutUnit RenderBox::containingBlockAvailableLineWidthInRegion(RenderRegion* re
         logicalTopPosition = max(logicalTopPosition, logicalTopPosition + offsetFromLogicalTopOfRegion);
         containingBlockRegion = cb->clampToStartAndEndRegions(region);
     }
-    return cb->availableLogicalWidthForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock);
+    return cb->availableLogicalWidthForLine(logicalTopPosition, false, containingBlockRegion, adjustedPageOffsetForContainingBlock, availableLogicalHeight());
 }
 
 LayoutUnit RenderBox::perpendicularContainingBlockLogicalHeight() const
@@ -1688,17 +1691,17 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         setLogicalWidth(logicalWidthLength.value() + borderAndPaddingLogicalWidth());
     else {
         // Calculate LogicalWidth
-        setLogicalWidth(computeLogicalWidthInRegionUsing(LogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage));
+        setLogicalWidth(computeLogicalWidthInRegionUsing(MainOrPreferredSize, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage));
 
         // Calculate MaxLogicalWidth
         if (!styleToUse->logicalMaxWidth().isUndefined()) {
-            LayoutUnit maxLogicalWidth = computeLogicalWidthInRegionUsing(MaxLogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
+            LayoutUnit maxLogicalWidth = computeLogicalWidthInRegionUsing(MaxSize, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
             if (logicalWidth() > maxLogicalWidth)
                 setLogicalWidth(maxLogicalWidth);
         }
 
         // Calculate MinLogicalWidth
-        LayoutUnit minLogicalWidth = computeLogicalWidthInRegionUsing(MinLogicalWidth, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
+        LayoutUnit minLogicalWidth = computeLogicalWidthInRegionUsing(MinSize, containerWidthInInlineDirection, cb, region, offsetFromLogicalTopOfFirstPage);
         if (logicalWidth() < minLogicalWidth)
             setLogicalWidth(minLogicalWidth);
     }
@@ -1724,46 +1727,50 @@ void RenderBox::computeLogicalWidthInRegion(RenderRegion* region, LayoutUnit off
         cb->setMarginEndForChild(this, containerLogicalWidth - logicalWidth() - cb->marginStartForChild(this));
 }
 
-LayoutUnit RenderBox::computeLogicalWidthInRegionUsing(LogicalWidthType widthType, LayoutUnit availableLogicalWidth,
+LayoutUnit RenderBox::computeLogicalWidthInRegionUsing(SizeType widthType, LayoutUnit availableLogicalWidth,
     const RenderBlock* cb, RenderRegion* region, LayoutUnit offsetFromLogicalTopOfFirstPage)
 {
-    LayoutUnit logicalWidthResult = logicalWidth();
     RenderStyle* styleToUse = style();
     Length logicalWidth;
-    if (widthType == LogicalWidth)
+    if (widthType == MainOrPreferredSize)
         logicalWidth = styleToUse->logicalWidth();
-    else if (widthType == MinLogicalWidth)
+    else if (widthType == MinSize)
         logicalWidth = styleToUse->logicalMinWidth();
     else
         logicalWidth = styleToUse->logicalMaxWidth();
 
     ASSERT(!logicalWidth.isUndefined());
 
-    if (logicalWidth.isIntrinsicOrAuto()) {
-        RenderView* renderView = view();
-        LayoutUnit marginStart = minimumValueForLength(styleToUse->marginStart(), availableLogicalWidth, renderView);
-        LayoutUnit marginEnd = minimumValueForLength(styleToUse->marginEnd(), availableLogicalWidth, renderView);
-        logicalWidthResult = availableLogicalWidth - marginStart - marginEnd;
+    // FIXME: minWidth:auto on a flex-item needs to go down the intrinsicOrAuto path below.
+    if (widthType == MinSize && logicalWidth.isAuto())
+        return computeBorderBoxLogicalWidth(0);
+    
+    if (!logicalWidth.isIntrinsicOrAuto()) {
+        // FIXME: If the containing block flow is perpendicular to our direction we need to use the available logical height instead.
+        return computeBorderBoxLogicalWidth(valueForLength(logicalWidth, availableLogicalWidth, view()));
+    }
 
-        // shrinkToAvoidFloats() is only true for width: auto so the below code works correctly for
-        // width: fill-available since no case matches and it returns the logicalWidthResult from above.
-        if (shrinkToAvoidFloats() && cb->containsFloats())
-            logicalWidthResult = shrinkLogicalWidthToAvoidFloats(marginStart, marginEnd, cb, region, offsetFromLogicalTopOfFirstPage);
+    if (logicalWidth.type() == MinContent)
+        return minPreferredLogicalWidth();
+    if (logicalWidth.type() == MaxContent)
+        return maxPreferredLogicalWidth();
 
-        if (logicalWidth.type() == MinContent)
-            logicalWidthResult = minPreferredLogicalWidth();
-        else if (logicalWidth.type() == MaxContent)
-            logicalWidthResult = maxPreferredLogicalWidth();
-        else if (logicalWidth.type() == FitContent || (logicalWidth.type() != FillAvailable && sizesLogicalWidthToFitContent(widthType)))
-            logicalWidthResult = max(minPreferredLogicalWidth(), min(maxPreferredLogicalWidth(), logicalWidthResult));
+    RenderView* renderView = view();
+    LayoutUnit marginStart = minimumValueForLength(styleToUse->marginStart(), availableLogicalWidth, renderView);
+    LayoutUnit marginEnd = minimumValueForLength(styleToUse->marginEnd(), availableLogicalWidth, renderView);
+    LayoutUnit logicalWidthResult = availableLogicalWidth - marginStart - marginEnd;
 
-    } else // FIXME: If the containing block flow is perpendicular to our direction we need to use the available logical height instead.
-        logicalWidthResult = computeBorderBoxLogicalWidth(valueForLength(logicalWidth, availableLogicalWidth, view())); 
+    // shrinkToAvoidFloats() is only true for width: auto so the below code works correctly for
+    // width: fill-available since no case matches and it returns the logicalWidthResult from above.
+    if (shrinkToAvoidFloats() && cb->containsFloats())
+        logicalWidthResult = min(logicalWidthResult, shrinkLogicalWidthToAvoidFloats(marginStart, marginEnd, cb, region, offsetFromLogicalTopOfFirstPage));
 
+    if (logicalWidth.type() == FitContent || (logicalWidth.type() != FillAvailable && sizesLogicalWidthToFitContent(widthType)))
+        return max(minPreferredLogicalWidth(), min(maxPreferredLogicalWidth(), logicalWidthResult));
     return logicalWidthResult;
 }
 
-bool RenderBox::sizesLogicalWidthToFitContent(LogicalWidthType widthType) const
+bool RenderBox::sizesLogicalWidthToFitContent(SizeType widthType) const
 {
     // Marquees in WinIE are like a mixture of blocks and inline-blocks.  They size as though they're blocks,
     // but they allow text to sit on the same line as the marquee.
@@ -1772,7 +1779,7 @@ bool RenderBox::sizesLogicalWidthToFitContent(LogicalWidthType widthType) const
 
     // This code may look a bit strange.  Basically width:intrinsic should clamp the size when testing both
     // min-width and width.  max-width is only clamped if it is also intrinsic.
-    Length logicalWidth = (widthType == MaxLogicalWidth) ? style()->logicalMaxWidth() : style()->logicalWidth();
+    Length logicalWidth = (widthType == MaxSize) ? style()->logicalMaxWidth() : style()->logicalWidth();
     if (logicalWidth.type() == Intrinsic)
         return true;
 
@@ -2009,11 +2016,11 @@ void RenderBox::computeLogicalHeight()
 
         LayoutUnit heightResult;
         if (checkMinMaxHeight) {
-            heightResult = computeLogicalHeightUsing(styleToUse->logicalHeight());
+            heightResult = computeLogicalHeightUsing(MainOrPreferredSize, styleToUse->logicalHeight());
             if (heightResult == -1)
                 heightResult = logicalHeight();
-            LayoutUnit minH = computeLogicalHeightUsing(styleToUse->logicalMinHeight()); // Leave as -1 if unset.
-            LayoutUnit maxH = styleToUse->logicalMaxHeight().isUndefined() ? heightResult : computeLogicalHeightUsing(styleToUse->logicalMaxHeight());
+            LayoutUnit minH = computeLogicalHeightUsing(MinSize, styleToUse->logicalMinHeight()); // Leave as -1 if unset.
+            LayoutUnit maxH = styleToUse->logicalMaxHeight().isUndefined() ? heightResult : computeLogicalHeightUsing(MaxSize, styleToUse->logicalMaxHeight());
             if (maxH == -1)
                 maxH = heightResult;
             heightResult = min(maxH, heightResult);
@@ -2060,26 +2067,27 @@ void RenderBox::computeLogicalHeight()
     }
 }
 
-LayoutUnit RenderBox::computeLogicalHeightUsing(const Length& height)
+LayoutUnit RenderBox::computeLogicalHeightUsing(SizeType heightType, const Length& height)
 {
-    LayoutUnit logicalHeight = computeContentLogicalHeightUsing(height);
+    LayoutUnit logicalHeight = computeContentLogicalHeightUsing(heightType, height);
     if (logicalHeight != -1)
         logicalHeight = computeBorderBoxLogicalHeight(logicalHeight);
     return logicalHeight;
 }
 
-LayoutUnit RenderBox::computeContentLogicalHeightUsing(const Length& height)
+LayoutUnit RenderBox::computeContentLogicalHeightUsing(SizeType heightType, const Length& height)
 {
-    LayoutUnit logicalHeight = -1;
-    if (!height.isAuto()) {
-        if (height.isFixed())
-            logicalHeight = height.value();
-        else if (height.isPercent())
-            logicalHeight = computePercentageLogicalHeight(height);
-        else if (height.isViewportPercentage())
-            logicalHeight = valueForLength(height, 0, view());
-    }
-    return logicalHeight;
+    // FIXME: For flexboxes, minHeight:auto should be min-content.
+    if (height.isAuto())
+        return heightType == MinSize ? 0 : -1;
+ 
+    if (height.isFixed())
+        return height.value();
+    if (height.isPercent())
+        return computePercentageLogicalHeight(height);
+    if (height.isViewportPercentage())
+        return valueForLength(height, 0, view());
+    return -1;
 }
 
 LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
@@ -2169,18 +2177,22 @@ LayoutUnit RenderBox::computePercentageLogicalHeight(const Length& height)
 
 LayoutUnit RenderBox::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
-    return computeReplacedLogicalWidthRespectingMinMaxWidth(computeReplacedLogicalWidthUsing(style()->logicalWidth()), includeMaxWidth);
+    return computeReplacedLogicalWidthRespectingMinMaxWidth(computeReplacedLogicalWidthUsing(MainOrPreferredSize, style()->logicalWidth()), includeMaxWidth);
 }
 
 LayoutUnit RenderBox::computeReplacedLogicalWidthRespectingMinMaxWidth(LayoutUnit logicalWidth, bool includeMaxWidth) const
 {
-    LayoutUnit minLogicalWidth = computeReplacedLogicalWidthUsing(style()->logicalMinWidth());
-    LayoutUnit maxLogicalWidth = !includeMaxWidth || style()->logicalMaxWidth().isUndefined() ? logicalWidth : computeReplacedLogicalWidthUsing(style()->logicalMaxWidth());
+    LayoutUnit minLogicalWidth = computeReplacedLogicalWidthUsing(MinSize, style()->logicalMinWidth());
+    LayoutUnit maxLogicalWidth = !includeMaxWidth || style()->logicalMaxWidth().isUndefined() ? logicalWidth : computeReplacedLogicalWidthUsing(MaxSize, style()->logicalMaxWidth());
     return max(minLogicalWidth, min(logicalWidth, maxLogicalWidth));
 }
 
-LayoutUnit RenderBox::computeReplacedLogicalWidthUsing(Length logicalWidth) const
+LayoutUnit RenderBox::computeReplacedLogicalWidthUsing(SizeType sizeType, Length logicalWidth) const
 {
+    // FIXME: For flexboxes, minWidth:auto should be min-content.
+    if (sizeType == MinSize && logicalWidth.isAuto())
+        return computeContentBoxLogicalWidth(0);
+
     switch (logicalWidth.type()) {
         case Fixed:
             return computeContentBoxLogicalWidth(logicalWidth.value());
@@ -2205,18 +2217,22 @@ LayoutUnit RenderBox::computeReplacedLogicalWidthUsing(Length logicalWidth) cons
 
 LayoutUnit RenderBox::computeReplacedLogicalHeight() const
 {
-    return computeReplacedLogicalHeightRespectingMinMaxHeight(computeReplacedLogicalHeightUsing(style()->logicalHeight()));
+    return computeReplacedLogicalHeightRespectingMinMaxHeight(computeReplacedLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight()));
 }
 
 LayoutUnit RenderBox::computeReplacedLogicalHeightRespectingMinMaxHeight(LayoutUnit logicalHeight) const
 {
-    LayoutUnit minLogicalHeight = computeReplacedLogicalHeightUsing(style()->logicalMinHeight());
-    LayoutUnit maxLogicalHeight = style()->logicalMaxHeight().isUndefined() ? logicalHeight : computeReplacedLogicalHeightUsing(style()->logicalMaxHeight());
+    LayoutUnit minLogicalHeight = computeReplacedLogicalHeightUsing(MinSize, style()->logicalMinHeight());
+    LayoutUnit maxLogicalHeight = style()->logicalMaxHeight().isUndefined() ? logicalHeight : computeReplacedLogicalHeightUsing(MaxSize, style()->logicalMaxHeight());
     return max(minLogicalHeight, min(logicalHeight, maxLogicalHeight));
 }
 
-LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(Length logicalHeight) const
+LayoutUnit RenderBox::computeReplacedLogicalHeightUsing(SizeType sizeType, Length logicalHeight) const
 {
+    // FIXME: For flexboxes, minWidth:auto should be min-content.
+    if (sizeType == MinSize && logicalHeight.isAuto())
+        return computeContentBoxLogicalHeight(0);
+
     switch (logicalHeight.type()) {
         case Fixed:
             return computeContentBoxLogicalHeight(logicalHeight.value());
@@ -2561,7 +2577,7 @@ void RenderBox::computePositionedLogicalWidth(RenderRegion* region, LayoutUnit o
     // Calculate constraint equation values for 'width' case.
     LayoutUnit logicalWidthResult;
     LayoutUnit logicalLeftResult;
-    computePositionedLogicalWidthUsing(style()->logicalWidth(), containerBlock, containerDirection,
+    computePositionedLogicalWidthUsing(MainOrPreferredSize, style()->logicalWidth(), containerBlock, containerDirection,
                                        containerLogicalWidth, bordersPlusPadding,
                                        logicalLeftLength, logicalRightLength, marginLogicalLeft, marginLogicalRight,
                                        logicalWidthResult, marginLogicalLeftAlias, marginLogicalRightAlias, logicalLeftResult);
@@ -2575,7 +2591,7 @@ void RenderBox::computePositionedLogicalWidth(RenderRegion* region, LayoutUnit o
         LayoutUnit maxMarginLogicalRight;
         LayoutUnit maxLogicalLeftPos;
 
-        computePositionedLogicalWidthUsing(style()->logicalMaxWidth(), containerBlock, containerDirection,
+        computePositionedLogicalWidthUsing(MaxSize, style()->logicalMaxWidth(), containerBlock, containerDirection,
                                            containerLogicalWidth, bordersPlusPadding,
                                            logicalLeftLength, logicalRightLength, marginLogicalLeft, marginLogicalRight,
                                            maxLogicalWidth, maxMarginLogicalLeft, maxMarginLogicalRight, maxLogicalLeftPos);
@@ -2595,7 +2611,7 @@ void RenderBox::computePositionedLogicalWidth(RenderRegion* region, LayoutUnit o
         LayoutUnit minMarginLogicalRight;
         LayoutUnit minLogicalLeftPos;
 
-        computePositionedLogicalWidthUsing(style()->logicalMinWidth(), containerBlock, containerDirection,
+        computePositionedLogicalWidthUsing(MinSize, style()->logicalMinWidth(), containerBlock, containerDirection,
                                            containerLogicalWidth, bordersPlusPadding,
                                            logicalLeftLength, logicalRightLength, marginLogicalLeft, marginLogicalRight,
                                            minLogicalWidth, minMarginLogicalLeft, minMarginLogicalRight, minLogicalLeftPos);
@@ -2609,7 +2625,7 @@ void RenderBox::computePositionedLogicalWidth(RenderRegion* region, LayoutUnit o
     }
 
     if (stretchesToMinIntrinsicLogicalWidth() && logicalWidth() < minPreferredLogicalWidth() - bordersPlusPadding) {
-        computePositionedLogicalWidthUsing(Length(minPreferredLogicalWidth() - bordersPlusPadding, Fixed), containerBlock, containerDirection,
+        computePositionedLogicalWidthUsing(MainOrPreferredSize, Length(minPreferredLogicalWidth() - bordersPlusPadding, Fixed), containerBlock, containerDirection,
                                            containerLogicalWidth, bordersPlusPadding,
                                            logicalLeftLength, logicalRightLength, marginLogicalLeft, marginLogicalRight,
                                            logicalWidthResult, marginLogicalLeftAlias, marginLogicalRightAlias, logicalLeftResult);
@@ -2646,11 +2662,15 @@ static void computeLogicalLeftPositionedOffset(LayoutUnit& logicalLeftPos, const
         logicalLeftPos += (child->isHorizontalWritingMode() ? containerBlock->borderLeft() : containerBlock->borderTop());
 }
 
-void RenderBox::computePositionedLogicalWidthUsing(Length logicalWidth, const RenderBoxModelObject* containerBlock, TextDirection containerDirection,
+void RenderBox::computePositionedLogicalWidthUsing(SizeType widthSizeType, Length logicalWidth, const RenderBoxModelObject* containerBlock, TextDirection containerDirection,
                                                    LayoutUnit containerLogicalWidth, LayoutUnit bordersPlusPadding,
                                                    Length logicalLeft, Length logicalRight, Length marginLogicalLeft, Length marginLogicalRight,
                                                    LayoutUnit& logicalWidthValue, LayoutUnit& marginLogicalLeftValue, LayoutUnit& marginLogicalRightValue, LayoutUnit& logicalLeftPos)
 {
+    // FIXME: What should flex items do here since min-width:auto == min-width:min-content instead of min-width:auto == min-width:0.
+    if (widthSizeType == MinSize && logicalWidth.isAuto())
+        logicalWidth = Length(0, Fixed);
+
     // 'left' and 'right' cannot both be 'auto' because one would of been
     // converted to the static position already
     ASSERT(!(logicalLeft.isAuto() && logicalRight.isAuto()));
@@ -2890,7 +2910,7 @@ void RenderBox::computePositionedLogicalHeight()
     LayoutUnit logicalTopPos;
 
     // Calculate constraint equation values for 'height' case.
-    computePositionedLogicalHeightUsing(styleToUse->logicalHeight(), containerBlock, containerLogicalHeight, bordersPlusPadding,
+    computePositionedLogicalHeightUsing(MainOrPreferredSize, styleToUse->logicalHeight(), containerBlock, containerLogicalHeight, bordersPlusPadding,
                                         logicalTopLength, logicalBottomLength, marginBefore, marginAfter,
                                         logicalHeightResult, marginBeforeAlias, marginAfterAlias, logicalTopPos);
     setLogicalTop(logicalTopPos);
@@ -2905,7 +2925,7 @@ void RenderBox::computePositionedLogicalHeight()
         LayoutUnit maxMarginAfter;
         LayoutUnit maxLogicalTopPos;
 
-        computePositionedLogicalHeightUsing(styleToUse->logicalMaxHeight(), containerBlock, containerLogicalHeight, bordersPlusPadding,
+        computePositionedLogicalHeightUsing(MaxSize, styleToUse->logicalMaxHeight(), containerBlock, containerLogicalHeight, bordersPlusPadding,
                                             logicalTopLength, logicalBottomLength, marginBefore, marginAfter,
                                             maxLogicalHeight, maxMarginBefore, maxMarginAfter, maxLogicalTopPos);
 
@@ -2924,7 +2944,7 @@ void RenderBox::computePositionedLogicalHeight()
         LayoutUnit minMarginAfter;
         LayoutUnit minLogicalTopPos;
 
-        computePositionedLogicalHeightUsing(styleToUse->logicalMinHeight(), containerBlock, containerLogicalHeight, bordersPlusPadding,
+        computePositionedLogicalHeightUsing(MinSize, styleToUse->logicalMinHeight(), containerBlock, containerLogicalHeight, bordersPlusPadding,
                                             logicalTopLength, logicalBottomLength, marginBefore, marginAfter,
                                             minLogicalHeight, minMarginBefore, minMarginAfter, minLogicalTopPos);
 
@@ -2976,11 +2996,15 @@ static void computeLogicalTopPositionedOffset(LayoutUnit& logicalTopPos, const R
     }
 }
 
-void RenderBox::computePositionedLogicalHeightUsing(Length logicalHeightLength, const RenderBoxModelObject* containerBlock,
+void RenderBox::computePositionedLogicalHeightUsing(SizeType heightSizeType, Length logicalHeightLength, const RenderBoxModelObject* containerBlock,
                                                     LayoutUnit containerLogicalHeight, LayoutUnit bordersPlusPadding,
                                                     Length logicalTop, Length logicalBottom, Length marginBefore, Length marginAfter,
                                                     LayoutUnit& logicalHeightValue, LayoutUnit& marginBeforeValue, LayoutUnit& marginAfterValue, LayoutUnit& logicalTopPos)
 {
+    // FIXME: What should flex items do here since min-height:auto == min-height:min-content instead of min-height:auto == min-height:0.
+    if (heightSizeType == MinSize && logicalHeightLength.isAuto())
+        logicalHeightLength = Length(0, Fixed);
+
     // 'top' and 'bottom' cannot both be 'auto' because 'top would of been
     // converted to the static position in computePositionedLogicalHeight()
     ASSERT(!(logicalTop.isAuto() && logicalBottom.isAuto()));
@@ -2989,6 +3013,7 @@ void RenderBox::computePositionedLogicalHeightUsing(Length logicalHeightLength,
 
     LayoutUnit logicalTopValue = 0;
 
+    // FIXME: For non-flexboxes + min-height, this needs to treat non-flexboxes as 0.
     bool logicalHeightIsAuto = logicalHeightLength.isAuto();
     bool logicalTopIsAuto = logicalTop.isAuto();
     bool logicalBottomIsAuto = logicalBottom.isAuto();
@@ -3263,7 +3288,7 @@ void RenderBox::computePositionedLogicalWidthReplaced()
 
     LayoutUnit logicalLeftPos = logicalLeftValue + marginLogicalLeftAlias;
     computeLogicalLeftPositionedOffset(logicalLeftPos, this, logicalWidth(), containerBlock, containerLogicalWidth);
-    setLogicalLeft(logicalLeftPos);
+    setLogicalLeft(logicalLeftPos.round());
 }
 
 void RenderBox::computePositionedLogicalHeightReplaced()
@@ -3392,7 +3417,7 @@ void RenderBox::computePositionedLogicalHeightReplaced()
     // Use computed values to calculate the vertical position.
     LayoutUnit logicalTopPos = logicalTopValue + marginBeforeAlias;
     computeLogicalTopPositionedOffset(logicalTopPos, this, logicalHeight(), containerBlock, containerLogicalHeight);
-    setLogicalTop(logicalTopPos);
+    setLogicalTop(logicalTopPos.round());
 }
 
 LayoutRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, LayoutUnit* extraWidthToEndOfLine)
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index 9f0577e82..031458266 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -33,7 +33,7 @@ class RenderBoxRegionInfo;
 class RenderRegion;
 struct PaintInfo;
 
-enum LogicalWidthType { LogicalWidth, MinLogicalWidth, MaxLogicalWidth };
+enum SizeType { MainOrPreferredSize, MinSize, MaxSize };
 
 enum OverlayScrollbarSizeRelevancy { IgnoreOverlayScrollbarSize, IncludeOverlayScrollbarSize };
 
@@ -335,17 +335,17 @@ public:
 
     // Whether or not the element shrinks to its intrinsic width (rather than filling the width
     // of a containing block).  HTML4 buttons, <select>s, <input>s, legends, and floating/compact elements do this.
-    bool sizesLogicalWidthToFitContent(LogicalWidthType) const;
+    bool sizesLogicalWidthToFitContent(SizeType) const;
     virtual bool stretchesToMinIntrinsicLogicalWidth() const { return false; }
 
     LayoutUnit shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStart, LayoutUnit childMarginEnd, const RenderBlock* cb, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
 
-    LayoutUnit computeLogicalWidthInRegionUsing(LogicalWidthType, LayoutUnit availableLogicalWidth, const RenderBlock* containingBlock, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
-    LayoutUnit computeLogicalHeightUsing(const Length& height);
-    LayoutUnit computeContentLogicalHeightUsing(const Length& height);
-    LayoutUnit computeReplacedLogicalWidthUsing(Length width) const;
+    LayoutUnit computeLogicalWidthInRegionUsing(SizeType, LayoutUnit availableLogicalWidth, const RenderBlock* containingBlock, RenderRegion*, LayoutUnit offsetFromLogicalTopOfFirstPage);
+    LayoutUnit computeLogicalHeightUsing(SizeType, const Length& height);
+    LayoutUnit computeContentLogicalHeightUsing(SizeType, const Length& height);
+    LayoutUnit computeReplacedLogicalWidthUsing(SizeType, Length width) const;
     LayoutUnit computeReplacedLogicalWidthRespectingMinMaxWidth(LayoutUnit logicalWidth, bool includeMaxWidth = true) const;
-    LayoutUnit computeReplacedLogicalHeightUsing(Length height) const;
+    LayoutUnit computeReplacedLogicalHeightUsing(SizeType, Length height) const;
     LayoutUnit computeReplacedLogicalHeightRespectingMinMaxHeight(LayoutUnit logicalHeight) const;
 
     virtual LayoutUnit computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
@@ -540,11 +540,11 @@ private:
     LayoutUnit containingBlockLogicalHeightForPositioned(const RenderBoxModelObject* containingBlock, bool checkForPerpendicularWritingMode = true) const;
 
     void computePositionedLogicalHeight();
-    void computePositionedLogicalWidthUsing(Length logicalWidth, const RenderBoxModelObject* containerBlock, TextDirection containerDirection,
+    void computePositionedLogicalWidthUsing(SizeType, Length logicalWidth, const RenderBoxModelObject* containerBlock, TextDirection containerDirection,
                                             LayoutUnit containerLogicalWidth, LayoutUnit bordersPlusPadding,
                                             Length logicalLeft, Length logicalRight, Length marginLogicalLeft, Length marginLogicalRight,
                                             LayoutUnit& logicalWidthValue, LayoutUnit& marginLogicalLeftValue, LayoutUnit& marginLogicalRightValue, LayoutUnit& logicalLeftPos);
-    void computePositionedLogicalHeightUsing(Length logicalHeight, const RenderBoxModelObject* containerBlock,
+    void computePositionedLogicalHeightUsing(SizeType, Length logicalHeight, const RenderBoxModelObject* containerBlock,
                                              LayoutUnit containerLogicalHeight, LayoutUnit bordersPlusPadding,
                                              Length logicalTop, Length logicalBottom, Length marginLogicalTop, Length marginLogicalBottom,
                                              LayoutUnit& logicalHeightValue, LayoutUnit& marginLogicalTopValue, LayoutUnit& marginLogicalBottomValue, LayoutUnit& logicalTopPos);
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index b14f53d21..067f6046d 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -44,6 +44,7 @@ enum ContentChangeType {
     ImageChanged,
     MaskImageChanged,
     CanvasChanged,
+    CanvasPixelsChanged,
     VideoChanged,
     FullScreenChanged
 };
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index aeeed10d3..4ae42bc7d 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -1063,11 +1063,14 @@ LayoutUnit RenderDeprecatedFlexibleBox::allowedChildFlex(RenderBox* child, bool
             minWidth = child->maxPreferredLogicalWidth();
         else if (child->style()->minWidth().type() == MinIntrinsic)
             minWidth = child->minPreferredLogicalWidth();
+        else if (child->style()->minWidth().type() == Auto)
+            minWidth = 0;
 
         LayoutUnit allowedShrinkage = min<LayoutUnit>(0, minWidth - width);
         return allowedShrinkage;
     } else {
-        if (child->style()->minHeight().isFixed()) {
+        Length minHeight = child->style()->minHeight();
+        if (minHeight.isFixed() || minHeight.isAuto()) {
             LayoutUnit minHeight = child->style()->minHeight().value();
             LayoutUnit height = child->overrideLogicalContentHeight();
             LayoutUnit allowedShrinkage = min<LayoutUnit>(0, minHeight - height);
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 47289cf22..1bc3aefaf 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -155,6 +155,7 @@ void RenderFlexibleBox::computePreferredLogicalWidths()
     ASSERT(preferredLogicalWidthsDirty());
 
     RenderStyle* styleToUse = style();
+    // FIXME: This should probably be checking for isSpecified since you should be able to use percentage, calc or viewport relative values for width.
     if (styleToUse->logicalWidth().isFixed() && styleToUse->logicalWidth().value() > 0)
         m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = computeContentBoxLogicalWidth(styleToUse->logicalWidth().value());
     else {
@@ -204,11 +205,13 @@ void RenderFlexibleBox::computePreferredLogicalWidths()
     m_maxPreferredLogicalWidth += scrollbarWidth;
     m_minPreferredLogicalWidth += scrollbarWidth;
 
+    // FIXME: This should probably be checking for isSpecified since you should be able to use percentage, calc or viewport relative values for min-width.
     if (styleToUse->logicalMinWidth().isFixed() && styleToUse->logicalMinWidth().value() > 0) {
         m_maxPreferredLogicalWidth = std::max(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMinWidth().value()));
         m_minPreferredLogicalWidth = std::max(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMinWidth().value()));
     }
 
+    // FIXME: This should probably be checking for isSpecified since you should be able to use percentage, calc or viewport relative values for maxWidth.
     if (styleToUse->logicalMaxWidth().isFixed()) {
         m_maxPreferredLogicalWidth = std::min(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMaxWidth().value()));
         m_minPreferredLogicalWidth = std::min(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(styleToUse->logicalMaxWidth().value()));
@@ -595,11 +598,11 @@ LayoutUnit RenderFlexibleBox::computeAvailableFreeSpace(LayoutUnit preferredMain
     else if (hasOverrideHeight())
         contentExtent = overrideLogicalContentHeight();
     else {
-        LayoutUnit heightResult = computeContentLogicalHeightUsing(style()->logicalHeight());
+        LayoutUnit heightResult = computeContentLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight());
         if (heightResult == -1)
             heightResult = preferredMainAxisExtent;
-        LayoutUnit minHeight = computeContentLogicalHeightUsing(style()->logicalMinHeight()); // Leave as -1 if unset.
-        LayoutUnit maxHeight = style()->logicalMaxHeight().isUndefined() ? heightResult : computeContentLogicalHeightUsing(style()->logicalMaxHeight());
+        LayoutUnit minHeight = computeContentLogicalHeightUsing(MinSize, style()->logicalMinHeight()); // Leave as -1 if unset.
+        LayoutUnit maxHeight = style()->logicalMaxHeight().isUndefined() ? heightResult : computeContentLogicalHeightUsing(MaxSize, style()->logicalMaxHeight());
         if (maxHeight == -1)
             maxHeight = heightResult;
         heightResult = std::min(maxHeight, heightResult);
@@ -771,10 +774,10 @@ LayoutUnit RenderFlexibleBox::lineBreakLength()
     if (!isColumnFlow())
         return mainAxisContentExtent();
 
-    LayoutUnit height = computeContentLogicalHeightUsing(style()->logicalHeight());
+    LayoutUnit height = computeContentLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight());
     if (height == -1)
         height = MAX_LAYOUT_UNIT;
-    LayoutUnit maxHeight = computeContentLogicalHeightUsing(style()->logicalMaxHeight());
+    LayoutUnit maxHeight = computeContentLogicalHeightUsing(MaxSize, style()->logicalMaxHeight());
     if (maxHeight != -1)
         height = std::min(height, maxHeight);
     return height;
@@ -789,6 +792,7 @@ LayoutUnit RenderFlexibleBox::adjustChildSizeForMinAndMax(RenderBox* child, Layo
     // https://bugs.webkit.org/show_bug.cgi?id=81809
     if (max.isSpecified() && childSize > valueForLength(max, flexboxAvailableContentExtent, renderView))
         childSize = valueForLength(max, flexboxAvailableContentExtent, renderView);
+    // FIXME: Treat auto min values as min-content.
     if (min.isSpecified() && childSize < valueForLength(min, flexboxAvailableContentExtent, renderView))
         childSize = valueForLength(min, flexboxAvailableContentExtent, renderView);
     return childSize;
@@ -1198,8 +1202,6 @@ void RenderFlexibleBox::applyStretchAlignmentToChild(RenderBox* child, LayoutUni
     if (!isColumnFlow() && child->style()->logicalHeight().isAuto()) {
         LayoutUnit logicalHeightBefore = child->logicalHeight();
         LayoutUnit stretchedLogicalHeight = child->logicalHeight() + availableAlignmentSpaceForChild(lineCrossAxisExtent, child);
-        if (stretchedLogicalHeight < logicalHeightBefore)
-            return;
 
         child->setLogicalHeight(stretchedLogicalHeight);
         child->computeLogicalHeight();
diff --git a/Source/WebCore/rendering/RenderGeometryMap.cpp b/Source/WebCore/rendering/RenderGeometryMap.cpp
index a1f50ed33..e6993dbef 100644
--- a/Source/WebCore/rendering/RenderGeometryMap.cpp
+++ b/Source/WebCore/rendering/RenderGeometryMap.cpp
@@ -33,29 +33,6 @@
 
 namespace WebCore {
 
-// Stores data about how to map from one renderer to its container.
-class RenderGeometryMapStep {
-    WTF_MAKE_NONCOPYABLE(RenderGeometryMapStep);
-public:
-    RenderGeometryMapStep(const RenderObject* renderer, bool accumulatingTransform, bool isNonUniform, bool isFixedPosition, bool hasTransform)
-        : m_renderer(renderer)
-        , m_accumulatingTransform(accumulatingTransform)
-        , m_isNonUniform(isNonUniform)
-        , m_isFixedPosition(isFixedPosition)
-        , m_hasTransform(hasTransform)
-    {
-    }
-        
-    const RenderObject* m_renderer;
-    LayoutSize m_offset;
-    OwnPtr<TransformationMatrix> m_transform; // Includes offset if non-null.
-    bool m_accumulatingTransform;
-    bool m_isNonUniform; // Mapping depends on the input point, e.g. because of CSS columns.
-    bool m_isFixedPosition;
-    bool m_hasTransform;
-};
-
-
 RenderGeometryMap::RenderGeometryMap()
     : m_insertionPosition(notFound)
     , m_nonUniformStepsCount(0)
@@ -81,7 +58,7 @@ FloatPoint RenderGeometryMap::absolutePoint(const FloatPoint& p) const
     }
 
 #if !ASSERT_DISABLED
-    FloatPoint rendererMappedResult = m_mapping.last()->m_renderer->localToAbsolute(p, false, true);
+    FloatPoint rendererMappedResult = m_mapping.last().m_renderer->localToAbsolute(p, false, true);
     ASSERT(rendererMappedResult == result);
 #endif
 
@@ -102,7 +79,7 @@ FloatRect RenderGeometryMap::absoluteRect(const FloatRect& rect) const
     }
 
 #if !ASSERT_DISABLED
-    FloatRect rendererMappedResult = m_mapping.last()->m_renderer->localToAbsoluteQuad(rect).boundingBox();
+    FloatRect rendererMappedResult = m_mapping.last().m_renderer->localToAbsoluteQuad(rect).boundingBox();
     // Inspector creates renderers with negative width <https://bugs.webkit.org/show_bug.cgi?id=87194>.
     // Taking FloatQuad bounds avoids spurious assertions because of that.
     ASSERT(enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()));
@@ -116,36 +93,36 @@ void RenderGeometryMap::mapToAbsolute(TransformState& transformState) const
     // If the mapping includes something like columns, we have to go via renderers.
     if (hasNonUniformStep()) {
         bool fixed = false;
-        m_mapping.last()->m_renderer->mapLocalToContainer(0, fixed, true, transformState, RenderObject::ApplyContainerFlip);
+        m_mapping.last().m_renderer->mapLocalToContainer(0, fixed, true, transformState, RenderObject::ApplyContainerFlip);
         return;
     }
     
     bool inFixed = false;
 
     for (int i = m_mapping.size() - 1; i >= 0; --i) {
-        const RenderGeometryMapStep* currStep = m_mapping[i].get();
+        const RenderGeometryMapStep& currentStep = m_mapping[i];
 
         // If this box has a transform, it acts as a fixed position container
         // for fixed descendants, which prevents the propagation of 'fixed'
         // unless the layer itself is also fixed position.
-        if (currStep->m_hasTransform && !currStep->m_isFixedPosition)
+        if (currentStep.m_hasTransform && !currentStep.m_isFixedPosition)
             inFixed = false;
-        else if (currStep->m_isFixedPosition)
+        else if (currentStep.m_isFixedPosition)
             inFixed = true;
 
         if (!i) {
-            if (currStep->m_transform)
-                transformState.applyTransform(*currStep->m_transform.get());
+            if (currentStep.m_transform)
+                transformState.applyTransform(*currentStep.m_transform.get());
 
             // The root gets special treatment for fixed position
             if (inFixed)
-                transformState.move(currStep->m_offset.width(), currStep->m_offset.height());
+                transformState.move(currentStep.m_offset.width(), currentStep.m_offset.height());
         } else {
-            TransformState::TransformAccumulation accumulate = currStep->m_accumulatingTransform ? TransformState::AccumulateTransform : TransformState::FlattenTransform;
-            if (currStep->m_transform)
-                transformState.applyTransform(*currStep->m_transform.get(), accumulate);
+            TransformState::TransformAccumulation accumulate = currentStep.m_accumulatingTransform ? TransformState::AccumulateTransform : TransformState::FlattenTransform;
+            if (currentStep.m_transform)
+                transformState.applyTransform(*currentStep.m_transform.get(), accumulate);
             else
-                transformState.move(currStep->m_offset.width(), currStep->m_offset.height(), accumulate);
+                transformState.move(currentStep.m_offset.width(), currentStep.m_offset.height(), accumulate);
         }
     }
 
@@ -184,48 +161,51 @@ void RenderGeometryMap::pushMappingsToAncestor(const RenderLayer* layer, const R
 void RenderGeometryMap::push(const RenderObject* renderer, const LayoutSize& offsetFromContainer, bool accumulatingTransform, bool isNonUniform, bool isFixedPosition, bool hasTransform)
 {
     ASSERT(m_insertionPosition != notFound);
-    
-    OwnPtr<RenderGeometryMapStep> step = adoptPtr(new RenderGeometryMapStep(renderer, accumulatingTransform, isNonUniform, isFixedPosition, hasTransform));
-    step->m_offset = offsetFromContainer;
-    
-    stepInserted(*step.get());
-    m_mapping.insert(m_insertionPosition, step.release());
+
+    m_mapping.insert(m_insertionPosition, RenderGeometryMapStep(renderer, accumulatingTransform, isNonUniform, isFixedPosition, hasTransform));
+
+    RenderGeometryMapStep& step = m_mapping[m_insertionPosition];
+    step.m_offset = offsetFromContainer;
+
+    stepInserted(step);
 }
 
 void RenderGeometryMap::push(const RenderObject* renderer, const TransformationMatrix& t, bool accumulatingTransform, bool isNonUniform, bool isFixedPosition, bool hasTransform)
 {
     ASSERT(m_insertionPosition != notFound);
 
-    OwnPtr<RenderGeometryMapStep> step = adoptPtr(new RenderGeometryMapStep(renderer, accumulatingTransform, isNonUniform, isFixedPosition, hasTransform));
+    m_mapping.insert(m_insertionPosition, RenderGeometryMapStep(renderer, accumulatingTransform, isNonUniform, isFixedPosition, hasTransform));
+    
+    RenderGeometryMapStep& step = m_mapping[m_insertionPosition];
     if (!t.isIntegerTranslation())
-        step->m_transform = adoptPtr(new TransformationMatrix(t));
+        step.m_transform = adoptPtr(new TransformationMatrix(t));
     else
-        step->m_offset = LayoutSize(t.e(), t.f());
-    
-    stepInserted(*step.get());
-    m_mapping.insert(m_insertionPosition, step.release());
+        step.m_offset = LayoutSize(t.e(), t.f());
+
+    stepInserted(step);
 }
 
 void RenderGeometryMap::pushView(const RenderView* view, const LayoutSize& scrollOffset, const TransformationMatrix* t)
 {
     ASSERT(m_insertionPosition != notFound);
+    ASSERT(!m_mapping.size()); // The view should always be the first thing pushed.
 
-    OwnPtr<RenderGeometryMapStep> step = adoptPtr(new RenderGeometryMapStep(view, false, false, false, t));
-    step->m_offset = scrollOffset;
+    m_mapping.insert(m_insertionPosition, RenderGeometryMapStep(view, false, false, false, t));
+    
+    RenderGeometryMapStep& step = m_mapping[m_insertionPosition];
+    step.m_offset = scrollOffset;
     if (t)
-        step->m_transform = adoptPtr(new TransformationMatrix(*t));
-        
-    ASSERT(!m_mapping.size()); // The view should always be the first thing pushed.
-    stepInserted(*step.get());
-    m_mapping.insert(m_insertionPosition, step.release());
+        step.m_transform = adoptPtr(new TransformationMatrix(*t));
+    
+    stepInserted(step);
 }
 
 void RenderGeometryMap::popMappingsToAncestor(const RenderBoxModelObject* ancestorRenderer)
 {
     ASSERT(m_mapping.size());
 
-    while (m_mapping.size() && m_mapping.last()->m_renderer != ancestorRenderer) {
-        stepRemoved(*m_mapping.last().get());
+    while (m_mapping.size() && m_mapping.last().m_renderer != ancestorRenderer) {
+        stepRemoved(m_mapping.last());
         m_mapping.removeLast();
     }
 }
@@ -239,7 +219,7 @@ void RenderGeometryMap::popMappingsToAncestor(const RenderLayer* ancestorLayer)
 void RenderGeometryMap::stepInserted(const RenderGeometryMapStep& step)
 {
     // Offset on the first step is the RenderView's offset, which is only applied when we have fixed-position.s
-    if (m_mapping.size())
+    if (m_mapping.size() > 1)
         m_accumulatedOffset += step.m_offset;
 
     if (step.m_isNonUniform)
diff --git a/Source/WebCore/rendering/RenderGeometryMap.h b/Source/WebCore/rendering/RenderGeometryMap.h
index 68002a837..8e63c5084 100644
--- a/Source/WebCore/rendering/RenderGeometryMap.h
+++ b/Source/WebCore/rendering/RenderGeometryMap.h
@@ -35,9 +35,36 @@
 
 namespace WebCore {
 
-class RenderGeometryMapStep;
 class RenderLayer;
 
+// Stores data about how to map from one renderer to its container.
+struct RenderGeometryMapStep {
+    RenderGeometryMapStep(const RenderGeometryMapStep& o)
+        : m_renderer(o.m_renderer)
+        , m_accumulatingTransform(o.m_accumulatingTransform)
+        , m_isNonUniform(o.m_isNonUniform)
+        , m_isFixedPosition(o.m_isFixedPosition)
+        , m_hasTransform(o.m_hasTransform)
+    {
+        ASSERT(!o.m_transform);
+    }
+    RenderGeometryMapStep(const RenderObject* renderer, bool accumulatingTransform, bool isNonUniform, bool isFixedPosition, bool hasTransform)
+        : m_renderer(renderer)
+        , m_accumulatingTransform(accumulatingTransform)
+        , m_isNonUniform(isNonUniform)
+        , m_isFixedPosition(isFixedPosition)
+        , m_hasTransform(hasTransform)
+    {
+    }
+    const RenderObject* m_renderer;
+    LayoutSize m_offset;
+    OwnPtr<TransformationMatrix> m_transform; // Includes offset if non-null.
+    bool m_accumulatingTransform;
+    bool m_isNonUniform; // Mapping depends on the input point, e.g. because of CSS columns.
+    bool m_isFixedPosition;
+    bool m_hasTransform;
+};
+
 // Can be used while walking the Renderer tree to cache data about offsets and transforms.
 class RenderGeometryMap {
 public:
@@ -72,8 +99,8 @@ private:
     bool hasNonUniformStep() const { return m_nonUniformStepsCount; }
     bool hasTransformStep() const { return m_transformedStepsCount; }
     bool hasFixedPositionStep() const { return m_fixedStepsCount; }
-    
-    typedef Vector<OwnPtr<RenderGeometryMapStep>, 32> RenderGeometryMapSteps;
+
+    typedef Vector<RenderGeometryMapStep, 32> RenderGeometryMapSteps;
 
     size_t m_insertionPosition;
     int m_nonUniformStepsCount;
@@ -85,4 +112,10 @@ private:
 
 } // namespace WebCore
 
+namespace WTF {
+// This is required for a struct with OwnPtr. We know RenderGeometryMapStep is simple enough that
+// initializing to 0 and moving with memcpy (and then not destructing the original) will work.
+template<> struct VectorTraits<WebCore::RenderGeometryMapStep> : SimpleClassVectorTraits { };
+}
+
 #endif // RenderGeometryMap_h
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index 6e1109c7b..776e2787b 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -219,8 +219,8 @@ void RenderImage::imageDimensionsChanged(bool imageSizeChanged, const IntRect* r
     bool shouldRepaint = true;
     if (intrinsicSizeChanged) {
         // lets see if we need to relayout at all..
-        int oldwidth = width();
-        int oldheight = height();
+        LayoutUnit oldwidth = width();
+        LayoutUnit oldheight = height();
         if (!preferredLogicalWidthsDirty())
             setPreferredLogicalWidthsDirty(true);
         computeLogicalWidth();
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index a4b1c7931..3032480c6 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -648,18 +648,26 @@ namespace {
 class AbsoluteQuadsGeneratorContext {
 public:
     AbsoluteQuadsGeneratorContext(const RenderInline* renderer, Vector<FloatQuad>& quads, bool* wasFixed)
-        : m_renderer(renderer)
-        , m_quads(quads)
-        , m_wasFixed(wasFixed) { }
+        : m_quads(quads)
+        , m_wasFixed(wasFixed)
+        , m_geometryMap()
+    {
+        RenderObject* root = renderer->parent();
+        while (root && root->parent())
+            root = root->parent();
+
+        if (root)
+            m_geometryMap.pushMappingsToAncestor(renderer, toRenderBoxModelObject(root));
+    }
 
     void operator()(const FloatRect& rect)
     {
-        m_quads.append(m_renderer->localToAbsoluteQuad(rect));
+        m_quads.append(m_geometryMap.absoluteRect(rect));
     }
 private:
-    const RenderInline* m_renderer;
     Vector<FloatQuad>& m_quads;
     bool* m_wasFixed;
+    RenderGeometryMap m_geometryMap;
 };
 
 } // unnamed namespace
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index 12c3b9267..12794cb46 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -1088,6 +1088,16 @@ void RenderLayer::setFilterBackendNeedsRepaintingInRect(const LayoutRect& rect,
     
     ASSERT_NOT_REACHED();
 }
+
+bool RenderLayer::hasAncestorWithFilterOutsets() const
+{
+    for (const RenderLayer* curr = this; curr; curr = curr->parent()) {
+        RenderBoxModelObject* renderer = curr->renderer();
+        if (renderer->style()->hasFilterOutsets())
+            return true;
+    }
+    return false;
+}
 #endif
     
 RenderLayer* RenderLayer::clippingRootForPainting() const
@@ -1419,15 +1429,24 @@ void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutP
         return;
 
     EPosition position = renderer()->style()->position();
-    if (position == FixedPosition && (!ancestorLayer || ancestorLayer == renderer()->view()->layer())) {
+
+    // FIXME: Positioning of out-of-flow(fixed, absolute) elements collected in a RenderFlowThread
+    // may need to be revisited in a future patch.
+    // If the fixed renderer is inside a RenderFlowThread, we should not compute location using localToAbsolute,
+    // since localToAbsolute maps the coordinates from named flow to regions coordinates and regions can be
+    // positioned in a completely different place in the viewport (RenderView).
+    if (position == FixedPosition && !renderer()->inRenderFlowThread() && (!ancestorLayer || ancestorLayer == renderer()->view()->layer())) {
         // If the fixed layer's container is the root, just add in the offset of the view. We can obtain this by calling
         // localToAbsolute() on the RenderView.
         FloatPoint absPos = renderer()->localToAbsolute(FloatPoint(), true);
         location += flooredLayoutSize(absPos);
         return;
     }
- 
-    if (position == FixedPosition) {
+
+    // For the fixed positioned elements inside a render flow thread, we should also skip the code path below
+    // Otherwise, for the case of ancestorLayer == rootLayer and fixed positioned element child of a transformed
+    // element in render flow thread, we will hit the fixed positioned container before hitting the ancestor layer.
+    if (position == FixedPosition && !renderer()->inRenderFlowThread()) {
         // For a fixed layers, we need to walk up to the root to see if there's a fixed position container
         // (e.g. a transformed layer). It's an error to call convertToLayerCoords() across a layer with a transform,
         // so we should always find the ancestor at or before we find the fixed position container.
@@ -1464,6 +1483,9 @@ void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutP
         parentLayer = parent();
         bool foundAncestorFirst = false;
         while (parentLayer) {
+            // RenderFlowThread is a positioned container, child of RenderView, positioned at (0,0).
+            // This implies that, for out-of-flow positioned elements inside a RenderFlowThread,
+            // we are bailing out before reaching root layer.
             if (isPositionedContainer(parentLayer))
                 break;
 
@@ -1475,6 +1497,11 @@ void RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, LayoutP
             parentLayer = parentLayer->parent();
         }
 
+        // We should not reach RenderView layer past the RenderFlowThread layer for any
+        // children of the RenderFlowThread.
+        if (renderer()->inRenderFlowThread() && !renderer()->isRenderFlowThread())
+            ASSERT(parentLayer != renderer()->view()->layer());
+
         if (foundAncestorFirst) {
             // Found ancestorLayer before the abs. positioned container, so compute offset of both relative
             // to enclosingPositionedAncestor and subtract.
@@ -3886,7 +3913,7 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, RenderRegion*
         clipRects.setOverflowClipRect(clipRects.posClipRect());
     
     // Update the clip rects that will be passed to child layers.
-    if (renderer()->hasOverflowClip() || renderer()->hasClip()) {
+    if (renderer()->hasClipOrOverflowClip()) {
         // This layer establishes a clip of some kind.
 
         // This offset cannot use convertToLayerCoords, because sometimes our rootLayer may be across
@@ -3973,7 +4000,7 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, RenderRegion* reg
     layerBounds = LayoutRect(offset, size());
 
     // Update the clip rects that will be passed to child layers.
-    if (renderer()->hasOverflowClip() || renderer()->hasClip()) {
+    if (renderer()->hasClipOrOverflowClip()) {
         // This layer establishes a clip of some kind.
         if (renderer()->hasOverflowClip()) {
             foregroundRect.intersect(toRenderBox(renderer())->overflowClipRect(offset, region, relevancy));
@@ -4843,10 +4870,10 @@ void RenderLayer::styleChanged(StyleDifference, const RenderStyle* oldStyle)
     bool backingDidCompositeLayers = isComposited() && backing()->canCompositeFilters();
 #endif
 
-#if USE(ACCELERATED_COMPOSITING)
     updateDescendantDependentFlags();
     updateTransform();
 
+#if USE(ACCELERATED_COMPOSITING)
     if (compositor()->updateLayerCompositingState(this))
         compositor()->setCompositingLayersNeedRebuild();
     else if (oldStyle && (oldStyle->clip() != renderer()->style()->clip() || oldStyle->hasClip() != renderer()->style()->hasClip()))
@@ -4994,7 +5021,14 @@ void RenderLayer::updateOrRemoveFilterEffect()
     else if (hasFilterInfo())
         filterInfo()->removeCustomFilterClients();
 #endif
-    
+
+#if ENABLE(SVG)
+    if (renderer()->style()->filter().hasReferenceFilter())
+        ensureFilterInfo()->updateReferenceFilterClients(renderer()->style()->filter());
+    else if (hasFilterInfo())
+        filterInfo()->removeReferenceFilterClients();
+#endif
+
     if (!paintsWithFilters()) {
         // Don't delete the whole filter info here, because we might use it
         // for loading CSS shader files.
@@ -5020,7 +5054,8 @@ void RenderLayer::updateOrRemoveFilterEffect()
 void RenderLayer::filterNeedsRepaint()
 {
     renderer()->node()->setNeedsStyleRecalc(SyntheticStyleChange);
-    renderer()->repaint();
+    if (renderer()->view())
+        renderer()->repaint();
 }
 #endif
 
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 186965905..1c32a4f89 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -471,6 +471,7 @@ public:
     RenderLayer* enclosingFilterLayer(bool includeSelf = true) const;
     RenderLayer* enclosingFilterRepaintLayer() const;
     void setFilterBackendNeedsRepaintingInRect(const LayoutRect&, bool immediate);
+    bool hasAncestorWithFilterOutsets() const;
 #endif
 
     bool canUseConvertToLayerCoords() const
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index f9a818a15..ee0a442f7 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -90,6 +90,8 @@ static inline bool isAcceleratedCanvas(RenderObject* renderer)
     return false;
 }
 
+bool RenderLayerBacking::m_creatingPrimaryGraphicsLayer = false;
+
 RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     : m_owningLayer(layer)
     , m_artificiallyInflatedBounds(false)
@@ -154,7 +156,7 @@ PassOwnPtr<GraphicsLayer> RenderLayerBacking::createGraphicsLayer(const String&
 
 bool RenderLayerBacking::shouldUseTileCache(const GraphicsLayer*) const
 {
-    return m_usingTiledCacheLayer;
+    return m_usingTiledCacheLayer && m_creatingPrimaryGraphicsLayer;
 }
 
 void RenderLayerBacking::createPrimaryGraphicsLayer()
@@ -163,7 +165,18 @@ void RenderLayerBacking::createPrimaryGraphicsLayer()
 #ifndef NDEBUG
     layerName = nameForLayer();
 #endif
+    
+    // The call to createGraphicsLayer ends calling back into here as
+    // a GraphicsLayerClient to ask if it shouldUseTileCache(). We only want
+    // the tile cache on our main layer. This is pretty ugly, but saves us from
+    // exposing the API to all clients.
+
+    m_creatingPrimaryGraphicsLayer = true;
     m_graphicsLayer = createGraphicsLayer(layerName);
+    m_creatingPrimaryGraphicsLayer = false;
+
+    if (m_usingTiledCacheLayer)
+        m_containmentLayer = createGraphicsLayer("TileCache Flattening Layer");
 
     if (m_isMainFrameRenderViewLayer) {
         bool isTransparent = false;
@@ -196,7 +209,7 @@ void RenderLayerBacking::destroyGraphicsLayers()
 
     m_graphicsLayer = nullptr;
     m_foregroundLayer = nullptr;
-    m_clippingLayer = nullptr;
+    m_containmentLayer = nullptr;
     m_maskLayer = nullptr;
 }
 
@@ -349,6 +362,11 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     if (layerConfigChanged)
         updateInternalHierarchy();
 
+    if (GraphicsLayer* flatteningLayer = tileCacheFlatteningLayer()) {
+        flatteningLayer->removeFromParent();
+        m_graphicsLayer->addChild(flatteningLayer);
+    }
+
     if (updateMaskLayer(renderer->hasMask()))
         m_graphicsLayer->setMaskLayer(m_maskLayer.get());
 
@@ -515,11 +533,11 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
 
     // If we have a layer that clips children, position it.
     IntRect clippingBox;
-    if (m_clippingLayer) {
+    if (GraphicsLayer* clipLayer = clippingLayer()) {
         clippingBox = clipBox(toRenderBox(renderer()));
-        m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
-        m_clippingLayer->setSize(clippingBox.size());
-        m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
+        clipLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
+        clipLayer->setSize(clippingBox.size());
+        clipLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
     }
     
     if (m_maskLayer) {
@@ -546,18 +564,19 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         m_graphicsLayer->setAnchorPoint(anchor);
 
         RenderStyle* style = renderer()->style();
+        GraphicsLayer* clipLayer = clippingLayer();
         if (style->hasPerspective()) {
             TransformationMatrix t = owningLayer()->perspectiveTransform();
             
-            if (m_clippingLayer) {
-                m_clippingLayer->setChildrenTransform(t);
+            if (clipLayer) {
+                clipLayer->setChildrenTransform(t);
                 m_graphicsLayer->setChildrenTransform(TransformationMatrix());
             }
             else
                 m_graphicsLayer->setChildrenTransform(t);
         } else {
-            if (m_clippingLayer)
-                m_clippingLayer->setChildrenTransform(TransformationMatrix());
+            if (clipLayer)
+                clipLayer->setChildrenTransform(TransformationMatrix());
             else
                 m_graphicsLayer->setChildrenTransform(TransformationMatrix());
         }
@@ -569,7 +588,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         FloatPoint foregroundPosition;
         FloatSize foregroundSize = newSize;
         IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
-        if (m_clippingLayer) {
+        if (hasClippingLayer()) {
             // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
             // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
             foregroundSize = FloatSize(clippingBox.size());
@@ -611,9 +630,9 @@ void RenderLayerBacking::updateInternalHierarchy()
         m_ancestorClippingLayer->addChild(m_graphicsLayer.get());
     }
 
-    if (m_clippingLayer) {
-        m_clippingLayer->removeFromParent();
-        m_graphicsLayer->addChild(m_clippingLayer.get());
+    if (m_containmentLayer) {
+        m_containmentLayer->removeFromParent();
+        m_graphicsLayer->addChild(m_containmentLayer.get());
     }
 
     // The clip for child layers does not include space for overflow controls, so they exist as
@@ -661,14 +680,14 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
     }
     
     if (needsDescendantClip) {
-        if (!m_clippingLayer) {
-            m_clippingLayer = createGraphicsLayer("Child clipping Layer");
-            m_clippingLayer->setMasksToBounds(true);
+        if (!m_containmentLayer && !m_usingTiledCacheLayer) {
+            m_containmentLayer = createGraphicsLayer("Child clipping Layer");
+            m_containmentLayer->setMasksToBounds(true);
             layersChanged = true;
         }
-    } else if (m_clippingLayer) {
-        m_clippingLayer->removeFromParent();
-        m_clippingLayer = nullptr;
+    } else if (hasClippingLayer()) {
+        m_containmentLayer->removeFromParent();
+        m_containmentLayer = nullptr;
         layersChanged = true;
     }
     
@@ -1033,7 +1052,7 @@ void RenderLayerBacking::contentChanged(ContentChangeType changeType)
     }
 
 #if ENABLE(WEBGL) || ENABLE(ACCELERATED_2D_CANVAS)
-    if ((changeType == CanvasChanged) && isAcceleratedCanvas(renderer())) {
+    if ((changeType == CanvasChanged || changeType == CanvasPixelsChanged) && isAcceleratedCanvas(renderer())) {
         m_graphicsLayer->setContentsNeedsDisplay();
         return;
     }
@@ -1541,7 +1560,18 @@ String RenderLayerBacking::nameForLayer() const
         if (node->isElementNode())
             name += " " + static_cast<Element*>(node)->tagName();
         if (node->hasID())
-            name += " \'" + static_cast<Element*>(node)->getIdAttribute() + "\'";
+            name += " id=\'" + static_cast<Element*>(node)->getIdAttribute() + "\'";
+
+        if (node->hasClass()) {
+            StyledElement* styledElement = static_cast<StyledElement*>(node);
+            String classes;
+            for (size_t i = 0; i < styledElement->classNames().size(); ++i) {
+                if (i > 0)
+                    classes += " ";
+                classes += styledElement->classNames()[i];
+            }
+            name += " class=\'" + classes + "\'";
+        }
     }
 
     if (m_owningLayer->isReflection())
@@ -1561,27 +1591,27 @@ CompositingLayerType RenderLayerBacking::compositingLayerType() const
     return ContainerCompositingLayer;
 }
 
-double RenderLayerBacking::backingStoreArea() const
+double RenderLayerBacking::backingStoreMemoryEstimate() const
 {
-    double backingArea;
+    double backingMemory;
     
-    // m_ancestorClippingLayer and m_clippingLayer are just used for masking, so have no backing.
-    backingArea = m_graphicsLayer->backingStoreArea();
+    // m_ancestorClippingLayer and m_containmentLayer are just used for masking or containment, so have no backing.
+    backingMemory = m_graphicsLayer->backingStoreMemoryEstimate();
     if (m_foregroundLayer)
-        backingArea += m_foregroundLayer->backingStoreArea();
+        backingMemory += m_foregroundLayer->backingStoreMemoryEstimate();
     if (m_maskLayer)
-        backingArea += m_maskLayer->backingStoreArea();
+        backingMemory += m_maskLayer->backingStoreMemoryEstimate();
 
     if (m_layerForHorizontalScrollbar)
-        backingArea += m_layerForHorizontalScrollbar->backingStoreArea();
+        backingMemory += m_layerForHorizontalScrollbar->backingStoreMemoryEstimate();
 
     if (m_layerForVerticalScrollbar)
-        backingArea += m_layerForVerticalScrollbar->backingStoreArea();
+        backingMemory += m_layerForVerticalScrollbar->backingStoreMemoryEstimate();
 
     if (m_layerForScrollCorner)
-        backingArea += m_layerForScrollCorner->backingStoreArea();
+        backingMemory += m_layerForScrollCorner->backingStoreMemoryEstimate();
     
-    return backingArea;
+    return backingMemory;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index d8718858e..622c38c85 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -74,8 +74,8 @@ public:
     GraphicsLayer* graphicsLayer() const { return m_graphicsLayer.get(); }
 
     // Layer to clip children
-    bool hasClippingLayer() const { return m_clippingLayer != 0; }
-    GraphicsLayer* clippingLayer() const { return m_clippingLayer.get(); }
+    bool hasClippingLayer() const { return (m_containmentLayer && !m_usingTiledCacheLayer); }
+    GraphicsLayer* clippingLayer() const { return !m_usingTiledCacheLayer ? m_containmentLayer.get() : 0; }
 
     // Layer to get clipped by ancestor
     bool hasAncestorClippingLayer() const { return m_ancestorClippingLayer != 0; }
@@ -86,7 +86,7 @@ public:
     
     bool hasMaskLayer() const { return m_maskLayer != 0; }
 
-    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer.get() : m_graphicsLayer.get(); }
+    GraphicsLayer* parentForSublayers() const { return m_containmentLayer ? m_containmentLayer.get() : m_graphicsLayer.get(); }
     GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer.get() : m_graphicsLayer.get(); }
 
     // RenderLayers with backing normally short-circuit paintLayer() because
@@ -160,7 +160,7 @@ public:
 #endif
 
     // Return an estimate of the backing store area (in pixels) allocated by this object's GraphicsLayers.
-    double backingStoreArea() const;
+    double backingStoreMemoryEstimate() const;
 
     String nameForLayer() const;
     
@@ -220,6 +220,9 @@ private:
 
     bool shouldClipCompositedBounds() const;
 
+    bool hasTileCacheFlatteningLayer() const { return (m_containmentLayer && m_usingTiledCacheLayer); }
+    GraphicsLayer* tileCacheFlatteningLayer() const { return m_usingTiledCacheLayer ? m_containmentLayer.get() : 0; }
+
     void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect, PaintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static CSSPropertyID graphicsLayerToCSSProperty(AnimatedPropertyID);
@@ -230,7 +233,7 @@ private:
     OwnPtr<GraphicsLayer> m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
     OwnPtr<GraphicsLayer> m_graphicsLayer;
     OwnPtr<GraphicsLayer> m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
-    OwnPtr<GraphicsLayer> m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+    OwnPtr<GraphicsLayer> m_containmentLayer; // Only used if we have clipping on a stacking context with compositing children, or if the layer has a tile cache.
     OwnPtr<GraphicsLayer> m_maskLayer;             // only used if we have a mask
 
     OwnPtr<GraphicsLayer> m_layerForHorizontalScrollbar;
@@ -246,6 +249,8 @@ private:
 #if ENABLE(CSS_FILTERS)
     bool m_canCompositeFilters;
 #endif
+
+    static bool m_creatingPrimaryGraphicsLayer;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 2869f6653..73f05fd7a 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -172,8 +172,6 @@ static inline bool compositingLogEnabled()
 #endif
 }
 
-#define PIXELS_PER_MEGAPIXEL 1000000.0
-
 RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     : m_renderView(renderView)
     , m_updateCompositingLayersTimer(this, &RenderLayerCompositor::updateCompositingLayersTimerFired)
@@ -194,8 +192,8 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     , m_rootLayerUpdateCount(0)
     , m_obligateCompositedLayerCount(0)
     , m_secondaryCompositedLayerCount(0)
-    , m_obligatoryBackingAreaMegaPixels(0)
-    , m_secondaryBackingAreaMegaPixels(0)
+    , m_obligatoryBackingStoreBytes(0)
+    , m_secondaryBackingStoreBytes(0)
 #endif
 {
 }
@@ -415,8 +413,8 @@ void RenderLayerCompositor::updateCompositingLayers(CompositingUpdateType update
     if (compositingLogEnabled() && isFullUpdate && (needHierarchyUpdate || needGeometryUpdate)) {
         m_obligateCompositedLayerCount = 0;
         m_secondaryCompositedLayerCount = 0;
-        m_obligatoryBackingAreaMegaPixels = 0;
-        m_secondaryBackingAreaMegaPixels = 0;
+        m_obligatoryBackingStoreBytes = 0;
+        m_secondaryBackingStoreBytes = 0;
 
         Frame* frame = m_renderView->frameView()->frame();
         bool isMainFrame = !m_renderView->document()->ownerElement();
@@ -448,11 +446,11 @@ void RenderLayerCompositor::updateCompositingLayers(CompositingUpdateType update
 #if !LOG_DISABLED
     if (compositingLogEnabled() && isFullUpdate && (needHierarchyUpdate || needGeometryUpdate)) {
         double endTime = currentTime();
-        LOG(Compositing, "Total layers   primary   secondary   obligatory backing (MP)   secondary backing(MP)   total backing (MP)  update time (ms)\n");
+        LOG(Compositing, "Total layers   primary   secondary   obligatory backing (KB)   secondary backing(KB)   total backing (KB)  update time (ms)\n");
 
         LOG(Compositing, "%8d %11d %9d %20.2f %22.2f %22.2f %18.2f\n",
             m_obligateCompositedLayerCount + m_secondaryCompositedLayerCount, m_obligateCompositedLayerCount,
-            m_secondaryCompositedLayerCount, m_obligatoryBackingAreaMegaPixels, m_secondaryBackingAreaMegaPixels, m_obligatoryBackingAreaMegaPixels + m_secondaryBackingAreaMegaPixels, 1000.0 * (endTime - startTime));
+            m_secondaryCompositedLayerCount, m_obligatoryBackingStoreBytes / 1024, m_secondaryBackingStoreBytes / 1024, (m_obligatoryBackingStoreBytes + m_secondaryBackingStoreBytes) / 1024, 1000.0 * (endTime - startTime));
     }
 #endif
     ASSERT(updateRoot || !m_compositingLayersNeedRebuild);
@@ -470,14 +468,14 @@ void RenderLayerCompositor::logLayerInfo(const RenderLayer* layer, int depth)
     RenderLayerBacking* backing = layer->backing();
     if (requiresCompositingLayer(layer) || layer->isRootLayer()) {
         ++m_obligateCompositedLayerCount;
-        m_obligatoryBackingAreaMegaPixels += backing->backingStoreArea() / PIXELS_PER_MEGAPIXEL;
+        m_obligatoryBackingStoreBytes += backing->backingStoreMemoryEstimate();
     } else {
         ++m_secondaryCompositedLayerCount;
-        m_secondaryBackingAreaMegaPixels += backing->backingStoreArea() / PIXELS_PER_MEGAPIXEL;
+        m_secondaryBackingStoreBytes += backing->backingStoreMemoryEstimate();
     }
 
-    LOG(Compositing, "%*p %dx%d %.3fMP (%s) %s\n", 12 + depth * 2, layer, backing->compositedBounds().width(), backing->compositedBounds().height(),
-        backing->backingStoreArea() / PIXELS_PER_MEGAPIXEL,
+    LOG(Compositing, "%*p %dx%d %.2fKB (%s) %s\n", 12 + depth * 2, layer, backing->compositedBounds().width(), backing->compositedBounds().height(),
+        backing->backingStoreMemoryEstimate() / 1024,
         reasonForCompositing(layer), layer->backing()->nameForLayer().utf8().data());
 }
 #endif
@@ -639,7 +637,7 @@ RenderLayer* RenderLayerCompositor::enclosingNonStackingClippingLayer(const Rend
         if (curr->isStackingContext())
             return 0;
 
-        if (curr->renderer()->hasOverflowClip() || curr->renderer()->hasClip())
+        if (curr->renderer()->hasClipOrOverflowClip())
             return curr;
     }
     return 0;
@@ -1612,8 +1610,7 @@ bool RenderLayerCompositor::clippedByAncestor(RenderLayer* layer) const
 // into the hierarchy between this layer and its children in the z-order hierarchy.
 bool RenderLayerCompositor::clipsCompositingDescendants(const RenderLayer* layer) const
 {
-    return layer->hasCompositingDescendant() &&
-           (layer->renderer()->hasOverflowClip() || layer->renderer()->hasClip());
+    return layer->hasCompositingDescendant() && layer->renderer()->hasClipOrOverflowClip();
 }
 
 // Return true if there is an ancestor layer that is fixed positioned to the view.
@@ -2087,12 +2084,12 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     if (requiresHorizontalScrollbarLayer()) {
         if (!m_layerForHorizontalScrollbar) {
             m_layerForHorizontalScrollbar = GraphicsLayer::create(this);
-    #ifndef NDEBUG
+#ifndef NDEBUG
             m_layerForHorizontalScrollbar->setName("horizontal scrollbar");
-    #endif
-    #if PLATFORM(MAC) && USE(CA)
+#endif
+#if PLATFORM(MAC) && USE(CA)
             m_layerForHorizontalScrollbar->setAcceleratesDrawing(acceleratedDrawingEnabled());
-    #endif
+#endif
             m_overflowControlsHostLayer->addChild(m_layerForHorizontalScrollbar.get());
 
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
@@ -2109,12 +2106,12 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     if (requiresVerticalScrollbarLayer()) {
         if (!m_layerForVerticalScrollbar) {
             m_layerForVerticalScrollbar = GraphicsLayer::create(this);
-    #ifndef NDEBUG
+#ifndef NDEBUG
             m_layerForVerticalScrollbar->setName("vertical scrollbar");
-    #endif
-    #if PLATFORM(MAC) && USE(CA)
-            m_layerForVerticalScrollbar->setAcceleratesDrawing(acceleratedDrawingEnabled());
-    #endif
+#endif
+#if PLATFORM(MAC) && USE(CA)
+        m_layerForVerticalScrollbar->setAcceleratesDrawing(acceleratedDrawingEnabled());
+#endif
             m_overflowControlsHostLayer->addChild(m_layerForVerticalScrollbar.get());
 
             if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
@@ -2131,12 +2128,12 @@ void RenderLayerCompositor::updateOverflowControlsLayers()
     if (requiresScrollCornerLayer()) {
         if (!m_layerForScrollCorner) {
             m_layerForScrollCorner = GraphicsLayer::create(this);
-    #ifndef NDEBUG
+#ifndef NDEBUG
             m_layerForScrollCorner->setName("scroll corner");
-    #endif
-    #if PLATFORM(MAC) && USE(CA)
+#endif
+#if PLATFORM(MAC) && USE(CA)
             m_layerForScrollCorner->setAcceleratesDrawing(acceleratedDrawingEnabled());
-    #endif
+#endif
             m_overflowControlsHostLayer->addChild(m_layerForScrollCorner.get());
         }
     } else if (m_layerForScrollCorner) {
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index ff24c9648..5b87e53c4 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -353,8 +353,8 @@ private:
     int m_rootLayerUpdateCount;
     int m_obligateCompositedLayerCount; // count of layer that have to be composited.
     int m_secondaryCompositedLayerCount; // count of layers that have to be composited because of stacking or overlap.
-    double m_obligatoryBackingAreaMegaPixels;
-    double m_secondaryBackingAreaMegaPixels;
+    double m_obligatoryBackingStoreBytes;
+    double m_secondaryBackingStoreBytes;
 #endif
 };
 
diff --git a/Source/WebCore/rendering/RenderLayerFilterInfo.cpp b/Source/WebCore/rendering/RenderLayerFilterInfo.cpp
index 703df638c..acbf07d9d 100644
--- a/Source/WebCore/rendering/RenderLayerFilterInfo.cpp
+++ b/Source/WebCore/rendering/RenderLayerFilterInfo.cpp
@@ -35,6 +35,13 @@
 #include "FilterEffectRenderer.h"
 #include "RenderLayer.h"
 
+#if ENABLE(SVG)
+#include "CachedSVGDocument.h"
+#include "SVGElement.h"
+#include "SVGFilter.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
+#endif
+
 #if ENABLE(CSS_SHADERS)
 #include "CustomFilterOperation.h"
 #include "CustomFilterProgram.h"
@@ -96,6 +103,9 @@ RenderLayerFilterInfo::~RenderLayerFilterInfo()
 #if ENABLE(CSS_SHADERS)
     removeCustomFilterClients();
 #endif
+#if ENABLE(SVG)
+    removeReferenceFilterClients();
+#endif
 }
 
 void RenderLayerFilterInfo::setRenderer(PassRefPtr<FilterEffectRenderer> renderer)
@@ -103,6 +113,56 @@ void RenderLayerFilterInfo::setRenderer(PassRefPtr<FilterEffectRenderer> rendere
     m_renderer = renderer; 
 }
 
+#if ENABLE(SVG)
+void RenderLayerFilterInfo::notifyFinished(CachedResource*)
+{
+    RenderObject* renderer = m_layer->renderer();
+    renderer->node()->setNeedsStyleRecalc(SyntheticStyleChange);
+    renderer->repaint();
+}
+
+void RenderLayerFilterInfo::updateReferenceFilterClients(const FilterOperations& operations)
+{
+    removeReferenceFilterClients();
+    for (size_t i = 0; i < operations.size(); ++i) {
+        RefPtr<FilterOperation> filterOperation = operations.operations().at(i);
+        if (filterOperation->getOperationType() != FilterOperation::REFERENCE)
+            continue;
+        ReferenceFilterOperation* referenceFilterOperation = static_cast<ReferenceFilterOperation*>(filterOperation.get());
+        CachedSVGDocument* cachedSVGDocument = static_cast<CachedSVGDocument*>(referenceFilterOperation->data());
+
+        if (cachedSVGDocument) {
+            // Reference is external; wait for notifyFinished().
+            cachedSVGDocument->addClient(this);
+            m_externalSVGReferences.append(cachedSVGDocument);
+        } else {
+            // Reference is internal; add layer as a client so we can trigger
+            // filter repaint on SVG attribute change.
+            Element* filter = m_layer->renderer()->node()->document()->getElementById(referenceFilterOperation->fragment());
+            if (!filter || !filter->renderer())
+                continue;
+            ASSERT(filter->renderer()->isSVGResourceContainer());
+            filter->renderer()->toRenderSVGResourceContainer()->addClientRenderLayer(m_layer);
+            m_internalSVGReferences.append(filter);
+        }
+    }
+}
+
+void RenderLayerFilterInfo::removeReferenceFilterClients()
+{
+    for (size_t i = 0; i < m_externalSVGReferences.size(); ++i)
+        m_externalSVGReferences.at(i)->removeClient(this);
+    m_externalSVGReferences.clear();
+    for (size_t i = 0; i < m_internalSVGReferences.size(); ++i) {
+        Element* filter = m_internalSVGReferences.at(i).get();
+        if (!filter->renderer())
+            continue;
+        filter->renderer()->toRenderSVGResourceContainer()->removeClientRenderLayer(m_layer);
+    }
+    m_internalSVGReferences.clear();
+}
+#endif
+
 #if ENABLE(CSS_SHADERS)
 void RenderLayerFilterInfo::notifyCustomFilterProgramLoaded(CustomFilterProgram*)
 {
diff --git a/Source/WebCore/rendering/RenderLayerFilterInfo.h b/Source/WebCore/rendering/RenderLayerFilterInfo.h
index 86a9c1393..ab45a9fca 100644
--- a/Source/WebCore/rendering/RenderLayerFilterInfo.h
+++ b/Source/WebCore/rendering/RenderLayerFilterInfo.h
@@ -32,6 +32,10 @@
 
 #if ENABLE(CSS_FILTERS)
 
+#if ENABLE(SVG)
+#include "CachedSVGDocument.h"
+#endif
+#include "FilterOperation.h"
 #include "LayoutTypes.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
@@ -53,6 +57,11 @@ typedef HashMap<const RenderLayer*, RenderLayerFilterInfo*> RenderLayerFilterInf
 class RenderLayerFilterInfo
 #if ENABLE(CSS_SHADERS)
     : public CustomFilterProgramClient
+#if ENABLE(SVG)
+    , public CachedSVGDocumentClient
+#endif
+#elif ENABLE(SVG)
+    : public CachedSVGDocumentClient
 #endif
 {
 public:
@@ -75,7 +84,12 @@ public:
     void removeCustomFilterClients();
 #endif
 
-    
+#if ENABLE(SVG)
+    void updateReferenceFilterClients(const FilterOperations&);
+    virtual void notifyFinished(CachedResource*);
+    void removeReferenceFilterClients();
+#endif
+
 private:
     RenderLayerFilterInfo(RenderLayer*);
     ~RenderLayerFilterInfo();
@@ -91,6 +105,10 @@ private:
 #endif
     
     static RenderLayerFilterInfoMap* s_filterMap;
+#if ENABLE(SVG)
+    Vector<RefPtr<Element> > m_internalSVGReferences;
+    Vector<CachedResourceHandle<CachedSVGDocument> > m_externalSVGReferences;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index b5ca92b81..deb66079c 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -150,7 +150,8 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     // treat <rt> as ruby text ONLY if it still has its default treatment of block
     if (node->hasTagName(rtTag) && style->display() == BLOCK)
         return new (arena) RenderRubyText(node);
-
+    if (doc->cssRegionsEnabled() && style->isDisplayRegionType() && !style->regionThread().isEmpty() && doc->renderView())
+        return new (arena) RenderRegion(node, doc->renderView()->flowThreadController()->ensureRenderFlowThreadWithName(style->regionThread()));
     switch (style->display()) {
     case NONE:
         return 0;
@@ -160,9 +161,6 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
     case INLINE_BLOCK:
     case RUN_IN:
     case COMPACT:
-        // Only non-replaced block elements can become a region.
-        if (doc->cssRegionsEnabled() && !style->regionThread().isEmpty() && doc->renderView())
-            return new (arena) RenderRegion(node, doc->renderView()->flowThreadController()->ensureRenderFlowThreadWithName(style->regionThread()));
         if ((!style->hasAutoColumnCount() || !style->hasAutoColumnWidth()) && doc->regionBasedColumnsEnabled())
             return new (arena) RenderMultiColumnBlock(node);
         return new (arena) RenderBlock(node);
@@ -678,6 +676,16 @@ void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderOb
         last->scheduleRelayout();
 }
 
+#ifndef NDEBUG
+void RenderObject::checkBlockPositionedObjectsNeedLayout()
+{
+    ASSERT(!needsLayout());
+
+    if (isRenderBlock())
+        toRenderBlock(this)->checkPositionedObjectsNeedLayout();
+}
+#endif
+
 void RenderObject::setPreferredLogicalWidthsDirty(bool shouldBeDirty, MarkingBehavior markParents)
 {
     bool alreadyDirty = preferredLogicalWidthsDirty();
@@ -730,6 +738,10 @@ RenderBlock* RenderObject::containingBlock() const
                 break;
             if (o->hasTransform() && o->isRenderBlock())
                 break;
+            // The render flow thread is the top most containing block
+            // for the fixed positioned elements.
+            if (o->isRenderFlowThread())
+                break;
 #if ENABLE(SVG)
             // foreignObject is the containing block for its contents.
             if (o->isSVGForeignObject())
@@ -2220,6 +2232,11 @@ RenderObject* RenderObject::container(const RenderBoxModelObject* repaintContain
             if (o->isSVGForeignObject())
                 break;
 #endif
+            // The render flow thread is the top most containing block
+            // for the fixed positioned elements.
+            if (o->isRenderFlowThread())
+                break;
+
             if (repaintContainerSkipped && o == repaintContainer)
                 *repaintContainerSkipped = true;
 
@@ -2681,7 +2698,11 @@ bool RenderObject::willRenderImage(CachedImage*)
 
     // If we're not in a window (i.e., we're dormant from being put in the b/f cache or in a background tab)
     // then we don't want to render either.
-    return !document()->inPageCache() && !document()->view()->isOffscreen();
+    if (document()->inPageCache() || document()->view()->isOffscreen())
+        return false;
+
+    // If a renderer is outside the viewport, we won't render.
+    return viewRect().intersects(absoluteClippedOverflowRect());
 }
 
 int RenderObject::maximalOutlineSize(PaintPhase p) const
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 3f01e90f9..60c56909c 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -541,6 +541,7 @@ public:
 
     bool hasClip() const { return isOutOfFlowPositioned() && style()->hasClip(); }
     bool hasOverflowClip() const { return m_bitfields.hasOverflowClip(); }
+    bool hasClipOrOverflowClip() const { return hasClip() || hasOverflowClip(); }
 
     bool hasTransform() const { return m_bitfields.hasTransform(); }
     bool hasMask() const { return style() && style()->hasMask(); }
@@ -932,7 +933,11 @@ private:
     StyleDifference adjustStyleDifference(StyleDifference, unsigned contextSensitiveProperties) const;
 
     Color selectionColor(int colorProperty) const;
-    
+
+#ifndef NDEBUG
+    void checkBlockPositionedObjectsNeedLayout();
+#endif
+
     RefPtr<RenderStyle> m_style;
 
     Node* m_node;
@@ -1104,6 +1109,9 @@ inline void RenderObject::setNeedsLayout(bool needsLayout, MarkingBehavior markP
         setNormalChildNeedsLayout(false);
         setNeedsPositionedMovementLayout(false);
         setAncestorLineBoxDirty(false);
+#ifndef NDEBUG
+        checkBlockPositionedObjectsNeedLayout();
+#endif
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 794acd820..2e0d7473b 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -315,7 +315,7 @@ void RenderReplaced::computeIntrinsicRatioInformation(FloatSize& intrinsicSize,
 LayoutUnit RenderReplaced::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
     if (style()->logicalWidth().isSpecified())
-        return computeReplacedLogicalWidthRespectingMinMaxWidth(computeReplacedLogicalWidthUsing(style()->logicalWidth()), includeMaxWidth);
+        return computeReplacedLogicalWidthRespectingMinMaxWidth(computeReplacedLogicalWidthUsing(MainOrPreferredSize, style()->logicalWidth()), includeMaxWidth);
 
     RenderBox* contentRenderer = embeddedContentBox();
 
@@ -340,7 +340,7 @@ LayoutUnit RenderReplaced::computeReplacedLogicalWidth(bool includeMaxWidth) con
             // or if 'width' has a computed value of 'auto', 'height' has some other computed value, and the element does have an intrinsic ratio; then the used value
             // of 'width' is: (used height) * (intrinsic ratio)
             if (intrinsicRatio && ((heightIsAuto && !hasIntrinsicWidth && hasIntrinsicHeight) || !heightIsAuto)) {
-                LayoutUnit logicalHeight = computeReplacedLogicalHeightUsing(style()->logicalHeight());
+                LayoutUnit logicalHeight = computeReplacedLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight());
                 return computeReplacedLogicalWidthRespectingMinMaxWidth(roundToInt(round(logicalHeight * intrinsicRatio)));
             }
 
@@ -352,7 +352,7 @@ LayoutUnit RenderReplaced::computeReplacedLogicalWidth(bool includeMaxWidth) con
                 // 'margin-left' + 'border-left-width' + 'padding-left' + 'width' + 'padding-right' + 'border-right-width' + 'margin-right' = width of containing block
                 LayoutUnit logicalWidth;
                 if (RenderBlock* blockWithWidth = firstContainingBlockWithLogicalWidth(this))
-                    logicalWidth = blockWithWidth->computeReplacedLogicalWidthRespectingMinMaxWidth(blockWithWidth->computeReplacedLogicalWidthUsing(blockWithWidth->style()->logicalWidth()), false);
+                    logicalWidth = blockWithWidth->computeReplacedLogicalWidthRespectingMinMaxWidth(blockWithWidth->computeReplacedLogicalWidthUsing(MainOrPreferredSize, blockWithWidth->style()->logicalWidth()), false);
                 else
                     logicalWidth = containingBlock()->availableLogicalWidth();
 
@@ -384,7 +384,7 @@ LayoutUnit RenderReplaced::computeReplacedLogicalHeight() const
 {
     // 10.5 Content height: the 'height' property: http://www.w3.org/TR/CSS21/visudet.html#propdef-height
     if (hasReplacedLogicalHeight())
-        return computeReplacedLogicalHeightRespectingMinMaxHeight(computeReplacedLogicalHeightUsing(style()->logicalHeight()));
+        return computeReplacedLogicalHeightRespectingMinMaxHeight(computeReplacedLogicalHeightUsing(MainOrPreferredSize, style()->logicalHeight()));
 
     RenderBox* contentRenderer = embeddedContentBox();
 
diff --git a/Source/WebCore/rendering/RenderScrollbarPart.cpp b/Source/WebCore/rendering/RenderScrollbarPart.cpp
index 1bf76ebca..3d93fe828 100644
--- a/Source/WebCore/rendering/RenderScrollbarPart.cpp
+++ b/Source/WebCore/rendering/RenderScrollbarPart.cpp
@@ -79,11 +79,11 @@ void RenderScrollbarPart::layoutVerticalPart()
     } 
 }
 
-static int calcScrollbarThicknessUsing(const Length& length, int containingLength, RenderView* renderView)
+static int calcScrollbarThicknessUsing(SizeType sizeType, const Length& length, int containingLength, RenderView* renderView)
 {
-    if (length.isIntrinsicOrAuto())
-        return ScrollbarTheme::theme()->scrollbarThickness();
-    return minimumValueForLength(length, containingLength, renderView);
+    if (!length.isIntrinsicOrAuto() || (sizeType == MinSize && length.isAuto()))
+        return minimumValueForLength(length, containingLength, renderView);
+    return ScrollbarTheme::theme()->scrollbarThickness();
 }
 
 void RenderScrollbarPart::computeScrollbarWidth()
@@ -92,9 +92,9 @@ void RenderScrollbarPart::computeScrollbarWidth()
         return;
     RenderView* renderView = view();
     int visibleSize = m_scrollbar->owningRenderer()->width() - m_scrollbar->owningRenderer()->borderLeft() - m_scrollbar->owningRenderer()->borderRight();
-    int w = calcScrollbarThicknessUsing(style()->width(), visibleSize, renderView);
-    int minWidth = calcScrollbarThicknessUsing(style()->minWidth(), visibleSize, renderView);
-    int maxWidth = style()->maxWidth().isUndefined() ? w : calcScrollbarThicknessUsing(style()->maxWidth(), visibleSize, renderView);
+    int w = calcScrollbarThicknessUsing(MainOrPreferredSize, style()->width(), visibleSize, renderView);
+    int minWidth = calcScrollbarThicknessUsing(MinSize, style()->minWidth(), visibleSize, renderView);
+    int maxWidth = style()->maxWidth().isUndefined() ? w : calcScrollbarThicknessUsing(MaxSize, style()->maxWidth(), visibleSize, renderView);
     setWidth(max(minWidth, min(maxWidth, w)));
     
     // Buttons and track pieces can all have margins along the axis of the scrollbar. 
@@ -108,9 +108,9 @@ void RenderScrollbarPart::computeScrollbarHeight()
         return;
     RenderView* renderView = view();
     int visibleSize = m_scrollbar->owningRenderer()->height() -  m_scrollbar->owningRenderer()->borderTop() - m_scrollbar->owningRenderer()->borderBottom();
-    int h = calcScrollbarThicknessUsing(style()->height(), visibleSize, renderView);
-    int minHeight = calcScrollbarThicknessUsing(style()->minHeight(), visibleSize, renderView);
-    int maxHeight = style()->maxHeight().isUndefined() ? h : calcScrollbarThicknessUsing(style()->maxHeight(), visibleSize, renderView);
+    int h = calcScrollbarThicknessUsing(MainOrPreferredSize, style()->height(), visibleSize, renderView);
+    int minHeight = calcScrollbarThicknessUsing(MinSize, style()->minHeight(), visibleSize, renderView);
+    int maxHeight = style()->maxHeight().isUndefined() ? h : calcScrollbarThicknessUsing(MaxSize, style()->maxHeight(), visibleSize, renderView);
     setHeight(max(minHeight, min(maxHeight, h)));
 
     // Buttons and track pieces can all have margins along the axis of the scrollbar. 
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index c43bf675c..55a65717d 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -124,11 +124,17 @@ void RenderTextControlSingleLine::layout()
     // and type=search if the text height is taller than the contentHeight()
     // because of compability.
 
-    RenderBlock::layoutBlock(false);
-
     RenderBox* innerTextRenderer = innerTextElement()->renderBox();
     ASSERT(innerTextRenderer);
     RenderBox* innerBlockRenderer = innerBlockElement() ? innerBlockElement()->renderBox() : 0;
+
+    // To ensure consistency between layouts, we need to reset any conditionally overriden height.
+    innerTextRenderer->style()->setHeight(Length(Auto));
+    if (innerBlockRenderer)
+        innerBlockRenderer->style()->setHeight(Length(Auto));
+
+    RenderBlock::layoutBlock(false);
+
     HTMLElement* container = containerElement();
     RenderBox* containerRenderer = container ? container->renderBox() : 0;
 
diff --git a/Source/WebCore/rendering/TextAutosizer.cpp b/Source/WebCore/rendering/TextAutosizer.cpp
new file mode 100644
index 000000000..0824aa336
--- /dev/null
+++ b/Source/WebCore/rendering/TextAutosizer.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(TEXT_AUTOSIZING)
+
+#include "TextAutosizer.h"
+
+#include "Document.h"
+#include "InspectorInstrumentation.h"
+#include "RenderObject.h"
+#include "RenderText.h"
+#include "RenderView.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+TextAutosizer::TextAutosizer(Document* document)
+    : m_document(document)
+{
+}
+
+TextAutosizer::~TextAutosizer()
+{
+}
+
+bool TextAutosizer::processSubtree(RenderObject* layoutRoot)
+{
+    // FIXME: Text Autosizing should only be enabled when m_document->page()->mainFrame()->view()->useFixedLayout()
+    // is true, but for now it's useful to ignore this so that it can be tested on desktop.
+    if (!m_document->settings() || !m_document->settings()->textAutosizingEnabled() || layoutRoot->view()->printing() || !m_document->page())
+        return false;
+
+    IntSize windowSize = m_document->settings()->textAutosizingWindowSizeOverride();
+    if (windowSize.isEmpty()) {
+        Frame* mainFrame = m_document->page()->mainFrame();
+        bool includeScrollbars = !InspectorInstrumentation::shouldApplyScreenWidthOverride(mainFrame);
+        windowSize = mainFrame->view()->visibleContentRect(includeScrollbars).size(); // FIXME: Check that this is always in logical (density-independent) pixels (see wkbug.com/87440).
+    }
+
+    for (RenderObject* descendant = traverseNext(layoutRoot, layoutRoot); descendant; descendant = traverseNext(descendant, layoutRoot)) {
+        if (!treatAsInline(descendant))
+            processBlock(toRenderBlock(descendant), windowSize);
+    }
+
+    return true;
+}
+
+void TextAutosizer::processBlock(RenderBlock* block, const IntSize& windowSize)
+{
+    int windowLogicalWidth = block->isHorizontalWritingMode() ? windowSize.width() : windowSize.height();
+    float multiplier = static_cast<float>(block->logicalWidth()) / windowLogicalWidth; // FIXME: This is overly simplistic.
+    if (multiplier < 1)
+        return;
+    for (RenderObject* descendant = traverseNext(block, block, treatAsInline); descendant; descendant = traverseNext(descendant, block, treatAsInline)) {
+        if (descendant->isText())
+            processText(toRenderText(descendant), multiplier);
+    }
+}
+
+void TextAutosizer::processText(RenderText* text, float multiplier)
+{
+    float specifiedSize = text->style()->fontDescription().specifiedSize();
+    float newSize = specifiedSize * multiplier; // FIXME: This is overly simplistic.
+
+    RefPtr<RenderStyle> style = RenderStyle::clone(text->style());
+    FontDescription fontDescription(style->fontDescription());
+    fontDescription.setComputedSize(newSize);
+    style->setFontDescription(fontDescription);
+    style->font().update(style->font().fontSelector());
+    text->setStyle(style.release());
+
+    // FIXME: Increase computed line height proportionately.
+    // FIXME: Increase list marker size proportionately.
+}
+
+bool TextAutosizer::treatAsInline(const RenderObject* renderer)
+{
+    return !renderer->isRenderBlock() || renderer->isListItem() || renderer->isInlineBlockOrInlineTable();
+}
+
+// FIXME: Consider making this a method on RenderObject if it remains this generic.
+RenderObject* TextAutosizer::traverseNext(RenderObject* current, const RenderObject* stayWithin, RenderObjectFilter filter)
+{
+    for (RenderObject* child = current->firstChild(); child; child = child->nextSibling()) {
+        if (!filter || filter(child)) {
+            ASSERT(!stayWithin || child->isDescendantOf(stayWithin));
+            return child;
+        }
+    }
+
+    for (RenderObject* ancestor = current; ancestor; ancestor = ancestor->parent()) {
+        if (ancestor == stayWithin)
+            return 0;
+        for (RenderObject* sibling = ancestor->nextSibling(); sibling; sibling = sibling->nextSibling()) {
+            if (!filter || filter(sibling)) {
+                ASSERT(!stayWithin || sibling->isDescendantOf(stayWithin));
+                return sibling;
+            }
+        }
+    }
+
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(TEXT_AUTOSIZING)
diff --git a/Source/WebCore/rendering/TextAutosizer.h b/Source/WebCore/rendering/TextAutosizer.h
new file mode 100644
index 000000000..f5e14cfe1
--- /dev/null
+++ b/Source/WebCore/rendering/TextAutosizer.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TextAutosizer_h
+#define TextAutosizer_h
+
+#if ENABLE(TEXT_AUTOSIZING)
+
+#include "LayoutTypes.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class Document;
+class RenderBlock;
+class RenderObject;
+class RenderStyle;
+class RenderText;
+
+class TextAutosizer {
+    WTF_MAKE_NONCOPYABLE(TextAutosizer);
+
+public:
+    static PassOwnPtr<TextAutosizer> create(Document* document) { return adoptPtr(new TextAutosizer(document)); }
+
+    virtual ~TextAutosizer();
+
+    bool processSubtree(RenderObject* layoutRoot);
+
+private:
+    explicit TextAutosizer(Document*);
+
+    void processBlock(RenderBlock*, const IntSize& windowSize);
+    void processText(RenderText*, float multiplier);
+
+    typedef bool (*RenderObjectFilter)(const RenderObject*);
+    static bool treatAsInline(const RenderObject*);
+
+    RenderObject* traverseNext(RenderObject* current, const RenderObject* stayWithin, RenderObjectFilter = 0);
+
+    Document* m_document;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(TEXT_AUTOSIZING)
+
+#endif // TextAutosizer_h
diff --git a/Source/WebCore/rendering/style/ContentData.cpp b/Source/WebCore/rendering/style/ContentData.cpp
index 1f7bf58f5..e8b453739 100644
--- a/Source/WebCore/rendering/style/ContentData.cpp
+++ b/Source/WebCore/rendering/style/ContentData.cpp
@@ -69,11 +69,11 @@ bool operator==(const ContentData& a, const ContentData& b)
     case CONTENT_NONE:
         return true;
     case CONTENT_OBJECT:
-        return static_cast<const ImageContentData*>(&a)->image() == static_cast<const ImageContentData*>(&b)->image();
+        return *static_cast<const ImageContentData*>(&a)->image() == *static_cast<const ImageContentData*>(&b)->image();
     case CONTENT_TEXT:
         return static_cast<const TextContentData*>(&a)->text() == static_cast<const TextContentData*>(&b)->text();
     case CONTENT_COUNTER:
-        return static_cast<const CounterContentData*>(&a)->counter() == static_cast<const CounterContentData*>(&b)->counter();
+        return *static_cast<const CounterContentData*>(&a)->counter() == *static_cast<const CounterContentData*>(&b)->counter();
     case CONTENT_QUOTE:
         return static_cast<const QuoteContentData*>(&a)->quote() == static_cast<const QuoteContentData*>(&b)->quote();
     }
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index d0702691c..cf4f7ba98 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -1506,6 +1506,13 @@ public:
             || originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE || originalDisplay() == INLINE_GRID;
     }
 
+    bool isDisplayRegionType() const
+    {
+        return display() == BLOCK || display() == INLINE_BLOCK
+            || display() == TABLE_CELL || display() == TABLE_CAPTION
+            || display() == LIST_ITEM;
+    }
+
     void setWritingMode(WritingMode v) { inherited_flags.m_writingMode = v; }
 
     // To tell if this style matched attribute selectors. This makes it impossible to share.
@@ -1581,7 +1588,7 @@ public:
     static unsigned short initialOutlineWidth() { return 3; }
     static int initialLetterWordSpacing() { return 0; }
     static Length initialSize() { return Length(); }
-    static Length initialMinSize() { return Length(0, Fixed); }
+    static Length initialMinSize() { return Length(); }
     static Length initialMaxSize() { return Length(Undefined); }
     static Length initialOffset() { return Length(); }
     static Length initialMargin() { return Length(Fixed); }
diff --git a/Source/WebCore/rendering/svg/RenderSVGEllipse.cpp b/Source/WebCore/rendering/svg/RenderSVGEllipse.cpp
index c9f183a55..b14f8acce 100644
--- a/Source/WebCore/rendering/svg/RenderSVGEllipse.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGEllipse.cpp
@@ -38,6 +38,7 @@ namespace WebCore {
 
 RenderSVGEllipse::RenderSVGEllipse(SVGStyledTransformableElement* node)
     : RenderSVGShape(node)
+    , m_usePathFallback(false)
 {
 }
 
@@ -54,12 +55,13 @@ void RenderSVGEllipse::createShape()
     m_center = FloatPoint();
     m_radii = FloatSize();
 
-    // Fallback to RenderSVGShape if shape has a non scaling stroke.
+    // Fallback to RenderSVGShape if shape has a non-scaling stroke.
     if (hasNonScalingStroke()) {
         RenderSVGShape::createShape();
-        setIsPaintingFallback(true);
+        m_usePathFallback = true;
         return;
-    }
+    } else
+        m_usePathFallback = false;
 
     calculateRadiiAndCenter();
 
@@ -97,21 +99,21 @@ void RenderSVGEllipse::calculateRadiiAndCenter()
 
 FloatRect RenderSVGEllipse::objectBoundingBox() const
 {
-    if (isPaintingFallback())
+    if (m_usePathFallback)
         return RenderSVGShape::objectBoundingBox();
     return m_boundingBox;
 }
 
 FloatRect RenderSVGEllipse::strokeBoundingBox() const
 {
-    if (isPaintingFallback())
+    if (m_usePathFallback)
         return RenderSVGShape::strokeBoundingBox();
     return m_outerStrokeRect;
 }
 
 void RenderSVGEllipse::fillShape(GraphicsContext* context) const
 {
-    if (isPaintingFallback()) {
+    if (m_usePathFallback) {
         RenderSVGShape::fillShape(context);
         return;
     }
@@ -122,17 +124,22 @@ void RenderSVGEllipse::strokeShape(GraphicsContext* context) const
 {
     if (!style()->svgStyle()->hasVisibleStroke())
         return;
-    if (isPaintingFallback()) {
+    if (m_usePathFallback) {
         RenderSVGShape::strokeShape(context);
         return;
     }
     context->strokeEllipse(m_boundingBox);
 }
 
-bool RenderSVGEllipse::shapeDependentStrokeContains(const FloatPoint& point) const
+bool RenderSVGEllipse::shapeDependentStrokeContains(const FloatPoint& point)
 {
-    if (isPaintingFallback())
+    // The optimized contains code below does not support non-smooth strokes so we need
+    // to fall back to RenderSVGShape::shapeDependentStrokeContains in these cases.
+    if (m_usePathFallback || !hasSmoothStroke()) {
+        if (!hasPath())
+            RenderSVGShape::createShape();
         return RenderSVGShape::shapeDependentStrokeContains(point);
+    }
 
     float halfStrokeWidth = strokeWidth() / 2;
     FloatPoint center = FloatPoint(m_center.x() - point.x(), m_center.y() - point.y());
@@ -151,7 +158,7 @@ bool RenderSVGEllipse::shapeDependentStrokeContains(const FloatPoint& point) con
 
 bool RenderSVGEllipse::shapeDependentFillContains(const FloatPoint& point, const WindRule fillRule) const
 {
-    if (isPaintingFallback())
+    if (m_usePathFallback)
         return RenderSVGShape::shapeDependentFillContains(point, fillRule);
 
     FloatPoint center = FloatPoint(m_center.x() - point.x(), m_center.y() - point.y());
diff --git a/Source/WebCore/rendering/svg/RenderSVGEllipse.h b/Source/WebCore/rendering/svg/RenderSVGEllipse.h
index 3720e9a31..9e88dee13 100644
--- a/Source/WebCore/rendering/svg/RenderSVGEllipse.h
+++ b/Source/WebCore/rendering/svg/RenderSVGEllipse.h
@@ -42,12 +42,12 @@ private:
     virtual const char* renderName() const { return "RenderSVGEllipse"; }
 
     virtual void createShape();
-    virtual bool isEmpty() const { return hasPath() ? RenderSVGShape::isEmpty() : m_boundingBox.isEmpty(); };
+    virtual bool isEmpty() const { return m_usePathFallback ? RenderSVGShape::isEmpty() : m_boundingBox.isEmpty(); };
     virtual void fillShape(GraphicsContext*) const;
     virtual void strokeShape(GraphicsContext*) const;
     virtual FloatRect objectBoundingBox() const;
     virtual FloatRect strokeBoundingBox() const;
-    virtual bool shapeDependentStrokeContains(const FloatPoint&) const;
+    virtual bool shapeDependentStrokeContains(const FloatPoint&);
     virtual bool shapeDependentFillContains(const FloatPoint&, const WindRule) const;
     void calculateRadiiAndCenter();
 
@@ -56,6 +56,7 @@ private:
     FloatRect m_outerStrokeRect;
     FloatPoint m_center;
     FloatSize m_radii;
+    bool m_usePathFallback;
 };
 
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGRect.cpp b/Source/WebCore/rendering/svg/RenderSVGRect.cpp
index 05429e804..120c132cf 100755
--- a/Source/WebCore/rendering/svg/RenderSVGRect.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRect.cpp
@@ -38,6 +38,7 @@ namespace WebCore {
 
 RenderSVGRect::RenderSVGRect(SVGRectElement* node)
     : RenderSVGShape(node)
+    , m_usePathFallback(false)
 {
 }
 
@@ -55,12 +56,13 @@ void RenderSVGRect::createShape()
     SVGRectElement* rect = static_cast<SVGRectElement*>(node());
     ASSERT(rect);
 
-    // Fallback to RenderSVGShape if rect has rounded corners.
+    // Fallback to RenderSVGShape if rect has rounded corners or a non-scaling stroke.
     if (rect->hasAttribute(SVGNames::rxAttr) || rect->hasAttribute(SVGNames::ryAttr) || hasNonScalingStroke()) {
-       RenderSVGShape::createShape();
-       setIsPaintingFallback(true);
-       return;
-    }
+        RenderSVGShape::createShape();
+        m_usePathFallback = true;
+        return;
+    } else
+        m_usePathFallback = false;
 
     SVGLengthContext lengthContext(rect);
     FloatSize boundingBoxSize(rect->width().value(lengthContext), rect->height().value(lengthContext));
@@ -91,61 +93,70 @@ void RenderSVGRect::createShape()
 
 FloatRect RenderSVGRect::objectBoundingBox() const
 {
-    if (isPaintingFallback())
+    if (m_usePathFallback)
         return RenderSVGShape::objectBoundingBox();
     return m_boundingBox;
 }
 
 FloatRect RenderSVGRect::strokeBoundingBox() const
 {
-    if (isPaintingFallback())
+    if (m_usePathFallback)
         return RenderSVGShape::strokeBoundingBox();
     return m_strokeBoundingRect;
 }
 
 void RenderSVGRect::fillShape(GraphicsContext* context) const
 {
-    if (!isPaintingFallback()) {
+    if (m_usePathFallback) {
+        RenderSVGShape::fillShape(context);
+        return;
+    }
+
 #if USE(CG)
-        // FIXME: CG implementation of GraphicsContextCG::fillRect has an own
-        // shadow drawing method, which draws an extra shadow.
-        // This is a workaround for switching off the extra shadow.
-        // https://bugs.webkit.org/show_bug.cgi?id=68899
-        if (context->hasShadow()) {
-            GraphicsContextStateSaver stateSaver(*context);
-            context->clearShadow();
-            context->fillRect(m_boundingBox);
-            return;
-        }
-#endif
+    // FIXME: CG implementation of GraphicsContextCG::fillRect has an own
+    // shadow drawing method, which draws an extra shadow.
+    // This is a workaround for switching off the extra shadow.
+    // https://bugs.webkit.org/show_bug.cgi?id=68899
+    if (context->hasShadow()) {
+        GraphicsContextStateSaver stateSaver(*context);
+        context->clearShadow();
         context->fillRect(m_boundingBox);
         return;
     }
-    RenderSVGShape::fillShape(context);
+#endif
+
+    context->fillRect(m_boundingBox);
 }
 
 void RenderSVGRect::strokeShape(GraphicsContext* context) const
 {
     if (!style()->svgStyle()->hasVisibleStroke())
         return;
-    if (!isPaintingFallback()) {
-        context->strokeRect(m_boundingBox, strokeWidth());
+
+    if (m_usePathFallback) {
+        RenderSVGShape::strokeShape(context);
         return;
     }
-    RenderSVGShape::strokeShape(context);
+
+    context->strokeRect(m_boundingBox, strokeWidth());
 }
 
-bool RenderSVGRect::shapeDependentStrokeContains(const FloatPoint& point) const
+bool RenderSVGRect::shapeDependentStrokeContains(const FloatPoint& point)
 {
-    if (isPaintingFallback())
+    // The optimized contains code below does not support non-smooth strokes so we need
+    // to fall back to RenderSVGShape::shapeDependentStrokeContains in these cases.
+    if (m_usePathFallback || !hasSmoothStroke()) {
+        if (!hasPath())
+            RenderSVGShape::createShape();
         return RenderSVGShape::shapeDependentStrokeContains(point);
+    }
 
     return m_outerStrokeRect.contains(point, FloatRect::InsideOrOnStroke) && !m_innerStrokeRect.contains(point, FloatRect::InsideButNotOnStroke);
 }
 
 bool RenderSVGRect::shapeDependentFillContains(const FloatPoint& point, const WindRule fillRule) const
 {
-    if (isPaintingFallback())
+    if (m_usePathFallback)
         return RenderSVGShape::shapeDependentFillContains(point, fillRule);
     return m_boundingBox.contains(point.x(), point.y());
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGRect.h b/Source/WebCore/rendering/svg/RenderSVGRect.h
index bd21538c2..36837f792 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRect.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRect.h
@@ -43,12 +43,12 @@ private:
     virtual const char* renderName() const { return "RenderSVGRect"; }
 
     virtual void createShape();
-    virtual bool isEmpty() const { return hasPath() ? RenderSVGShape::isEmpty() : m_boundingBox.isEmpty(); };
+    virtual bool isEmpty() const { return m_usePathFallback ? RenderSVGShape::isEmpty() : m_boundingBox.isEmpty(); };
     virtual void fillShape(GraphicsContext*) const;
     virtual void strokeShape(GraphicsContext*) const;
     virtual FloatRect objectBoundingBox() const;
     virtual FloatRect strokeBoundingBox() const;
-    virtual bool shapeDependentStrokeContains(const FloatPoint&) const;
+    virtual bool shapeDependentStrokeContains(const FloatPoint&);
     virtual bool shapeDependentFillContains(const FloatPoint&, const WindRule) const;
 
 private:
@@ -56,6 +56,7 @@ private:
     FloatRect m_innerStrokeRect;
     FloatRect m_outerStrokeRect;
     FloatRect m_strokeBoundingRect;
+    bool m_usePathFallback;
 };
 
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
index 3e223ed3b..51858e5bd 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
@@ -22,6 +22,7 @@
 #if ENABLE(SVG)
 #include "RenderSVGResourceContainer.h"
 
+#include "RenderLayer.h"
 #include "RenderSVGRoot.h"
 #include "RenderView.h"
 #include "SVGRenderingContext.h"
@@ -91,7 +92,7 @@ void RenderSVGResourceContainer::idChanged()
 
 void RenderSVGResourceContainer::markAllClientsForInvalidation(InvalidationMode mode)
 {
-    if (m_clients.isEmpty() || m_isInvalidating)
+    if ((m_clients.isEmpty() && m_clientLayers.isEmpty()) || m_isInvalidating)
         return;
 
     m_isInvalidating = true;
@@ -111,6 +112,13 @@ void RenderSVGResourceContainer::markAllClientsForInvalidation(InvalidationMode
 
         RenderSVGResource::markForLayoutAndParentResourceInvalidation(client, needsLayout);
     }
+
+#if ENABLE(CSS_FILTERS)
+    HashSet<RenderLayer*>::iterator layerEnd = m_clientLayers.end();
+    for (HashSet<RenderLayer*>::iterator it = m_clientLayers.begin(); it != layerEnd; ++it)
+        (*it)->filterNeedsRepaint();
+#endif
+
     m_isInvalidating = false;
 }
 
@@ -145,6 +153,18 @@ void RenderSVGResourceContainer::removeClient(RenderObject* client)
     m_clients.remove(client);
 }
 
+void RenderSVGResourceContainer::addClientRenderLayer(RenderLayer* client)
+{
+    ASSERT(client);
+    m_clientLayers.add(client);
+}
+
+void RenderSVGResourceContainer::removeClientRenderLayer(RenderLayer* client)
+{
+    ASSERT(client);
+    m_clientLayers.remove(client);
+}
+
 void RenderSVGResourceContainer::registerResource()
 {
     SVGDocumentExtensions* extensions = svgExtensionsFromNode(node());
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h
index 1e8e62de8..0f074863b 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.h
@@ -26,6 +26,8 @@
 
 namespace WebCore {
 
+class RenderLayer;
+
 class RenderSVGResourceContainer : public RenderSVGHiddenContainer,
                                    public RenderSVGResource {
 public:
@@ -42,6 +44,8 @@ public:
     static AffineTransform transformOnNonScalingStroke(RenderObject*, const AffineTransform& resourceTransform);
 
     void idChanged();
+    void addClientRenderLayer(RenderLayer*);
+    void removeClientRenderLayer(RenderLayer*);
 
 protected:
     enum InvalidationMode {
@@ -68,6 +72,7 @@ private:
     bool m_registered : 1;
     bool m_isInvalidating : 1;
     HashSet<RenderObject*> m_clients;
+    HashSet<RenderLayer*> m_clientLayers;
 };
 
 inline RenderSVGResourceContainer* getRenderSVGResourceContainerById(Document* document, const AtomicString& id)
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
index d5d792ded..e6f755c98 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
@@ -38,7 +38,6 @@
 #include "Page.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceFilterPrimitive.h"
-#include "Settings.h"
 #include "SVGElement.h"
 #include "SVGFilter.h"
 #include "SVGFilterElement.h"
@@ -47,6 +46,9 @@
 #include "SVGRenderingContext.h"
 #include "SVGStyledElement.h"
 #include "SVGUnitTypes.h"
+#include "Settings.h"
+#include "SourceAlpha.h"
+#include "SourceGraphic.h"
 
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
@@ -101,7 +103,7 @@ PassRefPtr<SVGFilterBuilder> RenderSVGResourceFilter::buildPrimitives(SVGFilter*
     FloatRect targetBoundingBox = filter->targetBoundingBox();
 
     // Add effects to the builder
-    RefPtr<SVGFilterBuilder> builder = SVGFilterBuilder::create(filter);
+    RefPtr<SVGFilterBuilder> builder = SVGFilterBuilder::create(SourceGraphic::create(filter), SourceAlpha::create(filter));
     for (Node* node = filterElement->firstChild(); node; node = node->nextSibling()) {
         if (!node->isSVGElement())
             continue;
diff --git a/Source/WebCore/rendering/svg/RenderSVGShape.cpp b/Source/WebCore/rendering/svg/RenderSVGShape.cpp
index 9c713992f..92d7c28fc 100755
--- a/Source/WebCore/rendering/svg/RenderSVGShape.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGShape.cpp
@@ -57,7 +57,6 @@ RenderSVGShape::RenderSVGShape(SVGStyledTransformableElement* node)
     , m_needsBoundariesUpdate(false) // Default is false, the cached rects are empty from the beginning.
     , m_needsShapeUpdate(true) // Default is true, so we grab a Path object once from SVGStyledTransformableElement.
     , m_needsTransformUpdate(true) // Default is true, so we grab a AffineTransform object once from SVGStyledTransformableElement.
-    , m_fillFallback(false)
 {
 }
 
@@ -69,7 +68,7 @@ void RenderSVGShape::createShape()
 {
     ASSERT(!m_path);
     m_path = adoptPtr(new Path);
-    ASSERT(isEmpty());
+    ASSERT(RenderSVGShape::isEmpty());
 
     SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
     updatePathFromGraphicsElement(element, path());
@@ -79,7 +78,7 @@ void RenderSVGShape::createShape()
 
 bool RenderSVGShape::isEmpty() const
 {
-    return m_path->isEmpty();
+    return path().isEmpty();
 }
 
 void RenderSVGShape::fillShape(GraphicsContext* context) const
@@ -89,7 +88,7 @@ void RenderSVGShape::fillShape(GraphicsContext* context) const
 
 FloatRect RenderSVGShape::objectBoundingBox() const
 {
-    return m_path->fastBoundingRect();
+    return path().fastBoundingRect();
 }
 
 void RenderSVGShape::strokeShape(GraphicsContext* context) const
@@ -98,7 +97,7 @@ void RenderSVGShape::strokeShape(GraphicsContext* context) const
         context->strokePath(path());
 }
 
-bool RenderSVGShape::shapeDependentStrokeContains(const FloatPoint& point) const
+bool RenderSVGShape::shapeDependentStrokeContains(const FloatPoint& point)
 {
     ASSERT(m_path);
     BoundingRectStrokeStyleApplier applier(this, style());
@@ -115,8 +114,7 @@ bool RenderSVGShape::shapeDependentStrokeContains(const FloatPoint& point) const
 
 bool RenderSVGShape::shapeDependentFillContains(const FloatPoint& point, const WindRule fillRule) const
 {
-    ASSERT(m_path);
-    return m_path->contains(point, fillRule);
+    return path().contains(point, fillRule);
 }
 
 bool RenderSVGShape::fillContains(const FloatPoint& point, bool requiresFill, const WindRule fillRule)
@@ -140,7 +138,6 @@ bool RenderSVGShape::strokeContains(const FloatPoint& point, bool requiresStroke
     if (requiresStroke && !RenderSVGResource::strokePaintingResource(this, style(), fallbackColor))
         return false;
 
-    const SVGRenderStyle* svgStyle = style()->svgStyle();
     for (size_t i = 0; i < m_zeroLengthLinecapLocations.size(); ++i) {
         ASSERT(style()->svgStyle()->hasStroke());
         float strokeWidth = this->strokeWidth();
@@ -155,12 +152,6 @@ bool RenderSVGShape::strokeContains(const FloatPoint& point, bool requiresStroke
         }
     }
 
-    if (!svgStyle->strokeDashArray().isEmpty() || svgStyle->strokeMiterLimit() != svgStyle->initialStrokeMiterLimit()
-        || svgStyle->joinStyle() != svgStyle->initialJoinStyle() || svgStyle->capStyle() != svgStyle->initialCapStyle()) {
-        if (!m_path)
-            RenderSVGShape::createShape();
-        return RenderSVGShape::shapeDependentStrokeContains(point);
-    }
     return shapeDependentStrokeContains(point);
 }
 
@@ -173,7 +164,6 @@ void RenderSVGShape::layout()
 
     bool needsShapeUpdate = m_needsShapeUpdate;
     if (needsShapeUpdate || m_needsBoundariesUpdate) {
-        setIsPaintingFallback(false);
         m_path.clear();
         createShape();
         m_needsShapeUpdate = false;
@@ -483,6 +473,15 @@ float RenderSVGShape::strokeWidth() const
     return style()->svgStyle()->strokeWidth().value(lengthContext);
 }
 
+bool RenderSVGShape::hasSmoothStroke() const
+{
+    const SVGRenderStyle* svgStyle = style()->svgStyle();
+    return svgStyle->strokeDashArray().isEmpty()
+        && svgStyle->strokeMiterLimit() == svgStyle->initialStrokeMiterLimit()
+        && svgStyle->joinStyle() == svgStyle->initialJoinStyle()
+        && svgStyle->capStyle() == svgStyle->initialCapStyle();
+}
+
 void RenderSVGShape::inflateWithStrokeAndMarkerBounds()
 {
     const SVGRenderStyle* svgStyle = style()->svgStyle();
diff --git a/Source/WebCore/rendering/svg/RenderSVGShape.h b/Source/WebCore/rendering/svg/RenderSVGShape.h
index 5d97bfd84..f6c22db68 100644
--- a/Source/WebCore/rendering/svg/RenderSVGShape.h
+++ b/Source/WebCore/rendering/svg/RenderSVGShape.h
@@ -75,7 +75,6 @@ public:
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
     virtual void fillShape(GraphicsContext*) const;
     virtual void strokeShape(GraphicsContext*) const;
-    bool isPaintingFallback() const { return m_fillFallback; }
 
     Path& path() const
     {
@@ -89,12 +88,12 @@ protected:
     virtual FloatRect objectBoundingBox() const;
     virtual FloatRect strokeBoundingBox() const { return m_strokeAndMarkerBoundingBox; }
     void setStrokeAndMarkerBoundingBox(FloatRect rect) { m_strokeAndMarkerBoundingBox = rect; }
-    virtual bool shapeDependentStrokeContains(const FloatPoint&) const;
+    virtual bool shapeDependentStrokeContains(const FloatPoint&);
     virtual bool shapeDependentFillContains(const FloatPoint&, const WindRule) const;
     float strokeWidth() const;
-    void setIsPaintingFallback(bool isFallback) { m_fillFallback = isFallback; }
     bool hasPath() const { return m_path.get(); }
     bool hasNonScalingStroke() const { return style()->svgStyle()->vectorEffect() == VE_NON_SCALING_STROKE; }
+    bool hasSmoothStroke() const;
 
 private:
     // Hit-detection separated for the fill and the stroke
@@ -148,7 +147,6 @@ private:
     bool m_needsBoundariesUpdate : 1;
     bool m_needsShapeUpdate : 1;
     bool m_needsTransformUpdate : 1;
-    bool m_fillFallback : 1;
 };
 
 inline RenderSVGShape* toRenderSVGShape(RenderObject* object)
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
index d1a0985d0..47bb63de2 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -547,29 +547,6 @@ void SVGInlineTextBox::paintDecoration(GraphicsContext* context, ETextDecoration
     }
 }
 
-static inline void normalizeTransform(AffineTransform& transform)
-{
-    // Obtain consistent numerical results for the AffineTransform on both 32/64bit platforms.
-    // Tested with SnowLeopard on Core Duo vs. Core 2 Duo.
-    static const float s_floatEpsilon = std::numeric_limits<float>::epsilon();
-
-    if (fabs(transform.a() - 1) <= s_floatEpsilon)
-        transform.setA(1);
-    else if (fabs(transform.a() + 1) <= s_floatEpsilon)
-        transform.setA(-1);
-
-    if (fabs(transform.d() - 1) <= s_floatEpsilon)
-        transform.setD(1);
-    else if (fabs(transform.d() + 1) <= s_floatEpsilon)
-        transform.setD(-1);
-
-    if (fabs(transform.e()) <= s_floatEpsilon)
-        transform.setE(0);
-
-    if (fabs(transform.f()) <= s_floatEpsilon)
-        transform.setF(0);
-}
-
 void SVGInlineTextBox::paintDecorationWithStyle(GraphicsContext* context, ETextDecoration decoration, const SVGTextFragment& fragment, RenderObject* decorationRenderer)
 {
     ASSERT(!m_paintingResource);
@@ -597,12 +574,7 @@ void SVGInlineTextBox::paintDecorationWithStyle(GraphicsContext* context, ETextD
     if (scalingFactor != 1) {
         width *= scalingFactor;
         decorationOrigin.scale(scalingFactor, scalingFactor);
-
-        AffineTransform newTransform = context->getCTM();
-        newTransform.scale(1 / scalingFactor);
-        normalizeTransform(newTransform);
-
-        context->setCTM(newTransform);
+        context->scale(FloatSize(1 / scalingFactor, 1 / scalingFactor));
     }
 
     decorationOrigin.move(0, -scaledFontMetrics.floatAscent() + positionOffsetForDecoration(decoration, scaledFontMetrics, thickness));
@@ -643,21 +615,12 @@ void SVGInlineTextBox::paintTextWithShadows(GraphicsContext* context, RenderStyl
         if (shadow)
             extraOffset = applyShadowToGraphicsContext(context, shadow, shadowRect, false /* stroked */, true /* opaque */, true /* horizontal */);
 
-        AffineTransform originalTransform;
-        if (scalingFactor != 1) {
-            originalTransform = context->getCTM();
-
-            AffineTransform newTransform = originalTransform;
-            newTransform.scale(1 / scalingFactor);
-            normalizeTransform(newTransform);
-
-            context->setCTM(newTransform);
-        }
+        context->save();
+        context->scale(FloatSize(1 / scalingFactor, 1 / scalingFactor));
 
         scaledFont.drawText(context, textRun, textOrigin + extraOffset, startPosition, endPosition);
 
-        if (scalingFactor != 1)
-            context->setCTM(originalTransform);
+        context->restore();
 
         restoreGraphicsContextAfterTextPainting(context, textRun);
 
diff --git a/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp
index 81fc325a1..685e51545 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextMetricsBuilder.cpp
@@ -155,6 +155,7 @@ void SVGTextMetricsBuilder::measureTextRenderer(RenderSVGInlineText* text, Measu
 
     initializeMeasurementWithTextRenderer(text);
     bool preserveWhiteSpace = text->style()->whiteSpace() == PRE;
+    int surrogatePairCharacters = 0;
 
     while (advance()) {
         const UChar* currentCharacter = m_run.data(m_textPosition);
@@ -168,7 +169,7 @@ void SVGTextMetricsBuilder::measureTextRenderer(RenderSVGInlineText* text, Measu
 
         if (data->processRenderer) {
             if (data->allCharactersMap) {
-                const SVGCharacterDataMap::const_iterator it = data->allCharactersMap->find(data->valueListPosition + m_textPosition - data->skippedCharacters + 1);
+                const SVGCharacterDataMap::const_iterator it = data->allCharactersMap->find(data->valueListPosition + m_textPosition - data->skippedCharacters - surrogatePairCharacters + 1);
                 if (it != data->allCharactersMap->end())
                     attributes->characterDataMap().set(m_textPosition + 1, it->second);
             }
@@ -176,7 +177,7 @@ void SVGTextMetricsBuilder::measureTextRenderer(RenderSVGInlineText* text, Measu
         }
 
         if (data->allCharactersMap && currentCharacterStartsSurrogatePair())
-            data->skippedCharacters += m_currentMetrics.length() - 1;
+            surrogatePairCharacters++;
 
         data->lastCharacter = currentCharacter;
     }
diff --git a/Source/WebCore/storage/Storage.cpp b/Source/WebCore/storage/Storage.cpp
index 260ef4f74..583ef3830 100644
--- a/Source/WebCore/storage/Storage.cpp
+++ b/Source/WebCore/storage/Storage.cpp
@@ -46,10 +46,14 @@ Storage::Storage(Frame* frame, PassRefPtr<StorageArea> storageArea)
 {
     ASSERT(m_frame);
     ASSERT(m_storageArea);
+    if (m_storageArea)
+        m_storageArea->incrementAccessCount();
 }
 
 Storage::~Storage()
 {
+    if (m_storageArea)
+        m_storageArea->decrementAccessCount();
 }
 
 unsigned Storage::length() const
diff --git a/Source/WebCore/storage/StorageArea.h b/Source/WebCore/storage/StorageArea.h
index 5da1bc150..3b2492a67 100644
--- a/Source/WebCore/storage/StorageArea.h
+++ b/Source/WebCore/storage/StorageArea.h
@@ -55,6 +55,9 @@ namespace WebCore {
         virtual bool contains(const String& key, Frame* sourceFrame) const = 0;
 
         virtual bool disabledByPrivateBrowsingInFrame(const Frame* sourceFrame) const = 0;
+
+        virtual void incrementAccessCount() { }
+        virtual void decrementAccessCount() { }
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/StorageAreaImpl.cpp b/Source/WebCore/storage/StorageAreaImpl.cpp
index 72e865718..694a97a6b 100644
--- a/Source/WebCore/storage/StorageAreaImpl.cpp
+++ b/Source/WebCore/storage/StorageAreaImpl.cpp
@@ -55,6 +55,8 @@ inline StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<Secu
 #ifndef NDEBUG
     , m_isShutdown(false)
 #endif
+    , m_accessCount(0)
+    , m_closeDatabaseTimer(this, &StorageAreaImpl::closeDatabaseTimerFired)
 {
     ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
@@ -93,6 +95,8 @@ StorageAreaImpl::StorageAreaImpl(StorageAreaImpl* area)
 #ifndef NDEBUG
     , m_isShutdown(area->m_isShutdown)
 #endif
+    , m_accessCount(0)
+    , m_closeDatabaseTimer(this, &StorageAreaImpl::closeDatabaseTimerFired)
 {
     ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
@@ -260,4 +264,31 @@ void StorageAreaImpl::blockUntilImportComplete() const
         m_storageAreaSync->blockUntilImportComplete();
 }
 
+void StorageAreaImpl::incrementAccessCount()
+{
+    m_accessCount++;
+
+    if (m_closeDatabaseTimer.isActive())
+        m_closeDatabaseTimer.stop();
+}
+
+void StorageAreaImpl::decrementAccessCount()
+{
+    ASSERT(m_accessCount);
+    --m_accessCount;
+
+    if (!m_accessCount) {
+        if (m_closeDatabaseTimer.isActive())
+            m_closeDatabaseTimer.stop();
+        m_closeDatabaseTimer.startOneShot(StorageTracker::tracker().storageDatabaseIdleInterval());
+    }
+}
+
+void StorageAreaImpl::closeDatabaseTimerFired(Timer<StorageAreaImpl> *)
+{
+    blockUntilImportComplete();
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleCloseDatabase();
+}
+
 }
diff --git a/Source/WebCore/storage/StorageAreaImpl.h b/Source/WebCore/storage/StorageAreaImpl.h
index a56361f2e..be0451c85 100644
--- a/Source/WebCore/storage/StorageAreaImpl.h
+++ b/Source/WebCore/storage/StorageAreaImpl.h
@@ -27,6 +27,7 @@
 #define StorageAreaImpl_h
 
 #include "StorageArea.h"
+#include "Timer.h"
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -53,6 +54,9 @@ namespace WebCore {
 
         virtual bool disabledByPrivateBrowsingInFrame(const Frame* sourceFrame) const;
 
+        virtual void incrementAccessCount();
+        virtual void decrementAccessCount();
+
         PassRefPtr<StorageAreaImpl> copy();
         void close();
 
@@ -69,6 +73,7 @@ namespace WebCore {
         StorageAreaImpl(StorageAreaImpl*);
 
         void blockUntilImportComplete() const;
+        void closeDatabaseTimerFired(Timer<StorageAreaImpl>*);
 
         StorageType m_storageType;
         RefPtr<SecurityOrigin> m_securityOrigin;
@@ -80,6 +85,8 @@ namespace WebCore {
 #ifndef NDEBUG
         bool m_isShutdown;
 #endif
+        unsigned m_accessCount;
+        Timer<StorageAreaImpl> m_closeDatabaseTimer;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/StorageAreaSync.cpp b/Source/WebCore/storage/StorageAreaSync.cpp
index 304905863..44209c6f5 100644
--- a/Source/WebCore/storage/StorageAreaSync.cpp
+++ b/Source/WebCore/storage/StorageAreaSync.cpp
@@ -382,10 +382,16 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
 {
     ASSERT(!isMainThread());
 
-    if (items.isEmpty() && !clearItems)
+    if (items.isEmpty() && !clearItems && !m_syncCloseDatabase)
         return;
     if (m_databaseOpenFailed)
         return;
+
+    if (!m_database.isOpen() && m_syncCloseDatabase) {
+        m_syncCloseDatabase = false;
+        return;
+    }
+
     if (!m_database.isOpen())
         openDatabase(CreateIfNonExistent);
     if (!m_database.isOpen())
diff --git a/Source/WebCore/storage/StorageTracker.cpp b/Source/WebCore/storage/StorageTracker.cpp
index 9e18dd473..0bb34b0c8 100644
--- a/Source/WebCore/storage/StorageTracker.cpp
+++ b/Source/WebCore/storage/StorageTracker.cpp
@@ -46,6 +46,10 @@ namespace WebCore {
 
 static StorageTracker* storageTracker = 0;
 
+// If there is no document referencing a storage database, close the underlying database
+// after it has been idle for m_StorageDatabaseIdleInterval seconds.
+static const double DefaultStorageDatabaseIdleInterval = 300;
+    
 void StorageTracker::initializeTracker(const String& storagePath, StorageTrackerClient* client)
 {
     ASSERT(isMainThread());
@@ -91,6 +95,7 @@ StorageTracker::StorageTracker(const String& storagePath)
     , m_isActive(false)
     , m_needsInitialization(false)
     , m_finishedImportingOriginIdentifiers(false)
+    , m_StorageDatabaseIdleInterval(DefaultStorageDatabaseIdleInterval)
 {
 }
 
@@ -627,5 +632,5 @@ long long StorageTracker::diskUsageForOrigin(SecurityOrigin* origin)
 
     return SQLiteFileSystem::getDatabaseFileSize(path);
 }
-    
+
 } // namespace WebCore
diff --git a/Source/WebCore/storage/StorageTracker.h b/Source/WebCore/storage/StorageTracker.h
index 9e1945adb..9ee23f5ff 100644
--- a/Source/WebCore/storage/StorageTracker.h
+++ b/Source/WebCore/storage/StorageTracker.h
@@ -74,6 +74,9 @@ public:
 
     void syncLocalStorage();
 
+    double storageDatabaseIdleInterval() { return m_StorageDatabaseIdleInterval; }
+    void setStorageDatabaseIdleInterval(double interval) { m_StorageDatabaseIdleInterval = interval; }
+
 private:
     StorageTracker(const String& storagePath);
     static void scheduleTask(void*);
@@ -118,6 +121,7 @@ private:
     bool m_isActive;
     bool m_needsInitialization;
     bool m_finishedImportingOriginIdentifiers;
+    double m_StorageDatabaseIdleInterval;
 };
     
 } // namespace WebCore
diff --git a/Source/WebCore/svg/SVGDocumentExtensions.cpp b/Source/WebCore/svg/SVGDocumentExtensions.cpp
index 7c2719da8..152ce8bb7 100644
--- a/Source/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/Source/WebCore/svg/SVGDocumentExtensions.cpp
@@ -169,14 +169,20 @@ void SVGDocumentExtensions::removeAnimationElementFromTarget(SVGSMILElement* ani
 void SVGDocumentExtensions::removeAllAnimationElementsFromTarget(SVGElement* targetElement)
 {
     ASSERT(targetElement);
-    HashSet<SVGSMILElement*>* animationElementsForTarget = m_animatedElements.take(targetElement);
-    if (!animationElementsForTarget)
+    HashMap<SVGElement*, HashSet<SVGSMILElement*>* >::iterator it = m_animatedElements.find(targetElement);
+    if (it == m_animatedElements.end())
         return;
-    HashSet<SVGSMILElement*>::iterator it = animationElementsForTarget->begin();
+
+    HashSet<SVGSMILElement*>* animationElementsForTarget = it->second;
+    Vector<SVGSMILElement*> toBeReset;
+
     HashSet<SVGSMILElement*>::iterator end = animationElementsForTarget->end();
-    for (; it != end; ++it)
-        (*it)->resetTargetElement();
-    delete animationElementsForTarget;
+    for (HashSet<SVGSMILElement*>::iterator it = animationElementsForTarget->begin(); it != end; ++it)
+        toBeReset.append(*it);
+
+    Vector<SVGSMILElement*>::iterator vectorEnd = toBeReset.end();
+    for (Vector<SVGSMILElement*>::iterator vectorIt = toBeReset.begin(); vectorIt != vectorEnd; ++vectorIt)
+        (*vectorIt)->resetTargetElement();
 }
 
 // FIXME: Callers should probably use ScriptController::eventHandlerLineNumber()
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index 8edbb65c6..c1ffe858d 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -61,7 +61,7 @@ PassRefPtr<SVGElement> SVGElement::create(const QualifiedName& tagName, Document
 
 SVGElement::~SVGElement()
 {
-    if (!hasRareSVGData())
+    if (!hasSVGRareData())
         ASSERT(!SVGElementRareData::rareDataMap().contains(this));
     else {
         SVGElementRareData::SVGElementRareDataMap& rareDataMap = SVGElementRareData::rareDataMap();
@@ -84,30 +84,30 @@ SVGElement::~SVGElement()
 
 bool SVGElement::willRecalcStyle(StyleChange change)
 {
-    if (!hasRareSVGData() || styleChangeType() == SyntheticStyleChange)
+    if (!hasSVGRareData() || styleChangeType() == SyntheticStyleChange)
         return true;
     // If the style changes because of a regular property change (not induced by SMIL animations themselves)
     // reset the "computed style without SMIL style properties", so the base value change gets reflected.
     if (change > NoChange || needsStyleRecalc())
-        rareSVGData()->setNeedsOverrideComputedStyleUpdate();
+        svgRareData()->setNeedsOverrideComputedStyleUpdate();
     return true;
 }
 
-SVGElementRareData* SVGElement::rareSVGData() const
+SVGElementRareData* SVGElement::svgRareData() const
 {
-    ASSERT(hasRareSVGData());
+    ASSERT(hasSVGRareData());
     return SVGElementRareData::rareDataFromMap(this);
 }
 
-SVGElementRareData* SVGElement::ensureRareSVGData()
+SVGElementRareData* SVGElement::ensureSVGRareData()
 {
-    if (hasRareSVGData())
-        return rareSVGData();
+    if (hasSVGRareData())
+        return svgRareData();
 
     ASSERT(!SVGElementRareData::rareDataMap().contains(this));
     SVGElementRareData* data = new SVGElementRareData;
     SVGElementRareData::rareDataMap().set(this, data);
-    setHasRareSVGData();
+    setHasSVGRareData();
     return data;
 }
 
@@ -220,7 +220,7 @@ void SVGElement::mapInstanceToElement(SVGElementInstance* instance)
 {
     ASSERT(instance);
 
-    HashSet<SVGElementInstance*>& instances = ensureRareSVGData()->elementInstances();
+    HashSet<SVGElementInstance*>& instances = ensureSVGRareData()->elementInstances();
     ASSERT(!instances.contains(instance));
 
     instances.add(instance);
@@ -229,9 +229,9 @@ void SVGElement::mapInstanceToElement(SVGElementInstance* instance)
 void SVGElement::removeInstanceMapping(SVGElementInstance* instance)
 {
     ASSERT(instance);
-    ASSERT(hasRareSVGData());
+    ASSERT(hasSVGRareData());
 
-    HashSet<SVGElementInstance*>& instances = rareSVGData()->elementInstances();
+    HashSet<SVGElementInstance*>& instances = svgRareData()->elementInstances();
     ASSERT(instances.contains(instance));
 
     instances.remove(instance);
@@ -239,11 +239,11 @@ void SVGElement::removeInstanceMapping(SVGElementInstance* instance)
 
 const HashSet<SVGElementInstance*>& SVGElement::instancesForElement() const
 {
-    if (!hasRareSVGData()) {
+    if (!hasSVGRareData()) {
         DEFINE_STATIC_LOCAL(HashSet<SVGElementInstance*>, emptyInstances, ());
         return emptyInstances;
     }
-    return rareSVGData()->elementInstances();
+    return svgRareData()->elementInstances();
 }
 
 bool SVGElement::boundingBox(FloatRect& rect, SVGLocatable::StyleUpdateStrategy styleUpdateStrategy)
@@ -261,7 +261,7 @@ bool SVGElement::boundingBox(FloatRect& rect, SVGLocatable::StyleUpdateStrategy
 
 void SVGElement::setCursorElement(SVGCursorElement* cursorElement)
 {
-    SVGElementRareData* rareData = ensureRareSVGData();
+    SVGElementRareData* rareData = ensureSVGRareData();
     if (SVGCursorElement* oldCursorElement = rareData->cursorElement()) {
         if (cursorElement == oldCursorElement)
             return;
@@ -272,13 +272,13 @@ void SVGElement::setCursorElement(SVGCursorElement* cursorElement)
 
 void SVGElement::cursorElementRemoved() 
 {
-    ASSERT(hasRareSVGData());
-    rareSVGData()->setCursorElement(0);
+    ASSERT(hasSVGRareData());
+    svgRareData()->setCursorElement(0);
 }
 
 void SVGElement::setCursorImageValue(CSSCursorImageValue* cursorImageValue)
 {
-    SVGElementRareData* rareData = ensureRareSVGData();
+    SVGElementRareData* rareData = ensureSVGRareData();
     if (CSSCursorImageValue* oldCursorImageValue = rareData->cursorImageValue()) {
         if (cursorImageValue == oldCursorImageValue)
             return;
@@ -289,19 +289,19 @@ void SVGElement::setCursorImageValue(CSSCursorImageValue* cursorImageValue)
 
 void SVGElement::cursorImageValueRemoved()
 {
-    ASSERT(hasRareSVGData());
-    rareSVGData()->setCursorImageValue(0);
+    ASSERT(hasSVGRareData());
+    svgRareData()->setCursorImageValue(0);
 }
 
 SVGElement* SVGElement::correspondingElement()
 {
-    ASSERT(!hasRareSVGData() || !rareSVGData()->correspondingElement() || shadowRoot());
-    return hasRareSVGData() ? rareSVGData()->correspondingElement() : 0;
+    ASSERT(!hasSVGRareData() || !svgRareData()->correspondingElement() || shadowRoot());
+    return hasSVGRareData() ? svgRareData()->correspondingElement() : 0;
 }
 
 void SVGElement::setCorrespondingElement(SVGElement* correspondingElement)
 {
-    ensureRareSVGData()->setCorrespondingElement(correspondingElement);
+    ensureSVGRareData()->setCorrespondingElement(correspondingElement);
 }
 
 void SVGElement::parseAttribute(const Attribute& attribute)
@@ -591,25 +591,25 @@ PassRefPtr<RenderStyle> SVGElement::customStyleForRenderer()
 
 StylePropertySet* SVGElement::animatedSMILStyleProperties() const
 {
-    if (hasRareSVGData())
-        return rareSVGData()->animatedSMILStyleProperties();
+    if (hasSVGRareData())
+        return svgRareData()->animatedSMILStyleProperties();
     return 0;
 }
 
 StylePropertySet* SVGElement::ensureAnimatedSMILStyleProperties()
 {
-    return ensureRareSVGData()->ensureAnimatedSMILStyleProperties();
+    return ensureSVGRareData()->ensureAnimatedSMILStyleProperties();
 }
 
 void SVGElement::setUseOverrideComputedStyle(bool value)
 {
-    if (hasRareSVGData())
-        rareSVGData()->setUseOverrideComputedStyle(value);
+    if (hasSVGRareData())
+        svgRareData()->setUseOverrideComputedStyle(value);
 }
 
 RenderStyle* SVGElement::computedStyle(PseudoId pseudoElementSpecifier)
 {
-    if (!hasRareSVGData() || !rareSVGData()->useOverrideComputedStyle())
+    if (!hasSVGRareData() || !svgRareData()->useOverrideComputedStyle())
         return Element::computedStyle(pseudoElementSpecifier);
 
     RenderStyle* parentStyle = 0;
@@ -618,7 +618,7 @@ RenderStyle* SVGElement::computedStyle(PseudoId pseudoElementSpecifier)
             parentStyle = renderer->style();
     }
 
-    return rareSVGData()->overrideComputedStyle(this, parentStyle);
+    return svgRareData()->overrideComputedStyle(this, parentStyle);
 }
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index d344f9d1a..470235aef 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -127,8 +127,8 @@ protected:
     
     virtual void removedFrom(ContainerNode*) OVERRIDE;
 
-    SVGElementRareData* rareSVGData() const;
-    SVGElementRareData* ensureRareSVGData();
+    SVGElementRareData* svgRareData() const;
+    SVGElementRareData* ensureSVGRareData();
 
     void reportAttributeParsingError(SVGParsingError, const Attribute&);
 
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index 7ae8f55e9..7f1e7edbd 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -423,29 +423,29 @@ PassRefPtr<CSSValue> SVGStyledElement::getPresentationAttribute(const String& na
 
 bool SVGStyledElement::instanceUpdatesBlocked() const
 {
-    return hasRareSVGData() && rareSVGData()->instanceUpdatesBlocked();
+    return hasSVGRareData() && svgRareData()->instanceUpdatesBlocked();
 }
 
 void SVGStyledElement::setInstanceUpdatesBlocked(bool value)
 {
-    if (hasRareSVGData())
-        rareSVGData()->setInstanceUpdatesBlocked(value);
+    if (hasSVGRareData())
+        svgRareData()->setInstanceUpdatesBlocked(value);
 }
 
 bool SVGStyledElement::hasPendingResources() const
 {
-    return hasRareSVGData() && rareSVGData()->hasPendingResources();
+    return hasSVGRareData() && svgRareData()->hasPendingResources();
 }
 
 void SVGStyledElement::setHasPendingResources()
 {
-    ensureRareSVGData()->setHasPendingResources(true);
+    ensureSVGRareData()->setHasPendingResources(true);
 }
 
 void SVGStyledElement::clearHasPendingResourcesIfPossible()
 {
     if (!document()->accessSVGExtensions()->isElementPendingResources(this))
-        ensureRareSVGData()->setHasPendingResources(false);
+        ensureSVGRareData()->setHasPendingResources(false);
 }
 
 AffineTransform SVGStyledElement::localCoordinateSpaceTransform(SVGLocatable::CTMScope) const
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 97bc43d31..836cfbbd4 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -155,7 +155,7 @@ SVGTRefElement::~SVGTRefElement()
 
 void SVGTRefElement::createShadowSubtree()
 {
-    ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot, ASSERT_NO_EXCEPTION);
+    ShadowRoot::create(this, ShadowRoot::UserAgentShadowRoot, ASSERT_NO_EXCEPTION);
 }
 
 void SVGTRefElement::updateReferencedText()
@@ -185,6 +185,8 @@ void SVGTRefElement::detachTarget()
     if (container)
         container->setTextContent(emptyContent, ignore);
 
+    ASSERT(inDocument());
+
     // Mark the referenced ID as pending.
     String id;
     SVGURIReference::targetElementFromIRIString(href(), document(), &id);
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index 4ff02e384..d59cfffd4 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -233,11 +233,8 @@ void SVGSMILElement::removedFrom(ContainerNode* rootParent)
         disconnectConditions();
 
         // Clear target now, because disconnectConditions calls targetElement() which will recreate the target if we removed it sooner. 
-        if (m_targetElement) {
-            document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
-            targetElementWillChange(m_targetElement, 0);
-            m_targetElement = 0;
-        }
+        if (m_targetElement)
+            resetTargetElement();
 
         m_attributeName = anyQName();
     }
@@ -554,6 +551,9 @@ SVGElement* SVGSMILElement::targetElement()
     if (m_targetElement)
         return m_targetElement;
 
+    if (!inDocument())
+        return 0;
+
     String href = getAttribute(XLinkNames::hrefAttr);
     ContainerNode* target = href.isEmpty() ? parentNode() : SVGURIReference::targetElementFromIRIString(href, document());
     if (!target || !target->isSVGElement())
@@ -579,6 +579,7 @@ void SVGSMILElement::targetElementWillChange(SVGElement* currentTarget, SVGEleme
 
 void SVGSMILElement::resetTargetElement()
 {
+    document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
     targetElementWillChange(m_targetElement, 0);
     m_targetElement = 0;
     animationAttributeChanged();
diff --git a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
index 605cc74e0..8ad1ec7d8 100644
--- a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
+++ b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.cpp
@@ -31,10 +31,10 @@
 
 namespace WebCore {
 
-SVGFilterBuilder::SVGFilterBuilder(Filter* filter)
+SVGFilterBuilder::SVGFilterBuilder(PassRefPtr<FilterEffect> sourceGraphic, PassRefPtr<FilterEffect> sourceAlpha)
 {
-    m_builtinEffects.add(SourceGraphic::effectName(), SourceGraphic::create(filter));
-    m_builtinEffects.add(SourceAlpha::effectName(), SourceAlpha::create(filter));
+    m_builtinEffects.add(SourceGraphic::effectName(), sourceGraphic);
+    m_builtinEffects.add(SourceAlpha::effectName(), sourceAlpha);
     addBuiltinEffects();
 }
 
diff --git a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h
index 713241c8e..44d3227b8 100644
--- a/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h
+++ b/Source/WebCore/svg/graphics/filters/SVGFilterBuilder.h
@@ -37,7 +37,7 @@ class SVGFilterBuilder : public RefCounted<SVGFilterBuilder> {
 public:
     typedef HashSet<FilterEffect*> FilterEffectSet;
 
-    static PassRefPtr<SVGFilterBuilder> create(Filter* filter) { return adoptRef(new SVGFilterBuilder(filter)); }
+    static PassRefPtr<SVGFilterBuilder> create(PassRefPtr<FilterEffect> sourceGraphic, PassRefPtr<FilterEffect> sourceAlpha) { return adoptRef(new SVGFilterBuilder(sourceGraphic, sourceAlpha)); }
 
     void add(const AtomicString& id, PassRefPtr<FilterEffect>);
 
@@ -60,7 +60,7 @@ public:
     void clearResultsRecursive(FilterEffect*);
 
 private:
-    SVGFilterBuilder(Filter*);
+    SVGFilterBuilder(PassRefPtr<FilterEffect> sourceGraphic, PassRefPtr<FilterEffect> sourceAlpha);
 
     inline void addBuiltinEffects()
     {
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index bf4392305..83d375374 100644
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -107,6 +107,10 @@ InternalSettings::InternalSettings(Frame* frame)
     , m_originalWindowFocusRestricted(settings()->windowFocusRestricted())
     , m_originalDeviceSupportsTouch(settings()->deviceSupportsTouch())
     , m_originalDeviceSupportsMouse(settings()->deviceSupportsMouse())
+#if ENABLE(TEXT_AUTOSIZING)
+    , m_originalTextAutosizingEnabled(settings()->textAutosizingEnabled())
+    , m_originalTextAutosizingWindowSizeOverride(settings()->textAutosizingWindowSizeOverride())
+#endif
 {
 }
 
@@ -128,6 +132,10 @@ void InternalSettings::restoreTo(Settings* settings)
     settings->setWindowFocusRestricted(m_originalWindowFocusRestricted);
     settings->setDeviceSupportsTouch(m_originalDeviceSupportsTouch);
     settings->setDeviceSupportsMouse(m_originalDeviceSupportsMouse);
+#if ENABLE(TEXT_AUTOSIZING)
+    settings->setTextAutosizingEnabled(m_originalTextAutosizingEnabled);
+    settings->setTextAutosizingWindowSizeOverride(m_originalTextAutosizingWindowSizeOverride);
+#endif
 }
 
 Settings* InternalSettings::settings() const
@@ -320,6 +328,29 @@ void InternalSettings::setPictographFontFamily(const String& family, const Strin
     setFontFamily(settings(), family, script, &Settings::setPictographFontFamily);
 }
 
+void InternalSettings::setTextAutosizingEnabled(bool enabled, ExceptionCode& ec)
+{
+#if ENABLE(TEXT_AUTOSIZING)
+    InternalSettingsGuardForSettings();
+    settings()->setTextAutosizingEnabled(enabled);
+#else
+    UNUSED_PARAM(enabled);
+    UNUSED_PARAM(ec);
+#endif
+}
+
+void InternalSettings::setTextAutosizingWindowSizeOverride(int width, int height, ExceptionCode& ec)
+{
+#if ENABLE(TEXT_AUTOSIZING)
+    InternalSettingsGuardForSettings();
+    settings()->setTextAutosizingWindowSizeOverride(IntSize(width, height));
+#else
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(ec);
+#endif
+}
+
 void InternalSettings::setEnableScrollAnimator(bool enabled, ExceptionCode& ec)
 {
 #if ENABLE(SMOOTH_SCROLLING)
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index 127da428f..7c3a330e7 100644
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -32,6 +32,10 @@
 #include <wtf/RefCounted.h>
 #include <wtf/text/WTFString.h>
 
+#if ENABLE(TEXT_AUTOSIZING)
+#include "IntSize.h"
+#endif
+
 namespace WebCore {
 
 typedef int ExceptionCode;
@@ -72,6 +76,8 @@ public:
     void setCursiveFontFamily(const String& family, const String& script, ExceptionCode&);
     void setFantasyFontFamily(const String& family, const String& script, ExceptionCode&);
     void setPictographFontFamily(const String& family, const String& script, ExceptionCode&);
+    void setTextAutosizingEnabled(bool enabled, ExceptionCode&);
+    void setTextAutosizingWindowSizeOverride(int width, int height, ExceptionCode&);
     void setEnableScrollAnimator(bool enabled, ExceptionCode&);
     bool scrollAnimatorEnabled(ExceptionCode&);
     void setCSSExclusionsEnabled(bool enabled, ExceptionCode&);
@@ -109,6 +115,10 @@ private:
     bool m_originalWindowFocusRestricted;
     bool m_originalDeviceSupportsTouch;
     bool m_originalDeviceSupportsMouse;
+#if ENABLE(TEXT_AUTOSIZING)
+    bool m_originalTextAutosizingEnabled;
+    IntSize m_originalTextAutosizingWindowSizeOverride;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index 1965f05e7..57e0f18be 100644
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -51,6 +51,8 @@ module window {
         void setCursiveFontFamily(in DOMString family, in DOMString script) raises(DOMException);
         void setFantasyFontFamily(in DOMString family, in DOMString script) raises(DOMException);
         void setPictographFontFamily(in DOMString family, in DOMString script) raises(DOMException);
+        void setTextAutosizingEnabled(in boolean enabled) raises(DOMException);
+        void setTextAutosizingWindowSizeOverride(in long width, in long height) raises(DOMException);
         void setEnableScrollAnimator(in boolean enabled) raises(DOMException);
         boolean scrollAnimatorEnabled() raises(DOMException);
         void setCSSExclusionsEnabled(in boolean enabled) raises(DOMException);
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index 2270b4acc..c97a19deb 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -65,6 +65,7 @@
 #include "TextIterator.h"
 #include "TextRun.h"
 #include "TreeScope.h"
+#include "ViewportArguments.h"
 
 #if ENABLE(INPUT_TYPE_COLOR)
 #include "ColorChooser.h"
@@ -634,6 +635,23 @@ void Internals::setPagination(Document* document, const String& mode, int gap, E
     document->page()->setPagination(pagination);
 }
 
+String Internals::configurationForViewport(Document* document, float devicePixelRatio, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight, ExceptionCode& ec)
+{
+    if (!document || !document->page()) {
+        ec = INVALID_ACCESS_ERR;
+        return String();
+    }
+
+    const int defaultLayoutWidthForNonMobilePages = 980;
+
+    ViewportArguments arguments = document->page()->viewportArguments();
+    ViewportAttributes attributes = computeViewportAttributes(arguments, defaultLayoutWidthForNonMobilePages, deviceWidth, deviceHeight, devicePixelRatio, IntSize(availableWidth, availableHeight));
+    restrictMinimumScaleFactorToViewportSize(attributes, IntSize(availableWidth, availableHeight));
+    restrictScaleFactorToInitialScaleIfNotUserScalable(attributes);
+
+    return "viewport size " + String::number(attributes.layoutSize.width()) + "x" + String::number(attributes.layoutSize.height()) + " scale " + String::number(attributes.initialScale) + " with limits [" + String::number(attributes.minimumScale) + ", " + String::number(attributes.maximumScale) + "] and userScalable " + (attributes.userScalable ? "true" : "false");
+}
+
 void Internals::reset(Document* document)
 {
     if (!document || !document->settings())
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index beac6f039..792ad6761 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -117,6 +117,7 @@ public:
     void setScrollViewPosition(Document*, long x, long y, ExceptionCode&);
 
     void setPagination(Document*, const String& mode, int gap, ExceptionCode&);
+    String configurationForViewport(Document*, float devicePixelRatio, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight, ExceptionCode&);
 
     bool wasLastChangeUserEdit(Element* textField, ExceptionCode&);
     String suggestedValue(Element* inputElement, ExceptionCode&);
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index 2f17f5558..de4458716 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -88,6 +88,13 @@ module window {
 
         void setPagination(in Document document, in DOMString mode, in long gap) raises(DOMException);
 
+        DOMString configurationForViewport(in Document document,
+                                           in float devicePixelRatio,
+                                           in long deviceWidth,
+                                           in long deviceHeight,
+                                           in long availableWidth,
+                                           in long availableHeight) raises(DOMException);
+
         boolean wasLastChangeUserEdit(in Element textField) raises (DOMException);
         DOMString suggestedValue(in Element inputElement) raises (DOMException);
         void setSuggestedValue(in Element inputElement, in DOMString value) raises (DOMException);
diff --git a/Source/WebCore/testing/js/WebCoreTestSupport.cpp b/Source/WebCore/testing/js/WebCoreTestSupport.cpp
index 7e50bc267..cfb938749 100644
--- a/Source/WebCore/testing/js/WebCoreTestSupport.cpp
+++ b/Source/WebCore/testing/js/WebCoreTestSupport.cpp
@@ -39,8 +39,8 @@ namespace WebCoreTestSupport {
 
 void injectInternalsObject(JSContextRef context)
 {
-    JSLock lock(SilenceAssertionsOnly);
     ExecState* exec = toJS(context);
+    JSLockHolder lock(exec);
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
     ScriptExecutionContext* scriptContext = globalObject->scriptExecutionContext();
     Document* document = scriptContext->isDocument() ? static_cast<Document*>(scriptContext) : 0;
@@ -49,11 +49,13 @@ void injectInternalsObject(JSContextRef context)
 
 void resetInternalsObject(JSContextRef context)
 {
-    JSLock lock(SilenceAssertionsOnly);
     ExecState* exec = toJS(context);
+    JSLockHolder lock(exec);
     JSDOMGlobalObject* globalObject = jsCast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-    Internals * internals = toInternals(globalObject->getDirect(exec->globalData(), Identifier(exec, Internals::internalsId)));
-    if (internals) {
+    JSValue internalsJS = globalObject->getDirect(exec->globalData(), Identifier(exec, Internals::internalsId));
+    if (internalsJS.isNull() || internalsJS.isEmpty())
+        return;
+    if (Internals* internals = toInternals(internalsJS)) {
         ScriptExecutionContext* scriptContext = globalObject->scriptExecutionContext();
         if (scriptContext->isDocument())
             internals->reset(static_cast<Document*>(scriptContext));
diff --git a/Source/WebCore/workers/DedicatedWorkerThread.cpp b/Source/WebCore/workers/DedicatedWorkerThread.cpp
index 5f60dd85e..678ce830f 100644
--- a/Source/WebCore/workers/DedicatedWorkerThread.cpp
+++ b/Source/WebCore/workers/DedicatedWorkerThread.cpp
@@ -39,13 +39,13 @@
 
 namespace WebCore {
 
-PassRefPtr<DedicatedWorkerThread> DedicatedWorkerThread::create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+PassRefPtr<DedicatedWorkerThread> DedicatedWorkerThread::create(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
 {
-    return adoptRef(new DedicatedWorkerThread(scriptURL, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType));
+    return adoptRef(new DedicatedWorkerThread(scriptURL, userAgent, settings, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType));
 }
 
-DedicatedWorkerThread::DedicatedWorkerThread(const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType)
+DedicatedWorkerThread::DedicatedWorkerThread(const KURL& url, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+    : WorkerThread(url, userAgent, settings, sourceCode, workerLoaderProxy, workerObjectProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType)
     , m_workerObjectProxy(workerObjectProxy)
 {
 }
diff --git a/Source/WebCore/workers/DedicatedWorkerThread.h b/Source/WebCore/workers/DedicatedWorkerThread.h
index 12a44da04..91e4c82dd 100644
--- a/Source/WebCore/workers/DedicatedWorkerThread.h
+++ b/Source/WebCore/workers/DedicatedWorkerThread.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
     class DedicatedWorkerThread : public WorkerThread {
     public:
-        static PassRefPtr<DedicatedWorkerThread> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        static PassRefPtr<DedicatedWorkerThread> create(const KURL& scriptURL, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
         WorkerObjectProxy& workerObjectProxy() const { return m_workerObjectProxy; }
         ~DedicatedWorkerThread();
 
@@ -50,7 +50,7 @@ namespace WebCore {
         virtual void runEventLoop();
 
     private:
-        DedicatedWorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        DedicatedWorkerThread(const KURL&, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerObjectProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
 
         WorkerObjectProxy& m_workerObjectProxy;
     };
diff --git a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 0db348023..1fa8a00ca 100644
--- a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -42,6 +42,7 @@
 #include "MessageEvent.h"
 #include "MessagePort.h"
 #include "NotImplemented.h"
+#include "PageGroup.h"
 #include "PlatformString.h"
 #include "ScriptCallStack.h"
 #include "SecurityOrigin.h"
@@ -97,6 +98,8 @@ public:
     // Removes a detached document from the list of worker's documents. May set the closing flag if this is the last document in the list.
     void documentDetached(Document*);
 
+    GroupSettings* groupSettings() const; // Page GroupSettings used by worker thread.
+
 private:
     SharedWorkerProxy(const String& name, const KURL&, PassRefPtr<SecurityOrigin>);
     void close();
@@ -160,6 +163,19 @@ bool SharedWorkerProxy::postTaskForModeToWorkerContext(PassOwnPtr<ScriptExecutio
     return true;
 }
 
+GroupSettings* SharedWorkerProxy::groupSettings() const
+{
+    if (isClosing())
+        return 0;
+    ASSERT(m_workerDocuments.size());
+    // Just pick the first active document, and use the groupsettings of that page.
+    Document* document = *(m_workerDocuments.begin());
+    if (document->page())
+        return document->page()->group().groupSettings();
+
+    return 0;
+}
+
 static void postExceptionTask(ScriptExecutionContext* context, const String& errorMessage, int lineNumber, const String& sourceURL)
 {
     context->reportException(errorMessage, lineNumber, sourceURL, 0);
@@ -343,7 +359,7 @@ void DefaultSharedWorkerRepository::workerScriptLoaded(SharedWorkerProxy& proxy,
 
     // Another loader may have already started up a thread for this proxy - if so, just send a connect to the pre-existing thread.
     if (!proxy.thread()) {
-        RefPtr<SharedWorkerThread> thread = SharedWorkerThread::create(proxy.name(), proxy.url(), userAgent, workerScript, proxy, proxy, DontPauseWorkerContextOnStart, contentSecurityPolicy, contentSecurityPolicyType);
+        RefPtr<SharedWorkerThread> thread = SharedWorkerThread::create(proxy.name(), proxy.url(), userAgent, proxy.groupSettings(), workerScript, proxy, proxy, DontPauseWorkerContextOnStart, contentSecurityPolicy, contentSecurityPolicyType);
         proxy.setThread(thread);
         thread->start();
     }
diff --git a/Source/WebCore/workers/SharedWorkerThread.cpp b/Source/WebCore/workers/SharedWorkerThread.cpp
index 13432ece8..50a89c8e7 100644
--- a/Source/WebCore/workers/SharedWorkerThread.cpp
+++ b/Source/WebCore/workers/SharedWorkerThread.cpp
@@ -38,13 +38,13 @@
 
 namespace WebCore {
 
-PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
 {
-    return adoptRef(new SharedWorkerThread(name, scriptURL, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType));
+    return adoptRef(new SharedWorkerThread(name, scriptURL, userAgent, settings, sourceCode, workerLoaderProxy, workerReportingProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType));
 }
 
-SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
-    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType)
+SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+    : WorkerThread(url, userAgent, settings, sourceCode, workerLoaderProxy, workerReportingProxy, startMode, contentSecurityPolicy, contentSecurityPolicyType)
     , m_name(name.isolatedCopy())
 {
 }
diff --git a/Source/WebCore/workers/SharedWorkerThread.h b/Source/WebCore/workers/SharedWorkerThread.h
index a58230dc2..3b35ed133 100644
--- a/Source/WebCore/workers/SharedWorkerThread.h
+++ b/Source/WebCore/workers/SharedWorkerThread.h
@@ -39,14 +39,14 @@ namespace WebCore {
 
     class SharedWorkerThread : public WorkerThread {
     public:
-        static PassRefPtr<SharedWorkerThread> create(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        static PassRefPtr<SharedWorkerThread> create(const String& name, const KURL&, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
         ~SharedWorkerThread();
 
     protected:
         virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String&, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
 
     private:
-        SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
 
         String m_name;
     };
diff --git a/Source/WebCore/workers/WorkerMessagingProxy.cpp b/Source/WebCore/workers/WorkerMessagingProxy.cpp
index a72b4c210..6f839f0a6 100644
--- a/Source/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/Source/WebCore/workers/WorkerMessagingProxy.cpp
@@ -42,6 +42,7 @@
 #include "InspectorInstrumentation.h"
 #include "MessageEvent.h"
 #include "NotImplemented.h"
+#include "PageGroup.h"
 #include "ScriptCallStack.h"
 #include "ScriptExecutionContext.h"
 #include "Worker.h"
@@ -272,7 +273,13 @@ WorkerMessagingProxy::~WorkerMessagingProxy()
 
 void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerThreadStartMode startMode)
 {
-    RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, sourceCode, *this, *this, startMode,
+    // FIXME: This need to be revisited when we support nested worker one day
+    ASSERT(m_scriptExecutionContext->isDocument());
+    Document* document = static_cast<Document*>(m_scriptExecutionContext.get());
+    GroupSettings* settings = 0;
+    if (document->page())
+        settings = document->page()->group().groupSettings();
+    RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, settings, sourceCode, *this, *this, startMode,
                                                                          m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeader(),
                                                                          m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeaderType());
     workerThreadCreated(thread);
diff --git a/Source/WebCore/workers/WorkerThread.cpp b/Source/WebCore/workers/WorkerThread.cpp
index 26ebd7ee6..9bde800eb 100644
--- a/Source/WebCore/workers/WorkerThread.cpp
+++ b/Source/WebCore/workers/WorkerThread.cpp
@@ -71,22 +71,23 @@ unsigned WorkerThread::workerThreadCount()
 struct WorkerThreadStartupData {
     WTF_MAKE_NONCOPYABLE(WorkerThreadStartupData); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+    static PassOwnPtr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
     {
-        return adoptPtr(new WorkerThreadStartupData(scriptURL, userAgent, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType));
+        return adoptPtr(new WorkerThreadStartupData(scriptURL, userAgent, settings, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType));
     }
 
     KURL m_scriptURL;
     String m_userAgent;
+    OwnPtr<GroupSettings> m_groupSettings;
     String m_sourceCode;
     WorkerThreadStartMode m_startMode;
     String m_contentSecurityPolicy;
     ContentSecurityPolicy::HeaderType m_contentSecurityPolicyType;
 private:
-    WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType);
+    WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const GroupSettings*, const String& sourceCode, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType);
 };
 
-WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
     : m_scriptURL(scriptURL.copy())
     , m_userAgent(userAgent.isolatedCopy())
     , m_sourceCode(sourceCode.isolatedCopy())
@@ -94,13 +95,20 @@ WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const St
     , m_contentSecurityPolicy(contentSecurityPolicy.isolatedCopy())
     , m_contentSecurityPolicyType(contentSecurityPolicyType)
 {
+    if (!settings)
+        return;
+
+    m_groupSettings = GroupSettings::create();
+    m_groupSettings->setLocalStorageQuotaBytes(settings->localStorageQuotaBytes());
+    m_groupSettings->setIndexedDBQuotaBytes(settings->indexedDBQuotaBytes());
+    m_groupSettings->setIndexedDBDatabasePath(settings->indexedDBDatabasePath().isolatedCopy());
 }
 
-WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
+WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const GroupSettings* settings, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy, WorkerThreadStartMode startMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType contentSecurityPolicyType)
     : m_threadID(0)
     , m_workerLoaderProxy(workerLoaderProxy)
     , m_workerReportingProxy(workerReportingProxy)
-    , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType))
+    , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, settings, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType))
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     , m_notificationClient(0)
 #endif
@@ -185,6 +193,11 @@ void WorkerThread::runEventLoop()
     m_runLoop.run(m_workerContext.get());
 }
 
+GroupSettings* WorkerThread::groupSettings()
+{
+    return m_startupData->m_groupSettings.get();
+}
+
 class WorkerThreadShutdownFinishTask : public ScriptExecutionContext::Task {
 public:
     static PassOwnPtr<WorkerThreadShutdownFinishTask> create()
diff --git a/Source/WebCore/workers/WorkerThread.h b/Source/WebCore/workers/WorkerThread.h
index 60c59d378..5b1751312 100644
--- a/Source/WebCore/workers/WorkerThread.h
+++ b/Source/WebCore/workers/WorkerThread.h
@@ -30,6 +30,7 @@
 #if ENABLE(WORKERS)
 
 #include "ContentSecurityPolicy.h"
+#include "GroupSettings.h"
 #include "WorkerRunLoop.h"
 #include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
@@ -61,6 +62,7 @@ namespace WebCore {
 
         // Number of active worker threads.
         static unsigned workerThreadCount();
+        GroupSettings* groupSettings();
 
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
         NotificationClient* getNotificationClient() { return m_notificationClient; }
@@ -68,7 +70,7 @@ namespace WebCore {
 #endif
 
     protected:
-        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
+        WorkerThread(const KURL&, const String& userAgent, const GroupSettings*,  const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&, WorkerThreadStartMode, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
 
         // Factory method for creating a new worker context for the thread.
         virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String& userAgent, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType) = 0;
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index b079d0cdf..f16b8653b 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -38,6 +38,7 @@
 #include "HTMLDocument.h"
 #include "HTTPParsers.h"
 #include "HTTPValidation.h"
+#include "HistogramSupport.h"
 #include "InspectorInstrumentation.h"
 #include "MemoryCache.h"
 #include "ResourceError.h"
@@ -54,6 +55,7 @@
 #include "XMLHttpRequestUpload.h"
 #include "markup.h"
 #include <wtf/ArrayBuffer.h>
+#include <wtf/ArrayBufferView.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/UnusedParam.h>
@@ -70,6 +72,13 @@ namespace WebCore {
 
 DEFINE_DEBUG_ONLY_GLOBAL(WTF::RefCountedLeakCounter, xmlHttpRequestCounter, ("XMLHttpRequest"));
 
+// Histogram enum to see when we can deprecate xhr.send(ArrayBuffer).
+enum XMLHttpRequestSendArrayBufferOrView {
+    XMLHttpRequestSendArrayBuffer,
+    XMLHttpRequestSendArrayBufferView,
+    XMLHttpRequestSendArrayBufferOrViewMax,
+};
+
 struct XMLHttpRequestStaticData {
     WTF_MAKE_NONCOPYABLE(XMLHttpRequestStaticData); WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -646,11 +655,28 @@ void XMLHttpRequest::send(DOMFormData* body, ExceptionCode& ec)
 
 void XMLHttpRequest::send(ArrayBuffer* body, ExceptionCode& ec)
 {
+    String consoleMessage("ArrayBuffer is deprecated in XMLHttpRequest.send(). Use ArrayBufferView instead.");
+    scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, WarningMessageLevel, consoleMessage);
+
+    HistogramSupport::histogramEnumeration("WebCore.XHR.send.ArrayBufferOrView", XMLHttpRequestSendArrayBuffer, XMLHttpRequestSendArrayBufferOrViewMax);
+
+    sendBytesData(body->data(), body->byteLength(), ec);
+}
+
+void XMLHttpRequest::send(ArrayBufferView* body, ExceptionCode& ec)
+{
+    HistogramSupport::histogramEnumeration("WebCore.XHR.send.ArrayBufferOrView", XMLHttpRequestSendArrayBufferView, XMLHttpRequestSendArrayBufferOrViewMax);
+
+    sendBytesData(body->baseAddress(), body->byteLength(), ec);
+}
+
+void XMLHttpRequest::sendBytesData(const void* data, size_t length, ExceptionCode& ec)
+{
     if (!initSend(ec))
         return;
 
     if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
-        m_requestEntityBody = FormData::create(body->data(), body->byteLength());
+        m_requestEntityBody = FormData::create(data, length);
         if (m_upload)
             m_requestEntityBody->setAlwaysStream(true);
     }
@@ -851,8 +877,8 @@ void XMLHttpRequest::dropProtection()
     // out. But it is protected from GC while loading, so this
     // can't be recouped until the load is done, so only
     // report the extra cost at that point.
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
     JSC::JSGlobalData* globalData = scriptExecutionContext()->globalData();
+    JSC::JSLockHolder lock(globalData);
     globalData->heap.reportExtraMemoryCost(m_responseBuilder.length() * 2);
 #endif
 
diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
index 927f63723..606428b76 100644
--- a/Source/WebCore/xml/XMLHttpRequest.h
+++ b/Source/WebCore/xml/XMLHttpRequest.h
@@ -93,6 +93,7 @@ public:
     void send(Blob*, ExceptionCode&);
     void send(DOMFormData*, ExceptionCode&);
     void send(ArrayBuffer*, ExceptionCode&);
+    void send(ArrayBufferView*, ExceptionCode&);
     void abort();
     void setRequestHeader(const AtomicString& name, const String& value, ExceptionCode&);
     void overrideMimeType(const String& override);
@@ -160,6 +161,7 @@ private:
     bool responseIsXML() const;
 
     bool initSend(ExceptionCode&);
+    void sendBytesData(const void*, size_t, ExceptionCode&);
 
     String getRequestHeader(const AtomicString& name) const;
     void setRequestHeaderInternal(const AtomicString& name, const String& value);
diff --git a/Source/WebCore/xml/XMLHttpRequest.idl b/Source/WebCore/xml/XMLHttpRequest.idl
index 095f4dc5c..c9557b3a4 100644
--- a/Source/WebCore/xml/XMLHttpRequest.idl
+++ b/Source/WebCore/xml/XMLHttpRequest.idl
@@ -69,7 +69,9 @@ module xml {
 
         [Custom] void send()
             raises(DOMException);
-        [Custom] void send(in ArrayBuffer data)
+        [Custom] void send(in ArrayBuffer data) // FIXME: this should be eventually deprecated.
+            raises(DOMException);
+        [Custom] void send(in ArrayBufferView data)
             raises(DOMException);
         [Conditional=BLOB, Custom] void send(in Blob data)
             raises(DOMException);
diff --git a/Source/WebCore/xml/parser/MarkupTokenizerBase.h b/Source/WebCore/xml/parser/MarkupTokenizerBase.h
index b8f9756ca..0a3cadaff 100644
--- a/Source/WebCore/xml/parser/MarkupTokenizerBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenizerBase.h
@@ -45,8 +45,6 @@ class MarkupTokenizerBase {
 public:
     virtual ~MarkupTokenizerBase() { }
 
-    OrdinalNumber lineNumber() const { return OrdinalNumber::fromZeroBasedInt(m_lineNumber); }
-
     typename State::State state() const { return m_state; }
     void setState(typename State::State state) { m_state = state; }
 
@@ -73,7 +71,7 @@ protected:
         // Returns whether we succeeded in peeking at the next character.
         // The only way we can fail to peek is if there are no more
         // characters in |source| (after collapsing \r\n, etc).
-        ALWAYS_INLINE bool peek(SegmentedString& source, int& lineNumber)
+        ALWAYS_INLINE bool peek(SegmentedString& source)
         {
         PeekAgain:
             m_nextInputCharacter = *source;
@@ -90,7 +88,7 @@ protected:
 
             if (m_nextInputCharacter == '\n' && m_skipNextNewLine) {
                 m_skipNextNewLine = false;
-                source.advancePastNewline(lineNumber);
+                source.advancePastNewlineAndUpdateLineNumber();
                 if (source.isEmpty())
                     return false;
                 m_nextInputCharacter = *source;
@@ -118,12 +116,12 @@ protected:
         }
 
         // Returns whether there are more characters in |source| after advancing.
-        bool advance(SegmentedString& source, int& lineNumber)
+        bool advance(SegmentedString& source)
         {
-            source.advance(lineNumber);
+            source.advanceAndUpdateLineNumber();
             if (source.isEmpty())
                 return false;
-            return peek(source, lineNumber);
+            return peek(source);
         }
 
         static const UChar endOfFileMarker = 0;
@@ -156,7 +154,7 @@ protected:
     inline bool emitAndResumeIn(SegmentedString& source, typename State::State state)
     {
         m_state = state;
-        source.advance(m_lineNumber);
+        source.advanceAndUpdateLineNumber();
         return true;
     }
     
@@ -172,7 +170,7 @@ protected:
         if (haveBufferedCharacterToken())
             return true;
         m_state = State::DataState;
-        source.advance(m_lineNumber);
+        source.advanceAndUpdateLineNumber();
         m_token->clear();
         m_token->makeEndOfFile();
         return true;
@@ -182,7 +180,6 @@ protected:
     {
         m_state = State::DataState;
         m_token = 0;
-        m_lineNumber = 0;
     }
 
     inline bool haveBufferedCharacterToken()
@@ -195,7 +192,6 @@ protected:
     // m_token is owned by the caller. If nextToken is not on the stack,
     // this member might be pointing to unallocated memory.
     Token* m_token;
-    int m_lineNumber;
 
     bool m_forceNullCharacterReplacement;
 
diff --git a/Source/WebCore/xml/parser/MarkupTokenizerInlineMethods.h b/Source/WebCore/xml/parser/MarkupTokenizerInlineMethods.h
index 9e3131577..814b8f216 100644
--- a/Source/WebCore/xml/parser/MarkupTokenizerInlineMethods.h
+++ b/Source/WebCore/xml/parser/MarkupTokenizerInlineMethods.h
@@ -71,7 +71,7 @@ inline void advanceStringAndASSERT(SegmentedString& source, const char* expected
 #define ADVANCE_TO(prefix, stateName)                                      \
     do {                                                                   \
         m_state = prefix::stateName;                                       \
-        if (!m_inputStreamPreprocessor.advance(source, m_lineNumber))      \
+        if (!m_inputStreamPreprocessor.advance(source))                    \
             return haveBufferedCharacterToken();                           \
         cc = m_inputStreamPreprocessor.nextInputCharacter();               \
         goto stateName;                                                    \
@@ -84,7 +84,7 @@ inline void advanceStringAndASSERT(SegmentedString& source, const char* expected
 #define SWITCH_TO(prefix, stateName)                                       \
     do {                                                                   \
         m_state = prefix::stateName;                                       \
-        if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source, m_lineNumber)) \
+        if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source))   \
             return haveBufferedCharacterToken();                           \
         cc = m_inputStreamPreprocessor.nextInputCharacter();               \
         goto stateName;                                                    \
diff --git a/Source/WebCore/xml/parser/XMLDocumentParser.cpp b/Source/WebCore/xml/parser/XMLDocumentParser.cpp
index 6a498145d..5241f0715 100644
--- a/Source/WebCore/xml/parser/XMLDocumentParser.cpp
+++ b/Source/WebCore/xml/parser/XMLDocumentParser.cpp
@@ -127,7 +127,7 @@ void XMLDocumentParser::append(const SegmentedString& s)
         return;
     }
 
-    doWrite(s.toString());
+    doWrite(parseString);
 
     // After parsing, go ahead and dispatch image beforeload events.
     ImageLoader::dispatchPendingBeforeLoadEvents();
diff --git a/Source/WebCore/xml/parser/XMLDocumentParser.h b/Source/WebCore/xml/parser/XMLDocumentParser.h
index 622cf9033..2a7245e61 100644
--- a/Source/WebCore/xml/parser/XMLDocumentParser.h
+++ b/Source/WebCore/xml/parser/XMLDocumentParser.h
@@ -94,7 +94,7 @@ class Text;
 
         static bool parseDocumentFragment(const String&, DocumentFragment*, Element* parent = 0, FragmentScriptingPermission = AllowScriptingContent);
 
-        // FIXME: This function used to be used by WML. Can we remove it?
+        // Used by the XMLHttpRequest to check if the responseXML was well formed.
         virtual bool wellFormed() const { return !m_sawError; }
 
         TextPosition textPosition() const;
diff --git a/Source/WebCore/xml/parser/XMLTokenizer.cpp b/Source/WebCore/xml/parser/XMLTokenizer.cpp
index a1d85b752..9e62e743c 100644
--- a/Source/WebCore/xml/parser/XMLTokenizer.cpp
+++ b/Source/WebCore/xml/parser/XMLTokenizer.cpp
@@ -225,7 +225,7 @@ bool XMLTokenizer::nextToken(SegmentedString& source, XMLToken& token)
     ASSERT(!m_token || m_token == &token || token.type() == XMLTokenTypes::Uninitialized);
     m_token = &token;
 
-    if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source, m_lineNumber))
+    if (source.isEmpty() || !m_inputStreamPreprocessor.peek(source))
         return haveBufferedCharacterToken();
     UChar cc = m_inputStreamPreprocessor.nextInputCharacter();
 
diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
index f399afad9..88fe273a8 100644
--- a/Source/WebKit/ChangeLog
+++ b/Source/WebKit/ChangeLog
@@ -1,3 +1,175 @@
+2012-07-09  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Battery status code needs refactoring to be reused in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=90760
+
+        Reviewed by Hajime Morita.
+
+        Add BatteryClientEfl to PlatformEfl.cmake.
+
+        * PlatformEfl.cmake:
+
+2012-07-08  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        [EFL] Change notifications directory path of WebKit_INCLUDE_DIRECTORIES in the PlatformEfl.cmake
+        https://bugs.webkit.org/show_bug.cgi?id=90650
+
+        Reviewed by Laszlo Gombos.
+
+        Change directory path for including notifications of WebCore
+        from WebCore/notifications to WebCore/Modules/notifications
+
+        * PlatformEfl.cmake:
+
+2012-07-07  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL][CMake] Remove non-existent include directory
+        https://bugs.webkit.org/show_bug.cgi?id=90605
+
+        Reviewed by Kentaro Hara.
+
+        * PlatformEfl.cmake:
+
+2012-07-06  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL][CMake] Move gtest sources to an upper level
+        https://bugs.webkit.org/show_bug.cgi?id=90602
+
+        Reviewed by Chang Shu.
+
+        Removed gtest since it is now built as a separated component.
+        This will allow us to share it with WebKit 2 API tests.
+
+        * PlatformEfl.cmake:
+
+2012-07-06  Seokju Kwon  <seokju.kwon@samsung.com>
+
+        [EFL] Add Web Inspector to WebKit-EFL
+        https://bugs.webkit.org/show_bug.cgi?id=83865
+
+        Reviewed by Pavel Feldman.
+
+        EFL port implementation for Web Inspector.
+        Prepare Web Inspector resources.
+
+        * PlatformEfl.cmake:
+
+2012-07-05  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        [EFL] Change class name from NotificationClientEfl to NotificationPresenterClientEfl.
+        https://bugs.webkit.org/show_bug.cgi?id=90542
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        NotificationClientEfl.cpp is changed to NotificationPresenterClientEfl.cpp
+        to be in line with other ports(qt, chromium, gtk).
+
+        * PlatformEfl.cmake:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove a few un-needed load(features) after r121777
+
+        The features are computed by configure.pro and cached in .qmake.cache.
+
+        Reviewed by Jocelyn Turcotte.
+
+        * WebKit1.pro:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix broken OR-operator in project file
+
+        Qmake expects |, not ||. The result was that the block was entered, even
+        if none of the two defines were set to 1.
+
+        Reviewed by Jocelyn Turcotte.
+
+        * WebKit1.pri:
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Move BatteryClientEfl from WebKit to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=90063
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Move BatteryClientEfl class from WebKit to WebCore
+        so that it can be reused in WebKit2.
+
+        * PlatformEfl.cmake:
+
+2012-07-02  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Use PUBLIC_BUILD to enable/disable DRT
+        https://bugs.webkit.org/show_bug.cgi?id=90271
+
+        Reviewed by George Staikos.
+
+        RIM PR #154707
+
+        Currently DRT code will be compiled only if ENABLE_DRT is set, and it's not
+        defined by default.
+        We should enable DRT by default unless PUBLIC_BUILD is set. In this way we don't
+        need to rebuild webkit before running DRT.
+
+        * PlatformBlackBerry.cmake:
+
+2012-07-02  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL][CMake] Integrate API unit tests with CTest
+        https://bugs.webkit.org/show_bug.cgi?id=87251
+
+        Reviewed by Daniel Bates.
+
+        Add every test to the test runner build target.
+
+        * PlatformEfl.cmake:
+
+2012-07-02  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Rename NotificationPresenterEfl with NotificationClientEfl
+        https://bugs.webkit.org/show_bug.cgi?id=90370
+
+        Reviewed by Csaba Osztrogonác.
+
+        Bug 80488 renamed NotificationPresenter with NotificationClient. So, EFL port needs to adjust
+        it as well.
+
+        * PlatformEfl.cmake:
+
+2012-06-29  Krzysztof Czech  <k.czech@samsung.com>
+
+        [EFL] Add support for Unit Tests, based on the gtest library.
+        https://bugs.webkit.org/show_bug.cgi?id=68509
+
+        Reviewed by Chang Shu.
+
+        Add configuration for building gtest library, testing framework and unit tests.
+
+        * PlatformEfl.cmake:
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121398.
+        http://trac.webkit.org/changeset/121398
+        https://bugs.webkit.org/show_bug.cgi?id=90136
+
+        broke efl build (Requested by ryuan on #webkit).
+
+        * PlatformEfl.cmake:
+
+2012-06-27  Krzysztof Czech  <k.czech@samsung.com>
+
+        [EFL] Add support for Unit Tests, based on the gtest library.
+        https://bugs.webkit.org/show_bug.cgi?id=68509
+
+        Reviewed by Chang Shu.
+
+        Add configuration for building gtest library, testing framework and unit tests.
+
+        * PlatformEfl.cmake:
+
 2012-06-26  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt][Win] Symbols are not exported in QtWebKit5.dll
diff --git a/Source/WebKit/PlatformBlackBerry.cmake b/Source/WebKit/PlatformBlackBerry.cmake
index be2a948dd..fa61b8bbe 100644
--- a/Source/WebKit/PlatformBlackBerry.cmake
+++ b/Source/WebKit/PlatformBlackBerry.cmake
@@ -24,7 +24,7 @@ LIST(APPEND WebKit_INCLUDE_DIRECTORIES
     "${WEBKIT_DIR}/blackberry/WebKitSupport"
     "${CMAKE_SOURCE_DIR}/Source" # For JavaScriptCore API headers
 )
-IF (ENABLE_DRT)
+IF (NOT PUBLIC_BUILD)
     LIST(APPEND WebKit_INCLUDE_DIRECTORIES
         # needed for DRT for now
         "${JAVASCRIPTCORE_DIR}/wtf"
@@ -107,7 +107,6 @@ LIST(APPEND WebKit_SOURCES
     blackberry/WebKitSupport/FatFingers.cpp
 )
 
-
 IF (ENABLE_WEBGL)
     LIST(APPEND WebKit_INCLUDE_DIRECTORIES
         ${OPENGL_INCLUDE_DIR}
@@ -119,7 +118,7 @@ IF (ENABLE_WEBGL)
     )
 ENDIF (ENABLE_WEBGL)
 
-IF (ENABLE_DRT)
+IF (NOT PUBLIC_BUILD)
     # DumpRenderTree sources
     LIST(APPEND WebKit_SOURCES
         blackberry/WebKitSupport/DumpRenderTreeSupport.cpp
@@ -204,7 +203,7 @@ FILE(GLOB BBWebKit_HEADERS "${CMAKE_CURRENT_SOURCE_DIR}/blackberry/Api/*.h")
 
 INSTALL(FILES ${BBWebKit_HEADERS} DESTINATION usr/include/browser/webkit)
 
-IF (ENABLE_DRT)
+IF (NOT PUBLIC_BUILD)
     INSTALL(FILES ${TOOLS_DIR}/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h
             DESTINATION usr/include/browser/webkit)
 ENDIF ()
diff --git a/Source/WebKit/PlatformEfl.cmake b/Source/WebKit/PlatformEfl.cmake
index e1a99e228..a3fd10911 100644
--- a/Source/WebKit/PlatformEfl.cmake
+++ b/Source/WebKit/PlatformEfl.cmake
@@ -85,12 +85,13 @@ ENDIF ()
 
 IF (ENABLE_NOTIFICATIONS)
   LIST(APPEND WebKit_INCLUDE_DIRECTORIES
-    "${WEBCORE_DIR}/notifications"
+    "${WEBCORE_DIR}/Modules/notifications"
   )
 ENDIF ()
 
 LIST(APPEND WebKit_SOURCES
     efl/WebCoreSupport/AssertMatchingEnums.cpp
+    efl/WebCoreSupport/BatteryClientEfl.cpp
     efl/WebCoreSupport/ChromeClientEfl.cpp
     efl/WebCoreSupport/DeviceOrientationClientEfl.cpp
     efl/WebCoreSupport/DeviceMotionClientEfl.cpp
@@ -161,7 +162,6 @@ ENDIF ()
 
 IF (ENABLE_BATTERY_STATUS)
     LIST(APPEND WebKit_INCLUDE_DIRECTORIES ${WEBCORE_DIR}/Modules/battery)
-    LIST(APPEND WebKit_SOURCES efl/WebCoreSupport/BatteryClientEfl.cpp)
 ENDIF ()
 
 IF (ENABLE_REGISTER_PROTOCOL_HANDLER)
@@ -293,3 +293,87 @@ INSTALL(FILES ${EWebKit_HEADERS}
 
 INSTALL(FILES ${WebKit_THEME}
         DESTINATION ${DATA_INSTALL_DIR}/themes)
+
+INCLUDE_DIRECTORIES(${THIRDPARTY_DIR}/gtest/include)
+
+SET(EWKUnitTests_LIBRARIES
+    ${JavaScriptCore_LIBRARY_NAME}
+    ${WebCore_LIBRARY_NAME}
+    ${WebKit_LIBRARY_NAME}
+    ${ECORE_LIBRARIES}
+    ${ECORE_EVAS_LIBRARIES}
+    ${EVAS_LIBRARIES}
+    ${EDJE_LIBRARIES}
+)
+
+SET(EWKUnitTests_INCLUDE_DIRECTORIES
+    "${CMAKE_SOURCE_DIR}/Source"
+    "${WEBKIT_DIR}/efl/ewk"
+    "${JAVASCRIPTCORE_DIR}"
+    "${WTF_DIR}"
+    "${WTF_DIR}/wtf"
+    ${ECORE_INCLUDE_DIRS}
+    ${ECORE_EVAS_INCLUDE_DIRS}
+    ${EVAS_INCLUDE_DIRS}
+    ${EDJE_INCLUDE_DIRS}
+)
+
+SET(EWKUnitTests_LINK_FLAGS
+    ${ECORE_LDFLAGS}
+    ${ECORE_EVAS_LDFLAGS}
+    ${EVAS_LDFLAGS}
+    ${EDJE_LDFLAGS}
+)
+
+IF (ENABLE_GLIB_SUPPORT)
+    LIST(APPEND EWKUnitTests_INCLUDE_DIRECTORIES "${WTF_DIR}/wtf/gobject")
+    LIST(APPEND EWKUnitTests_LIBRARIES
+        ${Glib_LIBRARIES}
+        ${Gthread_LIBRARIES}
+    )
+ENDIF ()
+
+SET(DEFAULT_TEST_PAGE_DIR ${CMAKE_SOURCE_DIR}/Source/WebKit/efl/tests/resources)
+
+ADD_DEFINITIONS(-DDEFAULT_TEST_PAGE_DIR=\"${DEFAULT_TEST_PAGE_DIR}\")
+ADD_DEFINITIONS(-DDEFAULT_THEME_PATH=\"${THEME_BINARY_DIR}\")
+
+ADD_LIBRARY(ewkTestUtils
+    ${WEBKIT_DIR}/efl/tests/UnitTestUtils/EWKTestBase.cpp
+    ${WEBKIT_DIR}/efl/tests/UnitTestUtils/EWKTestView.cpp
+)
+TARGET_LINK_LIBRARIES(ewkTestUtils ${EWKUnitTests_LIBRARIES})
+
+SET(WEBKIT_EFL_TEST_DIR "${WEBKIT_DIR}/efl/tests/")
+
+SET(EWKUnitTests_BINARIES
+    test_ewk_view
+)
+
+FOREACH(testName ${EWKUnitTests_BINARIES})
+    ADD_EXECUTABLE(${testName} ${WEBKIT_EFL_TEST_DIR}/${testName}.cpp ${WEBKIT_EFL_TEST_DIR}/test_runner.cpp)
+    ADD_TEST(${testName} ${CMAKE_RUNTIME_OUTPUT_DIRECTORY}/${testName})
+    TARGET_LINK_LIBRARIES(${testName} ${EWKUnitTests_LIBRARIES} ewkTestUtils gtest pthread)
+    ADD_TARGET_PROPERTIES(${testName} LINK_FLAGS "${EWKUnitTests_LINK_FLAGS}")
+    SET_TARGET_PROPERTIES(${testName} PROPERTIES FOLDER "WebKit")
+ENDFOREACH()
+
+IF (ENABLE_INSPECTOR)
+    SET(WEB_INSPECTOR_DIR ${CMAKE_BINARY_DIR}/WebKit/efl/webinspector)
+    ADD_DEFINITIONS(-DWEB_INSPECTOR_DIR="${WEB_INSPECTOR_DIR}")
+    ADD_DEFINITIONS(-DWEB_INSPECTOR_INSTALL_DIR="${CMAKE_INSTALL_PREFIX}/${DATA_INSTALL_DIR}/webinspector")
+    ADD_CUSTOM_TARGET(
+        web-inspector-resources ALL
+        COMMAND ${CMAKE_COMMAND} -E copy_directory ${WEBCORE_DIR}/inspector/front-end ${WEB_INSPECTOR_DIR}
+        COMMAND ${CMAKE_COMMAND} -E copy ${WEBCORE_DIR}/English.lproj/localizedStrings.js ${WEB_INSPECTOR_DIR}
+        COMMAND ${CMAKE_COMMAND} -E copy ${DERIVED_SOURCES_WEBCORE_DIR}/InspectorBackendCommands.js ${WEB_INSPECTOR_DIR}/InspectorBackendCommands.js
+        DEPENDS ${WebCore_LIBRARY_NAME}
+    )
+    INSTALL(DIRECTORY ${WEB_INSPECTOR_DIR}
+        DESTINATION ${CMAKE_INSTALL_PREFIX}/${DATA_INSTALL_DIR}
+        FILES_MATCHING PATTERN "*.js"
+                       PATTERN "*.html"
+                       PATTERN "*.css"
+                       PATTERN "*.gif"
+                       PATTERN "*.png")
+ENDIF ()
diff --git a/Source/WebKit/WebKit1.pri b/Source/WebKit/WebKit1.pri
index 69a2842b2..cf5b2be88 100644
--- a/Source/WebKit/WebKit1.pri
+++ b/Source/WebKit/WebKit1.pri
@@ -27,7 +27,7 @@ contains(DEFINES, ENABLE_VIDEO=1):contains(DEFINES, WTF_USE_QTKIT=1) {
     }
 }
 
-contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1) || contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
+contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1)|contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
     haveQt(5) {
         QT += sensors
     } else {
diff --git a/Source/WebKit/WebKit1.pro b/Source/WebKit/WebKit1.pro
index fce809cf5..b8f54b1f5 100644
--- a/Source/WebKit/WebKit1.pro
+++ b/Source/WebKit/WebKit1.pro
@@ -7,8 +7,6 @@
 TEMPLATE = lib
 TARGET = WebKit1
 
-load(features)
-
 include(WebKit1.pri)
 
 WEBKIT += wtf javascriptcore webcore
diff --git a/Source/WebKit/blackberry/Api/BackingStore.cpp b/Source/WebKit/blackberry/Api/BackingStore.cpp
index a7e50679d..beb09c2c4 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.cpp
+++ b/Source/WebKit/blackberry/Api/BackingStore.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010, 2011 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2009, 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -1159,8 +1159,11 @@ void BackingStorePrivate::blitVisibleContents(bool force)
 {
     // Blitting must never happen for direct rendering case.
     ASSERT(!shouldDirectRenderingToWindow());
-    if (shouldDirectRenderingToWindow())
+    if (shouldDirectRenderingToWindow()) {
+        BlackBerry::Platform::logAlways(BlackBerry::Platform::LogLevelCritical,
+            "BackingStore::blitVisibleContents operation not supported in direct rendering mode");
         return;
+    }
 
     if (m_suspendScreenUpdates) {
         // Avoid client going into busy loop while updates suspended.
@@ -2806,6 +2809,11 @@ void BackingStore::setScrollingOrZooming(bool scrollingOrZooming)
     d->setScrollingOrZooming(scrollingOrZooming);
 }
 
+void BackingStore::blitVisibleContents()
+{
+    d->blitVisibleContents(false /*force*/);
+}
+
 void BackingStore::blitContents(const BlackBerry::Platform::IntRect& dstRect, const BlackBerry::Platform::IntRect& contents)
 {
     // Blitting during direct rendering is not supported.
diff --git a/Source/WebKit/blackberry/Api/BackingStore.h b/Source/WebKit/blackberry/Api/BackingStore.h
index b52a182cb..6ac9c38fa 100644
--- a/Source/WebKit/blackberry/Api/BackingStore.h
+++ b/Source/WebKit/blackberry/Api/BackingStore.h
@@ -59,6 +59,7 @@ public:
     bool isScrollingOrZooming() const;
     void setScrollingOrZooming(bool);
 
+    void blitVisibleContents();
     void blitContents(const BlackBerry::Platform::IntRect& dstRect, const BlackBerry::Platform::IntRect& contents);
     void repaint(int x, int y, int width, int height, bool contentChanged, bool immediate);
 
diff --git a/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
index 3a6033a5a..d6ec87fe2 100644
--- a/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
+++ b/Source/WebKit/blackberry/Api/BlackBerryGlobal.cpp
@@ -60,8 +60,10 @@ void globalInitialize()
     blackberryDebugInitialize();
 #endif
 
+#if !LOG_DISABLED
     // Turn on logging.
     initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
 
     // Initialize threading/
     JSC::initializeThreading();
@@ -105,7 +107,10 @@ void clearMemoryCaches()
     BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchMessage(BlackBerry::Platform::createFunctionCallMessage(clearMemoryCachesInCompositingThread));
 #endif
 
-    collectJavascriptGarbageNow();
+    {
+        JSC::JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
+        collectJavascriptGarbageNow();
+    }
 
     // Clean caches after JS garbage collection because JS GC can
     // generate more dead resources.
diff --git a/Source/WebKit/blackberry/Api/WebPage.cpp b/Source/WebKit/blackberry/Api/WebPage.cpp
index a37826baf..e318003b4 100644
--- a/Source/WebKit/blackberry/Api/WebPage.cpp
+++ b/Source/WebKit/blackberry/Api/WebPage.cpp
@@ -48,13 +48,13 @@
 #include "DragClientBlackBerry.h"
 // FIXME: We should be using DumpRenderTreeClient, but I'm not sure where we should
 // create the DRT_BB object. See PR #120355.
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
 #include "DumpRenderTreeBlackBerry.h"
 #endif
 #include "EditorClientBlackBerry.h"
 #include "FocusController.h"
 #include "FrameLoaderClientBlackBerry.h"
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
 #include "GeolocationClientMock.h"
 #endif
 #include "GeolocationControllerClientBlackBerry.h"
@@ -157,6 +157,7 @@
 #include <BlackBerryPlatformSettings.h>
 #include <JavaScriptCore/APICast.h>
 #include <JavaScriptCore/JSContextRef.h>
+#include <JavaScriptCore/JSStringRef.h>
 #include <SharedPointer.h>
 #include <sys/keycodes.h>
 #include <unicode/ustring.h> // platform ICU
@@ -371,8 +372,9 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_touchEventModePriorGoingFullScreen(ProcessedTouchEvents)
 #endif
 #endif
-#if ENABLE(FULLSCREEN_API)
-    , m_xScrollOffsetPriorGoingFullScreen(-1)
+#if ENABLE(FULLSCREEN_API) && ENABLE(VIDEO)
+    , m_scaleBeforeFullScreen(-1.0)
+    , m_xScrollOffsetBeforeFullScreen(-1)
 #endif
     , m_currentCursor(Platform::CursorNone)
     , m_dumpRenderTree(0) // Lazy initialization.
@@ -395,13 +397,13 @@ WebPagePrivate::WebPagePrivate(WebPage* webPage, WebPageClient* client, const In
     , m_needsCommit(false)
     , m_suspendRootLayerCommit(false)
 #endif
+    , m_hasPendingSurfaceSizeChange(false)
     , m_pendingOrientation(-1)
     , m_fullscreenVideoNode(0)
     , m_hasInRegionScrollableAreas(false)
     , m_updateDelegatedOverlaysDispatched(false)
     , m_deferredTasksTimer(this, &WebPagePrivate::deferredTasksTimerFired)
     , m_selectPopup(0)
-    , m_parentPopup(0)
     , m_autofillManager(AutofillManager::create(this))
 {
     static bool isInitialized = false;
@@ -451,10 +453,15 @@ WebPagePrivate::~WebPagePrivate()
     delete m_touchEventHandler;
     m_touchEventHandler = 0;
 
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     delete m_dumpRenderTree;
     m_dumpRenderTree = 0;
 #endif
+
+#if USE(ACCELERATED_COMPOSITING)
+    deleteGuardedObject(m_selectionOverlay);
+    m_selectionOverlay = 0;
+#endif
 }
 
 WebPage::~WebPage()
@@ -495,7 +502,7 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     pageClients.inspectorClient = inspectorClient;
 
     m_page = new Page(pageClients);
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (getenv("drtRun")) {
         // In case running in DumpRenderTree mode set the controller to mock provider.
         GeolocationClientMock* mock = new GeolocationClientMock();
@@ -560,7 +567,6 @@ void WebPagePrivate::init(const WebString& pageGroupName)
     m_page->settings()->setTextReflowEnabled(m_webSettings->textReflowMode() == WebSettings::TextReflowEnabled);
 #endif
 
-    m_page->settings()->setUseHixie76WebSocketProtocol(false);
     m_page->settings()->setInteractiveFormValidationEnabled(true);
     m_page->settings()->setAllowUniversalAccessFromFileURLs(false);
     m_page->settings()->setAllowFileAccessFromFileURLs(false);
@@ -842,6 +848,93 @@ bool WebPage::executeJavaScriptInIsolatedWorld(const char* script, JavaScriptDat
     return d->executeJavaScriptInIsolatedWorld(sourceCode, returnType, returnValue);
 }
 
+bool WebPage::executeJavaScriptFunction(const std::vector<std::string> &function, const std::vector<std::string> &args, JavaScriptDataType& returnType, WebString& returnValue)
+{
+    if (!d->m_mainFrame)
+        return false;
+    JSC::Bindings::RootObject* root = d->m_mainFrame->script()->bindingRootObject();
+    if (!root)
+        return false;
+    JSC::ExecState* exec = root->globalObject()->globalExec();
+    JSGlobalContextRef ctx = toGlobalRef(exec);
+
+    WTF::Vector<JSStringRef> argList(args.size());
+    WTF::Vector<JSValueRef> argListRef(args.size());
+    for (unsigned i = 0; i < args.size(); ++i) {
+        JSStringRef str = JSStringCreateWithUTF8CString(args[i].c_str());
+        argList[i] = str;
+        JSValueRef strRef = JSValueMakeString(ctx, str);
+        argListRef[i] = strRef;
+    }
+
+    JSValueRef windowObjectValue = windowObject();
+    JSObjectRef obj = JSValueToObject(ctx, windowObjectValue, 0);
+    JSObjectRef thisObject = obj;
+    for (unsigned i = 0; i < function.size(); ++i) {
+        JSStringRef str = JSStringCreateWithUTF8CString(function[i].c_str());
+        thisObject = obj;
+        obj = JSValueToObject(ctx, JSObjectGetProperty(ctx, obj, str, 0), 0);
+        JSStringRelease(str);
+        if (!obj)
+            break;
+    }
+
+    JSObjectRef functionObject = obj;
+    JSValueRef result = 0;
+    JSValueRef exception;
+    if (functionObject && thisObject)
+        result = JSObjectCallAsFunction(ctx, functionObject, thisObject, args.size(), argListRef.data(), &exception);
+
+    for (unsigned i = 0; i < args.size(); ++i)
+        JSStringRelease(argList[i]);
+
+    JSC::JSValue value = toJS(exec, result);
+
+    if (!value) {
+        returnType = JSException;
+        JSStringRef stringRef = JSValueToStringCopy(ctx, exception, 0);
+        size_t bufferSize = JSStringGetMaximumUTF8CStringSize(stringRef);
+        WTF::Vector<char> buffer(bufferSize);
+        JSStringGetUTF8CString(stringRef, buffer.data(), bufferSize);
+        returnValue = WebString::fromUtf8(buffer.data());
+        return false;
+    }
+
+    JSType type = JSValueGetType(ctx, result);
+
+    switch (type) {
+    case kJSTypeNull:
+        returnType = JSNull;
+        break;
+    case kJSTypeBoolean:
+        returnType = JSBoolean;
+        break;
+    case kJSTypeNumber:
+        returnType = JSNumber;
+        break;
+    case kJSTypeString:
+        returnType = JSString;
+        break;
+    case kJSTypeObject:
+        returnType = JSObject;
+        break;
+    case kJSTypeUndefined:
+    default:
+        returnType = JSUndefined;
+        break;
+    }
+
+    if (returnType == JSBoolean || returnType == JSNumber || returnType == JSString || returnType == JSObject) {
+        JSStringRef stringRef = JSValueToStringCopy(ctx, result, 0);
+        size_t bufferSize = JSStringGetMaximumUTF8CStringSize(stringRef);
+        WTF::Vector<char> buffer(bufferSize);
+        JSStringGetUTF8CString(stringRef, buffer.data(), bufferSize);
+        returnValue = WebString::fromUtf8(buffer.data());
+    }
+
+    return true;
+}
+
 void WebPagePrivate::stopCurrentLoad()
 {
     // This function should contain all common code triggered by WebPage::load
@@ -960,6 +1053,9 @@ void WebPagePrivate::setLoadState(LoadState state)
                     Platform::createMethodCallMessage(&WebPagePrivate::destroyLayerResources, this));
             }
 #endif
+            // Suspend screen update to avoid ui thread blitting while resetting backingstore.
+            m_backingStore->d->suspendScreenAndBackingStoreUpdates();
+
             m_previousContentsSize = IntSize();
             m_backingStore->d->resetRenderQueue();
             m_backingStore->d->resetTiles(true /* resetBackground */);
@@ -1031,6 +1127,8 @@ void WebPagePrivate::setLoadState(LoadState state)
             setScrollPosition(IntPoint::zero());
             notifyTransformedScrollChanged();
 
+            m_backingStore->d->resumeScreenAndBackingStoreUpdates(BackingStore::None);
+
             // Paints the visible backingstore as white. Note it is important we do
             // this strictly after re-setting the scroll position to origin and resetting
             // the scales otherwise the visible contents calculation is wrong and we
@@ -1319,7 +1417,16 @@ void WebPage::setScrollPosition(const Platform::IntPoint& point)
         d->m_userPerformedManualScroll = true;
 
     d->m_backingStoreClient->setIsClientGeneratedScroll(true);
+
+    // UI thread can call BackingStorePrivate::setScrollingOrZooming(false) before WebKit thread calls WebPage::setScrollPosition(),
+    // in which case it will set ScrollableArea::m_constrainsScrollingToContentEdge to true earlier.
+    // We can cache ScrollableArea::m_constrainsScrollingToContentEdge and always set it to false before we set scroll position in
+    // WebKit thread to avoid scroll position clamping during scrolling, and restore it to what it was after that.
+    bool constrainsScrollingToContentEdge = d->m_mainFrame->view()->constrainsScrollingToContentEdge();
+    d->m_mainFrame->view()->setConstrainsScrollingToContentEdge(false);
     d->setScrollPosition(d->mapFromTransformed(point));
+    d->m_mainFrame->view()->setConstrainsScrollingToContentEdge(constrainsScrollingToContentEdge);
+
     d->m_backingStoreClient->setIsClientGeneratedScroll(false);
 }
 
@@ -1638,12 +1745,13 @@ void WebPagePrivate::layoutFinished()
 
 bool WebPagePrivate::shouldZoomToInitialScaleOnLoad() const
 {
-    // For FrameLoadTypeSame load, the first layout timer can be fired after the load Finished state. We should
-    // zoom to initial scale for this case as well, otherwise the scale of the web page can be incorrect.
+    // For FrameLoadTypeSame or FrameLoadTypeStandard load, the layout timer can be fired which can call dispatchDidFirstVisuallyNonEmptyLayout()
+    // after the load Finished state, in which case the web page will have no chance to zoom to initial scale. So we should give it a chance,
+    // otherwise the scale of the web page can be incorrect.
     FrameLoadType frameLoadType = FrameLoadTypeStandard;
     if (m_mainFrame && m_mainFrame->loader())
         frameLoadType = m_mainFrame->loader()->loadType();
-    if (m_loadState == Committed || (m_loadState == Finished && frameLoadType == FrameLoadTypeSame))
+    if (m_loadState == Committed || (m_loadState == Finished && (frameLoadType == FrameLoadTypeSame || frameLoadType == FrameLoadTypeStandard)))
         return true;
     return false;
 }
@@ -2208,7 +2316,7 @@ bool WebPagePrivate::authenticationChallenge(const KURL& url, const ProtectionSp
     WebString username;
     WebString password;
 
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_dumpRenderTree)
         return m_dumpRenderTree->didReceiveAuthenticationChallenge(inputCredential);
 #endif
@@ -3437,10 +3545,17 @@ IntSize WebPagePrivate::recomputeVirtualViewportFromViewportArguments()
     int desktopWidth = defaultMaxLayoutSize().width();
     int deviceWidth = Platform::Graphics::Screen::primaryScreen()->width();
     int deviceHeight = Platform::Graphics::Screen::primaryScreen()->height();
-    FloatSize currentPPI = Platform::Graphics::Screen::primaryScreen()->pixelsPerInch(-1);
-    int deviceDPI = int(roundf((currentPPI.width() + currentPPI.height()) / 2));
-    ViewportAttributes result = computeViewportAttributes(m_viewportArguments, desktopWidth, deviceWidth, deviceHeight, deviceDPI, m_defaultLayoutSize);
+    ViewportAttributes result = computeViewportAttributes(m_viewportArguments, desktopWidth, deviceWidth, deviceHeight, m_webSettings->devicePixelRatio(), m_defaultLayoutSize);
     m_page->setDeviceScaleFactor(result.devicePixelRatio);
+
+    setUserScalable(m_userScalable && result.userScalable);
+    if (result.initialScale > 0)
+        setInitialScale(result.initialScale * result.devicePixelRatio);
+    if (result.minimumScale > 0)
+        setMinimumScale(result.minimumScale * result.devicePixelRatio);
+    if (result.maximumScale > 0)
+        setMaximumScale(result.maximumScale * result.devicePixelRatio);
+
     return IntSize(result.layoutSize.width(), result.layoutSize.height());
 }
 
@@ -3483,14 +3598,6 @@ void WebPagePrivate::dispatchViewportPropertiesDidChange(const ViewportArguments
     if (!m_viewportArguments.height)
         m_viewportArguments.height = ViewportArguments::ValueDeviceHeight;
 
-    setUserScalable(arguments.userScalable == ViewportArguments::ValueAuto ? true : arguments.userScalable);
-    if (arguments.initialScale > 0)
-        setInitialScale(arguments.initialScale);
-    if (arguments.minimumScale > 0)
-        setMinimumScale(arguments.minimumScale);
-    if (arguments.maximumScale > 0)
-        setMaximumScale(arguments.maximumScale);
-
     IntSize virtualViewport = recomputeVirtualViewportFromViewportArguments();
     m_webPage->setVirtualViewportSize(virtualViewport.width(), virtualViewport.height());
 
@@ -3586,6 +3693,12 @@ void WebPagePrivate::setScreenOrientation(int orientation)
 void WebPage::setScreenOrientation(int orientation)
 {
     d->m_pendingOrientation = orientation;
+    d->m_hasPendingSurfaceSizeChange = true;
+}
+
+void WebPage::setHasPendingSurfaceSizeChange()
+{
+    d->m_hasPendingSurfaceSizeChange = true;
 }
 
 void WebPage::applyPendingOrientationIfNeeded()
@@ -3594,7 +3707,7 @@ void WebPage::applyPendingOrientationIfNeeded()
         d->setScreenOrientation(d->m_pendingOrientation);
 }
 
-void WebPagePrivate::screenRotated()
+void WebPagePrivate::resizeSurfaceIfNeeded()
 {
     // This call will cause the client to reallocate the window buffer to new size,
     // which needs to be serialized with usage of the window buffer. Accomplish
@@ -3602,17 +3715,19 @@ void WebPagePrivate::screenRotated()
     // the window buffer happens on the compositing thread.
     if (!Platform::userInterfaceThreadMessageClient()->isCurrentThread()) {
         Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(
-            Platform::createMethodCallMessage(&WebPagePrivate::screenRotated, this));
+            Platform::createMethodCallMessage(&WebPagePrivate::resizeSurfaceIfNeeded, this));
         return;
     }
 
-    SurfacePool::globalSurfacePool()->notifyScreenRotated();
-    m_client->notifyScreenRotated();
+    if (m_pendingOrientation != -1)
+        SurfacePool::globalSurfacePool()->notifyScreenRotated();
+
+    m_client->resizeSurfaceIfNeeded();
 }
 
 void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize, bool ensureFocusElementVisible)
 {
-    if (m_pendingOrientation == -1 && transformedActualVisibleSize == this->transformedActualVisibleSize())
+    if (m_pendingOrientation == -1 && !m_hasPendingSurfaceSizeChange && transformedActualVisibleSize == this->transformedActualVisibleSize())
         return;
 
     // Suspend all screen updates to the backingstore to make sure no-one tries to blit
@@ -3626,11 +3741,13 @@ void WebPagePrivate::setViewportSize(const IntSize& transformedActualVisibleSize
         setShouldResetTilesWhenShown(true);
 
     bool needsLayout = false;
-
     bool hasPendingOrientation = m_pendingOrientation != -1;
-    if (hasPendingOrientation)
-        screenRotated();
-    else {
+
+    if (m_hasPendingSurfaceSizeChange) {
+        resizeSurfaceIfNeeded();
+        m_hasPendingSurfaceSizeChange = false;
+    }
+    if (!hasPendingOrientation) {
         // If we are not rotating and we've started a viewport resize with
         // the Render tree in dirty state (i.e. it needs layout), lets
         // reset the needsLayout flag for now but set our own 'needsLayout'.
@@ -5142,7 +5259,7 @@ bool WebPage::findNextString(const char* text, bool forward, bool caseSensitive,
 
 void WebPage::runLayoutTests()
 {
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     // FIXME: do we need API to toggle this?
     d->m_page->settings()->setDeveloperExtrasEnabled(true);
 
@@ -5333,6 +5450,7 @@ void WebPage::clearBrowsingData()
 void WebPage::clearHistory()
 {
     // Don't clear the back-forward list as we might like to keep it.
+    PageGroup::removeAllVisitedLinks();
 }
 
 void WebPage::clearCookies()
@@ -6057,7 +6175,7 @@ void WebPagePrivate::destroyCompositor()
 {
     // m_compositor is a RefPtr, so it may live on beyond this point.
     // Disconnect the compositor from us
-    m_compositor->setPage(0);
+    m_compositor->detach();
     m_compositor.clear();
     m_ownedContext.clear();
 }
@@ -6208,13 +6326,18 @@ void WebPagePrivate::enterFullScreenForElement(Element* element)
         // we temporarily scroll the WebPage to x:0 so that the wrapper gets properly
         // positioned. The original scroll position is restored once element leaves fullscreen.
         WebCore::IntPoint scrollPosition = m_mainFrame->view()->scrollPosition();
-        m_xScrollOffsetPriorGoingFullScreen = scrollPosition.x();
+        m_xScrollOffsetBeforeFullScreen = scrollPosition.x();
         m_mainFrame->view()->setScrollPosition(WebCore::IntPoint(0, scrollPosition.y()));
 
 #if ENABLE(EVENT_MODE_METATAGS)
         m_touchEventModePriorGoingFullScreen = m_touchEventMode;
         didReceiveTouchEventMode(PureTouchEventsWithMouseConversion);
 #endif
+        // The current scale can be clamped to a greater minimum scale when we relayout contents during
+        // the change of the viewport size. Cache the current scale so that we can restore it when
+        // leaving fullscreen. Otherwise, it is possible that we will use the wrong scale.
+        m_scaleBeforeFullScreen = currentScale();
+
         // No fullscreen video widget has been made available by the Browser
         // chrome, or this is not a video element. The webkitRequestFullScreen
         // Javascript call is often made on a div element.
@@ -6236,16 +6359,27 @@ void WebPagePrivate::exitFullScreenForElement(Element* element)
         exitFullscreenForNode(element);
     } else {
         // When leaving fullscreen mode, we need to restore the 'x' scroll position
-        // prior going full screen.
+        // before fullscreen.
+        // FIXME: We may need to respect 'y' position as well, because the web page always scrolls to
+        // the top when leaving fullscreen mode.
         WebCore::IntPoint scrollPosition = m_mainFrame->view()->scrollPosition();
         m_mainFrame->view()->setScrollPosition(
-            WebCore::IntPoint(m_xScrollOffsetPriorGoingFullScreen, scrollPosition.y()));
-        m_xScrollOffsetPriorGoingFullScreen = -1;
+            WebCore::IntPoint(m_xScrollOffsetBeforeFullScreen, scrollPosition.y()));
+        m_xScrollOffsetBeforeFullScreen = -1;
 
 #if ENABLE(EVENT_MODE_METATAGS)
         didReceiveTouchEventMode(m_touchEventModePriorGoingFullScreen);
         m_touchEventModePriorGoingFullScreen = ProcessedTouchEvents;
 #endif
+        if (m_scaleBeforeFullScreen > 0) {
+            // Restore the scale when leaving fullscreen. We can't use TransformationMatrix::scale(double) here, as it
+            // will multiply the scale rather than set the scale.
+            // FIXME: We can refactor this into setCurrentScale(double) if it is useful in the future.
+            m_transformationMatrix->setM11(m_scaleBeforeFullScreen);
+            m_transformationMatrix->setM22(m_scaleBeforeFullScreen);
+            m_scaleBeforeFullScreen = -1.0;
+        }
+
         // This is where we would restore the browser's chrome
         // if hidden above.
         client()->fullscreenStop();
@@ -6460,7 +6594,7 @@ void WebPage::setTapHighlight(WebTapHighlight* tapHighlight)
 
 WebSelectionOverlay* WebPage::selectionOverlay() const
 {
-    return d->m_selectionOverlay.get();
+    return d->m_selectionOverlay;
 }
 
 void WebPage::addOverlay(WebOverlay* overlay)
@@ -6530,11 +6664,6 @@ PagePopupBlackBerry* WebPage::popup()
     return d->m_selectPopup;
 }
 
-void WebPagePrivate::setParentPopup(PagePopupBlackBerry* webPopup)
-{
-    m_parentPopup = webPopup;
-}
-
 void WebPagePrivate::setInspectorOverlayClient(WebCore::InspectorOverlay::InspectorOverlayClient* inspectorOverlayClient)
 {
     if (inspectorOverlayClient) {
@@ -6553,5 +6682,17 @@ void WebPagePrivate::setInspectorOverlayClient(WebCore::InspectorOverlay::Inspec
     }
 }
 
+void WebPagePrivate::applySizeOverride(int overrideWidth, int overrideHeight)
+{
+    m_client->requestUpdateViewport(overrideWidth, overrideHeight);
+}
+
+void WebPagePrivate::setTextZoomFactor(float textZoomFactor)
+{
+    if (!m_mainFrame)
+        return;
+
+    m_mainFrame->setTextZoomFactor(textZoomFactor);
+}
 }
 }
diff --git a/Source/WebKit/blackberry/Api/WebPage.h b/Source/WebKit/blackberry/Api/WebPage.h
index 54fdc9a5c..026349317 100644
--- a/Source/WebKit/blackberry/Api/WebPage.h
+++ b/Source/WebKit/blackberry/Api/WebPage.h
@@ -27,6 +27,8 @@
 #include <BlackBerryPlatformWebContext.h>
 #include <imf/input_data.h>
 #include <network/NetworkRequest.h>
+#include <string>
+#include <vector>
 
 struct OpaqueJSContext;
 typedef const struct OpaqueJSContext* JSContextRef;
@@ -103,6 +105,8 @@ public:
     // Takes a UTF16 encoded script that is used explicitly by the pattern matching code
     bool executeJavaScriptInIsolatedWorld(const std::wstring& script, JavaScriptDataType& returnType, WebString& returnValue);
 
+    bool executeJavaScriptFunction(const std::vector<std::string> &script, const std::vector<std::string> &args, JavaScriptDataType& returnType, WebString& returnValue);
+
     void initializeIconDataBase();
 
     void stopLoading();
@@ -121,6 +125,7 @@ public:
     bool isVisible() const;
 
     void setScreenOrientation(int);
+    void setHasPendingSurfaceSizeChange();
     void applyPendingOrientationIfNeeded();
 
     Platform::IntSize viewportSize() const;
diff --git a/Source/WebKit/blackberry/Api/WebPageClient.h b/Source/WebKit/blackberry/Api/WebPageClient.h
index 0a581421b..8ba09dd0a 100644
--- a/Source/WebKit/blackberry/Api/WebPageClient.h
+++ b/Source/WebKit/blackberry/Api/WebPageClient.h
@@ -126,12 +126,14 @@ public:
     virtual void scrollChanged(const Platform::IntPoint&) const = 0;
     virtual void zoomChanged(bool isMinZoomed, bool isMaxZoomed, bool isAtInitialZoom, double newZoom) const = 0;
 
+    virtual void requestUpdateViewport(int width, int height) = 0;
+
     virtual void setPageTitle(const unsigned short* title, unsigned titleLength) = 0;
 
     virtual Platform::Graphics::Window* window() const = 0;
 
     virtual void notifyContentRendered(const Platform::IntRect&) = 0;
-    virtual void notifyScreenRotated() = 0;
+    virtual void resizeSurfaceIfNeeded() = 0;
 
     virtual void inputFocusGained(Platform::BlackBerryInputType, int inputStyle) = 0;
     virtual void inputFocusLost() = 0;
diff --git a/Source/WebKit/blackberry/Api/WebPageCompositor.cpp b/Source/WebKit/blackberry/Api/WebPageCompositor.cpp
index fa4ad3bfc..6e50f17c1 100644
--- a/Source/WebKit/blackberry/Api/WebPageCompositor.cpp
+++ b/Source/WebKit/blackberry/Api/WebPageCompositor.cpp
@@ -47,12 +47,29 @@ WebPageCompositorPrivate::WebPageCompositorPrivate(WebPagePrivate* page, WebPage
     , m_webPage(page)
     , m_drawsRootLayer(false)
 {
+    ASSERT(m_webPage);
     setOneShot(true); // one-shot animation client
 }
 
 WebPageCompositorPrivate::~WebPageCompositorPrivate()
 {
-    Platform::AnimationFrameRateController::instance()->removeClient(this);
+    detach();
+}
+
+void WebPageCompositorPrivate::detach()
+{
+    if (m_webPage)
+        Platform::AnimationFrameRateController::instance()->removeClient(this);
+    m_webPage = 0;
+}
+
+void WebPageCompositorPrivate::setPage(WebPagePrivate *p)
+{
+    if (p == m_webPage)
+        return;
+    ASSERT(p);
+    ASSERT(m_webPage); // if this is null, we have a bug and we need to re-add.
+    m_webPage = p;
 }
 
 void WebPageCompositorPrivate::setContext(Platform::Graphics::GLES2Context* context)
diff --git a/Source/WebKit/blackberry/Api/WebPageCompositor_p.h b/Source/WebKit/blackberry/Api/WebPageCompositor_p.h
index b7c6bd14b..4aeff36d9 100644
--- a/Source/WebKit/blackberry/Api/WebPageCompositor_p.h
+++ b/Source/WebKit/blackberry/Api/WebPageCompositor_p.h
@@ -90,7 +90,8 @@ public:
     void releaseLayerResources();
 
     WebPagePrivate* page() const { return m_webPage; }
-    void setPage(WebPagePrivate* page) { m_webPage = page; }
+    void setPage(WebPagePrivate* page);
+    void detach();
     WebPageCompositorClient* client() const { return m_client; }
     void compositorDestroyed();
 
diff --git a/Source/WebKit/blackberry/Api/WebPage_p.h b/Source/WebKit/blackberry/Api/WebPage_p.h
index 9b2ee701a..a0ffce066 100644
--- a/Source/WebKit/blackberry/Api/WebPage_p.h
+++ b/Source/WebKit/blackberry/Api/WebPage_p.h
@@ -358,7 +358,7 @@ public:
     // Scroll and/or zoom so that the WebPage fits the new actual
     // visible size.
     void setViewportSize(const WebCore::IntSize& transformedActualVisibleSize, bool ensureFocusElementVisible);
-    void screenRotated(); // Helper method for setViewportSize().
+    void resizeSurfaceIfNeeded(); // Helper method for setViewportSize().
 
     void scheduleDeferrableTimer(WebCore::Timer<WebPagePrivate>*, double timeOut);
     void unscheduleAllDeferrableTimers();
@@ -440,6 +440,9 @@ public:
 
     void setInspectorOverlayClient(WebCore::InspectorOverlay::InspectorOverlayClient*);
 
+    void applySizeOverride(int overrideWidth, int overrideHeight);
+    void setTextZoomFactor(float);
+
     WebPage* m_webPage;
     WebPageClient* m_client;
     WebCore::Page* m_page;
@@ -447,7 +450,7 @@ public:
     RefPtr<WebCore::Node> m_currentContextNode;
     WebSettings* m_webSettings;
     OwnPtr<WebTapHighlight> m_tapHighlight;
-    OwnPtr<WebSelectionOverlay> m_selectionOverlay;
+    WebSelectionOverlay* m_selectionOverlay;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     OwnPtr<WebCore::JavaScriptDebuggerBlackBerry> m_scriptDebugger;
@@ -498,7 +501,10 @@ public:
 #if ENABLE(EVENT_MODE_METATAGS)
     WebCore::TouchEventMode m_touchEventModePriorGoingFullScreen;
 #endif
-    int m_xScrollOffsetPriorGoingFullScreen;
+#if ENABLE(VIDEO)
+    double m_scaleBeforeFullScreen;
+    int m_xScrollOffsetBeforeFullScreen;
+#endif
 #endif
 
     Platform::BlackBerryCursor m_currentCursor;
@@ -556,6 +562,7 @@ public:
     bool m_suspendRootLayerCommit;
 #endif
 
+    bool m_hasPendingSurfaceSizeChange;
     int m_pendingOrientation;
 
     RefPtr<WebCore::Node> m_fullscreenVideoNode;
@@ -615,8 +622,6 @@ public:
 
     // The popup that opened in this webpage
     WebCore::PagePopupBlackBerry* m_selectPopup;
-    // The popup that owned this webpage
-    WebCore::PagePopupBlackBerry* m_parentPopup;
 
     RefPtr<WebCore::AutofillManager> m_autofillManager;
 protected:
diff --git a/Source/WebKit/blackberry/Api/WebSelectionOverlay.h b/Source/WebKit/blackberry/Api/WebSelectionOverlay.h
index 5858edf71..6deec358d 100644
--- a/Source/WebKit/blackberry/Api/WebSelectionOverlay.h
+++ b/Source/WebKit/blackberry/Api/WebSelectionOverlay.h
@@ -21,12 +21,13 @@
 
 #include "BlackBerryGlobal.h"
 
+#include <BlackBerryPlatformGuardedPointer.h>
 #include <BlackBerryPlatformIntRectRegion.h>
 
 namespace BlackBerry {
 namespace WebKit {
 
-class BLACKBERRY_EXPORT WebSelectionOverlay {
+class BLACKBERRY_EXPORT WebSelectionOverlay : public BlackBerry::Platform::GuardedPointerBase {
 public:
     virtual ~WebSelectionOverlay() { }
 
diff --git a/Source/WebKit/blackberry/Api/WebSettings.cpp b/Source/WebKit/blackberry/Api/WebSettings.cpp
index 5996c6ab1..0cf36cc69 100644
--- a/Source/WebKit/blackberry/Api/WebSettings.cpp
+++ b/Source/WebKit/blackberry/Api/WebSettings.cpp
@@ -24,9 +24,13 @@
 
 #include "WebString.h"
 #include <Base64.h>
+#include <BlackBerryPlatformDeviceInfo.h>
 #include <BlackBerryPlatformFontInfo.h>
+#include <BlackBerryPlatformScreen.h>
 #include <Color.h>
+#include <FloatSize.h>
 #include <PageCache.h>
+#include <ViewportArguments.h>
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 
@@ -58,6 +62,7 @@ DEFINE_STATIC_LOCAL(String, BlackBerryZoomToFitOnLoadEnabled, ("BlackBerryZoomTo
 DEFINE_STATIC_LOCAL(String, BlackBerryFullScreenVideoCapable, ("BlackBerryFullScreenVideoCapable"));
 DEFINE_STATIC_LOCAL(String, BlackBerryCredentialAutofillEnabled, ("BlackBerryCredentialAutofillEnabled"));
 DEFINE_STATIC_LOCAL(String, BlackBerryFormAutofillEnabled, ("BlackBerryFormAutofillEnabled"));
+DEFINE_STATIC_LOCAL(String, BlackBerryDevicePixelRatio, ("BlackBerryDevicePixelRatio"));
 DEFINE_STATIC_LOCAL(String, SpatialNavigationEnabled, ("SpatialNavigationEnabled"));
 DEFINE_STATIC_LOCAL(String, WebKitDatabasePath, ("WebKitDatabasePath"));
 DEFINE_STATIC_LOCAL(String, WebKitDatabasesEnabled, ("WebKitDatabasesEnabled"));
@@ -173,6 +178,13 @@ WebSettings* WebSettings::standardSettings()
     settings->m_private->setBoolean(BlackBerryCredentialAutofillEnabled, false);
     settings->m_private->setBoolean(BlackBerryFormAutofillEnabled, false);
 
+    if (BlackBerry::Platform::DeviceInfo::instance()->isMobile()) {
+        WebCore::FloatSize currentPPI = Platform::Graphics::Screen::primaryScreen()->pixelsPerInch(-1);
+        int deviceDPI = int(roundf((currentPPI.width() + currentPPI.height()) / 2));
+        settings->m_private->setDouble(BlackBerryDevicePixelRatio, deviceDPI / WebCore::ViewportArguments::deprecatedTargetDPI);
+    } else
+        settings->m_private->setDouble(BlackBerryDevicePixelRatio, 1);
+
     settings->m_private->setInteger(WebKitDefaultFontSize, 16);
     settings->m_private->setInteger(WebKitDefaultFixedFontSize, 13);
     settings->m_private->setString(WebKitDefaultTextEncodingName, "iso-8859-1");
@@ -825,5 +837,15 @@ void WebSettings::setFormAutofillEnabled(bool enable)
     return m_private->setBoolean(BlackBerryFormAutofillEnabled, enable);
 }
 
+double WebSettings::devicePixelRatio() const
+{
+    return m_private->getDouble(BlackBerryDevicePixelRatio);
+}
+
+void WebSettings::setDevicePixelRatio(double ratio)
+{
+    m_private->setDouble(BlackBerryDevicePixelRatio, ratio);
+}
+
 } // namespace WebKit
 } // namespace BlackBerry
diff --git a/Source/WebKit/blackberry/Api/WebSettings.h b/Source/WebKit/blackberry/Api/WebSettings.h
index 794b8c607..a1ee57b8a 100644
--- a/Source/WebKit/blackberry/Api/WebSettings.h
+++ b/Source/WebKit/blackberry/Api/WebSettings.h
@@ -237,6 +237,9 @@ public:
     bool isFormAutofillEnabled() const;
     void setFormAutofillEnabled(bool);
 
+    double devicePixelRatio() const;
+    void setDevicePixelRatio(double);
+
 private:
     WebSettingsPrivate* m_private;
     WebSettings();
diff --git a/Source/WebKit/blackberry/Api/WebViewportArguments.cpp b/Source/WebKit/blackberry/Api/WebViewportArguments.cpp
index ab570a975..3275e2847 100644
--- a/Source/WebKit/blackberry/Api/WebViewportArguments.cpp
+++ b/Source/WebKit/blackberry/Api/WebViewportArguments.cpp
@@ -85,12 +85,12 @@ void WebViewportArguments::setHeight(float height)
     d->height = height;
 }
 
-float WebViewportArguments::targetDensityDpi() const
+float WebViewportArguments::devicePixelRatio() const
 {
     return 0;
 }
 
-void WebViewportArguments::setTargetDensityDpi(float)
+void WebViewportArguments::setDevicePixelRatio(float)
 {
 }
 
diff --git a/Source/WebKit/blackberry/Api/WebViewportArguments.h b/Source/WebKit/blackberry/Api/WebViewportArguments.h
index 3120a37a1..e49c25a58 100644
--- a/Source/WebKit/blackberry/Api/WebViewportArguments.h
+++ b/Source/WebKit/blackberry/Api/WebViewportArguments.h
@@ -50,10 +50,6 @@ public:
         ValueDesktopWidth = -2,
         ValueDeviceWidth = -3,
         ValueDeviceHeight = -4,
-        ValueDeviceDPI = -5,
-        ValueLowDPI = -6,
-        ValueMediumDPI = -7,
-        ValueHighDPI = -8
     };
 
     float initialScale() const;
@@ -71,9 +67,8 @@ public:
     float height() const;
     void setHeight(float);
 
-    // FIXME: Can we remove these functions? WebKit no longer supports targetDensityDpi.
-    float targetDensityDpi() const;
-    void setTargetDensityDpi(float);
+    float devicePixelRatio() const;
+    void setDevicePixelRatio(float);
 
     float userScalable() const;
     void setUserScalable(float);
diff --git a/Source/WebKit/blackberry/ChangeLog b/Source/WebKit/blackberry/ChangeLog
index 164a6f887..a7df5802a 100644
--- a/Source/WebKit/blackberry/ChangeLog
+++ b/Source/WebKit/blackberry/ChangeLog
@@ -1,3 +1,510 @@
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::init):
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        LayoutTestController.dumpConfigurationForViewport should move to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=45652
+
+        Reviewed by Eric Seidel.
+
+        * WebKitSupport/DumpRenderTreeSupport.cpp:
+        * WebKitSupport/DumpRenderTreeSupport.h:
+        (DumpRenderTreeSupport):
+
+2012-07-09  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] PagePopupBlackBerry::closePopup() should always clear the pointer in WebPagePrivate
+        https://bugs.webkit.org/show_bug.cgi?id=90817
+
+        Reviewed by Rob Buis.
+
+        PR# 174085.
+        PagePopupBlackBerry::closePopup() should always clear the pointer in WebPagePrivate to avoid crashes.
+        This patch also removes unused variable m_parentPopup and its setter.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate): Remove m_parentPopup.
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::closePagePopup):
+        * WebCoreSupport/PagePopupBlackBerry.cpp:
+        (WebCore::PagePopupBlackBerry::init): Remove the setParentPopup() call.
+        (WebCore::PagePopupBlackBerry::closePopup): Clear the reference in WebPagePrivate.
+        * WebCoreSupport/SelectPopupClient.cpp:
+        (WebCore::SelectPopupClient::setValueAndClosePopup): Add an assert for valid m_element.
+
+2012-07-09  Mike Lattanzio  <mlattanzio@rim.com>
+
+        [BlackBerry] meta viewport initial-scale doesn't factor in device pixel ratio
+        https://bugs.webkit.org/show_bug.cgi?id=90575
+
+        Reviewed by Rob Buis.
+
+        Refactor meta viewport handling to multiply the developer
+        specified scale properties by the devicePixelRatio. This
+        required moving the setting of these values until after
+        the call to computeViewportAttributes.
+
+        This fixes an isssue where content wider than the meta viewport
+        would case a zoom-out-to-fit scenario because we misinterpreted
+        the specified initial-scale.
+
+        New test to verify wide content doesn't affect initial-scale:
+        ManualTests/blackberry/meta-viewport-initial-scale-wide-content.html
+
+        Internal review from Konrad Piascik, Arvid Nilsson.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::recomputeVirtualViewportFromViewportArguments):
+        (BlackBerry::WebKit::WebPagePrivate::dispatchViewportPropertiesDidChange):
+
+2012-07-07  George Staikos  <staikos@webkit.org>
+
+        Detach animation clients properly if we clear the web page pointer.
+        https://bugs.webkit.org/show_bug.cgi?id=90730
+
+        Reviewed by Adam Treat.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::destroyCompositor):
+        * Api/WebPageCompositor.cpp:
+        (BlackBerry::WebKit::WebPageCompositorPrivate::WebPageCompositorPrivate):
+        (BlackBerry::WebKit::WebPageCompositorPrivate::~WebPageCompositorPrivate):
+        (WebKit):
+        (BlackBerry::WebKit::WebPageCompositorPrivate::detach):
+        (BlackBerry::WebKit::WebPageCompositorPrivate::setPage):
+        * Api/WebPageCompositor_p.h:
+        (WebPageCompositorPrivate):
+
+2012-07-06  Max Feil  <mfeil@rim.com>
+
+        [BlackBerry] exitFullScreenForElement() is not working for fullscreen elements in iframes
+        https://bugs.webkit.org/show_bug.cgi?id=90327
+
+        Reviewed by Antonio Gomes.
+
+        Fix exit fullscreen problem for elements in iframes. The
+        exitFullScreenForElement() call is passed a null element in
+        this case, instead of the original element which entered
+        fullscreen. If you look in Document.cpp you can see the
+        exitFullScreenForElement() call being made on the topDocument
+        (which has a null m_fullScreenElement) instead of the iframe's
+        document.
+
+        The Chromium and Windows ports get around this problem by
+        storing either the fullscreen element or its frame during
+        enterFullScreenForElement(), so I will bring the BlackBerry port
+        in line with this. See also bug 89817.
+
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::enterFullScreenForElement):
+        (WebCore::ChromeClientBlackBerry::exitFullScreenForElement):
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+        (ChromeClientBlackBerry):
+
+2012-07-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Add an API to explicitly call a JavaScript function with args.
+        https://bugs.webkit.org/show_bug.cgi?id=90694
+
+        Currently the Blackberry port doesn't expose the JavaScript
+        engine to 3rd parties so they rely upon executeJavaScript
+        which can be slower than necessary and unsafe as eval is used.
+        This new API provides a way to explicitly call a specific
+        JavaScript function with a list of args preventing the case
+        where an argument comes from a untrusted source and tries to
+        escape the arg list to take control of the JavaScript engine.
+
+        In the future if the Blackberry port introduces a formal
+        way to interact with the JavaScript engine this function should
+        be removed.
+
+        PR 149294
+
+        Reviewed by Unreviewed
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::executeJavaScriptFunction):
+        (WebKit):
+        * Api/WebPage.h:
+
+2012-07-05  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        [BlackBerry] Fix the build error introduced by enabling CUSTOM_THEME_HANDLER
+        https://bugs.webkit.org/show_bug.cgi?id=90588
+
+        Reviewed by Rob Buis.
+
+        Fix the build error introduced by enabling CUSTOM_THEME_HANDLER.
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::isProtocolHandlerRegistered):
+
+2012-07-04  Hanna Ma  <Hanma@rim.com>
+
+        [BlackBerry] Implement device metrics for blackberry.
+        https://bugs.webkit.org/show_bug.cgi?id=90494
+        RIM PR #159034
+
+        Reviewed by Rob Buis.
+
+        Implement calls to the application to change the device metrics for
+        the web inspector.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::applySizeOverride):
+        (WebKit):
+        (BlackBerry::WebKit::WebPagePrivate::setTextZoomFactor):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * WebCoreSupport/InspectorClientBlackBerry.cpp:
+        (WebCore::InspectorClientBlackBerry::InspectorClientBlackBerry):
+        (WebCore::InspectorClientBlackBerry::canOverrideDeviceMetrics):
+        (WebCore):
+        (WebCore::InspectorClientBlackBerry::overrideDeviceMetrics):
+        (WebCore::InspectorClientBlackBerry::supportsFrameInstrumentation):
+        * WebCoreSupport/InspectorClientBlackBerry.h:
+        (InspectorClientBlackBerry):
+
+2012-07-03  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Checkerboard shown when clicking on error page buttons
+        https://bugs.webkit.org/show_bug.cgi?id=90152
+        RIM PR #161867
+
+        Reviewed by George Staikos.
+
+        r121514 just made the race occur in lower possibility but can't avoid it.
+        This path is using another approach to fix the problem. When we are resetting
+        backingstore while committing a page we need to suspend backingstore and
+        screen update to make sure no other threads can update backingstore and screen.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::resetTiles):
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::setLoadState):
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable Custom Scheme Handlers for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore):
+        (WebCore::ChromeClientBlackBerry::isProtocolHandlerRegistered):
+        (WebCore::ChromeClientBlackBerry::unregisterProtocolHandler):
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+        (ChromeClientBlackBerry):
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable RegisterProtocolHandler for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore):
+        (WebCore::ChromeClientBlackBerry::registerProtocolHandler):
+        * WebCoreSupport/ChromeClientBlackBerry.h:
+        (ChromeClientBlackBerry):
+
+2012-07-03  Jan Keromnes  <janx@linux.com>
+
+        Web Inspector: WebInspector.TextViewer should be renamed WebInspector.TextEditor
+        https://bugs.webkit.org/show_bug.cgi?id=89939
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCoreSupport/inspectorBB.html:
+
+2012-07-02  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Use PUBLIC_BUILD to enable/disable DRT
+        https://bugs.webkit.org/show_bug.cgi?id=90271
+
+        Reviewed by George Staikos.
+
+        RIM PR #154707
+
+        Currently DRT code will be compiled only if ENABLE_DRT is set, and it's not
+        defined by default.
+        We should enable DRT by default unless PUBLIC_BUILD is set. In this way we don't
+        need to rebuild webkit before running DRT.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::~WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::init):
+        (BlackBerry::WebKit::WebPagePrivate::authenticationChallenge):
+        (BlackBerry::WebKit::WebPage::runLayoutTests):
+        * WebCoreSupport/ChromeClientBlackBerry.cpp:
+        (WebCore::ChromeClientBlackBerry::addMessageToConsole):
+        (WebCore::ChromeClientBlackBerry::runJavaScriptAlert):
+        (WebCore::ChromeClientBlackBerry::runJavaScriptConfirm):
+        (WebCore::ChromeClientBlackBerry::runJavaScriptPrompt):
+        (WebCore::ChromeClientBlackBerry::createWindow):
+        (WebCore::ChromeClientBlackBerry::runBeforeUnloadConfirmPanel):
+        (WebCore::ChromeClientBlackBerry::setStatusbarText):
+        (WebCore::ChromeClientBlackBerry::exceededDatabaseQuota):
+        (WebCore::ChromeClientBlackBerry::keyboardUIMode):
+
+2012-07-02  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Implement cancelVibration, and make sure it's canceled on
+        destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=90406
+
+        Reviewed by Rob Buis.
+
+        * WebCoreSupport/VibrationClientBlackBerry.cpp:
+        (WebCore::VibrationClientBlackBerry::cancelVibration):
+        (WebCore::VibrationClientBlackBerry::vibrationDestroyed):
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * Api/BlackBerryGlobal.cpp:
+        (BlackBerry::WebKit::globalInitialize):
+
+2012-07-01  George Staikos  <staikos@webkit.org>
+
+        Clear visited links when clearing history.
+        https://bugs.webkit.org/show_bug.cgi?id=90345
+
+        Reviewed by Antonio Gomes.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::clearHistory):
+
+2012-06-30  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry] WebView/Browser cause blank screen when selecting a dropdown field.
+        https://bugs.webkit.org/show_bug.cgi?id=90241
+
+        This issue is caused by single quotes in option's labels.
+        We should use the escape character of single quotes in JavaScript's string which 
+        starts and ends with single quotes.
+        So we replace lablels' single quotes with its escape character during generating the 
+        select popUp's HTML.
+
+        Reviewed by George Staikos.
+
+        * WebCoreSupport/SelectPopupClient.cpp:
+        (WebCore::SelectPopupClient::generateHTML):
+
+2012-06-30  Jakob Petsovits  <jpetsovits@rim.com>
+
+        [BlackBerry] Allow surface resizing for use cases other than rotation.
+        https://bugs.webkit.org/show_bug.cgi?id=90295
+        RIM PR 171459
+
+        Reviewed by George Staikos.
+
+        A new API method setHasPendingSurfaceSizeChange() is
+        introduced for that effect, and used inside of
+        setViewportSize() to let the WebPageClient do the
+        resizing. Methods are renamed to reflect that this
+        is not exclusively meant for rotation anymore.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPage::setScreenOrientation):
+        (WebKit):
+        (BlackBerry::WebKit::WebPage::setHasPendingSurfaceSizeChange):
+        (BlackBerry::WebKit::WebPagePrivate::resizeSurfaceIfNeeded):
+        (BlackBerry::WebKit::WebPagePrivate::setViewportSize):
+        * Api/WebPage.h:
+        * Api/WebPageClient.h:
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-06-29  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Page jumps after post-pinch-zoom re-render
+        https://bugs.webkit.org/show_bug.cgi?id=90282
+
+        Reviewed by Antonio Gomes.
+
+        PR: 170255
+        In r120622, we moved ScrollableArea::setConstrainsScrollingToContentEdge(false|true)
+        from WebPage::setScrollPosition() to BackingStorePrivate::setScrollingOrZooming()
+        to address an overscroll reset issue.
+        However, when we are ending bitmap zooming, UI thread can call
+        BackingStorePrivate::setScrollingOrZooming(false) before WebKit thread
+        calls WebPage::setScrollPosition(), in which case it will set
+        ScrollableArea::m_constrainsScrollingToContentEdge to true earlier.
+        To fix this, we can cache ScrollableArea::m_constrainsScrollingToContentEdge
+        and always set it to false before we set scroll position in WebKit
+        thread to avoid scroll position clamping during scrolling, and restore
+        it to what it was after that.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPage::setScrollPosition):
+
+2012-06-29  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Add blitVisibleContents() as public API.
+        https://bugs.webkit.org/show_bug.cgi?id=90211
+
+        Reviewed by Adam Treat.
+
+        We keep blitContents() (with src/dst rectangles)
+        for compatibility with older Cascades sprints for now,
+        but want to switch to always blitting the full viewport
+        and this is a good first step.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::blitVisibleContents):
+        (BlackBerry::WebKit::BackingStore::blitVisibleContents):
+        (WebKit):
+        * Api/BackingStore.h:
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        Added new WebSetting to specify what the devicePixelRatio should be.
+        Updated the call to computeViewportAttributes.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::recomputeVirtualViewportFromViewportArguments):
+        * Api/WebSettings.cpp:
+        (WebKit):
+        (BlackBerry::WebKit::WebSettings::standardSettings):
+        (BlackBerry::WebKit::WebSettings::devicePixelRatio):
+        (BlackBerry::WebKit::WebSettings::setDevicePixelRatio):
+        * Api/WebSettings.h:
+        * WebKitSupport/DumpRenderTreeSupport.cpp:
+        (DumpRenderTreeSupport::dumpConfigurationForViewport):
+
+2012-06-28  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry] Selection items show as garbage for non-ascii characters.
+        https://bugs.webkit.org/show_bug.cgi?id=89969
+
+        Add charset utf-8 to the select popup's page.
+
+        Reviewed by Antonio Gomes.
+
+        * WebCoreSupport/SelectPopupClient.cpp:
+        (WebCore::SelectPopupClient::generateHTML):
+
+2012-06-28  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Checkerboard shown when clicking on error page buttons
+        https://bugs.webkit.org/show_bug.cgi?id=90152
+        RIM PR #161867
+
+        Reviewed by George Staikos.
+
+        Reset m_hasBlitJobs when resetting tiles to prevent ui thread from drawing checkerboard unintentionally.
+
+        * Api/BackingStore.cpp:
+        (BlackBerry::WebKit::BackingStorePrivate::resetTiles):
+
+2012-06-27  Andrew Lo  <anlo@rim.com>
+
+        [BlackBerry] Selection overlay can become visible after it has been hidden
+        https://bugs.webkit.org/show_bug.cgi?id=90105
+
+        Reviewed by George Staikos.
+
+        When SelectionOverlay::hide is called from UI thread,
+        rather than setting the override opacity, dispatch to the
+        WebKit thread, which removes the overlay (normal case).
+
+        Internal PR164183.
+        Internally Reviewed by: Arvid Nilsson.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::~WebPagePrivate):
+        (BlackBerry::WebKit::WebPage::selectionOverlay):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+        * Api/WebSelectionOverlay.h:
+        * WebKitSupport/SelectionOverlay.cpp:
+        (BlackBerry::WebKit::SelectionOverlay::SelectionOverlay):
+        (BlackBerry::WebKit::SelectionOverlay::hide):
+        * WebKitSupport/SelectionOverlay.h:
+        (BlackBerry::WebKit::SelectionOverlay::create):
+        (SelectionOverlay):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * Api/BlackBerryGlobal.cpp:
+        (BlackBerry::WebKit::clearMemoryCaches):
+        * WebCoreSupport/ClientExtension.cpp:
+        * WebCoreSupport/PagePopupBlackBerry.cpp:
+        (WebCore::PagePopupBlackBerry::installDomFunction):
+        * WebKitSupport/DumpRenderTreeSupport.cpp:
+        (DumpRenderTreeSupport::computedStyleIncludingVisitedInfo):
+
+2012-06-27  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Wrong scale after leaving fullscreen <video>
+        https://bugs.webkit.org/show_bug.cgi?id=89546
+
+        Reviewed by Antonio Gomes.
+
+        PR: 164948
+        When we were entering fullscreen, the current scale A was clamped to a
+        greater minimum scale B as we relayouted the contents during the change
+        of the viewport size. When leaving fullscreen, we still used that scale
+        B as the current scale which was incorrect.
+        To fix this, we can save the current scale when entering fullscreen and
+        restore it when leaving fullscreen.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::WebPagePrivate):
+        (BlackBerry::WebKit::WebPagePrivate::enterFullScreenForElement):
+        (BlackBerry::WebKit::WebPagePrivate::exitFullScreenForElement):
+        * Api/WebPage_p.h:
+        (WebPagePrivate):
+
+2012-06-27  Jacky Jiang  <zhajiang@rim.com>
+
+        [BlackBerry] Scale was incorrect when reloading a simple web page after initial load
+        https://bugs.webkit.org/show_bug.cgi?id=88889
+
+        Reviewed by Antonio Gomes.
+
+        PR: 164442
+        For FrameLoadTypeStandard load, the layout timer can be fired which can
+        call dispatchDidFirstVisuallyNonEmptyLayout() after the load Finished
+        state, in which case the web page will have no chance to zoom to
+        initial scale. We should give it a chance as well as FrameLoadTypeSame
+        load.
+
+        * Api/WebPage.cpp:
+        (BlackBerry::WebKit::WebPagePrivate::shouldZoomToInitialScaleOnLoad):
+
 2012-06-26  Mike Fenton  <mifenton@rim.com>
 
         [BlackBerry] Add WebPage interface for Async spell check.
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
index 4d2024b0e..29de80020 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.cpp
@@ -93,7 +93,7 @@ ChromeClientBlackBerry::ChromeClientBlackBerry(WebPagePrivate* pagePrivate)
 
 void ChromeClientBlackBerry::addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID)
 {
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree)
         m_webPagePrivate->m_dumpRenderTree->addMessageToConsole(message, lineNumber, sourceID);
 #endif
@@ -103,7 +103,7 @@ void ChromeClientBlackBerry::addMessageToConsole(MessageSource, MessageType, Mes
 
 void ChromeClientBlackBerry::runJavaScriptAlert(Frame* frame, const String& message)
 {
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree) {
         m_webPagePrivate->m_dumpRenderTree->runJavaScriptAlert(message);
         return;
@@ -117,7 +117,7 @@ void ChromeClientBlackBerry::runJavaScriptAlert(Frame* frame, const String& mess
 
 bool ChromeClientBlackBerry::runJavaScriptConfirm(Frame* frame, const String& message)
 {
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree)
         return m_webPagePrivate->m_dumpRenderTree->runJavaScriptConfirm(message);
 #endif
@@ -129,7 +129,7 @@ bool ChromeClientBlackBerry::runJavaScriptConfirm(Frame* frame, const String& me
 
 bool ChromeClientBlackBerry::runJavaScriptPrompt(Frame* frame, const String& message, const String& defaultValue, String& result)
 {
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree) {
         result = m_webPagePrivate->m_dumpRenderTree->runJavaScriptPrompt(message, defaultValue);
         return true;
@@ -217,7 +217,7 @@ bool ChromeClientBlackBerry::shouldForceDocumentStyleSelectorUpdate()
 
 Page* ChromeClientBlackBerry::createWindow(Frame*, const FrameLoadRequest& request, const WindowFeatures& features, const NavigationAction&)
 {
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree && !m_webPagePrivate->m_dumpRenderTree->allowsOpeningWindow())
         return 0;
 #endif
@@ -252,7 +252,7 @@ Page* ChromeClientBlackBerry::createWindow(Frame*, const FrameLoadRequest& reque
     if (!webPage)
         return 0;
 
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree)
         m_webPagePrivate->m_dumpRenderTree->windowCreated(webPage);
 #endif
@@ -316,11 +316,11 @@ PagePopup* ChromeClientBlackBerry::openPagePopup(PagePopupClient* client, const
 
 void ChromeClientBlackBerry::closePagePopup(PagePopup*)
 {
-    if (hasOpenedPopup()) {
-        PagePopupBlackBerry* webPopup = m_webPagePrivate->m_webPage->popup();
-        webPopup->closePopup();
-        m_webPagePrivate->m_webPage->popupClosed();
-    }
+    if (!hasOpenedPopup())
+        return;
+
+    PagePopupBlackBerry* webPopup = m_webPagePrivate->m_webPage->popup();
+    webPopup->closePopup();
 }
 
 void ChromeClientBlackBerry::setToolbarsVisible(bool)
@@ -380,7 +380,7 @@ bool ChromeClientBlackBerry::canRunBeforeUnloadConfirmPanel()
 
 bool ChromeClientBlackBerry::runBeforeUnloadConfirmPanel(const String& message, Frame*)
 {
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree)
         return m_webPagePrivate->m_dumpRenderTree->runBeforeUnloadConfirmPanel(message);
 #endif
@@ -398,7 +398,7 @@ void ChromeClientBlackBerry::setStatusbarText(const String& status)
 {
     m_webPagePrivate->m_client->setStatus(status);
 
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree)
         m_webPagePrivate->m_dumpRenderTree->setStatusText(status);
 #endif
@@ -478,7 +478,7 @@ void ChromeClientBlackBerry::exceededDatabaseQuota(Frame* frame, const String& n
 
     SecurityOrigin* origin = document->securityOrigin();
 
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree) {
         m_webPagePrivate->m_dumpRenderTree->exceededDatabaseQuota(origin, name);
         return;
@@ -628,7 +628,7 @@ KeyboardUIMode ChromeClientBlackBerry::keyboardUIMode()
 {
     bool tabsToLinks = true;
 
-#if ENABLE_DRT
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     if (m_webPagePrivate->m_dumpRenderTree)
         tabsToLinks = DumpRenderTreeSupport::linksIncludedInFocusChain();
 #endif
@@ -727,13 +727,19 @@ void ChromeClientBlackBerry::enterFullScreenForElement(WebCore::Element* element
     element->document()->webkitWillEnterFullScreenForElement(element);
     m_webPagePrivate->enterFullScreenForElement(element);
     element->document()->webkitDidEnterFullScreenForElement(element);
+    m_fullScreenElement = element;
 }
 
-void ChromeClientBlackBerry::exitFullScreenForElement(WebCore::Element* element)
+void ChromeClientBlackBerry::exitFullScreenForElement(WebCore::Element*)
 {
-    element->document()->webkitWillExitFullScreenForElement(element);
-    m_webPagePrivate->exitFullScreenForElement(element);
-    element->document()->webkitDidExitFullScreenForElement(element);
+    // The element passed into this function is not reliable, i.e. it could
+    // be null. In addition the parameter may be disappearing in the future.
+    // So we use the reference to the element we saved above.
+    ASSERT(m_fullScreenElement);
+    m_fullScreenElement->document()->webkitWillExitFullScreenForElement(m_fullScreenElement.get());
+    m_webPagePrivate->exitFullScreenForElement(m_fullScreenElement.get());
+    m_fullScreenElement->document()->webkitDidExitFullScreenForElement(m_fullScreenElement.get());
+    m_fullScreenElement.clear();
 }
 
 void ChromeClientBlackBerry::fullScreenRendererChanged(RenderBox* fullScreenRenderer)
@@ -809,5 +815,21 @@ PassOwnPtr<ColorChooser> ChromeClientBlackBerry::createColorChooser(ColorChooser
     return nullptr;
 }
 
+#if ENABLE(CUSTOM_SCHEME_HANDLER)
+ChromeClient::CustomHandlersState ChromeClientBlackBerry::isProtocolHandlerRegistered(const String&, const String&, const String&)
+{
+    return ChromeClient::CustomHandlersDeclined;
+}
+
+void ChromeClientBlackBerry::unregisterProtocolHandler(const String&, const String&, const String&)
+{
+}
+#endif
+
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+void ChromeClientBlackBerry::registerProtocolHandler(const WTF::String&, const WTF::String&, const WTF::String&, const WTF::String&)
+{
+}
+#endif
 
 } // namespace WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
index a8e0fb628..818beeb21 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/ChromeClientBlackBerry.h
@@ -155,10 +155,20 @@ public:
     virtual bool allowsAcceleratedCompositing() const;
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    virtual void registerProtocolHandler(const WTF::String&, const WTF::String&, const WTF::String&, const WTF::String&);
+#endif
+
+#if ENABLE(CUSTOM_SCHEME_HANDLER)
+    virtual CustomHandlersState isProtocolHandlerRegistered(const String&, const String&, const String&);
+    virtual void unregisterProtocolHandler(const String&, const String&, const String&);
+#endif
+
     BlackBerry::WebKit::WebPagePrivate* webPagePrivate() const { return m_webPagePrivate; }
 
 private:
     BlackBerry::WebKit::WebPagePrivate* m_webPagePrivate;
+    RefPtr<WebCore::Element> m_fullScreenElement;
 };
 
 } // WebCore
diff --git a/Source/WebKit/blackberry/WebCoreSupport/ClientExtension.cpp b/Source/WebKit/blackberry/WebCoreSupport/ClientExtension.cpp
index d3d7b62b9..c6d0a6e24 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/ClientExtension.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/ClientExtension.cpp
@@ -84,11 +84,11 @@ static JSStaticValue clientExtensionStaticValues[] = {
 // FIXME: Revisit the creation of this class and make sure this is the best way to approach it.
 void attachExtensionObjectToFrame(Frame* frame, WebPageClient* client)
 {
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-
     JSDOMWindow* window = frame->script()->windowShell(mainThreadNormalWorld())->window();
 
     JSC::ExecState* exec = window->globalExec();
+    JSC::JSLockHolder lock(exec);
+
     JSContextRef scriptCtx = toRef(exec);
 
     JSClassDefinition definition = kJSClassDefinitionEmpty;
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
index 22e2364b0..bc8236013 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.cpp
@@ -85,6 +85,23 @@ void InspectorClientBlackBerry::clearBrowserCookies()
     m_webPagePrivate->m_client->clearCookies();
 }
 
+bool InspectorClientBlackBerry::canOverrideDeviceMetrics()
+{
+    return true;
+}
+
+void InspectorClientBlackBerry::overrideDeviceMetrics(int width, int height, float fontScaleFactor, bool)
+{
+    // Note: when width and height = 0, and fontScaleFactor = 1, this is the signal for restoring to default size.
+    m_webPagePrivate->applySizeOverride(width, height);
+    m_webPagePrivate->setTextZoomFactor(fontScaleFactor);
+}
+
+bool InspectorClientBlackBerry::supportsFrameInstrumentation()
+{
+    return true;
+}
+
 void InspectorClientBlackBerry::updateInspectorStateCookie(const String& cookie)
 {
     // If this is implemented, we should override and return true in InspectorStateClient::supportsInspectorStateUpdates().
diff --git a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
index 3f6f207dd..720592cde 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
+++ b/Source/WebKit/blackberry/WebCoreSupport/InspectorClientBlackBerry.h
@@ -53,6 +53,10 @@ public:
     virtual bool canClearBrowserCookies() { return true; }
     virtual void paintInspectorOverlay(WebCore::GraphicsContext&);
 
+    virtual bool canOverrideDeviceMetrics();
+    virtual void overrideDeviceMetrics(int, int, float, bool);
+    virtual bool supportsFrameInstrumentation();
+
     virtual void updateInspectorStateCookie(const String&);
 
 private:
diff --git a/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp
index a751fb7a2..5141a890b 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/PagePopupBlackBerry.cpp
@@ -68,8 +68,6 @@ bool PagePopupBlackBerry::init(WebPage* webpage)
 
     installDomFunction(webpage->d->mainFrame());
 
-    webpage->d->setParentPopup(this);
-
     return true;
 }
 
@@ -122,13 +120,12 @@ static JSStaticValue popUpExtensionStaticValues[] =
 
 void PagePopupBlackBerry::installDomFunction(Frame* frame)
 {
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-
     JSDOMWindow* window = toJSDOMWindow(frame, mainThreadNormalWorld());
     ASSERT(window);
 
     JSC::ExecState* exec = window->globalExec();
     ASSERT(exec);
+    JSC::JSLockHolder lock(exec);
 
     JSContextRef context = ::toRef(exec);
     JSObjectRef globalObject = JSContextGetGlobalObject(context);
@@ -163,6 +160,7 @@ void PagePopupBlackBerry::closePopup()
 {
     m_client->didClosePopup();
     m_webPagePrivate->client()->closePopupWebView();
+    m_webPagePrivate->m_webPage->popupClosed();
 }
 
 }
diff --git a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
index f30d01ed6..00058ef60 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/SelectPopupClient.cpp
@@ -65,7 +65,7 @@ void SelectPopupClient::generateHTML(bool multiple, int size, const ScopeArray<B
     const int* itemType, bool* selecteds)
 {
     StringBuilder source;
-    source.append("<html><head><style>\n");
+    source.append("<html><head><meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\"/><style>\n");
     // Include CSS file.
     source.append(popupControlBlackBerryCss,
             sizeof(popupControlBlackBerryCss));
@@ -82,7 +82,7 @@ void SelectPopupClient::generateHTML(bool multiple, int size, const ScopeArray<B
     // Add labels.
     source.append("[");
     for (int i = 0; i < size; i++) {
-        source.append("'" + String(labels[i].impl()) + "'");
+        source.append("'" + String(labels[i].impl()).replace("'", "\\'") + "'");
         // Don't append ',' to last element.
         if (i != size - 1)
             source.append(", ");
@@ -144,7 +144,7 @@ String SelectPopupClient::htmlSource()
 
 void SelectPopupClient::setValueAndClosePopup(int, const String& stringValue)
 {
-
+    ASSERT(m_element);
     ASSERT(m_size == stringValue.length());
 
     if (m_size > 0) {
diff --git a/Source/WebKit/blackberry/WebCoreSupport/VibrationClientBlackBerry.cpp b/Source/WebKit/blackberry/WebCoreSupport/VibrationClientBlackBerry.cpp
index 796ea6d0e..ef7d08b4b 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/VibrationClientBlackBerry.cpp
+++ b/Source/WebKit/blackberry/WebCoreSupport/VibrationClientBlackBerry.cpp
@@ -36,10 +36,12 @@ void VibrationClientBlackBerry::vibrate(const unsigned long& time)
 
 void VibrationClientBlackBerry::cancelVibration()
 {
+    BlackBerryPlatformVibrate::vibrate(0, 0.);
 }
 
 void VibrationClientBlackBerry::vibrationDestroyed()
 {
+    cancelVibration();
     delete this;
 }
 
diff --git a/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.html b/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.html
index 5f692197f..79828d98f 100644
--- a/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.html
+++ b/Source/WebKit/blackberry/WebCoreSupport/inspectorBB.html
@@ -39,7 +39,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
         <link rel="stylesheet" type="text/css" href="networkPanel.css">
         <link rel="stylesheet" type="text/css" href="helpScreen.css">
         <link rel="stylesheet" type="text/css" href="popover.css">
-        <link rel="stylesheet" type="text/css" href="textViewer.css">
+        <link rel="stylesheet" type="text/css" href="textEditor.css">
         <script type="text/javascript" src="javascript.js"></script>
     </head>
     <body class="detached">
diff --git a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp
index cd1cb4cf9..b777db06a 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.cpp
@@ -84,16 +84,6 @@ bool DumpRenderTreeSupport::linksIncludedInFocusChain()
     return s_linksIncludedInTabChain;
 }
 
-void DumpRenderTreeSupport::dumpConfigurationForViewport(Frame* mainFrame, int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    ViewportArguments arguments = mainFrame->page()->viewportArguments();
-    ViewportAttributes attrs = computeViewportAttributes(arguments, /* default layout width for non-mobile pages */ 980, deviceWidth, deviceHeight, deviceDPI, IntSize(availableWidth, availableHeight));
-    restrictMinimumScaleFactorToViewportSize(attrs, IntSize(availableWidth, availableHeight));
-    restrictScaleFactorToInitialScaleIfNotUserScalable(attrs);
-
-    fprintf(stdout, "viewport size %dx%d scale %f with limits [%f, %f] and userScalable %f\n", static_cast<int>(attrs.layoutSize.width()), static_cast<int>(attrs.layoutSize.height()), attrs.initialScale, attrs.minimumScale, attrs.maximumScale, attrs.userScalable);
-}
-
 int DumpRenderTreeSupport::numberOfPendingGeolocationPermissionRequests(WebPage* webPage)
 {
     GeolocationClientMock* mockClient = toGeolocationClientMock(GeolocationController(corePage(webPage))->client());
@@ -141,8 +131,8 @@ void DumpRenderTreeSupport::scalePageBy(WebPage* webPage, float scaleFactor, flo
 
 JSValueRef DumpRenderTreeSupport::computedStyleIncludingVisitedInfo(JSContextRef context, JSValueRef value)
 {
-    JSLock lock(SilenceAssertionsOnly);
     ExecState* exec = toJS(context);
+    JSLockHolder lock(exec);
     if (!value)
         return JSValueMakeUndefined(context);
     JSValue jsValue = toJS(exec, value);
diff --git a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h
index 54e48f029..58fc1b53e 100644
--- a/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h
+++ b/Source/WebKit/blackberry/WebKitSupport/DumpRenderTreeSupport.h
@@ -50,8 +50,6 @@ public:
     static void garbageCollectorCollect();
     static void garbageCollectorCollectOnAlternateThread(bool waitUntilDone);
 
-    static void dumpConfigurationForViewport(WebCore::Frame* mainFrame, int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight);
-
     static int numberOfPendingGeolocationPermissionRequests(BlackBerry::WebKit::WebPage*);
     static void resetGeolocationMock(BlackBerry::WebKit::WebPage*);
     static void setMockGeolocationError(BlackBerry::WebKit::WebPage*, int errorCode, const WTF::String message);
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
index 9480e8415..58fd28e26 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.cpp
@@ -23,6 +23,7 @@
 #include "SelectionOverlay.h"
 
 #include "GraphicsContext.h"
+#include "LayerMessage.h"
 #include "Path.h"
 #include "PlatformContextSkia.h"
 #include "RenderTheme.h"
@@ -37,6 +38,7 @@ namespace WebKit {
 
 SelectionOverlay::SelectionOverlay(WebPagePrivate* page)
     : m_page(page)
+    , m_hideDispatched(false)
 {
 }
 
@@ -69,15 +71,27 @@ void SelectionOverlay::draw(const Platform::IntRectRegion& region)
 
 void SelectionOverlay::hide()
 {
+    // Track a dispatched message, we don't want to flood the webkit thread.
+    // There can be as many as one more message enqued as needed but never less.
+    if (isWebKitThread())
+        m_hideDispatched = false;
+    else if (m_hideDispatched) {
+        // Early return if there is message already pending on the webkit thread.
+        return;
+    }
+    if (!isWebKitThread()) {
+        m_hideDispatched = true;
+        // Normally, this method is called on the WebKit thread, but it can also be
+        // called from the compositing thread.
+        dispatchWebKitMessage(BlackBerry::Platform::createMethodCallMessage(&SelectionOverlay::hide, this));
+        return;
+    }
+    ASSERT(BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread());
+
     if (!m_overlay)
         return;
 
-    // Normally, this method is called on the WebKit thread, but it can also be
-    // called from the compositing thread.
-    if (BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread())
-        m_page->m_webPage->removeOverlay(m_overlay.get());
-    else if (BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread())
-        m_overlay->override()->setOpacity(0);
+    m_page->m_webPage->removeOverlay(m_overlay.get());
 }
 
 void SelectionOverlay::notifySyncRequired(const GraphicsLayer*)
diff --git a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
index aad159f10..12731c581 100644
--- a/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
+++ b/Source/WebKit/blackberry/WebKitSupport/SelectionOverlay.h
@@ -30,7 +30,6 @@
 
 #include <BlackBerryPlatformIntRectRegion.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
 
 namespace BlackBerry {
 namespace WebKit {
@@ -39,9 +38,9 @@ class WebPagePrivate;
 
 class SelectionOverlay : public WebSelectionOverlay, public WebCore::GraphicsLayerClient {
 public:
-    static PassOwnPtr<SelectionOverlay> create(WebPagePrivate* page)
+    static SelectionOverlay* create(WebPagePrivate* page)
     {
-        return adoptPtr(new SelectionOverlay(page));
+        return new SelectionOverlay(page);
     }
 
     virtual ~SelectionOverlay();
@@ -64,6 +63,7 @@ private:
     WebPagePrivate* m_page;
     OwnPtr<WebOverlay> m_overlay;
     BlackBerry::Platform::IntRectRegion m_region;
+    bool m_hideDispatched;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/.gitignore b/Source/WebKit/chromium/.gitignore
index 12ec0f709..eece02216 100644
--- a/Source/WebKit/chromium/.gitignore
+++ b/Source/WebKit/chromium/.gitignore
@@ -4,7 +4,11 @@
 *.mk
 *.sln
 *.vcproj*
+*.vcxproj*
+All.ncb
+All.sdf
 All.xcodeproj
+WebKit.ncb
 WebKit.xcodeproj
 WebKitUnitTests.xcodeproj
 
diff --git a/Source/WebKit/chromium/ChangeLog b/Source/WebKit/chromium/ChangeLog
index 365d0eb3c..cd904d3c1 100644
--- a/Source/WebKit/chromium/ChangeLog
+++ b/Source/WebKit/chromium/ChangeLog
@@ -1,3 +1,1595 @@
+2012-07-11  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Adding HarfBuzz-ng for Linux
+        https://bugs.webkit.org/show_bug.cgi?id=90362
+
+        Reviewed by Tony Chang.
+
+        * features.gypi: Added use_harfbuzz_ng variable. If the value is set, USE(HARFBUZZ_NG) is defined.
+
+2012-07-10  Hayato Ito  <hayato@chromium.org>
+
+        Unreviewed gardening.
+
+        Android builder started to fail after r122292.
+        My best guess is that '--ant-compile' does not take an argument.
+
+        * WebKitUnitTests.gyp:
+
+2012-07-10  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium-Windows] Implement functions for localized time format information
+        https://bugs.webkit.org/show_bug.cgi?id=90236
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces test cases for date and time format related
+        functions in LocaleWin.
+
+        * tests/LocaleWinTest.cpp:
+        (LocaleWinTest):
+        (LocaleWinTest::dateComponents): Added.
+        (LocaleWinTest::msForDate): Moved inside class LocaleWinTest.
+        (LocaleWinTest::formatDate): Added.
+        (LocaleWinTest::parseDate): Added.
+        (LocaleWinTest::dateFormatText): Added.
+        (LocaleWinTest::firstDayOfWeek): Added.
+        (LocaleWinTest::monthLabel): Added.
+        (LocaleWinTest::weekDayShortLabel): Added.
+        (LocaleWinTest::timeFormatText): Added.
+        (LocaleWinTest::shortTimeFormatText): Added.
+        (LocaleWinTest::timeAMPMLabel): Added.
+        (TEST_F):
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        [Chromium-Android] Add apk test targets for webkit_unit_tests and TestWebKitAPI
+        https://bugs.webkit.org/show_bug.cgi?id=90918
+
+        Reviewed by Tony Chang.
+
+        The rules are similar to what we have added for DumpRenderTree apk.
+        All references to gtest_target_type can be removed once we enable APK
+        tests on the all bots.
+
+        * WebKitUnitTests.gyp:
+
+2012-07-10  Kevin Ellis  <kevers@chromium.org>
+
+        Input elements with type=range do not have default touch handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=88807
+
+        Reviewed by Antonio Gomes.
+
+        Adds flag to enable native handling of touch events for input elements
+        with type=range.
+
+        * features.gypi:
+
+2012-07-10  Adam Klein  <adamk@chromium.org>
+
+        [Chromium] REGRESSION(r121909): m_currentInputEvent never set
+        https://bugs.webkit.org/show_bug.cgi?id=90914
+
+        Reviewed by Abhishek Arya.
+
+        The always-null m_currentInputEvent causes a regression when
+        middle-clicking on a link that calls window.open('...', '_blank');
+        that new tab should open in the background, but instead opens in the
+        foreground (see code in ChromeClientImpl::getNavigationPolicy()).
+
+        Fix usage of TemporaryChange to specify a local variable name so that
+        m_currentInputEvent is actually set for the duration of handleInputEvent.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleInputEvent): Name the TemporaryChange instance.
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        * public/WebSettings.h:
+        (WebKit::WebSettings::setHixie76WebSocketProtocolEnabled):
+        * src/WebSettingsImpl.cpp:
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::initializeLoader):
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Replace use of ManagedTexture with CCScopedTexture for impl thread and remove implTextureManager from LayerRendererChromium
+        https://bugs.webkit.org/show_bug.cgi?id=90841
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-07-10  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Use default font rendering styles in FontPlatformData::querySystemForRenderStyle()
+        https://bugs.webkit.org/show_bug.cgi?id=90826
+
+        Reviewed by Adam Barth.
+
+        * WebKit.gyp:
+        * src/PlatformSupport.cpp:
+        (WebCore::PlatformSupport::getRenderStyleForStrike): Call style.setDefault() on Android or when the font is not specified.
+
+2012-07-10  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Avoid allocating render pass textures that have no content
+        https://bugs.webkit.org/show_bug.cgi?id=90702
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::ContentLayerChromiumWithUpdateTracking::ContentLayerChromiumWithUpdateTracking):
+        (CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit):
+        (WTF::CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit::CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit):
+        (WTF::CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit::beginTest):
+        (WTF::CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit::didCommit):
+        (WTF::CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit::drawLayersOnCCThread):
+        (WTF::CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit::afterTest):
+        (WTF):
+
+2012-07-10  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Unreviewed Chromium build fix for mac-release.
+
+        Fixing clang build after https://bugs.webkit.org/show_bug.cgi?id=90807
+
+        * public/WebSurroundingText.h:
+        (WebKit):
+
+2012-07-10  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        WebSurroundingText layout tests should use the same code path as the rest of the feature.
+        https://bugs.webkit.org/show_bug.cgi?id=90807
+
+        Reviewed by Adam Barth.
+
+        Replace the offset-based initialize method used only by LayoutTestController
+        with a point-based version to follow the same code path.
+
+        * public/WebSurroundingText.h:
+        (WebKit):
+        (WebSurroundingText):
+        * src/WebSurroundingText.cpp:
+        (WebKit::WebSurroundingText::initialize):
+
+2012-07-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122207.
+        http://trac.webkit.org/changeset/122207
+        https://bugs.webkit.org/show_bug.cgi?id=90874
+
+        Broke the cr-windows bot (Requested by beverloo on #webkit).
+
+        * DEPS:
+
+2012-07-10  Jochen Eisinger  <jochen@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * features.gypi:
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableDialogElement):
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::isDialogElementEnabled):
+
+2012-07-09  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Chromium-Mac] Implement functions for localized time format information
+        https://bugs.webkit.org/show_bug.cgi?id=90237
+
+        Reviewed by Kent Tamura.
+
+        * tests/LocaleMacTest.cpp:
+        (LocaleMacTest):
+        (LocaleMacTest::timeFormatText):
+        (LocaleMacTest::shortTimeFormatText):
+        (LocaleMacTest::timeAMPMLabel):
+        (TEST_F):
+
+2012-07-09  Eric Penner  <epenner@google.com>
+
+        [chromium] Merge updates and idle updates into one pass
+        https://bugs.webkit.org/show_bug.cgi?id=90324
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::ContentLayerChromiumWithUpdateTracking::resetPaintContentsCount):
+        (WTF::ContentLayerChromiumWithUpdateTracking::ContentLayerChromiumWithUpdateTracking):
+        (ContentLayerChromiumWithUpdateTracking):
+        (WTF::CCLayerTreeHostTestOpacityChange::afterTest):
+        * tests/CCTiledLayerTestCommon.h:
+        (FakeTiledLayerChromium):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-07-09  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Introduce LocaleMac class
+        https://bugs.webkit.org/show_bug.cgi?id=90248
+
+        Reviewed by Kent Tamura.
+
+        This patch added tests for LocaleMac class.
+
+        * WebKit.gypi:
+        * tests/LocaleMacTest.cpp: Added.
+        (LocaleMacTest):
+        (LocaleMacTest::dateComponents):
+        (LocaleMacTest::msForDate):
+        (LocaleMacTest::formatDate):
+        (LocaleMacTest::parseDate):
+        (LocaleMacTest::dateFormatText):
+        (LocaleMacTest::firstDayOfWeek):
+        (LocaleMacTest::monthLabel):
+        (LocaleMacTest::weekDayShortLabel):
+        (TEST_F):
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Create CCScopedTexture class for creating/freeing textures
+        https://bugs.webkit.org/show_bug.cgi?id=89485
+
+        Reviewed by Adrienne Walker.
+
+        * WebKit.gypi:
+        * tests/CCScopedTextureTest.cpp: Added.
+        (WebKitTests):
+        (WebKitTests::TEST):
+        (TrackingTextureAllocator):
+        (WebKitTests::TrackingTextureAllocator::TrackingTextureAllocator):
+        (WebKitTests::TrackingTextureAllocator::numTextures):
+
+2012-07-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Remove obsolete accessor plumbing
+        https://bugs.webkit.org/show_bug.cgi?id=90812
+
+        Reviewed by Tony Chang.
+
+        * public/WebIDBCursor.h: Remove direction.
+        * public/WebIDBDatabase.h: Remove name, version, objectStoreNames;
+        (WebKit::WebIDBDatabase::metadata):
+        * public/WebIDBIndex.h: Remove name, keyPath, unique, multiEntry;
+        * public/WebIDBObjectStore.h: Remove name, keyPath, indexNames, autoIncrement;
+        * src/IDBDatabaseBackendProxy.cpp: Remove plumbing.
+        * src/IDBDatabaseBackendProxy.h: Remove plumbing.
+        (IDBDatabaseBackendProxy):
+        * src/IDBIndexBackendProxy.cpp: Remove plumbing.
+        * src/IDBIndexBackendProxy.h: Remove plumbing.
+        (IDBIndexBackendProxy):
+        * src/IDBObjectStoreBackendProxy.cpp: Remove plumbing.
+        * src/IDBObjectStoreBackendProxy.h: Remove plumbing.
+        (IDBObjectStoreBackendProxy):
+        * src/IDBTransactionBackendProxy.cpp: Remove plumbing.
+        * src/IDBTransactionBackendProxy.h: Assert stub is not used - only needed
+        by real IDBTransactionBackendImpl
+        (WebKit::IDBTransactionBackendProxy::mode):
+        * src/WebIDBTransactionImpl.cpp: Remove plumbing.
+        * src/WebIDBTransactionImpl.h: Remove plumbing.
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122161.
+        http://trac.webkit.org/changeset/122161
+        https://bugs.webkit.org/show_bug.cgi?id=90837
+
+        failed to compile on chromium webkit linux bot (Requested by
+        shawnsingh on #webkit).
+
+        * WebKit.gypi:
+        * WebKitUnitTests.gyp:
+        * public/WebDOMMessageEvent.h:
+        * tests/AssociatedURLLoaderTest.cpp:
+        (WebKit::AssociatedURLLoaderTest::AssociatedURLLoaderTest):
+        (WebKit::AssociatedURLLoaderTest::SetUp):
+        (WebKit::AssociatedURLLoaderTest::CheckMethodFails):
+        (WebKit::AssociatedURLLoaderTest::CheckHeaderFails):
+        (WebKit::AssociatedURLLoaderTest::CheckAccessControlHeaders):
+        (WebKit::TEST_F):
+        * tests/EventListenerTest.cpp:
+        * tests/FrameTestHelpers.cpp:
+        (WebKit::FrameTestHelpers::registerMockedURLLoad):
+        (FrameTestHelpers):
+        (WebKit::FrameTestHelpers::loadFrame):
+        * tests/FrameTestHelpers.h:
+        (FrameTestHelpers):
+        * tests/ListenerLeakTest.cpp:
+        (WebKit::ListenerLeakTest::RunTest):
+        * tests/PopupMenuTest.cpp:
+        (WebKit::SelectPopupMenuTest::registerMockedURLLoad):
+        (WebKit::SelectPopupMenuTest::loadFrame):
+        (WebKit::TEST_F):
+        * tests/RunAllTests.cpp:
+        * tests/URLTestHelpers.cpp: Removed.
+        * tests/URLTestHelpers.h: Removed.
+        * tests/WebFrameTest.cpp:
+        (WebKit::WebFrameTest::registerMockedHttpURLLoad):
+        (WebKit::WebFrameTest::registerMockedChromeURLLoad):
+        (WebKit::TEST_F):
+        * tests/WebPageNewSerializerTest.cpp:
+        (WebKit::WebPageNewSerializeTest::registerMockedURLLoad):
+        (WebPageNewSerializeTest):
+        (WebKit::WebPageNewSerializeTest::setUpCSSTestPage):
+        (WebKit::WebPageNewSerializeTest::loadURLInTopFrame):
+        (WebKit::WebPageNewSerializeTest::resourceVectorContains):
+        (WebKit::TEST_F):
+        * tests/WebPageSerializerTest.cpp:
+        (WebKit::WebPageSerializerTest::registerMockedURLLoad):
+        (WebKit::WebPageSerializerTest::loadURLInTopFrame):
+        (WebKit::WebPageSerializerTest::webVectorContains):
+        (WebKit::TEST_F):
+        * tests/WebViewTest.cpp:
+        (WebKit::TEST_F):
+        (WebKit::WebViewTest::testAutoResize):
+        (WebKit::WebViewTest::testTextInputType):
+
+2012-07-09  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Use WEBKIT_IMPLEMENTATION == 1 for webkit_unit_tests
+        https://bugs.webkit.org/show_bug.cgi?id=90094
+
+        Reviewed by Adam Barth.
+
+        This patch adds the WEBKIT_IMPLEMENTATION = 1 define to
+        WebKitUnitTests.gyp. To get it to compile correctly, some string
+        and URL code was refactored, and GURL types were replaced with KURL types.
+
+        * WebKit.gypi:
+        * WebKitUnitTests.gyp:
+        * public/WebDOMMessageEvent.h:
+        (WebKit::WebDOMMessageEvent::WebDOMMessageEvent):
+        * tests/AssociatedURLLoaderTest.cpp:
+        * tests/EventListenerTest.cpp:
+        * tests/FrameTestHelpers.cpp:
+        (WebKit::FrameTestHelpers::loadFrame):
+        * tests/FrameTestHelpers.h:
+        * tests/ListenerLeakTest.cpp:
+        (WebKit::ListenerLeakTest::RunTest):
+        * tests/PopupMenuTest.cpp:
+        * tests/RunAllTests.cpp:
+        * tests/URLTestHelpers.cpp: Added.
+        (URLTestHelpers):
+        (WebKit::URLTestHelpers::registerMockedURLFromBaseURL):
+        (WebKit::URLTestHelpers::registerMockedURLLoad):
+        * tests/URLTestHelpers.h: Copied from Source/WebKit/chromium/public/WebDOMMessageEvent.h.
+        (WebKit):
+        (URLTestHelpers):
+        (WebKit::URLTestHelpers::toKURL):
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageNewSerializerTest.cpp:
+        * tests/WebPageSerializerTest.cpp:
+        * tests/WebViewTest.cpp:
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Decouple RenderPass drawing from CCRenderSurface
+        https://bugs.webkit.org/show_bug.cgi?id=90573
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/LayerRendererChromiumTest.cpp:
+        (FakeCCRendererClient::FakeCCRendererClient):
+
+2012-07-09  Adam Klein  <adamk@chromium.org>
+
+        Rename WebCore::WebKitMutationObserver to WebCore::MutationObserver
+        https://bugs.webkit.org/show_bug.cgi?id=90810
+
+        Reviewed by Ojan Vafai.
+
+        * src/WebKit.cpp:
+
+2012-07-09  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        SurroundingText should not advance character iterators if they are at end.
+        https://bugs.webkit.org/show_bug.cgi?id=90560
+
+        Reviewed by Ryosuke Niwa.
+
+        Moving the check for null visible positions to WebCore as it makes no
+        sense to be in a platform-specific code.
+
+        * src/WebSurroundingText.cpp:
+        (WebKit::WebSurroundingText::initialize):
+
+2012-07-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Create render surfaces on main thread only for the current frame
+        https://bugs.webkit.org/show_bug.cgi?id=89793
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostCommonTest.cpp:
+
+2012-07-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Make HTMLCollection RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=90414
+
+        Reviewed by Sam Weinig.
+
+        * src/WebPageSerializer.cpp:
+        (WebCore::retrieveResourcesForFrame):
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::collectTargetFrames):
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * features.gypi:
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * features.gypi:
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableDialogElement):
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::isDialogElementEnabled):
+
+2012-07-09  MORITA Hajime  <morrita@google.com>
+
+        [Chromium] ContextFeaturesClient::isEnabled is slow
+        https://bugs.webkit.org/show_bug.cgi?id=90367
+
+        Reviewed by Kent Tamura.
+
+        ContextFeaturesClientImpl::isEnabled touches a heavy part in chrome
+        where locks are acquired for each invocation.
+
+        This change introduces a set of caches to avoid such slow calls.
+        The cache class ContextFeaturesCache is implemented as a
+        Supplement of ScriptExecutionContext because the flag bits
+        depend on the domain of each Document.
+
+        * src/ContextFeaturesClientImpl.cpp:
+        (ContextFeaturesCache): Added.
+        (Entry): Added.
+        (WebKit::ContextFeaturesCache::Entry::Entry):
+        (WebKit::ContextFeaturesCache::Entry::isEnabled):
+        (WebKit::ContextFeaturesCache::Entry::set):
+        (WebKit::ContextFeaturesCache::Entry::needsRefresh):
+        (WebKit::ContextFeaturesCache::entryFor):
+        (WebKit):
+        (WebKit::ContextFeaturesCache::supplementName):
+        (WebKit::ContextFeaturesCache::from):
+        (WebKit::ContextFeaturesCache::refreshAgainst):
+        (WebKit::ContextFeaturesClientImpl::isEnabled):
+        (WebKit::ContextFeaturesClientImpl::urlDidChange): Added to invoke refrshAgainst.
+        (WebKit::ContextFeaturesClientImpl::askIfIsEnabled):
+        * src/ContextFeaturesClientImpl.h:
+        (ContextFeaturesClientImpl):
+
+2012-07-09  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Unreviewed chromium inspector test fix.
+
+        * src/js/Tests.js:
+        (.TestSuite.prototype.nonAnonymousUISourceCodes_):
+
+2012-07-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Unreviewed Chromium gardening. Roll Chromium DEPS
+
+        * DEPS: 145501 => 145569
+
+2012-07-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Unreviewed Chromium gardening - Disable WebAnimationTest for Linux and Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=90651
+
+        * tests/WebAnimationTest.cpp:
+        (WebKit):
+        (WebKit::TEST):
+
+2012-07-05  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Create a WebKit::Web* wrapper for the cc animation classes
+        https://bugs.webkit.org/show_bug.cgi?id=90303
+
+        Reviewed by James Robinson.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * src/WebAnimation.cpp: Added.
+        (WebKit):
+        (WebKit::WebAnimation::iterations):
+        (WebKit::WebAnimation::setIterations):
+        (WebKit::WebAnimation::startTime):
+        (WebKit::WebAnimation::setStartTime):
+        (WebKit::WebAnimation::timeOffset):
+        (WebKit::WebAnimation::setTimeOffset):
+        (WebKit::WebAnimation::alternatesDirection):
+        (WebKit::WebAnimation::setAlternatesDirection):
+        (WebKit::WebAnimation::toCCActiveAnimation):
+        (WebKit::WebAnimation::initialize):
+        (WebKit::WebAnimation::destroy):
+        * src/WebAnimationCurveCommon.cpp: Added.
+        (WebKit):
+        (WebKit::createTimingFunction):
+        * src/WebAnimationCurveCommon.h: Added.
+        (WebCore):
+        (WebKit):
+        * src/WebFloatAnimationCurve.cpp: Added.
+        (WebKit):
+        (WebKit::WebFloatAnimationCurve::add):
+        (WebKit::WebFloatAnimationCurve::toCCAnimationCurve):
+        (WebKit::WebFloatAnimationCurve::initialize):
+        (WebKit::WebFloatAnimationCurve::destroy):
+        * src/WebTransformAnimationCurve.cpp: Added.
+        (WebKit):
+        (WebKit::WebTransformAnimationCurve::add):
+        (WebKit::WebTransformAnimationCurve::toCCAnimationCurve):
+        (WebKit::WebTransformAnimationCurve::initialize):
+        (WebKit::WebTransformAnimationCurve::destroy):
+        * tests/WebAnimationTest.cpp: Added.
+        * tests/WebFloatAnimationCurveTest.cpp: Added.
+        * tests/WebTransformAnimationCurveTest.cpp: Added.
+
+2012-07-05  Vincent Scheib  <scheib@chromium.org>
+
+        [Chromium] Clear m_currentInputEvent after handled by pointerLockMouseEvent().
+        https://bugs.webkit.org/show_bug.cgi?id=90391
+
+        WebViewImpl::handleInputEvent was keeping a pointer to an input event that would
+        later be accessed. When in pointer lock, that pointer was not being cleared.
+        Code modified to use TemporaryChange to automatically clear the pointer at all
+        method exit points.
+
+        Reviewed by Abhishek Arya.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::handleInputEvent):
+
+2012-07-05  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add test framework and simple test.
+        https://bugs.webkit.org/show_bug.cgi?id=90561
+
+        ENABLE(TEXT_AUTOSIZING) is now on in Chromium (but disabled at runtime).
+        This allows it to be used in Layout Tests (and in future by Web
+        Inspector's mobile device emulation).
+
+        Reviewed by Adam Barth.
+
+        * features.gypi:
+
+2012-07-05  Oli Lan  <olilan@chromium.org>
+
+        [chromium] Add a method didChangeFormState to WebViewClient.
+        https://bugs.webkit.org/show_bug.cgi?id=90563
+
+        Reviewed by Adam Barth.
+
+        This patch adds a new method didChangeFormState to WebViewClient,
+        and calls it from ChromeClientImpl::formStateDidChange with the changed node.
+
+        This new method can be used for example by the Android port to update the browser's
+        IME when the state of the currently focused text node has changed. To facilitate this
+        usage, a focused() method has been added to WebNode.
+
+        A new test has been added to WebViewTest. This test checks that didChangeFormState
+        is called when an input's value is changed, and also checks that WebNode::focused() returns
+        the correct value for the provided node, in both the focused and non-focused cases.
+
+        * public/WebNode.h:
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::didChangeFormState):
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::formStateDidChange):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::focused):
+        (WebKit):
+        * tests/WebViewTest.cpp:
+        (FormChangeWebViewClient):
+        (WebKit::FormChangeWebViewClient::didChangeFormState):
+        (WebKit::FormChangeWebViewClient::reset):
+        (WebKit::FormChangeWebViewClient::called):
+        (WebKit::FormChangeWebViewClient::focused):
+        (WebKit):
+        (WebKit::TEST_F):
+        * tests/data/input_field_set_value_while_focused.html: Added.
+        * tests/data/input_field_set_value_while_not_focused.html: Added.
+
+2012-07-04  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Unreviewed, Chromium gardening. Roll Chromium DEPS.
+
+        * DEPS: chromium_rev: 145322 => 145501
+
+2012-07-04  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Respect memory needed for RenderSurfaces when reserving contents textures
+        https://bugs.webkit.org/show_bug.cgi?id=89901
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCPrioritizedTextureTest.cpp:
+        (WTF::CCPrioritizedTextureTest::createManager):
+        (WTF::TEST_F):
+        (WTF):
+        * tests/CCTiledLayerTestCommon.cpp:
+        (WebKitTests::FakeTiledLayerChromium::setTexturePriorities):
+        (WebKitTests):
+        * tests/CCTiledLayerTestCommon.h:
+        (FakeTiledLayerChromium):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-07-04  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Clear RenderSurfaces still when no idle paint will be done
+        https://bugs.webkit.org/show_bug.cgi?id=90553
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (CCLayerTreeHostTestCompositeAndReadbackCleanup):
+        (WTF::CCLayerTreeHostTestCompositeAndReadbackCleanup::CCLayerTreeHostTestCompositeAndReadbackCleanup):
+        (WTF::CCLayerTreeHostTestCompositeAndReadbackCleanup::beginTest):
+        (WTF::CCLayerTreeHostTestCompositeAndReadbackCleanup::afterTest):
+        (WTF):
+
+2012-07-04  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove CCLayerTreeHostTestThreadOnly class to cleanup CCLayerTreeHostTests
+        https://bugs.webkit.org/show_bug.cgi?id=90556
+
+        Reviewed by Adrienne Walker.
+
+        Currently many tests that run both single and threaded versions subclass
+        from CCLayerTreeHostTestThreadOnly just from copy/pasting. The class
+        only adds a runTestThreaded() which calls runTest(true). Many other
+        tests do run only in threaded mode call runTest(true) themselves, making
+        for an inconsistent mess.
+
+        We remove CCLayerTreeHostTestThreadOnly class, so we don't have tests
+        inheriting it that are not thread-only. And now all tests that are
+        thread-only call runTest(true) consistently.
+
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::TEST_F):
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing and adds compile guards around the runtime setting.
+
+        Reviewed by Adam Barth.
+
+        * features.gypi:
+        * public/WebSettings.h:
+        * src/WebSettingsImpl.cpp:
+        (WebKit::WebSettingsImpl::setTextAutosizingEnabled):
+        * src/WebSettingsImpl.h:
+        (WebSettingsImpl):
+
+2012-07-04  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Correctly reject accelerated animations with certain rotations.
+        https://bugs.webkit.org/show_bug.cgi?id=89768
+
+        Reviewed by James Robinson.
+
+        * tests/GraphicsLayerChromiumTest.cpp:
+        (WebKitTests::TEST_F):
+        (WebKitTests):
+
+2012-07-03  Alex Sakhartchouk  <alexst@chromium.org>
+
+        [chromium] Avoid calling getUniformLocation??() in the compositor startup
+        https://bugs.webkit.org/show_bug.cgi?id=90217
+
+        Reviewed by Adrienne Walker.
+
+        Fixing the build error.
+
+        * tests/TextureCopierTest.cpp:
+
+2012-07-03  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Remove enableFasterDOMStoreAccess which is never used
+        https://bugs.webkit.org/show_bug.cgi?id=90489
+
+        Reviewed by Adam Barth.
+
+        * src/WebScriptController.cpp:
+        (WebKit::WebScriptController::enableV8SingleThreadMode):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * .gitignore:
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-03  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
+        https://bugs.webkit.org/show_bug.cgi?id=88338
+
+        Reviewed by David Levin.
+
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::startWorkerContext):
+        * src/WebWorkerClientImpl.cpp:
+        (WebKit::WebWorkerClientImpl::startWorkerContext):
+
+2012-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-07-02  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        [Chromium] Implement a Layout Test for editing/SurroundingText
+        https://bugs.webkit.org/show_bug.cgi?id=82461
+
+        Reviewed by Ryosuke Niwa.
+
+        Allow passing nodes as arguments for layout test methods.
+
+        * public/WebBindings.h:
+        (WebBindings):
+        * src/WebBindings.cpp:
+        (WebKit::getNodeImpl):
+        (WebKit):
+        (WebKit::WebBindings::getNode):
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * src/WebKit.cpp:
+        (WebKit::enableLogChannel):
+
+2012-07-01  Keishi Hattori  <keishi@webkit.org>
+
+        Unreviewed, rolling out r121650.
+        http://trac.webkit.org/changeset/121650
+        https://bugs.webkit.org/show_bug.cgi?id=90303
+
+        runhooks is failing for chromium win bots and
+        WebAnimationTest.DefaultSettings is crashing
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * src/WebAnimation.cpp: Removed.
+        * src/WebAnimationCurveCommon.cpp: Removed.
+        * src/WebAnimationCurveCommon.h: Removed.
+        * src/WebFloatAnimationCurve.cpp: Removed.
+        * src/WebTransformAnimationCurve.cpp: Removed.
+        * tests/WebAnimationTest.cpp: Removed.
+        * tests/WebFloatAnimationCurveTest.cpp: Removed.
+        * tests/WebTransformAnimationCurveTest.cpp: Removed.
+
+2012-07-01  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Create a WebKit::Web* wrapper for the cc animation classes
+        https://bugs.webkit.org/show_bug.cgi?id=90303
+
+        Reviewed by James Robinson.
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * src/WebAnimation.cpp: Added.
+        (WebKit):
+        (WebKit::WebAnimation::iterations):
+        (WebKit::WebAnimation::setIterations):
+        (WebKit::WebAnimation::startTime):
+        (WebKit::WebAnimation::setStartTime):
+        (WebKit::WebAnimation::timeOffset):
+        (WebKit::WebAnimation::setTimeOffset):
+        (WebKit::WebAnimation::alternatesDirection):
+        (WebKit::WebAnimation::setAlternatesDirection):
+        (WebKit::WebAnimation::toCCActiveAnimation):
+        (WebKit::WebAnimation::initialize):
+        (WebKit::WebAnimation::destroy):
+        * src/WebAnimationCurveCommon.cpp: Added.
+        (WebKit):
+        (WebKit::createTimingFunction):
+        * src/WebAnimationCurveCommon.h: Added.
+        (WebCore):
+        (WebKit):
+        * src/WebFloatAnimationCurve.cpp: Added.
+        (WebKit):
+        (WebKit::WebFloatAnimationCurve::add):
+        (WebKit::WebFloatAnimationCurve::toCCAnimationCurve):
+        (WebKit::WebFloatAnimationCurve::initialize):
+        (WebKit::WebFloatAnimationCurve::destroy):
+        * src/WebTransformAnimationCurve.cpp: Added.
+        (WebKit):
+        (WebKit::WebTransformAnimationCurve::add):
+        (WebKit::WebTransformAnimationCurve::toCCAnimationCurve):
+        (WebKit::WebTransformAnimationCurve::initialize):
+        (WebKit::WebTransformAnimationCurve::destroy):
+        * tests/WebAnimationTest.cpp: Added.
+        * tests/WebFloatAnimationCurveTest.cpp: Added.
+        * tests/WebTransformAnimationCurveTest.cpp: Added.
+
+2012-06-30  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] CanvasLayerTextureUpdater needs to convert opaque rects back to content space.
+        https://bugs.webkit.org/show_bug.cgi?id=90092
+
+        The CanvasLayerTextureUpdater currently receives its opaque rects in
+        layer space, but is expected to return them in content space and does
+        not convert them. This patch adds this conversion. To avoid numerical
+        errors, this patch also switches to using float rects to store opaque
+        rects where appropriate.
+
+        Reviewed by Adrienne Walker.
+
+        * WebKit.gypi:
+        * src/WebContentLayerImpl.cpp:
+        (WebKit::WebContentLayerImpl::paintContents):
+        * src/WebContentLayerImpl.h:
+        (WebContentLayerImpl):
+        * tests/CCLayerTreeHostCommonTest.cpp:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::TestOpacityChangeLayerDelegate::paintContents):
+        (WTF::MockContentLayerDelegate::paintContents):
+        * tests/ContentLayerChromiumTest.cpp: Added.
+        (WebKit):
+        (OpaqueRectDrawingGraphicsContextPainter):
+        (WebKit::OpaqueRectDrawingGraphicsContextPainter::OpaqueRectDrawingGraphicsContextPainter):
+        (WebKit::OpaqueRectDrawingGraphicsContextPainter::~OpaqueRectDrawingGraphicsContextPainter):
+        (MockContentLayerDelegate):
+        (WebKit::MockContentLayerDelegate::MockContentLayerDelegate):
+        (WebKit::TEST):
+        * tests/LayerChromiumTest.cpp:
+        * tests/OpaqueRectTrackingContentLayerDelegateTest.cpp:
+        (WebCore::TEST_F):
+        * tests/TiledLayerChromiumTest.cpp:
+        * tests/WebLayerTest.cpp:
+
+2012-06-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Keep direction on IDBCursor to avoid calls to back end
+        https://bugs.webkit.org/show_bug.cgi?id=90114
+
+        Stop plumbing IDBCursorBackendInterface::direction() through API.
+
+        Reviewed by Tony Chang.
+
+        * src/IDBCursorBackendProxy.cpp:
+        * src/IDBCursorBackendProxy.h:
+        (IDBCursorBackendProxy):
+        * src/WebIDBCursorImpl.cpp:
+        * src/WebIDBCursorImpl.h:
+        (WebIDBCursorImpl):
+
+2012-06-29  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] WebFontRendering.cpp requires some OS(ANDROID) ifdefs to build downstream
+        https://bugs.webkit.org/show_bug.cgi?id=90292
+
+        Reviewed by Nate Chapin.
+
+        These ifdefs are required to build this file downstream. There's some
+        sublte difference between how the OS flags are set upstream and
+        downstream. This is on our list of issues to resolve, but in the
+        meantime, this patch makes these files identical upstream and
+        downstream to reduce noise in the upstreaming queue.
+
+        * src/linux/WebFontRendering.cpp:
+        (WebKit::WebFontRendering::setSubpixelPositioning):
+
+2012-06-29  Eric Penner  <epenner@google.com>
+
+        [chromium] Adding PrioritizedTexture and replacing ContentsTextureManager
+        https://bugs.webkit.org/show_bug.cgi?id=84308
+
+        Reviewed by Adrienne Walker.
+
+        * WebKit.gypi:
+        * tests/CCLayerTreeHostTest.cpp:
+        (WTF::CCLayerTreeHostTestAtomicCommitWithPartialUpdate::commitCompleteOnCCThread):
+        * tests/CCPrioritizedTextureTest.cpp: Added.
+        (WTF):
+        (CCPrioritizedTextureTest):
+        (WTF::CCPrioritizedTextureTest::CCPrioritizedTextureTest):
+        (WTF::CCPrioritizedTextureTest::~CCPrioritizedTextureTest):
+        (WTF::CCPrioritizedTextureTest::texturesMemorySize):
+        (WTF::CCPrioritizedTextureTest::createManager):
+        (WTF::CCPrioritizedTextureTest::validateTexture):
+        (WTF::CCPrioritizedTextureTest::allocator):
+        (WTF::TEST_F):
+        * tests/CCTiledLayerTestCommon.cpp:
+        (WebKitTests::FakeLayerTextureUpdater::Texture::Texture):
+        (WebKitTests::FakeLayerTextureUpdater::Texture::updateRect):
+        (WebKitTests::FakeLayerTextureUpdater::createTexture):
+        (WebKitTests::FakeTiledLayerChromium::FakeTiledLayerChromium):
+        (WebKitTests::FakeTiledLayerWithScaledBounds::FakeTiledLayerWithScaledBounds):
+        * tests/CCTiledLayerTestCommon.h:
+        (Texture):
+        (FakeLayerTextureUpdater):
+        (FakeTiledLayerChromium):
+        (FakeTiledLayerWithScaledBounds):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-06-29  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Roll chromium rev to 144906
+        https://bugs.webkit.org/show_bug.cgi?id=90278
+
+        Unreviewed. Deps roll.
+
+        * DEPS:
+
+2012-06-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Device Metrics] "Fit window" option inhibits adjusting the page zoom factor
+        https://bugs.webkit.org/show_bug.cgi?id=90187
+
+        Reviewed by Vsevolod Vlasov.
+
+        This change fixes the stale zoom factor, which does not get updated upon browser window resize in the "Fit window" mode.
+        The expected test results have little to do with actual dimensions of the test page in Chrome on a real mobile device,
+        since Chrome on the mobile uses a different zooming technique (pageScaleFactor-based viewport using layout width
+        rather than plain pageZoomFactor) and font boosting, which has not been upstreamed yet.
+
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::DeviceMetricsSupport::autoZoomPageToFitWidth):
+        (WebKit::DeviceMetricsSupport::ensureOriginalZoomFactor):
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        Updated the call to computeViewportAttributes.
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::dispatchViewportPropertiesDidChange):
+
+2012-06-29  Amy Ousterhout  <aousterh@chromium.org>
+
+        Deleting unused function in WebDeviceOrientation
+        https://bugs.webkit.org/show_bug.cgi?id=90185
+
+        Reviewed by Adam Barth.
+
+        Deleting the unused copy assignment function in WebDeviceOrientation.
+
+        * public/WebDeviceOrientation.h:
+        (WebDeviceOrientation):
+        * src/WebDeviceOrientation.cpp:
+
+2012-06-29  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement Date Time format parser
+        https://bugs.webkit.org/show_bug.cgi?id=89963
+
+        Reviewed by Kent Tamura.
+
+        This patch adds an unit test for date time format parser if
+        ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS) is true.
+
+        * tests/DateTimeFormatTest.cpp: Added.
+        (DateTimeFormatTest):
+        (Token):
+        (DateTimeFormatTest::Token::Token):
+        (DateTimeFormatTest::Token::operator==):
+        (DateTimeFormatTest::Token::toString):
+        (Tokens):
+        (DateTimeFormatTest::Tokens::Tokens):
+        (DateTimeFormatTest::Tokens::operator==):
+        (DateTimeFormatTest::Tokens::toString):
+        (DateTimeFormatTest::parse):
+        (DateTimeFormatTest::single):
+        (TokenHandler):
+        (DateTimeFormatTest::TokenHandler::~TokenHandler):
+        (DateTimeFormatTest::TokenHandler::fieldType):
+        (DateTimeFormatTest::TokenHandler::tokens):
+        (DateTimeFormatTest::TokenHandler::visitField):
+        (DateTimeFormatTest::TokenHandler::visitLiteral):
+        (operator<<):
+        (TEST_F):
+
+2012-06-28  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Implement IDBTransaction internal active flag
+        https://bugs.webkit.org/show_bug.cgi?id=89379
+
+        Reviewed by Tony Chang.
+
+        To match the IDB spec, transactions that have had no requests
+        filed against them should commit, not abort. This requires plumbing
+        through the commit() call from front-end to back-end.
+
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebKit::IDBTransactionBackendProxy::commit):
+        (WebKit):
+        * src/IDBTransactionBackendProxy.h:
+        (IDBTransactionBackendProxy):
+        * src/WebIDBTransactionImpl.cpp:
+        (WebKit::WebIDBTransactionImpl::commit):
+        (WebKit):
+        * src/WebIDBTransactionImpl.h:
+
+2012-06-28  Adrienne Walker  <enne@google.com>
+
+        [chromium] Split WebScrollbar into WebPluginScrollbar and WebScrollbar
+        https://bugs.webkit.org/show_bug.cgi?id=90117
+
+        Reviewed by James Robinson.
+
+        Convert WebScrollbar/WebScrollbarClient/WebScrollbarImpl to be
+        WebPluginScrollbar, WebPluginScrollbarClient, and
+        WebPluginScrollbarImpl. Modify ScrollbarGroup
+        to use this instead.
+
+        WebScrollbar is now the base interface for a pre-existing scrollbar
+        that is accessed in a const manner. It also provides all of the common
+        WebKit ScrollTypes.h enums. WebPluginScrollbar is now a scrollbar that
+        has been externally created and is externally modified in terms of its
+        position, invalidation, and painting.
+
+        This is a pre-refactoring for adding Web versions of ScrollbarTheme
+        into the Platform directory which will operate on WebScrollbar, but
+        that don't need all of what WebPluginScrollbar provides.
+
+        As WebScrollbar is moved to Platform, WebKit.gyp now must depend on
+        Platform as well.
+
+        * WebKit.gyp:
+        * public/WebPluginScrollbar.h:
+        (WebKit):
+        (WebPluginScrollbar):
+        (WebKit::WebPluginScrollbar::~WebPluginScrollbar):
+        * public/WebPluginScrollbarClient.h:
+        (WebKit):
+        (WebPluginScrollbarClient):
+        * public/WebScrollbar.h: Removed.
+        * public/WebScrollbarClient.h: Removed.
+        * src/AssertMatchingEnums.cpp:
+        * src/ScrollbarGroup.cpp:
+        (WebKit::ScrollbarGroup::scrollbarCreated):
+        (WebKit::ScrollbarGroup::scrollbarDestroyed):
+        (WebKit::ScrollbarGroup::scrollSize):
+        (WebKit::ScrollbarGroup::scrollPosition):
+        (WebKit::ScrollbarGroup::contentsSize):
+        * src/ScrollbarGroup.h:
+        (WebKit):
+        (ScrollbarGroup):
+        * src/WebPluginScrollbarImpl.cpp: Renamed from Source/WebKit/chromium/src/WebScrollbarImpl.cpp.
+        (WebKit):
+        (WebKit::WebPluginScrollbar::createForPlugin):
+        (WebKit::WebPluginScrollbar::defaultThickness):
+        (WebKit::WebPluginScrollbarImpl::WebPluginScrollbarImpl):
+        (WebKit::WebPluginScrollbarImpl::~WebPluginScrollbarImpl):
+        (WebKit::WebPluginScrollbarImpl::setScrollOffset):
+        (WebKit::WebPluginScrollbarImpl::invalidateScrollbarRect):
+        (WebKit::WebPluginScrollbarImpl::getTickmarks):
+        (WebKit::WebPluginScrollbarImpl::convertFromContainingViewToScrollbar):
+        (WebKit::WebPluginScrollbarImpl::scrollbarStyleChanged):
+        (WebKit::WebPluginScrollbarImpl::isOverlay):
+        (WebKit::WebPluginScrollbarImpl::value):
+        (WebKit::WebPluginScrollbarImpl::setLocation):
+        (WebKit::WebPluginScrollbarImpl::setValue):
+        (WebKit::WebPluginScrollbarImpl::setDocumentSize):
+        (WebKit::WebPluginScrollbarImpl::scroll):
+        (WebKit::WebPluginScrollbarImpl::paint):
+        (WebKit::WebPluginScrollbarImpl::handleInputEvent):
+        (WebKit::WebPluginScrollbarImpl::onMouseDown):
+        (WebKit::WebPluginScrollbarImpl::onMouseUp):
+        (WebKit::WebPluginScrollbarImpl::onMouseMove):
+        (WebKit::WebPluginScrollbarImpl::onMouseLeave):
+        (WebKit::WebPluginScrollbarImpl::onMouseWheel):
+        (WebKit::WebPluginScrollbarImpl::onKeyDown):
+        * src/WebPluginScrollbarImpl.h: Added.
+        (WebCore):
+        (WebKit):
+        (WebPluginScrollbarImpl):
+        (WebKit::WebPluginScrollbarImpl::scrollOffset):
+        (WebKit::WebPluginScrollbarImpl::scrollbar):
+        * src/WebScrollbarImpl.h: Removed.
+
+2012-06-28  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] On Android, we should be able to ask the embedder what intents exist in a region of the page
+        https://bugs.webkit.org/show_bug.cgi?id=90210
+
+        Reviewed by Dimitri Glazkov.
+
+        This patch introduces a function that asks the embedder to analyze the
+        region around a hit test result for interesting content, like phone
+        numbers, email addresses, or physical addresses. The embedder then
+        responds with the "most interesting" content, together with an intent
+        URL for enacting the intent embodied by that content.
+
+        This function will be used in a subsequent patch to detect content
+        after touch events.
+
+        * WebKit.gyp:
+        * public/WebContentDetectionResult.h: Added.
+        (WebKit):
+        (WebContentDetectionResult):
+        (WebKit::WebContentDetectionResult::WebContentDetectionResult):
+        (WebKit::WebContentDetectionResult::isValid):
+        (WebKit::WebContentDetectionResult::range):
+        (WebKit::WebContentDetectionResult::string):
+        (WebKit::WebContentDetectionResult::intent):
+        * public/WebViewClient.h:
+        (WebViewClient):
+        (WebKit::WebViewClient::detechContentAround):
+
+2012-06-28  Alec Flett  <alecflett@chromium.org>
+
+        IndexedDB: Hook up render-side key ASSERTing for get()
+        https://bugs.webkit.org/show_bug.cgi?id=90001
+
+        Reviewed by Tony Chang.
+
+        Hook up Chromium WebKit API to new onSuccess handler.
+
+        * src/WebIDBCallbacksImpl.cpp:
+        (WebKit::WebIDBCallbacksImpl::onSuccess):
+        * tests/IDBAbortOnCorruptTest.cpp:
+        (WebCore::MockIDBCallbacks::onSuccess):
+        * tests/IDBDatabaseBackendTest.cpp:
+
+2012-06-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed.  Rolled DEPS.
+
+        * DEPS:
+
+2012-06-28  Alpha Lam  <hclam@chromium.org>
+
+        Unreviewed, rolling out r121463.
+        http://trac.webkit.org/changeset/121463
+        https://bugs.webkit.org/show_bug.cgi?id=90094
+
+        Broke Windows build.
+
+        * WebKit.gypi:
+        * WebKitUnitTests.gyp:
+        * public/WebDOMMessageEvent.h:
+        * tests/AssociatedURLLoaderTest.cpp:
+        (WebKit::AssociatedURLLoaderTest::AssociatedURLLoaderTest):
+        (WebKit::AssociatedURLLoaderTest::SetUp):
+        (WebKit::AssociatedURLLoaderTest::CheckMethodFails):
+        (WebKit::AssociatedURLLoaderTest::CheckHeaderFails):
+        (WebKit::AssociatedURLLoaderTest::CheckAccessControlHeaders):
+        (WebKit::TEST_F):
+        * tests/EventListenerTest.cpp:
+        * tests/FrameTestHelpers.cpp:
+        (WebKit::FrameTestHelpers::registerMockedURLLoad):
+        (FrameTestHelpers):
+        (WebKit::FrameTestHelpers::loadFrame):
+        * tests/FrameTestHelpers.h:
+        (FrameTestHelpers):
+        * tests/ListenerLeakTest.cpp:
+        (WebKit::ListenerLeakTest::RunTest):
+        * tests/PopupMenuTest.cpp:
+        (WebKit::SelectPopupMenuTest::registerMockedURLLoad):
+        (WebKit::SelectPopupMenuTest::loadFrame):
+        (WebKit::TEST_F):
+        * tests/RunAllTests.cpp:
+        * tests/URLTestHelpers.cpp: Removed.
+        * tests/URLTestHelpers.h: Removed.
+        * tests/WebFrameTest.cpp:
+        (WebKit::WebFrameTest::registerMockedHttpURLLoad):
+        (WebKit::WebFrameTest::registerMockedChromeURLLoad):
+        (WebKit::TEST_F):
+        * tests/WebPageNewSerializerTest.cpp:
+        (WebKit::WebPageNewSerializeTest::registerMockedURLLoad):
+        (WebPageNewSerializeTest):
+        (WebKit::WebPageNewSerializeTest::setUpCSSTestPage):
+        (WebKit::WebPageNewSerializeTest::loadURLInTopFrame):
+        (WebKit::WebPageNewSerializeTest::resourceVectorContains):
+        (WebKit::TEST_F):
+        * tests/WebPageSerializerTest.cpp:
+        (WebKit::WebPageSerializerTest::registerMockedURLLoad):
+        (WebKit::WebPageSerializerTest::loadURLInTopFrame):
+        (WebKit::WebPageSerializerTest::webVectorContains):
+        (WebKit::TEST_F):
+        * tests/WebViewTest.cpp:
+        (WebKit::TEST_F):
+        (WebKit::WebViewTest::testAutoResize):
+        (WebKit::WebViewTest::testTextInputType):
+
+2012-06-28  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Use WEBKIT_IMPLEMENTATION == 1 for webkit_unit_tests
+        https://bugs.webkit.org/show_bug.cgi?id=90094
+
+        Reviewed by Adam Barth.
+
+        This patch adds the WEBKIT_IMPLEMENTATION = 1 define to
+        WebKitUnitTests.gyp. To get it to compile correctly, some string
+        and URL code was refactored and fixed.
+
+        * WebKit.gypi:
+        * WebKitUnitTests.gyp:
+        * public/WebDOMMessageEvent.h:
+        (WebKit::WebDOMMessageEvent::WebDOMMessageEvent):
+        * tests/AssociatedURLLoaderTest.cpp:
+        * tests/EventListenerTest.cpp:
+        * tests/FrameTestHelpers.cpp:
+        (WebKit::FrameTestHelpers::loadFrame):
+        * tests/FrameTestHelpers.h:
+        * tests/ListenerLeakTest.cpp:
+        (WebKit::ListenerLeakTest::RunTest):
+        * tests/PopupMenuTest.cpp:
+        * tests/RunAllTests.cpp:
+        * tests/URLTestHelpers.cpp: Added.
+        (URLTestHelpers):
+        (WebKit::URLTestHelpers::registerMockedURLFromBaseURL):
+        (WebKit::URLTestHelpers::registerMockedURLLoad):
+        * tests/URLTestHelpers.h: Copied from Source/WebKit/chromium/public/WebDOMMessageEvent.h.
+        (WebKit):
+        (URLTestHelpers):
+        (WebKit::URLTestHelpers::toKURL):
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageNewSerializerTest.cpp:
+        * tests/WebPageSerializerTest.cpp:
+        * tests/WebViewTest.cpp:
+
+2012-06-28  Oli Lan  <olilan@chromium.org>
+
+        [chromium] Change WebViewImpl::textInputInfo to use root editable element.
+        https://bugs.webkit.org/show_bug.cgi?id=90179
+
+        Reviewed by Adam Barth.
+
+        WebViewImpl::textInputInfo currently returns text value and offsets relative to the
+        focused node. For contenteditable nodes, this may not give the expected result.
+
+        This patch changes the method to return value and offsets for the root editable element.
+        This also allows the implementation to be simplified somewhat.
+
+        This also ensures that the offsets returned will use the same basis as the recently added
+        method Editor::setSelectionOffsets (and WebViewImpl::setEditableSelectionOffsets).
+
+        Testing for textInputInfo has been added to WebViewTest.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::textInputInfo):
+        * tests/WebViewTest.cpp:
+        (WebKit::TEST_F):
+
+2012-06-28  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Should schedule a commit when dropping contents textures
+        https://bugs.webkit.org/show_bug.cgi?id=90031
+
+        Reviewed by Adrienne Walker.
+
+        Adds a somewhat vacuous test unit test for committing when releasing textures.
+
+        * tests/CCLayerTreeHostImplTest.cpp:
+
+2012-06-27  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Do not multiply bounds by contentsScale in TiledLayerChromium and CanvasLayerTextureUpdater
+        https://bugs.webkit.org/show_bug.cgi?id=90103
+
+        Reviewed by Adrienne Walker.
+
+        * tests/CCTiledLayerTestCommon.cpp:
+        (WebKitTests::FakeLayerTextureUpdater::prepareToUpdate):
+        * tests/CCTiledLayerTestCommon.h:
+        (FakeTiledLayerChromium):
+        * tests/TiledLayerChromiumTest.cpp:
+
+2012-06-28  Dan Alcantara  <dfalcantara@chromium.org>
+
+        [chromium] Introduce way to reload a page using the original request URL
+        https://bugs.webkit.org/show_bug.cgi?id=89788
+
+        Reviewed by Adam Barth.
+
+        Adds a new reload method for cases where we need to override the URL
+        when reloading a page. This is needed for situations where a server
+        redirects navigation based on information that may have changed since
+        the last time the page was loaded.
+        
+        User agents, for example, can cause a server to redirect to the mobile
+        version of a page.  Changing to the desktop version by switching user agents
+        requires loading a URL from before the redirect occurred.
+
+        Also adds a unit test to confirm that scroll position and page scale are
+        saved when the reload occurs.
+
+        * public/WebFrame.h:
+        (WebFrame):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::reloadWithGivenURL):
+        (WebKit):
+        * src/WebFrameImpl.h:
+        (WebFrameImpl):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::setClearPageScaleFactorOnLoad):
+        (WebKit):
+        (WebKit::WebViewImpl::didCommitLoad):
+        * src/WebViewImpl.h:
+        (WebViewImpl):
+
+2012-06-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121395.
+        http://trac.webkit.org/changeset/121395
+        https://bugs.webkit.org/show_bug.cgi?id=90143
+
+        Patch causes crashes in fast/workers/worker-context-gc.html
+        (Requested by zdobersek on #webkit).
+
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::startWorkerContext):
+        * src/WebWorkerClientImpl.cpp:
+        (WebKit::WebWorkerClientImpl::startWorkerContext):
+
+2012-06-28  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement functions for localized time format information
+        https://bugs.webkit.org/show_bug.cgi?id=89965
+
+        Reviewed by Kent Tamura.
+
+        This patch adds new test LocalizedDateICUTest if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+        is true.
+
+        * WebKit.gypi:
+        * tests/LocalizedDateICUTest.cpp: Added.
+        (LocalizedDateICUTest):
+        (Labels):
+        (LocalizedDateICUTest::Labels::Labels):
+        (LocalizedDateICUTest::Labels::operator==):
+        (LocalizedDateICUTest::Labels::toString):
+        (LocalizedDateICUTest::labels):
+        (LocalizedDateICUTest::localizedDateFormatText):
+        (LocalizedDateICUTest::localizedShortDateFormatText):
+        (LocalizedDateICUTest::timeAMPMLabels):
+        (operator<<):
+        (TEST_F):
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121405.
+        http://trac.webkit.org/changeset/121405
+        https://bugs.webkit.org/show_bug.cgi?id=90135
+
+        broke windows build (Requested by shawnsingh_ on #webkit).
+
+        * WebKit.gypi:
+        * WebKitUnitTests.gyp:
+        * public/WebDOMMessageEvent.h:
+        * tests/AssociatedURLLoaderTest.cpp:
+        (WebKit::AssociatedURLLoaderTest::AssociatedURLLoaderTest):
+        (WebKit::AssociatedURLLoaderTest::SetUp):
+        (WebKit::AssociatedURLLoaderTest::CheckMethodFails):
+        (WebKit::AssociatedURLLoaderTest::CheckHeaderFails):
+        (WebKit::AssociatedURLLoaderTest::CheckAccessControlHeaders):
+        (WebKit::TEST_F):
+        * tests/EventListenerTest.cpp:
+        * tests/FrameTestHelpers.cpp:
+        (WebKit::FrameTestHelpers::registerMockedURLLoad):
+        (FrameTestHelpers):
+        (WebKit::FrameTestHelpers::loadFrame):
+        * tests/FrameTestHelpers.h:
+        (FrameTestHelpers):
+        * tests/ListenerLeakTest.cpp:
+        (WebKit::ListenerLeakTest::RunTest):
+        * tests/PopupMenuTest.cpp:
+        (WebKit::SelectPopupMenuTest::registerMockedURLLoad):
+        (WebKit::SelectPopupMenuTest::loadFrame):
+        * tests/RunAllTests.cpp:
+        * tests/URLTestHelpers.cpp: Removed.
+        * tests/URLTestHelpers.h: Removed.
+        * tests/WebFrameTest.cpp:
+        (WebKit::WebFrameTest::registerMockedHttpURLLoad):
+        (WebKit::WebFrameTest::registerMockedChromeURLLoad):
+        (WebKit::TEST_F):
+        * tests/WebPageNewSerializerTest.cpp:
+        (WebKit::WebPageNewSerializeTest::registerMockedURLLoad):
+        (WebPageNewSerializeTest):
+        (WebKit::WebPageNewSerializeTest::setUpCSSTestPage):
+        (WebKit::WebPageNewSerializeTest::loadURLInTopFrame):
+        (WebKit::WebPageNewSerializeTest::resourceVectorContains):
+        (WebKit::TEST_F):
+        * tests/WebPageSerializerTest.cpp:
+        (WebKit::WebPageSerializerTest::registerMockedURLLoad):
+        (WebKit::WebPageSerializerTest::loadURLInTopFrame):
+        (WebKit::WebPageSerializerTest::webVectorContains):
+        (WebKit::TEST_F):
+        * tests/WebViewTest.cpp:
+        (WebKit::TEST_F):
+        (WebKit::WebViewTest::testAutoResize):
+        (WebKit::WebViewTest::testTextInputType):
+
+2012-06-27  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Use WEBKIT_IMPLEMENTATION == 1 for webkit_unit_tests
+        https://bugs.webkit.org/show_bug.cgi?id=90094
+
+        Reviewed by James Robinson.
+
+        This patch adds the WEBKIT_IMPLEMENTATION = 1 define to
+        WebKitUnitTests.gyp. To get it to compile correctly, some string
+        and URL code was refactored and fixed.
+
+        * WebKit.gypi:
+        * WebKitUnitTests.gyp:
+        * public/WebDOMMessageEvent.h:
+        (WebKit::WebDOMMessageEvent::WebDOMMessageEvent):
+        * tests/AssociatedURLLoaderTest.cpp:
+        * tests/EventListenerTest.cpp:
+        * tests/FrameTestHelpers.cpp:
+        (WebKit::FrameTestHelpers::loadFrame):
+        * tests/FrameTestHelpers.h:
+        * tests/ListenerLeakTest.cpp:
+        (WebKit::ListenerLeakTest::RunTest):
+        * tests/PopupMenuTest.cpp:
+        * tests/RunAllTests.cpp:
+        * tests/URLTestHelpers.cpp: Added.
+        (URLTestHelpers):
+        (WebKit::URLTestHelpers::registerMockedURLFromBaseURL):
+        (WebKit::URLTestHelpers::registerMockedURLLoad):
+        * tests/URLTestHelpers.h: Copied from Source/WebKit/chromium/public/WebDOMMessageEvent.h.
+        (WebKit):
+        (URLTestHelpers):
+        (WebKit::URLTestHelpers::toKURL):
+        * tests/WebFrameTest.cpp:
+        * tests/WebPageNewSerializerTest.cpp:
+        * tests/WebPageSerializerTest.cpp:
+        * tests/WebViewTest.cpp:
+
+2012-06-27  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Platform] Implement localizedDecimalSeparator function
+        https://bugs.webkit.org/show_bug.cgi?id=90036
+
+        Reviewed by Kent Tamura.
+
+        This patch adds test case for localizedDecimalSeparator().
+
+        * tests/LocalizedNumberICUTest.cpp:
+        (testDecimalSeparator):
+        (TEST):
+
+2012-06-27  Yusuke Sato  <yusukes@chromium.org>
+
+        [chromium] Improve keyboardEvent() so a web page could receive a DOM3 spec compliant keyboard event.
+        https://bugs.webkit.org/show_bug.cgi?id=89637
+
+        Reviewed by Tony Chang.
+
+        This is a Gtk port of http://crrev.com/142209.
+
+        Normalizes event->state to make it Windows/Mac compatible. Since the
+        way of setting modifier mask on X is very different than Windows/Mac
+        as shown in http://crbug.com/127142#c8, the normalization is necessary.
+
+        * src/gtk/WebInputEventFactory.cpp:
+        (WebKit):
+        (WebKit::normalizeEventState):
+        (WebKit::WebInputEventFactory::keyboardEvent):
+
+2012-06-27  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Use SkColor in compositor internals
+        https://bugs.webkit.org/show_bug.cgi?id=90108
+
+        Reviewed by Adrienne Walker.
+
+        * src/NonCompositedContentHost.cpp:
+        (WebKit::NonCompositedContentHost::setBackgroundColor):
+        * tests/CCLayerImplTest.cpp:
+        (WebCore::TEST):
+        * tests/CCLayerTreeHostImplTest.cpp:
+        * tests/CCSolidColorLayerImplTest.cpp:
+        (CCLayerTestCommon::TEST):
+        * tests/LayerChromiumTest.cpp:
+
+2012-06-27  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        IndexedDB: should make the LevelDB persistant to the directory indicated in PageGroupSettings::indexedDBDataBasePath
+        https://bugs.webkit.org/show_bug.cgi?id=88338
+
+        Reviewed by David Levin.
+
+        * src/WebSharedWorkerImpl.cpp:
+        (WebKit::WebSharedWorkerImpl::startWorkerContext):
+        * src/WebWorkerClientImpl.cpp:
+        (WebKit::WebWorkerClientImpl::startWorkerContext):
+
+2012-06-27  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: Expose WebIDBTransaction::commit() method in public API
+        https://bugs.webkit.org/show_bug.cgi?id=90089
+
+        Reviewed by James Robinson.
+
+        Prep work for http://webkit.org/b/89379 which requires empty transactions to
+        trigger a commit from the front-end.
+
+        * public/WebIDBTransaction.h:
+        (WebKit::WebIDBTransaction::commit):
+
+2012-06-27  Josh Horwich  <jhorwich@chromium.org>
+
+        [chromium] Expose device scale factor in WebPluginContainer
+        https://bugs.webkit.org/show_bug.cgi?id=87874
+
+        Reviewed by Adam Barth.
+
+        * public/WebPluginContainer.h:
+        (WebPluginContainer):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::deviceScaleFactor):
+        (WebKit):
+        (WebKit::WebPluginContainerImpl::pageScaleFactor):
+        (WebKit::WebPluginContainerImpl::pageZoomFactor):
+        * src/WebPluginContainerImpl.h:
+        (WebPluginContainerImpl):
+
+2012-06-27  Robert Kroeger  <rjkroege@chromium.org>
+
+        [chromium] out-of-order assert in WebViewImpl setDeviceScaleFactor
+        https://bugs.webkit.org/show_bug.cgi?id=90006
+
+        The assert in WebViewImpl::setDeviceScaleFactor should test for non-scaling
+        after we have set both m_DeviceScaleInCompositor and page()->deviceScaleFactor()
+        instead of in between.
+
+        Reviewed by James Robinson.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setDeviceScaleFactor):
+
 2012-06-26  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed.  Rolled DEPS.
diff --git a/Source/WebKit/chromium/DEPS b/Source/WebKit/chromium/DEPS
index 94cb27e29..67aef6ffa 100644
--- a/Source/WebKit/chromium/DEPS
+++ b/Source/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '144160'
+  'chromium_rev': '145569'
 }
 
 deps = {
diff --git a/Source/WebKit/chromium/WebKit.gyp b/Source/WebKit/chromium/WebKit.gyp
index d75f5b709..6fce44075 100644
--- a/Source/WebKit/chromium/WebKit.gyp
+++ b/Source/WebKit/chromium/WebKit.gyp
@@ -68,7 +68,7 @@
             'variables': { 'enable_wexit_time_destructors': 1, },
             'dependencies': [
                 '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
-                '../../Platform/Platform.gyp/Platform.gyp:webkit_platform', # actually WebCore should depend on this
+                '../../Platform/Platform.gyp/Platform.gyp:webkit_platform',
                 '<(chromium_src_dir)/skia/skia.gyp:skia',
                 '<(chromium_src_dir)/third_party/icu/icu.gyp:icuuc',
                 '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
@@ -76,6 +76,7 @@
                 '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
             ],
             'export_dependent_settings': [
+                '../../Platform/Platform.gyp/Platform.gyp:webkit_platform',
                 '<(chromium_src_dir)/skia/skia.gyp:skia',
                 '<(chromium_src_dir)/third_party/icu/icu.gyp:icuuc',
                 '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
@@ -116,6 +117,7 @@
                 'public/WebCompositorInputHandler.h',
                 'public/WebCompositorInputHandlerClient.h',
                 'public/WebConsoleMessage.h',
+                'public/WebContentDetectionResult.h',
                 'public/WebContextMenuData.h',
                 'public/WebCrossOriginPreflightResultCache.h',
                 'public/WebCursorInfo.h',
@@ -238,8 +240,6 @@
                 'public/WebScreenInfo.h',
                 'public/WebScriptController.h',
                 'public/WebScriptSource.h',
-                'public/WebScrollbar.h',
-                'public/WebScrollbarClient.h',
                 'public/WebSearchableFormData.h',
                 'public/WebSecurityOrigin.h',
                 'public/WebSecurityPolicy.h',
@@ -477,8 +477,11 @@
                 'src/WebTextCheckingCompletionImpl.cpp',
                 'src/WebTextCheckingResult.cpp',
                 'src/WebAccessibilityObject.cpp',
+                'src/WebAnimation.cpp',
                 'src/WebAnimationControllerImpl.cpp',
                 'src/WebAnimationControllerImpl.h',
+                'src/WebAnimationCurveCommon.cpp',
+                'src/WebAnimationCurveCommon.h',
                 'src/WebArrayBuffer.cpp',
                 'src/WebArrayBufferView.cpp',
                 'src/WebBindings.cpp',
@@ -527,6 +530,7 @@
                 'src/WebFileChooserCompletionImpl.h',
                 'src/WebFileSystemCallbacksImpl.cpp',
                 'src/WebFileSystemCallbacksImpl.h',
+                'src/WebFloatAnimationCurve.cpp',
                 'src/WebFontCache.cpp',
                 'src/WebFontDescription.cpp',
                 'src/WebFontImpl.cpp',
@@ -615,6 +619,8 @@
                 'src/WebPluginListBuilderImpl.h',
                 'src/WebPluginLoadObserver.cpp',
                 'src/WebPluginLoadObserver.h',
+                'src/WebPluginScrollbarImpl.cpp',
+                'src/WebPluginScrollbarImpl.h',
                 'src/WebPopupMenuImpl.cpp',
                 'src/WebPopupMenuImpl.h',
                 'src/WebRange.cpp',
@@ -624,8 +630,6 @@
                 'src/WebScopedUserGesture.cpp',
                 'src/WebScriptController.cpp',
                 'src/WebScrollableLayer.cpp',
-                'src/WebScrollbarImpl.cpp',
-                'src/WebScrollbarImpl.h',
                 'src/WebSearchableFormData.cpp',
                 'src/WebSecurityOrigin.cpp',
                 'src/WebSecurityPolicy.cpp',
@@ -651,6 +655,7 @@
                 'src/WebSurroundingText.cpp',
                 'src/WebTextInputInfo.cpp',
                 'src/WebTextRun.cpp',
+                'src/WebTransformAnimationCurve.cpp',
                 'src/WebURLLoadTiming.cpp',
                 'src/WebScopedUserGesture.cpp',
                 'src/WebTextFieldDecoratorClient.cpp',
@@ -859,6 +864,7 @@
                 ['OS=="android"', {
                     'sources/': [
                         ['include', '^src/linux/WebFontRendering\\.cpp$'],
+                        ['include', '^src/linux/WebFontRenderStyle\\.cpp$'],
                     ],
                 }],
             ],
diff --git a/Source/WebKit/chromium/WebKit.gypi b/Source/WebKit/chromium/WebKit.gypi
index c410e6f4f..1a5babfd0 100644
--- a/Source/WebKit/chromium/WebKit.gypi
+++ b/Source/WebKit/chromium/WebKit.gypi
@@ -86,6 +86,7 @@
             'tests/CCSchedulerStateMachineTest.cpp',
             'tests/CCSchedulerTestCommon.h',
             'tests/CCSchedulerTest.cpp',
+            'tests/CCScopedTextureTest.cpp',
             'tests/CCSolidColorLayerImplTest.cpp',
             'tests/CCTestCommon.h',
             'tests/CCTiledLayerImplTest.cpp',
@@ -97,6 +98,8 @@
             'tests/CCTimerTest.cpp',
             'tests/ClipboardChromiumTest.cpp',
             'tests/CompositorFakeWebGraphicsContext3D.h',
+            'tests/ContentLayerChromiumTest.cpp',
+            'tests/DateTimeFormatTest.cpp',
             'tests/DecimalTest.cpp',
             'tests/DragImageTest.cpp',
             'tests/EventListenerTest.cpp',
@@ -123,6 +126,7 @@
             'tests/LevelDBTest.cpp',
             'tests/LinkHighlightTest.cpp',
             'tests/ListenerLeakTest.cpp',
+            'tests/LocalizedDateICUTest.cpp',
             'tests/LocalizedNumberICUTest.cpp',
             'tests/MockCCQuadCuller.h',
             'tests/OpaqueRectTrackingContentLayerDelegateTest.cpp',
@@ -132,6 +136,7 @@
             'tests/PODArenaTest.cpp',
             'tests/PODIntervalTreeTest.cpp',
             'tests/PODRedBlackTreeTest.cpp',
+            'tests/CCPrioritizedTextureTest.cpp',
             'tests/RegionTest.cpp',
             'tests/RenderTableCellTest.cpp',
             'tests/RenderTableRowTest.cpp',
@@ -145,7 +150,9 @@
             'tests/TreeSynchronizerTest.cpp',
             'tests/TreeTestHelpers.cpp',
             'tests/TreeTestHelpers.h',
+            'tests/WebAnimationTest.cpp',
             'tests/WebCompositorInputHandlerImplTest.cpp',
+            'tests/WebFloatAnimationCurveTest.cpp',
             'tests/WebFrameTest.cpp',
             'tests/WebLayerTest.cpp',
             'tests/WebLayerTreeViewTest.cpp',
@@ -154,6 +161,7 @@
             'tests/WebPageSerializerTest.cpp',
             'tests/WebSocketDeflaterTest.cpp',
             'tests/WebSocketExtensionDispatcherTest.cpp',
+            'tests/WebTransformAnimationCurveTest.cpp',
             'tests/WebTransformationMatrixTest.cpp',
             'tests/WebTransformOperationsTest.cpp',
             'tests/WebURLRequestTest.cpp',
@@ -173,6 +181,11 @@
                     'tests/WebPageSerializerTest.cpp',
                 ],
             }],
+            ['OS=="mac"', {
+                'webkit_unittest_files': [
+                    'tests/LocaleMacTest.cpp',
+                ],
+            }],
             ['OS!="mac"', {
                 'webkit_unittest_files': [
                     # Mac uses ScrollAnimatorMac instead of ScrollAnimatorNone.
diff --git a/Source/WebKit/chromium/WebKitUnitTests.gyp b/Source/WebKit/chromium/WebKitUnitTests.gyp
index 58af83985..bf68f4f49 100644
--- a/Source/WebKit/chromium/WebKitUnitTests.gyp
+++ b/Source/WebKit/chromium/WebKitUnitTests.gyp
@@ -113,6 +113,12 @@
                         },
                     },
                 }],
+                ['OS=="android" and gtest_target_type == "shared_library"', {
+                    'type': 'shared_library',
+                    'dependencies': [
+                        '<(chromium_src_dir)/testing/android/native_test.gyp:native_test_native_code',
+                    ],
+                }],
             ],
         }                
     ], # targets
@@ -124,5 +130,50 @@
                 'cflags_cc': ['-Wno-c++0x-compat'],
             },
         }],
+        ['OS=="android" and gtest_target_type == "shared_library"', {
+            # Wrap libwebkit_unit_tests.so into an android apk for execution.
+            'targets': [{
+                'target_name': 'webkit_unit_tests_apk',
+                'type': 'none',
+                'dependencies': [
+                    '<(chromium_src_dir)/base/base.gyp:base_java',
+                    'webkit_unit_tests',
+                ],
+                'variables': {
+                    'input_shlib_path': '<(SHARED_LIB_DIR)/<(SHARED_LIB_PREFIX)webkit_unit_tests<(SHARED_LIB_SUFFIX)',
+                    'input_jars_paths': [
+                        '<(PRODUCT_DIR)/lib.java/chromium_base.jar',
+                    ],
+                },
+                # Part of the following was copied from <(chromium_src_dir)/build/apk_test.gpyi.
+                # Not including it because gyp include doesn't support variable in path or under
+                # conditions. And we also have some different requirements.
+                'actions': [{
+                    'action_name': 'apk_webkit_unit_tests',
+                    'message': 'Building webkit_unit_tests test apk.',
+                    'inputs': [
+                        '<(chromium_src_dir)/testing/android/AndroidManifest.xml',
+                        '<(chromium_src_dir)/testing/android/generate_native_test.py',
+                        '<(input_shlib_path)',
+                        '<@(input_jars_paths)',
+                    ],
+                    'outputs': [
+                        '<(PRODUCT_DIR)/webkit_unit_tests_apk/webkit_unit_tests-debug.apk',
+                    ],
+                    'action': [
+                        '<(chromium_src_dir)/testing/android/generate_native_test.py',
+                        '--native_library',
+                        '<(input_shlib_path)',
+                        '--jars',
+                        '"<@(input_jars_paths)"',
+                        '--output',
+                        '<(PRODUCT_DIR)/webkit_unit_tests_apk',
+                        '--ant-args',
+                        '-DPRODUCT_DIR=<(ant_build_out)',
+                        '--ant-compile'
+                    ],
+                }],
+            }],
+        }],
     ],
 }
diff --git a/Source/WebKit/chromium/features.gypi b/Source/WebKit/chromium/features.gypi
index caa41dae3..7c02a0127 100644
--- a/Source/WebKit/chromium/features.gypi
+++ b/Source/WebKit/chromium/features.gypi
@@ -53,6 +53,7 @@
       'ENABLE_DATA_TRANSFER_ITEMS=1',
       'ENABLE_DETAILS=1',
       'ENABLE_DEVICE_ORIENTATION=1',
+      'ENABLE_DIALOG_ELEMENT=1',
       'ENABLE_DIRECTORY_UPLOAD=1',
       'ENABLE_DOWNLOAD_ATTRIBUTE=1',
       'ENABLE_ENCRYPTED_MEDIA=1',
@@ -92,9 +93,11 @@
       'ENABLE_STYLE_SCOPED=1',
       'ENABLE_SVG=<(enable_svg)',
       'ENABLE_SVG_FONTS=<(enable_svg)',
+      'ENABLE_TEXT_AUTOSIZING=1',
       'ENABLE_TOUCH_ADJUSTMENT=1',
       'ENABLE_TOUCH_EVENTS=<(enable_touch_events)',
       'ENABLE_TOUCH_ICON_LOADING=<(enable_touch_icon_loading)',
+      'ENABLE_TOUCH_SLIDER=1',
       'ENABLE_V8_SCRIPT_DEBUG_SERVER=1',
       'ENABLE_VIDEO=1',
       'ENABLE_VIDEO_TRACK=1',
@@ -126,6 +129,7 @@
       'enable_touch_events%': 1,
       'enable_touch_icon_loading%' : 0,
       'enable_mutation_observers%': 1,
+      'use_harfbuzz_ng%': 0,
     },
     'use_accelerated_compositing%': '<(use_accelerated_compositing)',
     'enable_skia_text%': '<(enable_skia_text)',
@@ -135,7 +139,6 @@
       ['OS=="android"', {
         'feature_defines': [
           'ENABLE_CALENDAR_PICKER=0',
-          'ENABLE_FONT_BOOSTING=1',
           'ENABLE_INPUT_SPEECH=0',
           'ENABLE_INPUT_TYPE_COLOR=0',
           'ENABLE_INPUT_TYPE_DATETIME=1',
@@ -161,7 +164,6 @@
       }, { # OS!="android"
         'feature_defines': [
           'ENABLE_CALENDAR_PICKER=1',
-          'ENABLE_FONT_BOOSTING=0',
           'ENABLE_INPUT_SPEECH=1',
           'ENABLE_INPUT_TYPE_COLOR=1',
           'ENABLE_JAVASCRIPT_I18N_API=1',
@@ -205,6 +207,11 @@
           'WTF_USE_SKIA_ON_MAC_CHROMIUM=1',
         ],
       }],
+      ['use_harfbuzz_ng==1', {
+        'feature_defines': [
+          'WTF_USE_HARFBUZZ_NG=1',
+        ],
+      }],
     ],
   },
 }
diff --git a/Source/WebKit/chromium/public/WebBindings.h b/Source/WebKit/chromium/public/WebBindings.h
index 34a320557..dc7b45f32 100644
--- a/Source/WebKit/chromium/public/WebBindings.h
+++ b/Source/WebKit/chromium/public/WebBindings.h
@@ -152,6 +152,10 @@ public:
     // If so, return it as a WebArrayBufferView object.
     WEBKIT_EXPORT static bool getArrayBufferView(NPObject* arrayBufferView, WebArrayBufferView*);
 
+    // Return true (success) if the given npobj is a node.
+    // If so, return that node as a WebNode object.
+    WEBKIT_EXPORT static bool getNode(NPObject* element, WebNode*);
+
     // Return true (success) if the given npobj is an element.
     // If so, return that element as a WebElement object.
     WEBKIT_EXPORT static bool getElement(NPObject* element, WebElement*);
diff --git a/Source/WebKit/chromium/public/WebContentDetectionResult.h b/Source/WebKit/chromium/public/WebContentDetectionResult.h
new file mode 100644
index 000000000..97801d25e
--- /dev/null
+++ b/Source/WebKit/chromium/public/WebContentDetectionResult.h
@@ -0,0 +1,64 @@
+/*
+* Copyright (C) 2012 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1.  Redistributions of source code must retain the above copyright
+*     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebContentDetectionResult_h
+#define WebContentDetectionResult_h
+
+#include "WebRange.h"
+#include "platform/WebString.h"
+#include "platform/WebURL.h"
+
+namespace WebKit {
+
+class WebContentDetectionResult {
+public:
+    WebContentDetectionResult()
+        : m_isValid(false)
+    {
+    }
+
+    WebContentDetectionResult(const WebRange& range, const WebString& string, const WebURL& intent)
+        : m_isValid(true)
+        , m_range(range)
+        , m_string(string)
+        , m_intent(intent)
+    {
+    }
+
+    bool isValid() const { return m_isValid; }
+    const WebRange& range() const { return m_range; }
+    const WebString& string() const { return m_string; }
+    const WebURL& intent() const { return m_intent; }
+
+private:
+    bool m_isValid;
+    WebRange m_range;
+    WebString m_string;
+    WebURL m_intent;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/public/WebDeviceOrientation.h b/Source/WebKit/chromium/public/WebDeviceOrientation.h
index 66540bd8a..f56c0325f 100644
--- a/Source/WebKit/chromium/public/WebDeviceOrientation.h
+++ b/Source/WebKit/chromium/public/WebDeviceOrientation.h
@@ -87,7 +87,6 @@ public:
 
 #if WEBKIT_IMPLEMENTATION
     WebDeviceOrientation(const WebCore::DeviceOrientationData*);
-    WebDeviceOrientation& operator=(const WebCore::DeviceOrientationData*);
     operator WTF::PassRefPtr<WebCore::DeviceOrientationData>() const;
 #endif
 
diff --git a/Source/WebKit/chromium/public/WebFrame.h b/Source/WebKit/chromium/public/WebFrame.h
index ab67c496d..b03fb7c69 100644
--- a/Source/WebKit/chromium/public/WebFrame.h
+++ b/Source/WebKit/chromium/public/WebFrame.h
@@ -319,6 +319,9 @@ public:
     // False |ignoreCache| revalidates any existing cache entries.
     virtual void reload(bool ignoreCache = false) = 0;
 
+    // This is used for situations where we want to reload a different URL because of a redirect.
+    virtual void reloadWithOverrideURL(const WebURL& overrideUrl, bool ignoreCache = false) = 0;
+
     // Load the given URL.
     virtual void loadRequest(const WebURLRequest&) = 0;
 
diff --git a/Source/WebKit/chromium/public/WebIDBCursor.h b/Source/WebKit/chromium/public/WebIDBCursor.h
index 4e23f0702..dfad19383 100644
--- a/Source/WebKit/chromium/public/WebIDBCursor.h
+++ b/Source/WebKit/chromium/public/WebIDBCursor.h
@@ -40,11 +40,6 @@ class WebIDBCursor {
 public:
     virtual ~WebIDBCursor() { }
 
-    virtual unsigned short direction() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return 0;
-    }
     virtual WebIDBKey key() const
     {
         WEBKIT_ASSERT_NOT_REACHED();
diff --git a/Source/WebKit/chromium/public/WebIDBDatabase.h b/Source/WebKit/chromium/public/WebIDBDatabase.h
index a001c2e92..3eb1ecb74 100644
--- a/Source/WebKit/chromium/public/WebIDBDatabase.h
+++ b/Source/WebKit/chromium/public/WebIDBDatabase.h
@@ -50,21 +50,6 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return WebIDBMetadata();
     }
-    virtual WebString name() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebString();
-    }
-    virtual WebString version() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebString();
-    }
-    virtual WebDOMStringList objectStoreNames() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebDOMStringList();
-    }
     virtual WebIDBObjectStore* createObjectStore(const WebString&, const WebIDBKeyPath&, bool, const WebIDBTransaction&, WebExceptionCode&)
     {
         WEBKIT_ASSERT_NOT_REACHED();
diff --git a/Source/WebKit/chromium/public/WebIDBIndex.h b/Source/WebKit/chromium/public/WebIDBIndex.h
index b10080842..10258ecc7 100644
--- a/Source/WebKit/chromium/public/WebIDBIndex.h
+++ b/Source/WebKit/chromium/public/WebIDBIndex.h
@@ -42,27 +42,6 @@ class WebIDBIndex {
 public:
     virtual ~WebIDBIndex() { }
 
-    virtual WebString name() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebString();
-    }
-    virtual WebIDBKeyPath keyPath() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebIDBKeyPath::createNull();
-    }
-    virtual bool unique() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return false;
-    }
-    virtual bool multiEntry() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return false;
-    }
-
     virtual void openObjectCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void openKeyCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void count(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebIDBObjectStore.h b/Source/WebKit/chromium/public/WebIDBObjectStore.h
index d9b3232a0..ec153a719 100644
--- a/Source/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/Source/WebKit/chromium/public/WebIDBObjectStore.h
@@ -43,27 +43,6 @@ class WebIDBObjectStore {
 public:
     virtual ~WebIDBObjectStore() { }
 
-    virtual WebString name() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebString();
-    }
-    virtual WebIDBKeyPath keyPath() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebIDBKeyPath::createNull();
-    }
-    virtual WebDOMStringList indexNames() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return WebDOMStringList();
-    }
-    virtual bool autoIncrement() const
-    {
-        WEBKIT_ASSERT_NOT_REACHED();
-        return false;
-    }
-
     virtual void get(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
 
     enum PutMode {
@@ -73,8 +52,6 @@ public:
     };
 
     virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, PutMode, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
-    // FIXME: Remove the following overload when all callers are updated.
-    virtual void deleteFunction(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void deleteFunction(const WebIDBKeyRange&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void clear(WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual WebIDBIndex* createIndex(const WebString&, const WebIDBKeyPath&, bool, bool, const WebIDBTransaction&, WebExceptionCode&)
diff --git a/Source/WebKit/chromium/public/WebIDBTransaction.h b/Source/WebKit/chromium/public/WebIDBTransaction.h
index 4d4800113..4ddcd8c56 100644
--- a/Source/WebKit/chromium/public/WebIDBTransaction.h
+++ b/Source/WebKit/chromium/public/WebIDBTransaction.h
@@ -51,6 +51,7 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
+    virtual void commit() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void abort() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void didCompleteTaskEvents() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void setCallbacks(WebIDBTransactionCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
diff --git a/Source/WebKit/chromium/public/WebNode.h b/Source/WebKit/chromium/public/WebNode.h
index d4ee874e9..5281db199 100644
--- a/Source/WebKit/chromium/public/WebNode.h
+++ b/Source/WebKit/chromium/public/WebNode.h
@@ -111,6 +111,7 @@ public:
     WEBKIT_EXPORT void simulateClick();
     WEBKIT_EXPORT WebNodeList getElementsByTagName(const WebString&) const;
     WEBKIT_EXPORT WebElement rootEditableElement() const;
+    WEBKIT_EXPORT bool focused() const;
 
     // Returns true if the node has a non-empty bounding box in layout.
     // This does not 100% guarantee the user can see it, but is pretty close.
diff --git a/Source/WebKit/chromium/public/WebPluginContainer.h b/Source/WebKit/chromium/public/WebPluginContainer.h
index 99f078fd6..debe26038 100644
--- a/Source/WebKit/chromium/public/WebPluginContainer.h
+++ b/Source/WebKit/chromium/public/WebPluginContainer.h
@@ -98,6 +98,7 @@ public:
         const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData) = 0;
 
     // Notifies that the zoom level has changed.
+    // Note, this does NOT affect pageScaleFactor or pageZoomFactor
     virtual void zoomLevelChanged(double zoomLevel) = 0;
 
     // Notifies whether the contents of the plugin are entirely opaque.
@@ -113,6 +114,10 @@ public:
     virtual WebPlugin* plugin() = 0;
     virtual void setPlugin(WebPlugin*) = 0;
 
+    virtual float deviceScaleFactor() = 0;
+    virtual float pageScaleFactor() = 0;
+    virtual float pageZoomFactor() = 0;
+
 protected:
     ~WebPluginContainer() { }
 };
diff --git a/Source/WebKit/chromium/public/WebPluginScrollbar.h b/Source/WebKit/chromium/public/WebPluginScrollbar.h
index 306f098aa..364ee0dfb 100644
--- a/Source/WebKit/chromium/public/WebPluginScrollbar.h
+++ b/Source/WebKit/chromium/public/WebPluginScrollbar.h
@@ -25,11 +25,51 @@
 #ifndef WebPluginScrollbar_h
 #define WebPluginScrollbar_h
 
-#include "WebScrollbar.h"
+#include <public/WebCanvas.h>
+#include <public/WebScrollbar.h>
 
 namespace WebKit {
 
-typedef WebScrollbar WebPluginScrollbar;
+class WebInputEvent;
+class WebPluginContainer;
+class WebPluginScrollbarClient;
+struct WebRect;
+
+class WebPluginScrollbar : public WebScrollbar {
+public:
+    // Creates a WebPluginScrollbar for use by a plugin. The plugin container and
+    // client are guaranteed to outlive this object.
+    WEBKIT_EXPORT static WebPluginScrollbar* createForPlugin(WebScrollbar::Orientation,
+                                                             WebPluginContainer*,
+                                                             WebPluginScrollbarClient*);
+
+    virtual ~WebPluginScrollbar() { }
+
+    // Gets the thickness of the scrollbar in pixels.
+    WEBKIT_EXPORT static int defaultThickness();
+
+    // Sets the rectangle of the scrollbar.
+    virtual void setLocation(const WebRect&) = 0;
+
+    // Sets the size of the scrollable region in pixels, i.e. if a document is
+    // 800x10000 pixels and the viewport is 1000x1000 pixels, then setLocation
+    // for the vertical scrollbar would have passed in a rectangle like:
+    //            (800 - defaultThickness(), 0) (defaultThickness() x 10000)
+    // and setDocumentSize(10000)
+    virtual void setDocumentSize(int) = 0;
+
+    // Sets the current value.
+    virtual void setValue(int position) = 0;
+
+    // Scroll back or forward with the given granularity.
+    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier) = 0;
+
+    // Paint the given rectangle.
+    virtual void paint(WebCanvas*, const WebRect&) = 0;
+
+    // Returns true iff the given event was used.
+    virtual bool handleInputEvent(const WebInputEvent&) = 0;
+};
 
 } // namespace WebKit
 
diff --git a/Source/WebKit/chromium/public/WebPluginScrollbarClient.h b/Source/WebKit/chromium/public/WebPluginScrollbarClient.h
index 36f8e49c8..bc5a124f4 100644
--- a/Source/WebKit/chromium/public/WebPluginScrollbarClient.h
+++ b/Source/WebKit/chromium/public/WebPluginScrollbarClient.h
@@ -25,12 +25,19 @@
 #ifndef WebPluginScrollbarClient_h
 #define WebPluginScrollbarClient_h
 
-#include "WebPluginScrollbar.h"
-#include "WebScrollbarClient.h"
-
 namespace WebKit {
 
-typedef WebScrollbarClient WebPluginScrollbarClient;
+class WebPluginScrollbar;
+struct WebRect;
+template <typename T> class WebVector;
+
+class WebPluginScrollbarClient {
+public:
+    virtual void valueChanged(WebPluginScrollbar*) = 0;
+    virtual void overlayChanged(WebPluginScrollbar*) = 0;
+    virtual void invalidateScrollbarRect(WebPluginScrollbar*, const WebRect&) = 0;
+    virtual void getTickmarks(WebPluginScrollbar*, WebVector<WebRect>*) const = 0;
+};
 
 } // namespace WebKit
 
diff --git a/Source/WebKit/chromium/public/WebRuntimeFeatures.h b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
index 0a954e164..a0dd04997 100644
--- a/Source/WebKit/chromium/public/WebRuntimeFeatures.h
+++ b/Source/WebKit/chromium/public/WebRuntimeFeatures.h
@@ -139,6 +139,9 @@ public:
     WEBKIT_EXPORT static void enableInputTypeDate(bool);
     WEBKIT_EXPORT static bool isInputTypeDateEnabled();
 
+    WEBKIT_EXPORT static void enableDialogElement(bool);
+    WEBKIT_EXPORT static bool isDialogElementEnabled();
+
 private:
     WebRuntimeFeatures();
 };
diff --git a/Source/WebKit/chromium/public/WebScrollbar.h b/Source/WebKit/chromium/public/WebScrollbar.h
deleted file mode 100644
index ecac86a01..000000000
--- a/Source/WebKit/chromium/public/WebScrollbar.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebScrollbar_h
-#define WebScrollbar_h
-
-#include "platform/WebCanvas.h"
-#include "platform/WebCommon.h"
-
-namespace WebKit {
-
-class WebInputEvent;
-class WebPluginContainer;
-class WebScrollbarClient;
-struct WebRect;
-
-class WebScrollbar {
-public:
-    enum Orientation {
-        Horizontal,
-        Vertical
-    };
-
-    enum ScrollDirection {
-        ScrollBackward,
-        ScrollForward
-    };
-
-    enum ScrollGranularity {
-        ScrollByLine,
-        ScrollByPage,
-        ScrollByDocument,
-        ScrollByPixel
-    };
-
-    // Creates a WebScrollbar for use by a plugin. The plugin container and
-    // client are guaranteed to outlive this object.
-    WEBKIT_EXPORT static WebScrollbar* createForPlugin(Orientation,
-                                                       WebPluginContainer*,
-                                                       WebScrollbarClient*);
-
-    virtual ~WebScrollbar() {}
-
-    // Gets the thickness of the scrollbar in pixels.
-    WEBKIT_EXPORT static int defaultThickness();
-
-    // Return true if this is an overlay scrollbar.
-    virtual bool isOverlay() const = 0;
-
-    // Sets the rectangle of the scrollbar.
-    virtual void setLocation(const WebRect&) = 0;
-
-    // Gets the current value (i.e. position inside the region).
-    virtual int value() const = 0;
-
-    // Sets the current value.
-    virtual void setValue(int position) = 0;
-
-    // Sets the size of the scrollable region in pixels.  i.e. if a document is
-    // 800x10000 pixels and the viewport is 1000x1000 pixels, then setLocation
-    // for the vertical scrollbar would have passed in a rectangle like:
-    //            (800 - defaultThickness(), 0) (defaultThickness() x 10000)
-    // and setDocumentSize(10000)
-    virtual void setDocumentSize(int size) = 0;
-
-    // Scroll back or forward with the given granularity.
-    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier) = 0;
-
-    // Paint the given rectangle.
-    virtual void paint(WebCanvas*, const WebRect&) = 0;
-
-    // Returns true iff the given event was used.
-    virtual bool handleInputEvent(const WebInputEvent&) = 0;
-};
-
-} // namespace WebKit
-
-#endif
diff --git a/Source/WebKit/chromium/public/WebSettings.h b/Source/WebKit/chromium/public/WebSettings.h
index 5ec5c50da..56b49ffbb 100644
--- a/Source/WebKit/chromium/public/WebSettings.h
+++ b/Source/WebKit/chromium/public/WebSettings.h
@@ -65,7 +65,7 @@ public:
     virtual void setMinimumFontSize(int) = 0;
     virtual void setMinimumLogicalFontSize(int) = 0;
     virtual void setApplyDefaultDeviceScaleFactorInCompositor(bool) = 0;
-    virtual void setFontBoostingEnabled(bool) = 0;
+    virtual void setTextAutosizingEnabled(bool) = 0;
     virtual void setDefaultTextEncodingName(const WebString&) = 0;
     virtual void setDeviceSupportsTouch(bool) = 0;
     virtual void setDeviceSupportsMouse(bool) = 0;
@@ -145,7 +145,6 @@ public:
     virtual void setShouldPrintBackgrounds(bool) = 0;
     virtual void setEnableScrollAnimator(bool) = 0;
     virtual bool scrollAnimatorEnabled() const = 0;
-    virtual void setHixie76WebSocketProtocolEnabled(bool) = 0;
     virtual void setVisualWordMovementEnabled(bool) = 0;
     virtual void setAcceleratedPaintingEnabled(bool) = 0;
     virtual void setViewportEnabled(bool) = 0;
@@ -161,6 +160,7 @@ public:
 
     // DEPRECATED
     virtual void setDefaultDeviceScaleFactor(int) { }
+    virtual void setHixie76WebSocketProtocolEnabled(bool) { }
 
 protected:
     ~WebSettings() { }
diff --git a/Source/WebKit/chromium/public/WebSurroundingText.h b/Source/WebKit/chromium/public/WebSurroundingText.h
index dd2a3c527..716fe4f0c 100644
--- a/Source/WebKit/chromium/public/WebSurroundingText.h
+++ b/Source/WebKit/chromium/public/WebSurroundingText.h
@@ -37,6 +37,8 @@ class SurroundingText;
 namespace WebKit {
 
 class WebHitTestResult;
+class WebNode;
+struct WebPoint;
 
 class WebSurroundingText {
 public:
@@ -50,9 +52,9 @@ public:
     // The maximum length of the contents retrieved is defined by maxLength.
     WEBKIT_EXPORT void initialize(const WebHitTestResult&, size_t maxLength);
 
-    // Initializes the object go get the surrounding text centered in the selected offset of the given node.
+    // Initializes the object to get the surrounding text centered in the position relative to a provided node.
     // The maximum length of the contents retrieved is defined by maxLength.
-    WEBKIT_EXPORT void initialize(WebNode textNode, size_t offset, size_t maxLength);
+    WEBKIT_EXPORT void initialize(const WebNode&, const WebPoint&, size_t maxLength);
 
     // Surrounding text content retrieved.
     WEBKIT_EXPORT WebString textContent() const;
diff --git a/Source/WebKit/chromium/public/WebViewClient.h b/Source/WebKit/chromium/public/WebViewClient.h
index 9b39da7dd..662409f7a 100644
--- a/Source/WebKit/chromium/public/WebViewClient.h
+++ b/Source/WebKit/chromium/public/WebViewClient.h
@@ -32,10 +32,12 @@
 #define WebViewClient_h
 
 #include "WebAccessibilityNotification.h"
+#include "WebContentDetectionResult.h"
 #include "WebDragOperation.h"
 #include "WebEditingAction.h"
 #include "WebFileChooserCompletion.h"
 #include "WebFileChooserParams.h"
+#include "WebHitTestResult.h"
 #include "WebPageVisibilityState.h"
 #include "WebPopupType.h"
 #include "WebTextAffinity.h"
@@ -185,6 +187,7 @@ public:
     virtual void didChangeContents() { }
     virtual void didExecuteCommand(const WebString& commandName) { }
     virtual void didEndEditing() { }
+    virtual void didChangeFormState(const WebNode&) { }
 
     // This method is called in response to WebView's handleInputEvent()
     // when the default action for the current keyboard event is not
@@ -363,6 +366,15 @@ public:
 
     virtual WebUserMediaClient* userMediaClient() { return 0; }
 
+
+    // Content detection ----------------------------------------------------
+
+    // Retrieves detectable content (e.g., email addresses, phone numbers)
+    // around a hit test result. The embedder should use platform-specific
+    // content detectors (e.g., from the Android intent system) to analyze the
+    // region around the hit test result.
+    virtual WebContentDetectionResult detectContentAround(const WebHitTestResult&) { return WebContentDetectionResult(); }
+
 protected:
     ~WebViewClient() { }
 };
diff --git a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
index 403088bc9..0f8442a76 100644
--- a/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/Source/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -93,7 +93,6 @@
 #include "WebMediaPlayerClient.h"
 #include "WebNotificationPresenter.h"
 #include "WebPageVisibilityState.h"
-#include "WebScrollbar.h"
 #include "WebSettings.h"
 #include "WebSpeechRecognizerClient.h"
 #include "WebStorageQuotaError.h"
@@ -111,6 +110,7 @@
 #include <public/WebFileSystem.h>
 #include <public/WebFilterOperation.h>
 #include <public/WebReferrerPolicy.h>
+#include <public/WebScrollbar.h>
 #include <public/WebURLResponse.h>
 #include <wtf/Assertions.h>
 #include <wtf/text/StringImpl.h>
diff --git a/Source/WebKit/chromium/src/ChromeClientImpl.cpp b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
index 50c560908..349733919 100644
--- a/Source/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -655,7 +655,7 @@ void ChromeClientImpl::dispatchViewportPropertiesDidChange(const ViewportArgumen
     // Call the common viewport computing logic in ViewportArguments.cpp.
     ViewportAttributes computed = computeViewportAttributes(
         args, settings->layoutFallbackWidth(), deviceRect.width, deviceRect.height,
-        dpi, IntSize(deviceRect.width, deviceRect.height));
+        dpi / ViewportArguments::deprecatedTargetDPI, IntSize(deviceRect.width, deviceRect.height));
 
     if (m_webView->ignoreViewportTagMaximumScale()) {
         computed.maximumScale = max(computed.maximumScale, m_webView->maxPageScaleFactor);
@@ -841,6 +841,9 @@ void ChromeClientImpl::setNewWindowNavigationPolicy(WebNavigationPolicy policy)
 
 void ChromeClientImpl::formStateDidChange(const Node* node)
 {
+    if (m_webView->client())
+        m_webView->client()->didChangeFormState(WebNode(const_cast<Node*>(node)));
+
     // The current history item is not updated yet.  That happens lazily when
     // WebFrame::currentHistoryItem is requested.
     WebFrameImpl* webframe = WebFrameImpl::fromFrame(node->document()->frame());
diff --git a/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp b/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp
index aada07787..63e16726e 100644
--- a/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp
+++ b/Source/WebKit/chromium/src/ContextFeaturesClientImpl.cpp
@@ -32,19 +32,116 @@
 #include "ContextFeaturesClientImpl.h"
 
 #include "Document.h"
+#include "SecurityOrigin.h"
 #include "WebDocument.h"
 #include "WebPermissionClient.h"
 
+using namespace WebCore;
+
 namespace WebKit {
 
-bool ContextFeaturesClientImpl::isEnabled(WebCore::Document* document, WebCore::ContextFeatures::FeatureType type, bool defaultValue)
+class ContextFeaturesCache : public Supplement<ScriptExecutionContext> {
+public:
+    class Entry {
+    public:
+        enum Value {
+            IsEnabled,
+            IsDisabled,
+            NeedsRefresh
+        };
+
+        Entry()
+            : m_value(NeedsRefresh)
+            , m_defaultValue(false)
+        { }
+
+        bool isEnabled() const
+        {
+            ASSERT(m_value != NeedsRefresh);
+            return m_value == IsEnabled;
+        }
+
+        void set(bool value, bool defaultValue)
+        {
+            m_value = value ? IsEnabled : IsDisabled;
+            m_defaultValue = defaultValue;
+        }
+
+        bool needsRefresh(bool defaultValue) const
+        {
+            return m_value == NeedsRefresh || m_defaultValue != defaultValue;
+        }
+
+    private:
+        Value m_value;
+        bool m_defaultValue; // Needs to be traked as a part of the signature since it can be changed dynamically.
+    };
+
+    static const AtomicString& supplementName();
+    static ContextFeaturesCache* from(Document*);
+
+    Entry& entryFor(ContextFeatures::FeatureType type)
+    {
+        size_t index = static_cast<size_t>(type);
+        ASSERT(index < ContextFeatures::FeatureTypeSize);
+        return m_entries[index];
+    }
+
+    void validateAgainst(Document*);
+
+private:
+    String m_domain;
+    Entry m_entries[ContextFeatures::FeatureTypeSize];
+};
+
+const AtomicString& ContextFeaturesCache::supplementName()
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("ContextFeaturesCache"));
+    return name;
+}
+
+ContextFeaturesCache* ContextFeaturesCache::from(Document* document)
+{
+    ContextFeaturesCache* cache = static_cast<ContextFeaturesCache*>(Supplement<ScriptExecutionContext>::from(document, supplementName()));
+    if (!cache) {
+        cache = new ContextFeaturesCache();
+        Supplement<ScriptExecutionContext>::provideTo(document, supplementName(), adoptPtr(cache));
+    }
+
+    return cache;
+}
+
+void ContextFeaturesCache::validateAgainst(Document* document)
+{
+    String currentDomain = document->securityOrigin()->domain();
+    if (currentDomain == m_domain)
+        return;
+    m_domain = currentDomain;
+    for (size_t i = 0; i < ContextFeatures::FeatureTypeSize; ++i)
+        m_entries[i] = Entry();
+}
+
+bool ContextFeaturesClientImpl::isEnabled(Document* document, ContextFeatures::FeatureType type, bool defaultValue)
+{
+    ContextFeaturesCache::Entry& cache = ContextFeaturesCache::from(document)->entryFor(type);
+    if (cache.needsRefresh(defaultValue))
+        cache.set(askIfIsEnabled(document, type, defaultValue), defaultValue);
+    return cache.isEnabled();
+}
+
+void ContextFeaturesClientImpl::urlDidChange(Document* document)
+{
+    ContextFeaturesCache::from(document)->validateAgainst(document);
+}
+
+bool ContextFeaturesClientImpl::askIfIsEnabled(Document* document, ContextFeatures::FeatureType type, bool defaultValue)
 {
     if (!m_client)
         return defaultValue;
 
     switch (type) {
-    case WebCore::ContextFeatures::ShadowDOM:
-    case WebCore::ContextFeatures::StyleScoped:
+    case ContextFeatures::ShadowDOM:
+    case ContextFeatures::StyleScoped:
         return m_client->allowWebComponents(WebDocument(document), defaultValue);
     default:
         return defaultValue;
diff --git a/Source/WebKit/chromium/src/ContextFeaturesClientImpl.h b/Source/WebKit/chromium/src/ContextFeaturesClientImpl.h
index ea1f9548d..26d993048 100644
--- a/Source/WebKit/chromium/src/ContextFeaturesClientImpl.h
+++ b/Source/WebKit/chromium/src/ContextFeaturesClientImpl.h
@@ -44,9 +44,12 @@ public:
     { }
 
     virtual bool isEnabled(WebCore::Document*, WebCore::ContextFeatures::FeatureType, bool defaultValue) OVERRIDE;
+    virtual void urlDidChange(WebCore::Document*) OVERRIDE;
     void setPermissionClient(WebPermissionClient* client) { m_client = client; }
 
 private:
+    bool askIfIsEnabled(WebCore::Document*, WebCore::ContextFeatures::FeatureType, bool defaultValue);
+
     WebPermissionClient* m_client;
 };
 
diff --git a/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp b/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp
index 2a62b926f..ca390ba90 100644
--- a/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBCursorBackendProxy.cpp
@@ -54,11 +54,6 @@ IDBCursorBackendProxy::~IDBCursorBackendProxy()
 {
 }
 
-unsigned short IDBCursorBackendProxy::direction() const
-{
-    return m_idbCursor->direction();
-}
-
 PassRefPtr<IDBKey> IDBCursorBackendProxy::key() const
 {
     return m_idbCursor->key();
diff --git a/Source/WebKit/chromium/src/IDBCursorBackendProxy.h b/Source/WebKit/chromium/src/IDBCursorBackendProxy.h
index 24a3e42c4..9e4b57008 100644
--- a/Source/WebKit/chromium/src/IDBCursorBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBCursorBackendProxy.h
@@ -42,7 +42,6 @@ public:
     static PassRefPtr<WebCore::IDBCursorBackendInterface> create(PassOwnPtr<WebIDBCursor>);
     virtual ~IDBCursorBackendProxy();
 
-    virtual unsigned short direction() const;
     virtual PassRefPtr<WebCore::IDBKey> key() const;
     virtual PassRefPtr<WebCore::IDBKey> primaryKey() const;
     virtual PassRefPtr<WebCore::SerializedScriptValue> value() const;
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
index 107ec63b3..901b55e54 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.cpp
@@ -66,21 +66,6 @@ IDBDatabaseMetadata IDBDatabaseBackendProxy::metadata() const
     return m_webIDBDatabase->metadata();
 }
 
-String IDBDatabaseBackendProxy::name() const
-{
-    return m_webIDBDatabase->name();
-}
-
-String IDBDatabaseBackendProxy::version() const
-{
-    return m_webIDBDatabase->version();
-}
-
-PassRefPtr<DOMStringList> IDBDatabaseBackendProxy::objectStoreNames() const
-{
-    return m_webIDBDatabase->objectStoreNames();
-}
-
 PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendProxy::createObjectStore(const String& name, const IDBKeyPath& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
index b05552ccb..2a93600c6 100644
--- a/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBDatabaseBackendProxy.h
@@ -43,9 +43,6 @@ public:
     virtual ~IDBDatabaseBackendProxy();
 
     virtual WebCore::IDBDatabaseMetadata metadata() const;
-    virtual String name() const;
-    virtual String version() const;
-    virtual PassRefPtr<WebCore::DOMStringList> objectStoreNames() const;
 
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> createObjectStore(const String& name, const WebCore::IDBKeyPath&, bool autoIncrement, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void deleteObjectStore(const String& name, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
diff --git a/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp b/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp
index 280db881d..60188fd48 100644
--- a/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBIndexBackendProxy.cpp
@@ -56,26 +56,6 @@ IDBIndexBackendProxy::~IDBIndexBackendProxy()
 {
 }
 
-String IDBIndexBackendProxy::name()
-{
-    return m_webIDBIndex->name();
-}
-
-IDBKeyPath IDBIndexBackendProxy::keyPath()
-{
-    return m_webIDBIndex->keyPath();
-}
-
-bool IDBIndexBackendProxy::unique()
-{
-    return m_webIDBIndex->unique();
-}
-
-bool IDBIndexBackendProxy::multiEntry()
-{
-    return m_webIDBIndex->multiEntry();
-}
-
 void IDBIndexBackendProxy::openCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBIndexBackendProxy.h b/Source/WebKit/chromium/src/IDBIndexBackendProxy.h
index 273405601..1c1c33692 100644
--- a/Source/WebKit/chromium/src/IDBIndexBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBIndexBackendProxy.h
@@ -42,11 +42,6 @@ public:
     static PassRefPtr<IDBIndexBackendInterface> create(PassOwnPtr<WebIDBIndex>);
     virtual ~IDBIndexBackendProxy();
 
-    virtual String name();
-    virtual WebCore::IDBKeyPath keyPath();
-    virtual bool unique();
-    virtual bool multiEntry();
-
     virtual void openCursor(PassRefPtr<WebCore::IDBKeyRange>, unsigned short direction, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void openKeyCursor(PassRefPtr<WebCore::IDBKeyRange>, unsigned short direction, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void count(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
index 9ca777bc9..42f808c85 100755
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.cpp
@@ -59,26 +59,6 @@ IDBObjectStoreBackendProxy::~IDBObjectStoreBackendProxy()
 {
 }
 
-String IDBObjectStoreBackendProxy::name() const
-{
-    return m_webIDBObjectStore->name();
-}
-
-IDBKeyPath IDBObjectStoreBackendProxy::keyPath() const
-{
-    return m_webIDBObjectStore->keyPath();
-}
-
-PassRefPtr<DOMStringList> IDBObjectStoreBackendProxy::indexNames() const
-{
-    return m_webIDBObjectStore->indexNames();
-}
-
-bool IDBObjectStoreBackendProxy::autoIncrement() const
-{
-    return m_webIDBObjectStore->autoIncrement();
-}
-
 void IDBObjectStoreBackendProxy::get(PassRefPtr<IDBKeyRange> keyRange, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
diff --git a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
index c6da74cf1..c666c9fc7 100644
--- a/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBObjectStoreBackendProxy.h
@@ -43,11 +43,6 @@ public:
     static PassRefPtr<WebCore::IDBObjectStoreBackendInterface> create(PassOwnPtr<WebIDBObjectStore>);
     virtual ~IDBObjectStoreBackendProxy();
 
-    virtual String name() const;
-    virtual WebCore::IDBKeyPath keyPath() const;
-    virtual PassRefPtr<WebCore::DOMStringList> indexNames() const;
-    virtual bool autoIncrement() const;
-
     virtual void get(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void put(PassRefPtr<WebCore::SerializedScriptValue>, PassRefPtr<WebCore::IDBKey>, PutMode, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
     virtual void deleteFunction(PassRefPtr<WebCore::IDBKeyRange>, PassRefPtr<WebCore::IDBCallbacks>, WebCore::IDBTransactionBackendInterface*, WebCore::ExceptionCode&);
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
index bfd9808ea..3a21a781b 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
@@ -62,9 +62,9 @@ PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendProxy::objectSto
     return IDBObjectStoreBackendProxy::create(objectStore.release());
 }
 
-unsigned short IDBTransactionBackendProxy::mode() const
+void IDBTransactionBackendProxy::commit()
 {
-    return m_webIDBTransaction->mode();
+    m_webIDBTransaction->commit();
 }
 
 void IDBTransactionBackendProxy::abort()
diff --git a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
index afef0082c..58918f68c 100644
--- a/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
+++ b/Source/WebKit/chromium/src/IDBTransactionBackendProxy.h
@@ -42,7 +42,12 @@ public:
     virtual ~IDBTransactionBackendProxy();
 
     virtual PassRefPtr<WebCore::IDBObjectStoreBackendInterface> objectStore(const String& name, WebCore::ExceptionCode&);
-    virtual unsigned short mode() const;
+    virtual unsigned short mode() const
+    {
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+    virtual void commit();
     virtual void abort();
     virtual bool scheduleTask(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
     virtual void didCompleteTaskEvents();
diff --git a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
index 0970ce6c2..7e9539376 100644
--- a/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
+++ b/Source/WebKit/chromium/src/NonCompositedContentHost.cpp
@@ -62,7 +62,7 @@ NonCompositedContentHost::~NonCompositedContentHost()
 
 void NonCompositedContentHost::setBackgroundColor(const WebCore::Color& color)
 {
-    m_graphicsLayer->platformLayer()->setBackgroundColor(color);
+    m_graphicsLayer->platformLayer()->setBackgroundColor(color.rgb());
 }
 
 void NonCompositedContentHost::setOpaque(bool opaque)
diff --git a/Source/WebKit/chromium/src/PlatformSupport.cpp b/Source/WebKit/chromium/src/PlatformSupport.cpp
index 94b26f05a..193b68b3a 100644
--- a/Source/WebKit/chromium/src/PlatformSupport.cpp
+++ b/Source/WebKit/chromium/src/PlatformSupport.cpp
@@ -68,13 +68,15 @@
 
 #if OS(DARWIN)
 #include <public/mac/WebThemeEngine.h>
-#elif OS(UNIX) && !OS(ANDROID)
-#include "WebFontInfo.h"
+#elif OS(UNIX)
 #include "WebFontRenderStyle.h"
-#include <public/linux/WebThemeEngine.h>
-#elif OS(ANDROID)
+#if OS(ANDROID)
 #include <public/android/WebThemeEngine.h>
-#endif
+#else
+#include "WebFontInfo.h"
+#include <public/linux/WebThemeEngine.h>
+#endif // OS(ANDROID)
+#endif // elif OS(UNIX)
 
 #include "NativeImageSkia.h"
 
@@ -257,16 +259,20 @@ void PlatformSupport::getFontFamilyForCharacters(const UChar* characters, size_t
 
 void PlatformSupport::getRenderStyleForStrike(const char* font, int sizeAndStyle, FontRenderStyle* result)
 {
-#if !OS(ANDROID)
     WebFontRenderStyle style;
 
-    if (WebKit::Platform::current()->sandboxSupport())
+#if OS(ANDROID)
+    style.setDefaults();
+#else
+    if (!font || !*font)
+        style.setDefaults(); // It's probably a webfont. Take the system defaults.
+    else if (WebKit::Platform::current()->sandboxSupport())
         WebKit::Platform::current()->sandboxSupport()->getRenderStyleForStrike(font, sizeAndStyle, &style);
     else
         WebFontInfo::renderStyleForStrike(font, sizeAndStyle, &style);
+#endif
 
     style.toFontRenderStyle(result);
-#endif
 }
 #endif
 
diff --git a/Source/WebKit/chromium/src/ScrollbarGroup.cpp b/Source/WebKit/chromium/src/ScrollbarGroup.cpp
index 19fdbade4..0e676cb5f 100644
--- a/Source/WebKit/chromium/src/ScrollbarGroup.cpp
+++ b/Source/WebKit/chromium/src/ScrollbarGroup.cpp
@@ -29,8 +29,8 @@
 #include "FrameView.h"
 #include "Scrollbar.h"
 #include "ScrollbarTheme.h"
-#include "platform/WebRect.h"
-#include "WebScrollbarImpl.h"
+#include "WebPluginScrollbarImpl.h"
+#include <public/WebRect.h>
 
 using namespace WebCore;
 
@@ -50,7 +50,7 @@ ScrollbarGroup::~ScrollbarGroup()
     ASSERT(!m_verticalScrollbar);
 }
 
-void ScrollbarGroup::scrollbarCreated(WebScrollbarImpl* scrollbar)
+void ScrollbarGroup::scrollbarCreated(WebPluginScrollbarImpl* scrollbar)
 {
     bool hadScrollbars = m_horizontalScrollbar || m_verticalScrollbar;
     if (scrollbar->scrollbar()->orientation() == HorizontalScrollbar) {
@@ -69,7 +69,7 @@ void ScrollbarGroup::scrollbarCreated(WebScrollbarImpl* scrollbar)
     }
 }
 
-void ScrollbarGroup::scrollbarDestroyed(WebScrollbarImpl* scrollbar)
+void ScrollbarGroup::scrollbarDestroyed(WebPluginScrollbarImpl* scrollbar)
 {
     if (scrollbar == m_horizontalScrollbar) {
         willRemoveHorizontalScrollbar(scrollbar->scrollbar());
@@ -93,7 +93,7 @@ void ScrollbarGroup::setLastMousePosition(const IntPoint& point)
 
 int ScrollbarGroup::scrollSize(WebCore::ScrollbarOrientation orientation) const
 {
-    WebScrollbarImpl* webScrollbar = orientation == HorizontalScrollbar ? m_horizontalScrollbar : m_verticalScrollbar;
+    WebPluginScrollbarImpl* webScrollbar = orientation == HorizontalScrollbar ? m_horizontalScrollbar : m_verticalScrollbar;
     if (!webScrollbar)
         return 0;
     Scrollbar* scrollbar = webScrollbar->scrollbar();
@@ -102,7 +102,7 @@ int ScrollbarGroup::scrollSize(WebCore::ScrollbarOrientation orientation) const
 
 int ScrollbarGroup::scrollPosition(Scrollbar* scrollbar) const
 {
-    WebScrollbarImpl* webScrollbar = scrollbar->orientation() == HorizontalScrollbar ? m_horizontalScrollbar : m_verticalScrollbar;
+    WebPluginScrollbarImpl* webScrollbar = scrollbar->orientation() == HorizontalScrollbar ? m_horizontalScrollbar : m_verticalScrollbar;
     if (!webScrollbar)
         return 0;
     return webScrollbar->scrollOffset();
@@ -225,14 +225,14 @@ IntSize ScrollbarGroup::contentsSize() const
     else if (m_verticalScrollbar) {
         size.setWidth(m_verticalScrollbar->scrollbar()->x());
         if (m_verticalScrollbar->scrollbar()->isOverlayScrollbar())
-            size.expand(WebScrollbar::defaultThickness(), 0);
+            size.expand(WebPluginScrollbar::defaultThickness(), 0);
     }
     if (m_verticalScrollbar)
         size.setHeight(m_verticalScrollbar->scrollbar()->totalSize());
     else if (m_horizontalScrollbar) {
         size.setHeight(m_horizontalScrollbar->scrollbar()->y());
         if (m_horizontalScrollbar->scrollbar()->isOverlayScrollbar())
-            size.expand(0, WebScrollbar::defaultThickness());
+            size.expand(0, WebPluginScrollbar::defaultThickness());
     }
     return size;
 }
diff --git a/Source/WebKit/chromium/src/ScrollbarGroup.h b/Source/WebKit/chromium/src/ScrollbarGroup.h
index aeb44052f..a0479c206 100644
--- a/Source/WebKit/chromium/src/ScrollbarGroup.h
+++ b/Source/WebKit/chromium/src/ScrollbarGroup.h
@@ -36,15 +36,15 @@ class FrameView;
 
 namespace WebKit {
 
-class WebScrollbarImpl;
+class WebPluginScrollbarImpl;
 
 class ScrollbarGroup : public WebCore::ScrollableArea {
 public:
     ScrollbarGroup(WebCore::FrameView*, const WebCore::IntRect& frameRect);
     ~ScrollbarGroup();
 
-    void scrollbarCreated(WebScrollbarImpl*);
-    void scrollbarDestroyed(WebScrollbarImpl*);
+    void scrollbarCreated(WebPluginScrollbarImpl*);
+    void scrollbarDestroyed(WebPluginScrollbarImpl*);
     void setLastMousePosition(const WebCore::IntPoint&);
     void setFrameRect(const WebCore::IntRect&);
 
@@ -79,8 +79,8 @@ private:
     WebCore::FrameView* m_frameView;
     WebCore::IntPoint m_lastMousePosition;
     WebCore::IntRect m_frameRect;
-    WebScrollbarImpl* m_horizontalScrollbar;
-    WebScrollbarImpl* m_verticalScrollbar;
+    WebPluginScrollbarImpl* m_horizontalScrollbar;
+    WebPluginScrollbarImpl* m_verticalScrollbar;
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebAnimation.cpp b/Source/WebKit/chromium/src/WebAnimation.cpp
new file mode 100644
index 000000000..7dddfc241
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebAnimation.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebAnimation.h>
+
+#include "AnimationIdVendor.h"
+#include "cc/CCActiveAnimation.h"
+#include "cc/CCAnimationCurve.h"
+#include <public/WebAnimationCurve.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+using WebCore::AnimationIdVendor;
+using WebCore::CCActiveAnimation;
+
+namespace WebKit {
+
+int WebAnimation::iterations() const
+{
+    return m_private->iterations();
+}
+
+void WebAnimation::setIterations(int n)
+{
+    m_private->setIterations(n);
+}
+
+double WebAnimation::startTime() const
+{
+    return m_private->startTime();
+}
+
+void WebAnimation::setStartTime(double monotonicTime)
+{
+    m_private->setStartTime(monotonicTime);
+}
+
+double WebAnimation::timeOffset() const
+{
+    return m_private->timeOffset();
+}
+
+void WebAnimation::setTimeOffset(double monotonicTime)
+{
+    m_private->setTimeOffset(monotonicTime);
+}
+
+bool WebAnimation::alternatesDirection() const
+{
+    return m_private->alternatesDirection();
+}
+
+void WebAnimation::setAlternatesDirection(bool alternates)
+{
+    m_private->setAlternatesDirection(alternates);
+}
+
+WebAnimation::operator PassOwnPtr<WebCore::CCActiveAnimation>() const
+{
+    OwnPtr<WebCore::CCActiveAnimation> toReturn(m_private->cloneForImplThread());
+    toReturn->setNeedsSynchronizedStartTime(true);
+    return toReturn.release();
+}
+
+void WebAnimation::initialize(const WebAnimationCurve& curve, TargetProperty targetProperty)
+{
+    m_private.reset(CCActiveAnimation::create(curve,
+                                              AnimationIdVendor::getNextAnimationId(),
+                                              AnimationIdVendor::getNextGroupId(),
+                                              static_cast<WebCore::CCActiveAnimation::TargetProperty>(targetProperty)).leakPtr());
+}
+
+void WebAnimation::destroy()
+{
+    m_private.reset(0);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebAnimationCurveCommon.cpp b/Source/WebKit/chromium/src/WebAnimationCurveCommon.cpp
new file mode 100644
index 000000000..b5b98b0a3
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebAnimationCurveCommon.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WebAnimationCurveCommon.h"
+
+#include "cc/CCTimingFunction.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+PassOwnPtr<WebCore::CCTimingFunction> createTimingFunction(WebAnimationCurve::TimingFunctionType type)
+{
+    switch (type) {
+    case WebAnimationCurve::TimingFunctionTypeEase:
+        return WebCore::CCEaseTimingFunction::create();
+    case WebAnimationCurve::TimingFunctionTypeEaseIn:
+        return WebCore::CCEaseInTimingFunction::create();
+    case WebAnimationCurve::TimingFunctionTypeEaseOut:
+        return WebCore::CCEaseOutTimingFunction::create();
+    case WebAnimationCurve::TimingFunctionTypeEaseInOut:
+        return WebCore::CCEaseInOutTimingFunction::create();
+    case WebAnimationCurve::TimingFunctionTypeLinear:
+        return nullptr;
+    }
+    return nullptr;
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebAnimationCurveCommon.h b/Source/WebKit/chromium/src/WebAnimationCurveCommon.h
new file mode 100644
index 000000000..562b6eb8d
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebAnimationCurveCommon.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebAnimationCurveCommon_h
+#define WebAnimationCurveCommon_h
+
+#include <public/WebAnimationCurve.h>
+#include <wtf/Forward.h>
+
+namespace WebCore {
+class CCTimingFunction;
+}
+
+namespace WebKit {
+PassOwnPtr<WebCore::CCTimingFunction> createTimingFunction(WebAnimationCurve::TimingFunctionType);
+}
+
+#endif // WebAnimationCurveCommon_h
diff --git a/Source/WebKit/chromium/src/WebBindings.cpp b/Source/WebKit/chromium/src/WebBindings.cpp
index c4f40df3d..b9bbd5d37 100644
--- a/Source/WebKit/chromium/src/WebBindings.cpp
+++ b/Source/WebKit/chromium/src/WebBindings.cpp
@@ -210,6 +210,8 @@ static bool getRangeImpl(NPObject* object, WebRange* webRange)
 
     V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(object);
     v8::Handle<v8::Object> v8Object(v8NPObject->v8Object);
+    if (v8Object.IsEmpty())
+        return false;
     if (!V8Range::info.equals(V8DOMWrapper::domWrapperType(v8Object)))
         return false;
 
@@ -221,6 +223,21 @@ static bool getRangeImpl(NPObject* object, WebRange* webRange)
     return true;
 }
 
+static bool getNodeImpl(NPObject* object, WebNode* webNode)
+{
+    if (!object || (object->_class != npScriptObjectClass))
+        return false;
+
+    V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(object);
+    v8::Handle<v8::Object> v8Object(v8NPObject->v8Object);
+    Node* native = V8Node::HasInstance(v8Object) ? V8Node::toNative(v8Object) : 0;
+    if (!native)
+        return false;
+
+    *webNode = WebNode(native);
+    return true;
+}
+
 static bool getElementImpl(NPObject* object, WebElement* webElement)
 {
     if (!object || (object->_class != npScriptObjectClass))
@@ -228,6 +245,8 @@ static bool getElementImpl(NPObject* object, WebElement* webElement)
 
     V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(object);
     v8::Handle<v8::Object> v8Object(v8NPObject->v8Object);
+    if (v8Object.IsEmpty())
+        return false;
     Element* native = V8Element::HasInstance(v8Object) ? V8Element::toNative(v8Object) : 0;
     if (!native)
         return false;
@@ -243,6 +262,8 @@ static bool getArrayBufferImpl(NPObject* object, WebArrayBuffer* arrayBuffer)
 
     V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(object);
     v8::Handle<v8::Object> v8Object(v8NPObject->v8Object);
+    if (v8Object.IsEmpty())
+        return false;
     ArrayBuffer* native = V8ArrayBuffer::HasInstance(v8Object) ? V8ArrayBuffer::toNative(v8Object) : 0;
     if (!native)
         return false;
@@ -258,6 +279,8 @@ static bool getArrayBufferViewImpl(NPObject* object, WebArrayBufferView* arrayBu
 
     V8NPObject* v8NPObject = reinterpret_cast<V8NPObject*>(object);
     v8::Handle<v8::Object> v8Object(v8NPObject->v8Object);
+    if (v8Object.IsEmpty())
+        return false;
     ArrayBufferView* native = V8ArrayBufferView::HasInstance(v8Object) ? V8ArrayBufferView::toNative(v8Object) : 0;
     if (!native)
         return false;
@@ -320,6 +343,16 @@ bool WebBindings::getArrayBufferView(NPObject* arrayBufferView, WebArrayBufferVi
 #endif
 }
 
+bool WebBindings::getNode(NPObject* node, WebNode* webNode)
+{
+#if USE(V8)
+    return getNodeImpl(node, webNode);
+#else
+    // Not supported on other ports (JSC, etc.).
+    return false;
+#endif
+}
+
 bool WebBindings::getElement(NPObject* element, WebElement* webElement)
 {
 #if USE(V8)
@@ -373,6 +406,8 @@ v8::Handle<v8::Value> WebBindings::toV8Value(const NPVariant* variant)
         if (object->_class != npScriptObjectClass)
             return v8::Undefined();
         V8NPObject* v8Object = reinterpret_cast<V8NPObject*>(object);
+        if (v8Object->v8Object.IsEmpty())
+            return v8::Undefined();
         return convertNPVariantToV8Object(variant, v8Object->rootObject->frame()->script()->windowScriptNPObject());
     }
     // Safe to pass 0 since we have checked the script object class to make sure the
diff --git a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
index 8c8122f6b..ecf099a4a 100644
--- a/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebContentLayerImpl.cpp
@@ -27,6 +27,7 @@
 #include "WebContentLayerImpl.h"
 
 #include "platform/WebContentLayerClient.h"
+#include "platform/WebFloatRect.h"
 #include "platform/WebRect.h"
 #include "GraphicsContext.h"
 #include "platform/WebCanvas.h"
@@ -53,11 +54,11 @@ WebContentLayerImpl::~WebContentLayerImpl()
     clearDelegate();
 }
 
-void WebContentLayerImpl::paintContents(SkCanvas* canvas, const IntRect& clip, IntRect& opaque)
+void WebContentLayerImpl::paintContents(SkCanvas* canvas, const IntRect& clip, FloatRect& opaque)
 {
     if (!m_contentClient)
         return;
-    WebRect webOpaque;
+    WebFloatRect webOpaque;
     m_contentClient->paintContents(canvas, WebRect(clip), webOpaque);
     opaque = webOpaque;
 }
diff --git a/Source/WebKit/chromium/src/WebContentLayerImpl.h b/Source/WebKit/chromium/src/WebContentLayerImpl.h
index 542bd9b8e..97729ea1e 100644
--- a/Source/WebKit/chromium/src/WebContentLayerImpl.h
+++ b/Source/WebKit/chromium/src/WebContentLayerImpl.h
@@ -41,7 +41,7 @@ protected:
     virtual ~WebContentLayerImpl();
 
     // ContentLayerDelegate implementation.
-    virtual void paintContents(SkCanvas*, const WebCore::IntRect& clip, WebCore::IntRect& opaque);
+    virtual void paintContents(SkCanvas*, const WebCore::IntRect& clip, WebCore::FloatRect& opaque) OVERRIDE;
 
     WebContentLayerClient* m_contentClient;
     bool m_drawsContent;
diff --git a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index 7792cf863..1bd1595b6 100644
--- a/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/Source/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -232,10 +232,12 @@ public:
 
         frame->setTextZoomFactor(m_webView->emulatedTextZoomFactor());
         ensureOriginalZoomFactor(frame->view());
-        frame->setPageAndTextZoomFactors(m_originalZoomFactor, m_webView->emulatedTextZoomFactor());
-        Document* doc = frame->document();
-        doc->styleResolverChanged(RecalcStyleImmediately);
-        doc->updateLayout();
+        Document* document = frame->document();
+        float numerator = document->renderView() ? document->renderView()->viewWidth() : frame->view()->contentsWidth();
+        float factor = m_originalZoomFactor * (numerator / m_emulatedFrameSize.width);
+        frame->setPageAndTextZoomFactors(factor, m_webView->emulatedTextZoomFactor());
+        document->styleResolverChanged(RecalcStyleImmediately);
+        document->updateLayout();
     }
 
     void webViewResized()
diff --git a/Source/WebKit/chromium/src/WebDeviceOrientation.cpp b/Source/WebKit/chromium/src/WebDeviceOrientation.cpp
index 24f7bc801..885076921 100644
--- a/Source/WebKit/chromium/src/WebDeviceOrientation.cpp
+++ b/Source/WebKit/chromium/src/WebDeviceOrientation.cpp
@@ -57,33 +57,6 @@ WebDeviceOrientation::WebDeviceOrientation(const WebCore::DeviceOrientationData*
     m_absolute = orientation->absolute();
 }
 
-WebDeviceOrientation& WebDeviceOrientation::operator=(const WebCore::DeviceOrientationData* orientation)
-{
-    if (!orientation) {
-        m_isNull = true;
-        m_canProvideAlpha = false;
-        m_alpha = 0;
-        m_canProvideBeta = false;
-        m_beta = 0;
-        m_canProvideGamma = false;
-        m_gamma = 0;
-        m_canProvideAbsolute = false;
-        m_absolute = false;
-        return *this;
-    }
-
-    m_isNull = false;
-    m_canProvideAlpha = orientation->canProvideAlpha();
-    m_alpha = orientation->alpha();
-    m_canProvideBeta = orientation->canProvideBeta();
-    m_beta = orientation->beta();
-    m_canProvideGamma = orientation->canProvideGamma();
-    m_gamma = orientation->gamma();
-    m_canProvideAbsolute = orientation->canProvideAbsolute();
-    m_absolute = orientation->absolute();
-    return *this;
-}
-
 WebDeviceOrientation::operator PassRefPtr<WebCore::DeviceOrientationData>() const
 {
     if (m_isNull)
diff --git a/Source/WebKit/chromium/src/WebFloatAnimationCurve.cpp b/Source/WebKit/chromium/src/WebFloatAnimationCurve.cpp
new file mode 100644
index 000000000..d8cc9bb98
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebFloatAnimationCurve.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebFloatAnimationCurve.h>
+
+#include "WebAnimationCurveCommon.h"
+#include "cc/CCKeyframedAnimationCurve.h"
+#include "cc/CCTimingFunction.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+void WebFloatAnimationCurve::add(const WebFloatKeyframe& keyframe)
+{
+    add(keyframe, TimingFunctionTypeEase);
+}
+
+void WebFloatAnimationCurve::add(const WebFloatKeyframe& keyframe, TimingFunctionType type)
+{
+    m_private->addKeyframe(WebCore::CCFloatKeyframe::create(keyframe.time, keyframe.value, createTimingFunction(type)));
+}
+
+void WebFloatAnimationCurve::add(const WebFloatKeyframe& keyframe, double x1, double y1, double x2, double y2)
+{
+    m_private->addKeyframe(WebCore::CCFloatKeyframe::create(keyframe.time, keyframe.value, WebCore::CCCubicBezierTimingFunction::create(x1, y1, x2, y2)));
+}
+
+float WebFloatAnimationCurve::getValue(double time) const
+{
+    return m_private->getValue(time);
+}
+
+WebFloatAnimationCurve::operator PassOwnPtr<WebCore::CCAnimationCurve>() const
+{
+    return m_private->clone();
+}
+
+void WebFloatAnimationCurve::initialize()
+{
+    m_private.reset(WebCore::CCKeyframedFloatAnimationCurve::create().leakPtr());
+}
+
+void WebFloatAnimationCurve::destroy()
+{
+    m_private.reset(0);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.cpp b/Source/WebKit/chromium/src/WebFrameImpl.cpp
index afe0f99ff..89189eea2 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/Source/WebKit/chromium/src/WebFrameImpl.cpp
@@ -978,6 +978,12 @@ void WebFrameImpl::reload(bool ignoreCache)
     m_frame->loader()->reload(ignoreCache);
 }
 
+void WebFrameImpl::reloadWithOverrideURL(const WebURL& overrideUrl, bool ignoreCache)
+{
+    m_frame->loader()->history()->saveDocumentAndScrollState();
+    m_frame->loader()->reloadWithOverrideURL(overrideUrl, ignoreCache);
+}
+
 void WebFrameImpl::loadRequest(const WebURLRequest& request)
 {
     ASSERT(!request.isNull());
diff --git a/Source/WebKit/chromium/src/WebFrameImpl.h b/Source/WebKit/chromium/src/WebFrameImpl.h
index 3ddfb76d2..9dbf68336 100644
--- a/Source/WebKit/chromium/src/WebFrameImpl.h
+++ b/Source/WebKit/chromium/src/WebFrameImpl.h
@@ -136,6 +136,7 @@ public:
                                                   bool isDirectory);
 #endif
     virtual void reload(bool ignoreCache);
+    virtual void reloadWithOverrideURL(const WebURL& overrideUrl, bool ignoreCache);
     virtual void loadRequest(const WebURLRequest&);
     virtual void loadHistoryItem(const WebHistoryItem&);
     virtual void loadData(
diff --git a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index 31266b1a3..5b5aedf7c 100644
--- a/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -92,9 +92,7 @@ void WebIDBCallbacksImpl::onSuccess(const WebSerializedScriptValue& serializedSc
 
 void WebIDBCallbacksImpl::onSuccess(const WebSerializedScriptValue& serializedScriptValue, const WebIDBKey& key, const WebIDBKeyPath& keyPath)
 {
-    // FIXME: proxy to the 3-parameter version when interface lands:
-    // m_callbacks->onSuccess(serializedScriptValue, key, keyPath););
-    ASSERT_NOT_REACHED();
+    m_callbacks->onSuccess(serializedScriptValue, key, keyPath);
 }
 
 void WebIDBCallbacksImpl::onSuccessWithContinuation()
diff --git a/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp b/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp
index 6f10efe9e..e9c0e04af 100644
--- a/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBCursorImpl.cpp
@@ -47,11 +47,6 @@ WebIDBCursorImpl::~WebIDBCursorImpl()
 {
 }
 
-unsigned short WebIDBCursorImpl::direction() const
-{
-    return m_idbCursorBackend->direction();
-}
-
 WebIDBKey WebIDBCursorImpl::key() const
 {
     return m_idbCursorBackend->key();
diff --git a/Source/WebKit/chromium/src/WebIDBCursorImpl.h b/Source/WebKit/chromium/src/WebIDBCursorImpl.h
index 418675142..f0d387b62 100644
--- a/Source/WebKit/chromium/src/WebIDBCursorImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBCursorImpl.h
@@ -44,7 +44,6 @@ public:
     WebIDBCursorImpl(WTF::PassRefPtr<WebCore::IDBCursorBackendInterface>);
     virtual ~WebIDBCursorImpl();
 
-    virtual unsigned short direction() const;
     virtual WebIDBKey key() const;
     virtual WebIDBKey primaryKey() const;
     virtual WebSerializedScriptValue value() const;
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
index e0a031890..94610eba9 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.cpp
@@ -46,11 +46,6 @@ WebIDBTransactionImpl::~WebIDBTransactionImpl()
 {
 }
 
-int WebIDBTransactionImpl::mode() const
-{
-    return m_backend->mode();
-}
-
 WebIDBObjectStore* WebIDBTransactionImpl::objectStore(const WebString& name, ExceptionCode& ec)
 {
     RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->objectStore(name, ec);
@@ -59,6 +54,11 @@ WebIDBObjectStore* WebIDBTransactionImpl::objectStore(const WebString& name, Exc
     return new WebIDBObjectStoreImpl(objectStore);
 }
 
+void WebIDBTransactionImpl::commit()
+{
+    m_backend->commit();
+}
+
 void WebIDBTransactionImpl::abort()
 {
     m_backend->abort();
diff --git a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
index fa1049bd0..323e2be59 100644
--- a/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
+++ b/Source/WebKit/chromium/src/WebIDBTransactionImpl.h
@@ -41,8 +41,8 @@ public:
     WebIDBTransactionImpl(WTF::PassRefPtr<WebCore::IDBTransactionBackendInterface>);
     virtual ~WebIDBTransactionImpl();  
 
-    virtual int mode() const;
     virtual WebIDBObjectStore* objectStore(const WebString& name, WebExceptionCode&);
+    virtual void commit();
     virtual void abort();
     virtual void didCompleteTaskEvents();
     virtual void setCallbacks(WebIDBTransactionCallbacks*);
diff --git a/Source/WebKit/chromium/src/WebKit.cpp b/Source/WebKit/chromium/src/WebKit.cpp
index 6106597ae..e41ce228d 100644
--- a/Source/WebKit/chromium/src/WebKit.cpp
+++ b/Source/WebKit/chromium/src/WebKit.cpp
@@ -32,13 +32,13 @@
 #include "WebKit.h"
 
 #include "Logging.h"
+#include "MutationObserver.h"
 #include "Page.h"
 #include "RuntimeEnabledFeatures.h"
 #include "Settings.h"
 #include "TextEncoding.h"
 #include "V8Binding.h"
 #include "V8RecursionScope.h"
-#include "WebKitMutationObserver.h"
 #include "WebMediaPlayerClientImpl.h"
 #include "WebSocket.h"
 #include "WorkerContextExecutionProxy.h"
@@ -50,6 +50,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
+#include <wtf/UnusedParam.h>
 #include <wtf/text/AtomicString.h>
 
 #if OS(DARWIN)
@@ -66,7 +67,7 @@ public:
     virtual void willProcessTask() { }
     virtual void didProcessTask()
     {
-        WebCore::WebKitMutationObserver::deliverAllMutations();
+        WebCore::MutationObserver::deliverAllMutations();
     }
 };
 
@@ -185,9 +186,13 @@ bool layoutTestMode()
 
 void enableLogChannel(const char* name)
 {
+#if !LOG_DISABLED
     WTFLogChannel* channel = WebCore::getChannelFromName(name);
     if (channel)
         channel->state = WTFLogChannelOn;
+#else
+    UNUSED_PARAM(name);
+#endif // !LOG_DISABLED
 }
 
 void resetPluginCache(bool reloadPages)
diff --git a/Source/WebKit/chromium/src/WebNode.cpp b/Source/WebKit/chromium/src/WebNode.cpp
index 49dcdd98e..14da1d570 100644
--- a/Source/WebKit/chromium/src/WebNode.cpp
+++ b/Source/WebKit/chromium/src/WebNode.cpp
@@ -213,6 +213,11 @@ WebElement WebNode::rootEditableElement() const
     return WebElement(m_private->rootEditableElement());
 }
 
+bool WebNode::focused() const
+{
+    return m_private->focused();
+}
+
 bool WebNode::hasNonEmptyBoundingBox() const
 {
     m_private->document()->updateLayoutIgnorePendingStylesheets();
diff --git a/Source/WebKit/chromium/src/WebPageSerializer.cpp b/Source/WebKit/chromium/src/WebPageSerializer.cpp
index 6adac2d6b..1d771fb00 100644
--- a/Source/WebKit/chromium/src/WebPageSerializer.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializer.cpp
@@ -165,7 +165,7 @@ void retrieveResourcesForFrame(Frame* frame,
         frameURLs->append(frameURL);
   
     // Now get the resources associated with each node of the document.
-    RefPtr<HTMLAllCollection> allNodes = frame->document()->all();
+    RefPtr<HTMLCollection> allNodes = frame->document()->all();
     for (unsigned i = 0; i < allNodes->length(); ++i) {
         Node* node = allNodes->item(i);
         // We are only interested in HTML resources.
diff --git a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
index ac200f1c9..dd4b15ebd 100644
--- a/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPageSerializerImpl.cpp
@@ -476,7 +476,7 @@ void WebPageSerializerImpl::collectTargetFrames()
         // Get current using document.
         Document* currentDoc = currentFrame->frame()->document();
         // Go through sub-frames.
-        RefPtr<HTMLAllCollection> all = currentDoc->all();
+        RefPtr<HTMLCollection> all = currentDoc->all();
 
         for (unsigned i = 0; Node* node = all->item(i); i++) {
             if (!node->isHTMLElement())
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 040eb6384..29489e25a 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -245,6 +245,30 @@ void WebPluginContainerImpl::setPlugin(WebPlugin* plugin)
     }
 }
 
+float WebPluginContainerImpl::deviceScaleFactor()
+{
+    Page* page = m_element->document()->page();
+    if (!page)
+        return 1.0;
+    return page->deviceScaleFactor();
+}
+
+float WebPluginContainerImpl::pageScaleFactor()
+{
+    Page* page = m_element->document()->page();
+    if (!page)
+        return 1.0;
+    return page->pageScaleFactor();
+}
+
+float WebPluginContainerImpl::pageZoomFactor()
+{
+    Frame* frame = m_element->document()->frame();
+    if (!frame)
+        return 1.0;
+    return frame->pageZoomFactor();
+}
+
 bool WebPluginContainerImpl::supportsPaginatedPrint() const
 {
     return m_webPlugin->supportsPaginatedPrint();
diff --git a/Source/WebKit/chromium/src/WebPluginContainerImpl.h b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
index a151f7090..4c2aaeb4a 100644
--- a/Source/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/Source/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -116,6 +116,10 @@ public:
     WebPlugin* plugin() { return m_webPlugin; }
     void setPlugin(WebPlugin*);
 
+    virtual float deviceScaleFactor();
+    virtual float pageScaleFactor();
+    virtual float pageZoomFactor();
+
     // Printing interface. The plugin can support custom printing
     // (which means it controls the layout, number of pages etc).
     // Whether the plugin supports its own paginated print. The other print
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
index 7a3ea90d6..b0f63a7e4 100644
--- a/Source/WebKit/chromium/src/WebScrollbarImpl.cpp
+++ b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.cpp
@@ -1,35 +1,29 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
-#include "WebScrollbarImpl.h"
+#include "WebPluginScrollbarImpl.h"
 
 #include "GraphicsContext.h"
 #include "KeyboardCodes.h"
@@ -38,37 +32,37 @@
 #include "Scrollbar.h"
 #include "ScrollbarGroup.h"
 #include "ScrollbarTheme.h"
-#include "platform/WebCanvas.h"
 #include "WebInputEvent.h"
 #include "WebInputEventConversion.h"
 #include "WebPluginContainerImpl.h"
-#include "platform/WebRect.h"
-#include "WebScrollbarClient.h"
-#include "platform/WebVector.h"
+#include "WebPluginScrollbarClient.h"
 #include "WebViewImpl.h"
 #include "painting/GraphicsContextBuilder.h"
+#include <public/WebCanvas.h>
+#include <public/WebRect.h>
+#include <public/WebVector.h>
 
 using namespace std;
 using namespace WebCore;
 
 namespace WebKit {
 
-WebScrollbar* WebScrollbar::createForPlugin(Orientation orientation,
-                                            WebPluginContainer* pluginContainer,
-                                            WebScrollbarClient* client)
+WebPluginScrollbar* WebPluginScrollbar::createForPlugin(Orientation orientation,
+                                                        WebPluginContainer* pluginContainer,
+                                                        WebPluginScrollbarClient* client)
 {
     WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(pluginContainer);
-    return new WebScrollbarImpl(orientation, plugin->scrollbarGroup(), client);
+    return new WebPluginScrollbarImpl(orientation, plugin->scrollbarGroup(), client);
 }
 
-int WebScrollbar::defaultThickness()
+int WebPluginScrollbar::defaultThickness()
 {
     return ScrollbarTheme::theme()->scrollbarThickness();
 }
 
-WebScrollbarImpl::WebScrollbarImpl(Orientation orientation,
+WebPluginScrollbarImpl::WebPluginScrollbarImpl(Orientation orientation,
                                    ScrollbarGroup* group,
-                                   WebScrollbarClient* client)
+                                   WebPluginScrollbarClient* client)
     : m_group(group)
     , m_client(client)
     , m_scrollOffset(0)
@@ -80,18 +74,18 @@ WebScrollbarImpl::WebScrollbarImpl(Orientation orientation,
     m_group->scrollbarCreated(this);
 }
 
-WebScrollbarImpl::~WebScrollbarImpl()
+WebPluginScrollbarImpl::~WebPluginScrollbarImpl()
 {
     m_group->scrollbarDestroyed(this);
 }
 
-void WebScrollbarImpl::setScrollOffset(int scrollOffset)
+void WebPluginScrollbarImpl::setScrollOffset(int scrollOffset)
 {
     m_scrollOffset = scrollOffset;
     m_client->valueChanged(this);
 }
 
-void WebScrollbarImpl::invalidateScrollbarRect(const IntRect& rect)
+void WebPluginScrollbarImpl::invalidateScrollbarRect(const IntRect& rect)
 {
     WebRect webrect(rect);
     webrect.x += m_scrollbar->x();
@@ -99,32 +93,37 @@ void WebScrollbarImpl::invalidateScrollbarRect(const IntRect& rect)
     m_client->invalidateScrollbarRect(this, webrect);
 }
 
-void WebScrollbarImpl::getTickmarks(Vector<IntRect>& tickmarks) const
+void WebPluginScrollbarImpl::getTickmarks(Vector<IntRect>& tickmarks) const
 {
     WebVector<WebRect> ticks;
-    m_client->getTickmarks(const_cast<WebScrollbarImpl*>(this), &ticks);
+    m_client->getTickmarks(const_cast<WebPluginScrollbarImpl*>(this), &ticks);
     tickmarks.resize(ticks.size());
     for (size_t i = 0; i < ticks.size(); ++i)
         tickmarks[i] = ticks[i];
 }
 
-IntPoint WebScrollbarImpl::convertFromContainingViewToScrollbar(const IntPoint& parentPoint) const
+IntPoint WebPluginScrollbarImpl::convertFromContainingViewToScrollbar(const IntPoint& parentPoint) const
 {
     IntPoint offset(parentPoint.x() - m_scrollbar->x(), parentPoint.y() - m_scrollbar->y());
     return m_scrollbar->Widget::convertFromContainingView(offset);
 }
 
-void WebScrollbarImpl::scrollbarStyleChanged()
+void WebPluginScrollbarImpl::scrollbarStyleChanged()
 {
     m_client->overlayChanged(this);
 }
 
-bool WebScrollbarImpl::isOverlay() const
+bool WebPluginScrollbarImpl::isOverlay() const
 {
     return m_scrollbar->isOverlayScrollbar();
 }
 
-void WebScrollbarImpl::setLocation(const WebRect& rect)
+int WebPluginScrollbarImpl::value() const
+{
+    return m_scrollOffset;
+}
+
+void WebPluginScrollbarImpl::setLocation(const WebRect& rect)
 {
     IntRect oldRect = m_scrollbar->frameRect();
     m_scrollbar->setFrameRect(rect);
@@ -138,24 +137,19 @@ void WebScrollbarImpl::setLocation(const WebRect& rect)
     m_scrollbar->setProportion(length, m_scrollbar->totalSize());
 }
 
-int WebScrollbarImpl::value() const
-{
-    return m_scrollOffset;
-}
-
-void WebScrollbarImpl::setValue(int position)
+void WebPluginScrollbarImpl::setValue(int position)
 {
     m_group->scrollToOffsetWithoutAnimation(m_scrollbar->orientation(), static_cast<float>(position));
 }
 
-void WebScrollbarImpl::setDocumentSize(int size)
+void WebPluginScrollbarImpl::setDocumentSize(int size)
 {
     int length = m_scrollbar->orientation() == HorizontalScrollbar ? m_scrollbar->width() : m_scrollbar->height();
     m_scrollbar->setEnabled(size > length);
     m_scrollbar->setProportion(length, size);
 }
 
-void WebScrollbarImpl::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+void WebPluginScrollbarImpl::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
 {
     WebCore::ScrollDirection dir;
     bool horizontal = m_scrollbar->orientation() == HorizontalScrollbar;
@@ -167,12 +161,12 @@ void WebScrollbarImpl::scroll(ScrollDirection direction, ScrollGranularity granu
     m_group->scroll(dir, static_cast<WebCore::ScrollGranularity>(granularity), multiplier);
 }
 
-void WebScrollbarImpl::paint(WebCanvas* canvas, const WebRect& rect)
+void WebPluginScrollbarImpl::paint(WebCanvas* canvas, const WebRect& rect)
 {
     m_scrollbar->paint(&GraphicsContextBuilder(canvas).context(), rect);
 }
 
-bool WebScrollbarImpl::handleInputEvent(const WebInputEvent& event)
+bool WebPluginScrollbarImpl::handleInputEvent(const WebInputEvent& event)
 {
     switch (event.type) {
     case WebInputEvent::MouseDown:
@@ -202,7 +196,7 @@ bool WebScrollbarImpl::handleInputEvent(const WebInputEvent& event)
     return false;
 }
 
-bool WebScrollbarImpl::onMouseDown(const WebInputEvent& event)
+bool WebPluginScrollbarImpl::onMouseDown(const WebInputEvent& event)
 {
     WebMouseEvent mousedown = *static_cast<const WebMouseEvent*>(&event);
     if (!m_scrollbar->frameRect().contains(mousedown.x, mousedown.y))
@@ -214,7 +208,7 @@ bool WebScrollbarImpl::onMouseDown(const WebInputEvent& event)
     return true;
 }
 
-bool WebScrollbarImpl::onMouseUp(const WebInputEvent& event)
+bool WebPluginScrollbarImpl::onMouseUp(const WebInputEvent& event)
 {
     WebMouseEvent mouseup = *static_cast<const WebMouseEvent*>(&event);
     if (m_scrollbar->pressedPart() == NoPart)
@@ -223,7 +217,7 @@ bool WebScrollbarImpl::onMouseUp(const WebInputEvent& event)
     return m_scrollbar->mouseUp(PlatformMouseEventBuilder(m_scrollbar.get(), mouseup));
 }
 
-bool WebScrollbarImpl::onMouseMove(const WebInputEvent& event)
+bool WebPluginScrollbarImpl::onMouseMove(const WebInputEvent& event)
 {
     WebMouseEvent mousemove = *static_cast<const WebMouseEvent*>(&event);
     if (m_scrollbar->frameRect().contains(mousemove.x, mousemove.y)
@@ -238,7 +232,7 @@ bool WebScrollbarImpl::onMouseMove(const WebInputEvent& event)
     return false;
 }
 
-bool WebScrollbarImpl::onMouseLeave(const WebInputEvent& event)
+bool WebPluginScrollbarImpl::onMouseLeave(const WebInputEvent& event)
 {
     if (m_scrollbar->hoveredPart() != NoPart)
         m_scrollbar->mouseExited();
@@ -246,14 +240,14 @@ bool WebScrollbarImpl::onMouseLeave(const WebInputEvent& event)
     return false;
 }
 
-bool WebScrollbarImpl::onMouseWheel(const WebInputEvent& event)
+bool WebPluginScrollbarImpl::onMouseWheel(const WebInputEvent& event)
 {
     WebMouseWheelEvent mousewheel = *static_cast<const WebMouseWheelEvent*>(&event);
     PlatformWheelEventBuilder platformEvent(m_scrollbar.get(), mousewheel);
     return m_group->handleWheelEvent(platformEvent);
 }
 
-bool WebScrollbarImpl::onKeyDown(const WebInputEvent& event)
+bool WebPluginScrollbarImpl::onKeyDown(const WebInputEvent& event)
 {
     WebKeyboardEvent keyboard = *static_cast<const WebKeyboardEvent*>(&event);
     int keyCode;
diff --git a/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
new file mode 100644
index 000000000..b42cb82fd
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebPluginScrollbarImpl.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebPluginScrollbarImpl_h
+#define WebPluginScrollbarImpl_h
+
+#include "WebPluginScrollbar.h"
+
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+class IntPoint;
+class IntRect;
+class Scrollbar;
+}
+
+namespace WebKit {
+
+class ScrollbarGroup;
+
+class WebPluginScrollbarImpl : public WebPluginScrollbar {
+public:
+    WebPluginScrollbarImpl(Orientation,
+                     ScrollbarGroup*,
+                     WebPluginScrollbarClient*);
+    ~WebPluginScrollbarImpl();
+
+    void setScrollOffset(int);
+    void invalidateScrollbarRect(const WebCore::IntRect&);
+    void getTickmarks(Vector<WebCore::IntRect>&) const;
+    WebCore::IntPoint convertFromContainingViewToScrollbar(const WebCore::IntPoint& parentPoint) const;
+    void scrollbarStyleChanged();
+
+    int scrollOffset() { return m_scrollOffset; }
+    WebCore::Scrollbar* scrollbar() { return m_scrollbar.get(); }
+
+    // WebKit::WebScrollbar methods
+    virtual bool isOverlay() const;
+    virtual int value() const;
+
+    // WebKit::WebPluginScrollbar methods
+    virtual void setLocation(const WebRect&);
+    virtual void setValue(int position);
+    virtual void setDocumentSize(int);
+    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier);
+    virtual void paint(WebCanvas*, const WebRect&);
+    virtual bool handleInputEvent(const WebInputEvent&);
+
+private:
+    bool onMouseDown(const WebInputEvent&);
+    bool onMouseUp(const WebInputEvent&);
+    bool onMouseMove(const WebInputEvent&);
+    bool onMouseLeave(const WebInputEvent&);
+    bool onMouseWheel(const WebInputEvent&);
+    bool onKeyDown(const WebInputEvent&);
+
+    ScrollbarGroup* m_group;
+    WebPluginScrollbarClient* m_client;
+
+    int m_scrollOffset;
+    RefPtr<WebCore::Scrollbar> m_scrollbar;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 03129c54d..491a30311 100644
--- a/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -531,4 +531,23 @@ bool WebRuntimeFeatures::isInputTypeDateEnabled()
 #endif
 }
 
+void WebRuntimeFeatures::enableDialogElement(bool enable)
+{
+#if ENABLE(DIALOG_ELEMENT)
+    RuntimeEnabledFeatures::setDialogElementEnabled(enable);
+#else
+    UNUSED_PARAM(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isDialogElementEnabled()
+{
+#if ENABLE(DIALOG_ELEMENT)
+    return RuntimeEnabledFeatures::dialogElementEnabled();
+#else
+    return false;
+#endif
+}
+
+
 } // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebScriptController.cpp b/Source/WebKit/chromium/src/WebScriptController.cpp
index 948da1a48..5d36bbe0d 100644
--- a/Source/WebKit/chromium/src/WebScriptController.cpp
+++ b/Source/WebKit/chromium/src/WebScriptController.cpp
@@ -48,7 +48,7 @@ void WebScriptController::registerExtension(v8::Extension* extension)
 
 void WebScriptController::enableV8SingleThreadMode()
 {
-    enableFasterDOMStoreAccess();
+    // FIXME: remove this method after all it's usages are gone.
 }
 
 void WebScriptController::flushConsoleMessages()
diff --git a/Source/WebKit/chromium/src/WebScrollbarImpl.h b/Source/WebKit/chromium/src/WebScrollbarImpl.h
deleted file mode 100644
index 644443c1c..000000000
--- a/Source/WebKit/chromium/src/WebScrollbarImpl.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebScrollbarImpl_h
-#define WebScrollbarImpl_h
-
-#include "WebScrollbar.h"
-
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-class IntPoint;
-class IntRect;
-class Scrollbar;
-}
-
-namespace WebKit {
-
-class ScrollbarGroup;
-
-class WebScrollbarImpl : public WebScrollbar {
-public:
-    WebScrollbarImpl(Orientation,
-                     ScrollbarGroup*,                     
-                     WebScrollbarClient*);
-    ~WebScrollbarImpl();
-
-    void setScrollOffset(int);
-    void invalidateScrollbarRect(const WebCore::IntRect&);
-    void getTickmarks(Vector<WebCore::IntRect>&) const;
-    WebCore::IntPoint convertFromContainingViewToScrollbar(const WebCore::IntPoint& parentPoint) const;
-    void scrollbarStyleChanged();
-
-    int scrollOffset() { return m_scrollOffset; }
-    WebCore::Scrollbar* scrollbar() { return m_scrollbar.get(); }
-
-    // WebKit::WebScrollbar methods
-    virtual bool isOverlay() const;
-    virtual void setLocation(const WebRect&);
-    virtual int value() const;
-    virtual void setValue(int position);
-    virtual void setDocumentSize(int size);
-    virtual void scroll(ScrollDirection, ScrollGranularity, float multiplier);
-    virtual void paint(WebCanvas*, const WebRect&);
-    virtual bool handleInputEvent(const WebInputEvent&);
-
-private:
-    bool onMouseDown(const WebInputEvent& event);
-    bool onMouseUp(const WebInputEvent& event);
-    bool onMouseMove(const WebInputEvent& event);
-    bool onMouseLeave(const WebInputEvent& event);
-    bool onMouseWheel(const WebInputEvent& event);
-    bool onKeyDown(const WebInputEvent& event);
-
-    ScrollbarGroup* m_group;
-    WebScrollbarClient* m_client;
-
-    int m_scrollOffset;
-    RefPtr<WebCore::Scrollbar> m_scrollbar;
-};
-
-} // namespace WebKit
-
-#endif
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.cpp b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
index e4d3ad835..5c57cf8ca 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.cpp
@@ -139,9 +139,13 @@ void WebSettingsImpl::setApplyDefaultDeviceScaleFactorInCompositor(bool applyDef
     m_applyDefaultDeviceScaleFactorInCompositor = applyDefaultDeviceScaleFactorInCompositor;
 }
 
-void WebSettingsImpl::setFontBoostingEnabled(bool enabled)
+void WebSettingsImpl::setTextAutosizingEnabled(bool enabled)
 {
-    m_settings->setFontBoostingEnabled(enabled);
+#if ENABLE(TEXT_AUTOSIZING)
+    m_settings->setTextAutosizingEnabled(enabled);
+#else
+    UNUSED_PARAM(enabled);
+#endif
 }
 
 void WebSettingsImpl::setDefaultTextEncodingName(const WebString& encoding)
@@ -551,15 +555,6 @@ bool WebSettingsImpl::scrollAnimatorEnabled() const
 #endif
 }
 
-void WebSettingsImpl::setHixie76WebSocketProtocolEnabled(bool enabled)
-{
-#if ENABLE(WEB_SOCKETS)
-    m_settings->setUseHixie76WebSocketProtocol(enabled);
-#else
-    UNUSED_PARAM(enabled);
-#endif
-}
-
 void WebSettingsImpl::setVisualWordMovementEnabled(bool enabled)
 {
     m_settings->setVisualWordMovementEnabled(enabled);
diff --git a/Source/WebKit/chromium/src/WebSettingsImpl.h b/Source/WebKit/chromium/src/WebSettingsImpl.h
index ddd89114f..163862e19 100644
--- a/Source/WebKit/chromium/src/WebSettingsImpl.h
+++ b/Source/WebKit/chromium/src/WebSettingsImpl.h
@@ -56,7 +56,7 @@ public:
     virtual void setMinimumFontSize(int);
     virtual void setMinimumLogicalFontSize(int);
     virtual void setApplyDefaultDeviceScaleFactorInCompositor(bool);
-    virtual void setFontBoostingEnabled(bool);
+    virtual void setTextAutosizingEnabled(bool);
     virtual void setDefaultTextEncodingName(const WebString&);
     virtual void setDeviceSupportsTouch(bool);
     virtual void setDeviceSupportsMouse(bool);
@@ -139,7 +139,6 @@ public:
     virtual void setShouldPrintBackgrounds(bool);
     virtual void setEnableScrollAnimator(bool);
     virtual bool scrollAnimatorEnabled() const;
-    virtual void setHixie76WebSocketProtocolEnabled(bool);
     virtual void setVisualWordMovementEnabled(bool);
     virtual void setShouldDisplaySubtitles(bool);
     virtual void setShouldDisplayCaptions(bool);
diff --git a/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp b/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
index e44a1b434..5cf999851 100644
--- a/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
+++ b/Source/WebKit/chromium/src/WebSharedWorkerImpl.cpp
@@ -34,9 +34,12 @@
 #include "CrossThreadTask.h"
 #include "DatabaseTask.h"
 #include "Document.h"
+#include "GroupSettings.h"
 #include "KURL.h"
 #include "MessageEvent.h"
 #include "MessagePortChannel.h"
+#include "Page.h"
+#include "PageGroup.h"
 #include "PlatformMessagePortChannel.h"
 #include "SecurityOrigin.h"
 #include "ScriptExecutionContext.h"
@@ -120,7 +123,6 @@ void WebSharedWorkerImpl::initializeLoader(const WebURL& url)
     m_webView->settings()->setOfflineWebApplicationCacheEnabled(WebRuntimeFeatures::isApplicationCacheEnabled());
     // FIXME: Settings information should be passed to the Worker process from Browser process when the worker
     // is created (similar to RenderThread::OnCreateNewView).
-    m_webView->settings()->setHixie76WebSocketProtocolEnabled(false);
     m_webView->initializeMainFrame(this);
 
     WebFrameImpl* webFrame = static_cast<WebFrameImpl*>(m_webView->mainFrame());
@@ -366,7 +368,13 @@ void WebSharedWorkerImpl::startWorkerContext(const WebURL& url, const WebString&
 {
     initializeLoader(url);
     WorkerThreadStartMode startMode = m_pauseWorkerContextOnStart ? PauseWorkerContextOnStart : DontPauseWorkerContextOnStart;
-    setWorkerThread(SharedWorkerThread::create(name, url, userAgent, sourceCode, *this, *this, startMode, contentSecurityPolicy,
+    ASSERT(m_loadingDocument->isDocument());
+    Document* document = static_cast<Document*>(m_loadingDocument.get());
+    GroupSettings* settings = 0;
+    if (document->page())
+        settings = document->page()->group().groupSettings();
+    setWorkerThread(SharedWorkerThread::create(name, url, userAgent, settings,
+                                               sourceCode, *this, *this, startMode, contentSecurityPolicy,
                                                static_cast<WebCore::ContentSecurityPolicy::HeaderType>(policyType)));
 
     workerThread()->start();
diff --git a/Source/WebKit/chromium/src/WebSurroundingText.cpp b/Source/WebKit/chromium/src/WebSurroundingText.cpp
index 26bb39255..f880676ae 100644
--- a/Source/WebKit/chromium/src/WebSurroundingText.cpp
+++ b/Source/WebKit/chromium/src/WebSurroundingText.cpp
@@ -40,26 +40,22 @@ using namespace WebCore;
 
 namespace WebKit {
 
-void WebSurroundingText::initialize(const WebHitTestResult& hitTestInfo, size_t maxLength)
+void WebSurroundingText::initialize(const WebHitTestResult& hitTestResult, size_t maxLength)
 {
-    Node* node = hitTestInfo.node().unwrap<Node>();
+    Node* node = hitTestResult.node().unwrap<Node>();
     if (!node || !node->renderer())
         return;
 
-    VisiblePosition visiblePosition(node->renderer()->positionForPoint(static_cast<IntPoint>(hitTestInfo.localPoint())));
-    if (visiblePosition.isNull())
-        return;
-
-    m_private.reset(new SurroundingText(visiblePosition, maxLength));
+    m_private.reset(new SurroundingText(VisiblePosition(node->renderer()->positionForPoint(static_cast<IntPoint>(hitTestResult.localPoint()))), maxLength));
 }
 
-void WebSurroundingText::initialize(WebNode textNode, size_t offset, size_t maxLength)
+void WebSurroundingText::initialize(const WebNode& webNode, const WebPoint& nodePoint, size_t maxLength)
 {
-    Node* node = textNode.unwrap<Node>();
-    if (!node || !node->isTextNode() || offset >= node->nodeValue().length())
+    const Node* node = webNode.constUnwrap<Node>();
+    if (!node || !node->renderer())
         return;
 
-    m_private.reset(new SurroundingText(VisiblePosition(Position(toText(node), offset).parentAnchoredEquivalent(), DOWNSTREAM), maxLength));
+    m_private.reset(new SurroundingText(node->renderer()->positionForPoint(static_cast<IntPoint>(nodePoint)), maxLength));
 }
 
 WebString WebSurroundingText::textContent() const
diff --git a/Source/WebKit/chromium/src/WebTransformAnimationCurve.cpp b/Source/WebKit/chromium/src/WebTransformAnimationCurve.cpp
new file mode 100644
index 000000000..ca95fa39e
--- /dev/null
+++ b/Source/WebKit/chromium/src/WebTransformAnimationCurve.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebTransformAnimationCurve.h>
+
+#include "WebAnimationCurveCommon.h"
+#include "cc/CCKeyframedAnimationCurve.h"
+#include "cc/CCTimingFunction.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebKit {
+
+void WebTransformAnimationCurve::add(const WebTransformKeyframe& keyframe)
+{
+    add(keyframe, TimingFunctionTypeEase);
+}
+
+void WebTransformAnimationCurve::add(const WebTransformKeyframe& keyframe, TimingFunctionType type)
+{
+    m_private->addKeyframe(WebCore::CCTransformKeyframe::create(keyframe.time, keyframe.value, createTimingFunction(type)));
+}
+
+void WebTransformAnimationCurve::add(const WebTransformKeyframe& keyframe, double x1, double y1, double x2, double y2)
+{
+    m_private->addKeyframe(WebCore::CCTransformKeyframe::create(keyframe.time, keyframe.value, WebCore::CCCubicBezierTimingFunction::create(x1, y1, x2, y2)));
+}
+
+WebTransformationMatrix WebTransformAnimationCurve::getValue(double time) const
+{
+    return m_private->getValue(time);
+}
+
+WebTransformAnimationCurve::operator PassOwnPtr<WebCore::CCAnimationCurve>() const
+{
+    return m_private->clone();
+}
+
+void WebTransformAnimationCurve::initialize()
+{
+    m_private.reset(WebCore::CCKeyframedTransformAnimationCurve::create().leakPtr());
+}
+
+void WebTransformAnimationCurve::destroy()
+{
+    m_private.reset(0);
+}
+
+} // namespace WebKit
diff --git a/Source/WebKit/chromium/src/WebViewImpl.cpp b/Source/WebKit/chromium/src/WebViewImpl.cpp
index 652e9a616..dd3315ff9 100644
--- a/Source/WebKit/chromium/src/WebViewImpl.cpp
+++ b/Source/WebKit/chromium/src/WebViewImpl.cpp
@@ -164,6 +164,7 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefPtr.h>
+#include <wtf/TemporaryChange.h>
 #include <wtf/Uint8ClampedArray.h>
 
 #if ENABLE(GESTURE_EVENTS)
@@ -1760,7 +1761,7 @@ bool WebViewImpl::handleInputEvent(const WebInputEvent& inputEvent)
     if (m_ignoreInputEvents)
         return false;
 
-    m_currentInputEvent = &inputEvent;
+    TemporaryChange<const WebInputEvent*> currentEventChange(m_currentInputEvent, &inputEvent);
 
 #if ENABLE(POINTER_LOCK)
     if (isPointerLocked() && WebInputEvent::isMouseEventType(inputEvent.type)) {
@@ -1798,12 +1799,10 @@ bool WebViewImpl::handleInputEvent(const WebInputEvent& inputEvent)
         node->dispatchMouseEvent(
               PlatformMouseEventBuilder(mainFrameImpl()->frameView(), *static_cast<const WebMouseEvent*>(&inputEvent)),
               eventType, static_cast<const WebMouseEvent*>(&inputEvent)->clickCount);
-        m_currentInputEvent = 0;
         return true;
     }
 
     bool handled = PageWidgetDelegate::handleInputEvent(m_page.get(), *this, inputEvent);
-    m_currentInputEvent = 0;
     return handled;
 }
 
@@ -1987,7 +1986,7 @@ WebTextInputInfo WebViewImpl::textInputInfo()
     if (!selection)
         return info;
 
-    Node* node = focusedWebCoreNode();
+    Node* node = selection->selection().rootEditableElement();
     if (!node)
         return info;
 
@@ -1995,33 +1994,22 @@ WebTextInputInfo WebViewImpl::textInputInfo()
     if (info.type == WebTextInputTypeNone)
         return info;
 
-    if (node->hasTagName(HTMLNames::textareaTag))
-        info.value = static_cast<HTMLTextAreaElement*>(node)->value();
-    else if (node->hasTagName(HTMLNames::inputTag))
-        info.value = static_cast<HTMLInputElement*>(node)->value();
-    else if (node->shouldUseInputMethod())
-        info.value = node->nodeValue();
-    else
-        return info;
+    info.value = plainText(rangeOfContents(node).get());
 
     if (info.value.isEmpty())
         return info;
 
-    if (node->hasTagName(HTMLNames::textareaTag) || node->hasTagName(HTMLNames::inputTag)) {
-        HTMLTextFormControlElement* formElement = static_cast<HTMLTextFormControlElement*>(node);
-        info.selectionStart = formElement->selectionStart();
-        info.selectionEnd = formElement->selectionEnd();
-        if (editor->hasComposition()) {
-            info.compositionStart = formElement->indexForVisiblePosition(Position(editor->compositionNode(), editor->compositionStart()));
-            info.compositionEnd = formElement->indexForVisiblePosition(Position(editor->compositionNode(), editor->compositionEnd()));
-        }
-    } else {
-        info.selectionStart = selection->start().computeOffsetInContainerNode();
-        info.selectionEnd = selection->end().computeOffsetInContainerNode();
-        if (editor->hasComposition()) {
-            info.compositionStart = static_cast<int>(editor->compositionStart());
-            info.compositionEnd = static_cast<int>(editor->compositionEnd());
-        }
+    size_t location;
+    size_t length;
+    RefPtr<Range> range = selection->selection().firstRange();
+    if (range && TextIterator::getLocationAndLengthFromRange(selection->rootEditableElement(), range.get(), location, length)) {
+        info.selectionStart = location;
+        info.selectionEnd = location + length;
+    }
+    range = editor->compositionRange();
+    if (range && TextIterator::getLocationAndLengthFromRange(selection->rootEditableElement(), range.get(), location, length)) {
+        info.compositionStart = location;
+        info.compositionEnd = location + length;
     }
 
     return info;
@@ -2551,16 +2539,16 @@ void WebViewImpl::setDeviceScaleFactor(float scaleFactor)
 
     page()->setDeviceScaleFactor(scaleFactor);
 
+    if (!m_layerTreeView.isNull() && m_webSettings->applyDefaultDeviceScaleFactorInCompositor()) {
+        m_deviceScaleInCompositor = page()->deviceScaleFactor();
+        m_layerTreeView.setDeviceScaleFactor(m_deviceScaleInCompositor);
+    }
     if (m_deviceScaleInCompositor != 1) {
         // Don't allow page scaling when compositor scaling is being used,
         // as they are currently incompatible. This means the deviceScale
         // needs to match the one in the compositor.
         ASSERT(scaleFactor == m_deviceScaleInCompositor);
     }
-    if (!m_layerTreeView.isNull() && m_webSettings->applyDefaultDeviceScaleFactorInCompositor()) {
-        m_deviceScaleInCompositor = page()->deviceScaleFactor();
-        m_layerTreeView.setDeviceScaleFactor(m_deviceScaleInCompositor);
-    }
 }
 
 bool WebViewImpl::isFixedLayoutModeEnabled() const
diff --git a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
index aee7b1df4..80899919b 100644
--- a/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
+++ b/Source/WebKit/chromium/src/WebWorkerClientImpl.cpp
@@ -39,10 +39,13 @@
 #include "ErrorEvent.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
+#include "GroupSettings.h"
 #include "InspectorInstrumentation.h"
 #include "MessageEvent.h"
 #include "MessagePort.h"
 #include "MessagePortChannel.h"
+#include "Page.h"
+#include "PageGroup.h"
 #include "ScriptCallStack.h"
 #include "ScriptExecutionContext.h"
 #include "Worker.h"
@@ -86,7 +89,12 @@ WorkerContextProxy* WebWorkerClientImpl::createWorkerContextProxy(Worker* worker
 
 void WebWorkerClientImpl::startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerThreadStartMode startMode)
 {
-    RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, sourceCode, *this, *this, startMode,
+    ASSERT(m_scriptExecutionContext->isDocument());
+    Document* document = static_cast<Document*>(m_scriptExecutionContext.get());
+    GroupSettings* settings = 0;
+    if (document->page())
+        settings = document->page()->group().groupSettings();
+    RefPtr<DedicatedWorkerThread> thread = DedicatedWorkerThread::create(scriptURL, userAgent, settings, sourceCode, *this, *this, startMode,
                                                                          m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeader(),
                                                                          m_scriptExecutionContext->contentSecurityPolicy()->deprecatedHeaderType());
     m_proxy->workerThreadCreated(thread);
diff --git a/Source/WebKit/chromium/src/gtk/WebInputEventFactory.cpp b/Source/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
index 72db521d5..43c238a69 100644
--- a/Source/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
+++ b/Source/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
@@ -272,6 +272,39 @@ static int gdkEventToWindowsKeyCode(const GdkEventKey* event)
     return WebCore::windowsKeyCodeForKeyEvent(event->keyval);
 }
 
+// Normalizes event->state to make it Windows/Mac compatible. Since the way
+// of setting modifier mask on X is very different than Windows/Mac as shown
+// in http://crbug.com/127142#c8, the normalization is necessary.
+static guint normalizeEventState(const GdkEventKey* event)
+{
+    guint mask = 0;
+    switch (gdkEventToWindowsKeyCode(event)) {
+    case WebCore::VKEY_CONTROL:
+    case WebCore::VKEY_LCONTROL:
+    case WebCore::VKEY_RCONTROL:
+        mask = GDK_CONTROL_MASK;
+        break;
+    case WebCore::VKEY_SHIFT:
+    case WebCore::VKEY_LSHIFT:
+    case WebCore::VKEY_RSHIFT:
+        mask = GDK_SHIFT_MASK;
+        break;
+    case WebCore::VKEY_MENU:
+    case WebCore::VKEY_LMENU:
+    case WebCore::VKEY_RMENU:
+        mask = GDK_MOD1_MASK;
+        break;
+    case WebCore::VKEY_CAPITAL:
+        mask = GDK_LOCK_MASK;
+        break;
+    default:
+        return event->state;
+    }
+    if (event->type == GDK_KEY_PRESS)
+        return event->state | mask;
+    return event->state & ~mask;
+}
+
 // Gets the corresponding control character of a specified key code. See:
 // http://en.wikipedia.org/wiki/Control_characters
 // We emulate Windows behavior here.
@@ -325,7 +358,7 @@ WebKeyboardEvent WebInputEventFactory::keyboardEvent(const GdkEventKey* event)
     WebKeyboardEvent result;
 
     result.timeStampSeconds = gdkEventTimeToWebEventTime(event->time);
-    result.modifiers = gdkStateToWebEventModifiers(event->state);
+    result.modifiers = gdkStateToWebEventModifiers(normalizeEventState(event));
 
     switch (event->type) {
     case GDK_KEY_RELEASE:
diff --git a/Source/WebKit/chromium/src/js/Tests.js b/Source/WebKit/chromium/src/js/Tests.js
index f7e3810c5..68c6742cc 100644
--- a/Source/WebKit/chromium/src/js/Tests.js
+++ b/Source/WebKit/chromium/src/js/Tests.js
@@ -649,7 +649,7 @@ TestSuite.prototype.nonAnonymousUISourceCodes_ = function()
         return !!uiSourceCode.url;
     }
 
-    var uiSourceCodes = WebInspector.panels.scripts._uiSourceCodeProvider.uiSourceCodes();
+    var uiSourceCodes = WebInspector.workspace.uiSourceCodes();
     return uiSourceCodes.filter(filterOutAnonymous);
 };
 
diff --git a/Source/WebKit/chromium/src/linux/WebFontRendering.cpp b/Source/WebKit/chromium/src/linux/WebFontRendering.cpp
index 7dc98e667..67d5c2b54 100644
--- a/Source/WebKit/chromium/src/linux/WebFontRendering.cpp
+++ b/Source/WebKit/chromium/src/linux/WebFontRendering.cpp
@@ -33,7 +33,7 @@
 
 #include "FontPlatformData.h"
 
-#if OS(LINUX)
+#if OS(LINUX) && !OS(ANDROID)
 #include "WebFontInfo.h"
 #endif
 
@@ -75,7 +75,7 @@ void WebFontRendering::setSubpixelRendering(bool useSubpixelRendering)
 void WebFontRendering::setSubpixelPositioning(bool useSubpixelPositioning)
 {
     FontPlatformData::setSubpixelPositioning(useSubpixelPositioning);
-#if OS(LINUX)
+#if OS(LINUX) && !OS(ANDROID)
     WebFontInfo::setSubpixelPositioning(useSubpixelPositioning);
 #endif
 }
diff --git a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
index 01f943a64..262fcf76f 100644
--- a/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerImplTest.cpp
@@ -97,7 +97,7 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     IntPoint arbitraryIntPoint = IntPoint(333, 444);
     IntRect arbitraryIntRect = IntRect(arbitraryIntPoint, arbitraryIntSize);
     FloatRect arbitraryFloatRect = FloatRect(arbitraryFloatPoint, FloatSize(1.234f, 5.678f));
-    Color arbitraryColor = Color(10, 20, 30);
+    SkColor arbitraryColor = SkColorSetRGB(10, 20, 30);
     WebTransformationMatrix arbitraryTransform;
     arbitraryTransform.scale3d(0.1, 0.2, 0.3);
     WebFilterOperations arbitraryFilters;
@@ -124,7 +124,7 @@ TEST(CCLayerImplTest, verifyLayerChangesAreTrackedProperly)
     EXECUTE_AND_VERIFY_ONLY_LAYER_CHANGED(root->setDebugBorderColor(arbitraryColor));
     EXECUTE_AND_VERIFY_ONLY_LAYER_CHANGED(root->setDebugBorderWidth(arbitraryNumber));
     EXECUTE_AND_VERIFY_ONLY_LAYER_CHANGED(root->setDrawsContent(true));
-    EXECUTE_AND_VERIFY_ONLY_LAYER_CHANGED(root->setBackgroundColor(Color::gray));
+    EXECUTE_AND_VERIFY_ONLY_LAYER_CHANGED(root->setBackgroundColor(SK_ColorGRAY));
     EXECUTE_AND_VERIFY_ONLY_LAYER_CHANGED(root->setBackgroundFilters(arbitraryFilters));
 
     // Changing these properties only affects how render surface is drawn
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
index 78448a517..73f1eb974 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostCommonTest.cpp
@@ -2183,7 +2183,11 @@ TEST(CCLayerTreeHostCommonTest, verifyAnimationsForRenderSurfaceHierarchy)
     childOfRS1->addChild(grandChildOfRS1);
     childOfRS2->addChild(grandChildOfRS2);
 
-    // In combination with descendantDrawsContent, opacity != 1 forces the layer to have a new renderSurface.
+    // Make our render surfaces.
+    renderSurface1->setForceRenderSurface(true);
+    renderSurface2->setForceRenderSurface(true);
+
+    // Put an animated opacity on the render surface.
     addOpacityTransitionToController(*renderSurface1->layerAnimationController(), 10, 1, 0, false);
 
     // Also put an animated opacity on a layer without descendants.
@@ -2194,9 +2198,8 @@ TEST(CCLayerTreeHostCommonTest, verifyAnimationsForRenderSurfaceHierarchy)
     WebTransformationMatrix sublayerTransform;
     sublayerTransform.scale3d(10.0, 1.0, 1.0);
 
-    // In combination with descendantDrawsContent and masksToBounds, an animated transform forces the layer to have a new renderSurface.
+    // Put a transform animation on the render surface.
     addAnimatedTransformToController(*renderSurface2->layerAnimationController(), 10, 30, 0);
-    renderSurface2->setMasksToBounds(true);
 
     // Also put transform animations on grandChildOfRoot, and grandChildOfRS2
     addAnimatedTransformToController(*grandChildOfRoot->layerAnimationController(), 10, 30, 0);
@@ -2793,9 +2796,11 @@ TEST(CCLayerTreeHostCommonTest, verifyBackFaceCullingWithAnimatingTransforms)
     backfaceMatrix.rotate3d(0, 1, 0, 180);
     backfaceMatrix.translate(-50, -50);
 
-    // Having a descendant that draws, masksToBounds, and animating transforms, will make the animatingSurface own a render surface.
+    // Make our render surface.
+    animatingSurface->setForceRenderSurface(true);
+
+    // Animate the transform on the render surface.
     addAnimatedTransformToController(*animatingSurface->layerAnimationController(), 10, 30, 0);
-    animatingSurface->setMasksToBounds(true);
     // This is just an animating layer, not a surface.
     addAnimatedTransformToController(*animatingChild->layerAnimationController(), 10, 30, 0);
 
@@ -3667,7 +3672,7 @@ class MockContentLayerDelegate : public ContentLayerDelegate {
 public:
     MockContentLayerDelegate() { }
     virtual ~MockContentLayerDelegate() { }
-    virtual void paintContents(SkCanvas*, const IntRect& clip, IntRect& opaque) { }
+    virtual void paintContents(SkCanvas*, const IntRect& clip, FloatRect& opaque) OVERRIDE { }
 };
 
 PassRefPtr<ContentLayerChromium> createDrawableContentLayerChromium(ContentLayerDelegate* delegate)
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
index 34846b7c2..fbede6ced 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostImplTest.cpp
@@ -127,11 +127,11 @@ public:
 
     void setupScrollAndContentsLayers(const IntSize& contentSize)
     {
-        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
         root->setScrollable(true);
         root->setScrollPosition(IntPoint(0, 0));
         root->setMaxScrollPosition(contentSize);
-        OwnPtr<CCLayerImpl> contents = CCLayerImpl::create(1);
+        OwnPtr<CCLayerImpl> contents = CCLayerImpl::create(2);
         contents->setDrawsContent(true);
         contents->setBounds(contentSize);
         contents->setContentBounds(contentSize);
@@ -186,12 +186,12 @@ TEST_F(CCLayerTreeHostImplTest, scrollDeltaNoLayers)
 TEST_F(CCLayerTreeHostImplTest, scrollDeltaTreeButNoChanges)
 {
     {
-        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-        root->addChild(CCLayerImpl::create(1));
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
         root->addChild(CCLayerImpl::create(2));
-        root->children()[1]->addChild(CCLayerImpl::create(3));
+        root->addChild(CCLayerImpl::create(3));
         root->children()[1]->addChild(CCLayerImpl::create(4));
-        root->children()[1]->children()[0]->addChild(CCLayerImpl::create(5));
+        root->children()[1]->addChild(CCLayerImpl::create(5));
+        root->children()[1]->children()[0]->addChild(CCLayerImpl::create(6));
         m_hostImpl->setRootLayer(root.release());
     }
     CCLayerImpl* root = m_hostImpl->rootLayer();
@@ -214,7 +214,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollDeltaRepeatedScrolls)
     IntPoint scrollPosition(20, 30);
     IntSize scrollDelta(11, -15);
     {
-        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(10);
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
         root->setScrollPosition(scrollPosition);
         root->setScrollable(true);
         root->setMaxScrollPosition(IntSize(100, 100));
@@ -263,7 +263,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollWithoutRootLayer)
 
 TEST_F(CCLayerTreeHostImplTest, replaceTreeWhileScrolling)
 {
-    const int scrollLayerId = 0;
+    const int scrollLayerId = 1;
 
     setupScrollAndContentsLayers(IntSize(100, 100));
     m_hostImpl->setViewportSize(IntSize(50, 50));
@@ -625,8 +625,10 @@ protected:
         setContentBounds(IntSize(10, 10));
         setDrawsContent(true);
         setSkipsDraw(false);
+        setVisibleLayerRect(IntRect(0, 0, 10, 10));
 
         OwnPtr<CCLayerTilingData> tiler = CCLayerTilingData::create(IntSize(100, 100), CCLayerTilingData::HasBorderTexels);
+        tiler->setBounds(contentBounds());
         setTilingData(*tiler.get());
     }
 
@@ -639,11 +641,11 @@ TEST_F(CCLayerTreeHostImplTest, didDrawNotCalledOnHiddenLayer)
 {
     // The root layer is always drawn, so run this test on a child layer that
     // will be masked out by the root layer's bounds.
-    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
     root->setMasksToBounds(true);
 
-    root->addChild(DidDrawCheckLayer::create(1));
+    root->addChild(DidDrawCheckLayer::create(2));
     DidDrawCheckLayer* layer = static_cast<DidDrawCheckLayer*>(root->children()[0].get());
     // Ensure visibleLayerRect for layer is empty
     layer->setPosition(FloatPoint(100, 100));
@@ -686,13 +688,13 @@ TEST_F(CCLayerTreeHostImplTest, willDrawNotCalledOnOccludedLayer)
     IntSize bigSize(1000, 1000);
     m_hostImpl->setViewportSize(bigSize);
 
-    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
 
-    root->addChild(DidDrawCheckLayer::create(1));
+    root->addChild(DidDrawCheckLayer::create(2));
     DidDrawCheckLayer* occludedLayer = static_cast<DidDrawCheckLayer*>(root->children()[0].get());
 
-    root->addChild(DidDrawCheckLayer::create(2));
+    root->addChild(DidDrawCheckLayer::create(3));
     DidDrawCheckLayer* topLayer = static_cast<DidDrawCheckLayer*>(root->children()[1].get());
     // This layer covers the occludedLayer above. Make this layer large so it can occlude.
     topLayer->setBounds(bigSize);
@@ -718,13 +720,13 @@ TEST_F(CCLayerTreeHostImplTest, willDrawNotCalledOnOccludedLayer)
 
 TEST_F(CCLayerTreeHostImplTest, didDrawCalledOnAllLayers)
 {
-    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
 
-    root->addChild(DidDrawCheckLayer::create(1));
+    root->addChild(DidDrawCheckLayer::create(2));
     DidDrawCheckLayer* layer1 = static_cast<DidDrawCheckLayer*>(root->children()[0].get());
 
-    layer1->addChild(DidDrawCheckLayer::create(2));
+    layer1->addChild(DidDrawCheckLayer::create(3));
     DidDrawCheckLayer* layer2 = static_cast<DidDrawCheckLayer*>(layer1->children()[0].get());
 
     layer1->setOpacity(0.3f);
@@ -769,9 +771,9 @@ private:
 TEST_F(CCLayerTreeHostImplTest, prepareToDrawFailsWhenAnimationUsesCheckerboard)
 {
     // When the texture is not missing, we draw as usual.
-    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     DidDrawCheckLayer* root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
-    root->addChild(MissingTextureAnimatingLayer::create(1, false, false, true));
+    root->addChild(MissingTextureAnimatingLayer::create(2, false, false, true));
 
     CCLayerTreeHostImpl::FrameData frame;
 
@@ -780,27 +782,27 @@ TEST_F(CCLayerTreeHostImplTest, prepareToDrawFailsWhenAnimationUsesCheckerboard)
     m_hostImpl->didDrawAllLayers(frame);
 
     // When a texture is missing and we're not animating, we draw as usual with checkerboarding.
-    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
-    root->addChild(MissingTextureAnimatingLayer::create(1, true, false, false));
+    root->addChild(MissingTextureAnimatingLayer::create(2, true, false, false));
 
     EXPECT_TRUE(m_hostImpl->prepareToDraw(frame));
     m_hostImpl->drawLayers(frame);
     m_hostImpl->didDrawAllLayers(frame);
 
     // When a texture is missing and we're animating, we don't want to draw anything.
-    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
-    root->addChild(MissingTextureAnimatingLayer::create(1, true, false, true));
+    root->addChild(MissingTextureAnimatingLayer::create(2, true, false, true));
 
     EXPECT_FALSE(m_hostImpl->prepareToDraw(frame));
     m_hostImpl->drawLayers(frame);
     m_hostImpl->didDrawAllLayers(frame);
 
     // When the layer skips draw and we're animating, we still draw the frame.
-    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(0));
+    m_hostImpl->setRootLayer(DidDrawCheckLayer::create(1));
     root = static_cast<DidDrawCheckLayer*>(m_hostImpl->rootLayer());
-    root->addChild(MissingTextureAnimatingLayer::create(1, false, true, true));
+    root->addChild(MissingTextureAnimatingLayer::create(2, false, true, true));
 
     EXPECT_TRUE(m_hostImpl->prepareToDraw(frame));
     m_hostImpl->drawLayers(frame);
@@ -809,7 +811,7 @@ TEST_F(CCLayerTreeHostImplTest, prepareToDrawFailsWhenAnimationUsesCheckerboard)
 
 TEST_F(CCLayerTreeHostImplTest, scrollRootIgnored)
 {
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     root->setScrollable(false);
     m_hostImpl->setRootLayer(root.release());
     initializeLayerRendererAndDrawFrame();
@@ -833,7 +835,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollNonCompositedRoot)
     contentLayer->setBounds(surfaceSize);
     contentLayer->setContentBounds(IntSize(surfaceSize.width() * 2, surfaceSize.height() * 2));
 
-    OwnPtr<CCLayerImpl> scrollLayer = CCLayerImpl::create(0);
+    OwnPtr<CCLayerImpl> scrollLayer = CCLayerImpl::create(2);
     scrollLayer->setScrollable(true);
     scrollLayer->setMaxScrollPosition(surfaceSize);
     scrollLayer->addChild(contentLayer.release());
@@ -852,8 +854,8 @@ TEST_F(CCLayerTreeHostImplTest, scrollNonCompositedRoot)
 TEST_F(CCLayerTreeHostImplTest, scrollChildCallsCommitAndRedraw)
 {
     IntSize surfaceSize(10, 10);
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-    root->addChild(createScrollableLayer(1, FloatPoint(5, 5), surfaceSize));
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    root->addChild(createScrollableLayer(2, FloatPoint(5, 5), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
     m_hostImpl->setViewportSize(surfaceSize);
     initializeLayerRendererAndDrawFrame();
@@ -868,8 +870,8 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildCallsCommitAndRedraw)
 TEST_F(CCLayerTreeHostImplTest, scrollMissesChild)
 {
     IntSize surfaceSize(10, 10);
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-    root->addChild(createScrollableLayer(1, FloatPoint(5, 5), surfaceSize));
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    root->addChild(createScrollableLayer(2, FloatPoint(5, 5), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
     m_hostImpl->setViewportSize(surfaceSize);
     initializeLayerRendererAndDrawFrame();
@@ -883,8 +885,8 @@ TEST_F(CCLayerTreeHostImplTest, scrollMissesChild)
 TEST_F(CCLayerTreeHostImplTest, scrollMissesBackfacingChild)
 {
     IntSize surfaceSize(10, 10);
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
-    OwnPtr<CCLayerImpl> child = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
+    OwnPtr<CCLayerImpl> child = createScrollableLayer(2, FloatPoint(5, 5), surfaceSize);
     m_hostImpl->setViewportSize(surfaceSize);
 
     WebTransformationMatrix matrix;
@@ -906,11 +908,11 @@ TEST_F(CCLayerTreeHostImplTest, scrollMissesBackfacingChild)
 TEST_F(CCLayerTreeHostImplTest, scrollBlockedByContentLayer)
 {
     IntSize surfaceSize(10, 10);
-    OwnPtr<CCLayerImpl> contentLayer = createScrollableLayer(0, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> contentLayer = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
     contentLayer->setShouldScrollOnMainThread(true);
     contentLayer->setScrollable(false);
 
-    OwnPtr<CCLayerImpl> scrollLayer = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> scrollLayer = createScrollableLayer(2, FloatPoint(5, 5), surfaceSize);
     scrollLayer->addChild(contentLayer.release());
 
     m_hostImpl->setRootLayer(scrollLayer.release());
@@ -925,7 +927,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnMainThread)
 {
     IntSize surfaceSize(10, 10);
     float pageScale = 2;
-    OwnPtr<CCLayerImpl> root = createScrollableLayer(0, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
     m_hostImpl->setRootLayer(root.release());
     m_hostImpl->setViewportSize(surfaceSize);
     initializeLayerRendererAndDrawFrame();
@@ -943,7 +945,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnMainThread)
     // The scale should apply to the scroll delta.
     expectedScrollDelta.scale(pageScale);
     OwnPtr<CCScrollAndScaleSet> scrollInfo = m_hostImpl->processScrollDeltas();
-    expectContains(*scrollInfo.get(), 0, expectedScrollDelta);
+    expectContains(*scrollInfo.get(), m_hostImpl->rootLayer()->id(), expectedScrollDelta);
 
     // The scroll range should also have been updated.
     EXPECT_EQ(m_hostImpl->rootLayer()->maxScrollPosition(), expectedMaxScroll);
@@ -956,7 +958,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnImplThread)
 {
     IntSize surfaceSize(10, 10);
     float pageScale = 2;
-    OwnPtr<CCLayerImpl> root = createScrollableLayer(0, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
     m_hostImpl->setRootLayer(root.release());
     m_hostImpl->setViewportSize(surfaceSize);
     m_hostImpl->setPageScaleFactorAndLimits(1, 1, pageScale);
@@ -976,7 +978,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnImplThread)
 
     // The scroll delta is not scaled because the main thread did not scale.
     OwnPtr<CCScrollAndScaleSet> scrollInfo = m_hostImpl->processScrollDeltas();
-    expectContains(*scrollInfo.get(), 0, expectedScrollDelta);
+    expectContains(*scrollInfo.get(), m_hostImpl->rootLayer()->id(), expectedScrollDelta);
 
     // The scroll range should also have been updated.
     EXPECT_EQ(m_hostImpl->rootLayer()->maxScrollPosition(), expectedMaxScroll);
@@ -988,10 +990,11 @@ TEST_F(CCLayerTreeHostImplTest, scrollRootAndChangePageScaleOnImplThread)
 TEST_F(CCLayerTreeHostImplTest, scrollChildAndChangePageScaleOnMainThread)
 {
     IntSize surfaceSize(10, 10);
-    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+    OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
     // Also mark the root scrollable so it becomes the root scroll layer.
     root->setScrollable(true);
-    root->addChild(createScrollableLayer(1, FloatPoint(5, 5), surfaceSize));
+    int scrollLayerId = 2;
+    root->addChild(createScrollableLayer(scrollLayerId, FloatPoint(5, 5), surfaceSize));
     m_hostImpl->setRootLayer(root.release());
     m_hostImpl->setViewportSize(surfaceSize);
     initializeLayerRendererAndDrawFrame();
@@ -1011,7 +1014,7 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildAndChangePageScaleOnMainThread)
     // The scale should apply to the scroll delta.
     expectedScrollDelta.scale(pageScale);
     OwnPtr<CCScrollAndScaleSet> scrollInfo = m_hostImpl->processScrollDeltas();
-    expectContains(*scrollInfo.get(), 1, expectedScrollDelta);
+    expectContains(*scrollInfo.get(), scrollLayerId, expectedScrollDelta);
 
     // The scroll range should not have changed.
     EXPECT_EQ(child->maxScrollPosition(), expectedMaxScroll);
@@ -1026,12 +1029,12 @@ TEST_F(CCLayerTreeHostImplTest, scrollChildBeyondLimit)
     // parent layer is scrolled on the axis on which the child was unable to
     // scroll.
     IntSize surfaceSize(10, 10);
-    OwnPtr<CCLayerImpl> root = createScrollableLayer(0, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
 
-    OwnPtr<CCLayerImpl> grandChild = createScrollableLayer(2, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> grandChild = createScrollableLayer(3, FloatPoint(5, 5), surfaceSize);
     grandChild->setScrollPosition(IntPoint(0, 5));
 
-    OwnPtr<CCLayerImpl> child = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> child = createScrollableLayer(2, FloatPoint(5, 5), surfaceSize);
     child->setScrollPosition(IntPoint(3, 0));
     child->addChild(grandChild.release());
 
@@ -1062,8 +1065,8 @@ TEST_F(CCLayerTreeHostImplTest, scrollEventBubbling)
     // When we try to scroll a non-scrollable child layer, the scroll delta
     // should be applied to one of its ancestors if possible.
     IntSize surfaceSize(10, 10);
-    OwnPtr<CCLayerImpl> root = createScrollableLayer(0, FloatPoint(5, 5), surfaceSize);
-    OwnPtr<CCLayerImpl> child = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> root = createScrollableLayer(1, FloatPoint(5, 5), surfaceSize);
+    OwnPtr<CCLayerImpl> child = createScrollableLayer(2, FloatPoint(5, 5), surfaceSize);
 
     child->setScrollable(false);
     root->addChild(child.release());
@@ -1088,13 +1091,13 @@ TEST_F(CCLayerTreeHostImplTest, scrollEventBubbling)
 TEST_F(CCLayerTreeHostImplTest, scrollBeforeRedraw)
 {
     IntSize surfaceSize(10, 10);
-    m_hostImpl->setRootLayer(createScrollableLayer(0, FloatPoint(5, 5), surfaceSize));
+    m_hostImpl->setRootLayer(createScrollableLayer(1, FloatPoint(5, 5), surfaceSize));
     m_hostImpl->setViewportSize(surfaceSize);
 
     // Draw one frame and then immediately rebuild the layer tree to mimic a tree synchronization.
     initializeLayerRendererAndDrawFrame();
     m_hostImpl->detachLayerTree();
-    m_hostImpl->setRootLayer(createScrollableLayer(0, FloatPoint(5, 5), surfaceSize));
+    m_hostImpl->setRootLayer(createScrollableLayer(2, FloatPoint(5, 5), surfaceSize));
 
     // Scrolling should still work even though we did not draw yet.
     EXPECT_EQ(m_hostImpl->scrollBegin(IntPoint(5, 5), CCInputHandlerClient::Wheel), CCInputHandlerClient::ScrollStarted);
@@ -1186,7 +1189,7 @@ TEST_F(CCLayerTreeHostImplTest, blendingOffWhenDrawingOpaqueLayers)
 {
 
     {
-        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(0);
+        OwnPtr<CCLayerImpl> root = CCLayerImpl::create(1);
         root->setAnchorPoint(FloatPoint(0, 0));
         root->setBounds(IntSize(10, 10));
         root->setContentBounds(root->bounds());
@@ -1195,7 +1198,7 @@ TEST_F(CCLayerTreeHostImplTest, blendingOffWhenDrawingOpaqueLayers)
     }
     CCLayerImpl* root = m_hostImpl->rootLayer();
 
-    root->addChild(BlendStateCheckLayer::create(1));
+    root->addChild(BlendStateCheckLayer::create(2));
     BlendStateCheckLayer* layer1 = static_cast<BlendStateCheckLayer*>(root->children()[0].get());
 
     CCLayerTreeHostImpl::FrameData frame;
@@ -1247,7 +1250,7 @@ TEST_F(CCLayerTreeHostImplTest, blendingOffWhenDrawingOpaqueLayers)
     EXPECT_TRUE(layer1->quadsAppended());
     m_hostImpl->didDrawAllLayers(frame);
 
-    layer1->addChild(BlendStateCheckLayer::create(2));
+    layer1->addChild(BlendStateCheckLayer::create(3));
     BlendStateCheckLayer* layer2 = static_cast<BlendStateCheckLayer*>(layer1->children()[0].get());
 
     // 2 opaque layers, drawn without blending.
@@ -1402,12 +1405,12 @@ TEST_F(CCLayerTreeHostImplTest, blendingOffWhenDrawingOpaqueLayers)
 TEST_F(CCLayerTreeHostImplTest, viewportCovered)
 {
     m_hostImpl->initializeLayerRenderer(createContext(), UnthrottledUploader);
-    m_hostImpl->setBackgroundColor(Color::gray);
+    m_hostImpl->setBackgroundColor(SK_ColorGRAY);
 
     IntSize viewportSize(1000, 1000);
     m_hostImpl->setViewportSize(viewportSize);
 
-    m_hostImpl->setRootLayer(BlendStateCheckLayer::create(0));
+    m_hostImpl->setRootLayer(BlendStateCheckLayer::create(1));
     BlendStateCheckLayer* root = static_cast<BlendStateCheckLayer*>(m_hostImpl->rootLayer());
     root->setExpectation(false, true);
     root->setOpaque(true);
@@ -1631,7 +1634,7 @@ public:
 
     virtual void appendQuads(CCQuadCuller& quadList, const CCSharedQuadState* sharedQuadState, bool&) OVERRIDE
     {
-        const Color gray(100, 100, 100);
+        SkColor gray = SkColorSetRGB(100, 100, 100);
         IntRect quadRect(0, 0, 5, 5);
         OwnPtr<CCDrawQuad> myQuad = CCSolidColorDrawQuad::create(sharedQuadState, quadRect, gray);
         quadList.append(myQuad.release());
@@ -1997,7 +2000,7 @@ private:
 
 TEST_F(CCLayerTreeHostImplTest, contextLostAndRestoredNotificationSentToAllLayers)
 {
-    m_hostImpl->setRootLayer(ContextLostNotificationCheckLayer::create(0));
+    m_hostImpl->setRootLayer(ContextLostNotificationCheckLayer::create(1));
     ContextLostNotificationCheckLayer* root = static_cast<ContextLostNotificationCheckLayer*>(m_hostImpl->rootLayer());
 
     root->addChild(ContextLostNotificationCheckLayer::create(1));
@@ -2200,11 +2203,11 @@ public:
 
 TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
 {
-    OwnPtr<CCLayerImpl> rootLayer(CCLayerImpl::create(0));
+    OwnPtr<CCLayerImpl> rootLayer(CCLayerImpl::create(1));
     rootLayer->setBounds(IntSize(10, 10));
     rootLayer->setAnchorPoint(FloatPoint(0, 0));
 
-    OwnPtr<CCTiledLayerImpl> tileLayer = CCTiledLayerImpl::create(1);
+    OwnPtr<CCTiledLayerImpl> tileLayer = CCTiledLayerImpl::create(2);
     tileLayer->setBounds(IntSize(10, 10));
     tileLayer->setAnchorPoint(FloatPoint(0, 0));
     tileLayer->setContentBounds(IntSize(10, 10));
@@ -2216,7 +2219,7 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     tileLayer->pushTileProperties(0, 0, 1, IntRect(0, 0, 10, 10));
     rootLayer->addChild(tileLayer.release());
 
-    OwnPtr<CCTextureLayerImpl> textureLayer = CCTextureLayerImpl::create(2);
+    OwnPtr<CCTextureLayerImpl> textureLayer = CCTextureLayerImpl::create(3);
     textureLayer->setBounds(IntSize(10, 10));
     textureLayer->setAnchorPoint(FloatPoint(0, 0));
     textureLayer->setContentBounds(IntSize(10, 10));
@@ -2225,7 +2228,7 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     rootLayer->addChild(textureLayer.release());
 
     FakeVideoFrameProvider provider;
-    OwnPtr<CCVideoLayerImpl> videoLayer = CCVideoLayerImpl::create(3, &provider);
+    OwnPtr<CCVideoLayerImpl> videoLayer = CCVideoLayerImpl::create(4, &provider);
     videoLayer->setBounds(IntSize(10, 10));
     videoLayer->setAnchorPoint(FloatPoint(0, 0));
     videoLayer->setContentBounds(IntSize(10, 10));
@@ -2233,7 +2236,7 @@ TEST_F(CCLayerTreeHostImplTest, dontUseOldResourcesAfterLostContext)
     videoLayer->setLayerTreeHostImpl(m_hostImpl.get());
     rootLayer->addChild(videoLayer.release());
 
-    OwnPtr<CCIOSurfaceLayerImpl> ioSurfaceLayer = CCIOSurfaceLayerImpl::create(4);
+    OwnPtr<CCIOSurfaceLayerImpl> ioSurfaceLayer = CCIOSurfaceLayerImpl::create(5);
     ioSurfaceLayer->setBounds(IntSize(10, 10));
     ioSurfaceLayer->setAnchorPoint(FloatPoint(0, 0));
     ioSurfaceLayer->setContentBounds(IntSize(10, 10));
@@ -2364,8 +2367,6 @@ TEST_F(CCLayerTreeHostImplTest, layersFreeTextures)
 
     // Kill the layer tree.
     m_hostImpl->setRootLayer(CCLayerImpl::create(100));
-    // FIXME: Remove this when we don't use ManagedTextures in impl layers.
-    m_hostImpl->layerRenderer()->implTextureManager()->deleteEvictedTextures(m_hostImpl->layerRenderer()->implTextureAllocator());
     // There should be no textures left in use after.
     EXPECT_EQ(0u, trackingWebGraphicsContext->numTextures());
 }
@@ -2383,7 +2384,7 @@ TEST_F(CCLayerTreeHostImplTest, hasTransparentBackground)
 
     // Run test case
     OwnPtr<CCLayerTreeHostImpl> myHostImpl = createLayerTreeHost(false, context.release(), CCLayerImpl::create(1));
-    myHostImpl->setBackgroundColor(Color::white);
+    myHostImpl->setBackgroundColor(SK_ColorWHITE);
 
     // Verify one quad is drawn when transparent background set is not set.
     myHostImpl->setHasTransparentBackground(false);
@@ -2465,6 +2466,11 @@ static void setupLayersForTextureCaching(CCLayerTreeHostImpl* layerTreeHostImpl,
     surfaceLayerPtr->addChild(child.release());
 }
 
+class LayerRendererChromiumWithReleaseTextures : public LayerRendererChromium {
+public:
+    using LayerRendererChromium::releaseRenderPassTextures;
+};
+
 TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
 {
     CCSettings::setPartialSwapEnabled(true);
@@ -2548,22 +2554,9 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         myHostImpl->didDrawAllLayers(frame);
     }
 
-    // Change opacity again, but evict the cached surface texture
+    // Change opacity again, and evict the cached surface texture.
     surfaceLayerPtr->setOpacity(0.5f);
-    ManagedTexture* contentsTexture = surfaceLayerPtr->renderSurface()->contentsTexture();
-    ASSERT_TRUE(contentsTexture->isValid(contentsTexture->size(), contentsTexture->format()));
-    CCRenderer* renderer = myHostImpl->layerRenderer();
-    TextureManager* textureManager = renderer->implTextureManager();
-    size_t maxMemoryLimit = textureManager->maxMemoryLimitBytes();
-
-    // This should evice all cached surfaces
-    textureManager->setMaxMemoryLimitBytes(0);
-
-    // Restore original limit
-    textureManager->setMaxMemoryLimitBytes(maxMemoryLimit);
-
-    // Was our surface evicted?
-    ASSERT_FALSE(contentsTexture->isValid(contentsTexture->size(), contentsTexture->format()));
+    static_cast<LayerRendererChromiumWithReleaseTextures*>(myHostImpl->layerRenderer())->releaseRenderPassTextures();
 
     // Change opacity and draw
     surfaceLayerPtr->setOpacity(0.6f);
@@ -2583,6 +2576,9 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCaching)
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         EXPECT_FALSE(quad->renderPass()->targetSurface()->contentsChanged());
 
+        // Was our surface evicted?
+        EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(quad->renderPass()->id()));
+
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
     }
@@ -2706,22 +2702,9 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         myHostImpl->didDrawAllLayers(frame);
     }
 
-    // Change opacity again, but evict the cached surface texture
+    // Change opacity again, and evict the cached surface texture.
     surfaceLayerPtr->setOpacity(0.5f);
-    ManagedTexture* contentsTexture = surfaceLayerPtr->renderSurface()->contentsTexture();
-    ASSERT_TRUE(contentsTexture->isValid(contentsTexture->size(), contentsTexture->format()));
-    CCRenderer* renderer = myHostImpl->layerRenderer();
-    TextureManager* textureManager = renderer->implTextureManager();
-    size_t maxMemoryLimit = textureManager->maxMemoryLimitBytes();
-
-    // This should evice all cached surfaces
-    textureManager->setMaxMemoryLimitBytes(0);
-
-    // Restore original limit
-    textureManager->setMaxMemoryLimitBytes(maxMemoryLimit);
-
-    // Was our surface evicted?
-    ASSERT_FALSE(contentsTexture->isValid(contentsTexture->size(), contentsTexture->format()));
+    static_cast<LayerRendererChromiumWithReleaseTextures*>(myHostImpl->layerRenderer())->releaseRenderPassTextures();
 
     // Change opacity and draw
     surfaceLayerPtr->setOpacity(0.6f);
@@ -2741,6 +2724,9 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingNoPartialSwap)
         CCRenderPassDrawQuad* quad = static_cast<CCRenderPassDrawQuad*>(frame.renderPasses[1]->quadList()[0].get());
         EXPECT_FALSE(quad->renderPass()->targetSurface()->contentsChanged());
 
+        // Was our surface evicted?
+        EXPECT_FALSE(myHostImpl->layerRenderer()->haveCachedResourcesForRenderPassId(quad->renderPass()->id()));
+
         myHostImpl->drawLayers(frame);
         myHostImpl->didDrawAllLayers(frame);
     }
@@ -2855,6 +2841,12 @@ TEST_F(CCLayerTreeHostImplTest, surfaceTextureCachingMemoryLimit)
     }
 }
 
+TEST_F(CCLayerTreeHostImplTest, releaseContentsTextureShouldTriggerCommit)
+{
+    m_hostImpl->releaseContentsTextures();
+    EXPECT_TRUE(m_didRequestCommit);
+}
+
 struct RenderPassCacheEntry {
     mutable OwnPtr<CCRenderPass> renderPassPtr;
     CCRenderPass* renderPass;
@@ -2883,8 +2875,7 @@ struct RenderPassCacheEntry {
     }
 };
 
-struct RenderPassRemovalTestData {
-    CCRenderPassList renderPassList;
+struct RenderPassRemovalTestData : public CCLayerTreeHostImpl::FrameData {
     std::map<char, RenderPassCacheEntry> renderPassCache;
     std::map<const CCRenderPass*, char> renderPassId;
     Vector<OwnPtr<CCRenderSurface> > renderSurfaceStore;
@@ -2892,87 +2883,76 @@ struct RenderPassRemovalTestData {
     OwnPtr<CCSharedQuadState> sharedQuadState;
 };
 
-class FakeRenderSurface : public CCRenderSurface {
-private:
-    bool m_hasCachedTexture;
-    bool m_contentsChanged;
-
+class CCTestRenderPass: public CCRenderPass {
 public:
-    FakeRenderSurface(CCLayerImpl* layerImpl)
-        : CCRenderSurface(layerImpl),
-          m_hasCachedTexture(false)
-    {
-    }
+    static PassOwnPtr<CCRenderPass> create(CCRenderSurface* targetSurface, int id) { return adoptPtr(new CCTestRenderPass(targetSurface, id)); }
 
-    virtual bool hasCachedContentsTexture() const OVERRIDE
-    {
-        return m_hasCachedTexture;
-    }
+    void appendQuad(PassOwnPtr<CCDrawQuad> quad) { m_quadList.append(quad); }
 
-    virtual bool prepareContentsTexture(LayerRendererChromium* lrc) OVERRIDE
-    {
-        return true;
-    }
+protected:
+    CCTestRenderPass(CCRenderSurface* targetSurface, int id) : CCRenderPass(targetSurface, id) { }
+};
 
-    virtual bool contentsChanged() const OVERRIDE
+class CCTestRenderer : public LayerRendererChromium, public CCRendererClient {
+public:
+    static PassOwnPtr<CCTestRenderer> create(WebKit::WebGraphicsContext3D* context)
     {
-        return m_contentsChanged;
-    }
+        OwnPtr<CCTestRenderer> renderer(adoptPtr(new CCTestRenderer(context)));
+        if (!renderer->initialize())
+            return nullptr;
 
-    void setHasCachedTexture(bool hasCachedTexture)
-    {
-        m_hasCachedTexture = hasCachedTexture;
+        return renderer.release();
     }
 
-    void setContentsChanged(bool contentsChanged)
-    {
-        m_contentsChanged = contentsChanged;
-    }
-};
+    void clearCachedTextures() { m_textures.clear(); }
+    void setHaveCachedResourcesForRenderPassId(int id) { m_textures.add(id); }
 
-class CCTestRenderPass: public CCRenderPass {
-public:
-    static PassOwnPtr<CCRenderPass> create(CCRenderSurface* targetSurface)
-    {
-        return adoptPtr(new CCTestRenderPass(targetSurface));
-    }
+    virtual bool haveCachedResourcesForRenderPassId(int id) const OVERRIDE { return m_textures.contains(id); }
+
+    // CCRendererClient implementation.
+    virtual const IntSize& deviceViewportSize() const OVERRIDE { return m_viewportSize; }
+    virtual const CCLayerTreeSettings& settings() const OVERRIDE { return m_settings; }
+    virtual void didLoseContext() OVERRIDE { }
+    virtual void onSwapBuffersComplete() OVERRIDE { }
+    virtual void setFullRootLayerDamage() OVERRIDE { }
+    virtual void releaseContentsTextures() OVERRIDE { }
+    virtual void setMemoryAllocationLimitBytes(size_t) OVERRIDE { }
 
 protected:
-    CCTestRenderPass(CCRenderSurface* surface)
-        : CCRenderPass(surface)
-    {
-    }
+    CCTestRenderer(WebKit::WebGraphicsContext3D* context) : LayerRendererChromium(this, context, UnthrottledUploader) { }
 
-public:
-    void appendQuad(PassOwnPtr<CCDrawQuad> quad)
-    {
-        m_quadList.append(quad);
-    }
+private:
+    CCLayerTreeSettings m_settings;
+    IntSize m_viewportSize;
+    HashSet<int> m_textures;
 };
 
-static PassOwnPtr<CCRenderPass> createDummyRenderPass(RenderPassRemovalTestData& testData)
+static PassOwnPtr<CCRenderPass> createDummyRenderPass(RenderPassRemovalTestData& testData, int id)
 {
-    OwnPtr<CCLayerImpl> layerImpl = CCLayerImpl::create(1);
-    CCRenderSurface* renderSurface = new FakeRenderSurface(layerImpl.get());
-    OwnPtr<CCRenderPass> renderPassPtr = CCTestRenderPass::create(renderSurface);
+    OwnPtr<CCLayerImpl> layerImpl(CCLayerImpl::create(id));
+    OwnPtr<CCRenderSurface> renderSurface(adoptPtr(new CCRenderSurface(layerImpl.get())));
+    OwnPtr<CCRenderPass> renderPassPtr(CCTestRenderPass::create(renderSurface.get(), layerImpl->id()));
 
-    testData.renderSurfaceStore.append(adoptPtr(renderSurface));
+    testData.renderSurfaceStore.append(renderSurface.release());
     testData.layerStore.append(layerImpl.release());
     return renderPassPtr.release();
 }
 
-static void configureRenderPassTestData(const char* testScript, RenderPassRemovalTestData& testData)
+static void configureRenderPassTestData(const char* testScript, RenderPassRemovalTestData& testData, CCTestRenderer* renderer)
 {
+    renderer->clearCachedTextures();
+
     // One shared state for all quads - we don't need the correct details
     testData.sharedQuadState = CCSharedQuadState::create(WebTransformationMatrix(), WebTransformationMatrix(), IntRect(), IntRect(), 1.0, true);
 
     const char* currentChar = testScript;
 
     // Pre-create root pass
-    OwnPtr<CCRenderPass> rootRenderPass = createDummyRenderPass(testData);
-    testData.renderPassId.insert(std::pair<CCRenderPass*, char>(rootRenderPass.get(), testScript[0]));
-    testData.renderPassCache.insert(std::pair<char, RenderPassCacheEntry>(testScript[0], RenderPassCacheEntry(rootRenderPass.release())));
-    while (*currentChar != '\0') {
+    char rootRenderPassId = testScript[0];
+    OwnPtr<CCRenderPass> rootRenderPass = createDummyRenderPass(testData, rootRenderPassId);
+    testData.renderPassId.insert(std::pair<CCRenderPass*, char>(rootRenderPass.get(), rootRenderPassId));
+    testData.renderPassCache.insert(std::pair<char, RenderPassCacheEntry>(rootRenderPassId, RenderPassCacheEntry(rootRenderPass.release())));
+    while (*currentChar) {
         char renderPassId = currentChar[0];
         currentChar++;
 
@@ -2985,23 +2965,24 @@ static void configureRenderPassTestData(const char* testScript, RenderPassRemova
         renderPass = testData.renderPassCache[renderPassId].renderPassPtr.release();
 
         // Cycle through quad data and create all quads
-        while (*currentChar != '\n' && *currentChar != '\0') {
+        while (*currentChar && *currentChar != '\n') {
             if (*currentChar == 's') {
                 // Solid color draw quad
-                OwnPtr<CCDrawQuad> quad = CCSolidColorDrawQuad::create(testData.sharedQuadState.get(), IntRect(0, 0, 10, 10), Color::white);
+                OwnPtr<CCDrawQuad> quad = CCSolidColorDrawQuad::create(testData.sharedQuadState.get(), IntRect(0, 0, 10, 10), SK_ColorWHITE);
                 
                 static_cast<CCTestRenderPass*>(renderPass.get())->appendQuad(quad.release());
                 currentChar++;
             } else if ((*currentChar >= 'A') && (*currentChar <= 'Z')) {
                 // RenderPass draw quad
                 char newRenderPassId = *currentChar;
+                ASSERT_NE(rootRenderPassId, newRenderPassId);
                 currentChar++;
                 bool hasTexture = false;
                 bool contentsChanged = true;
                 
                 if (*currentChar == '[') {
                     currentChar++;
-                    while ((*currentChar != ']') && (*currentChar != '\0')) {
+                    while (*currentChar && *currentChar != ']') {
                         switch (*currentChar) {
                         case 'c':
                             contentsChanged = false;
@@ -3019,22 +3000,24 @@ static void configureRenderPassTestData(const char* testScript, RenderPassRemova
                 CCRenderPass* refRenderPassPtr;
 
                 if (testData.renderPassCache.find(newRenderPassId) == testData.renderPassCache.end()) {
-                    OwnPtr<CCRenderPass> refRenderPass = createDummyRenderPass(testData);
+                    if (hasTexture)
+                        renderer->setHaveCachedResourcesForRenderPassId(newRenderPassId);
+
+                    OwnPtr<CCRenderPass> refRenderPass = createDummyRenderPass(testData, newRenderPassId);
                     refRenderPassPtr = refRenderPass.get();
-                    FakeRenderSurface* refRenderSurface = static_cast<FakeRenderSurface*>(refRenderPass->targetSurface());
-                    refRenderSurface->setHasCachedTexture(hasTexture);
-                    refRenderSurface->setContentsChanged(contentsChanged);
                     testData.renderPassId.insert(std::pair<CCRenderPass*, char>(refRenderPass.get(), newRenderPassId));
                     testData.renderPassCache.insert(std::pair<char, RenderPassCacheEntry>(newRenderPassId, RenderPassCacheEntry(refRenderPass.release())));
                 } else
                     refRenderPassPtr = testData.renderPassCache[newRenderPassId].renderPass;
 
-                OwnPtr<CCRenderPassDrawQuad> quad = CCRenderPassDrawQuad::create(testData.sharedQuadState.get(), IntRect(), refRenderPassPtr, isReplica, WebKit::WebFilterOperations(), WebKit::WebFilterOperations(), 1);
+                IntRect quadRect = IntRect(0, 0, 1, 1);
+                IntRect contentsChangedRect = contentsChanged ? quadRect : IntRect();
+                OwnPtr<CCRenderPassDrawQuad> quad = CCRenderPassDrawQuad::create(testData.sharedQuadState.get(), quadRect, refRenderPassPtr, isReplica, WebKit::WebFilterOperations(), WebKit::WebFilterOperations(), 1, contentsChangedRect);
                 static_cast<CCTestRenderPass*>(renderPass.get())->appendQuad(quad.release());
             }
         }
-        testData.renderPassList.insert(0, renderPass.release());
-        if (*currentChar != '\0')
+        testData.renderPasses.insert(0, renderPass.release());
+        if (*currentChar)
             currentChar++;
     }
 }
@@ -3042,8 +3025,7 @@ static void configureRenderPassTestData(const char* testScript, RenderPassRemova
 void dumpRenderPassTestData(const RenderPassRemovalTestData& testData, char* buffer)
 {
     char* pos = buffer;
-    CCRenderPassList::const_reverse_iterator it = testData.renderPassList.rbegin();
-    while (it != testData.renderPassList.rend()) {
+    for (CCRenderPassList::const_reverse_iterator it = testData.renderPasses.rbegin(); it != testData.renderPasses.rend(); ++it) {
         CCRenderPass* currentPass = it->get();
         char passId = testData.renderPassId.find(currentPass)->second;
         *pos = passId;
@@ -3057,15 +3039,14 @@ void dumpRenderPassTestData(const RenderPassRemovalTestData& testData, char* buf
                 *pos = 's';
                 pos++;
                 break;
-            case CCDrawQuad::RenderPass:
-                {
-                    CCRenderPassDrawQuad* renderPassDrawQuad = static_cast<CCRenderPassDrawQuad*>(currentQuad);
-                    const CCRenderPass* refPass = renderPassDrawQuad->renderPass();
-                    char refPassId = testData.renderPassId.find(refPass)->second;
-                    *pos = refPassId;
-                    pos++;
-                }
+            case CCDrawQuad::RenderPass: {
+                CCRenderPassDrawQuad* renderPassDrawQuad = static_cast<CCRenderPassDrawQuad*>(currentQuad);
+                const CCRenderPass* refPass = renderPassDrawQuad->renderPass();
+                char refPassId = testData.renderPassId.find(refPass)->second;
+                *pos = refPassId;
+                pos++;
                 break;
+            }
             default:
                 *pos = 'x';
                 pos++;
@@ -3076,7 +3057,6 @@ void dumpRenderPassTestData(const RenderPassRemovalTestData& testData, char* buf
         }
         *pos = '\n';
         pos++;
-        it++;
     }
     *pos = '\0';
 }
@@ -3229,15 +3209,18 @@ static void verifyRenderPassTestData(TestCase& testCase, RenderPassRemovalTestDa
     EXPECT_STREQ(testCase.expectedResult, actualResult) << "In test case: " << testCase.name;
 }
 
-TEST(RenderPassRemovalTest, testRemoveRenderPasses)
+TEST_F(CCLayerTreeHostImplTest, testRemoveRenderPasses)
 {
+    OwnPtr<CCGraphicsContext> context(createContext());
+    WebKit::WebGraphicsContext3D* context3d = context->context3D();
+    ASSERT_TRUE(context3d);
+    OwnPtr<CCTestRenderer> renderer(CCTestRenderer::create(context3d));
+
     int testCaseIndex = 0;
     while (removeRenderPassesCases[testCaseIndex].name) {
-        DebugScopedSetImplThread implThread;
         RenderPassRemovalTestData testData;
-        CCRenderPassList skippedPasses;
-        configureRenderPassTestData(removeRenderPassesCases[testCaseIndex].initScript, testData);
-        CCLayerTreeHostImpl::removePassesWithCachedTextures(testData.renderPassList, skippedPasses);
+        configureRenderPassTestData(removeRenderPassesCases[testCaseIndex].initScript, testData, renderer.get());
+        CCLayerTreeHostImpl::removeRenderPasses(CCLayerTreeHostImpl::CullRenderPassesWithCachedTextures(*renderer), testData);
         verifyRenderPassTestData(removeRenderPassesCases[testCaseIndex], testData);
         testCaseIndex++;
     }
diff --git a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
index 7d14d38d5..97d4568da 100644
--- a/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
+++ b/Source/WebKit/chromium/tests/CCLayerTreeHostTest.cpp
@@ -57,7 +57,6 @@ using namespace WTF;
 namespace {
 
 class CCLayerTreeHostTest : public CCThreadedTest { };
-class CCLayerTreeHostTestThreadOnly : public CCThreadedTestThreadOnly { };
 
 // Shortlived layerTreeHosts shouldn't die.
 class CCLayerTreeHostTestShortlived1 : public CCLayerTreeHostTest {
@@ -125,7 +124,7 @@ public:
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestShortlived3)
 
 // Test interleaving of redraws and commits
-class CCLayerTreeHostTestCommitingWithContinuousRedraw : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestCommitingWithContinuousRedraw : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestCommitingWithContinuousRedraw()
         : m_numCompleteCommits(0)
@@ -164,12 +163,12 @@ private:
 
 TEST_F(CCLayerTreeHostTestCommitingWithContinuousRedraw, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // Two setNeedsCommits in a row should lead to at least 1 commit and at least 1
 // draw with frame 0.
-class CCLayerTreeHostTestSetNeedsCommit1 : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestSetNeedsCommit1 : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetNeedsCommit1()
         : m_numCommits(0)
@@ -208,12 +207,12 @@ private:
 
 TEST_F(CCLayerTreeHostTestSetNeedsCommit1, DISABLED_runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // A setNeedsCommit should lead to 1 commit. Issuing a second commit after that
 // first committed frame draws should lead to another commit.
-class CCLayerTreeHostTestSetNeedsCommit2 : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestSetNeedsCommit2 : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetNeedsCommit2()
         : m_numCommits(0)
@@ -257,12 +256,12 @@ TEST_F(CCLayerTreeHostTestSetNeedsCommit2, FLAKY_runMultiThread)
 TEST_F(CCLayerTreeHostTestSetNeedsCommit2, runMultiThread)
 #endif
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // 1 setNeedsRedraw after the first commit has completed should lead to 1
 // additional draw.
-class CCLayerTreeHostTestSetNeedsRedraw : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestSetNeedsRedraw : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetNeedsRedraw()
         : m_numCommits(0)
@@ -304,11 +303,11 @@ private:
 
 TEST_F(CCLayerTreeHostTestSetNeedsRedraw, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // If the layerTreeHost says it can't draw, then we should not try to draw.
-class CCLayerTreeHostTestCanDrawBlocksDrawing : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestCanDrawBlocksDrawing : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestCanDrawBlocksDrawing()
         : m_numCommits(0)
@@ -362,7 +361,7 @@ private:
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestCanDrawBlocksDrawing)
 
 // beginLayerWrite should prevent draws from executing until a commit occurs
-class CCLayerTreeHostTestWriteLayersRedraw : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestWriteLayersRedraw : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestWriteLayersRedraw()
         : m_numCommits(0)
@@ -401,7 +400,7 @@ private:
 
 TEST_F(CCLayerTreeHostTestWriteLayersRedraw, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // Verify that when resuming visibility, requesting layer write permission
@@ -409,7 +408,7 @@ TEST_F(CCLayerTreeHostTestWriteLayersRedraw, runMultiThread)
 // scheduled redraws. This behavior is critical for reliably surviving tab
 // switching. There are no failure conditions to this test, it just passes
 // by not timing out.
-class CCLayerTreeHostTestWriteLayersAfterVisible : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestWriteLayersAfterVisible : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestWriteLayersAfterVisible()
         : m_numCommits(0)
@@ -444,11 +443,11 @@ private:
 
 TEST_F(CCLayerTreeHostTestWriteLayersAfterVisible, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // A compositeAndReadback while invisible should force a normal commit without assertion.
-class CCLayerTreeHostTestCompositeAndReadbackWhileInvisible : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestCompositeAndReadbackWhileInvisible : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestCompositeAndReadbackWhileInvisible()
         : m_numCommits(0)
@@ -483,10 +482,10 @@ private:
 
 TEST_F(CCLayerTreeHostTestCompositeAndReadbackWhileInvisible, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
-class CCLayerTreeHostTestAbortFrameWhenInvisible : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestAbortFrameWhenInvisible : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestAbortFrameWhenInvisible()
     {
@@ -517,7 +516,7 @@ private:
 
 TEST_F(CCLayerTreeHostTestAbortFrameWhenInvisible, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 
@@ -526,7 +525,7 @@ TEST_F(CCLayerTreeHostTestAbortFrameWhenInvisible, runMultiThread)
 // animate gets called yet-again, indicating that the proxy is correctly
 // handling the case where setNeedsAnimate() is called inside the begin frame
 // flow.
-class CCLayerTreeHostTestSetNeedsAnimateInsideAnimationCallback : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestSetNeedsAnimateInsideAnimationCallback : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetNeedsAnimateInsideAnimationCallback()
         : m_numAnimates(0)
@@ -558,12 +557,12 @@ private:
 
 TEST_F(CCLayerTreeHostTestSetNeedsAnimateInsideAnimationCallback, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // Add a layer animation and confirm that CCLayerTreeHostImpl::animateLayers does get
 // called and continues to get called.
-class CCLayerTreeHostTestAddAnimation : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestAddAnimation : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestAddAnimation()
         : m_numAnimates(0)
@@ -614,12 +613,12 @@ private:
 
 TEST_F(CCLayerTreeHostTestAddAnimation, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // Add a layer animation to a layer, but continually fail to draw. Confirm that after
 // a while, we do eventually force a draw.
-class CCLayerTreeHostTestCheckerboardDoesNotStarveDraws : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestCheckerboardDoesNotStarveDraws : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestCheckerboardDoesNotStarveDraws()
         : m_startedAnimating(false)
@@ -658,11 +657,11 @@ private:
 // Starvation can only be an issue with the MT compositor.
 TEST_F(CCLayerTreeHostTestCheckerboardDoesNotStarveDraws, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // Ensures that animations continue to be ticked when we are backgrounded.
-class CCLayerTreeHostTestTickAnimationWhileBackgrounded : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestTickAnimationWhileBackgrounded : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestTickAnimationWhileBackgrounded()
         : m_numAnimates(0)
@@ -701,7 +700,7 @@ private:
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestTickAnimationWhileBackgrounded)
 
 // Ensures that animations continue to be ticked when we are backgrounded.
-class CCLayerTreeHostTestAddAnimationWithTimingFunction : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestAddAnimationWithTimingFunction : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestAddAnimationWithTimingFunction()
     {
@@ -739,7 +738,7 @@ private:
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestAddAnimationWithTimingFunction)
 
 // Ensures that when opacity is being animated, this value does not cause the subtree to be skipped.
-class CCLayerTreeHostTestDoNotSkipLayersWithAnimatedOpacity : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestDoNotSkipLayersWithAnimatedOpacity : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestDoNotSkipLayersWithAnimatedOpacity()
     {
@@ -774,11 +773,11 @@ TEST_F(CCLayerTreeHostTestDoNotSkipLayersWithAnimatedOpacity, FLAKY_runMultiThre
 TEST_F(CCLayerTreeHostTestDoNotSkipLayersWithAnimatedOpacity, runMultiThread)
 #endif
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // Ensures that main thread animations have their start times synchronized with impl thread animations.
-class CCLayerTreeHostTestSynchronizeAnimationStartTimes : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestSynchronizeAnimationStartTimes : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSynchronizeAnimationStartTimes()
         : m_layerTreeHostImpl(0)
@@ -821,7 +820,7 @@ private:
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestSynchronizeAnimationStartTimes)
 
 // Ensures that main thread animations have their start times synchronized with impl thread animations.
-class CCLayerTreeHostTestAnimationFinishedEvents : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestAnimationFinishedEvents : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestAnimationFinishedEvents()
     {
@@ -846,7 +845,7 @@ private:
 
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestAnimationFinishedEvents)
 
-class CCLayerTreeHostTestScrollSimple : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestScrollSimple : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestScrollSimple()
         : m_initialScroll(IntPoint(10, 20))
@@ -916,10 +915,10 @@ private:
 
 TEST_F(CCLayerTreeHostTestScrollSimple, DISABLED_runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
-class CCLayerTreeHostTestScrollMultipleRedraw : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestScrollMultipleRedraw : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestScrollMultipleRedraw()
         : m_initialScroll(IntPoint(40, 10))
@@ -996,7 +995,7 @@ private:
 
 TEST_F(CCLayerTreeHostTestScrollMultipleRedraw, DISABLED_runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // This test verifies that properties on the layer tree host are commited to the impl side.
@@ -1142,7 +1141,7 @@ public:
     {
     }
 
-    virtual void paintContents(SkCanvas*, const IntRect&, IntRect&)
+    virtual void paintContents(SkCanvas*, const IntRect&, FloatRect&) OVERRIDE
     {
         // Set layer opacity to 0.
         m_test->layerTreeHost()->rootLayer()->setOpacity(0);
@@ -1159,8 +1158,7 @@ public:
     static PassRefPtr<ContentLayerChromiumWithUpdateTracking> create(ContentLayerDelegate *delegate) { return adoptRef(new ContentLayerChromiumWithUpdateTracking(delegate)); }
 
     int paintContentsCount() { return m_paintContentsCount; }
-    int idlePaintContentsCount() { return m_idlePaintContentsCount; }
-    void resetPaintContentsCount() { m_paintContentsCount = 0; m_idlePaintContentsCount = 0;}
+    void resetPaintContentsCount() { m_paintContentsCount = 0; }
 
     virtual void update(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion) OVERRIDE
     {
@@ -1168,24 +1166,17 @@ public:
         m_paintContentsCount++;
     }
 
-    virtual void idleUpdate(CCTextureUpdater& updater, const CCOcclusionTracker* occlusion) OVERRIDE
-    {
-        ContentLayerChromium::idleUpdate(updater, occlusion);
-        m_idlePaintContentsCount++;
-    }
-
 private:
     explicit ContentLayerChromiumWithUpdateTracking(ContentLayerDelegate* delegate)
         : ContentLayerChromium(delegate)
         , m_paintContentsCount(0)
-        , m_idlePaintContentsCount(0)
     {
+        setAnchorPoint(FloatPoint(0, 0));
         setBounds(IntSize(10, 10));
         setIsDrawable(true);
     }
 
     int m_paintContentsCount;
-    int m_idlePaintContentsCount;
 };
 
 // Layer opacity change during paint should not prevent compositor resources from being updated during commit.
@@ -1215,9 +1206,6 @@ public:
         // update() should have been called once.
         EXPECT_EQ(1, m_updateCheckLayer->paintContentsCount());
 
-        // idleUpdate() should have been called once
-        EXPECT_EQ(1, m_updateCheckLayer->idlePaintContentsCount());
-
         // clear m_updateCheckLayer so CCLayerTreeHost dies.
         m_updateCheckLayer.clear();
     }
@@ -1236,7 +1224,7 @@ class MockContentLayerDelegate : public ContentLayerDelegate {
 public:
     bool drawsContent() const { return true; }
     MOCK_CONST_METHOD0(preserves3D, bool());
-    void paintContents(SkCanvas*, const IntRect&, IntRect&) { }
+    void paintContents(SkCanvas*, const IntRect&, FloatRect&) OVERRIDE { }
     void notifySyncRequired() { }
 };
 
@@ -1488,9 +1476,6 @@ public:
             context->resetUsedTextures();
             break;
         case 1:
-            // Number of textures should be four as the first two
-            // textures are used by the impl thread.
-            ASSERT_EQ(4, context->numTextures());
             // Number of textures used for commit should still be two.
             EXPECT_EQ(2, context->numUsedTextures());
             // First two textures should not have been used.
@@ -1503,32 +1488,18 @@ public:
             context->resetUsedTextures();
             break;
         case 2:
-            // Number of textures should be three as we allow one
-            // partial update and the first two textures are used by
-            // the impl thread.
-            ASSERT_EQ(3, context->numTextures());
             // Number of textures used for commit should still be two.
             EXPECT_EQ(2, context->numUsedTextures());
-            // First texture should have been used.
-            EXPECT_TRUE(context->usedTexture(context->texture(0)));
-            // Second texture should not have been used.
-            EXPECT_FALSE(context->usedTexture(context->texture(1)));
-            // Third texture should have been used.
-            EXPECT_TRUE(context->usedTexture(context->texture(2)));
 
             context->resetUsedTextures();
             break;
         case 3:
-            // Number of textures should be two.
-            EXPECT_EQ(2, context->numTextures());
             // No textures should be used for commit.
             EXPECT_EQ(0, context->numUsedTextures());
 
             context->resetUsedTextures();
             break;
         case 4:
-            // Number of textures should be two.
-            EXPECT_EQ(2, context->numTextures());
             // Number of textures used for commit should be one.
             EXPECT_EQ(1, context->numUsedTextures());
 
@@ -1983,7 +1954,7 @@ public:
 SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestManySurfaces)
 
 // A loseContext(1) should lead to a didRecreateContext(true)
-class CCLayerTreeHostTestSetSingleLostContext : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestSetSingleLostContext : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetSingleLostContext()
     {
@@ -2012,12 +1983,12 @@ public:
 
 TEST_F(CCLayerTreeHostTestSetSingleLostContext, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 // A loseContext(10) should lead to a didRecreateContext(false), and
 // a finishAllRendering() should not hang.
-class CCLayerTreeHostTestSetRepeatedLostContext : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestSetRepeatedLostContext : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestSetRepeatedLostContext()
     {
@@ -2047,10 +2018,10 @@ public:
 
 TEST_F(CCLayerTreeHostTestSetRepeatedLostContext, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
-class CCLayerTreeHostTestFractionalScroll : public CCLayerTreeHostTestThreadOnly {
+class CCLayerTreeHostTestFractionalScroll : public CCLayerTreeHostTest {
 public:
     CCLayerTreeHostTestFractionalScroll()
         : m_scrollAmount(1.75, 0)
@@ -2100,7 +2071,7 @@ private:
 
 TEST_F(CCLayerTreeHostTestFractionalScroll, runMultiThread)
 {
-    runTestThreaded();
+    runTest(true);
 }
 
 class CCLayerTreeHostTestFinishAllRendering : public CCLayerTreeHostTest {
@@ -2269,4 +2240,97 @@ TEST_F(CCLayerTreeHostTestScrollChildLayer, runMultiThread)
     runTest(true);
 }
 
+class CCLayerTreeHostTestCompositeAndReadbackCleanup : public CCLayerTreeHostTest {
+public:
+    CCLayerTreeHostTestCompositeAndReadbackCleanup() { }
+
+    virtual void beginTest()
+    {
+        LayerChromium* rootLayer = m_layerTreeHost->rootLayer();
+
+        OwnArrayPtr<char> pixels(adoptArrayPtr(new char[4]));
+        m_layerTreeHost->compositeAndReadback(static_cast<void*>(pixels.get()), IntRect(0, 0, 1, 1));
+        EXPECT_FALSE(rootLayer->renderSurface());
+
+        endTest();
+    }
+
+    virtual void afterTest()
+    {
+    }
+};
+
+SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestCompositeAndReadbackCleanup)
+
+class CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit : public CCLayerTreeHostTest {
+public:
+    CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit()
+        : m_rootLayer(ContentLayerChromiumWithUpdateTracking::create(&m_mockDelegate))
+        , m_surfaceLayer1(ContentLayerChromiumWithUpdateTracking::create(&m_mockDelegate))
+        , m_surfaceLayer2(ContentLayerChromiumWithUpdateTracking::create(&m_mockDelegate))
+    {
+    }
+
+    virtual void beginTest()
+    {
+        m_layerTreeHost->setViewportSize(IntSize(100, 100));
+
+        m_rootLayer->setBounds(IntSize(100, 100));
+        m_surfaceLayer1->setBounds(IntSize(100, 100));
+        m_surfaceLayer1->setForceRenderSurface(true);
+        m_surfaceLayer1->setOpacity(0.5);
+        m_surfaceLayer2->setBounds(IntSize(100, 100));
+        m_surfaceLayer2->setForceRenderSurface(true);
+        m_surfaceLayer2->setOpacity(0.5);
+
+        m_rootLayer->addChild(m_surfaceLayer1);
+        m_surfaceLayer1->addChild(m_surfaceLayer2);
+        m_layerTreeHost->setRootLayer(m_rootLayer);
+    }
+
+    virtual void drawLayersOnCCThread(CCLayerTreeHostImpl* hostImpl)
+    {
+        CCRenderer* renderer = hostImpl->layerRenderer();
+        unsigned surface1RenderPassId = hostImpl->rootLayer()->children()[0]->id();
+        unsigned surface2RenderPassId = hostImpl->rootLayer()->children()[0]->children()[0]->id();
+
+        switch (hostImpl->sourceFrameNumber()) {
+        case 0:
+            EXPECT_TRUE(renderer->haveCachedResourcesForRenderPassId(surface1RenderPassId));
+            EXPECT_TRUE(renderer->haveCachedResourcesForRenderPassId(surface2RenderPassId));
+
+            // Reduce the memory limit to only fit the root layer and one render surface. This
+            // prevents any contents drawing into surfaces from being allocated.
+            hostImpl->setMemoryAllocationLimitBytes(100 * 100 * 4 * 2);
+            break;
+        case 1:
+            EXPECT_FALSE(renderer->haveCachedResourcesForRenderPassId(surface1RenderPassId));
+            EXPECT_FALSE(renderer->haveCachedResourcesForRenderPassId(surface2RenderPassId));
+
+            endTest();
+            break;
+        }
+    }
+
+    virtual void afterTest()
+    {
+        EXPECT_EQ(2, m_rootLayer->paintContentsCount());
+        EXPECT_EQ(2, m_surfaceLayer1->paintContentsCount());
+        EXPECT_EQ(2, m_surfaceLayer2->paintContentsCount());
+
+        // Clear layer references so CCLayerTreeHost dies.
+        m_rootLayer.clear();
+        m_surfaceLayer1.clear();
+        m_surfaceLayer2.clear();
+    }
+
+private:
+    MockContentLayerDelegate m_mockDelegate;
+    RefPtr<ContentLayerChromiumWithUpdateTracking> m_rootLayer;
+    RefPtr<ContentLayerChromiumWithUpdateTracking> m_surfaceLayer1;
+    RefPtr<ContentLayerChromiumWithUpdateTracking> m_surfaceLayer2;
+};
+
+SINGLE_AND_MULTI_THREAD_TEST_F(CCLayerTreeHostTestSurfaceNotAllocatedForLayersOutsideMemoryLimit)
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
index ee5e2907d..22ed5a997 100644
--- a/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCOcclusionTrackerTest.cpp
@@ -156,7 +156,7 @@ struct CCOcclusionTrackerTestImplThreadTypes {
     static int nextCCLayerImplId;
 };
 
-int CCOcclusionTrackerTestImplThreadTypes::nextCCLayerImplId = 0;
+int CCOcclusionTrackerTestImplThreadTypes::nextCCLayerImplId = 1;
 
 template<typename Types, bool opaqueLayers>
 class CCOcclusionTrackerTest : public testing::Test {
diff --git a/Source/WebKit/chromium/tests/CCPrioritizedTextureTest.cpp b/Source/WebKit/chromium/tests/CCPrioritizedTextureTest.cpp
new file mode 100644
index 000000000..468af36bb
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCPrioritizedTextureTest.cpp
@@ -0,0 +1,437 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCPrioritizedTexture.h"
+
+#include "CCTiledLayerTestCommon.h"
+#include "cc/CCPrioritizedTextureManager.h"
+#include <gtest/gtest.h>
+
+using namespace WebCore;
+using namespace WebKitTests;
+using namespace WTF;
+
+namespace {
+
+class CCPrioritizedTextureTest : public testing::Test {
+public:
+    CCPrioritizedTextureTest()
+        : m_textureSize(256, 256)
+        , m_textureFormat(GraphicsContext3D::RGBA)
+    {
+    }
+
+    virtual ~CCPrioritizedTextureTest()
+    {
+    }
+
+    size_t texturesMemorySize(size_t textureCount)
+    {
+        return TextureManager::memoryUseBytes(m_textureSize, m_textureFormat) * textureCount;
+    }
+
+    PassOwnPtr<CCPrioritizedTextureManager> createManager(size_t maxTextures)
+    {
+        return CCPrioritizedTextureManager::create(texturesMemorySize(maxTextures), 1024);
+    }
+
+    bool validateTexture(OwnPtr<CCPrioritizedTexture>& texture, bool requestLate)
+    {
+#if !ASSERT_DISABLED
+        texture->textureManager()->assertInvariants();
+#endif
+        if (requestLate)
+            texture->requestLate();
+        bool success = texture->canAcquireBackingTexture();
+        if (success)
+            texture->acquireBackingTexture(allocator());
+        return success;
+    }
+
+    FakeTextureAllocator* allocator()
+    {
+       return &m_fakeTextureAllocator;
+    }
+
+protected:
+    FakeTextureAllocator m_fakeTextureAllocator;
+    const IntSize m_textureSize;
+    const GC3Denum m_textureFormat;
+};
+
+TEST_F(CCPrioritizedTextureTest, requestTextureExceedingMaxLimit)
+{
+    const size_t maxTextures = 8;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(maxTextures);
+
+    // Create textures for double our memory limit.
+    OwnPtr<CCPrioritizedTexture> textures[maxTextures*2];
+
+    for (size_t i = 0; i < maxTextures*2; ++i)
+        textures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+
+    // Set decreasing priorities
+    for (size_t i = 0; i < maxTextures*2; ++i)
+        textures[i]->setRequestPriority(100 + i);
+
+    // Only lower half should be available.
+    textureManager->prioritizeTextures(0);
+    EXPECT_TRUE(validateTexture(textures[0], false));
+    EXPECT_TRUE(validateTexture(textures[7], false));
+    EXPECT_FALSE(validateTexture(textures[8], false));
+    EXPECT_FALSE(validateTexture(textures[15], false));
+
+    // Set increasing priorities
+    for (size_t i = 0; i < maxTextures*2; ++i)
+        textures[i]->setRequestPriority(100 - i);
+
+    // Only upper half should be available.
+    textureManager->prioritizeTextures(0);
+    EXPECT_FALSE(validateTexture(textures[0], false));
+    EXPECT_FALSE(validateTexture(textures[7], false));
+    EXPECT_TRUE(validateTexture(textures[8], false));
+    EXPECT_TRUE(validateTexture(textures[15], false));
+
+    EXPECT_EQ(texturesMemorySize(maxTextures), textureManager->memoryAboveCutoffBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    textureManager->clearAllMemory(allocator());
+}
+
+TEST_F(CCPrioritizedTextureTest, changeMemoryLimits)
+{
+    const size_t maxTextures = 8;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(maxTextures);
+    OwnPtr<CCPrioritizedTexture> textures[maxTextures];
+
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i]->setRequestPriority(100 + i);
+
+    // Set max limit to 8 textures
+    textureManager->setMaxMemoryLimitBytes(texturesMemorySize(8));
+    textureManager->prioritizeTextures(0);
+    for (size_t i = 0; i < maxTextures; ++i)
+        validateTexture(textures[i], false);
+    textureManager->reduceMemory(allocator());
+
+    EXPECT_EQ(texturesMemorySize(8), textureManager->memoryAboveCutoffBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    // Set max limit to 5 textures
+    textureManager->setMaxMemoryLimitBytes(texturesMemorySize(5));
+    textureManager->prioritizeTextures(0);
+    for (size_t i = 0; i < maxTextures; ++i)
+        EXPECT_EQ(validateTexture(textures[i], false), i < 5);
+    textureManager->reduceMemory(allocator());
+
+    EXPECT_EQ(texturesMemorySize(5), textureManager->memoryAboveCutoffBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    // Set max limit to 4 textures
+    textureManager->setMaxMemoryLimitBytes(texturesMemorySize(4));
+    textureManager->prioritizeTextures(0);
+    for (size_t i = 0; i < maxTextures; ++i)
+        EXPECT_EQ(validateTexture(textures[i], false), i < 4);
+    textureManager->reduceMemory(allocator());
+
+    EXPECT_EQ(texturesMemorySize(4), textureManager->memoryAboveCutoffBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    textureManager->clearAllMemory(allocator());
+}
+
+TEST_F(CCPrioritizedTextureTest, textureManagerPartialUpdateTextures)
+{
+    const size_t maxTextures = 4;
+    const size_t numTextures = 4;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(maxTextures);
+    OwnPtr<CCPrioritizedTexture> textures[numTextures];
+    OwnPtr<CCPrioritizedTexture> moreTextures[numTextures];
+
+    for (size_t i = 0; i < numTextures; ++i) {
+        textures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+        moreTextures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+    }
+
+    for (size_t i = 0; i < numTextures; ++i)
+        textures[i]->setRequestPriority(200 + i);
+    textureManager->prioritizeTextures(0);
+
+    // Allocate textures which are currently high priority.
+    EXPECT_TRUE(validateTexture(textures[0], false));
+    EXPECT_TRUE(validateTexture(textures[1], false));
+    EXPECT_TRUE(validateTexture(textures[2], false));
+    EXPECT_TRUE(validateTexture(textures[3], false));
+
+    EXPECT_TRUE(textures[0]->haveBackingTexture());
+    EXPECT_TRUE(textures[1]->haveBackingTexture());
+    EXPECT_TRUE(textures[2]->haveBackingTexture());
+    EXPECT_TRUE(textures[3]->haveBackingTexture());
+
+    for (size_t i = 0; i < numTextures; ++i)
+        moreTextures[i]->setRequestPriority(100 + i);
+    textureManager->prioritizeTextures(0);
+
+    // Textures are now below cutoff.
+    EXPECT_FALSE(validateTexture(textures[0], false));
+    EXPECT_FALSE(validateTexture(textures[1], false));
+    EXPECT_FALSE(validateTexture(textures[2], false));
+    EXPECT_FALSE(validateTexture(textures[3], false));
+
+    // But they are still valid to use.
+    EXPECT_TRUE(textures[0]->haveBackingTexture());
+    EXPECT_TRUE(textures[1]->haveBackingTexture());
+    EXPECT_TRUE(textures[2]->haveBackingTexture());
+    EXPECT_TRUE(textures[3]->haveBackingTexture());
+
+    // Higher priority textures are finally needed.
+    EXPECT_TRUE(validateTexture(moreTextures[0], false));
+    EXPECT_TRUE(validateTexture(moreTextures[1], false));
+    EXPECT_TRUE(validateTexture(moreTextures[2], false));
+    EXPECT_TRUE(validateTexture(moreTextures[3], false));
+
+    // Lower priority have been fully evicted.
+    EXPECT_FALSE(textures[0]->haveBackingTexture());
+    EXPECT_FALSE(textures[1]->haveBackingTexture());
+    EXPECT_FALSE(textures[2]->haveBackingTexture());
+    EXPECT_FALSE(textures[3]->haveBackingTexture());
+
+    textureManager->clearAllMemory(allocator());
+}
+
+TEST_F(CCPrioritizedTextureTest, textureManagerPrioritiesAreEqual)
+{
+    const size_t maxTextures = 16;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(maxTextures);
+    OwnPtr<CCPrioritizedTexture> textures[maxTextures];
+
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+
+    // All 16 textures have the same priority except 2 higher priority.
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i]->setRequestPriority(100);
+    textures[0]->setRequestPriority(99);
+    textures[1]->setRequestPriority(99);
+
+    // Set max limit to 8 textures
+    textureManager->setMaxMemoryLimitBytes(texturesMemorySize(8));
+    textureManager->prioritizeTextures(0);
+
+    // The two high priority textures should be available, others should not.
+    for (size_t i = 0; i < 2; ++i)
+        EXPECT_TRUE(validateTexture(textures[i], false));
+    for (size_t i = 2; i < maxTextures; ++i)
+        EXPECT_FALSE(validateTexture(textures[i], false));
+    EXPECT_EQ(texturesMemorySize(2), textureManager->memoryAboveCutoffBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    // Manually reserving textures should only succeed on the higher priority textures,
+    // and on remaining textures up to the memory limit.
+    for (size_t i = 0; i < 8; i++)
+        EXPECT_TRUE(validateTexture(textures[i], true));
+    for (size_t i = 9; i < maxTextures; i++)
+        EXPECT_FALSE(validateTexture(textures[i], true));
+    EXPECT_EQ(texturesMemorySize(8), textureManager->memoryAboveCutoffBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    textureManager->clearAllMemory(allocator());
+}
+
+TEST_F(CCPrioritizedTextureTest, textureManagerDestroyedFirst)
+{
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(1);
+    OwnPtr<CCPrioritizedTexture> texture = textureManager->createTexture(m_textureSize, m_textureFormat);
+
+    // Texture is initially invalid, but it will become available.
+    EXPECT_FALSE(texture->haveBackingTexture());
+
+    texture->setRequestPriority(100);
+    textureManager->prioritizeTextures(0);
+
+    EXPECT_TRUE(validateTexture(texture, false));
+    EXPECT_TRUE(texture->canAcquireBackingTexture());
+    EXPECT_TRUE(texture->haveBackingTexture());
+
+    textureManager->clearAllMemory(allocator());
+    textureManager.clear();
+
+    EXPECT_FALSE(texture->canAcquireBackingTexture());
+    EXPECT_FALSE(texture->haveBackingTexture());
+}
+
+TEST_F(CCPrioritizedTextureTest, textureMovedToNewManager)
+{
+    OwnPtr<CCPrioritizedTextureManager> textureManagerOne = createManager(1);
+    OwnPtr<CCPrioritizedTextureManager> textureManagerTwo = createManager(1);
+    OwnPtr<CCPrioritizedTexture> texture = textureManagerOne->createTexture(m_textureSize, m_textureFormat);
+
+    // Texture is initially invalid, but it will become available.
+    EXPECT_FALSE(texture->haveBackingTexture());
+
+    texture->setRequestPriority(100);
+    textureManagerOne->prioritizeTextures(0);
+
+    EXPECT_TRUE(validateTexture(texture, false));
+    EXPECT_TRUE(texture->canAcquireBackingTexture());
+    EXPECT_TRUE(texture->haveBackingTexture());
+
+    texture->setTextureManager(0);
+
+    textureManagerOne->clearAllMemory(allocator());
+    textureManagerOne.clear();
+
+    EXPECT_FALSE(texture->canAcquireBackingTexture());
+    EXPECT_FALSE(texture->haveBackingTexture());
+
+    texture->setTextureManager(textureManagerTwo.get());
+
+    textureManagerTwo->prioritizeTextures(0);
+
+    EXPECT_TRUE(validateTexture(texture, false));
+    EXPECT_TRUE(texture->canAcquireBackingTexture());
+    EXPECT_TRUE(texture->haveBackingTexture());
+
+    textureManagerTwo->clearAllMemory(allocator());
+}
+
+TEST_F(CCPrioritizedTextureTest, renderSurfacesReduceMemoryAvailableOutsideRootSurface)
+{
+    const size_t maxTextures = 8;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(maxTextures);
+
+    // Half of the memory is taken by surfaces.
+    const size_t renderSurfacesBytes = texturesMemorySize(4);
+
+    // Create textures to fill our memory limit.
+    OwnPtr<CCPrioritizedTexture> textures[maxTextures];
+
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+
+    // Set decreasing non-visible priorities outside root surface.
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i]->setRequestPriority(100 + i);
+
+    // Only lower half should be available.
+    textureManager->prioritizeTextures(renderSurfacesBytes);
+    EXPECT_TRUE(validateTexture(textures[0], false));
+    EXPECT_TRUE(validateTexture(textures[3], false));
+    EXPECT_FALSE(validateTexture(textures[4], false));
+    EXPECT_FALSE(validateTexture(textures[7], false));
+
+    // Set increasing non-visible priorities outside root surface.
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i]->setRequestPriority(100 - i);
+
+    // Only upper half should be available.
+    textureManager->prioritizeTextures(renderSurfacesBytes);
+    EXPECT_FALSE(validateTexture(textures[0], false));
+    EXPECT_FALSE(validateTexture(textures[3], false));
+    EXPECT_TRUE(validateTexture(textures[4], false));
+    EXPECT_TRUE(validateTexture(textures[7], false));
+
+    EXPECT_EQ(texturesMemorySize(4), textureManager->memoryAboveCutoffBytes());
+    EXPECT_EQ(texturesMemorySize(4), textureManager->memoryForRenderSurfacesBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    textureManager->clearAllMemory(allocator());
+}
+
+TEST_F(CCPrioritizedTextureTest, renderSurfacesReduceMemoryAvailableForRequestLate)
+{
+    const size_t maxTextures = 8;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(maxTextures);
+
+    // Half of the memory is taken by surfaces.
+    const size_t renderSurfacesBytes = texturesMemorySize(4);
+
+    // Create textures to fill our memory limit.
+    OwnPtr<CCPrioritizedTexture> textures[maxTextures];
+
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+
+    // Set equal priorities.
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i]->setRequestPriority(100);
+
+    // The first four to be requested late will be available.
+    textureManager->prioritizeTextures(renderSurfacesBytes);
+    for (unsigned i = 0; i < maxTextures; ++i)
+        EXPECT_FALSE(validateTexture(textures[i], false));
+    for (unsigned i = 0; i < maxTextures; i += 2)
+        EXPECT_TRUE(validateTexture(textures[i], true));
+    for (unsigned i = 1; i < maxTextures; i += 2)
+        EXPECT_FALSE(validateTexture(textures[i], true));
+
+    EXPECT_EQ(texturesMemorySize(4), textureManager->memoryAboveCutoffBytes());
+    EXPECT_EQ(texturesMemorySize(4), textureManager->memoryForRenderSurfacesBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    textureManager->clearAllMemory(allocator());
+}
+
+TEST_F(CCPrioritizedTextureTest, whenRenderSurfaceNotAvailableTexturesAlsoNotAvailable)
+{
+    const size_t maxTextures = 8;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = createManager(maxTextures);
+
+    // Half of the memory is taken by surfaces.
+    const size_t renderSurfacesBytes = texturesMemorySize(4);
+
+    // Create textures to fill our memory limit.
+    OwnPtr<CCPrioritizedTexture> textures[maxTextures];
+
+    for (size_t i = 0; i < maxTextures; ++i)
+        textures[i] = textureManager->createTexture(m_textureSize, m_textureFormat);
+
+    // Set 6 visible textures in the root surface, and 2 in a child surface.
+    for (size_t i = 0; i < 6; ++i)
+        textures[i]->setRequestPriority(CCPriorityCalculator::visiblePriority(true));
+    for (size_t i = 6; i < 8; ++i)
+        textures[i]->setRequestPriority(CCPriorityCalculator::visiblePriority(false));
+
+    textureManager->prioritizeTextures(renderSurfacesBytes);
+
+    // Unable to requestLate textures in the child surface.
+    EXPECT_FALSE(validateTexture(textures[6], true));
+    EXPECT_FALSE(validateTexture(textures[7], true));
+
+    // Root surface textures are valid.
+    for (size_t i = 0; i < 6; ++i)
+        EXPECT_TRUE(validateTexture(textures[i], false));
+
+    EXPECT_EQ(texturesMemorySize(6), textureManager->memoryAboveCutoffBytes());
+    EXPECT_EQ(texturesMemorySize(2), textureManager->memoryForRenderSurfacesBytes());
+    EXPECT_LE(textureManager->memoryUseBytes(), textureManager->memoryAboveCutoffBytes());
+
+    textureManager->clearAllMemory(allocator());
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
index 10eeb0f74..d0d87d252 100644
--- a/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
+++ b/Source/WebKit/chromium/tests/CCQuadCullerTest.cpp
@@ -60,7 +60,7 @@ typedef CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLa
 
 static PassOwnPtr<CCTiledLayerImpl> makeLayer(CCTiledLayerImpl* parent, const WebTransformationMatrix& drawTransform, const IntRect& layerRect, float opacity, bool opaque, const IntRect& layerOpaqueRect, Vector<CCLayerImpl*>& surfaceLayerList)
 {
-    OwnPtr<CCTiledLayerImpl> layer = CCTiledLayerImpl::create(0);
+    OwnPtr<CCTiledLayerImpl> layer = CCTiledLayerImpl::create(1);
     OwnPtr<CCLayerTilingData> tiler = CCLayerTilingData::create(IntSize(100, 100), CCLayerTilingData::NoBorderTexels);
     tiler->setBounds(layerRect.size());
     layer->setTilingData(*tiler);
diff --git a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
index c8b0edaed..b65e6e72b 100644
--- a/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
+++ b/Source/WebKit/chromium/tests/CCRenderSurfaceTest.cpp
@@ -57,7 +57,7 @@ TEST(CCRenderSurfaceTest, verifySurfaceChangesAreTrackedProperly)
     // This will fake that we are on the correct thread for testing purposes.
     DebugScopedSetImplThread setImplThread;
 
-    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(0);
+    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(1);
     owningLayer->createRenderSurface();
     ASSERT_TRUE(owningLayer->renderSurface());
     CCRenderSurface* renderSurface = owningLayer->renderSurface();
@@ -95,7 +95,7 @@ TEST(CCRenderSurfaceTest, sanityCheckSurfaceCreatesCorrectSharedQuadState)
     // This will fake that we are on the correct thread for testing purposes.
     DebugScopedSetImplThread setImplThread;
 
-    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(0);
+    OwnPtr<CCLayerImpl> owningLayer = CCLayerImpl::create(1);
     owningLayer->createRenderSurface();
     ASSERT_TRUE(owningLayer->renderSurface());
     CCRenderSurface* renderSurface = owningLayer->renderSurface();
diff --git a/Source/WebKit/chromium/tests/CCScopedTextureTest.cpp b/Source/WebKit/chromium/tests/CCScopedTextureTest.cpp
new file mode 100644
index 000000000..4d464ea51
--- /dev/null
+++ b/Source/WebKit/chromium/tests/CCScopedTextureTest.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCScopedTexture.h"
+
+#include "CCTiledLayerTestCommon.h"
+#include "GraphicsContext3D.h"
+
+#include <gtest/gtest.h>
+
+using namespace WebCore;
+using namespace WebKit;
+using namespace WebKitTests;
+
+namespace {
+
+TEST(CCScopedTextureTest, NewScopedTexture)
+{
+    FakeTextureAllocator allocator;
+    OwnPtr<CCScopedTexture> texture = CCScopedTexture::create(&allocator);
+
+    // New scoped textures do not hold a texture yet.
+    EXPECT_EQ(0u, texture->id());
+
+    // New scoped textures do not have a size yet.
+    EXPECT_EQ(IntSize(), texture->size());
+    EXPECT_EQ(0u, texture->bytes());
+}
+
+TEST(CCScopedTextureTest, CreateScopedTexture)
+{
+    FakeTextureAllocator allocator;
+    OwnPtr<CCScopedTexture> texture = CCScopedTexture::create(&allocator);
+    texture->allocate(IntSize(30, 30), GraphicsContext3D::RGBA);
+
+    // The texture has an allocated byte-size now.
+    size_t expectedBytes = 30 * 30 * 4;
+    EXPECT_EQ(expectedBytes, texture->bytes());
+
+    EXPECT_LT(0u, texture->id());
+    EXPECT_EQ(GraphicsContext3D::RGBA, texture->format());
+    EXPECT_EQ(IntSize(30, 30), texture->size());
+}
+
+// Fake TextureAllocator that tracks the number of textures in use.
+class TrackingTextureAllocator : public TextureAllocator {
+public:
+    TrackingTextureAllocator()
+        : m_nextTextureId(1)
+        , m_numTextures(0)
+    { }
+
+    virtual unsigned createTexture(const WebCore::IntSize&, GC3Denum) OVERRIDE
+    {
+        unsigned id = m_nextTextureId;
+        ++m_nextTextureId;
+
+        m_textures.set(id, true);
+        ++m_numTextures;
+        return id;
+    }
+
+    virtual void deleteTexture(unsigned id, const WebCore::IntSize&, GC3Denum) OVERRIDE
+    {
+        if (!m_textures.get(id))
+            return;
+
+        m_textures.set(id, false);
+        --m_numTextures;
+    }
+
+    virtual void deleteAllTextures() OVERRIDE
+    {
+        m_textures.clear();
+        m_numTextures = 0;
+    }
+
+    unsigned numTextures() const { return m_numTextures; }
+
+private:
+    unsigned m_nextTextureId;
+    HashMap<unsigned, bool> m_textures;
+    unsigned m_numTextures;
+};
+
+TEST(CCScopedTextureTest, ScopedTextureIsDeleted)
+{
+    TrackingTextureAllocator allocator;
+
+    {
+        OwnPtr<CCScopedTexture> texture = CCScopedTexture::create(&allocator);
+
+        EXPECT_EQ(0u, allocator.numTextures());
+        texture->allocate(IntSize(30, 30), GraphicsContext3D::RGBA);
+        EXPECT_LT(0u, texture->id());
+        EXPECT_EQ(1u, allocator.numTextures());
+    }
+
+    EXPECT_EQ(0u, allocator.numTextures());
+
+    {
+        OwnPtr<CCScopedTexture> texture = CCScopedTexture::create(&allocator);
+        EXPECT_EQ(0u, allocator.numTextures());
+        texture->allocate(IntSize(30, 30), GraphicsContext3D::RGBA);
+        EXPECT_LT(0u, texture->id());
+        EXPECT_EQ(1u, allocator.numTextures());
+        texture->free();
+        EXPECT_EQ(0u, allocator.numTextures());
+    }
+}
+
+TEST(CCScopedTextureTest, LeakScopedTexture)
+{
+    TrackingTextureAllocator allocator;
+
+    {
+        OwnPtr<CCScopedTexture> texture = CCScopedTexture::create(&allocator);
+
+        EXPECT_EQ(0u, allocator.numTextures());
+        texture->allocate(IntSize(30, 30), GraphicsContext3D::RGBA);
+        EXPECT_LT(0u, texture->id());
+        EXPECT_EQ(1u, allocator.numTextures());
+
+        texture->leak();
+        EXPECT_EQ(0u, texture->id());
+        EXPECT_EQ(1u, allocator.numTextures());
+
+        texture->free();
+        EXPECT_EQ(0u, texture->id());
+        EXPECT_EQ(1u, allocator.numTextures());
+    }
+
+    EXPECT_EQ(1u, allocator.numTextures());
+}
+
+}
diff --git a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
index 6b7124975..22763cef3 100644
--- a/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCSolidColorLayerImplTest.cpp
@@ -47,7 +47,7 @@ TEST(CCSolidColorLayerImplTest, verifyTilingCompleteAndNoOverlap)
     IntSize layerSize = IntSize(800, 600);
     IntRect visibleLayerRect = IntRect(IntPoint(), layerSize);
 
-    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(0);
+    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(1);
     layer->setVisibleLayerRect(visibleLayerRect);
     layer->setBounds(layerSize);
 
@@ -62,13 +62,13 @@ TEST(CCSolidColorLayerImplTest, verifyCorrectBackgroundColorInQuad)
 {
     DebugScopedSetImplThread scopedImplThread;
 
-    const Color testColor = 0xFFA55AFF;
+    SkColor testColor = 0xFFA55AFF;
 
     MockCCQuadCuller quadCuller;
     IntSize layerSize = IntSize(100, 100);
     IntRect visibleLayerRect = IntRect(IntPoint(), layerSize);
 
-    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(0);
+    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(1);
     layer->setVisibleLayerRect(visibleLayerRect);
     layer->setBounds(layerSize);
     layer->setBackgroundColor(testColor);
@@ -91,7 +91,7 @@ TEST(CCSolidColorLayerImplTest, verifyCorrectOpacityInQuad)
     IntSize layerSize = IntSize(100, 100);
     IntRect visibleLayerRect = IntRect(IntPoint(), layerSize);
 
-    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(0);
+    OwnPtr<CCSolidColorLayerImpl> layer = CCSolidColorLayerImpl::create(1);
     layer->setVisibleLayerRect(visibleLayerRect);
     layer->setBounds(layerSize);
     layer->setDrawOpacity(opacity);
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
index 85daea86b..efb3a6a16 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerImplTest.cpp
@@ -43,7 +43,7 @@ namespace {
 // visibility of the entire layer size.
 static PassOwnPtr<CCTiledLayerImpl> createLayer(const IntSize& tileSize, const IntSize& layerSize, CCLayerTilingData::BorderTexelOption borderTexels)
 {
-    OwnPtr<CCTiledLayerImpl> layer = CCTiledLayerImpl::create(0);
+    OwnPtr<CCTiledLayerImpl> layer = CCTiledLayerImpl::create(1);
     OwnPtr<CCLayerTilingData> tiler = CCLayerTilingData::create(tileSize, borderTexels);
     tiler->setBounds(layerSize);
     layer->setTilingData(*tiler);
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
index 7484b70f3..558cba576 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.cpp
@@ -30,7 +30,7 @@ using namespace WebCore;
 
 namespace WebKitTests {
 
-FakeLayerTextureUpdater::Texture::Texture(FakeLayerTextureUpdater* layer, PassOwnPtr<ManagedTexture> texture)
+FakeLayerTextureUpdater::Texture::Texture(FakeLayerTextureUpdater* layer, PassOwnPtr<CCPrioritizedTexture> texture)
     : LayerTextureUpdater::Texture(texture)
     , m_layer(layer)
 {
@@ -43,7 +43,7 @@ FakeLayerTextureUpdater::Texture::~Texture()
 void FakeLayerTextureUpdater::Texture::updateRect(CCGraphicsContext*, TextureAllocator* allocator, const IntRect&, const IntRect&)
 {
     if (allocator)
-        texture()->allocate(allocator);
+        texture()->acquireBackingTexture(allocator);
     m_layer->updateRect();
 }
 
@@ -63,7 +63,7 @@ FakeLayerTextureUpdater::~FakeLayerTextureUpdater()
 {
 }
 
-void FakeLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize&, float, IntRect& resultingOpaqueRect)
+void FakeLayerTextureUpdater::prepareToUpdate(const IntRect& contentRect, const IntSize&, float, float, IntRect& resultingOpaqueRect)
 {
     m_prepareCount++;
     m_lastUpdateRect = contentRect;
@@ -81,9 +81,9 @@ void FakeLayerTextureUpdater::setRectToInvalidate(const IntRect& rect, FakeTiled
     m_layer = layer;
 }
 
-PassOwnPtr<LayerTextureUpdater::Texture> FakeLayerTextureUpdater::createTexture(TextureManager* manager)
+PassOwnPtr<LayerTextureUpdater::Texture> FakeLayerTextureUpdater::createTexture(CCPrioritizedTextureManager* manager)
 {
-    return adoptPtr(new Texture(this, ManagedTexture::create(manager)));
+    return adoptPtr(new Texture(this, CCPrioritizedTexture::create(manager)));
 }
 
 FakeCCTiledLayerImpl::FakeCCTiledLayerImpl(int id)
@@ -95,7 +95,7 @@ FakeCCTiledLayerImpl::~FakeCCTiledLayerImpl()
 {
 }
 
-FakeTiledLayerChromium::FakeTiledLayerChromium(TextureManager* textureManager)
+FakeTiledLayerChromium::FakeTiledLayerChromium(CCPrioritizedTextureManager* textureManager)
     : TiledLayerChromium()
     , m_fakeTextureUpdater(adoptRef(new FakeLayerTextureUpdater))
     , m_textureManager(textureManager)
@@ -121,7 +121,26 @@ void FakeTiledLayerChromium::update(CCTextureUpdater& updater, const CCOcclusion
     updateLayerRect(updater, visibleLayerRect(), occlusion);
 }
 
-FakeTiledLayerWithScaledBounds::FakeTiledLayerWithScaledBounds(TextureManager* textureManager)
+void FakeTiledLayerChromium::setTexturePriorities(const CCPriorityCalculator& calculator)
+{
+    // Ensure there is always a target render surface available. If none has been
+    // set (the layer is an orphan for the test), then just set a surface on itself.
+    bool missingTargetRenderSurface = !targetRenderSurface();
+
+    if (missingTargetRenderSurface) {
+        createRenderSurface();
+        setTargetRenderSurface(renderSurface());
+    }
+
+    TiledLayerChromium::setTexturePriorities(calculator);
+
+    if (missingTargetRenderSurface) {
+        clearRenderSurface();
+        setTargetRenderSurface(0);
+    }
+}
+
+FakeTiledLayerWithScaledBounds::FakeTiledLayerWithScaledBounds(CCPrioritizedTextureManager* textureManager)
     : FakeTiledLayerChromium(textureManager)
 {
 }
diff --git a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
index 614e1eeb2..53e58b3a7 100644
--- a/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
+++ b/Source/WebKit/chromium/tests/CCTiledLayerTestCommon.h
@@ -30,10 +30,10 @@
 #include "LayerTextureUpdater.h"
 #include "Region.h"
 #include "TextureCopier.h"
-#include "TextureManager.h"
 #include "TextureUploader.h"
 #include "TiledLayerChromium.h"
 #include "cc/CCGraphicsContext.h"
+#include "cc/CCPrioritizedTexture.h"
 #include "cc/CCTextureUpdater.h"
 #include "cc/CCTiledLayerImpl.h"
 
@@ -45,7 +45,7 @@ class FakeLayerTextureUpdater : public WebCore::LayerTextureUpdater {
 public:
     class Texture : public WebCore::LayerTextureUpdater::Texture {
     public:
-        Texture(FakeLayerTextureUpdater*, PassOwnPtr<WebCore::ManagedTexture>);
+        Texture(FakeLayerTextureUpdater*, PassOwnPtr<WebCore::CCPrioritizedTexture>);
         virtual ~Texture();
 
         virtual void updateRect(WebCore::CCGraphicsContext*, WebCore::TextureAllocator* , const WebCore::IntRect&, const WebCore::IntRect&) OVERRIDE;
@@ -58,10 +58,10 @@ public:
     FakeLayerTextureUpdater();
     virtual ~FakeLayerTextureUpdater();
 
-    virtual PassOwnPtr<WebCore::LayerTextureUpdater::Texture> createTexture(WebCore::TextureManager*) OVERRIDE;
+    virtual PassOwnPtr<WebCore::LayerTextureUpdater::Texture> createTexture(WebCore::CCPrioritizedTextureManager*) OVERRIDE;
     virtual SampledTexelFormat sampledTexelFormat(GC3Denum) OVERRIDE { return SampledTexelFormatRGBA; }
 
-    virtual void prepareToUpdate(const WebCore::IntRect& contentRect, const WebCore::IntSize&, float, WebCore::IntRect& resultingOpaqueRect) OVERRIDE;
+    virtual void prepareToUpdate(const WebCore::IntRect& contentRect, const WebCore::IntSize&, float, float, WebCore::IntRect& resultingOpaqueRect) OVERRIDE;
     // Sets the rect to invalidate during the next call to prepareToUpdate(). After the next
     // call to prepareToUpdate() the rect is reset.
     void setRectToInvalidate(const WebCore::IntRect&, FakeTiledLayerChromium*);
@@ -105,14 +105,13 @@ public:
 
 class FakeTiledLayerChromium : public WebCore::TiledLayerChromium {
 public:
-    explicit FakeTiledLayerChromium(WebCore::TextureManager*);
+    explicit FakeTiledLayerChromium(WebCore::CCPrioritizedTextureManager*);
     virtual ~FakeTiledLayerChromium();
 
     static WebCore::IntSize tileSize() { return WebCore::IntSize(100, 100); }
 
     using WebCore::TiledLayerChromium::invalidateRect;
     using WebCore::TiledLayerChromium::updateLayerRect;
-    using WebCore::TiledLayerChromium::idleUpdateLayerRect;
     using WebCore::TiledLayerChromium::needsIdlePaint;
     using WebCore::TiledLayerChromium::skipsDraw;
     using WebCore::TiledLayerChromium::numPaintedTiles;
@@ -124,22 +123,25 @@ public:
     // Updates the visibleLayerRect().
     virtual void update(WebCore::CCTextureUpdater&, const WebCore::CCOcclusionTracker*) OVERRIDE;
 
-    virtual WebCore::TextureManager* textureManager() const OVERRIDE { return m_textureManager; }
+    virtual void setTexturePriorities(const WebCore::CCPriorityCalculator&) OVERRIDE;
+
+    virtual WebCore::CCPrioritizedTextureManager* textureManager() const OVERRIDE { return m_textureManager; }
     FakeLayerTextureUpdater* fakeLayerTextureUpdater() { return m_fakeTextureUpdater.get(); }
     WebCore::FloatRect updateRect() { return m_updateRect; }
 
-private:
+protected:
     virtual WebCore::LayerTextureUpdater* textureUpdater() const OVERRIDE { return m_fakeTextureUpdater.get(); }
     virtual void createTextureUpdaterIfNeeded() OVERRIDE { }
 
+private:
     RefPtr<FakeLayerTextureUpdater> m_fakeTextureUpdater;
-    WebCore::TextureManager* m_textureManager;
+    WebCore::CCPrioritizedTextureManager* m_textureManager;
     WebCore::FloatRect m_lastNeedsDisplayRect;
 };
 
 class FakeTiledLayerWithScaledBounds : public FakeTiledLayerChromium {
 public:
-    explicit FakeTiledLayerWithScaledBounds(WebCore::TextureManager*);
+    explicit FakeTiledLayerWithScaledBounds(WebCore::CCPrioritizedTextureManager*);
 
     void setContentBounds(const WebCore::IntSize& contentBounds) { m_forcedContentBounds = contentBounds; }
     virtual WebCore::IntSize contentBounds() const OVERRIDE { return m_forcedContentBounds; }
diff --git a/Source/WebKit/chromium/tests/ContentLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/ContentLayerChromiumTest.cpp
new file mode 100644
index 000000000..750418535
--- /dev/null
+++ b/Source/WebKit/chromium/tests/ContentLayerChromiumTest.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ContentLayerChromium.h"
+
+#include "BitmapCanvasLayerTextureUpdater.h"
+#include "CCLayerTreeTestCommon.h"
+#include "GraphicsContext.h"
+#include "OpaqueRectTrackingContentLayerDelegate.h"
+#include "skia/ext/platform_canvas.h"
+
+#include <gtest/gtest.h>
+#include <public/WebFloatRect.h>
+#include <public/WebRect.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RefPtr.h>
+
+using namespace WebCore;
+using namespace WebKit;
+
+namespace {
+
+class OpaqueRectDrawingGraphicsContextPainter : public GraphicsContextPainter {
+public:
+    explicit OpaqueRectDrawingGraphicsContextPainter(const IntRect& opaqueRect, const IntRect& contentRect)
+        : m_opaqueRect(opaqueRect)
+        , m_contentRect(contentRect)
+    {
+    }
+
+    virtual ~OpaqueRectDrawingGraphicsContextPainter()
+    {
+    }
+
+    virtual void paint(GraphicsContext& context, const IntRect& clip) OVERRIDE
+    {
+        Color alpha(0, 0, 0, 0);
+        context.fillRect(m_contentRect, alpha, ColorSpaceDeviceRGB);
+
+        Color white(255, 255, 255, 255);
+        context.fillRect(m_opaqueRect, white, ColorSpaceDeviceRGB);
+    }
+
+private:
+    IntRect m_opaqueRect;
+    IntRect m_contentRect;
+};
+
+class MockContentLayerDelegate : public ContentLayerDelegate {
+public:
+    explicit MockContentLayerDelegate(OpaqueRectTrackingContentLayerDelegate* client)
+        : m_client(client)
+    {
+    }
+
+    virtual void paintContents(SkCanvas* canvas, const IntRect& clip, FloatRect& opaque) OVERRIDE
+    {
+        WebFloatRect resultingOpaqueRect(opaque.x(), opaque.y(), opaque.width(), opaque.height());
+        WebRect webClipRect(clip.x(), clip.y(), clip.width(), clip.height());
+        m_client->paintContents(canvas, webClipRect, resultingOpaqueRect);
+        opaque = FloatRect(resultingOpaqueRect.x, resultingOpaqueRect.y, resultingOpaqueRect.width, resultingOpaqueRect.height);
+    }
+
+private:
+    OpaqueRectTrackingContentLayerDelegate* m_client;
+};
+
+TEST(ContentLayerChromiumTest, ContentLayerPainterWithDeviceScale)
+{
+    float contentsScale = 2;
+    IntRect contentRect(10, 10, 100, 100);
+    IntRect opaqueRectInLayerSpace(5, 5, 20, 20);
+    IntRect opaqueRectInContentSpace = opaqueRectInLayerSpace;
+    opaqueRectInContentSpace.scale(contentsScale);
+    OwnPtr<SkCanvas> canvas = adoptPtr(skia::CreateBitmapCanvas(contentRect.width(), contentRect.height(), false));
+    OpaqueRectDrawingGraphicsContextPainter painter(opaqueRectInLayerSpace, contentRect);
+    OpaqueRectTrackingContentLayerDelegate opaqueRectTrackingContentLayerDelegate(&painter);
+    MockContentLayerDelegate delegate(&opaqueRectTrackingContentLayerDelegate);
+    RefPtr<BitmapCanvasLayerTextureUpdater> updater = BitmapCanvasLayerTextureUpdater::create(ContentLayerPainter::create(&delegate), false);
+
+    IntRect resultingOpaqueRect;
+    updater->prepareToUpdate(contentRect, IntSize(256, 256), contentsScale, contentsScale, resultingOpaqueRect);
+
+    EXPECT_INT_RECT_EQ(opaqueRectInContentSpace, resultingOpaqueRect);
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/DateTimeFormatTest.cpp b/Source/WebKit/chromium/tests/DateTimeFormatTest.cpp
new file mode 100644
index 000000000..1c006abaf
--- /dev/null
+++ b/Source/WebKit/chromium/tests/DateTimeFormatTest.cpp
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateTimeFormat.h"
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+#include <gtest/gtest.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+
+using namespace WebCore;
+
+class DateTimeFormatTest : public ::testing::Test {
+public:
+    typedef DateTimeFormat::FieldType FieldType;
+
+    struct Token {
+        String string;
+        int count;
+        FieldType fieldType;
+
+        Token(FieldType fieldType, int count = 1)
+            : count(count)
+            , fieldType(fieldType)
+        {
+            ASSERT(fieldType != DateTimeFormat::FieldTypeLiteral);
+        }
+
+        Token(const String& string)
+            : string(string)
+            , count(0)
+            , fieldType(DateTimeFormat::FieldTypeLiteral)
+        {
+        }
+
+        bool operator==(const Token& other) const
+        {
+            return fieldType == other.fieldType && count == other.count && string == other.string;
+        }
+
+        String toString() const
+        {
+            switch (fieldType) {
+            case DateTimeFormat::FieldTypeInvalid:
+                return "*invalid*";
+            case DateTimeFormat::FieldTypeLiteral: {
+                StringBuilder builder;
+                builder.append('"');
+                builder.append(string);
+                builder.append('"');
+                return builder.toString();
+            }
+            default:
+                return String::format("Token(%d, %d)", fieldType, count);
+            }
+        }
+    };
+
+    class Tokens {
+    public:
+        Tokens() { }
+
+        explicit Tokens(const Vector<Token> tokens)
+            : m_tokens(tokens)
+        {
+        }
+
+        explicit Tokens(const String& string)
+        {
+            m_tokens.append(Token(string));
+        }
+
+        explicit Tokens(Token token1)
+        {
+            m_tokens.append(token1);
+        }
+
+        Tokens(Token token1, Token token2)
+        {
+            m_tokens.append(token1);
+            m_tokens.append(token2);
+        }
+
+        Tokens(Token token1, Token token2, Token token3)
+        {
+            m_tokens.append(token1);
+            m_tokens.append(token2);
+            m_tokens.append(token3);
+        }
+
+        Tokens(Token token1, Token token2, Token token3, Token token4)
+        {
+            m_tokens.append(token1);
+            m_tokens.append(token2);
+            m_tokens.append(token3);
+            m_tokens.append(token4);
+        }
+
+        Tokens(Token token1, Token token2, Token token3, Token token4, Token token5)
+        {
+            m_tokens.append(token1);
+            m_tokens.append(token2);
+            m_tokens.append(token3);
+            m_tokens.append(token4);
+            m_tokens.append(token5);
+        }
+
+        Tokens(Token token1, Token token2, Token token3, Token token4, Token token5, Token token6)
+        {
+            m_tokens.append(token1);
+            m_tokens.append(token2);
+            m_tokens.append(token3);
+            m_tokens.append(token4);
+            m_tokens.append(token5);
+            m_tokens.append(token6);
+        }
+
+        bool operator==(const Tokens& other) const
+        {
+            return m_tokens == other.m_tokens;
+        }
+
+        String toString() const
+        {
+            StringBuilder builder;
+            builder.append("Tokens(");
+            for (unsigned index = 0; index < m_tokens.size(); ++index) {
+                if (index)
+                    builder.append(",");
+                builder.append(m_tokens[index].toString());
+            }
+            builder.append(")");
+            return builder.toString();
+        }
+
+    private:
+        Vector<Token> m_tokens;
+    };
+
+protected:
+    Tokens parse(const String& formatString)
+    {
+        TokenHandler handler;
+        if (!DateTimeFormat::parse(formatString, handler))
+            return Tokens(Token("*failed*"));
+        return handler.tokens();
+    }
+
+    FieldType single(const char ch)
+    {
+        char formatString[2];
+        formatString[0] = ch;
+        formatString[1] = 0;
+        TokenHandler handler;
+        if (!DateTimeFormat::parse(formatString, handler))
+            return DateTimeFormat::FieldTypeInvalid;
+        return handler.fieldType(0);
+    }
+
+private:
+    class TokenHandler : public DateTimeFormat::TokenHandler {
+    public:
+        virtual ~TokenHandler() { }
+
+        FieldType fieldType(int index) const
+        {
+            return index >=0 && index < static_cast<int>(m_tokens.size()) ? m_tokens[index].fieldType : DateTimeFormat::FieldTypeInvalid;
+        }
+
+        Tokens tokens() const { return Tokens(m_tokens); }
+
+    private:
+        virtual void visitField(FieldType fieldType, int count) OVERRIDE
+        {
+            m_tokens.append(Token(fieldType, count));
+        }
+
+        virtual void visitLiteral(const String& string) OVERRIDE
+        {
+            m_tokens.append(Token(string));
+        }
+
+        Vector<Token> m_tokens;
+    };
+};
+
+std::ostream& operator<<(std::ostream& os, const DateTimeFormatTest::Tokens& tokens)
+{
+    return os << tokens.toString().ascii().data();
+}
+
+TEST_F(DateTimeFormatTest, CommonPattern)
+{
+    EXPECT_EQ(Tokens(), parse(""));
+
+    EXPECT_EQ(
+        Tokens(
+            Token(DateTimeFormat::FieldTypeYear, 4), Token("-"),
+            Token(DateTimeFormat::FieldTypeMonth, 2), Token("-"),
+            Token(DateTimeFormat::FieldTypeDayOfMonth, 2)),
+        parse("yyyy-MM-dd"));
+
+    EXPECT_EQ(
+        Tokens(
+            Token(DateTimeFormat::FieldTypeHour24, 2), Token(":"),
+            Token(DateTimeFormat::FieldTypeMinute, 2), Token(":"),
+            Token(DateTimeFormat::FieldTypeSecond, 2)),
+        parse("kk:mm:ss"));
+
+    EXPECT_EQ(
+        Tokens(
+            Token(DateTimeFormat::FieldTypeHour12), Token(":"),
+            Token(DateTimeFormat::FieldTypeMinute), Token(" "),
+            Token(DateTimeFormat::FieldTypePeriod)),
+        parse("h:m a"));
+
+    EXPECT_EQ(
+        Tokens(
+            Token(DateTimeFormat::FieldTypeYear), Token("Nen "),
+            Token(DateTimeFormat::FieldTypeMonth), Token("Getsu "),
+            Token(DateTimeFormat::FieldTypeDayOfMonth), Token("Nichi")),
+        parse("y'Nen' M'Getsu' d'Nichi'"));
+}
+
+TEST_F(DateTimeFormatTest, MissingClosingQuote)
+{
+    EXPECT_EQ(Tokens("*failed*"), parse("'foo"));
+    EXPECT_EQ(Tokens("*failed*"), parse("fo'o"));
+    EXPECT_EQ(Tokens("*failed*"), parse("foo'"));
+}
+
+TEST_F(DateTimeFormatTest, Quote)
+{
+    EXPECT_EQ(Tokens("FooBar"), parse("'FooBar'"));
+    EXPECT_EQ(Tokens("'"), parse("''"));
+    EXPECT_EQ(Tokens("'-'"), parse("''-''"));
+    EXPECT_EQ(Tokens("Foo'Bar"), parse("'Foo''Bar'"));
+    EXPECT_EQ(
+        Tokens(Token(DateTimeFormat::FieldTypeEra), Token("'s")),
+        parse("G'''s'"));
+    EXPECT_EQ(
+        Tokens(Token(DateTimeFormat::FieldTypeEra), Token("'"), Token(DateTimeFormat::FieldTypeSecond)),
+        parse("G''s"));
+}
+
+TEST_F(DateTimeFormatTest, SingleLowerCaseCharacter)
+{
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('b'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeLocalDayOfWeekStandAlon, single('c'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeDayOfMonth, single('d'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeLocalDayOfWeek, single('e'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeModifiedJulianDay, single('g'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeHour12, single('h'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeHour24, single('k'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeMinute, single('m'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeQuaterStandAlone, single('q'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeSecond, single('s'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeExtendedYear, single('u'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeNonLocationZone, single('v'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeWeekOfMonth, single('w'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeYear, single('y'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeZone, single('z'));
+}
+
+TEST_F(DateTimeFormatTest, SingleLowerCaseInvalid)
+{
+    EXPECT_EQ(DateTimeFormat::FieldTypePeriod, single('a'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('f'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('i'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('j'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('l'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('n'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('o'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('p'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('r'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('t'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('x'));
+}
+
+TEST_F(DateTimeFormatTest, SingleUpperCaseCharacter)
+{
+    EXPECT_EQ(DateTimeFormat::FieldTypeMillisecondsInDay, single('A'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeDayOfYear, single('D'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeDayOfWeek, single('E'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeDayOfWeekInMonth, single('F'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeEra, single('G'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeHour23, single('H'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeHour11, single('K'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeMonthStandAlone, single('L'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeMonth, single('M'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeQuater, single('Q'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeFractionalSecond, single('S'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeWeekOfYear, single('W'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeYearOfWeekOfYear, single('Y'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeRFC822Zone, single('Z'));
+}
+
+TEST_F(DateTimeFormatTest, SingleUpperCaseInvalid)
+{
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('B'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('C'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('I'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('J'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('N'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('O'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('P'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('R'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('T'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('U'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('V'));
+    EXPECT_EQ(DateTimeFormat::FieldTypeInvalid, single('X'));
+}
+
+#endif
diff --git a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
index 1979d935c..4fb15d1eb 100644
--- a/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/GraphicsLayerChromiumTest.cpp
@@ -256,6 +256,50 @@ TEST_F(GraphicsLayerChromiumTest, createTransformAnimationWithBigRotation)
     EXPECT_FALSE(m_platformLayer->layerAnimationController()->hasActiveAnimation());
 }
 
+TEST_F(GraphicsLayerChromiumTest, createTransformAnimationWithRotationInvolvingNegativeAngles)
+{
+    const double duration = 1;
+    WebCore::KeyframeValueList values(AnimatedPropertyWebkitTransform);
+
+    TransformOperations operations1;
+    operations1.operations().append(RotateTransformOperation::create(-330, TransformOperation::ROTATE));
+    values.insert(new TransformAnimationValue(0, &operations1));
+
+    TransformOperations operations2;
+    operations2.operations().append(RotateTransformOperation::create(-320, TransformOperation::ROTATE));
+    values.insert(new TransformAnimationValue(duration, &operations2));
+
+    RefPtr<Animation> animation = Animation::create();
+    animation->setDuration(duration);
+
+    IntSize boxSize;
+    m_graphicsLayer->addAnimation(values, boxSize, animation.get(), "", 0);
+
+    EXPECT_TRUE(m_platformLayer->layerAnimationController()->hasActiveAnimation());
+}
+
+TEST_F(GraphicsLayerChromiumTest, createTransformAnimationWithSmallRotationInvolvingLargeAngles)
+{
+    const double duration = 1;
+    WebCore::KeyframeValueList values(AnimatedPropertyWebkitTransform);
+
+    TransformOperations operations1;
+    operations1.operations().append(RotateTransformOperation::create(270, TransformOperation::ROTATE));
+    values.insert(new TransformAnimationValue(0, &operations1));
+
+    TransformOperations operations2;
+    operations2.operations().append(RotateTransformOperation::create(360, TransformOperation::ROTATE));
+    values.insert(new TransformAnimationValue(duration, &operations2));
+
+    RefPtr<Animation> animation = Animation::create();
+    animation->setDuration(duration);
+
+    IntSize boxSize;
+    m_graphicsLayer->addAnimation(values, boxSize, animation.get(), "", 0);
+
+    EXPECT_TRUE(m_platformLayer->layerAnimationController()->hasActiveAnimation());
+}
+
 TEST_F(GraphicsLayerChromiumTest, createTransformAnimationWithSingularMatrix)
 {
     const double duration = 1;
diff --git a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
index 6c78aa53c..f53ad50d1 100644
--- a/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBAbortOnCorruptTest.cpp
@@ -57,6 +57,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBKey>) { }
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) { }
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) { }
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, const IDBKeyPath&) { }
     virtual void onSuccessWithContinuation() { }
     virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<SerializedScriptValue> >&) { }
     virtual void onBlocked() { }
diff --git a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
index 17dd24bc6..eb3c85abc 100644
--- a/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
+++ b/Source/WebKit/chromium/tests/IDBDatabaseBackendTest.cpp
@@ -84,6 +84,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBKey>) OVERRIDE { }
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) OVERRIDE { }
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) OVERRIDE { }
+    virtual void onSuccess(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, const IDBKeyPath&) OVERRIDE { };
     virtual void onSuccessWithContinuation() OVERRIDE { }
     virtual void onSuccessWithPrefetch(const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<IDBKey> >&, const Vector<RefPtr<SerializedScriptValue> >&) OVERRIDE { }
     virtual void onBlocked() OVERRIDE { }
diff --git a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
index 4a92b1509..e7c655247 100644
--- a/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerChromiumTest.cpp
@@ -70,7 +70,7 @@ private:
 
 class MockLayerPainterChromium : public LayerPainterChromium {
 public:
-    virtual void paint(SkCanvas*, const IntRect&, IntRect&) { }
+    virtual void paint(SkCanvas*, const IntRect&, FloatRect&) OVERRIDE { }
 };
 
 
@@ -509,7 +509,7 @@ TEST_F(LayerChromiumTest, checkPropertyChangeCausesCorrectBehavior)
     // All properties need to be set to new values in order for setNeedsCommit to be called.
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setAnchorPoint(FloatPoint(1.23f, 4.56f)));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setAnchorPointZ(0.7f));
-    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setBackgroundColor(Color(0.4f, 0.4f, 0.4f, 1.0f)));
+    EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setBackgroundColor(SK_ColorLTGRAY));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setMasksToBounds(true));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setMaskLayer(dummyLayer.get()));
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(1, testLayer->setOpacity(0.5f));
diff --git a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
index cfdcdc156..9c9ec25b0 100644
--- a/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/LayerRendererChromiumTest.cpp
@@ -79,7 +79,7 @@ public:
         , m_memoryAllocationLimitBytes(0)
     {
         m_rootLayer->createRenderSurface();
-        m_rootRenderPass = CCRenderPass::create(m_rootLayer->renderSurface());
+        m_rootRenderPass = CCRenderPass::create(m_rootLayer->renderSurface(), m_rootLayer->id());
     }
 
     // CCRendererClient methods.
diff --git a/Source/WebKit/chromium/tests/LocaleMacTest.cpp b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
new file mode 100644
index 000000000..1150a301a
--- /dev/null
+++ b/Source/WebKit/chromium/tests/LocaleMacTest.cpp
@@ -0,0 +1,210 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ */
+
+#include "config.h"
+#include "LocaleMac.h"
+
+#include "DateComponents.h"
+#include <gtest/gtest.h>
+#include <wtf/DateMath.h>
+#include <wtf/MathExtras.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/CString.h>
+
+using namespace WebCore;
+
+class LocaleMacTest : public ::testing::Test {
+protected:
+    enum {
+        January = 0, February, March,
+        April, May, June,
+        July, August, September,
+        October, November, December,
+    };
+
+    enum {
+        Sunday = 0, Monday, Tuesday,
+        Wednesday, Thursday, Friday,
+        Saturday,
+    };
+
+    DateComponents dateComponents(int year, int month, int day)
+    {
+        DateComponents date;
+        date.setMillisecondsSinceEpochForDate(msForDate(year, month, day));
+        return date;
+    }
+
+    double msForDate(int year, int month, int day)
+    {
+        return dateToDaysFrom1970(year, month, day) * msPerDay;
+    }
+
+    String formatDate(const String& localeString, int year, int month, int day)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->formatDate(dateComponents(year, month, day));
+    }
+
+    double parseDate(const String& localeString, const String& dateString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->parseDate(dateString);
+    }
+
+#if ENABLE(CALENDAR_PICKER)
+    String dateFormatText(const String& localeString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->dateFormatText();
+    }
+
+    unsigned firstDayOfWeek(const String& localeString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->firstDayOfWeek();
+    }
+
+    String monthLabel(const String& localeString, unsigned index)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->monthLabels()[index];
+    }
+
+    String weekDayShortLabel(const String& localeString, unsigned index)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->weekDayShortLabels()[index];
+    }
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String timeFormatText(const String& localeString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->timeFormatText();
+    }
+
+    String shortTimeFormatText(const String& localeString)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->shortTimeFormatText();
+    }
+
+    String timeAMPMLabel(const String& localeString, unsigned index)
+    {
+        OwnPtr<LocaleMac> locale = LocaleMac::create(localeString);
+        return locale->timeAMPMLabels()[index];
+    }
+#endif
+};
+
+TEST_F(LocaleMacTest, formatDate)
+{
+    EXPECT_STREQ("4/27/05", formatDate("en_US", 2005, April, 27).utf8().data());
+    EXPECT_STREQ("27/04/05", formatDate("fr_FR", 2005, April, 27).utf8().data());
+    EXPECT_STREQ("05/04/27", formatDate("ja_JP", 2005, April, 27).utf8().data());
+}
+
+TEST_F(LocaleMacTest, parseDate)
+{
+    EXPECT_EQ(msForDate(2005, April, 27), parseDate("en_US", "April 27, 2005"));
+    EXPECT_EQ(msForDate(2005, April, 27), parseDate("fr_FR", "27 avril 2005"));
+    EXPECT_EQ(msForDate(2005, April, 27), parseDate("ja_JP", "2005/04/27"));
+}
+
+#if ENABLE(CALENDAR_PICKER)
+TEST_F(LocaleMacTest, dateFormatText)
+{
+    EXPECT_STREQ("Month/Day/Year", dateFormatText("en_US").utf8().data());
+    EXPECT_STREQ("Day/Month/Year", dateFormatText("fr_FR").utf8().data());
+    EXPECT_STREQ("Year/Month/Day", dateFormatText("ja_JP").utf8().data());
+}
+
+TEST_F(LocaleMacTest, firstDayOfWeek)
+{
+    EXPECT_EQ(Sunday, firstDayOfWeek("en_US"));
+    EXPECT_EQ(Monday, firstDayOfWeek("fr_FR"));
+    EXPECT_EQ(Sunday, firstDayOfWeek("ja_JP"));
+}
+
+TEST_F(LocaleMacTest, monthLabels)
+{
+    EXPECT_STREQ("January", monthLabel("en_US", January).utf8().data());
+    EXPECT_STREQ("June", monthLabel("en_US", June).utf8().data());
+    EXPECT_STREQ("December", monthLabel("en_US", December).utf8().data());
+
+    EXPECT_STREQ("janvier", monthLabel("fr_FR", January).utf8().data());
+    EXPECT_STREQ("juin", monthLabel("fr_FR", June).utf8().data());
+    EXPECT_STREQ("d\xC3\xA9" "cembre", monthLabel("fr_FR", December).utf8().data());
+
+    EXPECT_STREQ("1\xE6\x9C\x88", monthLabel("ja_JP", January).utf8().data());
+    EXPECT_STREQ("6\xE6\x9C\x88", monthLabel("ja_JP", June).utf8().data());
+    EXPECT_STREQ("12\xE6\x9C\x88", monthLabel("ja_JP", December).utf8().data());
+}
+
+TEST_F(LocaleMacTest, weekDayShortLabels)
+{
+    EXPECT_STREQ("Sun", weekDayShortLabel("en_US", Sunday).utf8().data());
+    EXPECT_STREQ("Wed", weekDayShortLabel("en_US", Wednesday).utf8().data());
+    EXPECT_STREQ("Sat", weekDayShortLabel("en_US", Saturday).utf8().data());
+
+    EXPECT_STREQ("dim.", weekDayShortLabel("fr_FR", Sunday).utf8().data());
+    EXPECT_STREQ("mer.", weekDayShortLabel("fr_FR", Wednesday).utf8().data());
+    EXPECT_STREQ("sam.", weekDayShortLabel("fr_FR", Saturday).utf8().data());
+
+    EXPECT_STREQ("\xE6\x97\xA5", weekDayShortLabel("ja_JP", Sunday).utf8().data());
+    EXPECT_STREQ("\xE6\xB0\xB4", weekDayShortLabel("ja_JP", Wednesday).utf8().data());
+    EXPECT_STREQ("\xE5\x9C\x9F", weekDayShortLabel("ja_JP", Saturday).utf8().data());
+}
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+TEST_F(LocaleMacTest, timeFormatText)
+{
+    EXPECT_STREQ("h:mm:ss a", timeFormatText("en_US").utf8().data());
+    EXPECT_STREQ("HH:mm:ss", timeFormatText("fr_FR").utf8().data());
+    EXPECT_STREQ("H:mm:ss", timeFormatText("ja_JP").utf8().data());
+}
+
+TEST_F(LocaleMacTest, shortTimeFormatText)
+{
+    EXPECT_STREQ("h:mm a", shortTimeFormatText("en_US").utf8().data());
+    EXPECT_STREQ("HH:mm", shortTimeFormatText("fr_FR").utf8().data());
+    EXPECT_STREQ("H:mm", shortTimeFormatText("ja_JP").utf8().data());
+}
+
+TEST_F(LocaleMacTest, timeAMPMLabels)
+{
+    EXPECT_STREQ("AM", timeAMPMLabel("en_US", 0).utf8().data());
+    EXPECT_STREQ("PM", timeAMPMLabel("en_US", 1).utf8().data());
+
+    EXPECT_STREQ("AM", timeAMPMLabel("fr_FR", 0).utf8().data());
+    EXPECT_STREQ("PM", timeAMPMLabel("fr_FR", 1).utf8().data());
+
+    EXPECT_STREQ("\xE5\x8D\x88\xE5\x89\x8D", timeAMPMLabel("ja_JP", 0).utf8().data());
+    EXPECT_STREQ("\xE5\x8D\x88\xE5\xBE\x8C", timeAMPMLabel("ja_JP", 1).utf8().data());
+}
+#endif
diff --git a/Source/WebKit/chromium/tests/LocaleWinTest.cpp b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
index d64e902a5..8da2f4461 100644
--- a/Source/WebKit/chromium/tests/LocaleWinTest.cpp
+++ b/Source/WebKit/chromium/tests/LocaleWinTest.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "LocaleWin.h"
 
+#include "DateComponents.h"
 #include <gtest/gtest.h>
 #include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
@@ -40,19 +41,100 @@
 using namespace WebCore;
 using namespace std;
 
-enum {
-    January = 0, February, March,
-    April, May, June,
-    July, August, September,
-    October, November, December,
-};
+class LocaleWinTest : public ::testing::Test {
+protected:
+    enum {
+        January = 0, February, March,
+        April, May, June,
+        July, August, September,
+        October, November, December,
+    };
 
-static double msForDate(int year, int month, int day)
-{
-    return dateToDaysFrom1970(year, month, day) * msPerDay;
-}
+    enum {
+        Sunday = 0, Monday, Tuesday,
+        Wednesday, Thursday, Friday,
+        Saturday,
+    };
+
+    // See http://msdn.microsoft.com/en-us/goglobal/bb964664.aspx
+    enum {
+        EnglishUS = 0x409,
+        FrenchFR = 0x40C,
+        JapaneseJP = 0x411,
+    };
+
+    DateComponents dateComponents(int year, int month, int day)
+    {
+        DateComponents date;
+        date.setMillisecondsSinceEpochForDate(msForDate(year, month, day));
+        return date;
+    }
+
+    double msForDate(int year, int month, int day)
+    {
+        return dateToDaysFrom1970(year, month, day) * msPerDay;
+    }
+
+    String formatDate(LCID lcid, int year, int month, int day)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->formatDate(dateComponents(year, month, day));
+    }
+
+    double parseDate(LCID lcid, const String& dateString)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->parseDate(dateString);
+    }
+
+#if ENABLE(CALENDAR_PICKER)
+    String dateFormatText(LCID lcid)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->dateFormatText();
+    }
+
+    unsigned firstDayOfWeek(LCID lcid)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->firstDayOfWeek();
+    }
+
+    String monthLabel(LCID lcid, unsigned index)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->monthLabels()[index];
+    }
+
+    String weekDayShortLabel(LCID lcid, unsigned index)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->weekDayShortLabels()[index];
+    }
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+    String timeFormatText(LCID lcid)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->timeFormatText();
+    }
 
-TEST(LocaleWinTest, TestLocalizedDateFormatText)
+    String shortTimeFormatText(LCID lcid)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->shortTimeFormatText();
+    }
+
+    String timeAMPMLabel(LCID lcid, unsigned index)
+    {
+        OwnPtr<LocaleWin> locale = LocaleWin::create(lcid);
+        return locale->timeAMPMLabels()[index];
+    }
+#endif
+};
+
+TEST_F(LocaleWinTest, TestLocalizedDateFormatText)
 {
     EXPECT_STREQ("year/month/day", LocaleWin::dateFormatText("y/M/d", "year", "month", "day").utf8().data());
     EXPECT_STREQ("year/month/day", LocaleWin::dateFormatText("yy/MM/dd", "year", "month", "day").utf8().data());
@@ -66,9 +148,8 @@ TEST(LocaleWinTest, TestLocalizedDateFormatText)
     EXPECT_STREQ("YY/mm/DD", LocaleWin::dateFormatText("YY/mm/DD", "year", "month", "day").utf8().data());
 }
 
-TEST(LocaleWinTest, TestFormat)
+TEST_F(LocaleWinTest, TestFormat)
 {
-    const LCID EnglishUS = 0x0409;
     OwnPtr<LocaleWin> locale = LocaleWin::create(EnglishUS);
 
     EXPECT_STREQ("4/7/2", locale->formatDate("M/d/y", 2012, 2012, April, 7).utf8().data());
@@ -126,9 +207,8 @@ TEST(LocaleWinTest, TestFormat)
     
 }
 
-TEST(LocaleWinTest, TestParse)
+TEST_F(LocaleWinTest, TestParse)
 {
-    const LCID EnglishUS = 0x0409;
     OwnPtr<LocaleWin> locale = LocaleWin::create(EnglishUS);
 
     EXPECT_EQ(msForDate(2012, April, 27), locale->parseDate("MM/dd/yy", 2012, "04/27/12"));
@@ -161,3 +241,91 @@ TEST(LocaleWinTest, TestParse)
     EXPECT_TRUE(isnan(locale->parseDate("MMMM/d/y", 2012, "November 32 2")));
     EXPECT_TRUE(isnan(locale->parseDate("MMMM/d/y", 2012, "-1/-1/-1")));
 }
+
+TEST_F(LocaleWinTest, formatDate)
+{
+    EXPECT_STREQ("4/27/2005", formatDate(EnglishUS, 2005, April, 27).utf8().data());
+    EXPECT_STREQ("27/04/2005", formatDate(FrenchFR, 2005, April, 27).utf8().data());
+    EXPECT_STREQ("2005/04/27", formatDate(JapaneseJP, 2005, April, 27).utf8().data());
+}
+
+TEST_F(LocaleWinTest, parseDate)
+{
+    EXPECT_EQ(msForDate(2005, April, 27), parseDate(EnglishUS, "April/27/2005"));
+    EXPECT_EQ(msForDate(2005, April, 27), parseDate(FrenchFR, "27/avril/2005"));
+    EXPECT_EQ(msForDate(2005, April, 27), parseDate(JapaneseJP, "2005/04/27"));
+}
+
+#if ENABLE(CALENDAR_PICKER)
+TEST_F(LocaleWinTest, dateFormatText)
+{
+    EXPECT_STREQ("Month/Day/Year", dateFormatText(EnglishUS).utf8().data());
+    EXPECT_STREQ("Day/Month/Year", dateFormatText(FrenchFR).utf8().data());
+    EXPECT_STREQ("Year/Month/Day", dateFormatText(JapaneseJP).utf8().data());
+}
+
+TEST_F(LocaleWinTest, firstDayOfWeek)
+{
+    EXPECT_EQ(Sunday, firstDayOfWeek(EnglishUS));
+    EXPECT_EQ(Monday, firstDayOfWeek(FrenchFR));
+    EXPECT_EQ(Sunday, firstDayOfWeek(JapaneseJP));
+}
+
+TEST_F(LocaleWinTest, monthLabels)
+{
+    EXPECT_STREQ("January", monthLabel(EnglishUS, January).utf8().data());
+    EXPECT_STREQ("June", monthLabel(EnglishUS, June).utf8().data());
+    EXPECT_STREQ("December", monthLabel(EnglishUS, December).utf8().data());
+
+    EXPECT_STREQ("janvier", monthLabel(FrenchFR, January).utf8().data());
+    EXPECT_STREQ("juin", monthLabel(FrenchFR, June).utf8().data());
+    EXPECT_STREQ("d\xC3\xA9" "cembre", monthLabel(FrenchFR, December).utf8().data());
+
+    EXPECT_STREQ("1\xE6\x9C\x88", monthLabel(JapaneseJP, January).utf8().data());
+    EXPECT_STREQ("6\xE6\x9C\x88", monthLabel(JapaneseJP, June).utf8().data());
+    EXPECT_STREQ("12\xE6\x9C\x88", monthLabel(JapaneseJP, December).utf8().data());
+}
+
+TEST_F(LocaleWinTest, weekDayShortLabels)
+{
+    EXPECT_STREQ("Sun", weekDayShortLabel(EnglishUS, Sunday).utf8().data());
+    EXPECT_STREQ("Wed", weekDayShortLabel(EnglishUS, Wednesday).utf8().data());
+    EXPECT_STREQ("Sat", weekDayShortLabel(EnglishUS, Saturday).utf8().data());
+
+    EXPECT_STREQ("dim.", weekDayShortLabel(FrenchFR, Sunday).utf8().data());
+    EXPECT_STREQ("mer.", weekDayShortLabel(FrenchFR, Wednesday).utf8().data());
+    EXPECT_STREQ("sam.", weekDayShortLabel(FrenchFR, Saturday).utf8().data());
+
+    EXPECT_STREQ("\xE6\x97\xA5", weekDayShortLabel(JapaneseJP, Sunday).utf8().data());
+    EXPECT_STREQ("\xE6\xB0\xB4", weekDayShortLabel(JapaneseJP, Wednesday).utf8().data());
+    EXPECT_STREQ("\xE5\x9C\x9F", weekDayShortLabel(JapaneseJP, Saturday).utf8().data());
+}
+#endif
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+TEST_F(LocaleWinTest, timeFormatText)
+{
+    EXPECT_STREQ("h:mm:ss a", timeFormatText(EnglishUS).utf8().data());
+    EXPECT_STREQ("HH:mm:ss", timeFormatText(FrenchFR).utf8().data());
+    EXPECT_STREQ("H:mm:ss", timeFormatText(JapaneseJP).utf8().data());
+}
+
+TEST_F(LocaleWinTest, shortTimeFormatText)
+{
+    EXPECT_STREQ("h:mm:ss a", shortTimeFormatText(EnglishUS).utf8().data());
+    EXPECT_STREQ("HH:mm:ss", shortTimeFormatText(FrenchFR).utf8().data());
+    EXPECT_STREQ("H:mm:ss", shortTimeFormatText(JapaneseJP).utf8().data());
+}
+
+TEST_F(LocaleWinTest, timeAMPMLabels)
+{
+    EXPECT_STREQ("AM", timeAMPMLabel(EnglishUS, 0).utf8().data());
+    EXPECT_STREQ("PM", timeAMPMLabel(EnglishUS, 1).utf8().data());
+
+    EXPECT_STREQ("", timeAMPMLabel(FrenchFR, 0).utf8().data());
+    EXPECT_STREQ("", timeAMPMLabel(FrenchFR, 1).utf8().data());
+
+    EXPECT_STREQ("\xE5\x8D\x88\xE5\x89\x8D", timeAMPMLabel(JapaneseJP, 0).utf8().data());
+    EXPECT_STREQ("\xE5\x8D\x88\xE5\xBE\x8C", timeAMPMLabel(JapaneseJP, 1).utf8().data());
+}
+#endif
diff --git a/Source/WebKit/chromium/tests/LocalizedDateICUTest.cpp b/Source/WebKit/chromium/tests/LocalizedDateICUTest.cpp
new file mode 100644
index 000000000..ea725a9f7
--- /dev/null
+++ b/Source/WebKit/chromium/tests/LocalizedDateICUTest.cpp
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+
+#include "LocaleICU.h"
+#include <gtest/gtest.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/StringBuilder.h>
+
+using namespace WebCore;
+
+class LocalizedDateICUTest : public ::testing::Test {
+public:
+    // Labels class is used for printing results in EXPECT_EQ macro.
+    class Labels {
+    public:
+        Labels(const Vector<String> labels)
+            : m_labels(labels)
+        {
+        }
+
+        // FIXME: We should use Vector<T>::operator==() if it works.
+        bool operator==(const Labels& other) const
+        {
+            if (m_labels.size() != other.m_labels.size())
+                return false;
+            for (unsigned index = 0; index < m_labels.size(); ++index)
+                if (m_labels[index] != other.m_labels[index])
+                    return false;
+            return true;
+        }
+
+        String toString() const
+        {
+            StringBuilder builder;
+            builder.append("labels(");
+            for (unsigned index = 0; index < m_labels.size(); ++index) {
+                if (index)
+                    builder.append(", ");
+                builder.append('"');
+                builder.append(m_labels[index]);
+                builder.append('"');
+            }
+            builder.append(')');
+            return builder.toString();
+        }
+
+    private:
+        Vector<String> m_labels;
+    };
+
+protected:
+    Labels labels(const String& element1, const String& element2)
+    {
+        Vector<String> labels = Vector<String>();
+        labels.append(element1);
+        labels.append(element2);
+        return Labels(labels);
+    }
+
+    String localizedDateFormatText(const char* localeString)
+    {
+        OwnPtr<LocaleICU> locale = LocaleICU::create(localeString);
+        return locale->localizedTimeFormatText();
+    }
+
+    String localizedShortDateFormatText(const char* localeString)
+    {
+        OwnPtr<LocaleICU> locale = LocaleICU::create(localeString);
+        return locale->localizedShortTimeFormatText();
+    }
+
+    Labels timeAMPMLabels(const char* localeString)
+    {
+        OwnPtr<LocaleICU> locale = LocaleICU::create(localeString);
+        return Labels(locale->timeAMPMLabels());
+    }
+};
+
+std::ostream& operator<<(std::ostream& os, const LocalizedDateICUTest::Labels& labels)
+{
+    return os << labels.toString().utf8().data();
+}
+
+TEST_F(LocalizedDateICUTest, localizedDateFormatText)
+{
+    // Note: EXPECT_EQ(String, String) doesn't print result as string.
+    EXPECT_STREQ("h:mm:ss a", localizedDateFormatText("en_US").utf8().data());
+    EXPECT_STREQ("HH:mm:ss", localizedDateFormatText("fr").utf8().data());
+    EXPECT_STREQ("H:mm:ss", localizedDateFormatText("ja").utf8().data());
+}
+
+TEST_F(LocalizedDateICUTest, localizedShortDateFormatText)
+{
+    EXPECT_STREQ("h:mm a", localizedShortDateFormatText("en_US").utf8().data());
+    EXPECT_STREQ("HH:mm", localizedShortDateFormatText("fr").utf8().data());
+    EXPECT_STREQ("H:mm", localizedShortDateFormatText("ja").utf8().data());
+}
+
+TEST_F(LocalizedDateICUTest, timeAMPMLabels)
+{
+    EXPECT_EQ(labels("AM", "PM"), timeAMPMLabels("en_US"));
+    EXPECT_EQ(labels("AM", "PM"), timeAMPMLabels("fr"));
+
+    UChar jaAM[3] = { 0x5348, 0x524d, 0 };
+    UChar jaPM[3] = { 0x5348, 0x5F8C, 0 };
+    EXPECT_EQ(labels(String(jaAM), String(jaPM)), timeAMPMLabels("ja"));
+}
+
+#endif
diff --git a/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp b/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp
index 92f85c6bb..9f89ce7a1 100644
--- a/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp
+++ b/Source/WebKit/chromium/tests/LocalizedNumberICUTest.cpp
@@ -79,3 +79,19 @@ TEST(LocalizedNumberICUTest, Reversible)
     testNumbers("zh_HK");
     testNumbers("zh_TW");
 }
+
+#if ENABLE(INPUT_TYPE_TIME_MULTIPLE_FIELDS)
+
+static String testDecimalSeparator(const char* localeString)
+{
+    OwnPtr<LocaleICU> locale = LocaleICU::create(localeString);
+    return locale->localizedDecimalSeparator();
+}
+
+TEST(LocalizedNumberICUTest, localizedDecimalSeparator)
+{
+    EXPECT_EQ(String("."), testDecimalSeparator("en_US"));
+    EXPECT_EQ(String(","), testDecimalSeparator("fr"));
+}
+
+#endif
diff --git a/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp b/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp
index dd60a97b7..38b0c9885 100644
--- a/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp
+++ b/Source/WebKit/chromium/tests/OpaqueRectTrackingContentLayerDelegateTest.cpp
@@ -30,11 +30,13 @@
 #include "GraphicsContext.h"
 #include "IntRect.h"
 #include "skia/ext/platform_canvas.h"
+#include <public/WebFloatRect.h>
 #include <public/WebRect.h>
 
 #include <gtest/gtest.h>
 
 using WebKit::WebRect;
+using WebKit::WebFloatRect;
 using namespace WebCore;
 
 namespace {
@@ -125,9 +127,9 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectPresentAfterOpa
 
     OpaqueRectTrackingContentLayerDelegate delegate(&painter);
 
-    WebRect opaqueRect;
+    WebFloatRect opaqueRect;
     delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
-    EXPECT_EQ_RECT(WebRect(0, 0, 400, 400), opaqueRect);
+    EXPECT_EQ_RECT(WebFloatRect(0, 0, 400, 400), opaqueRect);
 }
 
 TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentAfterNonOpaquePaint)
@@ -136,9 +138,9 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentAfter
     TestLayerPainterChromium painter(fillAlpha);
     OpaqueRectTrackingContentLayerDelegate delegate(&painter);
 
-    WebRect opaqueRect;
+    WebFloatRect opaqueRect;
     delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
-    EXPECT_EQ_RECT(WebRect(0, 0, 0, 0), opaqueRect);
+    EXPECT_EQ_RECT(WebFloatRect(0, 0, 0, 0), opaqueRect);
 }
 
 TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentForOpaqueLayerWithOpaquePaint)
@@ -149,9 +151,9 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentForOp
 
     delegate.setOpaque(true);
 
-    WebRect opaqueRect;
+    WebFloatRect opaqueRect;
     delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
-    EXPECT_EQ_RECT(WebRect(0, 0, 0, 0), opaqueRect);
+    EXPECT_EQ_RECT(WebFloatRect(0, 0, 0, 0), opaqueRect);
 }
 
 TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentForOpaqueLayerWithNonOpaquePaint)
@@ -162,9 +164,9 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testOpaqueRectNotPresentForOp
 
     delegate.setOpaque(true);
 
-    WebRect opaqueRect;
+    WebFloatRect opaqueRect;
     delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
-    EXPECT_EQ_RECT(WebRect(0, 0, 0, 0), opaqueRect);
+    EXPECT_EQ_RECT(WebFloatRect(0, 0, 0, 0), opaqueRect);
 }
 
 TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testPartialOpaqueRectNoTransform)
@@ -174,9 +176,9 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testPartialOpaqueRectNoTransf
     TestLayerPainterChromium painter(fillPartial);
     OpaqueRectTrackingContentLayerDelegate delegate(&painter);
 
-    WebRect opaqueRect;
+    WebFloatRect opaqueRect;
     delegate.paintContents(skCanvas(), canvasRect(), opaqueRect);
-    EXPECT_EQ_RECT(WebRect(partialRect.x(), partialRect.y(), partialRect.width(), partialRect.height()), opaqueRect);
+    EXPECT_EQ_RECT(WebFloatRect(partialRect.x(), partialRect.y(), partialRect.width(), partialRect.height()), opaqueRect);
 }
 
 TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testPartialOpaqueRectTranslation)
@@ -186,10 +188,10 @@ TEST_F(OpaqueRectTrackingContentLayerDelegateTest, testPartialOpaqueRectTranslat
     TestLayerPainterChromium painter(fillPartial);
     OpaqueRectTrackingContentLayerDelegate delegate(&painter);
 
-    WebRect opaqueRect;
+    WebFloatRect opaqueRect;
     WebRect contentRect(11, 12, 389, 388);
     delegate.paintContents(skCanvas(), contentRect, opaqueRect);
-    EXPECT_EQ_RECT(WebRect(partialRect.x(), partialRect.y(), partialRect.width(), partialRect.height()), opaqueRect);
+    EXPECT_EQ_RECT(WebFloatRect(partialRect.x(), partialRect.y(), partialRect.width(), partialRect.height()), opaqueRect);
 }
 
 } // namespace
diff --git a/Source/WebKit/chromium/tests/TextureCopierTest.cpp b/Source/WebKit/chromium/tests/TextureCopierTest.cpp
index 2c90c4ed5..b3ef4c2eb 100644
--- a/Source/WebKit/chromium/tests/TextureCopierTest.cpp
+++ b/Source/WebKit/chromium/tests/TextureCopierTest.cpp
@@ -78,7 +78,7 @@ TEST(TextureCopierTest, testDrawArraysCopy)
     int sourceTextureId = 1;
     int destTextureId = 2;
     IntSize size(256, 128);
-    OwnPtr<AcceleratedTextureCopier> copier(AcceleratedTextureCopier::create(ccContext->context3D()));
+    OwnPtr<AcceleratedTextureCopier> copier(AcceleratedTextureCopier::create(ccContext->context3D(), false));
     copier->copyTexture(ccContext.get(), sourceTextureId, destTextureId, size);
 }
 
diff --git a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
index 04b3c382e..c277e006e 100644
--- a/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
+++ b/Source/WebKit/chromium/tests/TiledLayerChromiumTest.cpp
@@ -26,10 +26,12 @@
 
 #include "TiledLayerChromium.h"
 
+#include "BitmapCanvasLayerTextureUpdater.h"
 #include "CCAnimationTestCommon.h"
 #include "CCLayerTreeTestCommon.h"
 #include "CCTiledLayerTestCommon.h"
 #include "FakeCCLayerTreeHostClient.h"
+#include "LayerPainterChromium.h"
 #include "WebCompositor.h"
 #include "cc/CCOverdrawMetrics.h"
 #include "cc/CCSingleThreadProxy.h" // For DebugScopedSetImplThread
@@ -68,30 +70,56 @@ private:
     IntRect m_scissorRectInScreen;
 };
 
-TEST(TiledLayerChromiumTest, pushDirtyTiles)
+class TiledLayerChromiumTest : public testing::Test {
+public:
+    TiledLayerChromiumTest() : ccContext(CCGraphicsContext::create3D(WebKit::CompositorFakeWebGraphicsContext3D::create(WebKit::WebGraphicsContext3D::Attributes()))) { }
+    virtual ~TiledLayerChromiumTest() { }
+
+    void updateTextures(int count = 500)
+    {
+        updater.update(ccContext.get(), &allocator, &copier, &uploader, count);
+    }
+public:
+    // FIXME: Rename these to add "m_".
+    OwnPtr<CCGraphicsContext> ccContext;
+    CCTextureUpdater updater;
+    FakeTextureAllocator allocator;
+    FakeTextureCopier copier;
+    FakeTextureUploader uploader;
+    CCPriorityCalculator priorityCalculator;
+};
+
+
+
+TEST_F(TiledLayerChromiumTest, pushDirtyTiles)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    CCPriorityCalculator priorityCalculator;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
+    layer->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should have both tiles on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 
-    textureManager->unprotectAllTextures();
-
     // Invalidates both tiles...
     layer->invalidateRect(IntRect(0, 0, 100, 200));
     // ....but then only update one of them.
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 100), 0);
     layer->pushPropertiesTo(layerImpl.get());
 
@@ -100,22 +128,26 @@ TEST(TiledLayerChromiumTest, pushDirtyTiles)
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
 }
 
-TEST(TiledLayerChromiumTest, pushOccludedDirtyTiles)
+TEST_F(TiledLayerChromiumTest, pushOccludedDirtyTiles)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    CCPriorityCalculator priorityCalculator;
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
     TestCCOcclusionTracker occluded;
 
-    CCTextureUpdater updater;
-
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
     layer->setDrawTransform(WebTransformationMatrix(1, 0, 0, 1, layer->bounds().width() / 2.0, layer->bounds().height() / 2.0));
     layer->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 200), &occluded);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -126,13 +158,12 @@ TEST(TiledLayerChromiumTest, pushOccludedDirtyTiles)
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 
-    textureManager->unprotectAllTextures();
-
     // Invalidates part of the top tile...
     layer->invalidateRect(IntRect(0, 0, 50, 50));
     // ....but the area is occluded.
     occluded.setOcclusion(IntRect(0, 0, 50, 50));
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 100), &occluded);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
@@ -144,29 +175,32 @@ TEST(TiledLayerChromiumTest, pushOccludedDirtyTiles)
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 }
 
-TEST(TiledLayerChromiumTest, pushDeletedTiles)
+TEST_F(TiledLayerChromiumTest, pushDeletedTiles)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
-    FakeTextureAllocator allocator;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
+    layer->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should have both tiles on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 
-    textureManager->evictAndDeleteAllTextures(&allocator);
+    textureManager->clearPriorities();
+    textureManager->clearAllMemory(&allocator);
     textureManager->setMaxMemoryLimitBytes(4*1024*1024);
-    textureManager->setPreferredMemoryLimitBytes(4*1024*1024);
 
     // This should drop the tiles on the impl thread.
     layer->pushPropertiesTo(layerImpl.get());
@@ -176,7 +210,10 @@ TEST(TiledLayerChromiumTest, pushDeletedTiles)
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
 
     // This should recreate and update the deleted textures.
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 100), 0);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should only have the first tile since the other tile was invalidated but not painted.
@@ -184,14 +221,12 @@ TEST(TiledLayerChromiumTest, pushDeletedTiles)
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
 }
 
-TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
+TEST_F(TiledLayerChromiumTest, pushIdlePaintTiles)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // The tile size is 100x100. Setup 5x5 tiles with one visible tile in the center.
     IntSize contentBounds(500, 500);
@@ -202,7 +237,12 @@ TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
     layer->setBounds(contentBounds);
     layer->setVisibleLayerRect(visibleRect);
     layer->invalidateRect(contentRect);
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     layer->updateLayerRect(updater, visibleRect, 0);
+    updateTextures();
 
     // We should need idle-painting for 3x3 tiles in the center.
     EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
@@ -212,19 +252,19 @@ TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
     // We should have one tile on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(2, 2));
 
-    textureManager->unprotectAllTextures();
-
     // For the next four updates, we should detect we still need idle painting.
     for (int i = 0; i < 4; i++) {
+        layer->setTexturePriorities(priorityCalculator);
+        textureManager->prioritizeTextures(0);
+
         layer->updateLayerRect(updater, visibleRect, 0);
         EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
-        layer->idleUpdateLayerRect(updater, visibleRect, 0);
+        updateTextures();
         layer->pushPropertiesTo(layerImpl.get());
-        textureManager->unprotectAllTextures();
     }
 
     // After four passes of idle painting, we should be finished painting
-    EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
+    // EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
 
     // We should have one tile surrounding the visible tile on all sides, but no other tiles.
     IntRect idlePaintTiles(1, 1, 3, 3);
@@ -238,19 +278,15 @@ TEST(TiledLayerChromiumTest, pushIdlePaintTiles)
     }
 }
 
-TEST(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
+TEST_F(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(1024*1024, 1024*1024, 1024);
+    // Start with 2mb of memory, but the test is going to try to use just more than 1mb, so we reduce to 1mb later.
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(2*1024*1024, 1024);
     DebugScopedSetImplThread implThread;
     RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl1(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl1(adoptPtr(new FakeCCTiledLayerImpl(1)));
     RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl2(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
-    FakeTextureAllocator allocator;
-    FakeTextureCopier copier;
-    FakeTextureUploader uploader;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl2(adoptPtr(new FakeCCTiledLayerImpl(2)));
 
     // For this test we have two layers. layer1 exhausts most texture memory, leaving room for 2 more tiles from
     // layer2, but not all three tiles. First we paint layer1, and one tile from layer2. Then when we idle paint
@@ -267,25 +303,33 @@ TEST(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     layer1->setBounds(layerRect.size());
     layer1->setVisibleLayerRect(layerRect);
     layer1->invalidateRect(layerRect);
-    layer1->updateLayerRect(updater, layerRect, 0);
 
     // Paint a single tile in layer2 so that it will idle paint.
+    layer2->setTexturePriorities(priorityCalculator);
+    layer1->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+    layer1->updateLayerRect(updater, layerRect, 0);
     layer2->updateLayerRect(updater, IntRect(0, 0, 100, 100), 0);
 
     // We should need idle-painting for both remaining tiles in layer2.
     EXPECT_TRUE(layer2->needsIdlePaint(layer2Rect));
 
     // Commit the frame over to impl.
-    updater.update(0, &allocator, &copier, &uploader, 5000);
+    updateTextures();
     layer1->pushPropertiesTo(layerImpl1.get());
     layer2->pushPropertiesTo(layerImpl2.get());
 
+    // Reduce our memory limits to 1mb.
+    textureManager->setMaxMemoryLimitBytes(1024 * 1024);
+
     // Now idle paint layer2. We are going to run out of memory though!
+    layer2->setTexturePriorities(priorityCalculator);
+    layer1->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer2->updateLayerRect(updater, IntRect(0, 0, 100, 100), 0);
-    layer2->idleUpdateLayerRect(updater, layer2Rect, 0);
 
     // Oh well, commit the frame and push.
-    updater.update(0, &allocator, &copier, &uploader, 5000);
+    updateTextures();
     layer1->pushPropertiesTo(layerImpl1.get());
     layer2->pushPropertiesTo(layerImpl2.get());
 
@@ -299,12 +343,13 @@ TEST(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     EXPECT_FALSE(layerImpl2->hasTileAt(0, 2));
 
     // Now if layer2 becomes fully visible, we should be able to paint it and push valid textures.
-    textureManager->unprotectAllTextures();
-
+    layer2->setTexturePriorities(priorityCalculator);
+    layer1->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer2->updateLayerRect(updater, layer2Rect, 0);
-    layer1->updateLayerRect(updater, IntRect(), 0);
+    layer1->updateLayerRect(updater, layerRect, 0);
 
-    updater.update(0, &allocator, &copier, &uploader, 5000);
+    updateTextures();
     layer1->pushPropertiesTo(layerImpl1.get());
     layer2->pushPropertiesTo(layerImpl2.get());
 
@@ -316,16 +361,14 @@ TEST(TiledLayerChromiumTest, pushTilesAfterIdlePaintFailed)
     EXPECT_TRUE(layerImpl2->hasTextureIdForTileAt(0, 2));
 }
 
-TEST(TiledLayerChromiumTest, pushIdlePaintedOccludedTiles)
+TEST_F(TiledLayerChromiumTest, pushIdlePaintedOccludedTiles)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
     TestCCOcclusionTracker occluded;
 
-    CCTextureUpdater updater;
-
     // The tile size is 100x100, so this invalidates one occluded tile, culls it during paint, but prepaints it.
     occluded.setOcclusion(IntRect(0, 0, 100, 100));
 
@@ -333,30 +376,36 @@ TEST(TiledLayerChromiumTest, pushIdlePaintedOccludedTiles)
     layer->setDrawTransform(WebTransformationMatrix(1, 0, 0, 1, layer->bounds().width() / 2.0, layer->bounds().height() / 2.0));
     layer->setVisibleLayerRect(IntRect(0, 0, 100, 100));
     layer->invalidateRect(IntRect(0, 0, 100, 100));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 100), &occluded);
-    layer->idleUpdateLayerRect(updater, IntRect(0, 0, 100, 100), &occluded);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should have the prepainted tile on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
 }
 
-TEST(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
+TEST_F(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     // However, during the paint, we invalidate one of the tiles. This should
     // not prevent the tile from being pushed.
     layer->setBounds(IntSize(100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
+    layer->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer.get());
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should have both tiles on the impl side.
@@ -364,28 +413,34 @@ TEST(TiledLayerChromiumTest, pushTilesMarkedDirtyDuringPaint)
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 }
 
-TEST(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
+TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-    OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(1)));
+    OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(2)));
 
     layer1->setBounds(IntSize(100, 200));
+    layer1->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer1->invalidateRect(IntRect(0, 0, 100, 200));
+
     layer2->setBounds(IntSize(100, 200));
+    layer2->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer2->invalidateRect(IntRect(0, 0, 100, 200));
 
+    layer1->setTexturePriorities(priorityCalculator);
+    layer2->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     layer1->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
 
     // Invalidate a tile on layer1
     layer2->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer1.get());
     layer2->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
 
+    updateTextures();
     layer1->pushPropertiesTo(layer1Impl.get());
     layer2->pushPropertiesTo(layer2Impl.get());
 
@@ -396,28 +451,32 @@ TEST(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnNextLayer)
     EXPECT_TRUE(layer2Impl->hasTileAt(0, 1));
 }
 
-TEST(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnPreviousLayer)
+TEST_F(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnPreviousLayer)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer1 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     RefPtr<FakeTiledLayerChromium> layer2 = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-    OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layer1Impl(adoptPtr(new FakeCCTiledLayerImpl(1)));
+    OwnPtr<FakeCCTiledLayerImpl> layer2Impl(adoptPtr(new FakeCCTiledLayerImpl(2)));
 
     layer1->setBounds(IntSize(100, 200));
+    layer1->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer1->invalidateRect(IntRect(0, 0, 100, 200));
+
     layer2->setBounds(IntSize(100, 200));
+    layer2->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer2->invalidateRect(IntRect(0, 0, 100, 200));
 
+    layer1->setTexturePriorities(priorityCalculator);
+    layer2->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     // Invalidate a tile on layer2
     layer1->fakeLayerTextureUpdater()->setRectToInvalidate(IntRect(0, 50, 100, 50), layer2.get());
     layer1->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
-
     layer2->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
-
+    updateTextures();
     layer1->pushPropertiesTo(layer1Impl.get());
     layer2->pushPropertiesTo(layer2Impl.get());
 
@@ -428,141 +487,94 @@ TEST(TiledLayerChromiumTest, pushTilesLayerMarkedDirtyDuringPaintOnPreviousLayer
     EXPECT_TRUE(layer2Impl->hasTileAt(0, 1));
 }
 
-TEST(TiledLayerChromiumTest, idlePaintOutOfMemory)
+TEST_F(TiledLayerChromiumTest, idlePaintOutOfMemory)
 {
-    // The tile size is 100x100. Setup 5x5 tiles with one 1x1 visible tile in the center.
+    // The tile size is 100x100. Setup 3x3 tiles with one 1x1 visible tile in the center.
     IntSize contentBounds(300, 300);
     IntRect contentRect(IntPoint::zero(), contentBounds);
     IntRect visibleRect(100, 100, 100, 100);
 
     // We have enough memory for only the visible rect, so we will run out of memory in first idle paint.
-    int memoryLimit = 4 * 100 * 100; // 2 tiles, 4 bytes per pixel.
+    int memoryLimit = 4 * 100 * 100; // 1 tiles, 4 bytes per pixel.
 
-    OwnPtr<TextureManager> textureManager = TextureManager::create(memoryLimit, memoryLimit / 2, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(memoryLimit, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
-    // This invalidates 9 tiles and then paints one visible tile.
+    // Invalidates 9 tiles and then paints one visible tile.
     layer->setBounds(contentBounds);
     layer->setVisibleLayerRect(visibleRect);
     layer->invalidateRect(contentRect);
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, visibleRect, 0);
 
-    // We should need idle-painting for 3x3 tiles surounding visible tile.
-    EXPECT_TRUE(layer->needsIdlePaint(visibleRect));
+    // Idle-painting should see no more priority tiles for painting.
+    EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
 
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
 
     // We should have one tile on the impl side.
     EXPECT_TRUE(layerImpl->hasTileAt(1, 1));
 
-    textureManager->unprotectAllTextures();
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, visibleRect, 0);
-    layer->idleUpdateLayerRect(updater, visibleRect, 0);
 
-    // We shouldn't signal we need another idle paint after we run out of memory.
+    // We shouldn't signal we need another idle paint.
     EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
-
-    layer->pushPropertiesTo(layerImpl.get());
-}
-
-TEST(TiledLayerChromiumTest, idlePaintZeroSizedLayer)
-{
-    OwnPtr<TextureManager> textureManager = TextureManager::create(20000, 10000, 1024);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
-
-    // The layer's bounds are empty.
-    IntRect contentRect;
-
-    layer->setBounds(contentRect.size());
-    layer->setVisibleLayerRect(contentRect);
-    layer->invalidateRect(contentRect);
-    layer->updateLayerRect(updater, contentRect, 0);
-
-    // Empty layers don't have tiles.
-    EXPECT_EQ(0u, layer->numPaintedTiles());
-
-    // Empty layers don't need prepaint.
-    EXPECT_FALSE(layer->needsIdlePaint(contentRect));
-
-    layer->pushPropertiesTo(layerImpl.get());
-
-    // Empty layers don't have tiles.
-    EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
-
-    // Non-visible layers don't idle paint.
-    layer->idleUpdateLayerRect(updater, contentRect, 0);
-
-    // Empty layers don't have tiles.
-    EXPECT_EQ(0u, layer->numPaintedTiles());
-
-    layer->pushPropertiesTo(layerImpl.get());
-
-    // Empty layers don't have tiles.
-    EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
 }
 
-TEST(TiledLayerChromiumTest, idlePaintZeroSizedAnimatingLayer)
+TEST_F(TiledLayerChromiumTest, idlePaintZeroSizedLayer)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(20000, 10000, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(20000, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
-    CCTextureUpdater updater;
+    bool animating[2] = {false, true};
+    for (int i = 0; i < 2; i++) {
+        // Pretend the layer is animating.
+        layer->setDrawTransformIsAnimating(animating[i]);
 
-    // Pretend the layer is animating.
-    layer->setDrawTransformIsAnimating(true);
+        // The layer's bounds are empty.
+        IntRect contentRect;
 
-    // The layer's bounds are empty.
-    IntRect contentRect;
+        layer->setBounds(contentRect.size());
+        layer->setVisibleLayerRect(contentRect);
+        layer->invalidateRect(contentRect);
 
-    layer->setBounds(contentRect.size());
-    layer->setVisibleLayerRect(contentRect);
-    layer->invalidateRect(contentRect);
-    layer->updateLayerRect(updater, contentRect, 0);
+        layer->setTexturePriorities(priorityCalculator);
+        textureManager->prioritizeTextures(0);
 
-    // Empty layers don't have tiles.
-    EXPECT_EQ(0u, layer->numPaintedTiles());
+        // Empty layers don't paint or idle-paint.
+        layer->updateLayerRect(updater, contentRect, 0);
 
-    // Empty layers don't need prepaint.
-    EXPECT_FALSE(layer->needsIdlePaint(contentRect));
+        // Empty layers don't have tiles.
+        EXPECT_EQ(0u, layer->numPaintedTiles());
 
-    layer->pushPropertiesTo(layerImpl.get());
+        // Empty layers don't need prepaint.
+        EXPECT_FALSE(layer->needsIdlePaint(contentRect));
 
-    // Empty layers don't have tiles.
-    EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
-
-    // Non-visible layers don't idle paint.
-    layer->idleUpdateLayerRect(updater, contentRect, 0);
-
-    // Empty layers don't have tiles.
-    EXPECT_EQ(0u, layer->numPaintedTiles());
-
-    layer->pushPropertiesTo(layerImpl.get());
+        layer->pushPropertiesTo(layerImpl.get());
 
-    // Empty layers don't have tiles.
-    EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
+        // Empty layers don't have tiles.
+        EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
+    }
 }
 
-TEST(TiledLayerChromiumTest, idlePaintNonVisibleLayers)
+TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleLayers)
 {
     IntSize contentBounds(100, 100);
     IntRect contentRect(IntPoint::zero(), contentBounds);
 
-    OwnPtr<TextureManager> textureManager = TextureManager::create(20000, 10000, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(20000, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // Invalidate the layer but make none of it visible, so nothing paints.
     IntRect visibleRect;
@@ -570,31 +582,20 @@ TEST(TiledLayerChromiumTest, idlePaintNonVisibleLayers)
     layer->setBounds(contentBounds);
     layer->setVisibleLayerRect(visibleRect);
     layer->invalidateRect(contentRect);
-    layer->updateLayerRect(updater, visibleRect, 0);
-
-    // Non-visible layers don't need idle paint.
-    EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
-
-    layer->pushPropertiesTo(layerImpl.get());
 
-    // We should not have any tiles pushed since the layer is not visible.
-    EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
+    for (int i = 0; i < 2; i++) {
+        // Paint / idle-paint.
+        layer->setTexturePriorities(priorityCalculator);
+        textureManager->prioritizeTextures(0);
+        layer->updateLayerRect(updater, visibleRect, 0);
 
-    // Non-visible layers don't idle paint.
-    layer->idleUpdateLayerRect(updater, visibleRect, 0);
+        // Non-visible layers don't need idle paint.
+        EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
 
-    layer->pushPropertiesTo(layerImpl.get());
-
-    // We should not have any tiles pushed since the layer is not visible.
-    EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
-}
+        layer->pushPropertiesTo(layerImpl.get());
 
-static void idlePaintRepeat(int repeatTimes, FakeTiledLayerChromium* layer, FakeCCTiledLayerImpl* layerImpl, CCTextureUpdater& updater, const IntRect& visibleRect)
-{
-    for (int i = 0; i < repeatTimes; ++i) {
-        layer->updateLayerRect(updater, visibleRect, 0);
-        layer->idleUpdateLayerRect(updater, visibleRect, 0);
-        layer->pushPropertiesTo(layerImpl);
+        // We should not have any tiles pushed since the layer is not visible.
+        EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
     }
 }
 
@@ -608,13 +609,11 @@ static void testHaveOuterTiles(FakeCCTiledLayerImpl* layerImpl, int width, int h
     }
 }
 
-TEST(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
+TEST_F(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(8000*8000*8, 8000*8000*4, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(8000*8000*8, 1024);
     DebugScopedSetImplThread implThread;
 
-    CCTextureUpdater updater;
-
     int tileWidth = FakeTiledLayerChromium::tileSize().width();
     int tileHeight = FakeTiledLayerChromium::tileSize().height();
     int width[] = { 1, 2, 3, 4, 9, 10, 0 };
@@ -623,7 +622,7 @@ TEST(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
     for (int j = 0; height[j]; ++j) {
         for (int i = 0; width[i]; ++i) {
             RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-            OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+            OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
             // Pretend the layer is animating.
             layer->setDrawTransformIsAnimating(true);
@@ -636,40 +635,51 @@ TEST(TiledLayerChromiumTest, idlePaintNonVisibleAnimatingLayers)
             layer->setVisibleLayerRect(visibleRect);
             layer->invalidateRect(contentRect);
 
+            layer->setTexturePriorities(priorityCalculator);
+            textureManager->prioritizeTextures(0);
+
             // If idlePaintRect gives back a non-empty result then we should paint it. Otherwise,
             // we shoud paint nothing.
             bool shouldPrepaint = !layer->idlePaintRect(visibleRect).isEmpty();
 
-            // This paints the layer but there's nothing visible so it's a no-op.
-            layer->updateLayerRect(updater, visibleRect, 0);
-            layer->pushPropertiesTo(layerImpl.get());
-
-            // We should not have any tiles pushed yet since the layer is not visible and we've not prepainted.
-            testHaveOuterTiles(layerImpl.get(), width[i], height[j], 0);
-
             // Normally we don't allow non-visible layers to pre-paint, but if they are animating then we should.
             EXPECT_EQ(shouldPrepaint, layer->needsIdlePaint(visibleRect));
 
             // If the layer is to be prepainted at all, then after four updates we should have the outer row/columns painted.
-            idlePaintRepeat(4, layer.get(), layerImpl.get(), updater, visibleRect);
+            for (int k = 0; k < 4; ++k) {
+                layer->setTexturePriorities(priorityCalculator);
+                textureManager->prioritizeTextures(0);
+
+                layer->updateLayerRect(updater, visibleRect, 0);
+                updateTextures();
+                layer->pushPropertiesTo(layerImpl.get());
+            }
+
             testHaveOuterTiles(layerImpl.get(), width[i], height[j], shouldPrepaint ? 1 : 0);
 
             // We don't currently idle paint past the outermost tiles.
             EXPECT_FALSE(layer->needsIdlePaint(visibleRect));
-            idlePaintRepeat(4, layer.get(), layerImpl.get(), updater, visibleRect);
+            for (int k = 0; k < 4; ++k) {
+                layer->setTexturePriorities(priorityCalculator);
+                textureManager->prioritizeTextures(0);
+
+                layer->updateLayerRect(updater, visibleRect, 0);
+                updateTextures();
+                layer->pushPropertiesTo(layerImpl.get());
+            }
+
             testHaveOuterTiles(layerImpl.get(), width[i], height[j], shouldPrepaint ? 1 : 0);
         }
     }
 }
 
-TEST(TiledLayerChromiumTest, invalidateFromPrepare)
+TEST_F(TiledLayerChromiumTest, invalidateFromPrepare)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
-    CCTextureUpdater updater;
     FakeTextureAllocator fakeAllocator;
     FakeTextureCopier fakeCopier;
     FakeTextureUploader fakeUploader;
@@ -677,7 +687,10 @@ TEST(TiledLayerChromiumTest, invalidateFromPrepare)
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
+    layer->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
     updater.update(ccContext.get(), &fakeAllocator, &fakeCopier, &fakeUploader, 1000);
     layer->pushPropertiesTo(layerImpl.get());
@@ -686,8 +699,6 @@ TEST(TiledLayerChromiumTest, invalidateFromPrepare)
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
 
-    textureManager->unprotectAllTextures();
-
     layer->fakeLayerTextureUpdater()->clearPrepareCount();
     // Invoke updateLayerRect again. As the layer is valid updateLayerRect shouldn't be invoked on
     // the LayerTextureUpdater.
@@ -709,16 +720,14 @@ TEST(TiledLayerChromiumTest, invalidateFromPrepare)
     EXPECT_EQ(1, layer->fakeLayerTextureUpdater()->prepareCount());
 }
 
-TEST(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
+TEST_F(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
 {
     // The updateRect (that indicates what was actually painted) should be in
     // layer space, not the content space.
 
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerWithScaledBounds> layer = adoptRef(new FakeTiledLayerWithScaledBounds(textureManager.get()));
 
-    CCTextureUpdater updater;
-
     IntRect layerBounds(0, 0, 300, 200);
     IntRect contentBounds(0, 0, 200, 250);
 
@@ -729,39 +738,50 @@ TEST(TiledLayerChromiumTest, verifyUpdateRectWhenContentBoundsAreScaled)
     // On first update, the updateRect includes all tiles, even beyond the boundaries of the layer.
     // However, it should still be in layer space, not content space.
     layer->invalidateRect(contentBounds);
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, contentBounds, 0);
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 300, 300 * 0.8), layer->updateRect());
+    updateTextures();
 
     // After the tiles are updated once, another invalidate only needs to update the bounds of the layer.
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->invalidateRect(contentBounds);
     layer->updateLayerRect(updater, contentBounds, 0);
     EXPECT_FLOAT_RECT_EQ(FloatRect(layerBounds), layer->updateRect());
+    updateTextures();
 
     // Partial re-paint should also be represented by the updateRect in layer space, not content space.
     IntRect partialDamage(30, 100, 10, 10);
     layer->invalidateRect(partialDamage);
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, contentBounds, 0);
     EXPECT_FLOAT_RECT_EQ(FloatRect(45, 80, 15, 8), layer->updateRect());
 }
 
-TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
+TEST_F(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     DebugScopedSetImplThread implThread;
-    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-
-    CCTextureUpdater updater;
+    OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
 
     // Create a layer with one tile.
     layer->setBounds(IntSize(100, 100));
+    layer->setVisibleLayerRect(IntRect(0, 0, 100, 100));
 
     // Invalidate the entire layer.
     layer->setNeedsDisplay();
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 100, 100), layer->lastNeedsDisplayRect());
 
     // Push the tiles to the impl side and check that there is exactly one.
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 100), 0);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
@@ -771,10 +791,14 @@ TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // Change the contents scale and verify that the content rectangle requiring painting
     // is not scaled.
     layer->setContentsScale(2);
+    layer->setVisibleLayerRect(IntRect(0, 0, 200, 200));
     EXPECT_FLOAT_RECT_EQ(FloatRect(0, 0, 100, 100), layer->lastNeedsDisplayRect());
 
     // The impl side should get 2x2 tiles now.
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 200, 200), 0);
+    updateTextures();
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_TRUE(layerImpl->hasTileAt(0, 0));
     EXPECT_TRUE(layerImpl->hasTileAt(0, 1));
@@ -784,7 +808,10 @@ TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     // Invalidate the entire layer again, but do not paint. All tiles should be gone now from the
     // impl side.
     layer->setNeedsDisplay();
+    layer->setTexturePriorities(priorityCalculator);
     layer->updateLayerRect(updater, IntRect(1, 0, 0, 1), 0);
+    textureManager->prioritizeTextures(0);
+
     layer->pushPropertiesTo(layerImpl.get());
     EXPECT_FALSE(layerImpl->hasTileAt(0, 0));
     EXPECT_FALSE(layerImpl->hasTileAt(0, 1));
@@ -792,7 +819,7 @@ TEST(TiledLayerChromiumTest, verifyInvalidationWhenContentsScaleChanges)
     EXPECT_FALSE(layerImpl->hasTileAt(1, 1));
 }
 
-TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
+TEST_F(TiledLayerChromiumTest, skipsDrawGetsReset)
 {
     // Initialize without threading support.
     WebKit::WebCompositor::initialize(0);
@@ -806,23 +833,23 @@ TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
 
     // We have enough memory for only one of the two layers.
     int memoryLimit = 4 * 300 * 300; // 4 bytes per pixel.
-    OwnPtr<TextureManager> textureManager = TextureManager::create(memoryLimit, memoryLimit, memoryLimit);
 
-    RefPtr<FakeTiledLayerChromium> rootLayer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    RefPtr<FakeTiledLayerChromium> childLayer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> rootLayer = adoptRef(new FakeTiledLayerChromium(ccLayerTreeHost->contentsTextureManager()));
+    RefPtr<FakeTiledLayerChromium> childLayer = adoptRef(new FakeTiledLayerChromium(ccLayerTreeHost->contentsTextureManager()));
     rootLayer->addChild(childLayer);
 
     rootLayer->setBounds(contentBounds);
+    rootLayer->setVisibleLayerRect(contentRect);
     rootLayer->setPosition(FloatPoint(150, 150));
     childLayer->setBounds(contentBounds);
+    childLayer->setVisibleLayerRect(contentRect);
     childLayer->setPosition(FloatPoint(150, 150));
     rootLayer->invalidateRect(contentRect);
     childLayer->invalidateRect(contentRect);
 
-    CCTextureUpdater updater;
-
     ccLayerTreeHost->setRootLayer(rootLayer);
     ccLayerTreeHost->setViewportSize(IntSize(300, 300));
+
     ccLayerTreeHost->updateLayers(updater, memoryLimit);
 
     // We'll skip the root layer.
@@ -830,7 +857,6 @@ TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
     EXPECT_FALSE(childLayer->skipsDraw());
 
     ccLayerTreeHost->commitComplete();
-    textureManager->unprotectAllTextures(); // CCLayerTreeHost::commitComplete() normally does this, but since we're mocking out the manager we have to do it.
 
     // Remove the child layer.
     rootLayer->removeAllChildren();
@@ -838,40 +864,46 @@ TEST(TiledLayerChromiumTest, skipsDrawGetsReset)
     ccLayerTreeHost->updateLayers(updater, memoryLimit);
     EXPECT_FALSE(rootLayer->skipsDraw());
 
+    ccLayerTreeHost->contentsTextureManager()->clearAllMemory(&allocator);
     ccLayerTreeHost->setRootLayer(0);
     ccLayerTreeHost.clear();
     WebKit::WebCompositor::shutdown();
 }
 
-TEST(TiledLayerChromiumTest, resizeToSmaller)
+TEST_F(TiledLayerChromiumTest, resizeToSmaller)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(60*1024*1024, 60*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(60*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    CCTextureUpdater updater;
 
     layer->setBounds(IntSize(700, 700));
+    layer->setVisibleLayerRect(IntRect(0, 0, 700, 700));
     layer->invalidateRect(IntRect(0, 0, 700, 700));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 700, 700), 0);
 
     layer->setBounds(IntSize(200, 200));
     layer->invalidateRect(IntRect(0, 0, 200, 200));
 }
 
-TEST(TiledLayerChromiumTest, hugeLayerUpdateCrash)
+TEST_F(TiledLayerChromiumTest, hugeLayerUpdateCrash)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(60*1024*1024, 60*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(60*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    CCTextureUpdater updater;
 
     int size = 1 << 30;
     layer->setBounds(IntSize(size, size));
+    layer->setVisibleLayerRect(IntRect(0, 0, 700, 700));
     layer->invalidateRect(IntRect(0, 0, size, size));
 
     // Ensure no crash for bounds where size * size would overflow an int.
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 700, 700), 0);
 }
 
-TEST(TiledLayerChromiumTest, partialUpdates)
+TEST_F(TiledLayerChromiumTest, partialUpdates)
 {
     // Initialize without threading support.
     WebKit::WebCompositor::initialize(0);
@@ -883,21 +915,16 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     OwnPtr<CCLayerTreeHost> ccLayerTreeHost = CCLayerTreeHost::create(&fakeCCLayerTreeHostClient, settings);
     ASSERT_TRUE(ccLayerTreeHost->initializeLayerRendererIfNeeded());
 
-    // Create one 500 x 300 tiled layer.
+    // Create one 300 x 200 tiled layer with 3 x 2 tiles.
     IntSize contentBounds(300, 200);
     IntRect contentRect(IntPoint::zero(), contentBounds);
 
-    OwnPtr<TextureManager> textureManager = TextureManager::create(60*1024*1024, 60*1024*1024, 1024);
-    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
+    RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(ccLayerTreeHost->contentsTextureManager()));
     layer->setBounds(contentBounds);
     layer->setPosition(FloatPoint(150, 150));
+    layer->setVisibleLayerRect(contentRect);
     layer->invalidateRect(contentRect);
 
-    CCTextureUpdater updater;
-    FakeTextureAllocator allocator;
-    FakeTextureCopier copier;
-    FakeTextureUploader uploader;
-
     ccLayerTreeHost->setRootLayer(layer);
     ccLayerTreeHost->setViewportSize(IntSize(300, 200));
 
@@ -905,12 +932,12 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
-        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
+        updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_TRUE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_FALSE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -923,12 +950,12 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
     {
         DebugScopedSetImplThread implThread;
-        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
+        updateTextures(4);
         EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_TRUE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        updateTextures(4);
         EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_FALSE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -940,13 +967,13 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     layer->invalidateRect(IntRect(50, 50, 200, 100));
     {
         DebugScopedSetImplThread implThread;
-        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_TRUE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_FALSE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -958,7 +985,7 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     layer->invalidateRect(IntRect(0, 0, 300, 200));
     {
         DebugScopedSetImplThread implThread;
-        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         layer->pushPropertiesTo(layerImpl.get());
     }
     ccLayerTreeHost->commitComplete();
@@ -967,13 +994,13 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     layer->invalidateRect(IntRect(50, 50, 200, 100));
     {
         DebugScopedSetImplThread implThread;
-        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_TRUE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        updateTextures(4);
         EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_FALSE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -985,9 +1012,9 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     layer->invalidateRect(IntRect(50, 50, 100, 100));
     {
         DebugScopedSetImplThread implThread;
-        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(0)));
+        OwnPtr<FakeCCTiledLayerImpl> layerImpl(adoptPtr(new FakeCCTiledLayerImpl(1)));
         ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
-        updater.update(0, &allocator, &copier, &uploader, 4);
+        updateTextures(4);
         EXPECT_EQ(4, layer->fakeLayerTextureUpdater()->updateCount());
         EXPECT_FALSE(updater.hasMoreUpdates());
         layer->fakeLayerTextureUpdater()->clearUpdateCount();
@@ -995,31 +1022,33 @@ TEST(TiledLayerChromiumTest, partialUpdates)
     }
     ccLayerTreeHost->commitComplete();
 
+    ccLayerTreeHost->contentsTextureManager()->clearAllMemory(&allocator);
     ccLayerTreeHost->setRootLayer(0);
     ccLayerTreeHost.clear();
     WebKit::WebCompositor::shutdown();
 }
 
-TEST(TiledLayerChromiumTest, tilesPaintedWithoutOcclusion)
+TEST_F(TiledLayerChromiumTest, tilesPaintedWithoutOcclusion)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
-    CCTextureUpdater updater;
 
     // The tile size is 100x100, so this invalidates and then paints two tiles.
     layer->setBounds(IntSize(100, 200));
-
+    layer->setVisibleLayerRect(IntRect(0, 0, 100, 200));
     layer->invalidateRect(IntRect(0, 0, 100, 200));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 100, 200), 0);
     EXPECT_EQ(2, layer->fakeLayerTextureUpdater()->prepareRectCount());
 }
 
-TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
+TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     TestCCOcclusionTracker occluded;
-    CCTextureUpdater updater;
 
     // The tile size is 100x100.
 
@@ -1029,6 +1058,9 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
     layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 600), &occluded);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
@@ -1059,12 +1091,11 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusion)
     EXPECT_EQ(3 + 2, occluded.overdrawMetrics().tilesCulledForUpload());
 }
 
-TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
+TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     TestCCOcclusionTracker occluded;
-    CCTextureUpdater updater;
 
     // The tile size is 100x100.
 
@@ -1075,6 +1106,9 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
     layer->setVisibleLayerRect(IntRect(0, 0, 600, 360));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 360), &occluded);
     EXPECT_EQ(24-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
@@ -1088,6 +1122,8 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
     layer->setVisibleLayerRect(IntRect(0, 0, 600, 350));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 350), &occluded);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
@@ -1101,6 +1137,8 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
     occluded.setOcclusion(IntRect(200, 200, 300, 150));
     layer->setVisibleLayerRect(IntRect(0, 0, 600, 340));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 340), &occluded);
     EXPECT_EQ(24-6, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
@@ -1110,12 +1148,11 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndVisiblityConstraints)
 
 }
 
-TEST(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
+TEST_F(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     TestCCOcclusionTracker occluded;
-    CCTextureUpdater updater;
 
     // The tile size is 100x100.
 
@@ -1125,8 +1162,11 @@ TEST(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
     layer->setVisibleLayerRect(IntRect(0, 0, 600, 600));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 600), &occluded);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
+    updateTextures();
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedTranslucent(), 330000, 1);
@@ -1134,21 +1174,20 @@ TEST(TiledLayerChromiumTest, tilesNotPaintedWithoutInvalidation)
 
     layer->fakeLayerTextureUpdater()->clearPrepareRectCount();
 
-    // Repaint without marking it dirty. The culled tiles remained dirty.
+    // Repaint without marking it dirty. The 3 culled tiles will be pre-painted now.
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 600), &occluded);
-    EXPECT_EQ(0, layer->fakeLayerTextureUpdater()->prepareRectCount());
+    EXPECT_EQ(3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 0, 1);
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedTranslucent(), 330000, 1);
     EXPECT_EQ(6, occluded.overdrawMetrics().tilesCulledForUpload());
 }
 
-TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
+TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     TestCCOcclusionTracker occluded;
-    CCTextureUpdater updater;
 
     // The tile size is 100x100.
 
@@ -1163,6 +1202,8 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
     occluded.setOcclusion(IntRect(100, 100, 150, 50));
     layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 600), &occluded);
     EXPECT_EQ(36-3, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
@@ -1171,12 +1212,11 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndTransforms)
     EXPECT_EQ(3, occluded.overdrawMetrics().tilesCulledForUpload());
 }
 
-TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
+TEST_F(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     TestCCOcclusionTracker occluded;
-    CCTextureUpdater updater;
 
     // The tile size is 100x100.
 
@@ -1190,6 +1230,8 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     occluded.setOcclusion(IntRect(200, 200, 300, 100));
     layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 600), &occluded);
     // The content is half the size of the layer (so the number of tiles is fewer).
     // In this case, the content is 300x300, and since the tile size is 100, the
@@ -1208,6 +1250,8 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     occluded.setOcclusion(IntRect(200, 200, 300, 200));
     layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 600), &occluded);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
@@ -1226,6 +1270,8 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     occluded.setOcclusion(IntRect(100, 100, 150, 100));
     layer->setVisibleLayerRect(IntRect(IntPoint(), layer->bounds()));
     layer->invalidateRect(IntRect(0, 0, 600, 600));
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
     layer->updateLayerRect(updater, IntRect(0, 0, 600, 600), &occluded);
     EXPECT_EQ(9-1, layer->fakeLayerTextureUpdater()->prepareRectCount());
 
@@ -1234,12 +1280,11 @@ TEST(TiledLayerChromiumTest, tilesPaintedWithOcclusionAndScaling)
     EXPECT_EQ(1 + 1, occluded.overdrawMetrics().tilesCulledForUpload());
 }
 
-TEST(TiledLayerChromiumTest, visibleContentOpaqueRegion)
+TEST_F(TiledLayerChromiumTest, visibleContentOpaqueRegion)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     TestCCOcclusionTracker occluded;
-    CCTextureUpdater updater;
 
     // The tile size is 100x100, so this invalidates and then paints two tiles in various ways.
 
@@ -1254,6 +1299,9 @@ TEST(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     layer->setVisibleLayerRect(visibleBounds);
     layer->setDrawOpacity(1);
 
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     // If the layer doesn't paint opaque content, then the visibleContentOpaqueRegion should be empty.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateRect(contentBounds);
@@ -1271,6 +1319,7 @@ TEST(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(opaquePaintRect);
     layer->invalidateRect(contentBounds);
     layer->updateLayerRect(updater, contentBounds, &occluded);
+    updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
     EXPECT_EQ(1u, opaqueContents.rects().size());
@@ -1283,6 +1332,7 @@ TEST(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     // If we paint again without invalidating, the same stuff should be opaque.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->updateLayerRect(updater, contentBounds, &occluded);
+    updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
     EXPECT_EQ(1u, opaqueContents.rects().size());
@@ -1297,6 +1347,7 @@ TEST(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateRect(IntRect(0, 0, 1, 1));
     layer->updateLayerRect(updater, contentBounds, &occluded);
+    updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(opaquePaintRect, visibleBounds), opaqueContents.bounds());
     EXPECT_EQ(1u, opaqueContents.rects().size());
@@ -1311,6 +1362,7 @@ TEST(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateRect(IntRect(10, 10, 1, 1));
     layer->updateLayerRect(updater, contentBounds, &occluded);
+    updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_EQ_RECT(intersection(IntRect(10, 100, 90, 100), visibleBounds), opaqueContents.bounds());
     EXPECT_EQ(1u, opaqueContents.rects().size());
@@ -1319,21 +1371,13 @@ TEST(TiledLayerChromiumTest, visibleContentOpaqueRegion)
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 17100, 1);
     EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedTranslucent(), 20000 + 20000 - 17100 + 1 + 1, 1);
     EXPECT_EQ(0, occluded.overdrawMetrics().tilesCulledForUpload());
-
-    // No metrics are recorded in prepaint, so the values should not change from above.
-    layer->idleUpdateLayerRect(updater, contentBounds, &occluded);
-    EXPECT_NEAR(occluded.overdrawMetrics().pixelsPainted(), 20000 * 2 + 1  + 1, 1);
-    EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedOpaque(), 17100, 1);
-    EXPECT_NEAR(occluded.overdrawMetrics().pixelsUploadedTranslucent(), 20000 + 20000 - 17100 + 1 + 1, 1);
-    EXPECT_EQ(0, occluded.overdrawMetrics().tilesCulledForUpload());
 }
 
-TEST(TiledLayerChromiumTest, pixelsPaintedMetrics)
+TEST_F(TiledLayerChromiumTest, pixelsPaintedMetrics)
 {
-    OwnPtr<TextureManager> textureManager = TextureManager::create(4*1024*1024, 2*1024*1024, 1024);
+    OwnPtr<CCPrioritizedTextureManager> textureManager = CCPrioritizedTextureManager::create(4*1024*1024, 1024);
     RefPtr<FakeTiledLayerChromium> layer = adoptRef(new FakeTiledLayerChromium(textureManager.get()));
     TestCCOcclusionTracker occluded;
-    CCTextureUpdater updater;
 
     // The tile size is 100x100, so this invalidates and then paints two tiles in various ways.
 
@@ -1348,10 +1392,14 @@ TEST(TiledLayerChromiumTest, pixelsPaintedMetrics)
     layer->setVisibleLayerRect(visibleBounds);
     layer->setDrawOpacity(1);
 
+    layer->setTexturePriorities(priorityCalculator);
+    textureManager->prioritizeTextures(0);
+
     // Invalidates and paints the whole layer.
     layer->fakeLayerTextureUpdater()->setOpaquePaintRect(IntRect());
     layer->invalidateRect(contentBounds);
     layer->updateLayerRect(updater, contentBounds, &occluded);
+    updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
 
@@ -1366,6 +1414,7 @@ TEST(TiledLayerChromiumTest, pixelsPaintedMetrics)
     layer->invalidateRect(IntRect(0, 0, 1, 1));
     layer->invalidateRect(IntRect(50, 200, 10, 10));
     layer->updateLayerRect(updater, contentBounds, &occluded);
+    updateTextures();
     opaqueContents = layer->visibleContentOpaqueRegion();
     EXPECT_TRUE(opaqueContents.isEmpty());
 
@@ -1377,4 +1426,264 @@ TEST(TiledLayerChromiumTest, pixelsPaintedMetrics)
     EXPECT_EQ(0, occluded.overdrawMetrics().tilesCulledForUpload());
 }
 
+TEST_F(TiledLayerChromiumTest, dontAllocateContentsWhenTargetSurfaceCantBeAllocated)
+{
+    // Initialize without threading support.
+    WebKit::WebCompositor::initialize(0);
+
+    // Tile size is 100x100.
+    IntRect rootRect(0, 0, 300, 200);
+    IntRect childRect(0, 0, 300, 100);
+    IntRect child2Rect(0, 100, 300, 100);
+
+    CCLayerTreeSettings settings;
+    FakeCCLayerTreeHostClient fakeCCLayerTreeHostClient;
+    OwnPtr<CCLayerTreeHost> ccLayerTreeHost = CCLayerTreeHost::create(&fakeCCLayerTreeHostClient, settings);
+    ASSERT_TRUE(ccLayerTreeHost->initializeLayerRendererIfNeeded());
+
+    RefPtr<FakeTiledLayerChromium> root = adoptRef(new FakeTiledLayerChromium(ccLayerTreeHost->contentsTextureManager()));
+    RefPtr<LayerChromium> surface = LayerChromium::create();
+    RefPtr<FakeTiledLayerChromium> child = adoptRef(new FakeTiledLayerChromium(ccLayerTreeHost->contentsTextureManager()));
+    RefPtr<FakeTiledLayerChromium> child2 = adoptRef(new FakeTiledLayerChromium(ccLayerTreeHost->contentsTextureManager()));
+
+    root->setBounds(rootRect.size());
+    root->setAnchorPoint(FloatPoint());
+    root->setVisibleLayerRect(rootRect);
+    root->addChild(surface);
+
+    surface->setForceRenderSurface(true);
+    surface->setAnchorPoint(FloatPoint());
+    surface->setOpacity(0.5);
+    surface->addChild(child);
+    surface->addChild(child2);
+
+    child->setBounds(childRect.size());
+    child->setAnchorPoint(FloatPoint());
+    child->setPosition(childRect.location());
+    child->setVisibleLayerRect(childRect);
+
+    child2->setBounds(child2Rect.size());
+    child2->setAnchorPoint(FloatPoint());
+    child2->setPosition(child2Rect.location());
+    child2->setVisibleLayerRect(child2Rect);
+
+    ccLayerTreeHost->setRootLayer(root);
+    ccLayerTreeHost->setViewportSize(rootRect.size());
+
+    // With a huge memory limit, all layers should update and push their textures.
+    root->invalidateRect(rootRect);
+    child->invalidateRect(childRect);
+    child2->invalidateRect(child2Rect);
+    ccLayerTreeHost->updateLayers(updater, std::numeric_limits<size_t>::max());
+    {
+        DebugScopedSetImplThread implThread;
+        updateTextures(1000);
+        EXPECT_EQ(6, root->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_EQ(3, child->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_EQ(3, child2->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_FALSE(updater.hasMoreUpdates());
+
+        root->fakeLayerTextureUpdater()->clearUpdateCount();
+        child->fakeLayerTextureUpdater()->clearUpdateCount();
+        child2->fakeLayerTextureUpdater()->clearUpdateCount();
+
+        OwnPtr<FakeCCTiledLayerImpl> rootImpl(adoptPtr(new FakeCCTiledLayerImpl(root->id())));
+        OwnPtr<FakeCCTiledLayerImpl> childImpl(adoptPtr(new FakeCCTiledLayerImpl(child->id())));
+        OwnPtr<FakeCCTiledLayerImpl> child2Impl(adoptPtr(new FakeCCTiledLayerImpl(child2->id())));
+        root->pushPropertiesTo(rootImpl.get());
+        child->pushPropertiesTo(childImpl.get());
+        child2->pushPropertiesTo(child2Impl.get());
+
+        for (unsigned i = 0; i < 3; ++i) {
+            for (unsigned j = 0; j < 2; ++j)
+                EXPECT_TRUE(rootImpl->hasTextureIdForTileAt(i, j));
+            EXPECT_TRUE(childImpl->hasTextureIdForTileAt(i, 0));
+            EXPECT_TRUE(child2Impl->hasTextureIdForTileAt(i, 0));
+        }
+    }
+    ccLayerTreeHost->commitComplete();
+
+    // With a memory limit that includes only the root layer (3x2 tiles) and half the surface that
+    // the child layers draw into, the child layers will not be allocated. If the surface isn't
+    // accounted for, then one of the children would fit within the memory limit.
+    root->invalidateRect(rootRect);
+    child->invalidateRect(childRect);
+    child2->invalidateRect(child2Rect);
+    ccLayerTreeHost->updateLayers(updater, (3 * 2 + 3 * 1) * (100 * 100) * 4);
+    {
+        DebugScopedSetImplThread implThread;
+        updateTextures(1000);
+        EXPECT_EQ(6, root->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_EQ(0, child->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_EQ(0, child2->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_FALSE(updater.hasMoreUpdates());
+
+        root->fakeLayerTextureUpdater()->clearUpdateCount();
+        child->fakeLayerTextureUpdater()->clearUpdateCount();
+        child2->fakeLayerTextureUpdater()->clearUpdateCount();
+
+        OwnPtr<FakeCCTiledLayerImpl> rootImpl(adoptPtr(new FakeCCTiledLayerImpl(root->id())));
+        OwnPtr<FakeCCTiledLayerImpl> childImpl(adoptPtr(new FakeCCTiledLayerImpl(child->id())));
+        OwnPtr<FakeCCTiledLayerImpl> child2Impl(adoptPtr(new FakeCCTiledLayerImpl(child2->id())));
+        root->pushPropertiesTo(rootImpl.get());
+        child->pushPropertiesTo(childImpl.get());
+        child2->pushPropertiesTo(child2Impl.get());
+
+        for (unsigned i = 0; i < 3; ++i) {
+            for (unsigned j = 0; j < 2; ++j)
+                EXPECT_TRUE(rootImpl->hasTextureIdForTileAt(i, j));
+            EXPECT_FALSE(childImpl->hasTextureIdForTileAt(i, 0));
+            EXPECT_FALSE(child2Impl->hasTextureIdForTileAt(i, 0));
+        }
+    }
+    ccLayerTreeHost->commitComplete();
+
+    // With a memory limit that includes only half the root layer, no contents will be
+    // allocated. If render surface memory wasn't accounted for, there is enough space
+    // for one of the children layers, but they draw into a surface that can't be
+    // allocated.
+    root->invalidateRect(rootRect);
+    child->invalidateRect(childRect);
+    child2->invalidateRect(child2Rect);
+    ccLayerTreeHost->updateLayers(updater, (3 * 1) * (100 * 100) * 4);
+    {
+        DebugScopedSetImplThread implThread;
+        updateTextures(1000);
+        EXPECT_EQ(0, root->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_EQ(0, child->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_EQ(0, child2->fakeLayerTextureUpdater()->updateCount());
+        EXPECT_FALSE(updater.hasMoreUpdates());
+
+        root->fakeLayerTextureUpdater()->clearUpdateCount();
+        child->fakeLayerTextureUpdater()->clearUpdateCount();
+        child2->fakeLayerTextureUpdater()->clearUpdateCount();
+
+        OwnPtr<FakeCCTiledLayerImpl> rootImpl(adoptPtr(new FakeCCTiledLayerImpl(root->id())));
+        OwnPtr<FakeCCTiledLayerImpl> childImpl(adoptPtr(new FakeCCTiledLayerImpl(child->id())));
+        OwnPtr<FakeCCTiledLayerImpl> child2Impl(adoptPtr(new FakeCCTiledLayerImpl(child2->id())));
+        root->pushPropertiesTo(rootImpl.get());
+        child->pushPropertiesTo(childImpl.get());
+        child2->pushPropertiesTo(child2Impl.get());
+
+        for (unsigned i = 0; i < 3; ++i) {
+            for (unsigned j = 0; j < 2; ++j)
+                EXPECT_FALSE(rootImpl->hasTextureIdForTileAt(i, j));
+            EXPECT_FALSE(childImpl->hasTextureIdForTileAt(i, 0));
+            EXPECT_FALSE(child2Impl->hasTextureIdForTileAt(i, 0));
+        }
+    }
+    ccLayerTreeHost->commitComplete();
+
+    ccLayerTreeHost->contentsTextureManager()->clearAllMemory(&allocator);
+    ccLayerTreeHost->setRootLayer(0);
+    ccLayerTreeHost.clear();
+    WebKit::WebCompositor::shutdown();
+}
+
+class TrackingLayerPainter : public LayerPainterChromium {
+public:
+    static PassOwnPtr<TrackingLayerPainter> create() { return adoptPtr(new TrackingLayerPainter()); }
+
+    virtual void paint(SkCanvas*, const IntRect& contentRect, FloatRect&) OVERRIDE
+    {
+        m_paintedRect = contentRect;
+    }
+
+    const IntRect& paintedRect() const { return m_paintedRect; }
+    void resetPaintedRect() { m_paintedRect = IntRect(); }
+
+private:
+    TrackingLayerPainter() { }
+
+    IntRect m_paintedRect;
+};
+
+class UpdateTrackingTiledLayerChromium : public FakeTiledLayerChromium {
+public:
+    explicit UpdateTrackingTiledLayerChromium(WebCore::CCPrioritizedTextureManager* manager)
+        : FakeTiledLayerChromium(manager)
+    {
+        OwnPtr<TrackingLayerPainter> trackingLayerPainter(TrackingLayerPainter::create());
+        m_trackingLayerPainter = trackingLayerPainter.get();
+        m_layerTextureUpdater = BitmapCanvasLayerTextureUpdater::create(trackingLayerPainter.release(), false);
+    }
+    virtual ~UpdateTrackingTiledLayerChromium() { }
+
+    TrackingLayerPainter* trackingLayerPainter() const { return m_trackingLayerPainter; }
+
+protected:
+    virtual WebCore::LayerTextureUpdater* textureUpdater() const OVERRIDE { return m_layerTextureUpdater.get(); }
+
+private:
+    TrackingLayerPainter* m_trackingLayerPainter;
+    RefPtr<BitmapCanvasLayerTextureUpdater> m_layerTextureUpdater;
+};
+
+TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringPaint)
+{
+    OwnPtr<CCPrioritizedTextureManager> textureManager(CCPrioritizedTextureManager::create(4000000, 4000000));
+    CCPriorityCalculator calculator;
+
+    RefPtr<UpdateTrackingTiledLayerChromium> layer = adoptRef(new UpdateTrackingTiledLayerChromium(textureManager.get()));
+
+    IntRect layerRect(0, 0, 30, 31);
+    layer->setPosition(layerRect.location());
+    layer->setBounds(layerRect.size());
+    layer->setContentsScale(1.5);
+
+    IntRect contentRect(0, 0, 45, 47);
+    EXPECT_EQ(contentRect.size(), layer->contentBounds());
+    layer->setVisibleLayerRect(contentRect);
+
+    layer->setTexturePriorities(calculator);
+    textureManager->prioritizeTextures(0);
+
+    // Update the whole tile.
+    layer->updateLayerRect(updater, contentRect, 0);
+    layer->trackingLayerPainter()->resetPaintedRect();
+
+    EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
+
+    updateTextures();
+
+    // Invalidate the entire layer in content space. When painting, the rect given to webkit should match the layer's bounds.
+    layer->invalidateRect(contentRect);
+    layer->updateLayerRect(updater, contentRect, 0);
+
+    EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
+}
+
+TEST_F(TiledLayerChromiumTest, nonIntegerContentsScaleIsNotDistortedDuringInvalidation)
+{
+    OwnPtr<CCPrioritizedTextureManager> textureManager(CCPrioritizedTextureManager::create(4000000, 4000000));
+    CCPriorityCalculator calculator;
+
+    RefPtr<UpdateTrackingTiledLayerChromium> layer = adoptRef(new UpdateTrackingTiledLayerChromium(textureManager.get()));
+
+    IntRect layerRect(0, 0, 30, 31);
+    layer->setPosition(layerRect.location());
+    layer->setBounds(layerRect.size());
+    layer->setContentsScale(1.3);
+
+    IntRect contentRect(IntPoint(), layer->contentBounds());
+    layer->setVisibleLayerRect(contentRect);
+
+    layer->setTexturePriorities(calculator);
+    textureManager->prioritizeTextures(0);
+
+    // Update the whole tile.
+    layer->updateLayerRect(updater, contentRect, 0);
+    layer->trackingLayerPainter()->resetPaintedRect();
+
+    EXPECT_INT_RECT_EQ(IntRect(), layer->trackingLayerPainter()->paintedRect());
+
+    updateTextures();
+
+    // Invalidate the entire layer in layer space. When painting, the rect given to webkit should match the layer's bounds.
+    layer->setNeedsDisplayRect(layerRect);
+    layer->updateLayerRect(updater, contentRect, 0);
+
+    EXPECT_INT_RECT_EQ(layerRect, layer->trackingLayerPainter()->paintedRect());
+}
+
 } // namespace
diff --git a/Source/WebKit/chromium/tests/WebAnimationTest.cpp b/Source/WebKit/chromium/tests/WebAnimationTest.cpp
new file mode 100644
index 000000000..df830cae6
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebAnimationTest.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebAnimation.h>
+
+#include <gtest/gtest.h>
+#include <public/WebFloatAnimationCurve.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+using namespace WebKit;
+
+namespace {
+
+// Linux/Win bots failed on this test.
+// https://bugs.webkit.org/show_bug.cgi?id=90651
+#if OS(WINDOWS)
+#define MAYBE_DefaultSettings DISABLED_DefaultSettings
+#elif OS(LINUX)
+#define MAYBE_DefaultSettings DISABLED_DefaultSettings
+#else
+#define MAYBE_DefaultSettings DefaultSettings
+#endif
+TEST(WebAnimationTest, MAYBE_DefaultSettings)
+{
+    WebFloatAnimationCurve curve;
+    WebAnimation animation(curve, WebAnimation::WebAnimationOpacity);
+
+    // Ensure that the defaults are correct.
+    EXPECT_EQ(1, animation.iterations());
+    EXPECT_EQ(0, animation.startTime());
+    EXPECT_EQ(0, animation.timeOffset());
+    EXPECT_FALSE(animation.alternatesDirection());
+}
+
+// Linux/Win bots failed on this test.
+// https://bugs.webkit.org/show_bug.cgi?id=90651
+#if OS(WINDOWS)
+#define MAYBE_ModifiedSettings DISABLED_ModifiedSettings
+#elif OS(LINUX)
+#define MAYBE_ModifiedSettings DISABLED_ModifiedSettings
+#else
+#define MAYBE_ModifiedSettings ModifiedSettings
+#endif
+TEST(WebAnimationTest, MAYBE_ModifiedSettings)
+{
+    WebFloatAnimationCurve curve;
+    WebAnimation animation(curve, WebAnimation::WebAnimationOpacity);
+    animation.setIterations(2);
+    animation.setStartTime(2);
+    animation.setTimeOffset(2);
+    animation.setAlternatesDirection(true);
+
+    EXPECT_EQ(2, animation.iterations());
+    EXPECT_EQ(2, animation.startTime());
+    EXPECT_EQ(2, animation.timeOffset());
+    EXPECT_TRUE(animation.alternatesDirection());
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/WebFloatAnimationCurveTest.cpp b/Source/WebKit/chromium/tests/WebFloatAnimationCurveTest.cpp
new file mode 100644
index 000000000..bdfe4ec7d
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebFloatAnimationCurveTest.cpp
@@ -0,0 +1,236 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebFloatAnimationCurve.h>
+
+#include "cc/CCTimingFunction.h"
+
+#include <gtest/gtest.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+using namespace WebKit;
+
+namespace {
+
+// Tests that a float animation with one keyframe works as expected.
+TEST(WebFloatAnimationCurveTest, OneFloatKeyframe)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 2), WebAnimationCurve::TimingFunctionTypeLinear);
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve.getValue(0));
+    EXPECT_FLOAT_EQ(2, curve.getValue(0.5));
+    EXPECT_FLOAT_EQ(2, curve.getValue(1));
+    EXPECT_FLOAT_EQ(2, curve.getValue(2));
+}
+
+// Tests that a float animation with two keyframes works as expected.
+TEST(WebFloatAnimationCurveTest, TwoFloatKeyframe)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 2), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(1, 4), WebAnimationCurve::TimingFunctionTypeLinear);
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve.getValue(0));
+    EXPECT_FLOAT_EQ(3, curve.getValue(0.5));
+    EXPECT_FLOAT_EQ(4, curve.getValue(1));
+    EXPECT_FLOAT_EQ(4, curve.getValue(2));
+}
+
+// Tests that a float animation with three keyframes works as expected.
+TEST(WebFloatAnimationCurveTest, ThreeFloatKeyframe)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 2), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(1, 4), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(2, 8), WebAnimationCurve::TimingFunctionTypeLinear);
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve.getValue(0));
+    EXPECT_FLOAT_EQ(3, curve.getValue(0.5));
+    EXPECT_FLOAT_EQ(4, curve.getValue(1));
+    EXPECT_FLOAT_EQ(6, curve.getValue(1.5));
+    EXPECT_FLOAT_EQ(8, curve.getValue(2));
+    EXPECT_FLOAT_EQ(8, curve.getValue(3));
+}
+
+// Tests that a float animation with multiple keys at a given time works sanely.
+TEST(WebFloatAnimationCurveTest, RepeatedFloatKeyTimes)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 4), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(1, 4), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(1, 6), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(2, 6), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    EXPECT_FLOAT_EQ(4, curve.getValue(-1));
+    EXPECT_FLOAT_EQ(4, curve.getValue(0));
+    EXPECT_FLOAT_EQ(4, curve.getValue(0.5));
+
+    // There is a discontinuity at 1. Any value between 4 and 6 is valid.
+    float value = curve.getValue(1);
+    EXPECT_TRUE(value >= 4 && value <= 6);
+
+    EXPECT_FLOAT_EQ(6, curve.getValue(1.5));
+    EXPECT_FLOAT_EQ(6, curve.getValue(2));
+    EXPECT_FLOAT_EQ(6, curve.getValue(3));
+}
+
+// Tests that the keyframes may be added out of order.
+TEST(WebFloatAnimationCurveTest, UnsortedKeyframes)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(2, 8), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(0, 2), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(1, 4), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1));
+    EXPECT_FLOAT_EQ(2, curve.getValue(0));
+    EXPECT_FLOAT_EQ(3, curve.getValue(0.5));
+    EXPECT_FLOAT_EQ(4, curve.getValue(1));
+    EXPECT_FLOAT_EQ(6, curve.getValue(1.5));
+    EXPECT_FLOAT_EQ(8, curve.getValue(2));
+    EXPECT_FLOAT_EQ(8, curve.getValue(3));
+}
+
+// Tests that a cubic bezier timing function works as expected.
+TEST(WebFloatAnimationCurveTest, CubicBezierTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 0), 0.25, 0, 0.75, 1);
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    EXPECT_FLOAT_EQ(0, curve.getValue(0));
+    EXPECT_LT(0, curve.getValue(0.25));
+    EXPECT_GT(0.25, curve.getValue(0.25));
+    EXPECT_FLOAT_EQ(0.5, curve.getValue(0.5));
+    EXPECT_LT(0.75, curve.getValue(0.75));
+    EXPECT_GT(1, curve.getValue(0.75));
+    EXPECT_FLOAT_EQ(1, curve.getValue(1));
+}
+
+// Tests that an ease timing function works as expected.
+TEST(WebFloatAnimationCurveTest, EaseTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 0), WebAnimationCurve::TimingFunctionTypeEase);
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time));
+    }
+}
+
+// Tests using a linear timing function.
+TEST(WebFloatAnimationCurveTest, LinearTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 0), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(time, curve.getValue(time));
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebFloatAnimationCurveTest, EaseInTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 0), WebAnimationCurve::TimingFunctionTypeEaseIn);
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseInTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time));
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebFloatAnimationCurveTest, EaseOutTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 0), WebAnimationCurve::TimingFunctionTypeEaseOut);
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseOutTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time));
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebFloatAnimationCurveTest, EaseInOutTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 0), WebAnimationCurve::TimingFunctionTypeEaseInOut);
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseInOutTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time));
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebFloatAnimationCurveTest, CustomBezierTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    double x1 = 0.3;
+    double y1 = 0.2;
+    double x2 = 0.8;
+    double y2 = 0.7;
+    curve.add(WebFloatKeyframe(0, 0), x1, y1, x2, y2);
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCCubicBezierTimingFunction::create(x1, y1, x2, y2));
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time));
+    }
+}
+
+// Tests that the default timing function is indeed ease.
+TEST(WebFloatAnimationCurveTest, DefaultTimingFunction)
+{
+    WebFloatAnimationCurve curve;
+    curve.add(WebFloatKeyframe(0, 0));
+    curve.add(WebFloatKeyframe(1, 1), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time));
+    }
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/WebFrameTest.cpp b/Source/WebKit/chromium/tests/WebFrameTest.cpp
index 4e2b0c5ea..6b14cff0f 100644
--- a/Source/WebKit/chromium/tests/WebFrameTest.cpp
+++ b/Source/WebKit/chromium/tests/WebFrameTest.cpp
@@ -419,6 +419,40 @@ TEST_F(WebFrameTest, ReloadDoesntSetRedirect)
     webkit_support::ServeAsynchronousMockedRequests();
 }
 
+TEST_F(WebFrameTest, ReloadWithOverrideURLPreservesState)
+{
+    const std::string firstURL = "find.html";
+    const std::string secondURL = "form.html";
+    const std::string thirdURL = "history.html";
+    const float pageScaleFactor = 1.1684f;
+    const int pageWidth = 640;
+    const int pageHeight = 480;
+
+    registerMockedHttpURLLoad(firstURL);
+    registerMockedHttpURLLoad(secondURL);
+    registerMockedHttpURLLoad(thirdURL);
+
+    WebViewImpl* webViewImpl = static_cast<WebViewImpl*>(FrameTestHelpers::createWebViewAndLoad(m_baseURL + firstURL, true));
+    webViewImpl->resize(WebSize(pageWidth, pageHeight));
+    webViewImpl->mainFrame()->setScrollOffset(WebSize(pageWidth / 4, pageHeight / 4));
+    webViewImpl->setPageScaleFactorPreservingScrollOffset(pageScaleFactor);
+
+    WebSize previousOffset = webViewImpl->mainFrame()->scrollOffset();
+    float previousScale = webViewImpl->pageScaleFactor();
+
+    // Reload the page using the cache.
+    webViewImpl->mainFrame()->reloadWithOverrideURL(GURL(m_baseURL + secondURL), false);
+    webkit_support::ServeAsynchronousMockedRequests();
+    ASSERT_EQ(previousOffset, webViewImpl->mainFrame()->scrollOffset());
+    ASSERT_EQ(previousScale, webViewImpl->pageScaleFactor());
+
+    // Reload the page while ignoring the cache.
+    webViewImpl->mainFrame()->reloadWithOverrideURL(GURL(m_baseURL + thirdURL), true);
+    webkit_support::ServeAsynchronousMockedRequests();
+    ASSERT_EQ(previousOffset, webViewImpl->mainFrame()->scrollOffset());
+    ASSERT_EQ(previousScale, webViewImpl->pageScaleFactor());
+}
+
 TEST_F(WebFrameTest, IframeRedirect)
 {
     registerMockedHttpURLLoad("iframe_redirect.html");
diff --git a/Source/WebKit/chromium/tests/WebLayerTest.cpp b/Source/WebKit/chromium/tests/WebLayerTest.cpp
index bc4929311..12deb5991 100644
--- a/Source/WebKit/chromium/tests/WebLayerTest.cpp
+++ b/Source/WebKit/chromium/tests/WebLayerTest.cpp
@@ -65,7 +65,7 @@ public:
 
 class MockWebContentLayerClient : public WebContentLayerClient {
 public:
-    MOCK_METHOD3(paintContents, void(WebCanvas*, const WebRect& clip, WebRect& opaque));
+    MOCK_METHOD3(paintContents, void(WebCanvas*, const WebRect& clip, WebFloatRect& opaque));
 };
 
 class WebLayerTest : public Test {
diff --git a/Source/WebKit/chromium/tests/WebTransformAnimationCurveTest.cpp b/Source/WebKit/chromium/tests/WebTransformAnimationCurveTest.cpp
new file mode 100644
index 000000000..f18f87be2
--- /dev/null
+++ b/Source/WebKit/chromium/tests/WebTransformAnimationCurveTest.cpp
@@ -0,0 +1,297 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <public/WebTransformAnimationCurve.h>
+
+#include "cc/CCTimingFunction.h"
+
+#include <gtest/gtest.h>
+#include <public/WebTransformOperations.h>
+#include <public/WebTransformationMatrix.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+using namespace WebKit;
+
+namespace {
+
+// Tests that a transform animation with one keyframe works as expected.
+TEST(WebTransformAnimationCurveTest, OneTransformKeyframe)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations;
+    operations.appendTranslate(2, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1).m41());
+    EXPECT_FLOAT_EQ(2, curve.getValue(0).m41());
+    EXPECT_FLOAT_EQ(2, curve.getValue(0.5).m41());
+    EXPECT_FLOAT_EQ(2, curve.getValue(1).m41());
+    EXPECT_FLOAT_EQ(2, curve.getValue(2).m41());
+}
+
+// Tests that a transform animation with two keyframes works as expected.
+TEST(WebTransformAnimationCurveTest, TwoTransformKeyframe)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(2, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(4, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1).m41());
+    EXPECT_FLOAT_EQ(2, curve.getValue(0).m41());
+    EXPECT_FLOAT_EQ(3, curve.getValue(0.5).m41());
+    EXPECT_FLOAT_EQ(4, curve.getValue(1).m41());
+    EXPECT_FLOAT_EQ(4, curve.getValue(2).m41());
+}
+
+// Tests that a transform animation with three keyframes works as expected.
+TEST(WebTransformAnimationCurveTest, ThreeTransformKeyframe)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(2, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(4, 0, 0);
+    WebKit::WebTransformOperations operations3;
+    operations3.appendTranslate(8, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(2, operations3), WebAnimationCurve::TimingFunctionTypeLinear);
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1).m41());
+    EXPECT_FLOAT_EQ(2, curve.getValue(0).m41());
+    EXPECT_FLOAT_EQ(3, curve.getValue(0.5).m41());
+    EXPECT_FLOAT_EQ(4, curve.getValue(1).m41());
+    EXPECT_FLOAT_EQ(6, curve.getValue(1.5).m41());
+    EXPECT_FLOAT_EQ(8, curve.getValue(2).m41());
+    EXPECT_FLOAT_EQ(8, curve.getValue(3).m41());
+}
+
+// Tests that a transform animation with multiple keys at a given time works sanely.
+TEST(WebTransformAnimationCurveTest, RepeatedTransformKeyTimes)
+{
+    // A step function.
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(4, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(4, 0, 0);
+    WebKit::WebTransformOperations operations3;
+    operations3.appendTranslate(6, 0, 0);
+    WebKit::WebTransformOperations operations4;
+    operations4.appendTranslate(6, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(1, operations3), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(2, operations4), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    EXPECT_FLOAT_EQ(4, curve.getValue(-1).m41());
+    EXPECT_FLOAT_EQ(4, curve.getValue(0).m41());
+    EXPECT_FLOAT_EQ(4, curve.getValue(0.5).m41());
+
+    // There is a discontinuity at 1. Any value between 4 and 6 is valid.
+    WebTransformationMatrix value = curve.getValue(1);
+    EXPECT_TRUE(value.m41() >= 4 && value.m41() <= 6);
+
+    EXPECT_FLOAT_EQ(6, curve.getValue(1.5).m41());
+    EXPECT_FLOAT_EQ(6, curve.getValue(2).m41());
+    EXPECT_FLOAT_EQ(6, curve.getValue(3).m41());
+}
+
+// Tests that the keyframes may be added out of order.
+TEST(WebTransformAnimationCurveTest, UnsortedKeyframes)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(2, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(4, 0, 0);
+    WebKit::WebTransformOperations operations3;
+    operations3.appendTranslate(8, 0, 0);
+    curve.add(WebTransformKeyframe(2, operations3), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    EXPECT_FLOAT_EQ(2, curve.getValue(-1).m41());
+    EXPECT_FLOAT_EQ(2, curve.getValue(0).m41());
+    EXPECT_FLOAT_EQ(3, curve.getValue(0.5).m41());
+    EXPECT_FLOAT_EQ(4, curve.getValue(1).m41());
+    EXPECT_FLOAT_EQ(6, curve.getValue(1.5).m41());
+    EXPECT_FLOAT_EQ(8, curve.getValue(2).m41());
+    EXPECT_FLOAT_EQ(8, curve.getValue(3).m41());
+}
+
+// Tests that a cubic bezier timing function works as expected.
+TEST(WebTransformAnimationCurveTest, CubicBezierTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), 0.25, 0, 0.75, 1);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+    EXPECT_FLOAT_EQ(0, curve.getValue(0).m41());
+    EXPECT_LT(0, curve.getValue(0.25).m41());
+    EXPECT_GT(0.25, curve.getValue(0.25).m41());
+    EXPECT_FLOAT_EQ(0.5, curve.getValue(0.5).m41());
+    EXPECT_LT(0.75, curve.getValue(0.75).m41());
+    EXPECT_GT(1, curve.getValue(0.75).m41());
+    EXPECT_FLOAT_EQ(1, curve.getValue(1).m41());
+}
+
+// Tests that an ease timing function works as expected.
+TEST(WebTransformAnimationCurveTest, EaseTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeEase);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time).m41());
+    }
+}
+
+// Tests using a linear timing function.
+TEST(WebTransformAnimationCurveTest, LinearTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeLinear);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(time, curve.getValue(time).m41());
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebTransformAnimationCurveTest, EaseInTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeEaseIn);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseInTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time).m41());
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebTransformAnimationCurveTest, EaseOutTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeEaseOut);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseOutTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time).m41());
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebTransformAnimationCurveTest, EaseInOutTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), WebAnimationCurve::TimingFunctionTypeEaseInOut);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseInOutTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time).m41());
+    }
+}
+
+// Tests that an ease in timing function works as expected.
+TEST(WebTransformAnimationCurveTest, CustomBezierTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    double x1 = 0.3;
+    double y1 = 0.2;
+    double x2 = 0.8;
+    double y2 = 0.7;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1), x1, y1, x2, y2);
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCCubicBezierTimingFunction::create(x1, y1, x2, y2));
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time).m41());
+    }
+}
+
+// Tests that the default timing function is indeed ease.
+TEST(WebTransformAnimationCurveTest, DefaultTimingFunction)
+{
+    WebTransformAnimationCurve curve;
+    WebKit::WebTransformOperations operations1;
+    operations1.appendTranslate(0, 0, 0);
+    WebKit::WebTransformOperations operations2;
+    operations2.appendTranslate(1, 0, 0);
+    curve.add(WebTransformKeyframe(0, operations1));
+    curve.add(WebTransformKeyframe(1, operations2), WebAnimationCurve::TimingFunctionTypeLinear);
+
+    OwnPtr<WebCore::CCTimingFunction> timingFunction(WebCore::CCEaseTimingFunction::create());
+    for (int i = 0; i <= 4; ++i) {
+        const double time = i * 0.25;
+        EXPECT_FLOAT_EQ(timingFunction->getValue(time), curve.getValue(time).m41());
+    }
+}
+
+} // namespace
diff --git a/Source/WebKit/chromium/tests/WebViewTest.cpp b/Source/WebKit/chromium/tests/WebViewTest.cpp
index f858fe7b5..7903721d9 100644
--- a/Source/WebKit/chromium/tests/WebViewTest.cpp
+++ b/Source/WebKit/chromium/tests/WebViewTest.cpp
@@ -92,6 +92,29 @@ private:
     TestData m_testData;
 };
 
+class FormChangeWebViewClient : public WebViewClient {
+public:
+    // WebViewClient methods
+    virtual void didChangeFormState(const WebNode& node)
+    {
+        m_focused = node.focused();
+        m_called = true;
+    }
+
+    // Local methods
+    void reset()
+    {
+        m_called = false;
+        m_focused = false;
+    }
+    bool called() { return m_called; }
+    bool focused() { return m_focused; }
+
+private:
+    bool m_called;
+    bool m_focused;
+};
+
 class WebViewTest : public testing::Test {
 public:
     WebViewTest()
@@ -306,7 +329,7 @@ TEST_F(WebViewTest, DISABLED_TextInputType)
 
 }
 
-TEST_F(WebViewTest, SetEditableSelectionOffsets)
+TEST_F(WebViewTest, SetEditableSelectionOffsetsAndTextInputInfo)
 {
     FrameTestHelpers::registerMockedURLLoad(m_baseURL, "input_field_populated.html");
     WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "input_field_populated.html");
@@ -314,6 +337,12 @@ TEST_F(WebViewTest, SetEditableSelectionOffsets)
     webView->setEditableSelectionOffsets(5, 13);
     WebFrameImpl* frame = static_cast<WebFrameImpl*>(webView->mainFrame());
     EXPECT_EQ("56789abc", frame->selectionAsText());
+    WebTextInputInfo info = webView->textInputInfo();
+    EXPECT_EQ("0123456789abcdefghijklmnopqrstuvwxyz", info.value);
+    EXPECT_EQ(5, info.selectionStart);
+    EXPECT_EQ(13, info.selectionEnd);
+    EXPECT_EQ(-1, info.compositionStart);
+    EXPECT_EQ(-1, info.compositionEnd);
     webView->close();
 
     FrameTestHelpers::registerMockedURLLoad(m_baseURL, "content_editable_populated.html");
@@ -322,6 +351,28 @@ TEST_F(WebViewTest, SetEditableSelectionOffsets)
     webView->setEditableSelectionOffsets(8, 19);
     frame = static_cast<WebFrameImpl*>(webView->mainFrame());
     EXPECT_EQ("89abcdefghi", frame->selectionAsText());
+    info = webView->textInputInfo();
+    EXPECT_EQ("0123456789abcdefghijklmnopqrstuvwxyz", info.value);
+    EXPECT_EQ(8, info.selectionStart);
+    EXPECT_EQ(19, info.selectionEnd);
+    EXPECT_EQ(-1, info.compositionStart);
+    EXPECT_EQ(-1, info.compositionEnd);
+    webView->close();
+}
+
+TEST_F(WebViewTest, FormChange)
+{
+    FormChangeWebViewClient client;
+    client.reset();
+    FrameTestHelpers::registerMockedURLLoad(m_baseURL, "input_field_set_value_while_focused.html");
+    WebView* webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "input_field_set_value_while_focused.html", true, 0, &client);
+    EXPECT_TRUE(client.called());
+    EXPECT_TRUE(client.focused());
+    client.reset();
+    FrameTestHelpers::registerMockedURLLoad(m_baseURL, "input_field_set_value_while_not_focused.html");
+    webView = FrameTestHelpers::createWebViewAndLoad(m_baseURL + "input_field_set_value_while_not_focused.html", true, 0, &client);
+    EXPECT_TRUE(client.called());
+    EXPECT_FALSE(client.focused());
     webView->close();
 }
 
diff --git a/Source/WebKit/chromium/tests/data/input_field_set_value_while_focused.html b/Source/WebKit/chromium/tests/data/input_field_set_value_while_focused.html
new file mode 100644
index 000000000..e6c73eaca
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/input_field_set_value_while_focused.html
@@ -0,0 +1,6 @@
+<input id='field'/>
+<script>
+  var field = document.getElementById('field');
+  field.focus();
+  field.value = 'some text';
+</script>
diff --git a/Source/WebKit/chromium/tests/data/input_field_set_value_while_not_focused.html b/Source/WebKit/chromium/tests/data/input_field_set_value_while_not_focused.html
new file mode 100644
index 000000000..4e578d44d
--- /dev/null
+++ b/Source/WebKit/chromium/tests/data/input_field_set_value_while_not_focused.html
@@ -0,0 +1,5 @@
+<input id='field'/>
+<script>
+  var field = document.getElementById('field');
+  field.value = 'some text';
+</script>
diff --git a/Source/WebKit/efl/ChangeLog b/Source/WebKit/efl/ChangeLog
index 2a675753b..141f8bf1b 100644
--- a/Source/WebKit/efl/ChangeLog
+++ b/Source/WebKit/efl/ChangeLog
@@ -1,3 +1,357 @@
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        LayoutTestController.dumpConfigurationForViewport should move to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=45652
+
+        Reviewed by Eric Seidel.
+
+        * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportEfl.h:
+
+2012-07-09  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Battery status code needs refactoring to be reused in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=90760
+
+        Reviewed by Hajime Morita.
+
+        Add BatteryClientEfl to WebKit, which uses BatteryProviderEfl from
+        WebCore internally.
+
+        * WebCoreSupport/BatteryClientEfl.cpp: Added.
+        (BatteryClientEfl::BatteryClientEfl):
+        (BatteryClientEfl::setController):
+        (BatteryClientEfl::startUpdating):
+        (BatteryClientEfl::stopUpdating):
+        (BatteryClientEfl::batteryControllerDestroyed):
+        (BatteryClientEfl::didChangeBatteryStatus):
+        * WebCoreSupport/BatteryClientEfl.h: Renamed from Source/WebCore/platform/efl/BatteryClientEfl.h.
+        (WebCore):
+        (BatteryClientEfl):
+        (BatteryClientEfl::~BatteryClientEfl):
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+
+2012-07-09  Adam Klein  <adamk@chromium.org>
+
+        Rename WebCore::WebKitMutationObserver to WebCore::MutationObserver
+        https://bugs.webkit.org/show_bug.cgi?id=90810
+
+        Reviewed by Ojan Vafai.
+
+        * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
+        (DumpRenderTreeSupportEfl::deliverAllMutationsIfNecessary):
+
+2012-07-09  Krzysztof Czech  <k.czech@samsung.com>
+
+        [EFL] Simplify runTest function by defining default arguments.
+        https://bugs.webkit.org/show_bug.cgi?id=90525
+
+        Reviewed by Chang Shu.
+
+        Default arguments will simplify macro RUN_TEST.
+        Function will only have one mandatory argument, callback test function.
+        Added static modifiers to callback functions.
+
+        * tests/UnitTestUtils/EWKTestBase.h:
+        (EWKTestBase):
+        * tests/test_ewk_view.cpp:
+        (ewkViewEditableGetCb):
+        (TEST):
+        (ewkViewUriGetCb):
+
+2012-07-08  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] REGRESSION (r122035): fullscreen/exit-full-screen-iframe.html is crashing
+        https://bugs.webkit.org/show_bug.cgi?id=90735
+
+        Reviewed by Antonio Gomes.
+
+        Keep a reference to the Element passed to enterFullScreenForElement() so
+        that we can reuse it later in exitFullScreenForElement(). This is needed
+        because the Element passed to exitFullScreenForElement() may be null.
+        This fixes the crash for the fullscreen/exit-full-screen-iframe.html
+        test introduced in r122035.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::enterFullScreenForElement):
+        (WebCore::ChromeClientEfl::exitFullScreenForElement):
+        * WebCoreSupport/ChromeClientEfl.h:
+        (ChromeClientEfl):
+
+2012-07-07  Jinwoo Song  <jinwoo7.song@samsung.com>
+
+        [EFL] Fix build break when Accelerated Compositing is on.
+        https://bugs.webkit.org/show_bug.cgi?id=90718
+
+        Unreviewed build fix.
+
+        ewk_view_accelerated_compositing_XXX APIs are in ewk_view_private.h
+
+        * WebCoreSupport/PageClientEfl.cpp:
+        (PageClientEfl::createEvasObjectForAcceleratedCompositing):
+        (PageClientEfl::acceleratedCompositingContext):
+        * WebCoreSupport/PageClientEfl.h:
+        (PageClientEfl):
+
+2012-07-06  Seokju Kwon  <seokju.kwon@samsung.com>
+
+        [EFL] Add Web Inspector to WebKit-EFL
+        https://bugs.webkit.org/show_bug.cgi?id=83865
+
+        Reviewed by Pavel Feldman.
+
+        EFL port implementation for Web Inspector.
+        Implementation of InspectorClientEfl and InspectorFrontendClientEfl
+        for using the Web Inspector in WebKit-EFL with new EWK APIs.
+
+        * WebCoreSupport/InspectorClientEfl.cpp:
+        (WebCore::notifyWebInspectorDestroy):
+        (WebCore):
+        (InspectorFrontendSettingsEfl):
+        (WebCore::InspectorFrontendSettingsEfl::getProperty):
+        (WebCore::InspectorFrontendSettingsEfl::setProperty):
+        (WebCore::InspectorClientEfl::InspectorClientEfl):
+        (WebCore::InspectorClientEfl::~InspectorClientEfl):
+        (WebCore::InspectorClientEfl::inspectorDestroyed):
+        (WebCore::InspectorClientEfl::openInspectorFrontend):
+        (WebCore::InspectorClientEfl::closeInspectorFrontend):
+        (WebCore::InspectorClientEfl::bringFrontendToFront):
+        (WebCore::InspectorClientEfl::sendMessageToFrontend):
+        (WebCore::InspectorClientEfl::releaseFrontendPage):
+        (WebCore::InspectorClientEfl::inspectorFilesPath):
+        (WebCore::InspectorFrontendClientEfl::InspectorFrontendClientEfl):
+        (WebCore::InspectorFrontendClientEfl::~InspectorFrontendClientEfl):
+        (WebCore::InspectorFrontendClientEfl::localizedStringsURL):
+        (WebCore::InspectorFrontendClientEfl::hiddenPanels):
+        (WebCore::InspectorFrontendClientEfl::bringToFront):
+        (WebCore::InspectorFrontendClientEfl::closeWindow):
+        (WebCore::InspectorFrontendClientEfl::inspectedURLChanged):
+        (WebCore::InspectorFrontendClientEfl::attachWindow):
+        (WebCore::InspectorFrontendClientEfl::detachWindow):
+        (WebCore::InspectorFrontendClientEfl::setAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientEfl::destroyInspectorWindow):
+        * WebCoreSupport/InspectorClientEfl.h:
+        (WebCore):
+        (InspectorClientEfl):
+        (InspectorFrontendClientEfl):
+        (WebCore::InspectorFrontendClientEfl::disconnectInspectorClient):
+        * ewk/ewk_view.cpp:
+        (_Ewk_View_Private_Data):
+        (_ewk_view_priv_new):
+        (ewk_view_web_inspector_show):
+        (ewk_view_web_inspector_close):
+        (ewk_view_web_inspector_view_get):
+        (ewk_view_web_inspector_view_set):
+        * ewk/ewk_view.h:
+
+2012-07-05  Kihong Kwon  <kihong.kwon@samsung.com>
+
+        [EFL] Change class name from NotificationClientEfl to NotificationPresenterClientEfl.
+        https://bugs.webkit.org/show_bug.cgi?id=90542
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Change class name from NotificationClientEfl to NotificationPresenterClientEfl
+        to be in line with other ports.(qt, chromium, blackberry)
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        * WebCoreSupport/NotificationPresenterClientEfl.cpp: Renamed from Source/WebKit/efl/WebCoreSupport/NotificationClientEfl.cpp.
+        (WebCore):
+        (WebCore::NotificationPresenterClientEfl::NotificationPresenterClientEfl):
+        (WebCore::NotificationPresenterClientEfl::~NotificationPresenterClientEfl):
+        (WebCore::NotificationPresenterClientEfl::show):
+        (WebCore::NotificationPresenterClientEfl::cancel):
+        (WebCore::NotificationPresenterClientEfl::notificationObjectDestroyed):
+        (WebCore::NotificationPresenterClientEfl::notificationControllerDestroyed):
+        (WebCore::NotificationPresenterClientEfl::requestPermission):
+        (WebCore::NotificationPresenterClientEfl::checkPermission):
+        (WebCore::NotificationPresenterClientEfl::cancelRequestsForPermission):
+        * WebCoreSupport/NotificationPresenterClientEfl.h: Renamed from Source/WebKit/efl/WebCoreSupport/NotificationClientEfl.h.
+        (WebCore):
+        (NotificationPresenterClientEfl):
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * ewk/ewk_main.cpp:
+        (_ewk_init_body):
+
+2012-07-02  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [EFL] Rename NotificationPresenterEfl with NotificationClientEfl
+        https://bugs.webkit.org/show_bug.cgi?id=90370
+
+        Reviewed by Csaba Osztrogonác.
+
+        Bug 80488 renamed NotificationPresenter with NotificationClient. So, EFL port needs to adjust it as well.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        * WebCoreSupport/NotificationClientEfl.cpp: Renamed from Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.cpp.
+        (WebCore):
+        (WebCore::NotificationClientEfl::NotificationClientEfl):
+        (WebCore::NotificationClientEfl::~NotificationClientEfl):
+        (WebCore::NotificationClientEfl::show):
+        (WebCore::NotificationClientEfl::cancel):
+        (WebCore::NotificationClientEfl::notificationObjectDestroyed):
+        (WebCore::NotificationClientEfl::notificationControllerDestroyed):
+        (WebCore::NotificationClientEfl::requestPermission):
+        (WebCore::NotificationClientEfl::checkPermission):
+        (WebCore::NotificationClientEfl::cancelRequestsForPermission):
+        * WebCoreSupport/NotificationClientEfl.h: Renamed from Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.h.
+        (WebCore):
+        (NotificationClientEfl):
+
+2012-06-29  Krzysztof Czech  <k.czech@samsung.com>, Tomasz Morawski <t.morawski@samsung.com>
+
+        [EFL] Implementation of testing framework and unit tests for WebKit-EFL port.
+        https://bugs.webkit.org/show_bug.cgi?id=68509
+
+        Reviewed by Chang Shu.
+
+        Testing framework is based on gtest library. Gtest library is part of the WebKit project. Framework is devided into base part and view part.
+        Base part takes care of efl initialization, defines test macros and prepares test to run. View part is a context of each test.
+
+        * tests/UnitTestUtils/EWKTestBase.cpp: Added.
+        (EWKUnitTests):
+        (EWKUnitTests::EWKTestBase::init):
+        (EWKUnitTests::EWKTestBase::shutdown):
+        (EWKUnitTests::EWKTestBase::shutdownAll):
+        (EWKUnitTests::EWKTestBase::startTest):
+        (EWKUnitTests::EWKTestBase::endTest):
+        (EWKUnitTests::EWKTestBase::createTest):
+        (EWKUnitTests::EWKTestBase::runTest):
+        * tests/UnitTestUtils/EWKTestBase.h: Added.
+        (EWKUnitTests):
+        (EWKTestBase):
+        * tests/UnitTestUtils/EWKTestConfig.h: Added.
+        (Config):
+        * tests/UnitTestUtils/EWKTestView.cpp: Added.
+        (EWKUnitTests):
+        (EWKUnitTests::EWKTestEcoreEvas::EWKTestEcoreEvas):
+        (EWKUnitTests::EWKTestEcoreEvas::evas):
+        (EWKUnitTests::EWKTestEcoreEvas::show):
+        (EWKUnitTests::EWKTestView::EWKTestView):
+        (EWKUnitTests::EWKTestView::init):
+        (EWKUnitTests::EWKTestView::show):
+        (EWKUnitTests::EWKTestView::mainFrame):
+        (EWKUnitTests::EWKTestView::evas):
+        (EWKUnitTests::EWKTestView::bindEvents):
+        * tests/UnitTestUtils/EWKTestView.h: Added.
+        (EWKUnitTests):
+        (EWKTestEcoreEvas):
+        (EWKTestView):
+        (EWKUnitTests::EWKTestView::webView):
+        * tests/resources/default_test_page.html: Added.
+        * tests/test_ewk_view.cpp: Added.
+        (ewkViewEditableGetCb):
+        (TEST):
+        (ewkViewUriGetCb):
+        * tests/test_runner.cpp: Added.
+        (parseCustomArguments):
+        (main):
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        Updated the call to computeViewportAttributes.
+
+        * WebCoreSupport/DumpRenderTreeSupportEfl.cpp:
+        (DumpRenderTreeSupportEfl::dumpConfigurationForViewport):
+        * ewk/ewk_view.cpp:
+        (_ewk_view_viewport_attributes_compute):
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121398.
+        http://trac.webkit.org/changeset/121398
+        https://bugs.webkit.org/show_bug.cgi?id=90136
+
+        broke efl build (Requested by ryuan on #webkit).
+
+        * tests/UnitTestUtils/EWKTestBase.cpp: Removed.
+        * tests/UnitTestUtils/EWKTestBase.h: Removed.
+        * tests/UnitTestUtils/EWKTestConfig.h: Removed.
+        * tests/UnitTestUtils/EWKTestView.cpp: Removed.
+        * tests/UnitTestUtils/EWKTestView.h: Removed.
+        * tests/resources/default_test_page.html: Removed.
+        * tests/test_ewk_view.cpp: Removed.
+        * tests/test_runner.cpp: Removed.
+
+2012-06-27  Krzysztof Czech  <k.czech@samsung.com>
+
+        [EFL] Implementation of testing framework and unit tests for WebKit-EFL port.
+        https://bugs.webkit.org/show_bug.cgi?id=68509
+
+        Reviewed by Chang Shu.
+
+        Testing framework is based on gtest library. Gtest library is part of the WebKit project. Framework is devided into base part and view part.
+        Base part takes care of efl initialization, defines test macros and prepares test to run. View part is a context of each test.
+
+        * tests/UnitTestUtils/EWKTestBase.cpp: Added.
+        (EWKUnitTests):
+        (EWKUnitTests::EWKTestBase::init):
+        (EWKUnitTests::EWKTestBase::shutdown):
+        (EWKUnitTests::EWKTestBase::shutdownAll):
+        (EWKUnitTests::EWKTestBase::startTest):
+        (EWKUnitTests::EWKTestBase::endTest):
+        (EWKUnitTests::EWKTestBase::createTest):
+        (EWKUnitTests::EWKTestBase::runTest):
+        * tests/UnitTestUtils/EWKTestBase.h: Added.
+        (EWKUnitTests):
+        (EWKTestBase):
+        * tests/UnitTestUtils/EWKTestConfig.h: Added.
+        (Config):
+        * tests/UnitTestUtils/EWKTestView.cpp: Added.
+        (EWKUnitTests):
+        (EWKUnitTests::EWKTestEcoreEvas::EWKTestEcoreEvas):
+        (EWKUnitTests::EWKTestEcoreEvas::evas):
+        (EWKUnitTests::EWKTestEcoreEvas::show):
+        (EWKUnitTests::EWKTestView::EWKTestView):
+        (EWKUnitTests::EWKTestView::init):
+        (EWKUnitTests::EWKTestView::show):
+        (EWKUnitTests::EWKTestView::mainFrame):
+        (EWKUnitTests::EWKTestView::evas):
+        (EWKUnitTests::EWKTestView::bindEvents):
+        * tests/UnitTestUtils/EWKTestView.h: Added.
+        (EWKUnitTests):
+        (EWKTestEcoreEvas):
+        (EWKTestView):
+        (EWKUnitTests::EWKTestView::webView):
+        * tests/resources/default_test_page.html: Added.
+        * tests/test_ewk_view.cpp: Added.
+        (ewkViewEditableGetCb):
+        (TEST):
+        (ewkViewUriGetCb):
+        * tests/test_runner.cpp: Added.
+        (parseCustomArguments):
+        (main):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * ewk/ewk_frame.cpp:
+        (ewk_frame_script_execute):
+        * ewk/ewk_view.cpp:
+        (ewk_view_js_object_add):
+
 2012-06-26  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
 
         Change return type in bandwidth attribute of network information API
diff --git a/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.cpp
index 2e12c14a7..e61da11f3 100644
--- a/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.cpp
@@ -1,5 +1,6 @@
 /*
- *  Copyright (C) 2012 Samsung Electronics
+ *  Copyright (C) 2012 Samsung Electronics.  All rights reserved.
+ *  Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,44 +24,26 @@
 #if ENABLE(BATTERY_STATUS)
 
 #include "BatteryController.h"
-#include "EventNames.h"
-#include <limits>
-
-namespace WebCore {
 
 BatteryClientEfl::BatteryClientEfl()
     : m_controller(0)
-    , m_timer(this, &BatteryClientEfl::timerFired)
-    , m_batteryStatusRefreshInterval(1.0)
+    , m_provider(this)
 {
 }
 
-void BatteryClientEfl::setController(BatteryController* controller)
+void BatteryClientEfl::setController(WebCore::BatteryController* controller)
 {
     m_controller = controller;
 }
 
 void BatteryClientEfl::startUpdating()
 {
-    if (m_timer.isActive())
-        return;
-
-    if (!e_dbus_init())
-        return;
-
-    if (!e_ukit_init()) {
-        e_dbus_shutdown();
-        return;
-    }
-
-    m_timer.startRepeating(m_batteryStatusRefreshInterval);
+    m_provider.startUpdating();
 }
 
 void BatteryClientEfl::stopUpdating()
 {
-    m_timer.stop();
-    e_ukit_shutdown();
-    e_dbus_shutdown();
+    m_provider.stopUpdating();
 }
 
 void BatteryClientEfl::batteryControllerDestroyed()
@@ -68,116 +51,10 @@ void BatteryClientEfl::batteryControllerDestroyed()
     delete this;
 }
 
-void BatteryClientEfl::setBatteryStatus(const AtomicString& eventType, PassRefPtr<BatteryStatus> batteryStatus)
-{
-    m_batteryStatus = batteryStatus;
-    m_controller->didChangeBatteryStatus(eventType, m_batteryStatus);
-}
-
-void BatteryClientEfl::timerFired(Timer<BatteryClientEfl>* timer)
+void BatteryClientEfl::didChangeBatteryStatus(const AtomicString& eventType, PassRefPtr<WebCore::BatteryStatus> status)
 {
-    ASSERT_UNUSED(timer, timer == &m_timer);
-    E_DBus_Connection* edbusConnection = e_dbus_bus_get(DBUS_BUS_SYSTEM);
-    if (edbusConnection)
-        e_upower_get_all_devices(edbusConnection, getBatteryStatus, static_cast<void*>(this));
+    ASSERT(m_controller);
+    m_controller->didChangeBatteryStatus(eventType, status);
 }
 
-void BatteryClientEfl::getBatteryStatus(void* data, void* replyData, DBusError* dBusError)
-{
-    E_Ukit_Get_All_Devices_Return* eukitDeviceNames = static_cast<E_Ukit_Get_All_Devices_Return*>(replyData);
-    if (!eukitDeviceNames || !eukitDeviceNames->strings || dbus_error_is_set(dBusError)) {
-         dbus_error_free(dBusError);
-         return;
-    }
-
-    E_DBus_Connection* edbusConnection = e_dbus_bus_get(DBUS_BUS_SYSTEM);
-    Eina_List* list;
-    void* deviceName;
-    EINA_LIST_FOREACH(eukitDeviceNames->strings, list, deviceName)
-        e_upower_get_all_properties(edbusConnection, static_cast<char*>(deviceName), setBatteryClient, data);
-}
-
-void BatteryClientEfl::setBatteryClient(void* data, void* replyData, DBusError* dBusError)
-{
-    E_Ukit_Get_All_Properties_Return* eukitPropertyNames = static_cast<E_Ukit_Get_All_Properties_Return*>(replyData);
-
-    if (!eukitPropertyNames || dbus_error_is_set(dBusError)) {
-        dbus_error_free(dBusError);
-        return;
-    }
-
-    if (!eukitPropertyNames->properties)
-        return;
-
-    E_Ukit_Property* property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "Type"));
-    if (!property || property->val.u != E_UPOWER_SOURCE_BATTERY)
-        return;
-
-    BatteryClientEfl* client = static_cast<BatteryClientEfl*>(data);
-    BatteryStatus* clientBatteryStatus = client->batteryStatus();
-    bool charging = false;
-    bool chargingChanged = false;
-    static unsigned chargingState = 0;
-
-    property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "State"));
-    if (!property)
-        return;
-    if (!clientBatteryStatus || chargingState != property->val.u) {
-        chargingChanged = true;
-        chargingState = property->val.u;
-        (chargingState == E_UPOWER_STATE_FULL || chargingState == E_UPOWER_STATE_CHARGING) ? charging = true : charging = false;
-    } else
-        charging = clientBatteryStatus->charging();
-
-    bool chargingTimeChanged = false;
-    bool dischargingTimeChanged = false;
-    double chargingTime = std::numeric_limits<double>::infinity();
-    double dischargingTime = std::numeric_limits<double>::infinity();
-
-    if (charging) {
-        if (!clientBatteryStatus || clientBatteryStatus->dischargingTime() != std::numeric_limits<double>::infinity())
-            dischargingTimeChanged = true;
-        dischargingTime = std::numeric_limits<double>::infinity();
-        property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "TimeToFull"));
-        if (!property)
-            return;
-        if (!clientBatteryStatus || clientBatteryStatus->chargingTime() != property->val.x)
-            chargingTimeChanged = true;
-        chargingTime = property->val.x;
-    } else {
-        if (!clientBatteryStatus || clientBatteryStatus->chargingTime() != std::numeric_limits<double>::infinity())
-            chargingTimeChanged = true;
-        chargingTime = std::numeric_limits<double>::infinity();
-        property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "TimeToEmpty"));
-        if (!property)
-            return;
-        if (!clientBatteryStatus || clientBatteryStatus->dischargingTime() != property->val.x)
-            dischargingTimeChanged = true;
-        dischargingTime = property->val.x;
-    }
-
-    double level = 0;
-    bool levelChanged = false;
-
-    property = static_cast<E_Ukit_Property*>(eina_hash_find(eukitPropertyNames->properties, "Percentage"));
-    if (!property)
-        return;
-    if (!clientBatteryStatus || clientBatteryStatus->level() != property->val.d)
-        levelChanged = true;
-    level = property->val.d;
-
-    WTF::RefPtr<BatteryStatus> batteryStatus = BatteryStatus::create(charging, chargingTime, dischargingTime, level);
-    if (chargingChanged)
-        client->setBatteryStatus(eventNames().chargingchangeEvent, batteryStatus);
-    if (chargingTimeChanged)
-        client->setBatteryStatus(eventNames().chargingtimechangeEvent, batteryStatus);
-    if (dischargingTimeChanged)
-        client->setBatteryStatus(eventNames().dischargingtimechangeEvent, batteryStatus);
-    if (levelChanged)
-        client->setBatteryStatus(eventNames().levelchangeEvent, batteryStatus);
-}
-
-}
-
-#endif // BATTERY_STATUS
-
+#endif // ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.h b/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.h
index df47d70be..4ba11e84c 100644
--- a/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/BatteryClientEfl.h
@@ -1,5 +1,6 @@
 /*
- *  Copyright (C) 2012 Samsung Electronics
+ *  Copyright (C) 2012 Samsung Electronics.  All rights reserved.
+ *  Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,42 +24,34 @@
 #if ENABLE(BATTERY_STATUS)
 
 #include "BatteryClient.h"
+#include "BatteryProviderEfl.h"
+#include "BatteryProviderEflClient.h"
 #include "BatteryStatus.h"
-#include "Timer.h"
-#include <E_Ukit.h>
-#include <wtf/text/AtomicString.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
-
 class BatteryController;
-class BatteryStatus;
+}
 
-class BatteryClientEfl : public BatteryClient {
+class BatteryClientEfl : public WebCore::BatteryClient, public WebCore::BatteryProviderEflClient {
 public:
     BatteryClientEfl();
-    ~BatteryClientEfl() { };
+    virtual ~BatteryClientEfl() { }
 
-    virtual void setController(BatteryController*);
+    // BatteryClient interface.
+    virtual void setController(WebCore::BatteryController*);
     virtual void startUpdating();
     virtual void stopUpdating();
     virtual void batteryControllerDestroyed();
 
-    void setBatteryStatus(const AtomicString& eventType, PassRefPtr<BatteryStatus>);
-    BatteryStatus* batteryStatus() { return m_batteryStatus.get(); }
-
 private:
-    void timerFired(Timer<BatteryClientEfl>*);
-    static void getBatteryStatus(void* data, void* replyData, DBusError*);
-    static void setBatteryClient(void* data, void* replyData, DBusError*);
+    // BatteryProviderEflClient interface.
+    virtual void didChangeBatteryStatus(const AtomicString& eventType, PassRefPtr<WebCore::BatteryStatus>);
 
-    BatteryController* m_controller;
-    Timer<BatteryClientEfl> m_timer;
-    RefPtr<BatteryStatus> m_batteryStatus;
-    const double m_batteryStatusRefreshInterval;
+    WebCore::BatteryController* m_controller;
+    WebCore::BatteryProviderEfl m_provider;
 };
 
-}
+#endif // ENABLE(BATTERY_STATUS)
 
-#endif // BATTERY_STATUS
 #endif // BatteryClientEfl_h
-
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index a234bf9f7..703fa88ec 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -628,14 +628,25 @@ bool ChromeClientEfl::supportsFullScreenForElement(const WebCore::Element* eleme
 
 void ChromeClientEfl::enterFullScreenForElement(WebCore::Element* element)
 {
+    // Keep a reference to the element to use it later in
+    // exitFullScreenForElement().
+    m_fullScreenElement = element;
+
     element->document()->webkitWillEnterFullScreenForElement(element);
     element->document()->webkitDidEnterFullScreenForElement(element);
 }
 
-void ChromeClientEfl::exitFullScreenForElement(WebCore::Element* element)
+void ChromeClientEfl::exitFullScreenForElement(WebCore::Element*)
 {
-    element->document()->webkitWillExitFullScreenForElement(element);
-    element->document()->webkitDidExitFullScreenForElement(element);
+    // The element passed into this function is not reliable, i.e. it could
+    // be null. In addition the parameter may be disappearing in the future.
+    // So we use the reference to the element we saved above.
+    ASSERT(m_fullScreenElement);
+
+    m_fullScreenElement->document()->webkitWillExitFullScreenForElement(m_fullScreenElement.get());
+    m_fullScreenElement->document()->webkitDidExitFullScreenForElement(m_fullScreenElement.get());
+
+    m_fullScreenElement.clear();
 }
 #endif
 
diff --git a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index ed770d610..a5ce3149a 100644
--- a/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -192,6 +192,9 @@ public:
 
     Evas_Object* m_view;
     KURL m_hoveredLinkURL;
+#if ENABLE(FULLSCREEN_API)
+    RefPtr<Element> m_fullScreenElement;
+#endif
 };
 }
 
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
index fe1f70dae..485db7f09 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.cpp
@@ -47,6 +47,7 @@
 #include <JSElement.h>
 #include <JavaScriptCore/OpaqueJSString.h>
 #include <MemoryCache.h>
+#include <MutationObserver.h>
 #include <PageGroup.h>
 #include <PrintContext.h>
 #include <RenderTreeAsText.h>
@@ -55,7 +56,6 @@
 #include <ScriptValue.h>
 #include <Settings.h>
 #include <TextIterator.h>
-#include <WebKitMutationObserver.h>
 #include <bindings/js/GCController.h>
 #include <history/HistoryItem.h>
 #include <workers/WorkerThread.h>
@@ -577,27 +577,10 @@ void DumpRenderTreeSupportEfl::setMockScrollbarsEnabled(bool enable)
     WebCore::Settings::setMockScrollbarsEnabled(enable);
 }
 
-void DumpRenderTreeSupportEfl::dumpConfigurationForViewport(Evas_Object* ewkView, int deviceDPI, const WebCore::IntSize& deviceSize, const WebCore::IntSize& availableSize)
-{
-    WebCore::Page* page = EWKPrivate::corePage(ewkView);
-
-    if (!page)
-        return;
-    WebCore::ViewportArguments arguments = page->mainFrame()->document()->viewportArguments();
-    WebCore::ViewportAttributes attributes = computeViewportAttributes(arguments,
-            /* default layout width for non-mobile pages */ 980,
-            deviceSize.width(), deviceSize.height(),
-            deviceDPI,
-            availableSize);
-    restrictMinimumScaleFactorToViewportSize(attributes, availableSize);
-    restrictScaleFactorToInitialScaleIfNotUserScalable(attributes);
-    fprintf(stdout, "viewport size %dx%d scale %f with limits [%f, %f] and userScalable %f\n", static_cast<int>(attributes.layoutSize.width()), static_cast<int>(attributes.layoutSize.height()), attributes.initialScale, attributes.minimumScale, attributes.maximumScale, attributes.userScalable);
-}
-
 void DumpRenderTreeSupportEfl::deliverAllMutationsIfNecessary()
 {
 #if ENABLE(MUTATION_OBSERVERS)
-    WebCore::WebKitMutationObserver::deliverAllMutations();
+    WebCore::MutationObserver::deliverAllMutations();
 #endif
 }
 
diff --git a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
index e9ba7e8a9..611f3c85f 100644
--- a/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/DumpRenderTreeSupportEfl.h
@@ -99,8 +99,6 @@ public:
 
     static void setMockScrollbarsEnabled(bool);
 
-    static void dumpConfigurationForViewport(Evas_Object* ewkView, int deviceDPI, const WebCore::IntSize& deviceSize, const WebCore::IntSize& availableSize);
-
     static void deliverAllMutationsIfNecessary();
     static String markerTextForListItem(JSContextRef, JSValueRef nodeObject);
     static void setInteractiveFormValidationEnabled(Evas_Object* ewkView, bool enabled);
diff --git a/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.cpp
index 7e29758bd..a0f1aacfc 100644
--- a/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.cpp
@@ -21,31 +21,86 @@
 #include "config.h"
 #include "InspectorClientEfl.h"
 
+#if ENABLE(INSPECTOR)
+#include "InspectorController.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
-
-using namespace WebCore;
+#include "ewk_view_private.h"
+#include <unistd.h>
 
 namespace WebCore {
 
+static void notifyWebInspectorDestroy(void* userData, Evas_Object* webview, void* eventInfo)
+{
+    InspectorFrontendClientEfl* inspectorFrontendClient = static_cast<InspectorFrontendClientEfl*>(userData);
+    if (inspectorFrontendClient)
+        inspectorFrontendClient->destroyInspectorWindow(true);
+}
+
+class InspectorFrontendSettingsEfl : public InspectorFrontendClientLocal::Settings {
+public:
+    virtual String getProperty(const String& name)
+    {
+        notImplemented();
+        return String();
+    }
+
+    virtual void setProperty(const String& name, const String& value)
+    {
+        notImplemented();
+    }
+};
+
+InspectorClientEfl::InspectorClientEfl(Evas_Object* webView)
+    : m_inspectedView(webView)
+    , m_inspectorView(0)
+    , m_frontendClient(0)
+{
+}
+
+InspectorClientEfl::~InspectorClientEfl()
+{
+    if (m_frontendClient) {
+        m_frontendClient->disconnectInspectorClient();
+        m_frontendClient = 0;
+    }
+}
+
 void InspectorClientEfl::inspectorDestroyed()
 {
+    closeInspectorFrontend();
     delete this;
 }
 
 void InspectorClientEfl::openInspectorFrontend(InspectorController*)
 {
-    notImplemented();
+    evas_object_smart_callback_call(m_inspectedView, "inspector,view,create", 0);
+
+    Evas_Object* inspectorView = ewk_view_web_inspector_view_get(m_inspectedView);
+    if (!inspectorView)
+        return;
+
+    m_inspectorView = inspectorView;
+
+    String inspectorUri = inspectorFilesPath();
+    ewk_view_uri_set(m_inspectorView, inspectorUri.utf8().data());
+
+    OwnPtr<InspectorFrontendClientEfl> frontendClient = adoptPtr(new InspectorFrontendClientEfl(m_inspectedView, m_inspectorView, this));
+    m_frontendClient = frontendClient.get();
+
+    InspectorController* controller = EWKPrivate::corePage(m_inspectorView)->inspectorController();
+    controller->setInspectorFrontendClient(frontendClient.release());
 }
 
 void InspectorClientEfl::closeInspectorFrontend()
 {
-    notImplemented();
+    if (m_frontendClient)
+        m_frontendClient->destroyInspectorWindow(false);
 }
 
 void InspectorClientEfl::bringFrontendToFront()
 {
-    notImplemented();
+    m_frontendClient->bringToFront();
 }
 
 void InspectorClientEfl::highlight()
@@ -58,21 +113,98 @@ void InspectorClientEfl::hideHighlight()
     notImplemented();
 }
 
-void InspectorClientEfl::populateSetting(const String&, String*)
+bool InspectorClientEfl::sendMessageToFrontend(const String& message)
+{
+    Page* frontendPage = EWKPrivate::corePage(m_inspectorView);
+    return doDispatchMessageOnFrontendPage(frontendPage, message);
+}
+
+void InspectorClientEfl::releaseFrontendPage()
+{
+    m_inspectorView = 0;
+    m_frontendClient = 0;
+}
+
+String InspectorClientEfl::inspectorFilesPath()
+{
+    String inspectorFilesPath = makeString("file://", WEB_INSPECTOR_INSTALL_DIR, "/inspector.html");
+    if (access(inspectorFilesPath.utf8().data(), R_OK)) // On success, zero is returned
+        inspectorFilesPath = makeString("file://", WEB_INSPECTOR_DIR, "/inspector.html");
+
+    return inspectorFilesPath;
+}
+
+InspectorFrontendClientEfl::InspectorFrontendClientEfl(Evas_Object* inspectedView, Evas_Object* inspectorView, InspectorClientEfl* inspectorClient)
+    : InspectorFrontendClientLocal(EWKPrivate::corePage(inspectedView)->inspectorController(), EWKPrivate::corePage(inspectorView), adoptPtr(new InspectorFrontendSettingsEfl()))
+    , m_inspectedView(inspectedView)
+    , m_inspectorView(inspectorView)
+    , m_inspectorClient(inspectorClient)
+{
+    evas_object_smart_callback_add(m_inspectorView, "inspector,view,destroy", notifyWebInspectorDestroy, this);
+}
+
+InspectorFrontendClientEfl::~InspectorFrontendClientEfl()
+{
+    evas_object_smart_callback_del(m_inspectorView, "inspector,view,destroy", notifyWebInspectorDestroy);
+
+    if (m_inspectorClient) {
+        m_inspectorClient->releaseFrontendPage();
+        m_inspectorClient = 0;
+    }
+}
+
+String InspectorFrontendClientEfl::localizedStringsURL()
+{
+    notImplemented();
+    return String();
+}
+
+String InspectorFrontendClientEfl::hiddenPanels()
+{
+    notImplemented();
+    return String();
+}
+
+void InspectorFrontendClientEfl::bringToFront()
 {
     notImplemented();
 }
 
-void InspectorClientEfl::storeSetting(const String&, const String&)
+void InspectorFrontendClientEfl::closeWindow()
+{
+    destroyInspectorWindow(true);
+}
+
+void InspectorFrontendClientEfl::inspectedURLChanged(const String&)
+{
+    notImplemented();
+}
+
+void InspectorFrontendClientEfl::attachWindow()
 {
     notImplemented();
 }
 
-bool InspectorClientEfl::sendMessageToFrontend(const String&)
+void InspectorFrontendClientEfl::detachWindow()
 {
     notImplemented();
-    return false;
 }
 
+void InspectorFrontendClientEfl::setAttachedWindowHeight(unsigned)
+{
+    notImplemented();
+}
+
+void InspectorFrontendClientEfl::destroyInspectorWindow(bool notifyInspectorController)
+{
+    if (notifyInspectorController)
+        EWKPrivate::corePage(m_inspectedView)->inspectorController()->disconnectFrontend();
+
+    if (m_inspectorClient)
+        m_inspectorClient->releaseFrontendPage();
+
+    evas_object_smart_callback_call(m_inspectedView, "inspector,view,close", m_inspectorView);
+}
 
 }
+#endif
diff --git a/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.h b/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.h
index f92e94dda..b6a078e72 100644
--- a/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/InspectorClientEfl.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 INdT - Instituto Nokia de Tecnologia
  * Copyright (C) 2009-2010 ProFUSION embedded systems
- * Copyright (C) 2009-2010 Samsung Electronics
+ * Copyright (C) 2009-2012 Samsung Electronics
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,13 +33,19 @@
 #define InspectorClientEfl_h
 
 #include "InspectorClient.h"
+#include "InspectorFrontendClientLocal.h"
+#include <Evas.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
+class InspectorFrontendClientEfl;
 class Page;
 
-class InspectorClientEfl : public WebCore::InspectorClient {
+class InspectorClientEfl : public InspectorClient {
 public:
+    InspectorClientEfl(Evas_Object*);
+    ~InspectorClientEfl();
+
     virtual void inspectorDestroyed();
 
     virtual void openInspectorFrontend(InspectorController*);
@@ -49,10 +55,43 @@ public:
     virtual void highlight();
     virtual void hideHighlight();
 
-    virtual void populateSetting(const String& key, String* value);
-    virtual void storeSetting(const String& key, const String& value);
-
     virtual bool sendMessageToFrontend(const String&);
+
+    void releaseFrontendPage();
+    String inspectorFilesPath();
+
+private:
+    Evas_Object* m_inspectedView;
+    Evas_Object* m_inspectorView;
+    InspectorFrontendClientEfl* m_frontendClient;
+};
+
+class InspectorFrontendClientEfl : public InspectorFrontendClientLocal {
+public:
+    InspectorFrontendClientEfl(Evas_Object*, Evas_Object*, InspectorClientEfl*);
+    ~InspectorFrontendClientEfl();
+
+    virtual String localizedStringsURL();
+    virtual String hiddenPanels();
+
+    virtual void bringToFront();
+    virtual void closeWindow();
+
+    virtual void inspectedURLChanged(const String&);
+
+    virtual void attachWindow();
+    virtual void detachWindow();
+
+    virtual void setAttachedWindowHeight(unsigned);
+
+    void disconnectInspectorClient() { m_inspectorClient = 0; }
+    void destroyInspectorWindow(bool notifyInspectorController);
+
+private:
+    Evas_Object* m_inspectedView;
+    Evas_Object* m_inspectorView;
+    InspectorClientEfl* m_inspectorClient;
+
 };
 }
 
diff --git a/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.cpp
index e33735134..c4e5ca8da 100644
--- a/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.cpp
@@ -59,7 +59,7 @@ void NotificationPresenterClientEfl::requestPermission(ScriptExecutionContext* c
     notImplemented();
 }
 
-NotificationPresenter::Permission NotificationPresenterClientEfl::checkPermission(ScriptExecutionContext* context)
+NotificationClient::Permission NotificationPresenterClientEfl::checkPermission(ScriptExecutionContext* context)
 {
     notImplemented();
     return PermissionDenied;
diff --git a/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.h b/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.h
index 55174e707..ece5ccfe4 100644
--- a/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/NotificationPresenterClientEfl.h
@@ -22,11 +22,11 @@
 
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
 #include "Notification.h"
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 
 namespace WebCore {
 
-class NotificationPresenterClientEfl : public NotificationPresenter {
+class NotificationPresenterClientEfl : public NotificationClient {
 
 public:
     NotificationPresenterClientEfl();
@@ -37,7 +37,7 @@ public:
     virtual void notificationObjectDestroyed(Notification*);
     virtual void notificationControllerDestroyed();
     virtual void requestPermission(ScriptExecutionContext*, PassRefPtr<VoidCallback>);
-    virtual NotificationPresenter::Permission checkPermission(ScriptExecutionContext*);
+    virtual NotificationClient::Permission checkPermission(ScriptExecutionContext*);
     virtual void cancelRequestsForPermission(ScriptExecutionContext*);
 };
 
diff --git a/Source/WebKit/efl/WebCoreSupport/PageClientEfl.cpp b/Source/WebKit/efl/WebCoreSupport/PageClientEfl.cpp
index 25fbd750c..6d409c073 100644
--- a/Source/WebKit/efl/WebCoreSupport/PageClientEfl.cpp
+++ b/Source/WebKit/efl/WebCoreSupport/PageClientEfl.cpp
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "PageClientEfl.h"
 
-#include "ewk_private.h"
+#include "ewk_view_private.h"
 
 namespace WebCore {
 class IntRect;
@@ -37,12 +37,12 @@ PageClientEfl::~PageClientEfl()
 }
 
 #if USE(ACCELERATED_COMPOSITING)
-bool PageClientEfl::createEvasObjectForAcceleratedCompositing(Evas_Native_Surface* nativeSurface, const IntRect& rect)
+bool PageClientEfl::createEvasObjectForAcceleratedCompositing(Evas_Native_Surface* nativeSurface, const WebCore::IntRect& rect)
 {
     return ewk_view_accelerated_compositing_object_create(m_view, nativeSurface, rect);
 }
 
-GraphicsContext3D* PageClientEfl::acceleratedCompositingContext()
+WebCore::GraphicsContext3D* PageClientEfl::acceleratedCompositingContext()
 {
     return ewk_view_accelerated_compositing_context_get(m_view);
 }
diff --git a/Source/WebKit/efl/WebCoreSupport/PageClientEfl.h b/Source/WebKit/efl/WebCoreSupport/PageClientEfl.h
index b95823c7a..6f98d701c 100644
--- a/Source/WebKit/efl/WebCoreSupport/PageClientEfl.h
+++ b/Source/WebKit/efl/WebCoreSupport/PageClientEfl.h
@@ -35,8 +35,8 @@ public:
     virtual ~PageClientEfl();
 
 #if USE(ACCELERATED_COMPOSITING)
-    bool createEvasObjectForAcceleratedCompositing(Evas_Native_Surface*, const IntRect&);
-    GraphicsContext3D* acceleratedCompositingContext();
+    bool createEvasObjectForAcceleratedCompositing(Evas_Native_Surface*, const WebCore::IntRect&);
+    WebCore::GraphicsContext3D* acceleratedCompositingContext();
 #endif
 
     Evas_Object* view() { return m_view; }
diff --git a/Source/WebKit/efl/ewk/ewk_frame.cpp b/Source/WebKit/efl/ewk/ewk_frame.cpp
index 6ba941d35..67a9bc82c 100644
--- a/Source/WebKit/efl/ewk/ewk_frame.cpp
+++ b/Source/WebKit/efl/ewk/ewk_frame.cpp
@@ -455,8 +455,8 @@ char* ewk_frame_script_execute(Evas_Object* ewkFrame, const char* script)
     if (!result || (!result.isBoolean() && !result.isString() && !result.isNumber()))
         return 0;
 
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
     JSC::ExecState* exec = smartData->frame->script()->globalObject(WebCore::mainThreadNormalWorld())->globalExec();
+    JSC::JSLockHolder lock(exec);
     resultString = WebCore::ustringToString(result.toString(exec)->value(exec));
     return strdup(resultString.utf8().data());
 #else
diff --git a/Source/WebKit/efl/ewk/ewk_main.cpp b/Source/WebKit/efl/ewk/ewk_main.cpp
index 84d2b5025..b48c28a6b 100644
--- a/Source/WebKit/efl/ewk/ewk_main.cpp
+++ b/Source/WebKit/efl/ewk/ewk_main.cpp
@@ -146,7 +146,9 @@ Eina_Bool _ewk_init_body(void)
             "work (ie: Adobe Flash)");
 
     WebCore::ScriptController::initializeThreading();
+#if !LOG_DISABLED
     WebCore::initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
     WebCore::Settings::setDefaultMinDOMTimerInterval(0.004);
 
     PlatformStrategiesEfl::initialize();
diff --git a/Source/WebKit/efl/ewk/ewk_view.cpp b/Source/WebKit/efl/ewk/ewk_view.cpp
index c45569ce1..1ae83fc9d 100644
--- a/Source/WebKit/efl/ewk/ewk_view.cpp
+++ b/Source/WebKit/efl/ewk/ewk_view.cpp
@@ -41,6 +41,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "InspectorClientEfl.h"
+#include "InspectorController.h"
 #include "IntSize.h"
 #include "JSDOMBinding.h"
 #include "JSDOMWindow.h"
@@ -344,6 +345,9 @@ struct _Ewk_View_Private_Data {
     SoupSession* soupSession;
     const char* cursorGroup;
     Evas_Object* cursorObject;
+#if ENABLE(INSPECTOR)
+    Evas_Object* inspectorView;
+#endif
 #ifdef HAVE_ECORE_X
     bool isUsingEcoreX;
 #endif
@@ -730,8 +734,9 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
     pageClients.chromeClient = new WebCore::ChromeClientEfl(smartData->self);
     pageClients.editorClient = new WebCore::EditorClientEfl(smartData->self);
     pageClients.dragClient = new WebCore::DragClientEfl;
-    pageClients.inspectorClient = new WebCore::InspectorClientEfl;
-
+#if ENABLE(INSPECTOR)
+    pageClients.inspectorClient = new WebCore::InspectorClientEfl(smartData->self);
+#endif
     priv->page = adoptPtr(new WebCore::Page(pageClients));
 
 #if ENABLE(DEVICE_ORIENTATION)
@@ -749,7 +754,7 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* smartData)
 #endif
 
 #if ENABLE(BATTERY_STATUS)
-    WebCore::provideBatteryTo(priv->page.get(), new WebCore::BatteryClientEfl);
+    WebCore::provideBatteryTo(priv->page.get(), new BatteryClientEfl);
 #endif
 
     priv->pageSettings = priv->page->settings();
@@ -1237,7 +1242,7 @@ static WebCore::ViewportAttributes _ewk_view_viewport_attributes_compute(const E
     WebCore::IntRect availableRect = enclosingIntRect(priv->page->chrome()->client()->pageRect());
     WebCore::IntRect deviceRect = enclosingIntRect(priv->page->chrome()->client()->windowRect());
 
-    WebCore::ViewportAttributes attributes = WebCore::computeViewportAttributes(priv->viewportArguments, desktopWidth, deviceRect.width(), deviceRect.height(), deviceDPI, availableRect.size());
+    WebCore::ViewportAttributes attributes = WebCore::computeViewportAttributes(priv->viewportArguments, desktopWidth, deviceRect.width(), deviceRect.height(), deviceDPI / WebCore::ViewportArguments::deprecatedTargetDPI, availableRect.size());
     WebCore::restrictMinimumScaleFactorToViewportSize(attributes, availableRect.size());
     WebCore::restrictScaleFactorToInitialScaleIfNotUserScalable(attributes);
 
@@ -4045,8 +4050,8 @@ Eina_Bool ewk_view_js_object_add(Evas_Object* ewkView, Ewk_JS_Object* object, co
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
     EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
 
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
     WebCore::JSDOMWindow* window = toJSDOMWindow(priv->mainFrame, WebCore::mainThreadNormalWorld());
+    JSC::JSLockHolder lock(window->globalExec());
     JSC::Bindings::RootObject* root;
     root = priv->mainFrame->script()->bindingRootObject();
 
@@ -4362,6 +4367,48 @@ void ewk_view_setting_should_display_text_descriptions_set(Evas_Object *ewkView,
 #endif
 }
 
+void ewk_view_web_inspector_show(const Evas_Object* ewkView)
+{
+#if ENABLE(INSPECTOR)
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    priv->page->inspectorController()->show();
+#endif
+}
+
+void ewk_view_web_inspector_close(const Evas_Object* ewkView)
+{
+#if ENABLE(INSPECTOR)
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv);
+
+    priv->page->inspectorController()->close();
+#endif
+}
+
+Evas_Object* ewk_view_web_inspector_view_get(const Evas_Object* ewkView)
+{
+#if ENABLE(INSPECTOR)
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+
+    return priv->inspectorView;
+#else
+    return 0;
+#endif
+}
+
+void ewk_view_web_inspector_view_set(Evas_Object* ewkView, Evas_Object* inspectorView)
+{
+#if ENABLE(INSPECTOR)
+    EWK_VIEW_SD_GET(ewkView, smartData);
+    EWK_VIEW_PRIV_GET(smartData, priv);
+
+    priv->inspectorView = inspectorView;
+#endif
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 bool ewk_view_accelerated_compositing_object_create(Evas_Object* ewkView, Evas_Native_Surface* nativeSurface, const WebCore::IntRect& rect)
 {
diff --git a/Source/WebKit/efl/ewk/ewk_view.h b/Source/WebKit/efl/ewk/ewk_view.h
index f645f7223..d5feb36b3 100644
--- a/Source/WebKit/efl/ewk/ewk_view.h
+++ b/Source/WebKit/efl/ewk/ewk_view.h
@@ -46,6 +46,8 @@
  *  - "icon,received", void: main frame received an icon.
  *  - "inputmethod,changed", Eina_Bool: reports that input method was changed and
  *    it gives a boolean value whether it's enabled or not as an argument.
+ *  - "inspector,view,close", Evas_Object*: request to close the view for web inspector.
+ *  - "inspector,view,create", void: request to create the new view for web inspector.
  *  - "js,windowobject,clear", void: Report that the JS window object has been cleared.
  *  - "link,hover,in", const char *link[2]: reports mouse is over a link.
  *    It gives the url in link[0] and link's title in link[1] as an argument.
@@ -2644,6 +2646,53 @@ EAPI Eina_Bool    ewk_view_setting_web_audio_get(const Evas_Object *o);
  */
 EAPI Eina_Bool    ewk_view_setting_web_audio_set(Evas_Object *o, Eina_Bool enable);
 
+/**
+ * Show the web inspector to debug a web page.
+ *
+ * The following signals are emiited.
+ * "inspector,view,create" and "inspector,view,close"
+ * The first one will be called to request the view for web inspector on view that will be inspected.
+ * This callback should create the view for web inspector and set the view with ewk_view_web_inspector_view_set().
+ * The second one will be called to close the view for web inspector on view having the web inspector after disconnecting frontend
+ * This callback should remove the view for web inspector.
+ *
+ * When the view having the web inspector is removed,
+ * please emit the "inspector,view,destroy" signal on view for web inspector.
+ *
+ * @param o The view to show the web inspector.
+ *
+ * @see ewk_view_web_inspector_close()
+ * @see ewk_view_web_inspector_view_set()
+ */
+EAPI void ewk_view_web_inspector_show(const Evas_Object *o);
+
+/**
+ * Close the web inspector view
+ *
+ * @param o The view to close the web inspector.
+ *
+ * @see ewk_view_web_inspector_show()
+ * @see ewk_view_web_inspector_view_get()
+ */
+EAPI void ewk_view_web_inspector_close(const Evas_Object *o);
+
+/**
+ * Get the view of web inspector.
+ *
+ * @param o The view that is inspected.
+ *
+ * @return view object on success or @c 0 on failure
+ */
+EAPI Evas_Object* ewk_view_web_inspector_view_get(const Evas_Object *o);
+
+/**
+ * Set the view of web inspector.
+ *
+ * @param o The view that is inspected.
+ * @param inspector_view The view of web inspector.
+ */
+EAPI void ewk_view_web_inspector_view_set(Evas_Object *o, Evas_Object *inspector_view);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit/efl/tests/UnitTestUtils/EWKTestBase.cpp b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestBase.cpp
new file mode 100644
index 000000000..608300aa6
--- /dev/null
+++ b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestBase.cpp
@@ -0,0 +1,109 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "config.h"
+#include "EWKTestBase.h"
+
+#include "EWKTestConfig.h"
+#include "EWKTestView.h"
+#include <EWebKit.h>
+
+#include <Ecore.h>
+#include <Edje.h>
+
+int EWKUnitTests::EWKTestBase::useX11Window;
+
+namespace EWKUnitTests {
+
+bool EWKTestBase::init()
+{
+    if (!ecore_evas_init())
+        return false;
+
+    if (!edje_init()) {
+        ecore_evas_shutdown();
+        return false;
+    }
+
+    int ret = ewk_init();
+    const char* proxyUri = getenv("http_proxy");
+
+    if (ret && proxyUri)
+        ewk_network_proxy_uri_set(proxyUri);
+
+    return ret;
+}
+
+void EWKTestBase::shutdown()
+{
+    ecore_evas_shutdown();
+    edje_shutdown();
+    ewk_shutdown();
+}
+
+void EWKTestBase::shutdownAll()
+{
+    int count = 0;
+
+    while ((count = ecore_evas_shutdown()) > 0) { }
+    while ((count = edje_shutdown()) > 0) { }
+    while ((count = ewk_shutdown()) > 0) { }
+}
+
+void EWKTestBase::startTest()
+{
+    ecore_main_loop_begin();
+}
+
+void EWKTestBase::endTest()
+{
+    ecore_main_loop_quit();
+}
+
+bool EWKTestBase::createTest(const char* url, void (*event_callback)(void*, Evas_Object*, void*), const char* event_name, void* event_data)
+{
+    EFL_INIT_RET();
+
+    EWKTestEcoreEvas evas(useX11Window);
+    if (!evas.evas())
+        return false;
+    evas.show();
+
+    EWKTestView view(evas.evas(), url);
+    if (!view.init())
+        return false;
+
+    view.bindEvents(event_callback, event_name, event_data);
+    view.show();
+
+    START_TEST();
+
+    return true;
+}
+
+bool EWKTestBase::runTest(void (*event_callback)(void*, Evas_Object*, void*), const char* event_name, void* event_data)
+{
+    return createTest(Config::defaultTestPage, event_callback, event_name, event_data);
+}
+
+bool EWKTestBase::runTest(const char* url, void (*event_callback)(void*, Evas_Object*, void*), const char* event_name, void* event_data)
+{
+    return createTest(url, event_callback, event_name, event_data);
+}
+
+}
diff --git a/Source/WebKit/efl/tests/UnitTestUtils/EWKTestBase.h b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestBase.h
new file mode 100644
index 000000000..fc1d27171
--- /dev/null
+++ b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestBase.h
@@ -0,0 +1,70 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#ifndef EWKTestBase_h
+#define EWKTestBase_h
+
+#include <Evas.h>
+#include <gtest/gtest.h>
+
+#define RUN_TEST(args...)   \
+    do {    \
+        ASSERT_EQ(true, EWKTestBase::runTest(args));    \
+    } while (0)
+
+#define START_TEST()    \
+    do {    \
+        EWKTestBase::startTest();   \
+    } while (0)
+
+#define END_TEST()    \
+    do {    \
+        EWKTestBase::endTest(); \
+    } while (0)
+
+#define EFL_INIT_RET()  \
+    do {    \
+        if (!EWKTestBase::init())   \
+            return false;    \
+    } while (0)
+
+#define EFL_INIT()  \
+    do {    \
+        EWKTestBase::init();    \
+    } while (0)
+
+namespace EWKUnitTests {
+
+class EWKTestBase {
+    static bool createTest(const char* url, void (*event_callback)(void*, Evas_Object*, void*), const char* event_name, void* event_data);
+public:
+    static bool init();
+    static void shutdown();
+    static void shutdownAll();
+    static void startTest();
+    static void endTest();
+
+    static bool runTest(const char* url, void (*event_callback)(void*, Evas_Object*, void*), const char* event_name = "load,finished", void* event_data = 0);
+    static bool runTest(void (*event_callback)(void*, Evas_Object*, void*), const char* event_name = "load,finished", void* event_data = 0);
+
+    static int useX11Window;
+};
+
+}
+
+#endif
diff --git a/Source/WebKit/efl/tests/UnitTestUtils/EWKTestConfig.h b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestConfig.h
new file mode 100644
index 000000000..a1cf6ea83
--- /dev/null
+++ b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestConfig.h
@@ -0,0 +1,31 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#ifndef EWKTestConfig_h
+#define EWKTestConfig_h
+
+namespace EWKUnitTests {
+namespace Config {
+static const int defaultViewWidth = 600;
+static const int defaultViewHeight = 800;
+static const char* const defaultThemePath = DEFAULT_THEME_PATH"/default.edj";
+static const char* const defaultTestPage = "file://"DEFAULT_TEST_PAGE_DIR"/default_test_page.html";
+}
+}
+
+#endif
diff --git a/Source/WebKit/efl/tests/UnitTestUtils/EWKTestView.cpp b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestView.cpp
new file mode 100644
index 000000000..fd29b811c
--- /dev/null
+++ b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestView.cpp
@@ -0,0 +1,148 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "config.h"
+#include "EWKTestView.h"
+
+#include "EWKTestConfig.h"
+#include <EWebKit.h>
+
+#include <wtf/PassOwnPtr.h>
+
+namespace EWKUnitTests {
+
+EWKTestEcoreEvas::EWKTestEcoreEvas(int useX11Window)
+{
+    if (useX11Window)
+        m_ecoreEvas = adoptPtr(ecore_evas_new(0, 0, 0, Config::defaultViewWidth, Config::defaultViewHeight, 0));
+    else
+        m_ecoreEvas = adoptPtr(ecore_evas_buffer_new(Config::defaultViewWidth, Config::defaultViewHeight));
+}
+
+EWKTestEcoreEvas::EWKTestEcoreEvas(const char* engine_name, int viewport_x, int viewport_y, int viewport_w, int viewport_h, const char* extra_options, int useX11Window)
+{
+    if (useX11Window)
+        m_ecoreEvas = adoptPtr(ecore_evas_new(engine_name, viewport_x, viewport_y, viewport_w, viewport_h, extra_options));
+    else
+        m_ecoreEvas = adoptPtr(ecore_evas_buffer_new(viewport_x, viewport_y));
+}
+
+Evas* EWKTestEcoreEvas::evas()
+{
+    if (m_ecoreEvas.get())
+        return ecore_evas_get(m_ecoreEvas.get());
+    return 0;
+}
+
+void EWKTestEcoreEvas::show()
+{
+    if (m_ecoreEvas.get())
+        ecore_evas_show(m_ecoreEvas.get());
+}
+
+EWKTestView::EWKTestView(Evas* evas)
+    : m_evas(evas)
+    , m_url(Config::defaultTestPage)
+    , m_defaultViewType(TiledView)
+    , m_width(Config::defaultViewWidth)
+    , m_height(Config::defaultViewHeight)
+{
+}
+
+EWKTestView::EWKTestView(Evas* evas, const char* url)
+    : m_evas(evas)
+    , m_url(url)
+    , m_defaultViewType(TiledView)
+    , m_width(Config::defaultViewWidth)
+    , m_height(Config::defaultViewHeight)
+{
+}
+
+EWKTestView::EWKTestView(Evas* evas, EwkViewType type, const char* url)
+    : m_evas(evas)
+    , m_url(url)
+    , m_defaultViewType(type)
+    , m_width(Config::defaultViewWidth)
+    , m_height(Config::defaultViewHeight)
+{
+}
+
+EWKTestView::EWKTestView(Evas* evas, EwkViewType type, const char* url, int width, int height)
+    : m_evas(evas)
+    , m_url(url)
+    , m_defaultViewType(type)
+    , m_width(width)
+    , m_height(height)
+{
+}
+
+bool EWKTestView::init()
+{
+    if (!m_evas || m_url.empty())
+        return false;
+
+    switch (m_defaultViewType) {
+    case SingleView:
+        m_webView = adoptPtr(ewk_view_single_add(m_evas));
+        break;
+
+    case TiledView:
+        m_webView = adoptPtr(ewk_view_tiled_add(m_evas));
+        break;
+    }
+
+    if (!m_webView.get())
+        return false;
+
+    ewk_view_theme_set(m_webView.get(), Config::defaultThemePath);
+    ewk_view_uri_set(m_webView.get(), m_url.c_str());
+}
+
+void EWKTestView::show()
+{
+    if (!m_webView.get())
+        return;
+    evas_object_resize(m_webView.get(), m_width, m_height);
+    evas_object_show(m_webView.get());
+    evas_object_focus_set(m_webView.get(), EINA_TRUE);
+}
+
+Evas_Object* EWKTestView::mainFrame()
+{
+    if (m_webView.get())
+        return ewk_view_frame_main_get(m_webView.get());
+    return 0;
+}
+
+Evas* EWKTestView::evas()
+{
+    if (m_webView.get())
+        return evas_object_evas_get(m_webView.get());
+    return 0;
+}
+
+void EWKTestView::bindEvents(void (*callback)(void*, Evas_Object*, void*), const char* eventName, void* ptr)
+{
+    if (!m_webView.get())
+        return;
+
+    evas_object_smart_callback_del(m_webView.get(), eventName, callback);
+    evas_object_smart_callback_add(m_webView.get(), eventName, callback, ptr);
+}
+
+}
diff --git a/Source/WebKit/efl/tests/UnitTestUtils/EWKTestView.h b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestView.h
new file mode 100644
index 000000000..6d15d0d30
--- /dev/null
+++ b/Source/WebKit/efl/tests/UnitTestUtils/EWKTestView.h
@@ -0,0 +1,75 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#ifndef EWKTestView_h
+#define EWKTestView_h
+
+#include <Ecore_Evas.h>
+#include <Evas.h>
+#include <string>
+#include <wtf/OwnPtr.h>
+
+namespace EWKUnitTests {
+
+class EWKTestEcoreEvas {
+public:
+    EWKTestEcoreEvas(int useX11Window);
+    EWKTestEcoreEvas(const char* engine_name, int viewport_x, int viewport_y, int viewport_w, int viewport_h, const char* extra_options, int useX11Window);
+
+    Evas* evas();
+    void show();
+
+private:
+    OwnPtr<Ecore_Evas> m_ecoreEvas;
+};
+
+class EWKTestView {
+public:
+    enum EwkViewType {
+        SingleView = 0,
+        TiledView,
+    };
+
+    explicit EWKTestView(Evas*);
+    EWKTestView(Evas*, const char* url);
+    EWKTestView(Evas*, EwkViewType, const char* url);
+    EWKTestView(Evas*, EwkViewType, const char* url, int width, int height);
+
+    Evas_Object* webView() { return m_webView.get(); }
+    Evas_Object* mainFrame();
+    Evas* evas();
+    void show();
+
+    bool init();
+    void bindEvents(void (*callback)(void*, Evas_Object*, void*), const char* eventName, void* ptr);
+
+private:
+    EWKTestView(const EWKTestView&);
+    EWKTestView operator=(const EWKTestView&);
+
+    Evas* m_evas;
+    OwnPtr<Evas_Object> m_webView;
+
+    int m_width, m_height;
+    EwkViewType m_defaultViewType;
+    std::string m_url;
+};
+
+}
+
+#endif
diff --git a/Source/WebKit/efl/tests/resources/default_test_page.html b/Source/WebKit/efl/tests/resources/default_test_page.html
new file mode 100644
index 000000000..edd81e732
--- /dev/null
+++ b/Source/WebKit/efl/tests/resources/default_test_page.html
@@ -0,0 +1,6 @@
+<HTML>
+<BODY>
+<H2 align="center">EFL Unit Tests</H2>
+<H2 align="center">Default Testing Web Page</H2>
+</BODY>
+</HTML>
diff --git a/Source/WebKit/efl/tests/test_ewk_view.cpp b/Source/WebKit/efl/tests/test_ewk_view.cpp
new file mode 100644
index 000000000..2d490797a
--- /dev/null
+++ b/Source/WebKit/efl/tests/test_ewk_view.cpp
@@ -0,0 +1,54 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "config.h"
+
+#include "UnitTestUtils/EWKTestBase.h"
+#include <EWebKit.h>
+#include <gtest/gtest.h>
+
+using namespace EWKUnitTests;
+
+/**
+* @brief Checking whether function properly returns correct value.
+*/
+static void ewkViewEditableGetCb(void* eventInfo, Evas_Object* o, void* data)
+{
+    ewk_view_editable_set(o, EINA_FALSE);
+    EXPECT_EQ(EINA_FALSE, ewk_view_editable_get(o));
+    END_TEST();
+}
+
+TEST(test_ewk_view, ewk_view_editable_get)
+{
+    RUN_TEST(ewkViewEditableGetCb);
+}
+
+/**
+* @brief Checking whether function returns correct uri string.
+*/
+static void ewkViewUriGetCb(void* eventInfo, Evas_Object* o, void* data)
+{
+    EXPECT_STREQ("http://www.webkit.org/", ewk_view_uri_get(o));
+    END_TEST();
+}
+
+TEST(test_ewk_view, ewk_view_uri_get)
+{
+    RUN_TEST("http://www.webkit.org", ewkViewUriGetCb);
+}
diff --git a/Source/WebKit/efl/tests/test_runner.cpp b/Source/WebKit/efl/tests/test_runner.cpp
new file mode 100644
index 000000000..702a61f6c
--- /dev/null
+++ b/Source/WebKit/efl/tests/test_runner.cpp
@@ -0,0 +1,40 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public License
+    along with this library; if not, write to the Free Software Foundation,
+    Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+*/
+
+#include "UnitTestUtils/EWKTestBase.h"
+#include <getopt.h>
+#include <gtest/gtest.h>
+
+static void parseCustomArguments(int argc, char** argv)
+{
+    static const option options[] = {
+        {"useX11Window", no_argument, &EWKUnitTests::EWKTestBase::useX11Window, true},
+        {0, 0, 0, 0}
+    };
+
+    int option;
+    while ((option = getopt_long(argc, argv, "", options, 0)) != -1) { }
+}
+
+int main(int argc, char** argv)
+{
+    atexit(EWKUnitTests::EWKTestBase::shutdownAll);
+    parseCustomArguments(argc, argv);
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}
diff --git a/Source/WebKit/gtk/ChangeLog b/Source/WebKit/gtk/ChangeLog
index f2478d5a2..95fa53e62 100644
--- a/Source/WebKit/gtk/ChangeLog
+++ b/Source/WebKit/gtk/ChangeLog
@@ -1,3 +1,190 @@
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+
+2012-07-10  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [GTK] Fix memory leaks by adopting allocation of GdkPixbuf
+        https://bugs.webkit.org/show_bug.cgi?id=90790
+
+        Reviewed by Carlos Garcia Campos.
+
+        Fixed a memory leak in WebKitFaviconDatabase by adopting an
+        allocation of GdkPixbuf.
+
+        * webkit/webkitfavicondatabase.cpp:
+        (getIconPixbufSynchronously):
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        LayoutTestController.dumpConfigurationForViewport should move to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=45652
+
+        Reviewed by Eric Seidel.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-07-09  Adam Klein  <adamk@chromium.org>
+
+        Rename WebCore::WebKitMutationObserver to WebCore::MutationObserver
+        https://bugs.webkit.org/show_bug.cgi?id=90810
+
+        Reviewed by Ojan Vafai.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::deliverAllMutationsIfNecessary):
+
+2012-07-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Implement dumpFrameScrollPosition in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=89356
+
+        Reviewed by Martin Robinson.
+
+        Add a new method for returning the WebKitDOMDocument that is loaded
+        in a given frame, webkit_web_frame_get_dom_document.
+
+        * docs/webkitgtk-sections.txt:
+        * webkit/webkitwebframe.cpp:
+        (webkit_web_frame_get_dom_document):
+        * webkit/webkitwebframe.h:
+        * webkit/webkitwebview.cpp: State explicitly that the document being returned
+        when calling webkit_web_view_get_dom_document is loaded in the main frame.
+        Also call the webkit_web_frame_get_dom_document on WebKitWebView's main frame
+        to get the document.
+
+2012-07-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Unskip the CSS Regions layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=90771
+
+        Reviewed by Martin Robinson.
+
+        Add a method to DumpRenderTreeSupportGtk for enabling or disabling
+        CSS Regions from DumpRenderTree.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::setCSSRegionsEnabled):
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-07-09  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [GTK] Memory leak in webkitwebnavigationaction.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=90787
+
+        Reviewed by Martin Robinson.
+
+        Fixed a memory leak in WebKitWebNavigationAction.
+
+        * webkit/webkitwebnavigationaction.cpp:
+        (webkit_web_navigation_action_finalize): Free the g_strdup()'d string.
+
+2012-07-07  Zan Dobersek  <zandobersek@gmail.com>
+
+        REGRESSION (r122035): fullscreen/exit-full-screen-iframe.html failing on GTK Linux 64-bit Release
+        https://bugs.webkit.org/show_bug.cgi?id=90719
+
+        Reviewed by Martin Robinson.
+
+        Follow the approach of the BlackBerry port outlined in r122035, using in exitFullScreenForElement
+        the fullscreen element to which the reference was saved when enterFullScreenForElement was called.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::exitFullScreenForElement):
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * webkit/webkitglobals.cpp:
+        (webkitInit):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        [GTK] Enable CSS grid layout LayoutTests on GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=90226
+
+        Reviewed by Martin Robinson.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::setCSSGridLayoutEnabled): Pass through to Settings object.
+        * WebCoreSupport/DumpRenderTreeSupportGtk.h:
+        (DumpRenderTreeSupportGtk):
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        Updated the call to computeViewportAttributes.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::dumpConfigurationForViewport):
+        * webkit/webkitviewportattributes.cpp:
+        (webkitViewportAttributesRecompute):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * WebCoreSupport/DumpRenderTreeSupportGtk.cpp:
+        (DumpRenderTreeSupportGtk::gcCountJavascriptObjects):
+
+2012-06-27  Martin Robinson  <mrobinson@igalia.com>
+
+        [gtk] Spell checker doesn't recognize contractions (apostrophes)
+        https://bugs.webkit.org/show_bug.cgi?id=86118
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Work-around a bug in Pango by trying to detect apostrophes
+        that create contractions. This work-around is similar to one
+        found in gtkspell.
+
+        * webkit/webkitspellcheckerenchant.cpp:
+        (wordEndIsAContractionApostrophe): Added this helper which tries to detect
+        situations where a word end is both an apostrophe and followed by a alphabetic
+        character.
+        (checkSpellingOfString): When searching for the end of a word, skip over
+        apostrophes that appear to be part of contractions.
+
+2012-06-27  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=87503
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add the Gamepad feature dependencies libraries to the LIBADD
+        list for the libwebkitgtk library.
+
+        * GNUmakefile.am:
+
 2012-06-25  Carlos Garcia Campos  <cgarcia@igalia.com>
 
         Unreviewed. Update NEWS and configure.ac for 1.9.4 release
diff --git a/Source/WebKit/gtk/GNUmakefile.am b/Source/WebKit/gtk/GNUmakefile.am
index 12ee765a3..db3afada4 100644
--- a/Source/WebKit/gtk/GNUmakefile.am
+++ b/Source/WebKit/gtk/GNUmakefile.am
@@ -87,6 +87,7 @@ libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIBA
 	$(ENCHANT_LIBS) \
 	$(FREETYPE_LIBS) \
 	$(GAIL_LIBS) \
+	$(GAMEPAD_LIBS) \
 	$(GEOCLUE_LIBS) \
 	$(GLIB_LIBS) \
 	$(GSTREAMER_LIBS) \
diff --git a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index 3b309f8b8..91a21e819 100644
--- a/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -945,10 +945,15 @@ void ChromeClient::enterFullScreenForElement(WebCore::Element* element)
     element->document()->webkitDidEnterFullScreenForElement(element);
 }
 
-void ChromeClient::exitFullScreenForElement(WebCore::Element* element)
+void ChromeClient::exitFullScreenForElement(WebCore::Element*)
 {
+    // The element passed into this function is not reliable, i.e. it could
+    // be null. In addition the parameter may be disappearing in the future.
+    // So we use the reference to the element we saved above.
+    ASSERT(m_fullScreenElement);
+
     gboolean returnValue;
-    GRefPtr<WebKitDOMHTMLElement> kitElement(adoptGRef(kit(reinterpret_cast<HTMLElement*>(element))));
+    GRefPtr<WebKitDOMHTMLElement> kitElement(adoptGRef(kit(reinterpret_cast<HTMLElement*>(m_fullScreenElement.get()))));
     g_signal_emit_by_name(m_webView, "leaving-fullscreen", kitElement.get(), &returnValue);
     if (returnValue)
         return;
@@ -957,10 +962,10 @@ void ChromeClient::exitFullScreenForElement(WebCore::Element* element)
     ASSERT(widgetIsOnscreenToplevelWindow(window));
     g_signal_handlers_disconnect_by_func(window, reinterpret_cast<void*>(onFullscreenGtkKeyPressEvent), this);
 
-    element->document()->webkitWillExitFullScreenForElement(element);
+    m_fullScreenElement->document()->webkitWillExitFullScreenForElement(m_fullScreenElement.get());
     gtk_window_unfullscreen(GTK_WINDOW(window));
     m_adjustmentWatcher.enableAllScrollbars();
-    element->document()->webkitDidExitFullScreenForElement(element);
+    m_fullScreenElement->document()->webkitDidExitFullScreenForElement(m_fullScreenElement.get());
     m_fullScreenElement.clear();
 }
 #endif
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
index a9de875c9..07aa0102b 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.cpp
@@ -50,6 +50,7 @@
 #include "JSLock.h"
 #include "JSNodeList.h"
 #include "JSValue.h"
+#include "MutationObserver.h"
 #include "NodeList.h"
 #include "PageGroup.h"
 #include "PlatformString.h"
@@ -64,7 +65,6 @@
 #include "Settings.h"
 #include "TextIterator.h"
 #include "WebKitAccessibleWrapperAtk.h"
-#include "WebKitMutationObserver.h"
 #include "WorkerThread.h"
 #include "webkitglobalsprivate.h"
 #include "webkitwebframe.h"
@@ -600,7 +600,7 @@ void DumpRenderTreeSupportGtk::gcCollectJavascriptObjectsOnAlternateThread(bool
 
 unsigned long DumpRenderTreeSupportGtk::gcCountJavascriptObjects()
 {
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
+    JSC::JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return JSDOMWindow::commonJSGlobalData()->heap.objectCount();
 }
 
@@ -617,18 +617,6 @@ void DumpRenderTreeSupportGtk::layoutFrame(WebKitWebFrame* frame)
     view->layout();
 }
 
-// For testing fast/viewport.
-void DumpRenderTreeSupportGtk::dumpConfigurationForViewport(WebKitWebView* webView, gint deviceDPI, gint deviceWidth, gint deviceHeight, gint availableWidth, gint availableHeight)
-{
-    g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
-
-    ViewportArguments arguments = webView->priv->corePage->mainFrame()->document()->viewportArguments();
-    ViewportAttributes attrs = computeViewportAttributes(arguments, /* default layout width for non-mobile pages */ 980, deviceWidth, deviceHeight, deviceDPI, IntSize(availableWidth, availableHeight));
-    restrictMinimumScaleFactorToViewportSize(attrs, IntSize(availableWidth, availableHeight));
-    restrictScaleFactorToInitialScaleIfNotUserScalable(attrs);
-    fprintf(stdout, "viewport size %dx%d scale %f with limits [%f, %f] and userScalable %f\n", static_cast<int>(attrs.layoutSize.width()), static_cast<int>(attrs.layoutSize.height()), attrs.initialScale, attrs.minimumScale, attrs.maximumScale, attrs.userScalable);
-}
-
 void DumpRenderTreeSupportGtk::clearOpener(WebKitWebFrame* frame)
 {
     Frame* coreFrame = core(frame);
@@ -781,19 +769,19 @@ int DumpRenderTreeSupportGtk::numberOfPendingGeolocationPermissionRequests(WebKi
 #endif
 }
 
-void DumpRenderTreeSupportGtk::setHixie76WebSocketProtocolEnabled(WebKitWebView* webView, bool enabled)
+void DumpRenderTreeSupportGtk::setPageCacheSupportsPlugins(WebKitWebView* webView, bool enabled)
 {
-#if ENABLE(WEB_SOCKETS)
-    core(webView)->settings()->setUseHixie76WebSocketProtocol(enabled);
-#else
-    UNUSED_PARAM(webView);
-    UNUSED_PARAM(enabled);
-#endif
+    core(webView)->settings()->setPageCacheSupportsPlugins(enabled);
 }
 
-void DumpRenderTreeSupportGtk::setPageCacheSupportsPlugins(WebKitWebView* webView, bool enabled)
+void DumpRenderTreeSupportGtk::setCSSGridLayoutEnabled(WebKitWebView* webView, bool enabled)
 {
-    core(webView)->settings()->setPageCacheSupportsPlugins(enabled);
+    core(webView)->settings()->setCSSGridLayoutEnabled(enabled);
+}
+
+void DumpRenderTreeSupportGtk::setCSSRegionsEnabled(WebKitWebView* webView, bool enabled)
+{
+    core(webView)->settings()->setCSSRegionsEnabled(enabled);
 }
 
 bool DumpRenderTreeSupportGtk::elementDoesAutoCompleteForElementWithId(WebKitWebFrame* frame, JSStringRef id)
@@ -838,7 +826,7 @@ JSValueRef DumpRenderTreeSupportGtk::computedStyleIncludingVisitedInfo(JSContext
 void DumpRenderTreeSupportGtk::deliverAllMutationsIfNecessary()
 {
 #if ENABLE(MUTATION_OBSERVERS)
-    WebKitMutationObserver::deliverAllMutations();
+    MutationObserver::deliverAllMutations();
 #endif
 }
 
diff --git a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
index 79832fa90..99be717a1 100644
--- a/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
+++ b/Source/WebKit/gtk/WebCoreSupport/DumpRenderTreeSupportGtk.h
@@ -53,8 +53,6 @@ public:
     static void setSelectTrailingWhitespaceEnabled(bool);
     static bool selectTrailingWhitespaceEnabled();
 
-    static void dumpConfigurationForViewport(WebKitWebView* webView, gint deviceDPI, gint deviceWidth, gint deviceHeight, gint availableWidth, gint availableHeight);
-
     static void clearOpener(WebKitWebFrame*);
 
     // FIXME: Move these to webkitwebframe.h once their API has been discussed.
@@ -120,8 +118,9 @@ public:
     static void setMockGeolocationError(WebKitWebView*, int errorCode, const gchar* errorMessage);
     static int numberOfPendingGeolocationPermissionRequests(WebKitWebView*);
 
-    static void setHixie76WebSocketProtocolEnabled(WebKitWebView*, bool enabled);
     static void setPageCacheSupportsPlugins(WebKitWebView*, bool enabled);
+    static void setCSSGridLayoutEnabled(WebKitWebView*, bool enabled);
+    static void setCSSRegionsEnabled(WebKitWebView*, bool enabled);
 
     static void deliverAllMutationsIfNecessary();
     static void setDomainRelaxationForbiddenForURLScheme(bool forbidden, const char* urlScheme);
diff --git a/Source/WebKit/gtk/docs/webkitgtk-sections.txt b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
index f6589a22f..97fbc0507 100644
--- a/Source/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/Source/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -86,6 +86,7 @@ WebKitLoadStatus
 WebKitWebFrame
 webkit_web_frame_find_frame
 webkit_web_frame_get_data_source
+webkit_web_frame_get_dom_document
 webkit_web_frame_get_global_context
 webkit_web_frame_get_horizontal_scrollbar_policy
 webkit_web_frame_get_load_status
diff --git a/Source/WebKit/gtk/webkit/webkitfavicondatabase.cpp b/Source/WebKit/gtk/webkit/webkitfavicondatabase.cpp
index a9c3e6557..6babfe4dd 100644
--- a/Source/WebKit/gtk/webkit/webkitfavicondatabase.cpp
+++ b/Source/WebKit/gtk/webkit/webkitfavicondatabase.cpp
@@ -407,7 +407,7 @@ static GdkPixbuf* getIconPixbufSynchronously(WebKitFaviconDatabase* database, co
     int pixbufWidth = gdk_pixbuf_get_width(pixbuf.get());
     int pixbufHeight = gdk_pixbuf_get_height(pixbuf.get());
     if (!iconSize.isZero() && (pixbufWidth != iconSize.width() || pixbufHeight != iconSize.height()))
-        pixbuf = gdk_pixbuf_scale_simple(pixbuf.get(), iconSize.width(), iconSize.height(), GDK_INTERP_BILINEAR);
+        pixbuf = adoptGRef(gdk_pixbuf_scale_simple(pixbuf.get(), iconSize.width(), iconSize.height(), GDK_INTERP_BILINEAR));
     return pixbuf.leakRef();
 }
 
diff --git a/Source/WebKit/gtk/webkit/webkitglobals.cpp b/Source/WebKit/gtk/webkit/webkitglobals.cpp
index 78a4949fb..42f7a1d93 100644
--- a/Source/WebKit/gtk/webkit/webkitglobals.cpp
+++ b/Source/WebKit/gtk/webkit/webkitglobals.cpp
@@ -504,7 +504,9 @@ void webkitInit()
     JSC::initializeThreading();
     WTF::initializeMainThread();
 
+#if !LOG_DISABLED
     WebCore::initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
     PlatformStrategiesGtk::initialize();
 
     // We make sure the text codecs have been initialized, because
diff --git a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
index f51a12f23..0eb4986d1 100644
--- a/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
+++ b/Source/WebKit/gtk/webkit/webkitspellcheckerenchant.cpp
@@ -88,6 +88,18 @@ static void webkit_spell_checker_enchant_init(WebKitSpellCheckerEnchant* checker
     priv->enchantDicts = 0;
 }
 
+static bool wordEndIsAContractionApostrophe(const char* string, long offset)
+{
+    if (g_utf8_get_char(g_utf8_offset_to_pointer(string, offset)) != g_utf8_get_char("'"))
+        return false;
+
+    // If this is the last character in the string, it cannot be the apostrophe part of a contraction.
+    if (offset == g_utf8_strlen(string, -1))
+        return false;
+
+    return g_unichar_isalpha(g_utf8_get_char(g_utf8_offset_to_pointer(string, offset + 1)));
+}
+
 static void checkSpellingOfString(WebKitSpellChecker* checker, const char* string, int* misspellingLocation, int* misspellingLength)
 {
     WebKitSpellCheckerEnchantPrivate* priv = WEBKIT_SPELL_CHECKER_ENCHANT(checker)->priv;
@@ -113,7 +125,7 @@ static void checkSpellingOfString(WebKitSpellChecker* checker, const char* strin
             int end = i;
             int wordLength;
 
-            while (attrs.get()[end].is_word_end < 1)
+            while (attrs.get()[end].is_word_end < 1 || wordEndIsAContractionApostrophe(string, end))
                 end++;
 
             wordLength = end - start;
diff --git a/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp b/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
index c08191fae..138bdc321 100644
--- a/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
+++ b/Source/WebKit/gtk/webkit/webkitviewportattributes.cpp
@@ -534,7 +534,7 @@ void webkitViewportAttributesRecompute(WebKitViewportAttributes* viewportAttribu
 
     ViewportArguments arguments = webView->priv->corePage->mainFrame()->document()->viewportArguments();
 
-    ViewportAttributes attributes = computeViewportAttributes(arguments, priv->desktopWidth, priv->deviceWidth, priv->deviceHeight, priv->deviceDPI, IntSize(priv->availableWidth, priv->availableHeight));
+    ViewportAttributes attributes = computeViewportAttributes(arguments, priv->desktopWidth, priv->deviceWidth, priv->deviceHeight, priv->deviceDPI / ViewportArguments::deprecatedTargetDPI, IntSize(priv->availableWidth, priv->availableHeight));
     restrictMinimumScaleFactorToViewportSize(attributes, IntSize(priv->availableWidth, priv->availableHeight));
     restrictScaleFactorToInitialScaleIfNotUserScalable(attributes);
 
diff --git a/Source/WebKit/gtk/webkit/webkitwebframe.cpp b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
index 77292213e..c1033e61d 100644
--- a/Source/WebKit/gtk/webkit/webkitwebframe.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebframe.cpp
@@ -56,6 +56,7 @@
 #include "TextIterator.h"
 #include "WebKitAccessibleWrapperAtk.h"
 #include "markup.h"
+#include "webkit/WebKitDOMDocumentPrivate.h"
 #include "webkit/WebKitDOMRangePrivate.h"
 #include "webkitenumtypes.h"
 #include "webkitglobalsprivate.h"
@@ -1180,6 +1181,30 @@ WebKitDOMRange* webkit_web_frame_get_range_for_word_around_caret(WebKitWebFrame*
     return kit(visibleSelection.firstRange().get());
 }
 
+/**
+ * webkit_web_frame_get_dom_document:
+ * @frame: a #WebKitWebFrame
+ * 
+ * Returns: (transfer none): the #WebKitDOMDocument currently loaded
+ * in the @frame or %NULL if no document is loaded
+ *
+ * Since: 1.10
+ **/
+WebKitDOMDocument* webkit_web_frame_get_dom_document(WebKitWebFrame* frame)
+{
+    g_return_val_if_fail(WEBKIT_IS_WEB_FRAME(frame), 0);
+
+    Frame* coreFrame = core(frame);
+    if (!coreFrame)
+        return 0;
+
+    Document* doc = coreFrame->document();
+    if (!doc)
+        return 0;
+
+    return kit(doc);
+}
+
 namespace WebKit {
 
 WebKitWebView* getViewFromFrame(WebKitWebFrame* frame)
diff --git a/Source/WebKit/gtk/webkit/webkitwebframe.h b/Source/WebKit/gtk/webkit/webkitwebframe.h
index 012f8a8e9..1b5b8aca5 100644
--- a/Source/WebKit/gtk/webkit/webkitwebframe.h
+++ b/Source/WebKit/gtk/webkit/webkitwebframe.h
@@ -183,6 +183,9 @@ webkit_web_frame_replace_selection           (WebKitWebFrame        *frame,
 WEBKIT_API WebKitDOMRange*
 webkit_web_frame_get_range_for_word_around_caret (WebKitWebFrame    *frame);
 
+WEBKIT_API WebKitDOMDocument*
+webkit_web_frame_get_dom_document            (WebKitWebFrame        *frame);
+
 G_END_DECLS
 
 #endif
diff --git a/Source/WebKit/gtk/webkit/webkitwebnavigationaction.cpp b/Source/WebKit/gtk/webkit/webkitwebnavigationaction.cpp
index 72b9965ba..ca8a72518 100644
--- a/Source/WebKit/gtk/webkit/webkitwebnavigationaction.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebnavigationaction.cpp
@@ -123,6 +123,7 @@ static void webkit_web_navigation_action_finalize(GObject* obj)
     WebKitWebNavigationActionPrivate* priv = navigationAction->priv;
 
     g_free(priv->originalUri);
+    g_free(priv->targetFrame);
 
     G_OBJECT_CLASS(webkit_web_navigation_action_parent_class)->finalize(obj);
 }
diff --git a/Source/WebKit/gtk/webkit/webkitwebview.cpp b/Source/WebKit/gtk/webkit/webkitwebview.cpp
index aac487f23..3344bf84b 100644
--- a/Source/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/Source/WebKit/gtk/webkit/webkitwebview.cpp
@@ -3438,10 +3438,6 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     coreSettings->setWebAudioEnabled(settingsPrivate->enableWebAudio);
 #endif
 
-#if ENABLE(WEB_SOCKETS)
-    coreSettings->setUseHixie76WebSocketProtocol(false);
-#endif
-
 #if ENABLE(SMOOTH_SCROLLING)
     coreSettings->setEnableScrollAnimator(settingsPrivate->enableSmoothScrolling);
 #endif
@@ -5228,7 +5224,8 @@ GdkPixbuf* webkit_web_view_try_get_favicon_pixbuf(WebKitWebView* webView, guint
  * webkit_web_view_get_dom_document:
  * @web_view: a #WebKitWebView
  * 
- * Returns: (transfer none): the #WebKitDOMDocument currently loaded in the @web_view
+ * Returns: (transfer none): the #WebKitDOMDocument currently loaded in
+ * the main frame of the @web_view or %NULL if no document is loaded
  *
  * Since: 1.3.1
  **/
@@ -5237,15 +5234,7 @@ webkit_web_view_get_dom_document(WebKitWebView* webView)
 {
     g_return_val_if_fail(WEBKIT_IS_WEB_VIEW(webView), 0);
 
-    Frame* coreFrame = core(webView)->mainFrame();
-    if (!coreFrame)
-        return 0;
-
-    Document* doc = coreFrame->document();
-    if (!doc)
-        return 0;
-
-    return kit(doc);
+    return webkit_web_frame_get_dom_document(webView->priv->mainFrame);
 }
 
 GtkMenu* webkit_web_view_get_context_menu(WebKitWebView* webView)
diff --git a/Source/WebKit/mac/ChangeLog b/Source/WebKit/mac/ChangeLog
index 606bceb83..c89cbcf1f 100644
--- a/Source/WebKit/mac/ChangeLog
+++ b/Source/WebKit/mac/ChangeLog
@@ -1,3 +1,229 @@
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences setHixie76WebSocketProtocolEnabled:]):
+        (-[WebPreferences isHixie76WebSocketProtocolEnabled]):
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChanged:]):
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Consider closing unused localStorage database after a timeout.
+        https://bugs.webkit.org/show_bug.cgi?id=90713
+
+        For a localStorage, if there is no active document referencing to it for certain amount of time (300 seconds),
+        we can close the underlying sqlite database.
+
+        Reviewed by Brady Eidson.
+
+        * Storage/WebStorageManager.mm:
+        (+[WebStorageManager setStorageDatabaseIdleInterval:]): add a new method for DumpRenderTree to set the timeout
+            that we will wait before closing database.
+        (initializeLocalStoragePath):
+        * Storage/WebStorageManagerPrivate.h:
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing.
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * Misc/WebIconDatabase.mm:
+        (-[WebIconDatabase _scaleIcon:toSize:]):
+        * Misc/WebKitLogging.h:
+        * Misc/WebKitLogging.m:
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _attributeStringFromDOMRange:]):
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:]):
+
+2012-07-01  Timothy Hatcher  <timothy@apple.com>
+
+        Make the "Inspect Element" context menu item appear in nightly builds again.
+
+        rdar://problem/11702613
+        https://webkit.org/b/89323
+
+        Reviewed by Dan Bernstein.
+
+        * WebView/WebUIDelegatePrivate.h:
+        Add missing enums that were added in ContextMenuItem.h but left out here.
+
+2012-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121529.
+        http://trac.webkit.org/changeset/121529
+        https://bugs.webkit.org/show_bug.cgi?id=90260
+
+        Failed to compile on Chromium WebKitMacBuilder (Requested by
+        keishi on #webkit).
+
+        * DefaultDelegates/WebDefaultContextMenuDelegate.mm:
+        (-[WebDefaultUIDelegate menuItemWithTag:target:representedObject:]):
+        * Misc/WebNSControlExtras.m:
+        (-[NSControl sizeToFitAndAdjustWindowHeight]):
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::shouldEraseMarkersAfterChangeSelection):
+        (WebEditorClient::getGuessesForWord):
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidFirstLayout):
+        (WebFrameLoaderClient::provisionalLoadStarted):
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView scrollWheel:]):
+        * WebView/WebFullScreenController.mm:
+        (-[WebFullScreenController finishedEnterFullScreenAnimation:]):
+        (-[WebFullScreenController exitFullScreen]):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _pasteWithPasteboard:allowPlainText:]):
+        * WebView/WebView.mm:
+        (+[WebView initialize]):
+        (-[WebView _deviceScaleFactor]):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD branches now that no port builds on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90252
+
+        Reviewed by Ryosuke Niwa.
+
+        * DefaultDelegates/WebDefaultContextMenuDelegate.mm:
+        (-[WebDefaultUIDelegate menuItemWithTag:target:representedObject:]):
+        * Misc/WebNSControlExtras.m:
+        (-[NSControl sizeToFitAndAdjustWindowHeight]):
+        * WebCoreSupport/WebEditorClient.mm:
+        (WebEditorClient::shouldEraseMarkersAfterChangeSelection):
+        (WebEditorClient::getGuessesForWord):
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::dispatchDidFirstLayout):
+        (WebFrameLoaderClient::provisionalLoadStarted):
+        * WebCoreSupport/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+        * WebView/WebDynamicScrollBarsView.mm:
+        (-[WebDynamicScrollBarsView scrollWheel:]):
+        * WebView/WebFullScreenController.mm:
+        (-[WebFullScreenController finishedEnterFullScreenAnimation:]):
+        (-[WebFullScreenController exitFullScreen]):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _pasteWithPasteboard:allowPlainText:]):
+        * WebView/WebView.mm:
+        (+[WebView initialize]):
+        (-[WebView _deviceScaleFactor]):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * DOM/WebDOMOperations.mm:
+        (JSC):
+        * Misc/WebCoreStatistics.mm:
+        (+[WebCoreStatistics javaScriptObjectsCount]):
+        (+[WebCoreStatistics javaScriptGlobalObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedGlobalObjectsCount]):
+        (+[WebCoreStatistics javaScriptProtectedObjectTypeCounts]):
+        (+[WebCoreStatistics javaScriptObjectTypeCounts]):
+        (+[WebCoreStatistics shouldPrintExceptions]):
+        (+[WebCoreStatistics setShouldPrintExceptions:]):
+        (+[WebCoreStatistics memoryStatistics]):
+        (+[WebCoreStatistics javaScriptReferencedObjectsCount]):
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::evaluate):
+        (WebKit::NetscapePluginInstanceProxy::invoke):
+        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
+        (WebKit::NetscapePluginInstanceProxy::construct):
+        (WebKit::NetscapePluginInstanceProxy::getProperty):
+        (WebKit::NetscapePluginInstanceProxy::setProperty):
+        (WebKit::NetscapePluginInstanceProxy::removeProperty):
+        (WebKit::NetscapePluginInstanceProxy::hasMethod):
+        (WebKit::NetscapePluginInstanceProxy::enumerate):
+        (WebKit::NetscapePluginInstanceProxy::addValueToArray):
+        (WebKit::NetscapePluginInstanceProxy::moveGlobalExceptionToExecState):
+        * Plugins/WebNetscapePluginStream.mm:
+        (WebNetscapePluginStream::wantsAllStreams):
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView sendEvent:isDrawRect:]):
+        (-[WebNetscapePluginView privateBrowsingModeDidChange]):
+        (-[WebNetscapePluginView setWindowIfNecessary]):
+        (-[WebNetscapePluginView createPluginScriptableObject]):
+        (-[WebNetscapePluginView getFormValue:]):
+        (-[WebNetscapePluginView evaluateJavaScriptPluginRequest:]):
+        (-[WebNetscapePluginView webFrame:didFinishLoadWithReason:]):
+        (-[WebNetscapePluginView loadPluginRequest:]):
+        (-[WebNetscapePluginView _printedPluginBitmap]):
+        * Plugins/WebPluginController.mm:
+        (+[WebPluginController plugInViewWithArguments:fromPluginPackage:]):
+        (-[WebPluginController stopOnePlugin:]):
+        (-[WebPluginController destroyOnePlugin:]):
+        (-[WebPluginController startAllPlugins]):
+        (-[WebPluginController addPlugin:]):
+        * WebView/WebFrame.mm:
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):
+        * WebView/WebScriptDebugDelegate.mm:
+        (-[WebScriptCallFrame scopeChain]):
+        (-[WebScriptCallFrame evaluateWebScript:]):
+        * WebView/WebView.mm:
+        (+[WebView _reportException:inContext:]):
+        (-[WebView aeDescByEvaluatingJavaScriptFromString:]):
+        (-[WebView _computedStyleIncludingVisitedInfo:forElement:]):
+
 2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r121058.
diff --git a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
index b1b84966d..7f95c3018 100644
--- a/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -52,11 +52,11 @@ ENABLE_DATALIST = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
 ENABLE_DETAILS = ENABLE_DETAILS;
 ENABLE_DEVICE_ORIENTATION = ;
+ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_FILE_SYSTEM = ;
 ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
 ENABLE_FILTERS_macosx = ENABLE_FILTERS;
-ENABLE_FONT_BOOSTING = ;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
@@ -120,6 +120,7 @@ ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
+ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_UNDO_MANAGER = ;
@@ -133,4 +134,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FONT_BOOSTING) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit/mac/DOM/WebDOMOperations.mm b/Source/WebKit/mac/DOM/WebDOMOperations.mm
index e6e6d3a2c..aaa7a7027 100644
--- a/Source/WebKit/mac/DOM/WebDOMOperations.mm
+++ b/Source/WebKit/mac/DOM/WebDOMOperations.mm
@@ -67,8 +67,9 @@ using namespace JSC;
     if (!value)
         return 0;
 
-    JSLock lock(SilenceAssertionsOnly);
-    return kit(toElement(toJS(toJS(context), value)));
+    ExecState* exec = toJS(context);
+    JSLockHolder lock(exec);
+    return kit(toElement(toJS(exec, value)));
 }
 
 - (NSString *)_markerTextForListItem
diff --git a/Source/WebKit/mac/Misc/WebCoreStatistics.mm b/Source/WebKit/mac/Misc/WebCoreStatistics.mm
index 1840451d6..296dd6b25 100644
--- a/Source/WebKit/mac/Misc/WebCoreStatistics.mm
+++ b/Source/WebKit/mac/Misc/WebCoreStatistics.mm
@@ -58,31 +58,31 @@ using namespace WebCore;
 
 + (size_t)javaScriptObjectsCount
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return JSDOMWindow::commonJSGlobalData()->heap.objectCount();
 }
 
 + (size_t)javaScriptGlobalObjectsCount
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return JSDOMWindow::commonJSGlobalData()->heap.globalObjectCount();
 }
 
 + (size_t)javaScriptProtectedObjectsCount
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return JSDOMWindow::commonJSGlobalData()->heap.protectedObjectCount();
 }
 
 + (size_t)javaScriptProtectedGlobalObjectsCount
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return JSDOMWindow::commonJSGlobalData()->heap.protectedGlobalObjectCount();
 }
 
 + (NSCountedSet *)javaScriptProtectedObjectTypeCounts
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     
     NSCountedSet *result = [NSCountedSet set];
 
@@ -97,7 +97,7 @@ using namespace WebCore;
 
 + (NSCountedSet *)javaScriptObjectTypeCounts
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     
     NSCountedSet *result = [NSCountedSet set];
 
@@ -167,13 +167,13 @@ using namespace WebCore;
 
 + (BOOL)shouldPrintExceptions
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return Console::shouldPrintExceptions();
 }
 
 + (void)setShouldPrintExceptions:(BOOL)print
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     Console::setShouldPrintExceptions(print);
 }
 
@@ -201,7 +201,7 @@ using namespace WebCore;
 {
     WTF::FastMallocStatistics fastMallocStatistics = WTF::fastMallocStatistics();
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     size_t heapSize = JSDOMWindow::commonJSGlobalData()->heap.size();
     size_t heapFree = JSDOMWindow::commonJSGlobalData()->heap.capacity() - heapSize;
     GlobalMemoryStatistics globalMemoryStats = globalMemoryStatistics();
@@ -245,7 +245,7 @@ using namespace WebCore;
 
 + (size_t)javaScriptReferencedObjectsCount
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return JSDOMWindow::commonJSGlobalData()->heap.protectedObjectCount();
 }
 
diff --git a/Source/WebKit/mac/Misc/WebIconDatabase.mm b/Source/WebKit/mac/Misc/WebIconDatabase.mm
index 4f8fc6e06..fee30f786 100644
--- a/Source/WebKit/mac/Misc/WebIconDatabase.mm
+++ b/Source/WebKit/mac/Misc/WebIconDatabase.mm
@@ -441,7 +441,7 @@ static WebIconDatabaseClient* defaultClient()
     ASSERT(size.width);
     ASSERT(size.height);
     
-#if !LOG_DISABLED        
+#if !LOG_DISABLED
     double start = CFAbsoluteTimeGetCurrent();
 #endif
     
diff --git a/Source/WebKit/mac/Misc/WebKitLogging.h b/Source/WebKit/mac/Misc/WebKitLogging.h
index f71f73063..5f3428da3 100644
--- a/Source/WebKit/mac/Misc/WebKitLogging.h
+++ b/Source/WebKit/mac/Misc/WebKitLogging.h
@@ -36,6 +36,7 @@
 extern "C" {
 #endif
 
+#if !LOG_DISABLED
 extern WTFLogChannel WebKitLogTiming;
 extern WTFLogChannel WebKitLogLoading;
 extern WTFLogChannel WebKitLogFontCache;
@@ -62,6 +63,7 @@ extern WTFLogChannel WebKitLogIconDatabase;
 extern WTFLogChannel WebKitLogTextInput;
 
 void WebKitInitializeLoggingChannelsIfNecessary(void);
+#endif // !LOG_DISABLED
 
 // FIXME: Why is this in the "logging" header file?
 // Use WebCoreThreadViolationCheck instead for checks that throw an exception even in production builds.
diff --git a/Source/WebKit/mac/Misc/WebKitLogging.m b/Source/WebKit/mac/Misc/WebKitLogging.m
index 72a822fee..e005fefa3 100644
--- a/Source/WebKit/mac/Misc/WebKitLogging.m
+++ b/Source/WebKit/mac/Misc/WebKitLogging.m
@@ -28,6 +28,8 @@
 
 #import "WebKitLogging.h"
 
+#if !LOG_DISABLED
+
 WTFLogChannel WebKitLogTextInput =              { 0x00000010, "WebKitLogLevel", WTFLogChannelOff };
 WTFLogChannel WebKitLogTiming =                 { 0x00000020, "WebKitLogLevel", WTFLogChannelOff };
 WTFLogChannel WebKitLogLoading =                { 0x00000040, "WebKitLogLevel", WTFLogChannelOff };
@@ -98,6 +100,7 @@ void WebKitInitializeLoggingChannelsIfNecessary()
     initializeLogChannel(&WebKitLogIconDatabase);
     initializeLogChannel(&WebKitLogTextInput);
 }
+#endif // !LOG_DISABLED
 
 void ReportDiscardedDelegateException(SEL delegateSelector, id exception)
 {
diff --git a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index fa82096ec..4a7d3d266 100644
--- a/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -867,8 +867,7 @@ bool NetscapePluginInstanceProxy::evaluate(uint32_t objectID, const String& scri
     if (!frame)
         return false;
 
-    JSLock lock(SilenceAssertionsOnly);
-    
+    JSLockHolder lock(pluginWorld()->globalData());
     Strong<JSGlobalObject> globalObject(*pluginWorld()->globalData(), frame->script()->globalObject(pluginWorld()));
     ExecState* exec = globalObject->globalExec();
 
@@ -904,7 +903,7 @@ bool NetscapePluginInstanceProxy::invoke(uint32_t objectID, const Identifier& me
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue function = object->get(exec, methodName);
     CallData callData;
     CallType callType = getCallData(function, callData);
@@ -937,7 +936,7 @@ bool NetscapePluginInstanceProxy::invokeDefault(uint32_t objectID, data_t argume
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);    
+    JSLockHolder lock(exec);    
     CallData callData;
     CallType callType = object->methodTable()->getCallData(object, callData);
     if (callType == CallTypeNone)
@@ -969,7 +968,7 @@ bool NetscapePluginInstanceProxy::construct(uint32_t objectID, data_t argumentsD
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     ConstructData constructData;
     ConstructType constructType = object->methodTable()->getConstructData(object, constructData);
@@ -1002,7 +1001,7 @@ bool NetscapePluginInstanceProxy::getProperty(uint32_t objectID, const Identifie
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);    
+    JSLockHolder lock(exec);    
     JSValue value = object->get(exec, propertyName);
     
     marshalValue(exec, value, resultData, resultLength);
@@ -1023,7 +1022,7 @@ bool NetscapePluginInstanceProxy::getProperty(uint32_t objectID, unsigned proper
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);    
+    JSLockHolder lock(exec);    
     JSValue value = object->get(exec, propertyName);
     
     marshalValue(exec, value, resultData, resultLength);
@@ -1047,7 +1046,7 @@ bool NetscapePluginInstanceProxy::setProperty(uint32_t objectID, const Identifie
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);    
+    JSLockHolder lock(exec);    
 
     JSValue value = demarshalValue(exec, valueData, valueLength);
     PutPropertySlot slot;
@@ -1073,7 +1072,7 @@ bool NetscapePluginInstanceProxy::setProperty(uint32_t objectID, unsigned proper
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);    
+    JSLockHolder lock(exec);    
     
     JSValue value = demarshalValue(exec, valueData, valueLength);
     object->methodTable()->putByIndex(object, exec, propertyName, value, false);
@@ -1098,12 +1097,12 @@ bool NetscapePluginInstanceProxy::removeProperty(uint32_t objectID, const Identi
         return false;
 
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
+    JSLockHolder lock(exec);
     if (!object->hasProperty(exec, propertyName)) {
         exec->clearException();
         return false;
     }
     
-    JSLock lock(SilenceAssertionsOnly);
     object->methodTable()->deleteProperty(object, exec, propertyName);
     exec->clearException();    
     return true;
@@ -1125,12 +1124,12 @@ bool NetscapePluginInstanceProxy::removeProperty(uint32_t objectID, unsigned pro
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
+    JSLockHolder lock(exec);
     if (!object->hasProperty(exec, propertyName)) {
         exec->clearException();
         return false;
     }
     
-    JSLock lock(SilenceAssertionsOnly);
     object->methodTable()->deletePropertyByIndex(object, exec, propertyName);
     exec->clearException();    
     return true;
@@ -1196,7 +1195,7 @@ bool NetscapePluginInstanceProxy::hasMethod(uint32_t objectID, const Identifier&
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue func = object->get(exec, methodName);
     exec->clearException();
     return !func.isUndefined();
@@ -1218,7 +1217,7 @@ bool NetscapePluginInstanceProxy::enumerate(uint32_t objectID, data_t& resultDat
         return false;
     
     ExecState* exec = frame->script()->globalObject(pluginWorld())->globalExec();
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
  
     PropertyNameArray propertyNames(exec);
     object->methodTable()->getPropertyNames(object, exec, propertyNames, ExcludeDontEnumProperties);
@@ -1262,7 +1261,7 @@ static bool getObjectID(NetscapePluginInstanceProxy* pluginInstanceProxy, JSObje
     
 void NetscapePluginInstanceProxy::addValueToArray(NSMutableArray *array, ExecState* exec, JSValue value)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     if (value.isString()) {
         [array addObject:[NSNumber numberWithInt:StringValueType]];
@@ -1672,7 +1671,7 @@ void NetscapePluginInstanceProxy::moveGlobalExceptionToExecState(ExecState* exec
         return;
 
     {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         throwError(exec, createError(exec, stringToUString(globalExceptionString())));
     }
 
diff --git a/Source/WebKit/mac/Plugins/WebNetscapePluginStream.mm b/Source/WebKit/mac/Plugins/WebNetscapePluginStream.mm
index bb7f4d5f5..a7daaaec0 100644
--- a/Source/WebKit/mac/Plugins/WebNetscapePluginStream.mm
+++ b/Source/WebKit/mac/Plugins/WebNetscapePluginStream.mm
@@ -368,7 +368,7 @@ bool WebNetscapePluginStream::wantsAllStreams() const
     NPError error;
     {
         PluginStopDeferrer deferrer(m_pluginView.get());
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         error = m_pluginFuncs->getvalue(m_plugin, NPPVpluginWantsAllNetworkStreams, &value);
     }
     if (error != NPERR_NO_ERROR)
diff --git a/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm b/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
index 5f1f55694..426405f25 100644
--- a/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/Source/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -669,7 +669,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
     // Set the pluginAllowPopup flag.
     ASSERT(_eventHandler);
     {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         UserGestureIndicator gestureIndicator(_eventHandler->currentEventIsUserGesture() ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
         acceptedEvent = [_pluginPackage.get() pluginFuncs]->event(plugin, event);
     }
@@ -850,7 +850,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
 
     [self willCallPlugInFunction];
     {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         if ([_pluginPackage.get() pluginFuncs]->setvalue)
             [_pluginPackage.get() pluginFuncs]->setvalue(plugin, NPNVprivateModeBool, &value);
     }
@@ -991,7 +991,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
         inSetWindow = YES;        
         [self willCallPlugInFunction];
         {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+            JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
             npErr = [_pluginPackage.get() pluginFuncs]->setwindow(plugin, &window);
         }
         [self didCallPlugInFunction];
@@ -1444,7 +1444,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
     NPError error;
     [self willCallPlugInFunction];
     {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         error = [_pluginPackage.get() pluginFuncs]->getvalue(plugin, NPPVpluginScriptableNPObject, &value);
     }
     [self didCallPlugInFunction];
@@ -1463,7 +1463,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
     NPError error;
     [self willCallPlugInFunction];
     {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         error = [_pluginPackage.get() pluginFuncs]->getvalue(plugin, NPPVformValue, &buffer);
     }
     [self didCallPlugInFunction];
@@ -1595,7 +1595,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
         if ([JSPluginRequest sendNotification]) {
             [self willCallPlugInFunction];
             {
-                JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+                JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
                 [_pluginPackage.get() pluginFuncs]->urlnotify(plugin, [URL _web_URLCString], NPRES_DONE, [JSPluginRequest notifyData]);
             }
             [self didCallPlugInFunction];
@@ -1627,7 +1627,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
         
     [self willCallPlugInFunction];
     {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         [_pluginPackage.get() pluginFuncs]->urlnotify(plugin, [[[pluginRequest request] URL] _web_URLCString], reason, [pluginRequest notifyData]);
     }
     [self didCallPlugInFunction];
@@ -1671,7 +1671,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
                 if ([pluginRequest sendNotification]) {
                     [self willCallPlugInFunction];
                     {
-                        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+                        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
                         [_pluginPackage.get() pluginFuncs]->urlnotify(plugin, [[[pluginRequest request] URL] _web_URLCString], NPERR_GENERIC_ERROR, [pluginRequest notifyData]);
                     }
                     [self didCallPlugInFunction];
@@ -2471,7 +2471,7 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
     // Tell the plugin to print into the GWorld
     [self willCallPlugInFunction];
     {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         [_pluginPackage.get() pluginFuncs]->print(plugin, &npPrint);
     }
     [self didCallPlugInFunction];
diff --git a/Source/WebKit/mac/Plugins/WebPluginController.mm b/Source/WebKit/mac/Plugins/WebPluginController.mm
index 65a05ae40..dd599d6d1 100644
--- a/Source/WebKit/mac/Plugins/WebPluginController.mm
+++ b/Source/WebKit/mac/Plugins/WebPluginController.mm
@@ -96,10 +96,10 @@ static NSMutableSet *pluginViews = nil;
     NSView *view = nil;
 
     if ([viewFactory respondsToSelector:@selector(plugInViewWithArguments:)]) {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         view = [viewFactory plugInViewWithArguments:arguments];
     } else if ([viewFactory respondsToSelector:@selector(pluginViewWithArguments:)]) {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         view = [viewFactory pluginViewWithArguments:arguments];
     }
     
@@ -149,10 +149,10 @@ static NSMutableSet *pluginViews = nil;
 - (void)stopOnePlugin:(NSView *)view
 {
     if ([view respondsToSelector:@selector(webPlugInStop)]) {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         [view webPlugInStop];
     } else if ([view respondsToSelector:@selector(pluginStop)]) {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         [view pluginStop];
     }
 }
@@ -160,10 +160,10 @@ static NSMutableSet *pluginViews = nil;
 - (void)destroyOnePlugin:(NSView *)view
 {
     if ([view respondsToSelector:@selector(webPlugInDestroy)]) {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         [view webPlugInDestroy];
     } else if ([view respondsToSelector:@selector(pluginDestroy)]) {
-        JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+        JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         [view pluginDestroy];
     }
 }
@@ -180,10 +180,10 @@ static NSMutableSet *pluginViews = nil;
     for (int i = 0; i < count; i++) {
         id aView = [_views objectAtIndex:i];
         if ([aView respondsToSelector:@selector(webPlugInStart)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+            JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
             [aView webPlugInStart];
         } else if ([aView respondsToSelector:@selector(pluginStart)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+            JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
             [aView pluginStart];
         }
     }
@@ -252,10 +252,10 @@ static NSMutableSet *pluginViews = nil;
 
         LOG(Plugins, "initializing plug-in %@", view);
         if ([view respondsToSelector:@selector(webPlugInInitialize)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+            JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
             [view webPlugInInitialize];
         } else if ([view respondsToSelector:@selector(pluginInitialize)]) {
-            JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+            JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
             [view pluginInitialize];
         }
 
@@ -265,15 +265,15 @@ static NSMutableSet *pluginViews = nil;
         if (_started) {
             LOG(Plugins, "starting plug-in %@", view);
             if ([view respondsToSelector:@selector(webPlugInStart)]) {
-                JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+                JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
                 [view webPlugInStart];
             } else if ([view respondsToSelector:@selector(pluginStart)]) {
-                JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+                JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
                 [view pluginStart];
             }
             
             if ([view respondsToSelector:@selector(setContainingWindow:)]) {
-                JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+                JSC::JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
                 [view setContainingWindow:[_documentView window]];
             }
         }
diff --git a/Source/WebKit/mac/Storage/WebStorageManager.mm b/Source/WebKit/mac/Storage/WebStorageManager.mm
index bb24b3ed6..eea21fd8b 100644
--- a/Source/WebKit/mac/Storage/WebStorageManager.mm
+++ b/Source/WebKit/mac/Storage/WebStorageManager.mm
@@ -97,7 +97,12 @@ static pthread_once_t registerLocalStoragePath = PTHREAD_ONCE_INIT;
     return sLocalStoragePath;
 }
 
-static void initializeLocalStoragePath() 
++ (void)setStorageDatabaseIdleInterval:(double)interval
+{
+    StorageTracker::tracker().setStorageDatabaseIdleInterval(interval);
+}
+
+static void initializeLocalStoragePath()
 {
     NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
     sLocalStoragePath = [defaults objectForKey:WebStorageDirectoryDefaultsKey];
diff --git a/Source/WebKit/mac/Storage/WebStorageManagerPrivate.h b/Source/WebKit/mac/Storage/WebStorageManagerPrivate.h
index ab9487170..79fe0050e 100644
--- a/Source/WebKit/mac/Storage/WebStorageManagerPrivate.h
+++ b/Source/WebKit/mac/Storage/WebStorageManagerPrivate.h
@@ -43,6 +43,6 @@ extern NSString * const WebStorageDidModifyOriginNotification;
 - (void)syncFileSystemAndTrackerDatabase;
 
 + (NSString *)_storageDirectoryPath;
-
++ (void)setStorageDatabaseIdleInterval:(double)interval;
 @end
 
diff --git a/Source/WebKit/mac/WebView/WebFrame.mm b/Source/WebKit/mac/WebView/WebFrame.mm
index 3c497f663..0ad0eca25 100644
--- a/Source/WebKit/mac/WebView/WebFrame.mm
+++ b/Source/WebKit/mac/WebView/WebFrame.mm
@@ -104,7 +104,6 @@ using namespace HTMLNames;
 using JSC::JSGlobalObject;
 using JSC::JSLock;
 using JSC::JSValue;
-using JSC::SilenceAssertionsOnly;
 
 /*
 Here is the current behavior matrix for four types of navigations:
@@ -597,8 +596,8 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     if (!result || (!result.isBoolean() && !result.isString() && !result.isNumber()))
         return @"";
 
-    JSLock lock(SilenceAssertionsOnly);
     JSC::ExecState* exec = _private->coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec();
+    JSC::JSLockHolder lock(exec);
     return ustringToString(result.toString(exec)->value(exec));
 }
 
@@ -1123,8 +1122,8 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     if (!result || (!result.isBoolean() && !result.isString() && !result.isNumber()))
         return @"";
 
-    JSLock lock(SilenceAssertionsOnly);
     JSC::ExecState* exec = anyWorldGlobalObject->globalExec();
+    JSC::JSLockHolder lock(exec);
     return ustringToString(result.toString(exec)->value(exec));
 }
 
diff --git a/Source/WebKit/mac/WebView/WebHTMLView.mm b/Source/WebKit/mac/WebView/WebHTMLView.mm
index c431f9b02..04a5a9973 100644
--- a/Source/WebKit/mac/WebView/WebHTMLView.mm
+++ b/Source/WebKit/mac/WebView/WebHTMLView.mm
@@ -6140,7 +6140,7 @@ static void extractUnderlines(NSAttributedString *string, Vector<CompositionUnde
 - (NSAttributedString *)_attributeStringFromDOMRange:(DOMRange *)range
 {
     NSAttributedString *attributedString;
-#if !LOG_DISABLED        
+#if !LOG_DISABLED
     double start = CFAbsoluteTimeGetCurrent();
 #endif    
     attributedString = [[[NSAttributedString alloc] _initWithDOMRange:range] autorelease];
diff --git a/Source/WebKit/mac/WebView/WebPreferences.mm b/Source/WebKit/mac/WebView/WebPreferences.mm
index 6796237a5..9c28230ba 100644
--- a/Source/WebKit/mac/WebView/WebPreferences.mm
+++ b/Source/WebKit/mac/WebView/WebPreferences.mm
@@ -386,7 +386,6 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:YES],  WebKitHyperlinkAuditingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitUsePreHTML5ParserQuirksKey,
         [NSNumber numberWithBool:YES],  WebKitAVFoundationEnabledKey,
-        [NSNumber numberWithBool:NO],  WebKitHixie76WebSocketProtocolEnabledKey,
         [NSNumber numberWithBool:NO],   WebKitMediaPlaybackRequiresUserGesturePreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitMediaPlaybackAllowsInlinePreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitWebAudioEnabledPreferenceKey,
@@ -1561,12 +1560,11 @@ static NSString *classIBCreatorID = nil;
 
 - (void)setHixie76WebSocketProtocolEnabled:(BOOL)flag
 {
-    [self _setBoolValue:flag forKey:WebKitHixie76WebSocketProtocolEnabledKey];
 }
 
 - (BOOL)isHixie76WebSocketProtocolEnabled
 {
-    return [self _boolValueForKey:WebKitHixie76WebSocketProtocolEnabledKey];
+    return false;
 }
 
 - (BOOL)mediaPlaybackRequiresUserGesture
diff --git a/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm b/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm
index 25a596ca3..50b84be24 100644
--- a/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm
+++ b/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm
@@ -174,9 +174,9 @@ NSString * const WebScriptErrorLineNumberKey = @"WebScriptErrorLineNumber";
     if (!_private->debuggerCallFrame)
         return [NSArray array];
 
-    JSLock lock(SilenceAssertionsOnly);
 
     ScopeChainNode* scopeChain = _private->debuggerCallFrame->scopeChain();
+    JSLockHolder lock(scopeChain->globalData);
     if (!scopeChain->next)  // global frame
         return [NSArray arrayWithObject:_private->globalObject];
 
@@ -229,13 +229,13 @@ NSString * const WebScriptErrorLineNumberKey = @"WebScriptErrorLineNumber";
     if (!_private->debuggerCallFrame)
         return nil;
 
-    JSLock lock(SilenceAssertionsOnly);
-
     // If this is the global call frame and there is no dynamic global object,
     // Dashcode is attempting to execute JS in the evaluator using a stale
     // WebScriptCallFrame. Instead, we need to set the dynamic global object
     // and evaluate the JS in the global object's global call frame.
     JSGlobalObject* globalObject = _private->debugger->globalObject();
+    JSLockHolder lock(globalObject->globalData());
+
     if (self == _private->debugger->globalCallFrame() && !globalObject->globalData().dynamicGlobalObject) {
         JSGlobalObject* globalObject = _private->debugger->globalObject();
 
diff --git a/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h b/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h
index 991323173..bb534a241 100644
--- a/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h
+++ b/Source/WebKit/mac/WebView/WebUIDelegatePrivate.h
@@ -89,6 +89,17 @@ enum {
     WebMenuItemTagMakeLowerCase,
     WebMenuItemTagCapitalize,
     WebMenuItemTagChangeBack,
+    WebMenuItemTagOpenMediaInNewWindow,
+    WebMenuItemTagCopyMediaLinkToClipboard,
+    WebMenuItemTagToggleMediaControls,
+    WebMenuItemTagToggleMediaLoop,
+    WebMenuItemTagEnterVideoFullscreen,
+    WebMenuItemTagMediaPlayPause,
+    WebMenuItemTagMediaMute,
+    WebMenuItemTagDictationAlternative,
+    WebMenuItemBaseCustomTag = 5000,
+    WebMenuItemCustomTagNoAction = 5998,
+    WebMenuItemLastCustomTag = 5999,
     WebMenuItemTagBaseApplication = 10000
 };
 
diff --git a/Source/WebKit/mac/WebView/WebView.mm b/Source/WebKit/mac/WebView/WebView.mm
index f7a681bc7..c35b873f4 100644
--- a/Source/WebKit/mac/WebView/WebView.mm
+++ b/Source/WebKit/mac/WebView/WebView.mm
@@ -581,8 +581,8 @@ static NSString *createUserVisibleWebKitVersionString()
     if (!exception || !context)
         return;
 
-    JSLock lock(SilenceAssertionsOnly);
     JSC::ExecState* execState = toJS(context);
+    JSLockHolder lock(execState);
 
     // Make sure the context has a DOMWindow global object, otherwise this context didn't originate from a WebView.
     if (!toJSDOMWindow(execState->lexicalGlobalObject()))
@@ -723,8 +723,10 @@ static bool shouldRespectPriorityInCSSAttributeSetters()
 
     static bool didOneTimeInitialization = false;
     if (!didOneTimeInitialization) {
+#if !LOG_DISABLED
         WebKitInitializeLoggingChannelsIfNecessary();
         WebCore::initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
         [WebHistoryItem initWindowWatcherIfNecessary];
 #if ENABLE(SQL_DATABASE)
         WebKitInitializeDatabasesIfNecessary();
@@ -1523,9 +1525,6 @@ static bool needsSelfRetainWhileLoadingQuirk()
     settings->setAVFoundationEnabled(false);
 #endif
 #endif
-#if ENABLE(WEB_SOCKETS)
-    settings->setUseHixie76WebSocketProtocol([preferences isHixie76WebSocketProtocolEnabled]);
-#endif
     settings->setMediaPlaybackRequiresUserGesture([preferences mediaPlaybackRequiresUserGesture]);
     settings->setMediaPlaybackAllowsInline([preferences mediaPlaybackAllowsInline]);
     settings->setSuppressesIncrementalRendering([preferences suppressesIncrementalRendering]);
@@ -4851,7 +4850,7 @@ static NSAppleEventDescriptor* aeDescFromJSValue(ExecState* exec, JSValue jsValu
     JSValue result = coreFrame->script()->executeScript(script, true).jsValue();
     if (!result) // FIXME: pass errors
         return 0;
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec());
     return aeDescFromJSValue(coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec(), result);
 }
 
@@ -6560,8 +6559,8 @@ static void glibContextIterationCallback(CFRunLoopObserverRef, CFRunLoopActivity
 
 - (JSValueRef)_computedStyleIncludingVisitedInfo:(JSContextRef)context forElement:(JSValueRef)value
 {
-    JSLock lock(SilenceAssertionsOnly);
     ExecState* exec = toJS(context);
+    JSLockHolder lock(exec);
     if (!value)
         return JSValueMakeUndefined(context);
     JSValue jsValue = toJS(exec, value);
diff --git a/Source/WebKit/qt/Api/qgraphicswebview.cpp b/Source/WebKit/qt/Api/qgraphicswebview.cpp
index 5fdc91b71..343c2a166 100644
--- a/Source/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/Source/WebKit/qt/Api/qgraphicswebview.cpp
@@ -296,11 +296,7 @@ void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem*
         return;
     }
 #endif
-#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
-    page()->mainFrame()->render(painter, d->overlay() ? QWebFrame::ContentsLayer : QWebFrame::AllLayers, option->exposedRect.toAlignedRect());
-#else
     page()->mainFrame()->render(painter, QWebFrame::AllLayers, option->exposedRect.toRect());
-#endif
     painter->setRenderHints(oldHints);
 }
 
diff --git a/Source/WebKit/qt/Api/qwebframe.cpp b/Source/WebKit/qt/Api/qwebframe.cpp
index b72d4e47a..21b3a0b70 100644
--- a/Source/WebKit/qt/Api/qwebframe.cpp
+++ b/Source/WebKit/qt/Api/qwebframe.cpp
@@ -322,14 +322,14 @@ void QWebFramePrivate::renderFromTiledBackingStore(GraphicsContext* context, con
         painter->restore();
     }
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
     renderCompositedLayers(context, IntRect(clip.boundingRect()));
     renderFrameExtras(context, QFlags<QWebFrame::RenderLayer>(QWebFrame::ScrollBarLayer) | QWebFrame::PanIconLayer, clip);
 #endif
 }
 #endif
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 void QWebFramePrivate::renderCompositedLayers(GraphicsContext* context, const IntRect& clip)
 {
     if (!rootTextureMapperLayer || !textureMapper)
@@ -395,7 +395,7 @@ void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QFlags<QWe
 
             context->restore();
         }
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
         renderCompositedLayers(context, IntRect(clip.boundingRect()));
 #endif
     }
@@ -506,13 +506,12 @@ static JSValueRef qtSenderCallback(JSContextRef context, JSObjectRef, JSObjectRe
 
 void QWebFramePrivate::addQtSenderToGlobalObject()
 {
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-
     JSDOMWindow* window = toJSDOMWindow(frame, mainThreadNormalWorld());
     Q_ASSERT(window);
 
     JSC::ExecState* exec = window->globalExec();
     Q_ASSERT(exec);
+    JSC::JSLockHolder lock(exec);
 
     JSContextRef context = ::toRef(exec);
     JSRetainPtr<JSStringRef> propertyName(Adopt, JSStringCreateWithUTF8CString("__qt_sender__"));
@@ -657,7 +656,6 @@ void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object
         return;
 #if USE(JSC)
     JSC::Bindings::QtInstance::ValueOwnership valueOwnership = static_cast<JSC::Bindings::QtInstance::ValueOwnership>(ownership);
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
     JSDOMWindow* window = toJSDOMWindow(d->frame, mainThreadNormalWorld());
     JSC::Bindings::RootObject* root;
     if (valueOwnership == JSC::Bindings::QtInstance::QtOwnership)
@@ -675,6 +673,7 @@ void QWebFrame::addToJavaScriptWindowObject(const QString &name, QObject *object
     }
 
     JSC::ExecState* exec = window->globalExec();
+    JSC::JSLockHolder lock(exec);
 
     JSC::JSObject* runtimeObject =
             JSC::Bindings::QtInstance::getQtInstance(object, root, valueOwnership)->createRuntimeObject(exec);
diff --git a/Source/WebKit/qt/Api/qwebframe_p.h b/Source/WebKit/qt/Api/qwebframe_p.h
index 4cff08d8a..2762c2be7 100644
--- a/Source/WebKit/qt/Api/qwebframe_p.h
+++ b/Source/WebKit/qt/Api/qwebframe_p.h
@@ -39,7 +39,7 @@ using QTM_NAMESPACE::QOrientationSensor;
 #include "Frame.h"
 #include "ViewportArguments.h"
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 #include "texmap/TextureMapper.h"
 #endif
 
@@ -84,7 +84,7 @@ public:
         , allowsScrolling(true)
         , marginWidth(-1)
         , marginHeight(-1)
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
         , rootTextureMapperLayer(0)
 #endif
         {}
@@ -104,7 +104,7 @@ public:
     void renderFromTiledBackingStore(WebCore::GraphicsContext*, const QRegion& clip);
 #endif
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
     void renderCompositedLayers(WebCore::GraphicsContext*, const WebCore::IntRect& clip);
 #endif
     void renderFrameExtras(WebCore::GraphicsContext*, QFlags<QWebFrame::RenderLayer>, const QRegion& clip);
@@ -124,7 +124,7 @@ public:
     bool allowsScrolling;
     int marginWidth;
     int marginHeight;
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
     WebCore::TextureMapperLayer* rootTextureMapperLayer;
     OwnPtr<WebCore::TextureMapper> textureMapper;
 #endif
diff --git a/Source/WebKit/qt/Api/qwebpage.cpp b/Source/WebKit/qt/Api/qwebpage.cpp
index b1f2eccdd..e72c0862e 100644
--- a/Source/WebKit/qt/Api/qwebpage.cpp
+++ b/Source/WebKit/qt/Api/qwebpage.cpp
@@ -358,10 +358,6 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
 
     settings = new QWebSettings(page->settings());
 
-#if ENABLE(WEB_SOCKETS)
-    page->settings()->setUseHixie76WebSocketProtocol(false);
-#endif
-
     history.d = new QWebHistoryPrivate(static_cast<WebCore::BackForwardListImpl*>(page->backForwardList()));
     memset(actions, 0, sizeof(actions));
 
@@ -2559,7 +2555,7 @@ QWebPage::ViewportAttributes QWebPage::viewportAttributesForSize(const QSize& av
         deviceHeight = size.height();
     }
 
-    WebCore::ViewportAttributes conf = WebCore::computeViewportAttributes(d->viewportArguments(), desktopWidth, deviceWidth, deviceHeight, qt_defaultDpi(), availableSize);
+    WebCore::ViewportAttributes conf = WebCore::computeViewportAttributes(d->viewportArguments(), desktopWidth, deviceWidth, deviceHeight, qt_defaultDpi() / WebCore::ViewportArguments::deprecatedTargetDPI, availableSize);
     WebCore::restrictMinimumScaleFactorToViewportSize(conf, availableSize);
     WebCore::restrictScaleFactorToInitialScaleIfNotUserScalable(conf);
 
diff --git a/Source/WebKit/qt/Api/qwebscriptworld.h b/Source/WebKit/qt/Api/qwebscriptworld.h
index 6a9d6e08a..3d083c63b 100644
--- a/Source/WebKit/qt/Api/qwebscriptworld.h
+++ b/Source/WebKit/qt/Api/qwebscriptworld.h
@@ -20,6 +20,10 @@
 #ifndef QWebScriptWorld_h_
 #define QWebScriptWorld_h_
 
+#if 0
+#pragma qt_no_master_include
+#endif
+
 #include <QtCore/qurl.h>
 #include <QtCore/qshareddata.h>
 
diff --git a/Source/WebKit/qt/Api/qwebsettings.cpp b/Source/WebKit/qt/Api/qwebsettings.cpp
index a540dc35f..5358dd204 100644
--- a/Source/WebKit/qt/Api/qwebsettings.cpp
+++ b/Source/WebKit/qt/Api/qwebsettings.cpp
@@ -156,11 +156,9 @@ void QWebSettingsPrivate::apply()
         settings->setAcceleratedCompositingEnabled(value);
         settings->setAcceleratedCompositingFor3DTransformsEnabled(value);
         settings->setAcceleratedCompositingForAnimationEnabled(value);
-#if USE(TEXTURE_MAPPER)
         settings->setAcceleratedCompositingForVideoEnabled(false);
         settings->setAcceleratedCompositingForPluginsEnabled(false);
 #endif
-#endif
 #if ENABLE(WEBGL)
         value = attributes.value(QWebSettings::WebGLEnabled,
                                  global->attributes.value(QWebSettings::WebGLEnabled));
diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
index 8789ec929..c6941fa54 100644
--- a/Source/WebKit/qt/ChangeLog
+++ b/Source/WebKit/qt/ChangeLog
@@ -1,3 +1,234 @@
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2012-07-09  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Shared code that is guarded with ENABLE(WEBGL) should be guarded with USE()
+        https://bugs.webkit.org/show_bug.cgi?id=90506
+
+        Reviewed by Martin Robinson.
+
+        Updated necessary parts of PageClientQt to be guarded with USE(3D_GRAPHICS) instead of
+        ENABLE(WEBGL). The WebKit1 glue to WebGL still requires the Qt OpenGL module, so it's
+        disable if QT_OPENGL_LIB is not defined.
+
+        * WebCoreSupport/PageClientQt.cpp:
+        (createPlatformGraphicsContext3DFromWidget):
+        (WebCore):
+        * WebCoreSupport/PageClientQt.h:
+        (PageClientQWidget):
+        (PageClientQGraphicsWidget):
+
+2012-07-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Buildfix for newer Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=90519
+
+        Reviewed by Tor Arne Vestbø.
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp: Include QtGui/QStandardItemModel instead of deprecated QStandardItemModel.
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Adjust to changed generation of master include file
+
+        The responsiblity for creating the master include was moved out of syncqt.
+        @ignore_for_master_contents still stays, as syncqt (ab-)uses this for
+        determining whether a header is private.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Api/qwebscriptworld.h:
+        * tests/util.h:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Get rid of un-needed QT += declarative for Qt 5
+
+        The declarative module has been renamed to quick1 in Qt 5, and the
+        engine-only module for Qt 5 is named 'qml'. For many of the instances
+        we could just remove 'declarative', since the project file was only
+        used for Qt5/WebKit2 builds. In the other cases the module was wrapped
+        in a haveQt(4) scope.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * declarative/experimental/experimental.pri:
+        * declarative/public.pri:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * declarative/declarative.pro:
+        * declarative/public.pri:
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121766.
+        http://trac.webkit.org/changeset/121766
+        https://bugs.webkit.org/show_bug.cgi?id=90465
+
+        It caused flakey build errors on the bots (Requested by Ossy
+        on #webkit).
+
+        * declarative/declarative.pro:
+        * declarative/public.pri:
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * declarative/declarative.pro:
+        * declarative/public.pri:
+        * tests/qgraphicswebview/qgraphicswebview.pro:
+
+2012-07-02  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Get rid of GraphicsLayerQt
+        https://bugs.webkit.org/show_bug.cgi?id=78598
+
+        Reviewed by Luiz Agostini.
+
+        Removed all references to GraphicsLayerQt, including #ifdef code paths that only apply
+        when TEXTURE_MAPPER is disabled.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::paint):
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderFromTiledBackingStore):
+        (QWebFramePrivate::renderRelativeCoords):
+        * Api/qwebframe_p.h:
+        (QWebFramePrivate::QWebFramePrivate):
+        (QWebFramePrivate):
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore):
+        (WebCore::PageClientQGraphicsWidget::~PageClientQGraphicsWidget):
+        (WebCore::PageClientQGraphicsWidget::update):
+        (WebCore::PageClientQGraphicsWidget::syncLayers):
+        (WebCore::PageClientQGraphicsWidget::setRootGraphicsLayer):
+        * WebCoreSupport/PageClientQt.h:
+        (WebCore):
+        (WebCore::PageClientQWidget::PageClientQWidget):
+        (PageClientQWidget):
+        (PageClientQGraphicsWidget):
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * WebCoreSupport/InitWebCoreQt.cpp:
+        (WebCore::initializeWebCoreQt):
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        Updated the call to computeViewportAttributes.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::viewportAttributesForSize):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::viewportAsText):
+
+2012-06-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        [Qt] inspector/styles/inject-stylesheet.html makes 4 tests flakey (TEXT PASS)
+        https://bugs.webkit.org/show_bug.cgi?id=90167
+
+        Reviewed by Csaba Osztrogonác.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::removeUserStyleSheets):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2012-06-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Restore original value of mock scrollbars between tests
+        https://bugs.webkit.org/show_bug.cgi?id=90155
+
+        Reviewed by Simon Hausmann.
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setMockScrollbarsEnabled):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::addQtSenderToGlobalObject):
+        (QWebFrame::addToJavaScriptWindowObject):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::injectInternalsObject):
+        (DumpRenderTreeSupportQt::resetInternalsObject):
+
 2012-06-27  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Fix compilation of example platform plugin with Qt 5
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 3814d3569..1492c395e 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -248,6 +248,11 @@ void DumpRenderTreeSupportQt::setFrameFlatteningEnabled(QWebPage* page, bool ena
     QWebPagePrivate::core(page)->settings()->setFrameFlatteningEnabled(enabled);
 }
 
+void DumpRenderTreeSupportQt::setMockScrollbarsEnabled(QWebPage* page, bool enabled)
+{
+    QWebPagePrivate::core(page)->settings()->setMockScrollbarsEnabled(enabled);
+}
+
 void DumpRenderTreeSupportQt::webPageSetGroupName(QWebPage* page, const QString& groupName)
 {
     page->handle()->page->setGroupName(groupName);
@@ -737,10 +742,10 @@ QString DumpRenderTreeSupportQt::viewportAsText(QWebPage* page, int deviceDPI, c
     WebCore::ViewportArguments args = page->d->viewportArguments();
 
     WebCore::ViewportAttributes conf = WebCore::computeViewportAttributes(args,
-        /* desktop-width */ 980,
-        /* device-width  */ deviceSize.width(),
-        /* device-height */ deviceSize.height(),
-        /* device-dpi    */ deviceDPI,
+        /* desktop-width    */ 980,
+        /* device-width     */ deviceSize.width(),
+        /* device-height    */ deviceSize.height(),
+        /* devicePixelRatio */ deviceDPI / WebCore::ViewportArguments::deprecatedTargetDPI,
         availableSize);
     WebCore::restrictMinimumScaleFactorToViewportSize(conf, availableSize);
     WebCore::restrictScaleFactorToInitialScaleIfNotUserScalable(conf);
@@ -917,6 +922,11 @@ void DumpRenderTreeSupportQt::addUserStyleSheet(QWebPage* page, const QString& s
     page->handle()->page->group().addUserStyleSheetToWorld(mainThreadNormalWorld(), sourceCode, QUrl(), nullptr, nullptr, WebCore::InjectInAllFrames);
 }
 
+void DumpRenderTreeSupportQt::removeUserStyleSheets(QWebPage* page)
+{
+    page->handle()->page->group().removeUserStyleSheetsFromWorld(mainThreadNormalWorld());
+}
+
 void DumpRenderTreeSupportQt::simulateDesktopNotificationClick(const QString& title)
 {
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
@@ -1086,13 +1096,12 @@ void DumpRenderTreeSupportQt::injectInternalsObject(QWebFrame* frame)
 {
     WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
 #if USE(JSC)
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-
     JSDOMWindow* window = toJSDOMWindow(coreFrame, mainThreadNormalWorld());
     Q_ASSERT(window);
 
     JSC::ExecState* exec = window->globalExec();
     Q_ASSERT(exec);
+    JSC::JSLockHolder lock(exec);
 
     JSContextRef context = toRef(exec);
     WebCoreTestSupport::injectInternalsObject(context);
@@ -1113,13 +1122,12 @@ void DumpRenderTreeSupportQt::resetInternalsObject(QWebFrame* frame)
 {
     WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
 #if USE(JSC)
-    JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-
     JSDOMWindow* window = toJSDOMWindow(coreFrame, mainThreadNormalWorld());
     Q_ASSERT(window);
 
     JSC::ExecState* exec = window->globalExec();
     Q_ASSERT(exec);
+    JSC::JSLockHolder lock(exec);
 
     JSContextRef context = toRef(exec);
     WebCoreTestSupport::resetInternalsObject(context);
@@ -1129,22 +1137,6 @@ void DumpRenderTreeSupportQt::resetInternalsObject(QWebFrame* frame)
 #endif
 }
 
-bool DumpRenderTreeSupportQt::defaultHixie76WebSocketProtocolEnabled()
-{
-    return true;
-}
-
-void DumpRenderTreeSupportQt::setHixie76WebSocketProtocolEnabled(QWebPage* page, bool enabled)
-{
-#if ENABLE(WEB_SOCKETS)
-    if (Page* corePage = QWebPagePrivate::core(page))
-        corePage->settings()->setUseHixie76WebSocketProtocol(enabled);
-#else
-    UNUSED_PARAM(page);
-    UNUSED_PARAM(enabled);
-#endif
-}
-
 QImage DumpRenderTreeSupportQt::paintPagesWithBoundaries(QWebFrame* qframe)
 {
     Frame* frame = QWebFramePrivate::core(qframe);
diff --git a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 17629001a..21564e222 100644
--- a/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -117,6 +117,7 @@ public:
 
     static void setDomainRelaxationForbiddenForURLScheme(bool forbidden, const QString& scheme);
     static void setFrameFlatteningEnabled(QWebPage*, bool);
+    static void setMockScrollbarsEnabled(QWebPage*, bool);
     static void setCaretBrowsingEnabled(QWebPage* page, bool value);
     static void setAuthorAndUserStylesEnabled(QWebPage*, bool);
     static void setMediaType(QWebFrame* qframe, const QString& type);
@@ -195,6 +196,7 @@ public:
     static QString pageSizeAndMarginsInPixels(QWebFrame* frame, int pageIndex, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft);
     static QString pageProperty(QWebFrame* frame, const QString& propertyName, int pageNumber);
     static void addUserStyleSheet(QWebPage* page, const QString& sourceCode);
+    static void removeUserStyleSheets(QWebPage*);
     static void simulateDesktopNotificationClick(const QString& title);
     static QString viewportAsText(QWebPage*, int deviceDPI, const QSize& deviceSize, const QSize& availableSize);
 
@@ -226,9 +228,6 @@ public:
     static bool thirdPartyCookiePolicyAllows(QWebPage*, const QUrl&, const QUrl& firstPartyUrl);
 #endif
 
-    static bool defaultHixie76WebSocketProtocolEnabled();
-    static void setHixie76WebSocketProtocolEnabled(QWebPage*, bool);
-
     static QImage paintPagesWithBoundaries(QWebFrame*);
 };
 
diff --git a/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp b/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
index 452091c28..5ac449d5d 100644
--- a/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/InitWebCoreQt.cpp
@@ -66,7 +66,9 @@ void initializeWebCoreQt()
     if (initialized)
         return;
 
+#if !LOG_DISABLED
     WebCore::initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
     ScriptController::initializeThreading();
     WTF::initializeMainThread();
     WebCore::SecurityPolicy::setLocalLoadPolicy(WebCore::SecurityPolicy::AllowLocalLoadsForLocalAndSubstituteData);
diff --git a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
index 93be5a5e2..990179906 100644
--- a/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/PageClientQt.cpp
@@ -23,13 +23,16 @@
 
 #include <QGraphicsScene>
 #include <QGraphicsView>
+
 #if defined(Q_WS_X11)
 #include <QX11Info>
 #endif
 
-#if ENABLE(WEBGL)
+#ifdef QT_OPENGL_LIB
 #include <QGLWidget>
+#endif
 
+#if USE(3D_GRAPHICS)
 #if HAVE(QT5)
 #include <QWindow>
 #endif
@@ -37,6 +40,7 @@
 static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformGraphicsContext3D* context,
                                                       PlatformGraphicsSurface3D* surface)
 {
+#ifdef QT_OPENGL_LIB
     *context = 0;
     *surface = 0;
     QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(widget);
@@ -61,10 +65,11 @@ static void createPlatformGraphicsContext3DFromWidget(QWidget* widget, PlatformG
         delete glWidget;
         glWidget = 0;
     }
+#endif
 }
 #endif
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 #include "TextureMapper.h"
 #include "texmap/TextureMapperLayer.h"
 #endif
@@ -85,7 +90,7 @@ QWindow* QWebPageClient::ownerWindow() const
 
 namespace WebCore {
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 TextureMapperLayerClientQt::TextureMapperLayerClientQt(QWebFrame* frame, GraphicsLayer* layer)
     : m_frame(frame)
     , m_rootGraphicsLayer(GraphicsLayer::create(0))
@@ -237,7 +242,7 @@ void PageClientQWidget::setWidgetVisible(Widget* widget, bool visible)
     qtWidget->setVisible(visible);
 }
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 void PageClientQWidget::createPlatformGraphicsContext3D(PlatformGraphicsContext3D* context,
                                                         PlatformGraphicsSurface3D* surface)
 {
@@ -249,13 +254,6 @@ void PageClientQWidget::createPlatformGraphicsContext3D(PlatformGraphicsContext3
 PageClientQGraphicsWidget::~PageClientQGraphicsWidget()
 {
     delete overlay;
-#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
-    if (!rootGraphicsLayer)
-        return;
-    // we don't need to delete the root graphics layer. The lifecycle is managed in GraphicsLayerQt.cpp.
-    rootGraphicsLayer.data()->setParentItem(0);
-    view->scene()->removeItem(rootGraphicsLayer.data());
-#endif
 }
 
 void PageClientQGraphicsWidget::scroll(int dx, int dy, const QRect& rectToScroll)
@@ -267,62 +265,26 @@ void PageClientQGraphicsWidget::update(const QRect& dirtyRect)
 {
     view->update(dirtyRect);
 
-    createOrDeleteOverlay();
     if (overlay)
         overlay->update(QRectF(dirtyRect));
-#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
-    syncLayers();
-#endif
-}
-
-void PageClientQGraphicsWidget::createOrDeleteOverlay()
-{
-    // We don't use an overlay with TextureMapper. Instead, the overlay is drawn inside QWebFrame.
-#if !USE(TEXTURE_MAPPER)
-    bool useOverlay = false;
-    if (!viewResizesToContents) {
-#if USE(ACCELERATED_COMPOSITING)
-        useOverlay = useOverlay || rootGraphicsLayer;
-#endif
-#if USE(TILED_BACKING_STORE)
-        useOverlay = useOverlay || QWebFramePrivate::core(page->mainFrame())->tiledBackingStore();
-#endif
-    }
-    if (useOverlay == !!overlay)
-        return;
-
-    if (useOverlay) {
-        overlay = new QGraphicsItemOverlay(view, page);
-        overlay->setZValue(OverlayZValue);
-    } else {
-        // Changing the overlay might be done inside paint events.
-        overlay->deleteLater();
-        overlay = 0;
-    }
-#endif // !USE(TEXTURE_MAPPER)
 }
 
 #if USE(ACCELERATED_COMPOSITING)
 void PageClientQGraphicsWidget::syncLayers()
 {
-#if USE(TEXTURE_MAPPER)
     if (TextureMapperLayerClient)
         TextureMapperLayerClient->syncRootLayer();
-#endif
 
     QWebFramePrivate::core(page->mainFrame())->view()->syncCompositingStateIncludingSubframes();
 
-#if USE(TEXTURE_MAPPER)
     if (!TextureMapperLayerClient)
         return;
 
     if (TextureMapperLayerClient->rootLayer()->descendantsOrSelfHaveRunningAnimations() && !syncTimer.isActive())
         syncTimer.startOneShot(1.0 / 60.0);
     update(view->boundingRect().toAlignedRect());
-#endif
 }
 
-#if USE(TEXTURE_MAPPER)
 void PageClientQGraphicsWidget::setRootGraphicsLayer(GraphicsLayer* layer)
 {
     if (layer) {
@@ -339,24 +301,6 @@ void PageClientQGraphicsWidget::setRootGraphicsLayer(GraphicsLayer* layer)
     }
     TextureMapperLayerClient.clear();
 }
-#else
-void PageClientQGraphicsWidget::setRootGraphicsLayer(GraphicsLayer* layer)
-{
-    if (rootGraphicsLayer) {
-        rootGraphicsLayer.data()->setParentItem(0);
-        view->scene()->removeItem(rootGraphicsLayer.data());
-        QWebFramePrivate::core(page->mainFrame())->view()->syncCompositingStateIncludingSubframes();
-    }
-
-    rootGraphicsLayer = layer ? layer->platformLayer() : 0;
-
-    if (rootGraphicsLayer) {
-        rootGraphicsLayer.data()->setParentItem(view);
-        rootGraphicsLayer.data()->setZValue(RootGraphicsLayerZValue);
-    }
-    createOrDeleteOverlay();
-}
-#endif
 
 void PageClientQGraphicsWidget::markForSync(bool scheduleSync)
 {
@@ -487,7 +431,7 @@ QRectF PageClientQGraphicsWidget::windowRect() const
 }
 #endif // QT_NO_GRAPHICSVIEW
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
 void PageClientQGraphicsWidget::createPlatformGraphicsContext3D(PlatformGraphicsContext3D* context,
                                                                 PlatformGraphicsSurface3D* surface)
 {
diff --git a/Source/WebKit/qt/WebCoreSupport/PageClientQt.h b/Source/WebKit/qt/WebCoreSupport/PageClientQt.h
index d8ae0243e..febca03f5 100644
--- a/Source/WebKit/qt/WebCoreSupport/PageClientQt.h
+++ b/Source/WebKit/qt/WebCoreSupport/PageClientQt.h
@@ -43,7 +43,7 @@
 
 namespace WebCore {
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
 class TextureMapperLayerClientQt {
 public:
     TextureMapperLayerClientQt(QWebFrame*, GraphicsLayer*);
@@ -63,7 +63,7 @@ public:
     PageClientQWidget(QWidget* newView, QWebPage* newPage)
         : view(newView)
         , page(newPage)
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
         , syncTimer(this, &PageClientQWidget::syncLayers)
 #endif
     {
@@ -99,7 +99,7 @@ public:
 
     virtual void setWidgetVisible(Widget*, bool visible);
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
     virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
                                                  PlatformGraphicsSurface3D*);
 #endif
@@ -107,19 +107,19 @@ public:
     QWidget* view;
     QWebPage* page;
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
     virtual void setRootGraphicsLayer(GraphicsLayer*);
     virtual void markForSync(bool scheduleSync);
     void syncLayers(Timer<PageClientQWidget>*);
 #endif
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
     virtual bool allowsAcceleratedCompositing() const { return true; }
 #else
     virtual bool allowsAcceleratedCompositing() const { return false; }
 #endif
 
-#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#if USE(ACCELERATED_COMPOSITING)
     Timer<PageClientQWidget> syncTimer;
     OwnPtr<TextureMapperLayerClientQt> TextureMapperLayerClient;
 #endif
@@ -207,13 +207,11 @@ public:
 
     virtual void setWidgetVisible(Widget*, bool);
 
-#if ENABLE(WEBGL)
+#if USE(3D_GRAPHICS)
     virtual void createPlatformGraphicsContext3D(PlatformGraphicsContext3D*,
                                                  PlatformGraphicsSurface3D*);
 #endif
 
-    void createOrDeleteOverlay();
-
 #if USE(TILED_BACKING_STORE)
     void updateTiledBackingStoreScale();
     virtual QRectF graphicsItemVisibleRect() const;
@@ -236,11 +234,7 @@ public:
     bool viewResizesToContents;
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(TEXTURE_MAPPER)
     OwnPtr<TextureMapperLayerClientQt> TextureMapperLayerClient;
-#else
-    QPointer<QGraphicsObject> rootGraphicsLayer;
-#endif
     // we have to flush quite often, so we use a meta-method instead of QTimer::singleShot for putting the event in the queue
     Timer<PageClientQGraphicsWidget> syncTimer;
 #endif
diff --git a/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp b/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
index 2dd6cdb4e..cdc6ee0c9 100644
--- a/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
+++ b/Source/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
@@ -28,7 +28,7 @@
 #include "QWebPageClient.h"
 #include "qgraphicswebview.h"
 #include <QGraphicsProxyWidget>
-#include <QStandardItemModel>
+#include <QtGui/QStandardItemModel>
 
 namespace WebCore {
 
diff --git a/Source/WebKit/qt/declarative/declarative.pro b/Source/WebKit/qt/declarative/declarative.pro
index e7ed4496c..737928338 100644
--- a/Source/WebKit/qt/declarative/declarative.pro
+++ b/Source/WebKit/qt/declarative/declarative.pro
@@ -7,8 +7,6 @@
 TEMPLATE = subdirs
 CONFIG += ordered
 
-load(features)
-
 public_api.file = public.pri
 public_api.makefile = Makefile.declarative.public
 SUBDIRS += public_api
diff --git a/Source/WebKit/qt/declarative/experimental/experimental.pri b/Source/WebKit/qt/declarative/experimental/experimental.pri
index 20d54523c..2586bb784 100644
--- a/Source/WebKit/qt/declarative/experimental/experimental.pri
+++ b/Source/WebKit/qt/declarative/experimental/experimental.pri
@@ -24,7 +24,7 @@ contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
 wince*:LIBS += $$QMAKE_LIBS_GUI
 
-QT += declarative widgets network quick quick-private webkit webkit-private
+QT += widgets network quick quick-private webkit webkit-private
 
 DESTDIR = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}
 
diff --git a/Source/WebKit/qt/declarative/public.pri b/Source/WebKit/qt/declarative/public.pri
index 576ce03ca..34c66399f 100644
--- a/Source/WebKit/qt/declarative/public.pri
+++ b/Source/WebKit/qt/declarative/public.pri
@@ -11,8 +11,6 @@ TARGET.module_name = QtWebKit
 
 CONFIG += qt plugin
 
-load(features)
-
 QMLDIRFILE = $${_PRO_FILE_PWD_}/qmldir
 copy2build.input = QMLDIRFILE
 copy2build.output = $${ROOT_BUILD_DIR}/imports/$${TARGET.module_name}/qmldir
@@ -26,7 +24,8 @@ contains(QT_CONFIG, reduce_exports):CONFIG += hide_symbols
 
 wince*:LIBS += $$QMAKE_LIBS_GUI
 
-QT += declarative webkit webkit-private
+QT += webkit webkit-private
+haveQt(4): QT += declarative
 haveQt(5): QT += widgets quick quick-private
 
 contains(DEFINES, HAVE_QQUICK1=1) {
diff --git a/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro b/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
index 1e0ab0a80..3e9fb1528 100644
--- a/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
+++ b/Source/WebKit/qt/tests/qgraphicswebview/qgraphicswebview.pro
@@ -1,7 +1,6 @@
 include(../tests.pri)
 exists($${TARGET}.qrc):RESOURCES += $${TARGET}.qrc
 
-load(features)
 contains(DEFINES, ENABLE_WEBGL=1) {
     QT += opengl
 }
diff --git a/Source/WebKit/qt/tests/util.h b/Source/WebKit/qt/tests/util.h
index 2fb59e067..cfa22eb08 100644
--- a/Source/WebKit/qt/tests/util.h
+++ b/Source/WebKit/qt/tests/util.h
@@ -18,6 +18,10 @@
 */
 // Functions and macros that really need to be in QTestLib
 
+#if 0
+#pragma qt_no_master_include
+#endif
+
 #include <QEventLoop>
 #include <QSignalSpy>
 #include <QTimer>
diff --git a/Source/WebKit/win/ChangeLog b/Source/WebKit/win/ChangeLog
index 39d4d0796..ce2d8d010 100644
--- a/Source/WebKit/win/ChangeLog
+++ b/Source/WebKit/win/ChangeLog
@@ -1,3 +1,103 @@
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings):
+        (WebPreferences::setHixie76WebSocketProtocolEnabled):
+        (WebPreferences::hixie76WebSocketProtocolEnabled):
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged):
+
+2012-07-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Make HTMLCollection RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=90414
+
+        Reviewed by Sam Weinig.
+
+        * DOMHTMLClasses.cpp:
+        (DOMHTMLDocument::forms):
+        (DOMHTMLSelectElement::options):
+
+2012-07-03  Mihai Balan  <mibalan@adobe.com>
+
+        [CSS Regions] Enabling regions on Windows lead to crash-on-launch for WebKit.exe
+        https://bugs.webkit.org/show_bug.cgi?id=90435
+
+        Reviewed by Csaba Osztrogonác.
+
+        Initial patch for enabling regions led to WebKit crashing on launch. Moving the
+        IDL declarations for CSS regions getter/setter at the end of the file solves the
+        problem. As per http://trac.webkit.org/changeset/95650 seems it has to do with
+        binary compatibility.
+
+        * Interfaces/IWebPreferences.idl: Mover getter/setter for CSS regions at the end of file
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * WebView.cpp:
+        (WebView::initWithFrame):
+
+2012-06-29  Mihai Balan  <mibalan@adobe.com>
+
+        [CSS Regions] Adding feature defines for CSS Regions for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=88645
+
+        Reviewed by Tony Chang.
+
+        Re-trying to enable CSS regions on Windows. This time only enabling
+        regions since exclusions lead to some very strange compiling/linking
+        problems. This time adding preferences code to make sure the settings
+        get propagated to DRT (previous experiments by abucur showed they
+        didn't.).
+
+        * WebPreferenceKeysPrivate.h: Added preference key for CSS regions
+        * Interfaces/IWebPreferences.idl: Added getters and setters for CSS regions settings
+        * WebPreferences.cpp: ditto
+        (WebPreferences::initializeDefaultSettings):
+        (WebPreferences::isCSSRegionsEnabled):
+        (WebPreferences::setCSSRegionsEnabled):
+        * WebPreferences.h: ditto
+        (WebPreferences):
+        * WebView.cpp: Added settings code to handle CSS regions, too
+        (WebView::notifyPreferencesChanged):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * WebCoreStatistics.cpp:
+        (WebCoreStatistics::javaScriptObjectsCount):
+        (WebCoreStatistics::javaScriptGlobalObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedGlobalObjectsCount):
+        (WebCoreStatistics::javaScriptProtectedObjectTypeCounts):
+        * WebFrame.cpp:
+        (WebFrame::stringByEvaluatingJavaScriptInScriptWorld):
+        * WebJavaScriptCollector.cpp:
+        (WebJavaScriptCollector::objectCount):
+        * WebView.cpp:
+        (WebView::stringByEvaluatingJavaScriptFromString):
+        (WebView::reportException):
+        (WebView::elementFromJS):
+
 2012-06-23  Sheriff Bot  <webkit.review.bot@gmail.com>
 
         Unreviewed, rolling out r121058.
diff --git a/Source/WebKit/win/DOMHTMLClasses.cpp b/Source/WebKit/win/DOMHTMLClasses.cpp
index 5f156b7a5..d58fc6910 100644
--- a/Source/WebKit/win/DOMHTMLClasses.cpp
+++ b/Source/WebKit/win/DOMHTMLClasses.cpp
@@ -305,7 +305,8 @@ HRESULT STDMETHODCALLTYPE DOMHTMLDocument::forms(
         return E_FAIL;
 
     HTMLDocument* htmlDoc = static_cast<HTMLDocument*>(m_document);
-    *collection = DOMHTMLCollection::createInstance(htmlDoc->forms());
+    RefPtr<HTMLCollection> forms = htmlDoc->forms();
+    *collection = DOMHTMLCollection::createInstance(forms.get());
     return S_OK;
 }
     
@@ -709,7 +710,8 @@ HRESULT STDMETHODCALLTYPE DOMHTMLSelectElement::options(
     if (!selectElement->options())
         return E_FAIL;
 
-    *result = DOMHTMLOptionsCollection::createInstance(selectElement->options());
+    RefPtr<HTMLOptionsCollection> options = selectElement->options();
+    *result = DOMHTMLOptionsCollection::createInstance(options.get());
     return S_OK;
 }
     
diff --git a/Source/WebKit/win/Interfaces/IWebPreferences.idl b/Source/WebKit/win/Interfaces/IWebPreferences.idl
index a1511bb7e..a15eeae62 100644
--- a/Source/WebKit/win/Interfaces/IWebPreferences.idl
+++ b/Source/WebKit/win/Interfaces/IWebPreferences.idl
@@ -207,4 +207,7 @@ interface IWebPreferences : IUnknown
 
     HRESULT setShouldDisplayTextDescriptions(BOOL shouldDisplayTextDescriptions);
     HRESULT shouldDisplayTextDescriptions(BOOL *shouldDisplayTextDescriptions);
+
+    HRESULT isCSSRegionsEnabled([out, retval] BOOL* enabled);
+    HRESULT setCSSRegionsEnabled([in] BOOL enabled);
 }
diff --git a/Source/WebKit/win/WebCoreStatistics.cpp b/Source/WebKit/win/WebCoreStatistics.cpp
index 0e3057682..c1ca9f214 100644
--- a/Source/WebKit/win/WebCoreStatistics.cpp
+++ b/Source/WebKit/win/WebCoreStatistics.cpp
@@ -98,7 +98,7 @@ HRESULT STDMETHODCALLTYPE WebCoreStatistics::javaScriptObjectsCount(
     if (!count)
         return E_POINTER;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     *count = (UINT)JSDOMWindow::commonJSGlobalData()->heap.objectCount();
     return S_OK;
 }
@@ -109,7 +109,7 @@ HRESULT STDMETHODCALLTYPE WebCoreStatistics::javaScriptGlobalObjectsCount(
     if (!count)
         return E_POINTER;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     *count = (UINT)JSDOMWindow::commonJSGlobalData()->heap.globalObjectCount();
     return S_OK;
 }
@@ -120,7 +120,7 @@ HRESULT STDMETHODCALLTYPE WebCoreStatistics::javaScriptProtectedObjectsCount(
     if (!count)
         return E_POINTER;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     *count = (UINT)JSDOMWindow::commonJSGlobalData()->heap.protectedObjectCount();
     return S_OK;
 }
@@ -131,7 +131,7 @@ HRESULT STDMETHODCALLTYPE WebCoreStatistics::javaScriptProtectedGlobalObjectsCou
     if (!count)
         return E_POINTER;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     *count = (UINT)JSDOMWindow::commonJSGlobalData()->heap.protectedGlobalObjectCount();
     return S_OK;
 }
@@ -139,7 +139,7 @@ HRESULT STDMETHODCALLTYPE WebCoreStatistics::javaScriptProtectedGlobalObjectsCou
 HRESULT STDMETHODCALLTYPE WebCoreStatistics::javaScriptProtectedObjectTypeCounts( 
     /* [retval][out] */ IPropertyBag2** typeNamesAndCounts)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     OwnPtr<TypeCountSet> jsObjectTypeNames(JSDOMWindow::commonJSGlobalData()->heap.protectedObjectTypeCounts());
     typedef TypeCountSet::const_iterator Iterator;
     Iterator end = jsObjectTypeNames->end();
diff --git a/Source/WebKit/win/WebFrame.cpp b/Source/WebKit/win/WebFrame.cpp
index 27d24f2fb..9ce1c7811 100644
--- a/Source/WebKit/win/WebFrame.cpp
+++ b/Source/WebKit/win/WebFrame.cpp
@@ -126,7 +126,6 @@ using namespace std;
 using JSC::JSGlobalObject;
 using JSC::JSLock;
 using JSC::JSValue;
-using JSC::SilenceAssertionsOnly;
 
 #define FLASH_REDRAW 0
 
@@ -2528,8 +2527,8 @@ HRESULT WebFrame::stringByEvaluatingJavaScriptInScriptWorld(IWebScriptWorld* iWo
     if (!result || !result.isBoolean() && !result.isString() && !result.isNumber())
         return S_OK;
 
-    JSLock lock(SilenceAssertionsOnly);
     JSC::ExecState* exec = anyWorldGlobalObject->globalExec();
+    JSC::JSLockHolder lock(exec);
     String resultString = ustringToString(result.toString(exec)->value(exec));
     *evaluationResult = BString(resultString).release();
 
diff --git a/Source/WebKit/win/WebJavaScriptCollector.cpp b/Source/WebKit/win/WebJavaScriptCollector.cpp
index cb56b27e2..7b2f67fa6 100644
--- a/Source/WebKit/win/WebJavaScriptCollector.cpp
+++ b/Source/WebKit/win/WebJavaScriptCollector.cpp
@@ -111,7 +111,7 @@ HRESULT STDMETHODCALLTYPE WebJavaScriptCollector::objectCount(
         return E_POINTER;
     }
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     *count = (UINT)JSDOMWindow::commonJSGlobalData()->heap.objectCount();
     return S_OK;
 }
diff --git a/Source/WebKit/win/WebPreferenceKeysPrivate.h b/Source/WebKit/win/WebPreferenceKeysPrivate.h
index 95e9f9f5f..56efccc87 100644
--- a/Source/WebKit/win/WebPreferenceKeysPrivate.h
+++ b/Source/WebKit/win/WebPreferenceKeysPrivate.h
@@ -53,6 +53,7 @@
 #define WebKitAllowFileAccessFromFileURLsPreferenceKey "WebKitAllowFileAccessFromFileURLs"
 #define WebKitJavaScriptCanOpenWindowsAutomaticallyPreferenceKey "WebKitJavaScriptCanOpenWindowsAutomatically"
 #define WebKitPluginsEnabledPreferenceKey "WebKitPluginsEnabled"
+#define WebKitCSSRegionsEnabledPreferenceKey "WebKitCSSRegionsEnabled"
 #define WebKitDatabasesEnabledPreferenceKey "WebKitDatabasesEnabled"
 #define WebKitLocalStorageEnabledPreferenceKey "WebKitLocalStorageEnabled"
 #define WebKitExperimentalNotificationsEnabledPreferenceKey "WebKitExperimentalNotificationsEnabled"
diff --git a/Source/WebKit/win/WebPreferences.cpp b/Source/WebKit/win/WebPreferences.cpp
index 3946b5e72..e1784a761 100644
--- a/Source/WebKit/win/WebPreferences.cpp
+++ b/Source/WebKit/win/WebPreferences.cpp
@@ -212,6 +212,7 @@ void WebPreferences::initializeDefaultSettings()
     CFDictionaryAddValue(defaults, CFSTR(WebKitFrameFlatteningEnabledPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitJavaScriptCanOpenWindowsAutomaticallyPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitPluginsEnabledPreferenceKey), kCFBooleanTrue);
+    CFDictionaryAddValue(defaults, CFSTR(WebKitCSSRegionsEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitDatabasesEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitLocalStorageEnabledPreferenceKey), kCFBooleanTrue);
     CFDictionaryAddValue(defaults, CFSTR(WebKitExperimentalNotificationsEnabledPreferenceKey), kCFBooleanFalse);
@@ -268,7 +269,6 @@ void WebPreferences::initializeDefaultSettings()
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitMemoryInfoEnabledPreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitHyperlinkAuditingEnabledPreferenceKey), kCFBooleanTrue);
-    CFDictionaryAddValue(defaults, CFSTR(WebKitHixie76WebSocketProtocolEnabledPreferenceKey), kCFBooleanFalse);
 
     CFDictionaryAddValue(defaults, CFSTR(WebKitMediaPlaybackRequiresUserGesturePreferenceKey), kCFBooleanFalse);
     CFDictionaryAddValue(defaults, CFSTR(WebKitMediaPlaybackAllowsInlinePreferenceKey), kCFBooleanTrue);
@@ -908,6 +908,20 @@ HRESULT STDMETHODCALLTYPE WebPreferences::setPlugInsEnabled(
     return S_OK;
 }
 
+HRESULT STDMETHODCALLTYPE WebPreferences::isCSSRegionsEnabled(
+    /* [retval][out] */ BOOL* enabled)
+{
+    *enabled = boolValueForKey(CFSTR(WebKitCSSRegionsEnabledPreferenceKey));
+    return S_OK;
+}
+
+HRESULT STDMETHODCALLTYPE WebPreferences::setCSSRegionsEnabled(
+    /* [in] */ BOOL enabled)
+{
+    setBoolValue(CFSTR(WebKitCSSRegionsEnabledPreferenceKey), enabled);
+    return S_OK;
+}
+
 HRESULT STDMETHODCALLTYPE WebPreferences::allowsAnimatedImages( 
     /* [retval][out] */ BOOL* enabled)
 {
@@ -967,14 +981,13 @@ HRESULT STDMETHODCALLTYPE WebPreferences::loadsSiteIconsIgnoringImageLoadingPref
 HRESULT STDMETHODCALLTYPE WebPreferences::setHixie76WebSocketProtocolEnabled(
     /* [in] */ BOOL enabled)
 {
-    setBoolValue(CFSTR(WebKitHixie76WebSocketProtocolEnabledPreferenceKey), enabled);
     return S_OK;
 }
 
 HRESULT STDMETHODCALLTYPE WebPreferences::hixie76WebSocketProtocolEnabled(
     /* [retval][out] */ BOOL* enabled)
 {
-    *enabled = boolValueForKey(CFSTR(WebKitHixie76WebSocketProtocolEnabledPreferenceKey));
+    *enabled = false;
     return S_OK;
 }
 
diff --git a/Source/WebKit/win/WebPreferences.h b/Source/WebKit/win/WebPreferences.h
index bfc4d3159..884ef1184 100644
--- a/Source/WebKit/win/WebPreferences.h
+++ b/Source/WebKit/win/WebPreferences.h
@@ -162,6 +162,12 @@ public:
     
     virtual HRESULT STDMETHODCALLTYPE setPlugInsEnabled( 
         /* [in] */ BOOL enabled);
+
+    virtual HRESULT STDMETHODCALLTYPE isCSSRegionsEnabled(
+        /* [retval][out] */ BOOL* enabled);
+    
+    virtual HRESULT STDMETHODCALLTYPE setCSSRegionsEnabled(
+        /* [in] */ BOOL);
     
     virtual HRESULT STDMETHODCALLTYPE allowsAnimatedImages( 
         /* [retval][out] */ BOOL* enabled);
diff --git a/Source/WebKit/win/WebView.cpp b/Source/WebKit/win/WebView.cpp
index 880bc1bd0..c709ba9f1 100644
--- a/Source/WebKit/win/WebView.cpp
+++ b/Source/WebKit/win/WebView.cpp
@@ -2641,7 +2641,9 @@ HRESULT STDMETHODCALLTYPE WebView::initWithFrame(
 
     static bool didOneTimeInitialization;
     if (!didOneTimeInitialization) {
+#if !LOG_DISABLED
         initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
 #if ENABLE(SQL_DATABASE)
         WebKitInitializeWebDatabasesIfNecessary();
 #endif
@@ -3194,8 +3196,8 @@ HRESULT STDMETHODCALLTYPE WebView::stringByEvaluatingJavaScriptFromString(
     if (!scriptExecutionResult)
         return E_FAIL;
     else if (scriptExecutionResult.isString()) {
-        JSLock lock(JSC::SilenceAssertionsOnly);
         JSC::ExecState* exec = coreFrame->script()->globalObject(mainThreadNormalWorld())->globalExec();
+        JSC::JSLockHolder lock(exec);
         *result = BString(ustringToString(scriptExecutionResult.getString(exec)));
     }
 
@@ -4668,6 +4670,11 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         return hr;
     settings->setPluginsEnabled(!!enabled);
 
+    hr = preferences->isCSSRegionsEnabled(&enabled);
+    if (FAILED(hr))
+        return hr;
+    settings->setCSSRegionsEnabled(!!enabled);
+
     hr = preferences->privateBrowsingEnabled(&enabled);
     if (FAILED(hr))
         return hr;
@@ -4900,13 +4907,6 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
         return hr;
     settings->setLoadsSiteIconsIgnoringImageLoadingSetting(!!enabled);
 
-#if ENABLE(WEB_SOCKETS)
-    hr = prefsPrivate->hixie76WebSocketProtocolEnabled(&enabled);
-    if (FAILED(hr))
-        return hr;
-    settings->setUseHixie76WebSocketProtocol(enabled);
-#endif
-
     hr = prefsPrivate->showsToolTipOverTruncatedText(&enabled);
     if (FAILED(hr))
         return hr;
@@ -5851,8 +5851,8 @@ HRESULT STDMETHODCALLTYPE WebView::reportException(
     if (!context || !exception)
         return E_FAIL;
 
-    JSLock lock(JSC::SilenceAssertionsOnly);
     JSC::ExecState* execState = toJS(context);
+    JSC::JSLockHolder lock(execState);
 
     // Make sure the context has a DOMWindow global object, otherwise this context didn't originate from a WebView.
     if (!toJSDOMWindow(execState->lexicalGlobalObject()))
@@ -5878,8 +5878,9 @@ HRESULT STDMETHODCALLTYPE WebView::elementFromJS(
     if (!nodeObject)
         return E_FAIL;
 
-    JSLock lock(JSC::SilenceAssertionsOnly);
-    Element* elt = toElement(toJS(toJS(context), nodeObject));
+    JSC::ExecState* exec = toJS(context);
+    JSC::JSLockHolder lock(exec);
+    Element* elt = toElement(toJS(exec, nodeObject));
     if (!elt)
         return E_FAIL;
 
diff --git a/Source/WebKit/wx/ChangeLog b/Source/WebKit/wx/ChangeLog
index 077cdd463..f0913c36c 100644
--- a/Source/WebKit/wx/ChangeLog
+++ b/Source/WebKit/wx/ChangeLog
@@ -1,3 +1,13 @@
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * WebView.cpp:
+        (WebKit::WebView::Create):
+
 2012-05-31  Hajime Morrita  <morrita@chromium.org>
 
         REGRESSION(r117572): editing/spelling/spellcheck-async-remove-frame.html crashes on Mac
diff --git a/Source/WebKit/wx/WebView.cpp b/Source/WebKit/wx/WebView.cpp
index addd11c3a..acb60f643 100644
--- a/Source/WebKit/wx/WebView.cpp
+++ b/Source/WebKit/wx/WebView.cpp
@@ -389,7 +389,9 @@ bool WebView::Create(wxWindow* parent, const wxString& url, int id, const wxPoin
 
     m_impl = new WebViewPrivate();
 
-    WebCore::initializeLoggingChannelsIfNecessary();    
+#if !LOG_DISABLED
+    WebCore::initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
     WebCore::HTMLFrameOwnerElement* parentFrame = 0;
 
     WebCore::EditorClientWx* editorClient = new WebCore::EditorClientWx();
diff --git a/Source/WebKit2/CMakeLists.txt b/Source/WebKit2/CMakeLists.txt
index d40ba848a..1da9a6ac8 100644
--- a/Source/WebKit2/CMakeLists.txt
+++ b/Source/WebKit2/CMakeLists.txt
@@ -22,10 +22,12 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBKIT2_DIR}/WebProcess"
     "${WEBKIT2_DIR}/WebProcess/ApplicationCache"
     "${WEBKIT2_DIR}/WebProcess/Authentication"
+    "${WEBKIT2_DIR}/WebProcess/Battery"
     "${WEBKIT2_DIR}/WebProcess/Cookies"
     "${WEBKIT2_DIR}/WebProcess/Downloads"
     "${WEBKIT2_DIR}/WebProcess/FullScreen"
     "${WEBKIT2_DIR}/WebProcess/Geolocation"
+    "${WEBKIT2_DIR}/WebProcess/NetworkInfo"
     "${WEBKIT2_DIR}/WebProcess/IconDatabase"
     "${WEBKIT2_DIR}/WebProcess/InjectedBundle"
     "${WEBKIT2_DIR}/WebProcess/InjectedBundle/API"
@@ -41,6 +43,7 @@ SET(WebKit2_INCLUDE_DIRECTORIES
     "${WEBKIT2_DIR}/WebProcess/WebCoreSupport"
     "${WEBKIT2_DIR}/WebProcess/WebPage"
     "${WEBCORE_DIR}"
+    "${WEBCORE_DIR}/Modules/battery"
     "${WEBCORE_DIR}/Modules/intents"
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings/js"
@@ -137,6 +140,7 @@ SET(WebKit2_SOURCES
     Shared/UpdateInfo.cpp
     Shared/VisitedLinkTable.cpp
     Shared/WebBackForwardListItem.cpp
+    Shared/WebBatteryStatus.cpp
     Shared/WebConnection.cpp
     Shared/WebConnectionClient.cpp
     Shared/WebContextMenuItem.cpp
@@ -154,6 +158,7 @@ SET(WebKit2_SOURCES
     Shared/WebLayerTreeInfo.cpp
     Shared/WebMemorySampler.cpp
     Shared/WebMouseEvent.cpp
+    Shared/WebNetworkInfo.cpp
     Shared/WebOpenPanelParameters.cpp
     Shared/WebPageCreationParameters.cpp
     Shared/WebPageGroupData.cpp
@@ -214,6 +219,8 @@ SET(WebKit2_SOURCES
     UIProcess/VisitedLinkProvider.cpp
     UIProcess/WebApplicationCacheManagerProxy.cpp
     UIProcess/WebBackForwardList.cpp
+    UIProcess/WebBatteryManagerProxy.cpp
+    UIProcess/WebBatteryProvider.cpp
     UIProcess/WebConnectionToWebProcess.cpp
     UIProcess/WebContext.cpp
     UIProcess/WebContextConnectionClient.cpp
@@ -246,6 +253,8 @@ SET(WebKit2_SOURCES
     UIProcess/WebLoaderClient.cpp
     UIProcess/WebMediaCacheManagerProxy.cpp
     UIProcess/WebNavigationData.cpp
+    UIProcess/WebNetworkInfoManagerProxy.cpp
+    UIProcess/WebNetworkInfoProvider.cpp
     UIProcess/WebOpenPanelResultListenerProxy.cpp
     UIProcess/WebPageContextMenuClient.cpp
     UIProcess/WebPageGroup.cpp
@@ -258,12 +267,16 @@ SET(WebKit2_SOURCES
     UIProcess/WebTextChecker.cpp
     UIProcess/WebTextCheckerClient.cpp
     UIProcess/WebUIClient.cpp
+    UIProcess/WebVibrationProvider.cpp
+    UIProcess/WebVibrationProxy.cpp
 
     UIProcess/API/C/WKApplicationCacheManager.cpp
     UIProcess/API/C/WKAuthenticationChallenge.cpp
     UIProcess/API/C/WKAuthenticationDecisionListener.cpp
     UIProcess/API/C/WKBackForwardList.cpp
     UIProcess/API/C/WKBackForwardListItem.cpp
+    UIProcess/API/C/WKBatteryManager.cpp
+    UIProcess/API/C/WKBatteryStatus.cpp
     UIProcess/API/C/WKContext.cpp
     UIProcess/API/C/WKCookieManager.cpp
     UIProcess/API/C/WKCredential.cpp
@@ -280,9 +293,11 @@ SET(WebKit2_SOURCES
     UIProcess/API/C/WKIconDatabase.cpp
     UIProcess/API/C/WKInspector.cpp
     UIProcess/API/C/WKIntentData.cpp
+    UIProcess/API/C/WKIntentServiceInfo.cpp
     UIProcess/API/C/WKKeyValueStorageManager.cpp
     UIProcess/API/C/WKMediaCacheManager.cpp
     UIProcess/API/C/WKNavigationData.cpp
+    UIProcess/API/C/WKNetworkInfoManager.cpp
     UIProcess/API/C/WKNotification.cpp
     UIProcess/API/C/WKNotificationManager.cpp
     UIProcess/API/C/WKNotificationPermissionRequest.cpp
@@ -295,6 +310,7 @@ SET(WebKit2_SOURCES
     UIProcess/API/C/WKProtectionSpace.cpp
     UIProcess/API/C/WKResourceCacheManager.cpp
     UIProcess/API/C/WKTextChecker.cpp
+    UIProcess/API/C/WKVibration.cpp
 
     UIProcess/Authentication/AuthenticationChallengeProxy.cpp
     UIProcess/Authentication/AuthenticationDecisionListener.cpp
@@ -328,6 +344,8 @@ SET(WebKit2_SOURCES
 
     WebProcess/Authentication/AuthenticationManager.cpp
 
+    WebProcess/Battery/WebBatteryManager.cpp
+
     WebProcess/Cookies/WebCookieManager.cpp
 
     WebProcess/Downloads/Download.cpp
@@ -380,6 +398,8 @@ SET(WebKit2_SOURCES
 
     WebProcess/MediaCache/WebMediaCacheManager.cpp
 
+    WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
+
     WebProcess/Notifications/NotificationPermissionRequestManager.cpp
     WebProcess/Notifications/WebNotificationManager.cpp
 
@@ -401,6 +421,7 @@ SET(WebKit2_SOURCES
 
     WebProcess/ResourceCache/WebResourceCacheManager.cpp
 
+    WebProcess/WebCoreSupport/WebBatteryClient.cpp
     WebProcess/WebCoreSupport/WebChromeClient.cpp
     WebProcess/WebCoreSupport/WebColorChooser.cpp
     WebProcess/WebCoreSupport/WebContextMenuClient.cpp
@@ -411,10 +432,12 @@ SET(WebKit2_SOURCES
     WebProcess/WebCoreSupport/WebGeolocationClient.cpp
     WebProcess/WebCoreSupport/WebInspectorClient.cpp
     WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp
+    WebProcess/WebCoreSupport/WebNetworkInfoClient.cpp
     WebProcess/WebCoreSupport/WebNotificationClient.cpp
     WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
     WebProcess/WebCoreSupport/WebPopupMenu.cpp
     WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp
+    WebProcess/WebCoreSupport/WebVibrationClient.cpp
 
     WebProcess/WebPage/DecoderAdapter.cpp
     WebProcess/WebPage/DrawingArea.cpp
@@ -447,6 +470,7 @@ SET(WebKit2_MESSAGES_IN_FILES
     UIProcess/DrawingAreaProxy.messages.in
     UIProcess/LayerTreeCoordinatorProxy.messages.in
     UIProcess/WebApplicationCacheManagerProxy.messages.in
+    UIProcess/WebBatteryManagerProxy.messages.in
     UIProcess/WebContext.messages.in
     UIProcess/WebCookieManagerProxy.messages.in
     UIProcess/WebDatabaseManagerProxy.messages.in
@@ -456,9 +480,11 @@ SET(WebKit2_MESSAGES_IN_FILES
     UIProcess/WebInspectorProxy.messages.in
     UIProcess/WebKeyValueStorageManagerProxy.messages.in
     UIProcess/WebMediaCacheManagerProxy.messages.in
+    UIProcess/WebNetworkInfoManagerProxy.messages.in
     UIProcess/WebPageProxy.messages.in
     UIProcess/WebProcessProxy.messages.in
     UIProcess/WebResourceCacheManagerProxy.messages.in
+    UIProcess/WebVibrationProxy.messages.in
 
     UIProcess/Downloads/DownloadProxy.messages.in
 
@@ -472,6 +498,8 @@ SET(WebKit2_MESSAGES_IN_FILES
 
     WebProcess/Authentication/AuthenticationManager.messages.in
 
+    WebProcess/Battery/WebBatteryManager.messages.in
+
     WebProcess/Cookies/WebCookieManager.messages.in
 
     WebProcess/FullScreen/WebFullScreenManager.messages.in
@@ -484,6 +512,8 @@ SET(WebKit2_MESSAGES_IN_FILES
 
     WebProcess/MediaCache/WebMediaCacheManager.messages.in
 
+    WebProcess/NetworkInfo/WebNetworkInfoManager.messages.in
+
     WebProcess/Notifications/WebNotificationManager.messages.in
 
     WebProcess/Plugins/PluginProcessConnection.messages.in
diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index d92c0297c..7aefe8e0e 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,1652 @@
+2012-07-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122318.
+        http://trac.webkit.org/changeset/122318
+        https://bugs.webkit.org/show_bug.cgi?id=90961
+
+        It made 11 fast/events/touch fail (Requested by bbandix on
+        #webkit).
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        * UIProcess/API/qt/qquickwebview_p.h:
+
+2012-07-11  Keunsoon Lee  <keunsoon.lee@samsung.com>
+
+        [EFL][Wk2] WebErrorsEfl.cpp needs to return non-empty errors
+        https://bugs.webkit.org/show_bug.cgi?id=90688
+
+        Reviewed by Hajime Morita.
+
+        Return meaningful error for each case.
+
+        * WebProcess/WebCoreSupport/efl/WebErrorsEfl.cpp:
+        (WebKit::cancelledError): create ResourceError for "request canceled".
+        (WebKit::blockedError): create ResourceError for "request blocked".
+        (WebKit::cannotShowURLError): create ResourceError for "cannot show url".
+        (WebKit::interruptedForPolicyChangeError): create ResourceError for "Frame load interrupted by policy change".
+        (WebKit::cannotShowMIMETypeError): create ResourceError for "Cannot show mimetype".
+        (WebKit::fileDoesNotExistError): create ResourceError for "File does not exist".
+        (WebKit::pluginWillHandleLoadError): create ResourceError for "Plugin will handle load".
+
+2012-07-11  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] Fix wheel scrolling for simple pages
+        https://bugs.webkit.org/show_bug.cgi?id=90793
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Call WebPage::setFixedLayoutSize in setResizesToContentsUsingLayoutSize
+        instead of setting the view size manually and scheduling a relayout.
+        Since setFixedLayoutSize forces a relayout it also updates the scrollbars
+        after the visible rect is available.
+        This fixes scrolling with wheel events for a QML WebView loading a simple
+        local page which previously ended up in a state where scrolling was disabled
+        because the scrollbar update happened before the correct visible rect size was
+        available.
+
+        Add a QML test and infrastructure to QWebKitTest to cover this case.
+
+        * UIProcess/API/qt/qwebkittest.cpp:
+        (QWebKitTest::wheelEvent):
+        * UIProcess/API/qt/qwebkittest_p.h:
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_wheelEventHandling.qml: Added.
+        * UIProcess/API/qt/tests/qmltests/common/test4.html: Added.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::setResizesToContentsUsingLayoutSize):
+
+2012-07-11  Andras Becsi  <andras.becsi@nokia.com>
+
+        [Qt][WK2] ASSERT: "!m_viewportItem->isMoving()" in QtViewportHandler::flickMoveEnded()
+        https://bugs.webkit.org/show_bug.cgi?id=90875
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Since MultiPointTouchArea and PinchArea use the childMouseEventFilter
+        method to filter touch events too, and because Flickable filters child
+        mouse events the canvas calls this function before propagating the touch
+        event to the WebView. Since Flickable does not accept touch events the
+        canvas tries to propagate a synthesized mouse event through the base
+        class childMouseEventFilter function which is accepted by Flickable and
+        interferes with the input events we send to Flicakble hence messes up
+        the internal state of the WebView.
+        This patch reimplements the virtual childMouseEventFilter method so that all
+        the mouse and touch events can be processed by WebKit before they arrive to
+        Flickable.
+
+        * UIProcess/API/qt/qquickwebview.cpp:
+        (QQuickWebView::childMouseEventFilter):
+        * UIProcess/API/qt/qquickwebview_p.h:
+
+2012-07-10  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Add Battery Status Provider
+        https://bugs.webkit.org/show_bug.cgi?id=90543
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Define a battery status provider for WebKit2 EFL which
+        relies on WebCore::BatteryProviderEfl.
+
+        * CMakeLists.txt: Add WebCore/Modules/battery to include
+        paths.
+        * PlatformEfl.cmake: Add BatteryProvider class to CMake.
+        * UIProcess/API/efl/BatteryProvider.cpp: Added.
+        (toBatteryProvider):
+        (startUpdatingCallback):
+        (stopUpdatingCallback):
+        (BatteryProvider::~BatteryProvider):
+        (BatteryProvider::create):
+        (BatteryProvider::BatteryProvider):
+        (BatteryProvider::startUpdating):
+        (BatteryProvider::stopUpdating):
+        (BatteryProvider::didChangeBatteryStatus):
+        * UIProcess/API/efl/BatteryProvider.h: Added.
+        (BatteryProvider):
+        * UIProcess/API/efl/ewk_context.cpp:
+        (_Ewk_Context): Add BatteryProvider to Ewk_Context.
+        (createDefaultEwkContext):
+        (ewk_context_default_get):
+
+2012-07-10  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt] Enable antialiasing for TextureMapper
+        https://bugs.webkit.org/show_bug.cgi?id=90915
+
+        Reviewed by Martin Robinson.
+
+        Enable the new antialiasing functionality for WebLayerTreeRendering.
+        This will make one-tile layers antialiased when using UI_SIDE_COMPOSITING.
+
+        * UIProcess/WebLayerTreeRenderer.cpp:
+        (WebKit::WebLayerTreeRenderer::ensureRootLayer):
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        WebCore::Settings for Hixie76 WebSocket protocol doesn't do anything and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90910
+
+        Reviewed by Eric Seidel.
+
+        * Shared/WebPreferencesStore.h:
+        (WebKit):
+        * UIProcess/API/C/WKPreferences.cpp:
+        (WKPreferencesSetHixie76WebSocketProtocolEnabled):
+        (WKPreferencesGetHixie76WebSocketProtocolEnabled):
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::updatePreferences):
+
+2012-07-10  Helder Correia  <helder.correia@nokia.com>
+
+        [Qt] Repaint counter for accelerated compositing
+        https://bugs.webkit.org/show_bug.cgi?id=90116
+
+        Reviewed by Noam Rosenthal.
+
+        No new tests, just introducing a debug feature.
+
+        For this feature to be enabled, the environment variable
+        QT_WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS must be set to 1. Once enabled,
+        both repaint counters and tile borders will be painted.
+
+        Important notes:
+        - Only WebKit2 is targetted for now.
+        - There is no integration with Preferences. That aproach was
+        taken initially but revealed complex and overkill for such a
+        debugging-only functionality. Thus, to disable it simply restart with
+        the environment variable unset or set to some other value.
+
+        A Qt-specific drawRepaintCounter() function was added to
+        TextureMapperGL. A QImage is used as scratch buffer to paint borders and
+        counters. It is then uploaded to a BitmapTexture acquired from the pool
+        and finally draw by TextureMapper. The actual compositing happens inside
+        LayerBackingStore::paintToTextureMapper(). Each LayerBackingStoreTile
+        now has a repaint counter which gets incremented in
+        LayerBackingStore::updateTile().
+
+        * UIProcess/texmap/LayerBackingStore.cpp:
+        (WebKit::LayerBackingStore::updateTile):
+        (WebKit):
+        (WebKit::shouldShowTileDebugVisuals):
+        (WebKit::LayerBackingStore::paintToTextureMapper):
+        * UIProcess/texmap/LayerBackingStore.h:
+        (WebKit::LayerBackingStoreTile::LayerBackingStoreTile):
+        (LayerBackingStoreTile):
+        (WebKit::LayerBackingStoreTile::incrementRepaintCount):
+        (WebKit::LayerBackingStoreTile::repaintCount):
+
+2012-07-10  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [WK2] Add Vibration API support for WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=90058
+
+        Reviewed by Anders Carlsson.
+
+        Add support for Vibration API to WebKit2.
+
+        * CMakeLists.txt:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Platform/CoreIPC/MessageID.h:
+        * Shared/API/c/WKBase.h:
+        * Shared/APIObject.h:
+        * Target.pri:
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit):
+        * UIProcess/API/C/WKVibration.cpp: Added.
+        (WKVibrationGetTypeID):
+        (WKVibrationSetProvider):
+        * UIProcess/API/C/WKVibration.h: Added.
+        * UIProcess/WebVibrationProvider.cpp: Added.
+        (WebKit):
+        (WebKit::WebVibrationProvider::vibrate):
+        (WebKit::WebVibrationProvider::cancelVibration):
+        * UIProcess/WebVibrationProvider.h: Added.
+        (WebKit):
+        (WebVibrationProvider):
+        * UIProcess/WebVibrationProxy.cpp: Added.
+        (WebKit):
+        (WebKit::WebVibrationProxy::create):
+        (WebKit::WebVibrationProxy::WebVibrationProxy):
+        (WebKit::WebVibrationProxy::~WebVibrationProxy):
+        (WebKit::WebVibrationProxy::invalidate):
+        (WebKit::WebVibrationProxy::initializeProvider):
+        (WebKit::WebVibrationProxy::didReceiveMessage):
+        (WebKit::WebVibrationProxy::vibrate):
+        (WebKit::WebVibrationProxy::cancelVibration):
+        * UIProcess/WebVibrationProxy.h: Added.
+        (CoreIPC):
+        (WebKit):
+        (WebVibrationProxy):
+        (WebKit::WebVibrationProxy::clearContext):
+        (WebKit::WebVibrationProxy::type):
+        * UIProcess/WebVibrationProxy.messages.in: Added.
+        * WebProcess/WebCoreSupport/WebVibrationClient.cpp: Added.
+        (WebKit):
+        (WebKit::WebVibrationClient::vibrate):
+        (WebKit::WebVibrationClient::cancelVibration):
+        (WebKit::WebVibrationClient::vibrationDestroyed):
+        * WebProcess/WebCoreSupport/WebVibrationClient.h: Added.
+        (WebKit):
+        (WebVibrationClient):
+        (WebKit::WebVibrationClient::WebVibrationClient):
+        (WebKit::WebVibrationClient::~WebVibrationClient):
+
+2012-07-10  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add API to clear the cache to WebKit2 GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=90856
+
+        Reviewed by Martin Robinson.
+
+        * UIProcess/API/gtk/WebKitWebContext.cpp:
+        (webkit_web_context_clear_cache): Call
+        WKResourceCacheManagerClearCacheForAllOrigins() to clear all
+        resources currently cached.
+        * UIProcess/API/gtk/WebKitWebContext.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt: Add new symbol.
+
+2012-07-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122178.
+        http://trac.webkit.org/changeset/122178
+        https://bugs.webkit.org/show_bug.cgi?id=90857
+
+        browser tests, PrerenderBrowserTest.PrerenderFavicon and other
+        tests, started to fail (Requested by hayato on #webkit).
+
+        * win/WebKit2.def:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Pete Williamson  <petewil@google.com>
+
+        Export the iconURL list to make it available to the Internals class for testing
+        https://bugs.webkit.org/show_bug.cgi?id=88665
+
+        Reviewed by Kent Tamura.
+
+        * win/WebKit2.def: export the DocumentL::iconURLs function
+
+2012-07-09  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Add missing Battery Status API integration to WebContext and WebPage
+        https://bugs.webkit.org/show_bug.cgi?id=90784
+
+        Reviewed by Anders Carlsson.
+
+        Integrate Battery Status API to WebPage, WebContext and
+        properly route messages to the WebBatteryManagerProxy.
+        Without this, the Battery Status tests are crashing for
+        WebKit2.
+
+        * UIProcess/API/C/WKContext.cpp:
+        (WKContextGetBatteryManager):
+        * UIProcess/API/C/WKContext.h:
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        (WebKit::WebContext::~WebContext):
+        (WebKit::WebContext::disconnectProcess):
+        (WebKit::WebContext::didReceiveMessage):
+        * UIProcess/WebContext.h:
+        (WebKit):
+        (WebContext):
+        (WebKit::WebContext::batteryManagerProxy):
+        * UIProcess/WebProcessProxy.cpp:
+        (WebKit::WebProcessProxy::didReceiveMessage):
+        * WebProcess/WebCoreSupport/WebBatteryClient.cpp:
+        (WebKit::WebBatteryClient::setController):
+        (WebKit):
+        * WebProcess/WebCoreSupport/WebBatteryClient.h:
+        (WebBatteryClient):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::WebPage):
+
+2012-07-09  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] [WK2] ASSERTION FAILED: !HashTranslator::equal(KeyTraits::emptyValue(), key)
+        https://bugs.webkit.org/show_bug.cgi?id=90464
+
+        Reviewed by Daniel Bates.
+
+        HashMap has the property that 0 is the empty value for integer
+        keys, so do not use 0 as a key in the HashMap.
+
+        * Platform/efl/WorkQueueEfl.cpp:
+        (WorkQueue::dispatchAfterDelay):
+
+2012-07-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add a setting to enable/disable page cache to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=90773
+
+        Reviewed by Martin Robinson.
+
+        * UIProcess/API/gtk/WebKitSettings.cpp:
+        (webKitSettingsSetProperty):
+        (webKitSettingsGetProperty):
+        (webkit_settings_class_init):
+        (webkit_settings_get_enable_page_cache):
+        (webkit_settings_set_enable_page_cache):
+        * UIProcess/API/gtk/WebKitSettings.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt:
+        * UIProcess/API/gtk/tests/TestWebKitSettings.cpp:
+        (testWebKitSettings):
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Fix inspector detach when inspector was attached by the client
+        https://bugs.webkit.org/show_bug.cgi?id=90763
+
+        Reviewed by Martin Robinson.
+
+        When the inspector is detached, we are unconditionally removing it
+        from the inspected view, but if the inspector was attached by the
+        client, the parent might be another widget.
+
+        * UIProcess/gtk/WebInspectorProxyGtk.cpp:
+        (WebKit::WebInspectorProxy::platformDetach): Remove the inspector
+        view from its parent widget.
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-09  Dan Bernstein  <mitz@apple.com>
+
+        Fix the Mac build when codesign_allocate is not installed at /usr/bin.
+
+        * PluginProcess/mac/add-entitlements.sh: Let codesign(1) know where the codesign_allocate
+        tool is by setting the CODESIGN_ALLOCATE environment variable to its path as obtained with
+        xcrun.
+
+2012-07-06  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Add support for Network Information API
+        https://bugs.webkit.org/show_bug.cgi?id=89870
+
+        Reviewed by Anders Carlsson.
+
+        Add Network Information API support for WebKit2.
+
+        * CMakeLists.txt:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Platform/CoreIPC/MessageID.h:
+        * Shared/API/c/WKBase.h:
+        * Shared/APIObject.h:
+        * Shared/WebNetworkInfo.cpp: Added.
+        (WebKit):
+        (WebKit::WebNetworkInfo::WebNetworkInfo):
+        (WebKit::WebNetworkInfo::~WebNetworkInfo):
+        (WebKit::WebNetworkInfo::Data::encode):
+        (WebKit::WebNetworkInfo::Data::decode):
+        * Shared/WebNetworkInfo.h: Added.
+        (WebKit):
+        (WebNetworkInfo):
+        (Data):
+        (WebKit::WebNetworkInfo::create):
+        (WebKit::WebNetworkInfo::bandwidth):
+        (WebKit::WebNetworkInfo::metered):
+        (WebKit::WebNetworkInfo::data):
+        (WebKit::WebNetworkInfo::type):
+        * Target.pri:
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit):
+        * UIProcess/API/C/WKNetworkInfoManager.cpp: Added.
+        (WKNetworkInfoManagerGetTypeID):
+        * UIProcess/API/C/WKNetworkInfoManager.h: Added.
+        * UIProcess/WebNetworkInfoManagerProxy.cpp: Added.
+        (WebKit):
+        (WebKit::WebNetworkInfoManagerProxy::create):
+        (WebKit::WebNetworkInfoManagerProxy::WebNetworkInfoManagerProxy):
+        (WebKit::WebNetworkInfoManagerProxy::~WebNetworkInfoManagerProxy):
+        (WebKit::WebNetworkInfoManagerProxy::invalidate):
+        (WebKit::WebNetworkInfoManagerProxy::initializeProvider):
+        (WebKit::WebNetworkInfoManagerProxy::providerDidChangeNetworkInformation):
+        (WebKit::WebNetworkInfoManagerProxy::didReceiveMessage):
+        (WebKit::WebNetworkInfoManagerProxy::startUpdating):
+        (WebKit::WebNetworkInfoManagerProxy::stopUpdating):
+        (WebKit::WebNetworkInfoManagerProxy::getBandwidth):
+        (WebKit::WebNetworkInfoManagerProxy::isMetered):
+        * UIProcess/WebNetworkInfoManagerProxy.h: Added.
+        (CoreIPC):
+        (WebKit):
+        (WebNetworkInfoManagerProxy):
+        (WebKit::WebNetworkInfoManagerProxy::clearContext):
+        (WebKit::WebNetworkInfoManagerProxy::type):
+        * UIProcess/WebNetworkInfoManagerProxy.messages.in: Added.
+        * UIProcess/WebNetworkInfoProvider.cpp: Added.
+        (WebKit):
+        (WebKit::WebNetworkInfoProvider::startUpdating):
+        (WebKit::WebNetworkInfoProvider::stopUpdating):
+        (WebKit::WebNetworkInfoProvider::bandwidth):
+        (WebKit::WebNetworkInfoProvider::metered):
+        * UIProcess/WebNetworkInfoProvider.h: Added.
+        (WebKit):
+        (WebNetworkInfoProvider):
+        * WebKit2.pri:
+        * WebProcess/NetworkInfo/WebNetworkInfoManager.cpp: Added.
+        (WebKit):
+        (WebKit::WebNetworkInfoManager::WebNetworkInfoManager):
+        (WebKit::WebNetworkInfoManager::~WebNetworkInfoManager):
+        (WebKit::WebNetworkInfoManager::didReceiveMessage):
+        (WebKit::WebNetworkInfoManager::registerWebPage):
+        (WebKit::WebNetworkInfoManager::unregisterWebPage):
+        (WebKit::WebNetworkInfoManager::bandwidth):
+        (WebKit::WebNetworkInfoManager::metered):
+        (WebKit::WebNetworkInfoManager::didChangeNetworkInformation):
+        * WebProcess/NetworkInfo/WebNetworkInfoManager.h: Added.
+        (CoreIPC):
+        (WebKit):
+        (WebNetworkInfoManager):
+        * WebProcess/NetworkInfo/WebNetworkInfoManager.messages.in: Added.
+        * WebProcess/WebCoreSupport/WebNetworkInfoClient.cpp: Added.
+        (WebKit):
+        (WebKit::WebNetworkInfoClient::~WebNetworkInfoClient):
+        (WebKit::WebNetworkInfoClient::bandwidth):
+        (WebKit::WebNetworkInfoClient::metered):
+        (WebKit::WebNetworkInfoClient::startUpdating):
+        (WebKit::WebNetworkInfoClient::stopUpdating):
+        * WebProcess/WebCoreSupport/WebNetworkInfoClient.h: Added.
+        (WebKit):
+        (WebNetworkInfoClient):
+        (WebKit::WebNetworkInfoClient::WebNetworkInfoClient):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::WebProcess):
+        (WebKit::WebProcess::didReceiveMessage):
+        * WebProcess/WebProcess.h:
+        (WebProcess):
+        (WebKit::WebProcess::networkInfoManager):
+
+2012-07-06  Jessie Berlin  <jberlin@apple.com>
+
+        WKContext should ask for its injected bundle initialization user data when it needs it so the
+        client doesn't have to keep it up to date.
+        https://bugs.webkit.org/show_bug.cgi?id=90627
+
+        Reviewed by Anders Carlsson.
+
+        Add a getInjectedBundleInitializationUserData callback to WKContextInjectedBundleClient.
+
+        * Shared/APIClientTraits.cpp:
+        Allow the WKContextInjectedBundleClient API to be versioned.
+        * Shared/APIClientTraits.h:
+
+        * UIProcess/API/C/WKContext.h:
+        Add the callback and bump the version of WKContextInjectedBundleClient.
+
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::ensureWebProcess):
+        Prefer any user data returned when the callback is invoked over that set with
+        WKContextSetInitializationUserDataForInjectedBundle.
+
+        * UIProcess/WebContextInjectedBundleClient.cpp:
+        (WebKit::WebContextInjectedBundleClient::getInjectedBundleInitializationUserData):
+        Invoke the callback if the client has registered for it.
+        * UIProcess/WebContextInjectedBundleClient.h:
+
+2012-07-06  Jessie Berlin  <jberlin@apple.com>
+
+        WebContext::injectedBundleInitializationUserData() is unused, should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=90486
+
+        Reviewed by Anders Carlsson.
+
+        * UIProcess/WebContext.h:
+        Remove it.
+
+2012-07-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add site specific quirks setting to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=90663
+
+        Reviewed by Martin Robinson.
+
+        * UIProcess/API/gtk/WebKitSettings.cpp:
+        (webKitSettingsSetProperty):
+        (webKitSettingsGetProperty):
+        (webkit_settings_class_init):
+        (webkit_settings_get_enable_site_specific_quirks):
+        (webkit_settings_set_enable_site_specific_quirks):
+        * UIProcess/API/gtk/WebKitSettings.h:
+        * UIProcess/API/gtk/docs/webkit2gtk-sections.txt:
+        * UIProcess/API/gtk/tests/TestWebKitSettings.cpp:
+        (testWebKitSettings):
+
+2012-07-06  Dominik Röttsches  <dominik.rottsches@intel.com>
+
+        ProcessLauncher's WorkQueue's name is too long on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=44041
+
+        Reviewed by Andreas Kling.
+
+        Shorten thread name for process launcher so that we can silence the warning
+        for thread names getting truncated under VisualStudio -
+        see createThread() in  Threading.cpp.
+
+        * UIProcess/Launcher/ProcessLauncher.cpp:
+        (WebKit::processLauncherWorkQueue):
+
+2012-07-06  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] WebKit-EFL headers do not build with gcc < 4.6
+        https://bugs.webkit.org/show_bug.cgi?id=90681
+
+        Unreviewed EFL build fix.
+
+        Remove several forward declarations from ewk_view
+        header to avoid typedef redefinitions which are
+        illegal in C.
+
+        * UIProcess/API/efl/ewk_view.h:
+
+2012-07-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Buildfix for newer Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=90519
+
+        Reviewed by Tor Arne Vestbø.
+
+        * UIProcess/API/qt/qwebkittest.cpp: Include qpa/qwindowsysteminterface.h instead of deprecated qwindowsysteminterface_qpa.h.
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Adjust to changed generation of master include file
+
+        The responsiblity for creating the master include was moved out of syncqt.
+        @ignore_for_master_contents still stays, as syncqt (ab-)uses this for
+        determining whether a header is private.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * UIProcess/API/qt/tests/bytearraytestdata.h:
+        * UIProcess/API/qt/tests/testwindow.h:
+
+2012-07-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Ewk_View needs to report load status changes
+        https://bugs.webkit.org/show_bug.cgi?id=90566
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add new "load,finished", "load,provisional,failed",
+        "load,provisional,redirect" and "load,provisional,started"
+        signals on the Ewk_View to notify the client of different
+        load state changes.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_load_finished):
+        (ewk_view_load_provisional_failed):
+        (ewk_view_load_provisional_redirect):
+        (ewk_view_load_provisional_started):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_loader_client.cpp:
+        (didFinishLoadForFrame):
+        (didFailLoadWithErrorForFrame):
+        (didStartProvisionalLoadForFrame):
+        (didReceiveServerRedirectForProvisionalLoadForFrame):
+        (didFailProvisionalLoadWithErrorForFrame):
+        (ewk_view_loader_client_attach):
+        * UIProcess/API/efl/ewk_view_private.h:
+
+2012-07-05  Luiz Agostini  <luiz.agostini@nokia.com>
+
+        [Qt] Transform should be applied to the clip rect in QRawWebView::paint
+        https://bugs.webkit.org/show_bug.cgi?id=90652
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Applying the transformation matrix to the clip rect in QRawWebView::paint.
+
+        * UIProcess/API/qt/raw/qrawwebview.cpp:
+        (QRawWebView::paint):
+
+2012-07-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Ewk_View should provide API to set/get device pixel ratio
+        https://bugs.webkit.org/show_bug.cgi?id=90590
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add API to Ewk_View so retrieve and set the device
+        pixel ratio.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_device_pixel_ratio_set):
+        (ewk_view_device_pixel_ratio_get):
+        * UIProcess/API/efl/ewk_view.h:
+
+2012-07-05  Anders Carlsson  <andersca@apple.com>
+
+        Type-ahead doesn't work in options inside optgroups
+        https://bugs.webkit.org/show_bug.cgi?id=90647
+        <rdar://problem/5604894>
+
+        Reviewed by Dan Bernstein.
+
+        Set the title of the menu item to a string that doesn't contain any leading or trailing whitespace.
+
+        * UIProcess/mac/WebPopupMenuProxyMac.mm:
+        (WebKit::WebPopupMenuProxyMac::populate):
+
+2012-07-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Add C API for Battery Status API
+        https://bugs.webkit.org/show_bug.cgi?id=90545
+
+        Reviewed by Anders Carlsson.
+
+        Add C API for WKBatteryManager and WKBatteryStatus
+        so that clients can support the Battery Status API
+        in WebKit2.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UIProcess/API/C/WKBatteryManager.cpp:
+        (WKBatteryManagerProviderDidChangeBatteryStatus):
+        (WKBatteryManagerProviderUpdateBatteryStatus):
+        * UIProcess/API/C/WKBatteryStatus.cpp: Copied from Source/WebKit2/UIProcess/API/C/WKBatteryManager.cpp.
+        (WKBatteryStatusGetTypeID):
+        (WKBatteryStatusCreate):
+        * UIProcess/API/C/WKBatteryStatus.h: Copied from Source/WebKit2/UIProcess/API/C/WKBatteryManager.cpp.
+
+2012-07-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121899.
+        http://trac.webkit.org/changeset/121899
+        https://bugs.webkit.org/show_bug.cgi?id=90623
+
+        Unauthorized WK2 API breakage (Requested by andersca on
+        #webkit).
+
+        * Shared/API/c/WKSharedAPICast.h:
+        (WebKit::toCopiedURLAPI):
+
+2012-07-05  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] WTR crashes if a URL is passed as a parameter
+        https://bugs.webkit.org/show_bug.cgi?id=88093
+
+        Reviewed by Zoltan Herczeg.
+
+        * Shared/API/c/WKSharedAPICast.h:
+        (WebKit::toCopiedURLAPI):
+        Don't special case null string. It's handled
+        fine by WebURL and passing 0 is not suitable
+        to the API.
+
+2012-07-05  Dongwoo Im  <dw.im@samsung.com>
+
+        [EFL] Enable the CUSTOM_SCHEME_HANDLER feature as default.
+        https://bugs.webkit.org/show_bug.cgi?id=88608
+
+        Reviewed by Hajime Morita.
+
+        * WebProcess/WebCoreSupport/WebChromeClient.h:
+        (WebKit::WebChromeClient::isProtocolHandlerRegistered): Add a stub function.
+        (WebKit::WebChromeClient::unregisterProtocolHandler): Add a stub function.
+        (WebChromeClient):
+
+2012-07-05  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [Wk2][EFL] EFL needs a WebKitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=87659
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * PlatformEfl.cmake: Added WKImageCairo.cpp in source list.
+
+2012-07-05  Hyerim Bae  <hyerim.bae@samsung.com>
+
+        [EFL][WK2] Add ewk_view_reload_bypass_cache API.
+        https://bugs.webkit.org/show_bug.cgi?id=89413
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add API, which is for reloading documents without cache.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_reload_bypass_cache):
+        * UIProcess/API/efl/ewk_view.h:
+
+2012-07-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Ewk_View needs API to load HTML data
+        https://bugs.webkit.org/show_bug.cgi?id=90540
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add method to Ewk_View to load provided HTML data.
+        This is used for e.g. when an URL cannot be reached
+        and we need to display an error page.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_html_load):
+        * UIProcess/API/efl/ewk_view.h:
+
+2012-07-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Ewk_View needs to report new resource requests
+        https://bugs.webkit.org/show_bug.cgi?id=90577
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add new "resource,request,new" signal to Ewk_View to
+        notify clients of the resource requests being initiated.
+        New Ewk_Url_Request and Ewk_Web_Resource types are
+        introduced in order to provide the clients with the
+        needed information regarding the resource requests.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_url_request.cpp: Added.
+        (_Ewk_Url_Request):
+        (ewk_url_request_ref):
+        (ewk_url_request_unref):
+        (ewk_url_request_url_get):
+        (ewk_request_first_party_get):
+        (ewk_url_request_http_method_get):
+        (ewk_url_request_new):
+        * UIProcess/API/efl/ewk_url_request.h: Added.
+        * UIProcess/API/efl/ewk_url_request_private.h: Added.
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_base_add):
+        (ewk_view_resource_load_initiated):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/API/efl/ewk_view_resource_load_client.cpp: Added.
+        (didInitiateLoadForResource):
+        (ewk_view_resource_load_client_attach):
+        * UIProcess/API/efl/ewk_view_resource_load_client_private.h: Added.
+        * UIProcess/API/efl/ewk_web_resource.cpp: Added.
+        (_Ewk_Web_Resource):
+        (ewk_web_resource_ref):
+        (ewk_web_resource_unref):
+        (ewk_web_resource_uri_get):
+        (ewk_web_resource_new):
+        (ewk_web_resource_main_get):
+        * UIProcess/API/efl/ewk_web_resource.h: Added.
+        * UIProcess/API/efl/ewk_web_resource_private.h: Added.
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing.
+
+        Reviewed by Adam Barth.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-07-04  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Ewk_View should report load errors
+        https://bugs.webkit.org/show_bug.cgi?id=90479
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The Ewk_View now emits a "load,error" signal when the
+        main frame fails loading. Information about the error
+        is provided via the new Ewk_Web_Error type.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_load_error):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_loader_client.cpp:
+        (didFailLoadWithErrorForFrame):
+        (ewk_view_loader_client_attach):
+        * UIProcess/API/efl/ewk_view_private.h:
+        * UIProcess/API/efl/ewk_web_error.cpp: Added.
+        (_Ewk_Web_Error):
+        (ewk_web_error_free):
+        (ewk_web_error_domain_get):
+        (ewk_web_error_url_get):
+        (ewk_web_error_code_get):
+        (ewk_web_error_description_get):
+        (ewk_web_error_cancellation_get):
+        (ewk_web_error_new):
+        * UIProcess/API/efl/ewk_web_error.h: Added.
+        * UIProcess/API/efl/ewk_web_error_private.h: Added.
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Ewk_View should report the load progress
+        https://bugs.webkit.org/show_bug.cgi?id=90457
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        The Ewk_View now reports the estimated load progress
+        of the page via the new "load,progress".
+        A method is also added to Ewk_View in order to
+        retrieve the current load progress.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_load_progress_get):
+        (ewk_view_load_progress_changed):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_loader_client.cpp:
+        (didChangeProgress):
+        (ewk_view_loader_client_attach):
+        * UIProcess/API/efl/ewk_view_private.h:
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Add support for Battery Status API
+        https://bugs.webkit.org/show_bug.cgi?id=89558
+
+        Reviewed by Anders Carlsson.
+
+        Add support for Battery Status API to WebKit2.
+
+        * CMakeLists.txt:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Platform/CoreIPC/MessageID.h:
+        * Shared/API/c/WKBase.h:
+        * Shared/APIObject.h:
+        * Shared/WebBatteryStatus.cpp: Added.
+        (WebKit):
+        (WebKit::WebBatteryStatus::WebBatteryStatus):
+        (WebKit::WebBatteryStatus::~WebBatteryStatus):
+        (WebKit::WebBatteryStatus::Data::encode):
+        (WebKit::WebBatteryStatus::Data::decode):
+        * Shared/WebBatteryStatus.h: Added.
+        (WebKit):
+        (WebBatteryStatus):
+        (Data):
+        (WebKit::WebBatteryStatus::create):
+        (WebKit::WebBatteryStatus::isCharging):
+        (WebKit::WebBatteryStatus::chargingTime):
+        (WebKit::WebBatteryStatus::dischargingTime):
+        (WebKit::WebBatteryStatus::level):
+        (WebKit::WebBatteryStatus::data):
+        (WebKit::WebBatteryStatus::type):
+        * Target.pri:
+        * UIProcess/API/C/WKAPICast.h:
+        (WebKit):
+        * UIProcess/API/C/WKBatteryManager.cpp: Added.
+        (WKBatteryManagerGetTypeID):
+        * UIProcess/API/C/WKBatteryManager.h: Added.
+        * UIProcess/WebBatteryManagerProxy.cpp: Added.
+        (WebKit):
+        (WebKit::WebBatteryManagerProxy::create):
+        (WebKit::WebBatteryManagerProxy::WebBatteryManagerProxy):
+        (WebKit::WebBatteryManagerProxy::~WebBatteryManagerProxy):
+        (WebKit::WebBatteryManagerProxy::invalidate):
+        (WebKit::WebBatteryManagerProxy::initializeProvider):
+        (WebKit::WebBatteryManagerProxy::didReceiveMessage):
+        (WebKit::WebBatteryManagerProxy::startUpdating):
+        (WebKit::WebBatteryManagerProxy::stopUpdating):
+        (WebKit::WebBatteryManagerProxy::providerDidChangeBatteryStatus):
+        (WebKit::WebBatteryManagerProxy::providerUpdateBatteryStatus):
+        * UIProcess/WebBatteryManagerProxy.h: Added.
+        (CoreIPC):
+        (WebKit):
+        (WebBatteryManagerProxy):
+        (WebKit::WebBatteryManagerProxy::clearContext):
+        (WebKit::WebBatteryManagerProxy::type):
+        * UIProcess/WebBatteryManagerProxy.messages.in: Added.
+        * UIProcess/WebBatteryProvider.cpp: Added.
+        (WebKit):
+        (WebKit::WebBatteryProvider::startUpdating):
+        (WebKit::WebBatteryProvider::stopUpdating):
+        * UIProcess/WebBatteryProvider.h: Added.
+        (WebKit):
+        (WebBatteryProvider):
+        * WebKit2.pri:
+        * WebProcess/Battery/WebBatteryManager.cpp: Added.
+        (WebKit):
+        (WebKit::WebBatteryManager::WebBatteryManager):
+        (WebKit::WebBatteryManager::~WebBatteryManager):
+        (WebKit::WebBatteryManager::didReceiveMessage):
+        (WebKit::WebBatteryManager::registerWebPage):
+        (WebKit::WebBatteryManager::unregisterWebPage):
+        (WebKit::WebBatteryManager::didChangeBatteryStatus):
+        (WebKit::WebBatteryManager::updateBatteryStatus):
+        * WebProcess/Battery/WebBatteryManager.h: Added.
+        (CoreIPC):
+        (WebKit):
+        (WebBatteryManager):
+        * WebProcess/Battery/WebBatteryManager.messages.in: Added.
+        * WebProcess/WebCoreSupport/WebBatteryClient.cpp: Added.
+        (WebKit):
+        (WebKit::WebBatteryClient::startUpdating):
+        (WebKit::WebBatteryClient::stopUpdating):
+        (WebKit::WebBatteryClient::batteryControllerDestroyed):
+        * WebProcess/WebCoreSupport/WebBatteryClient.h: Added.
+        (WebKit):
+        (WebBatteryClient):
+        (WebKit::WebBatteryClient::WebBatteryClient):
+        (WebKit::WebBatteryClient::~WebBatteryClient):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::WebProcess):
+        (WebKit::WebProcess::didReceiveMessage):
+        * WebProcess/WebProcess.h:
+        (WebProcess):
+        (WebKit::WebProcess::batteryManager):
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri:
+        * Target.pri:
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121766.
+        http://trac.webkit.org/changeset/121766
+        https://bugs.webkit.org/show_bug.cgi?id=90465
+
+        It caused flakey build errors on the bots (Requested by Ossy
+        on #webkit).
+
+        * DerivedSources.pri:
+        * Target.pri:
+
+2012-07-03  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Add WebKitWebView::context-menu-dismissed signal to WebKit2 GTK+ API
+        https://bugs.webkit.org/show_bug.cgi?id=90386
+
+        Reviewed by Martin Robinson.
+
+        * UIProcess/API/gtk/WebKitWebView.cpp:
+        (webkit_web_view_class_init): Add context-menu-dismissed signal.
+        (contextMenuDismissed): Emit context-menu-dismissed signal.
+        (webkitWebViewPopulateContextMenu): Connect to deactivate signal
+        of the GtkMenu and emit WebKitWebView::context-menu-dismissed when
+        the gtk menu is deactivated.
+        * UIProcess/API/gtk/WebKitWebView.h:
+        (_WebKitWebViewClass): Add virtual methos for
+        context-menu-dismissed signal.
+        * UIProcess/API/gtk/tests/TestContextMenu.cpp:
+        (testContextMenuDismissed):
+        (beforeAll):
+        * UIProcess/gtk/WebContextMenuProxyGtk.h:
+        (WebKit::WebContextMenuProxyGtk::gtkMenu): Get the GtkMenu built
+        for the context menu proxy.
+
+2012-07-03  Piotr Roguski  <p.roguski@samsung.com>
+
+        [EFL][WK2] Added missing WebPageProxy::ViewIsFocused flag to WebPageProxy::viewStateDidChange()
+        call in _ewk_view_smart_focus_out() function.
+        https://bugs.webkit.org/show_bug.cgi?id=89877
+
+        Reviewed by Andreas Kling.
+
+        Although name of the flag suggest it should be used only on focus in,
+        omitting it in case of focus out will prevent WebPageProxy::viewStateDidChange()
+        from sending Messages::WebPage::SetFocused(false).
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (_ewk_view_smart_focus_out):
+
+2012-07-03  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        [Qt][WK2] API tests randomly asserts in QQuickWebPage::setContentsScale(qreal)
+        https://bugs.webkit.org/show_bug.cgi?id=88679
+
+        Reviewed by Csaba Osztrogonác.
+
+        Viewport parameters cannot be calculated while viewport is not visible and 
+        viewport size is 0, so let's delay calculation of viewport parameters until view 
+        becomes visible.
+
+        * UIProcess/qt/QtViewportHandler.cpp:
+        (WebKit::QtViewportHandler::pageContentsSizeChanged):
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri:
+        * Target.pri:
+
+2012-07-03  Alexis Menard  <alexis.menard@openbossa.org>
+
+        [Qt] When calling accept() on the FilePickerContextObject with an empty list, early return and call reject().
+        https://bugs.webkit.org/show_bug.cgi?id=89755
+
+        Reviewed by Simon Hausmann.
+
+        When calling accept with an empty list of files we can just bailout
+        and call reject(). Any other processing is pointless.
+
+       * UIProcess/API/qt/tests/qmltests/WebView/tst_singleFileUpload.qml:
+       * UIProcess/qt/QtDialogRunner.cpp:
+        (WebKit::FilePickerContextObject::accept):
+
+2012-07-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WK2] fast/viewport/viewport-91.html still fails after r121555 and r121661
+        https://bugs.webkit.org/show_bug.cgi?id=90376
+
+        Reviewed by Csaba Osztrogonác.
+
+        layoutTestController.dumpConfigurationForViewport still need
+        to use the constant target DPI of 160.
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::viewportConfigurationAsText):
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add API to deliver a Web Intent to a frame
+        https://bugs.webkit.org/show_bug.cgi?id=90067
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add ewk_view_intent_deliver() method on the Ewk_View
+        to deliver a Web Intent to the view's main frame.
+
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_intent_deliver):
+        * UIProcess/API/efl/ewk_view.h:
+
+2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add API to inspect a Web Intent service
+        https://bugs.webkit.org/show_bug.cgi?id=90066
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL API to inspect a Web Intent Service and emit
+        a signal on the view when a new intent service
+        registers.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_intent_service.cpp: Added.
+        (_Ewk_Intent_Service):
+        (ewk_intent_service_ref):
+        (ewk_intent_service_unref):
+        (ewk_intent_service_action_get):
+        (ewk_intent_service_type_get):
+        (ewk_intent_service_href_get):
+        (ewk_intent_service_title_get):
+        (ewk_intent_service_disposition_get):
+        (ewk_intent_service_new):
+        * UIProcess/API/efl/ewk_intent_service.h: Added.
+        * UIProcess/API/efl/ewk_intent_service_private.h: Copied from Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp.
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_intent_service_register):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_loader_client.cpp:
+        (registerIntentServiceForFrame):
+        (ewk_view_loader_client_attach):
+        * UIProcess/API/efl/ewk_view_private.h:
+
+2012-07-02  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Free Ewk_Intent calloc'd memory with free() instead of delete
+        https://bugs.webkit.org/show_bug.cgi?id=90433
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Free calloc'd memory with free() instead of delete in Ewk_Intent.
+        Add blank lines before return statements for consistency.
+
+        * UIProcess/API/efl/ewk_intent.cpp:
+        (ewk_intent_unref):
+        (ewk_intent_action_get):
+        (ewk_intent_type_get):
+        (ewk_intent_service_get):
+        (ewk_intent_suggestions_get):
+        (ewk_intent_extra_get):
+        (ewk_intent_extra_names_get):
+        (ewk_intent_new):
+
+2012-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [TextureMapper] The TextureMapper should support edge-distance anti-antialiasing
+        https://bugs.webkit.org/show_bug.cgi?id=90308
+
+        Reviewed by Noam Rosenthal.
+
+        * UIProcess/texmap/LayerBackingStore.cpp:
+        (WebKit::LayerBackingStore::paintToTextureMapper): Update the method to call paint with
+        the new argument.
+
+2012-07-02  Benjamin Poulain  <bpoulain@apple.com>
+
+        Do not do any logging initialization when logging is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=90228
+
+        Reviewed by Simon Fraser.
+
+        * Platform/Logging.cpp:
+        * Platform/Logging.h:
+        * UIProcess/WebContext.cpp:
+        (WebKit::WebContext::WebContext):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::WebProcess):
+
+2012-07-02  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        [Qt][WK2] New API tests introduced in r121620 fail
+        https://bugs.webkit.org/show_bug.cgi?id=90372
+
+        Reviewed by Luiz Agostini.
+
+        Updated the pixel comparison to produce more predictable results.
+
+        * UIProcess/API/qt/tests/qrawwebview/tst_qrawwebview.cpp:
+        (compareImages):
+
+2012-07-02  Alexis Menard  <alexis.menard@openbossa.org>
+
+        [Qt] Fix WebProcess crash on Mac when accessing a site with video tag.
+        https://bugs.webkit.org/show_bug.cgi?id=90384
+
+        Reviewed by Jocelyn Turcotte.
+
+        We need to initialize the private symbols used by MediaPlayerPrivateQTKit
+        otherwise they will be null and it will lead to a crash. We copy WebSystemInterface
+        files for WK2 just like the Mac port as WK2 may have different needs than WK1 layer (we
+        may add or remove symbols in here). It doesn't fix the video rendering yet but it's
+        first step.
+
+        * Target.pri:
+        * WebProcess/WebCoreSupport/qt/WebSystemInterface.h: Added.
+        * WebProcess/WebCoreSupport/qt/WebSystemInterface.mm: Added.
+        (InitWebCoreSystemInterfaceForWK2):
+        * WebProcess/qt/WebProcessMainQt.cpp:
+        (WebKit::WebProcessMainQt):
+
+2012-07-02  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
+
+        [EFL] [WK2] Remove content sniffer and decoder initialization from WebProcess
+        https://bugs.webkit.org/show_bug.cgi?id=90275
+
+        Reviewed by Martin Robinson.
+
+        Do not initialize content sniffer and decoder in the WebProcess
+        because the initialization is now done in WebCore.
+
+        * WebProcess/efl/WebProcessMainEfl.cpp:
+        (WebKit::WebProcessMainEfl):
+
+2012-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r120329, r121113, and r121138.
+        http://trac.webkit.org/changeset/120329
+        http://trac.webkit.org/changeset/121113
+        http://trac.webkit.org/changeset/121138
+        https://bugs.webkit.org/show_bug.cgi?id=90368
+
+        Introduced noticeable keyboard-related spins due to
+        synchronous IPC. (Requested by kling on #webkit).
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::handleKeyboardEvent):
+        (WebKit::WebPageProxy::didReceiveEvent):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+        * UIProcess/WebPageProxy.messages.in:
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::keyEvent):
+
+2012-07-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL][WK2] Add API to inspect a Web Intent
+        https://bugs.webkit.org/show_bug.cgi?id=89749
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add EFL API to inspect a Web Intent and emit a signal
+        on the view when a new intent request is made.
+
+        * PlatformEfl.cmake:
+        * UIProcess/API/efl/EWebKit2.h:
+        * UIProcess/API/efl/ewk_intent.cpp: Added.
+        (_Ewk_Intent):
+        (ewk_intent_ref):
+        (ewk_intent_unref):
+        (ewk_intent_action_get):
+        (ewk_intent_type_get):
+        (ewk_intent_service_get):
+        (ewk_intent_suggestions_get):
+        (ewk_intent_extra_get):
+        (ewk_intent_extra_names_get):
+        (ewk_intent_new):
+        * UIProcess/API/efl/ewk_intent.h: Added.
+        * UIProcess/API/efl/ewk_intent_private.h: Copied from Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp.
+        * UIProcess/API/efl/ewk_view.cpp:
+        (ewk_view_intent_request_new):
+        * UIProcess/API/efl/ewk_view.h:
+        * UIProcess/API/efl/ewk_view_loader_client.cpp:
+        (didReceiveIntentForFrame):
+        (ewk_view_loader_client_attach):
+        * UIProcess/API/efl/ewk_view_private.h:
+
+2012-06-29  Luiz Agostini  <luiz.agostini@nokia.com>
+
+        [Qt][WK2] Private non-QtQuick API
+        https://bugs.webkit.org/show_bug.cgi?id=84532
+
+        Reviewed by Noam Rosenthal.
+
+        Adding new private non-QtQuick API. This new C++ API makes it possible
+        to have control over the lower levels of WebKit without going via QML.
+
+        This is a first version of the API, enough to show pages on the screen.
+        Many features are not implemented.
+
+        * Target.pri:
+        * UIProcess/API/qt/raw/qrawwebview.cpp: Added.
+        * UIProcess/API/qt/raw/qrawwebview_p.h: Added.
+        * UIProcess/API/qt/raw/qrawwebview_p_p.h: Added.
+
+        The tests for the new API are pixel tests. They use QRawWebView to load
+        html files and generate images, and them compare those images to the ones
+        in UIProcess/API/qt/tests/html/resources.
+
+        * UIProcess/API/qt/tests/html/bluesquare.html: Added.
+        * UIProcess/API/qt/tests/html/redsquare.html: Added.
+        * UIProcess/API/qt/tests/html/resources/qwkview_noBackground1.png: Added.
+        * UIProcess/API/qt/tests/html/resources/qwkview_noBackground3.png: Added.
+        * UIProcess/API/qt/tests/html/resources/qwkview_paint.png: Added.
+        * UIProcess/API/qt/tests/qrawwebview/qrawwebview.pro: Added.
+        * UIProcess/API/qt/tests/qrawwebview/tst_qrawwebview.cpp: Added.
+
+2012-06-29  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Move intent delivery code from the frame to the page
+        https://bugs.webkit.org/show_bug.cgi?id=89974
+
+        Reviewed by Anders Carlsson.
+
+        Move the intent delivery code from the frame to the page
+        and add the corresponding C API for WKPage.
+
+        * UIProcess/API/C/WKPage.cpp:
+        (WKPageDeliverIntentToFrame):
+        * UIProcess/API/C/WKPage.h:
+        * UIProcess/WebFrameProxy.cpp:
+        (WebKit::WebFrameProxy::stopLoading):
+        * UIProcess/WebFrameProxy.h:
+        (WebKit):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit):
+        (WebKit::WebPageProxy::deliverIntentToFrame):
+        * UIProcess/WebPageProxy.h:
+        (WebPageProxy):
+
+2012-06-29  Dan Bernstein  <mitz@apple.com>
+
+        Can’t get basic element info from a WKRenderObject
+        https://bugs.webkit.org/show_bug.cgi?id=90301
+
+        Reviewed by Anders Carlsson.
+
+        Moved the element info (tag name, id and class names) from WebRenderLayer to WebRenderObject,
+        and gave WebRenderLayer a reference to a (shallow) WebRenderObject. Added WKRenderObject API
+        for getting element info, while leaving the WKRenderLayer API in place for now for Safari.
+
+        * Shared/API/c/WKRenderLayer.cpp:
+        (WKRenderLayerGetRenderer): Added this wrapper.
+        (WKRenderLayerCopyRendererName): Changed to get the name from the renderer.
+        (WKRenderLayerCopyElementTagName): Changed to go through the renderer.
+        (WKRenderLayerCopyElementID): Ditto.
+        (WKRenderLayerGetElementClassNames): Ditto.
+        * Shared/API/c/WKRenderLayer.h: Added declaration of WKRenderLayerGetRenderer() and comments
+        about removing older API.
+        * Shared/API/c/WKRenderObject.cpp:
+        (WKRenderObjectCopyElementTagName): Added this wrapper.
+        (WKRenderObjectCopyElementID): Ditto.
+        (WKRenderObjectGetElementClassNames): Ditto.
+        * Shared/API/c/WKRenderObject.h:
+        * Shared/UserMessageCoders.h:
+        (WebKit::UserMessageEncoder::baseEncode): Removed the element info from the encoding of
+        WebRenderLayer, and added the renderer. Added the element info to the encoding of
+        WebRenderObject.
+        (WebKit::UserMessageDecoder::baseDecode): Updated to match the encoding changes.
+        * Shared/WebRenderLayer.cpp:
+        (WebKit::WebRenderLayer::WebRenderLayer): Changed to initialize the m_renderer member
+        variable with a WebRenderObject for the layer’s renderer, and removed the initialization of
+        the element-related member variables that were removed.
+        * Shared/WebRenderLayer.h:
+        (WebKit::WebRenderLayer::create): Changed to take a renderer instead of renderer and element
+        info.
+        (WebKit::WebRenderLayer::renderer): Added this getter.
+        (WebKit::WebRenderLayer::WebRenderLayer): Changed to take a renderer instead of renderer and
+        element info.
+        * Shared/WebRenderObject.cpp:
+        (WebKit::WebRenderObject::create): Changed to pass true for the shouldIncludeDescendants
+        parameter.
+        (WebKit::WebRenderObject::WebRenderObject): Added a shouldIncludeDescdendants boolean
+        parameter. When it is false, the m_children array remains null. Added initialization of
+        member variables with the element’s tag name, id and class list.
+        * Shared/WebRenderObject.h:
+        (WebKit::WebRenderObject::create): Added an overload that takes a RenderObject and creates
+        a shallow WebRenderObject.
+        (WebRenderObject): Changed to take element tag name, id and class list.
+        (WebKit::WebRenderObject::elementTagName): Added this getter.
+        (WebKit::WebRenderObject::elementID): Ditto.
+        (WebKit::WebRenderObject::elementClassNames): Ditto.
+        (WebKit::WebRenderObject::WebRenderObject): 
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r121572.
+        http://trac.webkit.org/changeset/121572
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Breaks Mac build since it depends on r121547, which was rolled
+        out
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
+        (WebKit::NPN_GetValue):
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::shouldEraseMarkersAfterChangeSelection):
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove BUILDING_ON_LEOPARD now that no ports build on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90249
+
+        Reviewed by Ryosuke Niwa.
+
+        * WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
+        (WebKit::NPN_GetValue):
+        * WebProcess/WebCoreSupport/WebEditorClient.cpp:
+        (WebKit::WebEditorClient::shouldEraseMarkersAfterChangeSelection):
+        * WebProcess/WebCoreSupport/WebEditorClient.h:
+
+2012-06-29  Konrad Piascik  <kpiascik@rim.com>
+
+        Don't hardcode target dpi of 160 (it should be 96 on desktop)
+        https://bugs.webkit.org/show_bug.cgi?id=88114
+
+        Reviewed by Adam Barth.
+
+        Updated the call to computeViewportAttributes.
+
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::sendViewportAttributesChanged):
+        (WebKit::WebPage::viewportConfigurationAsText):
+
+2012-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121529.
+        http://trac.webkit.org/changeset/121529
+        https://bugs.webkit.org/show_bug.cgi?id=90260
+
+        Failed to compile on Chromium WebKitMacBuilder (Requested by
+        keishi on #webkit).
+
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]):
+        (-[WKFullScreenWindowController beganExitFullScreenWithInitialFrame:WebCore::finalFrame:WebCore::]):
+        * WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm:
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-06-29  Eric Seidel  <eric@webkit.org>
+
+        Remove more BUILDING_ON_LEOPARD branches now that no port builds on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=90252
+
+        Reviewed by Ryosuke Niwa.
+
+        * UIProcess/mac/WKFullScreenWindowController.mm:
+        (-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]):
+        (-[WKFullScreenWindowController beganExitFullScreenWithInitialFrame:WebCore::finalFrame:WebCore::]):
+        * WebProcess/Plugins/Netscape/mac/NetscapeSandboxFunctions.mm:
+        * WebProcess/WebCoreSupport/mac/WebSystemInterface.mm:
+        (InitWebCoreSystemInterface):
+
+2012-06-28  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] NodeRenderingContext ctor could be built on top of the ComposedShadowTreeWalker
+        https://bugs.webkit.org/show_bug.cgi?id=89732
+
+        Reviewed by Dimitri Glazkov.
+
+        * win/WebKit2.def:
+        * win/WebKit2CFLite.def:
+
+2012-06-28  John Sullivan  <sullivan@apple.com>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=90216>
+        <rdar://problem/11766518>
+        Undo handling in WebKit2 is not robust against some page-closing code paths
+
+        Reviewed by Enrica Casucci.
+
+        * UIProcess/API/mac/PageClientImpl.h:
+        Declared public function viewWillMoveToAnotherWindow().
+        
+        * UIProcess/API/mac/PageClientImpl.mm:
+        (WebKit::PageClientImpl::viewWillMoveToAnotherWindow):
+        New function, calls clearAllEditCommands() to remove any Undo actions from the stack.
+        This guarantees that no Undo actions will be abandoned when the PageClientImpl is dealloc'ed.
+
+        * UIProcess/API/mac/WKView.mm:
+        (-[WKView viewWillMoveToWindow:]):
+        Now informs PageClientImpl via new function PageClientImpl::viewWillMoveToAnotherWindow().
+
+2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2] Add C API to inspect a Web Intent service
+        https://bugs.webkit.org/show_bug.cgi?id=89276
+
+        Reviewed by Anders Carlsson.
+
+        Add C API for Web intent service so that it can be queried
+        on client side.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * UIProcess/API/C/WKIntentServiceInfo.cpp: Added.
+        (WKIntentServiceInfoGetTypeID):
+        (WKIntentServiceInfoCopyAction):
+        (WKIntentServiceInfoCopyType):
+        (WKIntentServiceInfoCopyHref):
+        (WKIntentServiceInfoCopyTitle):
+        (WKIntentServiceInfoCopyDisposition):
+        * UIProcess/API/C/WKIntentServiceInfo.h: Added.
+
+2012-06-28  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt] KURL assert at fast/loader/opaque-base-url.html
+        https://bugs.webkit.org/show_bug.cgi?id=89468
+
+        Reviewed by Simon Hausmann.
+
+        Don't use the KURL(ParsedURLStringTag, const String&) constructor.
+        We cannot be sure that the url in encode was valid and even if it
+        was the message could have been corrupted.
+        * Shared/qt/WebCoreArgumentCodersQt.cpp:
+        (CoreIPC::::encode):
+        (CoreIPC::::decode):
+
+2012-06-27  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix the build without TEXTURE_MAPPER_GL.
+
+        * WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp:
+        * WebProcess/WebPage/gtk/LayerTreeHostGtk.h:
+        * WebProcess/WebPage/gtk/WebPageGtk.cpp:
+        (WebKit::WebPage::platformInitialize):
+
+2012-06-25  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        JSLock should be per-JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=89123
+
+        Reviewed by Geoffrey Garen.
+
+        Changed all sites that used JSLock to instead use the new JSLockHolder
+        and pass in the correct JS context that the code is about to interact with that 
+        needs protection. Also added a couple JSLocks to places that didn't already 
+        have it that needed it.
+
+        * Shared/mac/WebMemorySampler.mac.mm:
+        (WebKit::WebMemorySampler::sampleWebKit):
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::javaScriptObjectsCount):
+        (WebKit::InjectedBundle::reportException):
+        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
+        (WebKit::JSNPObject::callMethod):
+        (WebKit::JSNPObject::callObject):
+        (WebKit::JSNPObject::callConstructor):
+        (WebKit::JSNPObject::put):
+        (WebKit::JSNPObject::deleteProperty):
+        (WebKit::JSNPObject::getOwnPropertyNames):
+        (WebKit::JSNPObject::propertyGetter):
+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
+        (WebKit::NPJSObject::hasMethod):
+        (WebKit::NPJSObject::invoke):
+        (WebKit::NPJSObject::invokeDefault):
+        (WebKit::NPJSObject::hasProperty):
+        (WebKit::NPJSObject::getProperty):
+        (WebKit::NPJSObject::setProperty):
+        (WebKit::NPJSObject::removeProperty):
+        (WebKit::NPJSObject::enumerate):
+        (WebKit::NPJSObject::construct):
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::convertJSValueToNPVariant):
+        (WebKit::NPRuntimeObjectMap::evaluate):
+        (WebKit::NPRuntimeObjectMap::moveGlobalExceptionToExecState):
+        * WebProcess/WebPage/WebFrame.cpp:
+        (WebKit::WebFrame::jsWrapperForWorld):
+        (WebKit::WebFrame::computedStyleIncludingVisitedInfo):
+        * WebProcess/WebPage/WebPage.cpp:
+        (WebKit::WebPage::runJavaScriptInMainFrame):
+        * WebProcess/WebProcess.cpp:
+        (WebKit::WebProcess::getWebCoreStatistics):
+
+2012-06-27  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        REGRESSION(r121135): It made qmltests::WebViewColorChooser::test_accept() fail
+        https://bugs.webkit.org/show_bug.cgi?id=89871
+
+        Reviewed by Simon Hausmann.
+
+        Added proper event synchronization to the test case.
+
+        * UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml:
+
+2012-06-27  Brady Eidson  <beidson@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=87513
+        WebBackForwardList needs an overhaul to consistently and clearly handle error conditions.
+
+        Reviewed by Darin Adler.
+
+        - We think a null entry might somehow be getting in the list so we now try to prevent that.
+        - We think a null entry might somehow be in the list so we now null check when indexing into m_entries.
+        - A lot of index math - especially tracking "no current index" - was implicit or wrong.
+        - Operating on a WebBackForwardList whose page has been closed is now an explicit no-op.
+        - The session state data reading and writing code was fragile and needed an overhaul.
+        - This includes adding a new V1 format of the session data that is easier to validate when reading back in.
+
+        * UIProcess/WebBackForwardList.cpp:
+        (WebKit::WebBackForwardList::~WebBackForwardList):
+        (WebKit::WebBackForwardList::pageClosed):
+        (WebKit::WebBackForwardList::addItem):
+        (WebKit::WebBackForwardList::goToItem):
+        (WebKit::WebBackForwardList::backListCount):
+        (WebKit::WebBackForwardList::forwardListCount):
+        (WebKit::WebBackForwardList::backListAsImmutableArrayWithLimit):
+        (WebKit::WebBackForwardList::forwardListAsImmutableArrayWithLimit):
+        (WebKit::WebBackForwardList::clear):
+
+        * UIProcess/WebBackForwardList.h:
+        (WebBackForwardList):
+
+        * UIProcess/cf/WebBackForwardListCF.cpp:
+        (WebKit::createEmptySessionHistoryDictionary):
+        (WebKit::WebBackForwardList::createCFDictionaryRepresentation):
+        (WebKit::WebBackForwardList::restoreFromCFDictionaryRepresentation):
+        (WebKit::WebBackForwardList::restoreFromV0CFDictionaryRepresentation):
+        (WebKit::WebBackForwardList::restoreFromV1CFDictionaryRepresentation):
+        (WebKit::extractBackForwardListEntriesFromArray):
+
+2012-06-27  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=87503
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add the Gamepad feature dependencies libraries to the LIBADD
+        list for the libwebkitgtk2 library.
+
+        * GNUmakefile.am:
+
 2012-06-26  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Avoid use of deprecated Qt API
diff --git a/Source/WebKit2/Configurations/FeatureDefines.xcconfig b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
index b1b84966d..7f95c3018 100644
--- a/Source/WebKit2/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebKit2/Configurations/FeatureDefines.xcconfig
@@ -52,11 +52,11 @@ ENABLE_DATALIST = ;
 ENABLE_DATA_TRANSFER_ITEMS = ;
 ENABLE_DETAILS = ENABLE_DETAILS;
 ENABLE_DEVICE_ORIENTATION = ;
+ENABLE_DIALOG_ELEMENT = ;
 ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_FILE_SYSTEM = ;
 ENABLE_FILTERS = $(ENABLE_FILTERS_$(REAL_PLATFORM_NAME));
 ENABLE_FILTERS_macosx = ENABLE_FILTERS;
-ENABLE_FONT_BOOSTING = ;
 ENABLE_FULLSCREEN_API = ENABLE_FULLSCREEN_API;
 ENABLE_GAMEPAD = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
@@ -120,6 +120,7 @@ ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_DOM_OBJC_BINDINGS = $(ENABLE_SVG_DOM_OBJC_BINDINGS_$(REAL_PLATFORM_NAME));
 ENABLE_SVG_DOM_OBJC_BINDINGS_macosx = ENABLE_SVG_DOM_OBJC_BINDINGS;
 ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
+ENABLE_TEXT_AUTOSIZING = ;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_UNDO_MANAGER = ;
@@ -133,4 +134,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FONT_BOOSTING) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CSP_NEXT) $(ENABLE_CSS3_FLEXBOX) $(ENABLE_CSS_BOX_DECORATION_BREAK) $(ENABLE_CSS_EXCLUSIONS) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_IMAGE_RESOLUTION) $(ENABLE_CSS_REGIONS) $(ENABLE_CSS_SHADERS) $(ENABLE_CSS_VARIABLES) $(ENABLE_CUSTOM_SCHEME_HANDLER) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIALOG_ELEMENT) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_HIGH_DPI_CANVAS) $(ENABLE_ICONDATABASE) $(ENABLE_IFRAME_SEAMLESS) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_TYPE_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_CSS_VENDOR_PREFIXES) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_LINK_PRERENDER) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_AUTOSIZING) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_UNDO_MANAGER) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebKit2/DerivedSources.pri b/Source/WebKit2/DerivedSources.pri
index 319bf7e14..42fa6657a 100644
--- a/Source/WebKit2/DerivedSources.pri
+++ b/Source/WebKit2/DerivedSources.pri
@@ -11,8 +11,6 @@
 sanitizedFile = $$toSanitizedPath($$_FILE_)
 equals(sanitizedFile, $$toSanitizedPath($$_PRO_FILE_)):TEMPLATE = derived
 
-load(features)
-
 WEBCORE_GENERATED_SOURCES_DIR = ../WebCore/$${GENERATED_SOURCES_DESTDIR}
 
 SOURCE_DIR = $${ROOT_WEBKIT_DIR}/Source
@@ -40,12 +38,14 @@ VPATH = \
     PluginProcess \
     WebProcess/ApplicationCache \
     WebProcess/Authentication \
+    WebProcess/Battery \
     WebProcess/Cookies \
     WebProcess/FullScreen \
     WebProcess/Geolocation \
     WebProcess/IconDatabase \
     WebProcess/KeyValueStorage \
     WebProcess/MediaCache \
+    WebProcess/NetworkInfo \
     WebProcess/Notifications \
     WebProcess/Plugins \
     WebProcess/ResourceCache \
@@ -71,6 +71,8 @@ MESSAGE_RECEIVERS = \
     PluginProxy.messages.in \
     WebApplicationCacheManager.messages.in \
     WebApplicationCacheManagerProxy.messages.in \
+    WebBatteryManager.messages.in \
+    WebBatteryManagerProxy.messages.in \
     WebContext.messages.in \
     WebCookieManager.messages.in \
     WebCookieManagerProxy.messages.in \
@@ -85,6 +87,8 @@ MESSAGE_RECEIVERS = \
     WebKeyValueStorageManagerProxy.messages.in \
     WebMediaCacheManager.messages.in \
     WebMediaCacheManagerProxy.messages.in \
+    WebNetworkInfoManager.messages.in \
+    WebNetworkInfoManagerProxy.messages.in \
     WebNotificationManagerProxy.messages.in \
     WebNotificationManager.messages.in \
     WebFullScreenManager.messages.in \
@@ -99,6 +103,7 @@ MESSAGE_RECEIVERS = \
     WebProcessProxy.messages.in \
     WebResourceCacheManager.messages.in \
     WebResourceCacheManagerProxy.messages.in \
+    WebVibrationProxy.messages.in \
     NPObjectMessageReceiver.messages.in
 
 SCRIPTS = \
diff --git a/Source/WebKit2/GNUmakefile.am b/Source/WebKit2/GNUmakefile.am
index 016d68197..b0c0724da 100644
--- a/Source/WebKit2/GNUmakefile.am
+++ b/Source/WebKit2/GNUmakefile.am
@@ -59,6 +59,7 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CPP
 	-I$(srcdir)/Source/WebKit2/WebProcess \
 	-I$(srcdir)/Source/WebKit2/WebProcess/ApplicationCache \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Authentication \
+	-I$(srcdir)/Source/WebKit2/WebProcess/Battery \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Cookies \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Downloads \
 	-I$(srcdir)/Source/WebKit2/WebProcess/FullScreen \
@@ -73,6 +74,7 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CPP
 	-I$(srcdir)/Source/WebKit2/WebProcess/KeyValueStorage \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Launching \
 	-I$(srcdir)/Source/WebKit2/WebProcess/MediaCache \
+	-I$(srcdir)/Source/WebKit2/WebProcess/NetworkInfo \
 	-I$(srcdir)/Source/WebKit2/WebProcess/Notifications \
 	-I$(srcdir)/Source/WebKit2/WebProcess/ResourceCache \
 	-I$(srcdir)/Source/WebKit2/WebProcess/soup \
@@ -160,6 +162,7 @@ libwebkit2gtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_LIB
 	$(COVERAGE_LDFLAGS) \
 	$(ENCHANT_LIBS) \
 	$(GAIL_LIBS) \
+	$(GAMEPAD_LIBS) \
 	$(GEOCLUE_LIBS) \
 	$(GLIB_LIBS) \
 	$(GSTREAMER_LIBS) \
@@ -210,12 +213,14 @@ vpath %.messages.in = \
 	$(WebKit2)/WebProcess \
 	$(WebKit2)/WebProcess/ApplicationCache \
 	$(WebKit2)/WebProcess/Authentication \
+	$(WebKit2)/WebProcess/Battery \
 	$(WebKit2)/WebProcess/Cookies \
 	$(WebKit2)/WebProcess/FullScreen \
 	$(WebKit2)/WebProcess/Geolocation \
 	$(WebKit2)/WebProcess/IconDatabase \
 	$(WebKit2)/WebProcess/KeyValueStorage \
 	$(WebKit2)/WebProcess/MediaCache \
+	$(WebKit2)/WebProcess/NetworkInfo \
 	$(WebKit2)/WebProcess/Notifications \
 	$(WebKit2)/WebProcess/Plugins \
 	$(WebKit2)/WebProcess/ResourceCache \
@@ -512,12 +517,14 @@ EXTRA_DIST += \
 	$(shell ls $(WebKit2)/WebProcess/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/ApplicationCache/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/Authentication/*.in) \
+	$(shell ls $(WebKit2)/WebProcess/Battery/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/Cookies/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/FullScreen/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/Geolocation/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/IconDatabase/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/KeyValueStorage/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/MediaCache/*.in) \
+	$(shell ls $(WebKit2)/WebProcess/NetworkInfo/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/Notifications/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/Plugins/*.in) \
 	$(shell ls $(WebKit2)/WebProcess/ResourceCache/*.in) \
diff --git a/Source/WebKit2/GNUmakefile.list.am b/Source/WebKit2/GNUmakefile.list.am
index 836dad601..d420afa22 100644
--- a/Source/WebKit2/GNUmakefile.list.am
+++ b/Source/WebKit2/GNUmakefile.list.am
@@ -47,6 +47,8 @@ webkit2_h_api += \
 	$(WebKit2)/UIProcess/API/C/WKAuthenticationDecisionListener.h \
 	$(WebKit2)/UIProcess/API/C/WKBackForwardList.h \
 	$(WebKit2)/UIProcess/API/C/WKBackForwardListItem.h \
+	$(WebKit2)/UIProcess/API/C/WKBatteryManager.h \
+	$(WebKit2)/UIProcess/API/C/WKBatteryStatus.h \
 	$(WebKit2)/UIProcess/API/C/WKContext.h \
 	$(WebKit2)/UIProcess/API/C/WKContextPrivate.h \
 	$(WebKit2)/UIProcess/API/C/WKCookieManager.h \
@@ -64,10 +66,12 @@ webkit2_h_api += \
 	$(WebKit2)/UIProcess/API/C/WKHitTestResult.h \
 	$(WebKit2)/UIProcess/API/C/WKInspector.h \
 	$(WebKit2)/UIProcess/API/C/WKIntentData.h \
+	$(WebKit2)/UIProcess/API/C/WKIntentServiceInfo.h \
 	$(WebKit2)/UIProcess/API/C/WKKeyValueStorageManager.h \
 	$(WebKit2)/UIProcess/API/C/WKMediaCacheManager.h \
 	$(WebKit2)/UIProcess/API/C/WKNativeEvent.h \
 	$(WebKit2)/UIProcess/API/C/WKNavigationData.h \
+	$(WebKit2)/UIProcess/API/C/WKNetworkInfoManager.h \
 	$(WebKit2)/UIProcess/API/C/WKNotification.h \
 	$(WebKit2)/UIProcess/API/C/WKNotificationManager.h \
 	$(WebKit2)/UIProcess/API/C/WKNotificationPermissionRequest.h \
@@ -84,6 +88,7 @@ webkit2_h_api += \
 	$(WebKit2)/UIProcess/API/C/WKProtectionSpaceTypes.h \
 	$(WebKit2)/UIProcess/API/C/WKResourceCacheManager.h \
 	$(WebKit2)/UIProcess/API/C/WKTextChecker.h \
+	$(WebKit2)/UIProcess/API/C/WKVibration.cpp \
 	$(WebKit2)/UIProcess/API/cpp/WKRetainPtr.h
 
 webkit2gtk_h_api += \
@@ -151,6 +156,10 @@ webkit2_built_sources += \
 	DerivedSources/WebKit2/WebApplicationCacheManagerMessages.h \
 	DerivedSources/WebKit2/WebApplicationCacheManagerProxyMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebApplicationCacheManagerProxyMessages.h \
+	DerivedSources/WebKit2/WebBatteryManagerMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebBatteryManagerMessages.h \
+	DerivedSources/WebKit2/WebBatteryManagerProxyMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebBatteryManagerProxyMessages.h \
 	DerivedSources/WebKit2/WebContextMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebContextMessages.h \
 	DerivedSources/WebKit2/WebCookieManagerMessageReceiver.cpp \
@@ -185,6 +194,10 @@ webkit2_built_sources += \
 	DerivedSources/WebKit2/WebMediaCacheManagerMessages.h \
 	DerivedSources/WebKit2/WebMediaCacheManagerProxyMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebMediaCacheManagerProxyMessages.h \
+	DerivedSources/WebKit2/WebNetworkInfoManagerMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebNetworkInfoManagerMessages.h \
+	DerivedSources/WebKit2/WebNetworkInfoManagerProxyMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebNetworkInfoManagerProxyMessages.h \
 	DerivedSources/WebKit2/WebNotificationManagerMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebNotificationManagerMessages.h \
 	DerivedSources/WebKit2/WebNotificationManagerProxyMessageReceiver.cpp \
@@ -206,7 +219,9 @@ webkit2_built_sources += \
 	DerivedSources/WebKit2/WebSoupRequestManagerMessageReceiver.cpp \
 	DerivedSources/WebKit2/WebSoupRequestManagerMessages.h \
 	DerivedSources/WebKit2/WebSoupRequestManagerProxyMessageReceiver.cpp \
-	DerivedSources/WebKit2/WebSoupRequestManagerProxyMessages.h
+	DerivedSources/WebKit2/WebSoupRequestManagerProxyMessages.h \
+	DerivedSources/WebKit2/WebVibrationProxyMessageReceiver.cpp \
+	DerivedSources/WebKit2/WebVibrationProxyMessages.h
 
 webkit2gtk_built_sources += \
 	DerivedSources/WebKit2/webkit2gtk/webkit2/WebKitEnumTypes.cpp \
@@ -420,6 +435,8 @@ webkit2_sources += \
 	Source/WebKit2/Shared/VisitedLinkTable.h \
 	Source/WebKit2/Shared/WebBackForwardListItem.cpp \
 	Source/WebKit2/Shared/WebBackForwardListItem.h \
+	Source/WebKit2/Shared/WebBatteryStatus.cpp \
+	Source/WebKit2/Shared/WebBatteryStatus.h \
 	Source/WebKit2/Shared/WebCertificateInfo.h \
 	Source/WebKit2/Shared/WebConnection.cpp \
 	Source/WebKit2/Shared/WebConnection.h \
@@ -451,6 +468,7 @@ webkit2_sources += \
 	Source/WebKit2/Shared/WebKeyboardEvent.cpp \
 	Source/WebKit2/Shared/WebMouseEvent.cpp \
 	Source/WebKit2/Shared/WebNavigationDataStore.h \
+	Source/WebKit2/Shared/WebNetworkInfo.h \
 	Source/WebKit2/Shared/WebNumber.h \
 	Source/WebKit2/Shared/WebOpenPanelParameters.cpp \
 	Source/WebKit2/Shared/WebOpenPanelParameters.h \
@@ -504,6 +522,10 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/C/WKBackForwardList.h \
 	Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.cpp \
 	Source/WebKit2/UIProcess/API/C/WKBackForwardListItem.h \
+	Source/WebKit2/UIProcess/API/C/WKBatteryManager.cpp \
+	Source/WebKit2/UIProcess/API/C/WKBatteryManager.h \
+	Source/WebKit2/UIProcess/API/C/WKBatteryStatus.cpp \
+	Source/WebKit2/UIProcess/API/C/WKBatteryStatus.h \
 	Source/WebKit2/UIProcess/API/C/WKContext.cpp \
 	Source/WebKit2/UIProcess/API/C/WKContext.h \
 	Source/WebKit2/UIProcess/API/C/WKContextPrivate.h \
@@ -538,6 +560,8 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/C/WKInspector.h \
 	Source/WebKit2/UIProcess/API/C/WKIntentData.cpp \
 	Source/WebKit2/UIProcess/API/C/WKIntentData.h \
+	Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.cpp \
+	Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.h \
 	Source/WebKit2/UIProcess/API/C/WKKeyValueStorageManager.cpp \
 	Source/WebKit2/UIProcess/API/C/WKKeyValueStorageManager.h \
 	Source/WebKit2/UIProcess/API/C/WKMediaCacheManager.cpp \
@@ -545,6 +569,8 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/C/WKNativeEvent.h \
 	Source/WebKit2/UIProcess/API/C/WKNavigationData.cpp \
 	Source/WebKit2/UIProcess/API/C/WKNavigationData.h \
+	Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.cpp \
+	Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.h \
 	Source/WebKit2/UIProcess/API/C/WKNotification.cpp \
 	Source/WebKit2/UIProcess/API/C/WKNotification.h \
 	Source/WebKit2/UIProcess/API/C/WKNotificationManager.cpp \
@@ -573,6 +599,8 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/API/C/WKResourceCacheManager.cpp \
 	Source/WebKit2/UIProcess/API/C/WKTextChecker.h \
 	Source/WebKit2/UIProcess/API/C/WKTextChecker.cpp \
+	Source/WebKit2/UIProcess/API/C/WKVibration.cpp \
+	Source/WebKit2/UIProcess/API/C/WKVibration.h \
 	Source/WebKit2/UIProcess/API/cpp/WKRetainPtr.h \
 	Source/WebKit2/UIProcess/API/gtk/PageClientImpl.h \
 	Source/WebKit2/UIProcess/API/gtk/PageClientImpl.cpp \
@@ -771,6 +799,10 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/WebApplicationCacheManagerProxy.cpp \
 	Source/WebKit2/UIProcess/WebBackForwardList.cpp \
 	Source/WebKit2/UIProcess/WebBackForwardList.h \
+	Source/WebKit2/UIProcess/WebBatteryManagerProxy.cpp \
+	Source/WebKit2/UIProcess/WebBatteryManagerProxy.h \
+	Source/WebKit2/UIProcess/WebBatteryProvider.cpp \
+	Source/WebKit2/UIProcess/WebBatteryProvider.h \
 	Source/WebKit2/UIProcess/WebColorChooserProxy.h \
 	Source/WebKit2/UIProcess/WebConnectionToWebProcess.cpp \
 	Source/WebKit2/UIProcess/WebConnectionToWebProcess.h \
@@ -835,6 +867,10 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/WebLoaderClient.h \
 	Source/WebKit2/UIProcess/WebNavigationData.cpp \
 	Source/WebKit2/UIProcess/WebNavigationData.h \
+	Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.cpp \
+	Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.h \
+	Source/WebKit2/UIProcess/WebNetworkInfoProvider.cpp \
+	Source/WebKit2/UIProcess/WebNetworkInfoProvider.h \
 	Source/WebKit2/UIProcess/WebOpenPanelResultListenerProxy.cpp \
 	Source/WebKit2/UIProcess/WebOpenPanelResultListenerProxy.h \
 	Source/WebKit2/UIProcess/WebPageContextMenuClient.cpp \
@@ -860,11 +896,17 @@ webkit2_sources += \
 	Source/WebKit2/UIProcess/WebTextCheckerClient.h \
 	Source/WebKit2/UIProcess/WebUIClient.cpp \
 	Source/WebKit2/UIProcess/WebUIClient.h \
+	Source/WebKit2/UIProcess/WebVibrationProvider.cpp \
+	Source/WebKit2/UIProcess/WebVibrationProvider.h \
+	Source/WebKit2/UIProcess/WebVibrationProxy.cpp \
+	Source/WebKit2/UIProcess/WebVibrationProxy.h \
 	Source/WebKit2/WebKit2Prefix.h \
 	Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.h \
 	Source/WebKit2/WebProcess/ApplicationCache/WebApplicationCacheManager.cpp \
 	Source/WebKit2/WebProcess/Authentication/AuthenticationManager.cpp \
 	Source/WebKit2/WebProcess/Authentication/AuthenticationManager.h \
+	Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp \
+	Source/WebKit2/WebProcess/Battery/WebBatteryManager.h \
 	Source/WebKit2/WebProcess/Cookies/WebCookieManager.h \
 	Source/WebKit2/WebProcess/Cookies/WebCookieManager.cpp \
 	Source/WebKit2/WebProcess/Cookies/soup/WebCookieManagerSoup.cpp \
@@ -963,6 +1005,8 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/KeyValueStorage/WebKeyValueStorageManager.h \
 	Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.cpp \
 	Source/WebKit2/WebProcess/MediaCache/WebMediaCacheManager.h \
+	Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp \
+	Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h \
 	Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.cpp \
 	Source/WebKit2/WebProcess/Notifications/NotificationPermissionRequestManager.h \
 	Source/WebKit2/WebProcess/Notifications/WebNotificationManager.cpp \
@@ -1013,6 +1057,8 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebAlternativeTextClient.h \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.cpp \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebColorChooser.cpp \
@@ -1034,6 +1080,8 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorClient.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebInspectorFrontendClient.h \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.cpp \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebNotificationClient.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp \
@@ -1042,6 +1090,8 @@ webkit2_sources += \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebPopupMenu.h \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp \
 	Source/WebKit2/WebProcess/WebCoreSupport/WebSearchPopupMenu.h \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.cpp \
+	Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.h \
 	Source/WebKit2/WebProcess/WebPage/DecoderAdapter.cpp \
 	Source/WebKit2/WebProcess/WebPage/DecoderAdapter.h \
 	Source/WebKit2/WebProcess/WebPage/DrawingArea.cpp \
diff --git a/Source/WebKit2/Platform/CoreIPC/MessageID.h b/Source/WebKit2/Platform/CoreIPC/MessageID.h
index d923a1be2..22d306b04 100644
--- a/Source/WebKit2/Platform/CoreIPC/MessageID.h
+++ b/Source/WebKit2/Platform/CoreIPC/MessageID.h
@@ -40,6 +40,7 @@ enum MessageClass {
     MessageClassInjectedBundle,
     MessageClassLayerTreeCoordinator,
     MessageClassWebApplicationCacheManager,
+    MessageClassWebBatteryManagerProxy,
     MessageClassWebCookieManager,
     MessageClassWebDatabaseManager,
     MessageClassWebFullScreenManager,
@@ -48,6 +49,7 @@ enum MessageClass {
     MessageClassWebInspector,
     MessageClassWebKeyValueStorageManager,
     MessageClassWebMediaCacheManager,
+    MessageClassWebNetworkInfoManagerProxy,
     MessageClassWebNotificationManager,
     MessageClassWebPage,
     MessageClassWebProcess,
@@ -62,6 +64,7 @@ enum MessageClass {
     MessageClassDrawingAreaProxy,
     MessageClassLayerTreeCoordinatorProxy,
     MessageClassWebApplicationCacheManagerProxy,
+    MessageClassWebBatteryManager,
     MessageClassWebContext,
     MessageClassWebContextLegacy,
     MessageClassWebCookieManagerProxy,
@@ -72,6 +75,7 @@ enum MessageClass {
     MessageClassWebInspectorProxy,
     MessageClassWebKeyValueStorageManagerProxy,
     MessageClassWebMediaCacheManagerProxy,
+    MessageClassWebNetworkInfoManager,
     MessageClassWebNotificationManagerProxy,
     MessageClassWebPageProxy,
     MessageClassWebProcessProxy,
@@ -79,6 +83,7 @@ enum MessageClass {
 #if USE(SOUP)
     MessageClassWebSoupRequestManagerProxy,
 #endif
+    MessageClassWebVibrationProxy,
 
     // Messages sent to a WebConnection
     MessageClassWebConnectionLegacy,
diff --git a/Source/WebKit2/Platform/Logging.cpp b/Source/WebKit2/Platform/Logging.cpp
index f2318ecec..33b463743 100644
--- a/Source/WebKit2/Platform/Logging.cpp
+++ b/Source/WebKit2/Platform/Logging.cpp
@@ -90,4 +90,4 @@ void initializeLogChannelsIfNecessary()
 
 } // namespace WebKit
 
-#endif // LOG_DISABLED
+#endif // !LOG_DISABLED
diff --git a/Source/WebKit2/Platform/Logging.h b/Source/WebKit2/Platform/Logging.h
index 06f96091c..c47bfff6e 100644
--- a/Source/WebKit2/Platform/Logging.h
+++ b/Source/WebKit2/Platform/Logging.h
@@ -52,6 +52,6 @@ WTFLogChannel* getChannelFromName(const String& channelName);
 
 } // namespace WebKit
 
-#endif // LOG_DISABLED
+#endif // !LOG_DISABLED
 
 #endif // Logging_h
diff --git a/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp b/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp
index 3a39ba9ed..41ffedf53 100644
--- a/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp
+++ b/Source/WebKit2/Platform/efl/WorkQueueEfl.cpp
@@ -167,7 +167,7 @@ bool WorkQueue::timerFired(void* data)
 
 void WorkQueue::dispatchAfterDelay(const Function<void()>& function, double delay)
 {
-    static int timerId = 0;
+    static int timerId = 1;
     m_timers.set(timerId, adoptPtr(ecore_timer_add(delay, reinterpret_cast<Ecore_Task_Cb>(timerFired), new TimerWorkItem(timerId, function, this))));
     timerId++;
 }
diff --git a/Source/WebKit2/PlatformEfl.cmake b/Source/WebKit2/PlatformEfl.cmake
index 5f6e09e3a..bd07c3b39 100644
--- a/Source/WebKit2/PlatformEfl.cmake
+++ b/Source/WebKit2/PlatformEfl.cmake
@@ -14,6 +14,8 @@ LIST(APPEND WebKit2_SOURCES
     Platform/CoreIPC/unix/ConnectionUnix.cpp
     Platform/CoreIPC/unix/AttachmentUnix.cpp
 
+    Shared/API/c/cairo/WKImageCairo.cpp
+
     Shared/API/c/gtk/WKGraphicsContextGtk.cpp
 
     Shared/cairo/LayerTreeContextCairo.cpp
@@ -30,10 +32,17 @@ LIST(APPEND WebKit2_SOURCES
     UIProcess/API/C/soup/WKContextSoup.cpp
     UIProcess/API/C/soup/WKSoupRequestManager.cpp
 
+    UIProcess/API/efl/BatteryProvider.cpp
     UIProcess/API/efl/PageClientImpl.cpp
     UIProcess/API/efl/ewk_context.cpp
+    UIProcess/API/efl/ewk_intent.cpp
+    UIProcess/API/efl/ewk_intent_service.cpp
+    UIProcess/API/efl/ewk_url_request.cpp
     UIProcess/API/efl/ewk_view.cpp
     UIProcess/API/efl/ewk_view_loader_client.cpp
+    UIProcess/API/efl/ewk_view_resource_load_client.cpp
+    UIProcess/API/efl/ewk_web_error.cpp
+    UIProcess/API/efl/ewk_web_resource.cpp
 
     UIProcess/cairo/BackingStoreCairo.cpp
 
diff --git a/Source/WebKit2/PluginProcess/mac/add-entitlements.sh b/Source/WebKit2/PluginProcess/mac/add-entitlements.sh
index 825695a2b..9d2420373 100755
--- a/Source/WebKit2/PluginProcess/mac/add-entitlements.sh
+++ b/Source/WebKit2/PluginProcess/mac/add-entitlements.sh
@@ -32,4 +32,8 @@ if [[ $needs_signing == 0 ]]; then
     exit
 fi
 
+if [ ! $CODESIGN_ALLOCATE ]; then
+    export CODESIGN_ALLOCATE=$(xcrun -find codesign_allocate)
+fi
+
 codesign -f -s - --entitlements "${entitlement_file}" "${app_path}"
diff --git a/Source/WebKit2/Shared/API/c/WKBase.h b/Source/WebKit2/Shared/API/c/WKBase.h
index 8b7e81fbc..3f707bace 100644
--- a/Source/WebKit2/Shared/API/c/WKBase.h
+++ b/Source/WebKit2/Shared/API/c/WKBase.h
@@ -86,6 +86,8 @@ typedef const struct OpaqueWKAuthenticationChallenge* WKAuthenticationChallengeR
 typedef const struct OpaqueWKAuthenticationDecisionListener* WKAuthenticationDecisionListenerRef;
 typedef const struct OpaqueWKBackForwardList* WKBackForwardListRef;
 typedef const struct OpaqueWKBackForwardListItem* WKBackForwardListItemRef;
+typedef const struct OpaqueWKBatteryManager* WKBatteryManagerRef;
+typedef const struct OpaqueWKBatteryStatus* WKBatteryStatusRef;
 typedef const struct OpaqueWKResourceCacheManager* WKResourceCacheManagerRef;
 typedef const struct OpaqueWKContext* WKContextRef;
 typedef const struct OpaqueWKCookieManager* WKCookieManagerRef;
@@ -107,6 +109,8 @@ typedef const struct OpaqueWKIntentServiceInfo* WKIntentServiceInfoRef;
 typedef const struct OpaqueWKKeyValueStorageManager* WKKeyValueStorageManagerRef;
 typedef const struct OpaqueWKMediaCacheManager* WKMediaCacheManagerRef;
 typedef const struct OpaqueWKNavigationData* WKNavigationDataRef;
+typedef const struct OpaqueWKNetworkInfoManager* WKNetworkInfoManagerRef;
+typedef const struct OpaqueWKNetworkInfo* WKNetworkInfoRef;
 typedef const struct OpaqueWKNotification* WKNotificationRef;
 typedef const struct OpaqueWKNotificationManager* WKNotificationManagerRef;
 typedef const struct OpaqueWKNotificationPermissionRequest* WKNotificationPermissionRequestRef;
@@ -119,6 +123,7 @@ typedef const struct OpaqueWKPluginSiteDataManager* WKPluginSiteDataManagerRef;
 typedef const struct OpaqueWKPreferences* WKPreferencesRef;
 typedef const struct OpaqueWKProtectionSpace* WKProtectionSpaceRef;
 typedef const struct OpaqueWKTextChecker* WKTextCheckerRef;
+typedef const struct OpaqueWKVibration* WKVibrationRef;
 
 /* WebKit2 Bundle types */
 
diff --git a/Source/WebKit2/Shared/API/c/WKRenderLayer.cpp b/Source/WebKit2/Shared/API/c/WKRenderLayer.cpp
index 7c2765100..82cf959be 100644
--- a/Source/WebKit2/Shared/API/c/WKRenderLayer.cpp
+++ b/Source/WebKit2/Shared/API/c/WKRenderLayer.cpp
@@ -37,16 +37,21 @@ WKTypeID WKRenderLayerGetTypeID()
     return toAPI(WebRenderLayer::APIType);
 }
 
+WKRenderObjectRef WKRenderLayerGetRenderer(WKRenderLayerRef renderLayerRef)
+{
+    return toAPI(toImpl(renderLayerRef)->renderer());
+}
+
 WKStringRef WKRenderLayerCopyRendererName(WKRenderLayerRef renderLayerRef)
 {
-    return toCopiedAPI(toImpl(renderLayerRef)->renderObjectName());
+    return toCopiedAPI(toImpl(renderLayerRef)->renderer()->name());
 }
 
 WKStringRef WKRenderLayerCopyElementTagName(WKRenderLayerRef renderLayerRef)
 {
     WebRenderLayer* renderLayer = toImpl(renderLayerRef);
-    if (!renderLayer->elementTagName().isNull())
-        return toCopiedAPI(toImpl(renderLayerRef)->elementTagName());
+    if (!renderLayer->renderer()->elementTagName().isNull())
+        return toCopiedAPI(renderLayer->renderer()->elementTagName());
 
     return 0;
 }
@@ -54,15 +59,15 @@ WKStringRef WKRenderLayerCopyElementTagName(WKRenderLayerRef renderLayerRef)
 WKStringRef WKRenderLayerCopyElementID(WKRenderLayerRef renderLayerRef)
 {
     WebRenderLayer* renderLayer = toImpl(renderLayerRef);
-    if (!renderLayer->elementID().isNull())
-        return toCopiedAPI(toImpl(renderLayerRef)->elementID());
+    if (!renderLayer->renderer()->elementID().isNull())
+        return toCopiedAPI(renderLayer->renderer()->elementID());
 
     return 0;
 }
 
 WKArrayRef WKRenderLayerGetElementClassNames(WKRenderLayerRef renderLayerRef)
 {
-    return toAPI(toImpl(renderLayerRef)->elementClassNames());
+    return toAPI(toImpl(renderLayerRef)->renderer()->elementClassNames());
 }
 
 WKRect WKRenderLayerGetAbsoluteBounds(WKRenderLayerRef renderLayerRef)
diff --git a/Source/WebKit2/Shared/API/c/WKRenderLayer.h b/Source/WebKit2/Shared/API/c/WKRenderLayer.h
index 6683d87b4..72f28e0b9 100644
--- a/Source/WebKit2/Shared/API/c/WKRenderLayer.h
+++ b/Source/WebKit2/Shared/API/c/WKRenderLayer.h
@@ -36,8 +36,12 @@ extern "C" {
 
 WK_EXPORT WKTypeID WKRenderLayerGetTypeID();
 
+WK_EXPORT WKRenderObjectRef WKRenderLayerGetRenderer(WKRenderLayerRef renderLayer);
+
+// FIXME: Remove this function once Safari does not require it.
 WK_EXPORT WKStringRef WKRenderLayerCopyRendererName(WKRenderLayerRef renderLayer);
 
+// FIXME: Remove these three functions once Safari does not require them.
 WK_EXPORT WKStringRef WKRenderLayerCopyElementTagName(WKRenderLayerRef renderLayer);
 WK_EXPORT WKStringRef WKRenderLayerCopyElementID(WKRenderLayerRef renderLayer);
 WK_EXPORT WKArrayRef WKRenderLayerGetElementClassNames(WKRenderLayerRef renderLayer);
diff --git a/Source/WebKit2/Shared/API/c/WKRenderObject.cpp b/Source/WebKit2/Shared/API/c/WKRenderObject.cpp
index 1c7274985..2bc9728cf 100644
--- a/Source/WebKit2/Shared/API/c/WKRenderObject.cpp
+++ b/Source/WebKit2/Shared/API/c/WKRenderObject.cpp
@@ -42,6 +42,29 @@ WKStringRef WKRenderObjectCopyName(WKRenderObjectRef renderObjectRef)
     return toCopiedAPI(toImpl(renderObjectRef)->name());
 }
 
+WKStringRef WKRenderObjectCopyElementTagName(WKRenderObjectRef renderObjectRef)
+{
+    WebRenderObject* renderObject = toImpl(renderObjectRef);
+    if (!renderObject->elementTagName().isNull())
+        return toCopiedAPI(renderObject->elementTagName());
+
+    return 0;
+}
+
+WKStringRef WKRenderObjectCopyElementID(WKRenderObjectRef renderObjectRef)
+{
+    WebRenderObject* renderObject = toImpl(renderObjectRef);
+    if (!renderObject->elementID().isNull())
+        return toCopiedAPI(renderObject->elementID());
+
+    return 0;
+}
+
+WKArrayRef WKRenderObjectGetElementClassNames(WKRenderObjectRef renderObjectRef)
+{
+    return toAPI(toImpl(renderObjectRef)->elementClassNames());
+}
+
 WKPoint WKRenderObjectGetAbsolutePosition(WKRenderObjectRef renderObjectRef)
 {
     IntPoint absolutePosition = toImpl(renderObjectRef)->absolutePosition();
diff --git a/Source/WebKit2/Shared/API/c/WKRenderObject.h b/Source/WebKit2/Shared/API/c/WKRenderObject.h
index 51d1e22db..965cf2a96 100644
--- a/Source/WebKit2/Shared/API/c/WKRenderObject.h
+++ b/Source/WebKit2/Shared/API/c/WKRenderObject.h
@@ -36,6 +36,11 @@ extern "C" {
 WK_EXPORT WKTypeID WKRenderObjectGetTypeID();
 
 WK_EXPORT WKStringRef WKRenderObjectCopyName(WKRenderObjectRef renderObject);
+
+WK_EXPORT WKStringRef WKRenderObjectCopyElementTagName(WKRenderObjectRef renderObject);
+WK_EXPORT WKStringRef WKRenderObjectCopyElementID(WKRenderObjectRef renderObject);
+WK_EXPORT WKArrayRef WKRenderObjectGetElementClassNames(WKRenderObjectRef renderObject);
+
 WK_EXPORT WKPoint WKRenderObjectGetAbsolutePosition(WKRenderObjectRef renderObject);
 WK_EXPORT WKRect WKRenderObjectGetFrameRect(WKRenderObjectRef renderObject);
 WK_EXPORT WKArrayRef WKRenderObjectGetChildren(WKRenderObjectRef renderObject);
diff --git a/Source/WebKit2/Shared/APIClientTraits.cpp b/Source/WebKit2/Shared/APIClientTraits.cpp
index eaa730690..1926be817 100644
--- a/Source/WebKit2/Shared/APIClientTraits.cpp
+++ b/Source/WebKit2/Shared/APIClientTraits.cpp
@@ -68,4 +68,9 @@ const size_t APIClientTraits<WKBundlePageFormClient>::interfaceSizesByVersion[]
     sizeof(WKBundlePageFormClient)
 };
 
+const size_t APIClientTraits<WKContextInjectedBundleClient>::interfaceSizesByVersion[] = {
+    offsetof(WKContextInjectedBundleClient, getInjectedBundleInitializationUserData),
+    sizeof(WKContextInjectedBundleClient)
+};
+
 } // namespace WebKit
diff --git a/Source/WebKit2/Shared/APIClientTraits.h b/Source/WebKit2/Shared/APIClientTraits.h
index 8c1b16402..d218078c6 100644
--- a/Source/WebKit2/Shared/APIClientTraits.h
+++ b/Source/WebKit2/Shared/APIClientTraits.h
@@ -27,6 +27,7 @@
 #define APIClientTraits_h
 
 #include "WKBundlePage.h"
+#include "WKContext.h"
 #include "WKPage.h"
 
 namespace WebKit {
@@ -64,6 +65,10 @@ template<> struct APIClientTraits<WKBundlePageFormClient> {
     static const size_t interfaceSizesByVersion[2];
 };
 
+template<> struct APIClientTraits<WKContextInjectedBundleClient> {
+    static const size_t interfaceSizesByVersion[2];
+};
+
 } // namespace WebKit
 
 #endif // APIClientTraits_h
diff --git a/Source/WebKit2/Shared/APIObject.h b/Source/WebKit2/Shared/APIObject.h
index ead74f00d..6e9c1d6f6 100644
--- a/Source/WebKit2/Shared/APIObject.h
+++ b/Source/WebKit2/Shared/APIObject.h
@@ -72,6 +72,8 @@ public:
         TypeApplicationCacheManager,
         TypeBackForwardList,
         TypeBackForwardListItem,
+        TypeBatteryManager,
+        TypeBatteryStatus,
         TypeCacheManager,
         TypeContext,
         TypeCookieManager,
@@ -93,6 +95,8 @@ public:
         TypeKeyValueStorageManager,
         TypeMediaCacheManager,
         TypeNavigationData,
+        TypeNetworkInfo,
+        TypeNetworkInfoManager,
         TypeNotification,
         TypeNotificationManager,
         TypeNotificationPermissionRequest,
@@ -103,6 +107,7 @@ public:
         TypePluginSiteDataManager,
         TypePreferences,
         TypeTextChecker,
+        TypeVibration,
 
         // Bundle types
         TypeBundle,
diff --git a/Source/WebKit2/Shared/UserMessageCoders.h b/Source/WebKit2/Shared/UserMessageCoders.h
index ace72fd2e..85ed57b57 100644
--- a/Source/WebKit2/Shared/UserMessageCoders.h
+++ b/Source/WebKit2/Shared/UserMessageCoders.h
@@ -145,10 +145,7 @@ public:
         }
         case APIObject::TypeRenderLayer: {
             WebRenderLayer* renderLayer = static_cast<WebRenderLayer*>(m_root);
-            encoder->encode(renderLayer->renderObjectName());
-            encoder->encode(renderLayer->elementTagName());
-            encoder->encode(renderLayer->elementID());
-            encoder->encode(Owner(renderLayer->elementClassNames()));
+            encoder->encode(Owner(renderLayer->renderer()));
             encoder->encode(renderLayer->isReflection());
             encoder->encode(renderLayer->isClipping());
             encoder->encode(renderLayer->isClipped());
@@ -162,6 +159,9 @@ public:
         case APIObject::TypeRenderObject: {
             WebRenderObject* renderObject = static_cast<WebRenderObject*>(m_root);
             encoder->encode(renderObject->name());
+            encoder->encode(renderObject->elementTagName());
+            encoder->encode(renderObject->elementID());
+            encoder->encode(Owner(renderObject->elementClassNames()));
             encoder->encode(renderObject->absolutePosition());
             encoder->encode(renderObject->frameRect());
             encoder->encode(Owner(renderObject->children().get()));
@@ -367,10 +367,7 @@ public:
             break;
         }
         case APIObject::TypeRenderLayer: {
-            String renderObjectName;
-            String elementTagName;
-            String elementID;
-            RefPtr<APIObject> elementClassNames;
+            RefPtr<APIObject> renderer;
             bool isReflection;
             bool isClipping;
             bool isClipped;
@@ -380,14 +377,10 @@ public:
             RefPtr<APIObject> normalFlowList;
             RefPtr<APIObject> positiveZOrderList;
 
-            if (!decoder->decode(renderObjectName))
-                return false;
-            if (!decoder->decode(elementTagName))
+            Owner rendererCoder(coder, renderer);
+            if (!decoder->decode(rendererCoder))
                 return false;
-            if (!decoder->decode(elementID))
-                return false;
-            Owner classNamesCoder(coder, elementClassNames);
-            if (!decoder->decode(classNamesCoder))
+            if (renderer->type() != APIObject::TypeRenderObject)
                 return false;
             if (!decoder->decodeBool(isReflection))
                 return false;
@@ -408,20 +401,29 @@ public:
             Owner positiveZOrderListCoder(coder, positiveZOrderList);
             if (!decoder->decode(positiveZOrderListCoder))
                 return false;
-            coder.m_root = WebRenderLayer::create(renderObjectName, elementTagName, elementID, static_pointer_cast<MutableArray>(elementClassNames),
-                isReflection, isClipping, isClipped, static_cast<WebRenderLayer::CompositingLayerType>(compositingLayerTypeAsUInt32),
+            coder.m_root = WebRenderLayer::create(static_pointer_cast<WebRenderObject>(renderer), isReflection, isClipping, isClipped, static_cast<WebRenderLayer::CompositingLayerType>(compositingLayerTypeAsUInt32),
                 absoluteBoundingBox, static_pointer_cast<MutableArray>(negativeZOrderList), static_pointer_cast<MutableArray>(normalFlowList),
                 static_pointer_cast<MutableArray>(positiveZOrderList));
             break;
         }
         case APIObject::TypeRenderObject: {
             String name;
+            String elementTagName;
+            String elementID;
+            RefPtr<APIObject> elementClassNames;
             WebCore::IntPoint absolutePosition;
             WebCore::IntRect frameRect;
             RefPtr<APIObject> children;
             
             if (!decoder->decode(name))
                 return false;
+            if (!decoder->decode(elementTagName))
+                return false;
+            if (!decoder->decode(elementID))
+                return false;
+            Owner classNamesCoder(coder, elementClassNames);
+            if (!decoder->decode(classNamesCoder))
+                return false;
             if (!decoder->decode(absolutePosition))
                 return false;
             if (!decoder->decode(frameRect))
@@ -429,9 +431,9 @@ public:
             Owner messageCoder(coder, children);
             if (!decoder->decode(messageCoder))
                 return false;
-            if (children->type() != APIObject::TypeArray)
+            if (children && children->type() != APIObject::TypeArray)
                 return false;
-            coder.m_root = WebRenderObject::create(name, absolutePosition, frameRect, WTF::static_pointer_cast<MutableArray>(children));
+            coder.m_root = WebRenderObject::create(name, elementTagName, elementID, WTF::static_pointer_cast<MutableArray>(elementClassNames), absolutePosition, frameRect, WTF::static_pointer_cast<MutableArray>(children));
             break;
         }
         case APIObject::TypeURL: {
diff --git a/Source/WebKit2/Shared/WebBatteryStatus.cpp b/Source/WebKit2/Shared/WebBatteryStatus.cpp
new file mode 100644
index 000000000..c8d806da9
--- /dev/null
+++ b/Source/WebKit2/Shared/WebBatteryStatus.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebBatteryStatus.h"
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "ArgumentCoders.h"
+#include "Arguments.h"
+
+namespace WebKit {
+
+WebBatteryStatus::WebBatteryStatus(bool isCharging, double chargingTime, double dischargingTime, double level)
+{
+    m_data.isCharging = isCharging;
+    m_data.chargingTime = chargingTime;
+    m_data.dischargingTime = dischargingTime;
+    m_data.level = level;
+}
+
+WebBatteryStatus::~WebBatteryStatus()
+{
+}
+
+void WebBatteryStatus::Data::encode(CoreIPC::ArgumentEncoder* encoder) const
+{
+    encoder->encode(CoreIPC::In(isCharging, chargingTime, dischargingTime, level));
+}
+
+bool WebBatteryStatus::Data::decode(CoreIPC::ArgumentDecoder* decoder, Data& data)
+{
+    return decoder->decode(CoreIPC::Out(data.isCharging, data.chargingTime, data.dischargingTime, data.level));
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit2/Shared/WebBatteryStatus.h b/Source/WebKit2/Shared/WebBatteryStatus.h
new file mode 100644
index 000000000..fd1d7932d
--- /dev/null
+++ b/Source/WebKit2/Shared/WebBatteryStatus.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebBatteryStatus_h
+#define WebBatteryStatus_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "APIObject.h"
+#include "ArgumentDecoder.h"
+#include "ArgumentEncoder.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebKit {
+
+class WebBatteryStatus : public APIObject {
+public:
+    static const Type APIType = TypeBatteryStatus;
+
+    struct Data {
+        void encode(CoreIPC::ArgumentEncoder*) const;
+        static bool decode(CoreIPC::ArgumentDecoder*, Data&);
+
+        bool isCharging;
+        double chargingTime;
+        double dischargingTime;
+        double level;
+    };
+
+    static PassRefPtr<WebBatteryStatus> create(bool isCharging, double chargingTime, double dischargingTime, double level)
+    {
+        return adoptRef(new WebBatteryStatus(isCharging, chargingTime, dischargingTime, level));
+    }
+
+    virtual ~WebBatteryStatus();
+    double isCharging() const { return m_data.isCharging; }
+    double chargingTime() const { return m_data.chargingTime; }
+    double dischargingTime() const { return m_data.dischargingTime; }
+    double level() const { return m_data.level; }
+
+    const Data& data() const { return m_data; }
+
+private:
+    WebBatteryStatus(bool isCharging, double chargingTime, double dischargingTime, double level);
+
+    virtual Type type() const { return APIType; }
+
+    Data m_data;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
+
+#endif // WebBatteryStatus_h
diff --git a/Source/WebKit2/Shared/WebNetworkInfo.cpp b/Source/WebKit2/Shared/WebNetworkInfo.cpp
new file mode 100644
index 000000000..cc31bdccb
--- /dev/null
+++ b/Source/WebKit2/Shared/WebNetworkInfo.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebNetworkInfo.h"
+
+#if ENABLE(NETWORK_INFO)
+
+#include "ArgumentCoders.h"
+#include "Arguments.h"
+
+namespace WebKit {
+
+WebNetworkInfo::WebNetworkInfo(double bandwidth, bool metered)
+{
+    m_data.bandwidth = bandwidth;
+    m_data.metered = metered;
+}
+
+WebNetworkInfo::~WebNetworkInfo()
+{
+}
+
+void WebNetworkInfo::Data::encode(CoreIPC::ArgumentEncoder* encoder) const
+{
+    encoder->encode(CoreIPC::In(bandwidth, metered));
+}
+
+bool WebNetworkInfo::Data::decode(CoreIPC::ArgumentDecoder* decoder, Data& data)
+{
+    return decoder->decode(CoreIPC::Out(data.bandwidth, data.metered));
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
diff --git a/Source/WebKit2/Shared/WebNetworkInfo.h b/Source/WebKit2/Shared/WebNetworkInfo.h
new file mode 100644
index 000000000..4c1617374
--- /dev/null
+++ b/Source/WebKit2/Shared/WebNetworkInfo.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNetworkInfo_h
+#define WebNetworkInfo_h
+
+#if ENABLE(NETWORK_INFO)
+
+#include "APIObject.h"
+#include "ArgumentDecoder.h"
+#include "ArgumentEncoder.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebKit {
+
+class WebNetworkInfo : public APIObject {
+public:
+    static const Type APIType = TypeNetworkInfo;
+
+    struct Data {
+        void encode(CoreIPC::ArgumentEncoder*) const;
+        static bool decode(CoreIPC::ArgumentDecoder*, Data&);
+
+        double bandwidth;
+        bool metered;
+    };
+
+    static PassRefPtr<WebNetworkInfo> create(double bandwidth, bool metered)
+    {
+        return adoptRef(new WebNetworkInfo(bandwidth, metered));
+    }
+
+    virtual ~WebNetworkInfo();
+
+    double bandwidth() const { return m_data.bandwidth; }
+    bool metered() const { return m_data.metered; }
+
+    const Data& data() const { return m_data; }
+
+private:
+    WebNetworkInfo(double bandwidth, bool metered);
+
+    virtual Type type() const { return APIType; }
+
+    Data m_data;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
+
+#endif // WebNetworkInfo_h
diff --git a/Source/WebKit2/Shared/WebPreferencesStore.h b/Source/WebKit2/Shared/WebPreferencesStore.h
index 335244f16..0a84cdbf8 100644
--- a/Source/WebKit2/Shared/WebPreferencesStore.h
+++ b/Source/WebKit2/Shared/WebPreferencesStore.h
@@ -95,7 +95,6 @@ namespace WebKit {
     macro(AllowUniversalAccessFromFileURLs, allowUniversalAccessFromFileURLs, Bool, bool, false) \
     macro(AllowFileAccessFromFileURLs, allowFileAccessFromFileURLs, Bool, bool, false) \
     macro(AVFoundationEnabled, isAVFoundationEnabled, Bool, bool, DEFAULT_WEBKIT_AVFOUNDATION_ENABLED) \
-    macro(Hixie76WebSocketProtocolEnabled, hixie76WebSocketProtocolEnabled, Bool, bool, false) \
     macro(MediaPlaybackRequiresUserGesture, mediaPlaybackRequiresUserGesture, Bool, bool, false) \
     macro(MediaPlaybackAllowsInline, mediaPlaybackAllowsInline, Bool, bool, true) \
     macro(InspectorStartsAttached, inspectorStartsAttached, Bool, bool, true) \
diff --git a/Source/WebKit2/Shared/WebRenderLayer.cpp b/Source/WebKit2/Shared/WebRenderLayer.cpp
index 586f1362e..9b138fc6f 100644
--- a/Source/WebKit2/Shared/WebRenderLayer.cpp
+++ b/Source/WebKit2/Shared/WebRenderLayer.cpp
@@ -75,27 +75,7 @@ PassRefPtr<MutableArray> WebRenderLayer::createArrayFromLayerList(Vector<RenderL
 
 WebRenderLayer::WebRenderLayer(RenderLayer* layer)
 {
-    RenderBoxModelObject* renderer = layer->renderer();
-
-    m_renderObjectName = renderer->renderName();
-
-    if (Node* node = renderer->node()) {
-        if (node->isElementNode()) {
-            Element* element = toElement(node);
-            m_elementTagName = element->tagName();
-            m_elementID = element->getIdAttribute();
-            if (element->isStyledElement() && element->hasClass()) {
-                StyledElement* styledElement = static_cast<StyledElement*>(element);
-                if (size_t classNameCount = styledElement->classNames().size()) {
-                    m_elementClassNames = MutableArray::create();
-                    for (size_t i = 0; i < classNameCount; ++i)
-                        m_elementClassNames->append(WebString::create(styledElement->classNames()[i]).get());
-                }
-            }
-
-        }
-    }
-
+    m_renderer = WebRenderObject::create(layer->renderer());
     m_isReflection = layer->isReflection();
 
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebKit2/Shared/WebRenderLayer.h b/Source/WebKit2/Shared/WebRenderLayer.h
index f3323bc40..5ebd05071 100644
--- a/Source/WebKit2/Shared/WebRenderLayer.h
+++ b/Source/WebKit2/Shared/WebRenderLayer.h
@@ -26,12 +26,7 @@
 #ifndef WebRenderLayer_h
 #define WebRenderLayer_h
 
-#include "APIObject.h"
-#include "MutableArray.h"
-#include <WebCore/IntRect.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/Vector.h>
-#include <wtf/text/WTFString.h>
+#include "WebRenderObject.h"
 
 namespace WebCore {
     class RenderLayer;
@@ -48,22 +43,17 @@ public:
     enum CompositingLayerType { None, Normal, Tiled, Media, Container };
 
     static PassRefPtr<WebRenderLayer> create(WebPage*);
-    static PassRefPtr<WebRenderLayer> create(const String& renderObjectName, const String& elementTagName, const String& elementID, PassRefPtr<MutableArray> elementClassNames,
-        bool isReflection, bool isClipping, bool isClipped, CompositingLayerType type, WebCore::IntRect absoluteBoundingBox,
-        PassRefPtr<MutableArray> negativeZOrderList, PassRefPtr<MutableArray> normalFlowList, PassRefPtr<MutableArray> positiveZOrderList)
+    static PassRefPtr<WebRenderLayer> create(PassRefPtr<WebRenderObject> renderer, bool isReflection, bool isClipping, bool isClipped, CompositingLayerType type,
+        WebCore::IntRect absoluteBoundingBox, PassRefPtr<MutableArray> negativeZOrderList, PassRefPtr<MutableArray> normalFlowList, PassRefPtr<MutableArray> positiveZOrderList)
     {
-        return adoptRef(new WebRenderLayer(renderObjectName, elementTagName, elementID, elementClassNames, isReflection, isClipping, isClipped,
-            type, absoluteBoundingBox, negativeZOrderList, normalFlowList, positiveZOrderList));
+        return adoptRef(new WebRenderLayer(renderer, isReflection, isClipping, isClipped, type, absoluteBoundingBox, negativeZOrderList, normalFlowList, positiveZOrderList));
     }
 
     ImmutableArray* negativeZOrderList() const { return m_negativeZOrderList.get(); }
     ImmutableArray* normalFlowList() const { return m_normalFlowList.get(); }
     ImmutableArray* positiveZOrderList() const { return m_positiveZOrderList.get(); }
 
-    const String& renderObjectName() const { return m_renderObjectName; }
-    const String& elementTagName() const { return m_elementTagName; }
-    const String& elementID() const { return m_elementID; }
-    ImmutableArray* elementClassNames() const { return m_elementClassNames.get(); }
+    WebRenderObject* renderer() const { return m_renderer.get(); }
     bool isReflection() const { return m_isReflection; }
     bool isClipping() const { return m_isClipping; }
     bool isClipped() const { return m_isClipped; }
@@ -72,13 +62,9 @@ public:
 
 private:
     WebRenderLayer(WebCore::RenderLayer*);
-    WebRenderLayer(const String& renderObjectName, const String& elementTagName, const String& elementID, PassRefPtr<MutableArray> elementClassNames,
-        bool isReflection, bool isClipping, bool isClipped, CompositingLayerType type, WebCore::IntRect absoluteBoundingBox,
+    WebRenderLayer(PassRefPtr<WebRenderObject> renderer, bool isReflection, bool isClipping, bool isClipped, CompositingLayerType type, WebCore::IntRect absoluteBoundingBox,
         PassRefPtr<MutableArray> negativeZOrderList, PassRefPtr<MutableArray> normalFlowList, PassRefPtr<MutableArray> positiveZOrderList)
-        : m_renderObjectName(renderObjectName)
-        , m_elementTagName(elementTagName)
-        , m_elementID(elementID)
-        , m_elementClassNames(elementClassNames)
+        : m_renderer(renderer)
         , m_isReflection(isReflection)
         , m_isClipping(isClipping)
         , m_isClipped(isClipped)
@@ -94,10 +80,7 @@ private:
 
     static PassRefPtr<MutableArray> createArrayFromLayerList(Vector<WebCore::RenderLayer*>*);
 
-    String m_renderObjectName;
-    String m_elementTagName;
-    String m_elementID;
-    RefPtr<MutableArray> m_elementClassNames;
+    RefPtr<WebRenderObject> m_renderer;
     bool m_isReflection;
     bool m_isClipping;
     bool m_isClipped;
diff --git a/Source/WebKit2/Shared/WebRenderObject.cpp b/Source/WebKit2/Shared/WebRenderObject.cpp
index 2520d3dbd..146230e9d 100644
--- a/Source/WebKit2/Shared/WebRenderObject.cpp
+++ b/Source/WebKit2/Shared/WebRenderObject.cpp
@@ -27,6 +27,7 @@
 #include "WebRenderObject.h"
 
 #include "WebPage.h"
+#include "WebString.h"
 #include <WebCore/Frame.h>
 #include <WebCore/FrameLoaderClient.h>
 #include <WebCore/RenderText.h>
@@ -50,13 +51,29 @@ PassRefPtr<WebRenderObject> WebRenderObject::create(WebPage* page)
     if (!contentRenderer)
         return 0;
 
-    return adoptRef(new WebRenderObject(contentRenderer));
+    return adoptRef(new WebRenderObject(contentRenderer, true));
 }
 
-WebRenderObject::WebRenderObject(RenderObject* renderer)
+WebRenderObject::WebRenderObject(RenderObject* renderer, bool shouldIncludeDescendants)
 {
     m_name = renderer->renderName();
 
+    if (Node* node = renderer->node()) {
+        if (node->isElementNode()) {
+            Element* element = toElement(node);
+            m_elementTagName = element->tagName();
+            m_elementID = element->getIdAttribute();
+            if (element->isStyledElement() && element->hasClass()) {
+                StyledElement* styledElement = static_cast<StyledElement*>(element);
+                if (size_t classNameCount = styledElement->classNames().size()) {
+                    m_elementClassNames = MutableArray::create();
+                    for (size_t i = 0; i < classNameCount; ++i)
+                        m_elementClassNames->append(WebString::create(styledElement->classNames()[i]).get());
+                }
+            }
+        }
+    }
+
     // FIXME: broken with transforms
     m_absolutePosition = flooredIntPoint(renderer->localToAbsolute(FloatPoint()));
 
@@ -69,9 +86,12 @@ WebRenderObject::WebRenderObject(RenderObject* renderer)
     } else if (renderer->isRenderInline())
         m_frameRect = toRenderBoxModelObject(renderer)->borderBoundingBox();
 
+    if (!shouldIncludeDescendants)
+        return;
+
     m_children = MutableArray::create();
     for (RenderObject* coreChild = renderer->firstChild(); coreChild; coreChild = coreChild->nextSibling()) {
-        RefPtr<WebRenderObject> child = adoptRef(new WebRenderObject(coreChild));
+        RefPtr<WebRenderObject> child = adoptRef(new WebRenderObject(coreChild, shouldIncludeDescendants));
         m_children->append(child.get());
     }
 
@@ -84,7 +104,7 @@ WebRenderObject::WebRenderObject(RenderObject* renderer)
 
     FrameView* frameView = static_cast<FrameView*>(widget);
     if (RenderView* coreContentRenderer = frameView->frame()->contentRenderer()) {
-        RefPtr<WebRenderObject> contentRenderer = adoptRef(new WebRenderObject(coreContentRenderer));
+        RefPtr<WebRenderObject> contentRenderer = adoptRef(new WebRenderObject(coreContentRenderer, shouldIncludeDescendants));
         m_children->append(contentRenderer.get());
     }
 }
diff --git a/Source/WebKit2/Shared/WebRenderObject.h b/Source/WebKit2/Shared/WebRenderObject.h
index 1fcb03ca1..3e056222e 100644
--- a/Source/WebKit2/Shared/WebRenderObject.h
+++ b/Source/WebKit2/Shared/WebRenderObject.h
@@ -30,7 +30,6 @@
 #include "MutableArray.h"
 #include <WebCore/IntRect.h>
 #include <wtf/PassRefPtr.h>
-#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
@@ -46,22 +45,35 @@ public:
     static const Type APIType = TypeRenderObject;
 
     static PassRefPtr<WebRenderObject> create(WebPage*);
-    static PassRefPtr<WebRenderObject> create(const String& name, WebCore::IntPoint absolutePosition, WebCore::IntRect frameRect, PassRefPtr<MutableArray> children)
+    static PassRefPtr<WebRenderObject> create(WebCore::RenderObject* renderer)
     {
-        return adoptRef(new WebRenderObject(name, absolutePosition, frameRect, children));
+        return adoptRef(new WebRenderObject(renderer, false));
+    }
+
+    static PassRefPtr<WebRenderObject> create(const String& name, const String& elementTagName, const String& elementID,
+        PassRefPtr<MutableArray> elementClassNames, WebCore::IntPoint absolutePosition, WebCore::IntRect frameRect, PassRefPtr<MutableArray> children)
+    {
+        return adoptRef(new WebRenderObject(name, elementTagName, elementID, elementClassNames, absolutePosition, frameRect, children));
     }
 
     RefPtr<ImmutableArray> children() const { return m_children; }
 
     const String& name() const { return m_name; }
+    const String& elementTagName() const { return m_elementTagName; }
+    const String& elementID() const { return m_elementID; }
+    ImmutableArray* elementClassNames() const { return m_elementClassNames.get(); }
     WebCore::IntPoint absolutePosition() const { return m_absolutePosition; }
     WebCore::IntRect frameRect() const { return m_frameRect; }
 
 private:
-    WebRenderObject(WebCore::RenderObject*);
-    WebRenderObject(const String& name, WebCore::IntPoint absolutePosition, WebCore::IntRect frameRect, PassRefPtr<MutableArray> children)
+    WebRenderObject(WebCore::RenderObject*, bool shouldIncludeDescendants);
+    WebRenderObject(const String& name, const String& elementTagName, const String& elementID, PassRefPtr<MutableArray> elementClassNames,
+        WebCore::IntPoint absolutePosition, WebCore::IntRect frameRect, PassRefPtr<MutableArray> children)
         : m_children(children)
         , m_name(name)
+        , m_elementTagName(elementTagName)
+        , m_elementID(elementID)
+        , m_elementClassNames(elementClassNames)
         , m_absolutePosition(absolutePosition)
         , m_frameRect(frameRect)
     {
@@ -72,6 +84,9 @@ private:
     RefPtr<MutableArray> m_children;
 
     String m_name;
+    String m_elementTagName;
+    String m_elementID;
+    RefPtr<MutableArray> m_elementClassNames;
     WebCore::IntPoint m_absolutePosition;
     WebCore::IntRect m_frameRect;
 };
diff --git a/Source/WebKit2/Shared/mac/WebMemorySampler.mac.mm b/Source/WebKit2/Shared/mac/WebMemorySampler.mac.mm
index 6a947ae48..29cdddc0f 100644
--- a/Source/WebKit2/Shared/mac/WebMemorySampler.mac.mm
+++ b/Source/WebKit2/Shared/mac/WebMemorySampler.mac.mm
@@ -116,7 +116,7 @@ WebMemoryStatistics WebMemorySampler::sampleWebKit() const
     totalBytesInUse += fastMallocBytesInUse;
     totalBytesCommitted += fastMallocBytesCommitted;
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     size_t jscHeapBytesInUse = JSDOMWindow::commonJSGlobalData()->heap.size();
     size_t jscHeapBytesCommitted = JSDOMWindow::commonJSGlobalData()->heap.capacity();
     totalBytesInUse += jscHeapBytesInUse;
diff --git a/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp b/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
index 7a77ef30f..ad5574f8f 100644
--- a/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
+++ b/Source/WebKit2/Shared/qt/WebCoreArgumentCodersQt.cpp
@@ -44,13 +44,10 @@ bool ArgumentCoder<ResourceRequest>::decode(ArgumentDecoder* decoder, ResourceRe
     // FIXME: Add *more* coding implementation when we want to implement something that
     // depends on this like the policy client.
 
-    ResourceRequest request;
     String url;
     if (!decoder->decode(url))
         return false;
-    request.setURL(KURL(WebCore::ParsedURLString, url));
-
-    resourceRequest = request;
+    resourceRequest.setURL(KURL(KURL(), url));
     return true;
 }
 
diff --git a/Source/WebKit2/Target.pri b/Source/WebKit2/Target.pri
index 3799d85fe..25d894f7e 100644
--- a/Source/WebKit2/Target.pri
+++ b/Source/WebKit2/Target.pri
@@ -7,8 +7,6 @@
 TEMPLATE = lib
 TARGET = WebKit2
 
-load(features)
-
 include(WebKit2.pri)
 
 WEBKIT += wtf javascriptcore webcore
@@ -99,6 +97,7 @@ HEADERS += \
     Shared/VisitedLinkTable.h \
     Shared/WebCoreArgumentCoders.h \
     Shared/WebBackForwardListItem.h \
+    Shared/WebBatteryStatus.h \
     Shared/WebCertificateInfo.h \
     Shared/WebConnection.h \
     Shared/WebConnectionClient.h \
@@ -147,6 +146,8 @@ HEADERS += \
     UIProcess/API/C/WKAuthenticationDecisionListener.h \
     UIProcess/API/C/WKBackForwardList.h \
     UIProcess/API/C/WKBackForwardListItem.h \
+    UIProcess/API/C/WKBatteryManager.h \
+    UIProcess/API/C/WKBatteryStatus.h \
     UIProcess/API/C/WKContext.h \
     UIProcess/API/C/WKContextPrivate.h \
     UIProcess/API/C/WKCredential.h \
@@ -162,9 +163,11 @@ HEADERS += \
     UIProcess/API/C/WKIconDatabase.h \
     UIProcess/API/C/WKInspector.h \
     UIProcess/API/C/WKIntentData.h \
+    UIProcess/API/C/WKIntentServiceInfo.h \
     UIProcess/API/C/WKOpenPanelParameters.h \
     UIProcess/API/C/WKOpenPanelResultListener.h \
     UIProcess/API/C/WKNavigationData.h \
+    UIProcess/API/C/WKNetworkInfoManager.h \
     UIProcess/API/C/WKNotification.h \
     UIProcess/API/C/WKNotificationManager.h \
     UIProcess/API/C/WKNotificationPermissionRequest.h \
@@ -177,6 +180,7 @@ HEADERS += \
     UIProcess/API/C/WKPreferencesPrivate.h \
     UIProcess/API/C/WKProtectionSpace.h \
     UIProcess/API/C/WKProtectionSpaceTypes.h \
+    UIProcess/API/C/WKVibration.h \
     UIProcess/API/C/WebKit2.h \
     UIProcess/API/C/qt/WKNativeEvent.h \
     UIProcess/API/cpp/WKRetainPtr.h \
@@ -200,6 +204,8 @@ HEADERS += \
     UIProcess/API/qt/qquicknetworkrequest_p.h \
     UIProcess/API/qt/qquickurlschemedelegate_p.h \
     UIProcess/API/qt/qwebkittest_p.h \
+    UIProcess/API/qt/raw/qrawwebview_p.h \
+    UIProcess/API/qt/raw/qrawwebview_p_p.h \
     UIProcess/Authentication/AuthenticationChallengeProxy.h \
     UIProcess/Authentication/AuthenticationDecisionListener.h \
     UIProcess/Authentication/WebCredential.h \
@@ -230,6 +236,8 @@ HEADERS += \
     UIProcess/VisitedLinkProvider.h \
     UIProcess/WebApplicationCacheManagerProxy.h \
     UIProcess/WebBackForwardList.h \
+    UIProcess/WebBatteryManagerProxy.h \
+    UIProcess/WebBatteryProvider.h \
     UIProcess/WebColorChooserProxy.h \
     UIProcess/WebConnectionToWebProcess.h \
     UIProcess/WebContext.h \
@@ -273,6 +281,8 @@ HEADERS += \
     UIProcess/WebResourceCacheManagerProxy.h \
     UIProcess/WebResourceLoadClient.h \
     UIProcess/WebUIClient.h \
+    UIProcess/WebVibrationProvider.h \
+    UIProcess/WebVibrationProxy.h \
     UIProcess/qt/QtWebContext.h \
     UIProcess/qt/QtWebPageEventHandler.h \
     UIProcess/qt/QtGestureRecognizer.h \
@@ -296,6 +306,7 @@ HEADERS += \
     UIProcess/texmap/LayerBackingStore.h \
     WebProcess/ApplicationCache/WebApplicationCacheManager.h \
     WebProcess/Authentication/AuthenticationManager.h \
+    WebProcess/Battery/WebBatteryManager.h \
     WebProcess/Cookies/WebCookieManager.h \
     WebProcess/Downloads/Download.h \
     WebProcess/Downloads/DownloadManager.h \
@@ -329,6 +340,7 @@ HEADERS += \
     WebProcess/InjectedBundle/InjectedBundleUserMessageCoders.h \
     WebProcess/KeyValueStorage/WebKeyValueStorageManager.h \
     WebProcess/MediaCache/WebMediaCacheManager.h \
+    WebProcess/NetworkInfo/WebNetworkInfoManager.h \
     WebProcess/Notifications/NotificationPermissionRequestManager.h \
     WebProcess/Notifications/WebNotificationManager.h \
     WebProcess/ResourceCache/WebResourceCacheManager.h \
@@ -346,6 +358,7 @@ HEADERS += \
     WebProcess/Plugins/PluginProxy.h \
     WebProcess/Plugins/PluginProcessConnection.h \
     WebProcess/Plugins/PluginProcessConnectionManager.h \
+    WebProcess/WebCoreSupport/WebBatteryClient.h \
     WebProcess/WebCoreSupport/WebChromeClient.h \
     WebProcess/WebCoreSupport/WebColorChooser.h \
     WebProcess/WebCoreSupport/WebContextMenuClient.h \
@@ -357,10 +370,12 @@ HEADERS += \
     WebProcess/WebCoreSupport/WebGeolocationClient.h \
     WebProcess/WebCoreSupport/WebInspectorClient.h \
     WebProcess/WebCoreSupport/WebInspectorFrontendClient.h \
+    WebProcess/WebCoreSupport/WebNetworkInfoClient.h \
     WebProcess/WebCoreSupport/WebNotificationClient.h \
     WebProcess/WebCoreSupport/WebPlatformStrategies.h \
     WebProcess/WebCoreSupport/WebPopupMenu.h \
     WebProcess/WebCoreSupport/WebSearchPopupMenu.h \
+    WebProcess/WebCoreSupport/WebVibrationClient.h \
     WebProcess/WebCoreSupport/qt/WebFrameNetworkingContext.h \
     WebProcess/WebPage/DrawingArea.h \
     WebProcess/WebPage/DrawingAreaImpl.h \
@@ -461,6 +476,7 @@ SOURCES += \
     Shared/UpdateInfo.cpp \
     Shared/VisitedLinkTable.cpp \
     Shared/WebBackForwardListItem.cpp \
+    Shared/WebBatteryStatus.cpp \
     Shared/WebConnection.cpp \
     Shared/WebConnectionClient.cpp \
     Shared/WebContextMenuItem.cpp \
@@ -477,6 +493,7 @@ SOURCES += \
     Shared/WebImage.cpp \
     Shared/WebLayerTreeInfo.cpp \
     Shared/WebMouseEvent.cpp \
+    Shared/WebNetworkInfo.cpp \
     Shared/WebOpenPanelParameters.cpp \
     Shared/WebPageCreationParameters.cpp \
     Shared/WebPageGroupData.cpp \
@@ -508,6 +525,8 @@ SOURCES += \
     UIProcess/API/C/WKAuthenticationDecisionListener.cpp \
     UIProcess/API/C/WKBackForwardList.cpp \
     UIProcess/API/C/WKBackForwardListItem.cpp \
+    UIProcess/API/C/WKBatteryManager.cpp \
+    UIProcess/API/C/WKBatteryStatus.cpp \
     UIProcess/API/C/WKContext.cpp \
     UIProcess/API/C/WKCredential.cpp \
     UIProcess/API/C/WKDatabaseManager.cpp \
@@ -521,18 +540,21 @@ SOURCES += \
     UIProcess/API/C/WKIconDatabase.cpp \
     UIProcess/API/C/WKInspector.cpp \
     UIProcess/API/C/WKIntentData.cpp \
+    UIProcess/API/C/WKIntentServiceInfo.cpp \
     UIProcess/API/C/WKNotification.cpp \
     UIProcess/API/C/WKNotificationManager.cpp \
     UIProcess/API/C/WKNotificationPermissionRequest.cpp \
     UIProcess/API/C/WKOpenPanelParameters.cpp \
     UIProcess/API/C/WKOpenPanelResultListener.cpp \
     UIProcess/API/C/WKNavigationData.cpp \
+    UIProcess/API/C/WKNetworkInfoManager.cpp \
     UIProcess/API/C/WKPage.cpp \
     UIProcess/API/C/WKPageGroup.cpp \
     UIProcess/API/C/WKPluginSiteDataManager.cpp \
     UIProcess/API/C/WKPreferences.cpp \
     UIProcess/API/C/WKProtectionSpace.cpp \
     UIProcess/API/C/WKResourceCacheManager.cpp \
+    UIProcess/API/C/WKVibration.cpp \
     UIProcess/API/cpp/qt/WKStringQt.cpp \
     UIProcess/API/cpp/qt/WKURLQt.cpp \
     UIProcess/API/qt/qwebdownloaditem.cpp \
@@ -549,6 +571,7 @@ SOURCES += \
     UIProcess/API/qt/qquickurlschemedelegate.cpp \
     UIProcess/API/qt/qwebpreferences.cpp \
     UIProcess/API/qt/qwebkittest.cpp \
+    UIProcess/API/qt/raw/qrawwebview.cpp \
     UIProcess/Authentication/AuthenticationChallengeProxy.cpp \
     UIProcess/Authentication/AuthenticationDecisionListener.cpp \
     UIProcess/Authentication/WebCredential.cpp \
@@ -582,6 +605,8 @@ SOURCES += \
     UIProcess/VisitedLinkProvider.cpp \
     UIProcess/WebApplicationCacheManagerProxy.cpp \
     UIProcess/WebBackForwardList.cpp \
+    UIProcess/WebBatteryManagerProxy.cpp \
+    UIProcess/WebBatteryProvider.cpp \
     UIProcess/WebConnectionToWebProcess.cpp \
     UIProcess/WebContext.cpp \
     UIProcess/WebContextConnectionClient.cpp \
@@ -613,6 +638,8 @@ SOURCES += \
     UIProcess/WebLoaderClient.cpp \
     UIProcess/WebMediaCacheManagerProxy.cpp \
     UIProcess/WebNavigationData.cpp \
+    UIProcess/WebNetworkInfoManagerProxy.cpp \
+    UIProcess/WebNetworkInfoProvider.cpp \
     UIProcess/WebOpenPanelResultListenerProxy.cpp \
     UIProcess/WebPageContextMenuClient.cpp \
     UIProcess/WebPageGroup.cpp \
@@ -623,6 +650,8 @@ SOURCES += \
     UIProcess/WebResourceCacheManagerProxy.cpp \
     UIProcess/WebResourceLoadClient.cpp \
     UIProcess/WebUIClient.cpp \
+    UIProcess/WebVibrationProvider.cpp \
+    UIProcess/WebVibrationProxy.cpp \
     UIProcess/qt/QtWebContext.cpp \
     UIProcess/qt/QtWebPageEventHandler.cpp \
     UIProcess/qt/QtGestureRecognizer.cpp \
@@ -651,6 +680,7 @@ SOURCES += \
     UIProcess/texmap/LayerBackingStore.cpp \
     WebProcess/ApplicationCache/WebApplicationCacheManager.cpp \
     WebProcess/Authentication/AuthenticationManager.cpp \
+    WebProcess/Battery/WebBatteryManager.cpp \
     WebProcess/Cookies/WebCookieManager.cpp \
     WebProcess/Cookies/qt/WebCookieManagerQt.cpp \
     WebProcess/Downloads/Download.cpp \
@@ -695,6 +725,7 @@ SOURCES += \
     WebProcess/InjectedBundle/qt/InjectedBundleQt.cpp \
     WebProcess/KeyValueStorage/WebKeyValueStorageManager.cpp \
     WebProcess/MediaCache/WebMediaCacheManager.cpp \
+    WebProcess/NetworkInfo/WebNetworkInfoManager.cpp \
     WebProcess/Notifications/NotificationPermissionRequestManager.cpp \
     WebProcess/Notifications/WebNotificationManager.cpp \
     WebProcess/ResourceCache/WebResourceCacheManager.cpp \
@@ -714,6 +745,7 @@ SOURCES += \
     WebProcess/Plugins/PluginProxy.cpp \
     WebProcess/Plugins/PluginProcessConnection.cpp \
     WebProcess/Plugins/PluginProcessConnectionManager.cpp \
+    WebProcess/WebCoreSupport/WebBatteryClient.cpp \
     WebProcess/WebCoreSupport/WebChromeClient.cpp \
     WebProcess/WebCoreSupport/WebColorChooser.cpp \
     WebProcess/WebCoreSupport/WebContextMenuClient.cpp \
@@ -724,10 +756,12 @@ SOURCES += \
     WebProcess/WebCoreSupport/WebGeolocationClient.cpp \
     WebProcess/WebCoreSupport/WebInspectorClient.cpp \
     WebProcess/WebCoreSupport/WebInspectorFrontendClient.cpp \
+    WebProcess/WebCoreSupport/WebNetworkInfoClient.cpp \
     WebProcess/WebCoreSupport/WebNotificationClient.cpp \
     WebProcess/WebCoreSupport/WebPlatformStrategies.cpp \
     WebProcess/WebCoreSupport/WebPopupMenu.cpp \
     WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp \
+    WebProcess/WebCoreSupport/WebVibrationClient.cpp \
     WebProcess/WebCoreSupport/qt/WebContextMenuClientQt.cpp \
     WebProcess/WebCoreSupport/qt/WebErrorsQt.cpp \
     WebProcess/WebCoreSupport/qt/WebDragClientQt.cpp \
@@ -766,6 +800,16 @@ SOURCES += \
     WebProcess/qt/WebProcessQt.cpp
 
 mac: {
+
+    contains(DEFINES, WTF_USE_QTKIT=1) {
+        DEFINES += NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
+        INCLUDEPATH += \
+            $$PWD/../../WebKitLibraries/
+        HEADERS += \
+            WebProcess/WebCoreSupport/qt/WebSystemInterface.h
+        SOURCES += \
+            WebProcess/WebCoreSupport/qt/WebSystemInterface.mm
+    }
     INCLUDEPATH += \
         Platform/mac \
         Platform/CoreIPC/mac
diff --git a/Source/WebKit2/UIProcess/API/C/WKAPICast.h b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
index 816f8f1ae..bef294e8a 100644
--- a/Source/WebKit2/UIProcess/API/C/WKAPICast.h
+++ b/Source/WebKit2/UIProcess/API/C/WKAPICast.h
@@ -56,6 +56,8 @@ class NotificationPermissionRequest;
 class WebApplicationCacheManagerProxy;
 class WebBackForwardList;
 class WebBackForwardListItem;
+class WebBatteryManagerProxy;
+class WebBatteryStatus;
 class WebResourceCacheManagerProxy;
 class WebContext;
 class WebCookieManagerProxy;
@@ -75,6 +77,8 @@ class WebIntentServiceInfo;
 class WebKeyValueStorageManagerProxy;
 class WebMediaCacheManagerProxy;
 class WebNavigationData;
+class WebNetworkInfoManagerProxy;
+class WebNetworkInfo;
 class WebNotification;
 class WebNotificationProvider;
 class WebNotificationManagerProxy;
@@ -88,12 +92,15 @@ class WebProtectionSpace;
 class WebRenderLayer;
 class WebRenderObject;
 class WebTextChecker;
+class WebVibrationProxy;
 
 WK_ADD_API_MAPPING(WKApplicationCacheManagerRef, WebApplicationCacheManagerProxy)
 WK_ADD_API_MAPPING(WKAuthenticationChallengeRef, AuthenticationChallengeProxy)
 WK_ADD_API_MAPPING(WKAuthenticationDecisionListenerRef, AuthenticationDecisionListener)
 WK_ADD_API_MAPPING(WKBackForwardListItemRef, WebBackForwardListItem)
 WK_ADD_API_MAPPING(WKBackForwardListRef, WebBackForwardList)
+WK_ADD_API_MAPPING(WKBatteryManagerRef, WebBatteryManagerProxy)
+WK_ADD_API_MAPPING(WKBatteryStatusRef, WebBatteryStatus)
 WK_ADD_API_MAPPING(WKResourceCacheManagerRef, WebResourceCacheManagerProxy)
 WK_ADD_API_MAPPING(WKContextRef, WebContext)
 WK_ADD_API_MAPPING(WKCookieManagerRef, WebCookieManagerProxy)
@@ -114,6 +121,8 @@ WK_ADD_API_MAPPING(WKIntentServiceInfoRef, WebIntentServiceInfo)
 WK_ADD_API_MAPPING(WKKeyValueStorageManagerRef, WebKeyValueStorageManagerProxy)
 WK_ADD_API_MAPPING(WKMediaCacheManagerRef, WebMediaCacheManagerProxy)
 WK_ADD_API_MAPPING(WKNavigationDataRef, WebNavigationData)
+WK_ADD_API_MAPPING(WKNetworkInfoManagerRef, WebNetworkInfoManagerProxy)
+WK_ADD_API_MAPPING(WKNetworkInfoRef, WebNetworkInfo)
 WK_ADD_API_MAPPING(WKNotificationManagerRef, WebNotificationManagerProxy)
 WK_ADD_API_MAPPING(WKNotificationPermissionRequestRef, NotificationPermissionRequest)
 WK_ADD_API_MAPPING(WKNotificationProviderRef, WebNotificationProvider)
@@ -128,6 +137,7 @@ WK_ADD_API_MAPPING(WKProtectionSpaceRef, WebProtectionSpace)
 WK_ADD_API_MAPPING(WKRenderLayerRef, WebRenderLayer)
 WK_ADD_API_MAPPING(WKRenderObjectRef, WebRenderObject)
 WK_ADD_API_MAPPING(WKTextCheckerRef, WebTextChecker)
+WK_ADD_API_MAPPING(WKVibrationRef, WebVibrationProxy)
 
 #if ENABLE(INSPECTOR)
 WK_ADD_API_MAPPING(WKInspectorRef, WebInspectorProxy)
diff --git a/Source/WebKit2/UIProcess/API/C/WKBatteryManager.cpp b/Source/WebKit2/UIProcess/API/C/WKBatteryManager.cpp
new file mode 100644
index 000000000..950336d56
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKBatteryManager.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKBatteryManager.h"
+
+#include "WKAPICast.h"
+#include <wtf/text/AtomicString.h>
+
+#if ENABLE(BATTERY_STATUS)
+#include "WebBatteryManagerProxy.h"
+#endif
+
+using namespace WebKit;
+
+WKTypeID WKBatteryManagerGetTypeID()
+{
+#if ENABLE(BATTERY_STATUS)
+    return toAPI(WebBatteryManagerProxy::APIType);
+#else
+    return 0;
+#endif
+}
+
+void WKBatteryManagerSetProvider(WKBatteryManagerRef batteryManager, const WKBatteryProvider* provider)
+{
+#if ENABLE(BATTERY_STATUS)
+    toImpl(batteryManager)->initializeProvider(provider);
+#endif
+}
+
+void WKBatteryManagerProviderDidChangeBatteryStatus(WKBatteryManagerRef batteryManager, WKStringRef eventType, WKBatteryStatusRef status)
+{
+#if ENABLE(BATTERY_STATUS)
+    toImpl(batteryManager)->providerDidChangeBatteryStatus(AtomicString(toImpl(eventType)->string()), toImpl(status));
+#endif
+}
+
+void WKBatteryManagerProviderUpdateBatteryStatus(WKBatteryManagerRef batteryManager, WKBatteryStatusRef status)
+{
+#if ENABLE(BATTERY_STATUS)
+    toImpl(batteryManager)->providerUpdateBatteryStatus(toImpl(status));
+#endif
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKBatteryManager.h b/Source/WebKit2/UIProcess/API/C/WKBatteryManager.h
new file mode 100644
index 000000000..712cbfb4c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKBatteryManager.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKBatteryManager_h
+#define WKBatteryManager_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// Provider.
+typedef void (*WKBatteryProviderStartUpdatingCallback)(WKBatteryManagerRef batteryManager, const void* clientInfo);
+typedef void (*WKBatteryProviderStopUpdatingCallback)(WKBatteryManagerRef batteryManager, const void* clientInfo);
+
+struct WKBatteryProvider {
+    int                                                                 version;
+    const void *                                                        clientInfo;
+    WKBatteryProviderStartUpdatingCallback                              startUpdating;
+    WKBatteryProviderStopUpdatingCallback                               stopUpdating;
+};
+typedef struct WKBatteryProvider WKBatteryProvider;
+
+enum { kWKBatteryProviderCurrentVersion = 0 };
+
+WK_EXPORT WKTypeID WKBatteryManagerGetTypeID();
+
+WK_EXPORT void WKBatteryManagerSetProvider(WKBatteryManagerRef batteryManager, const WKBatteryProvider* provider);
+
+WK_EXPORT void WKBatteryManagerProviderDidChangeBatteryStatus(WKBatteryManagerRef batteryManager, WKStringRef eventType, WKBatteryStatusRef status);
+WK_EXPORT void WKBatteryManagerProviderUpdateBatteryStatus(WKBatteryManagerRef batteryManager, WKBatteryStatusRef status);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* WKBatteryManager_h */
diff --git a/Source/WebKit2/UIProcess/API/C/WKBatteryStatus.cpp b/Source/WebKit2/UIProcess/API/C/WKBatteryStatus.cpp
new file mode 100644
index 000000000..0069a6f95
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKBatteryStatus.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKBatteryStatus.h"
+
+#include "WKAPICast.h"
+
+#if ENABLE(BATTERY_STATUS)
+#include "WebBatteryStatus.h"
+#endif
+
+using namespace WebKit;
+
+WKTypeID WKBatteryStatusGetTypeID()
+{
+#if ENABLE(BATTERY_STATUS)
+    return toAPI(WebBatteryStatus::APIType);
+#else
+    return 0;
+#endif
+}
+
+WKBatteryStatusRef WKBatteryStatusCreate(bool isCharging, double chargingTime, double dischargingTime, double level)
+{
+#if ENABLE(BATTERY_STATUS)
+    RefPtr<WebBatteryStatus> status = WebBatteryStatus::create(isCharging, chargingTime, dischargingTime, level);
+    return toAPI(status.release().leakRef());
+#else
+    return 0;
+#endif
+}
+
diff --git a/Source/WebKit2/UIProcess/API/C/WKBatteryStatus.h b/Source/WebKit2/UIProcess/API/C/WKBatteryStatus.h
new file mode 100644
index 000000000..afa1dd931
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKBatteryStatus.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKBatteryStatus_h
+#define WKBatteryStatus_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKBatteryStatusGetTypeID();
+
+WK_EXPORT WKBatteryStatusRef WKBatteryStatusCreate(bool isCharging, double chargingTime, double dischargingTime, double level);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKBatteryStatus_h
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.cpp b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
index 9f6dbbc37..7bfc04aed 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.cpp
@@ -170,6 +170,15 @@ WKApplicationCacheManagerRef WKContextGetApplicationCacheManager(WKContextRef co
     return toAPI(toImpl(contextRef)->applicationCacheManagerProxy());
 }
 
+WKBatteryManagerRef WKContextGetBatteryManager(WKContextRef contextRef)
+{
+#if ENABLE(BATTERY_STATUS)
+    return toAPI(toImpl(contextRef)->batteryManagerProxy());
+#else
+    return 0;
+#endif
+}
+
 WKDatabaseManagerRef WKContextGetDatabaseManager(WKContextRef contextRef)
 {
     return toAPI(toImpl(contextRef)->databaseManagerProxy());
diff --git a/Source/WebKit2/UIProcess/API/C/WKContext.h b/Source/WebKit2/UIProcess/API/C/WKContext.h
index f4299daff..85e4c157c 100644
--- a/Source/WebKit2/UIProcess/API/C/WKContext.h
+++ b/Source/WebKit2/UIProcess/API/C/WKContext.h
@@ -42,16 +42,22 @@ typedef uint32_t WKCacheModel;
 // Injected Bundle Client
 typedef void (*WKContextDidReceiveMessageFromInjectedBundleCallback)(WKContextRef page, WKStringRef messageName, WKTypeRef messageBody, const void *clientInfo);
 typedef void (*WKContextDidReceiveSynchronousMessageFromInjectedBundleCallback)(WKContextRef page, WKStringRef messageName, WKTypeRef messageBody, WKTypeRef* returnData, const void *clientInfo);
+typedef WKTypeRef (*WKContextGetInjectedBundleInitializationUserDataCallback)(WKContextRef context, const void *clientInfo);
 
 struct WKContextInjectedBundleClient {
     int                                                                 version;
     const void *                                                        clientInfo;
+
+    // Version 0.
     WKContextDidReceiveMessageFromInjectedBundleCallback                didReceiveMessageFromInjectedBundle;
     WKContextDidReceiveSynchronousMessageFromInjectedBundleCallback     didReceiveSynchronousMessageFromInjectedBundle;
+
+    // Version 1.
+    WKContextGetInjectedBundleInitializationUserDataCallback            getInjectedBundleInitializationUserData;
 };
 typedef struct WKContextInjectedBundleClient WKContextInjectedBundleClient;
 
-enum { kWKContextInjectedBundleClientCurrentVersion = 0 };
+enum { kWKContextInjectedBundleClientCurrentVersion = 1 };
 
 // History Client
 typedef void (*WKContextDidNavigateWithNavigationDataCallback)(WKContextRef context, WKPageRef page, WKNavigationDataRef navigationData, WKFrameRef frame, const void *clientInfo);
@@ -142,6 +148,7 @@ WK_EXPORT void WKContextStartMemorySampler(WKContextRef context, WKDoubleRef int
 WK_EXPORT void WKContextStopMemorySampler(WKContextRef context);
 
 WK_EXPORT WKApplicationCacheManagerRef WKContextGetApplicationCacheManager(WKContextRef context);
+WK_EXPORT WKBatteryManagerRef WKContextGetBatteryManager(WKContextRef context);
 WK_EXPORT WKCookieManagerRef WKContextGetCookieManager(WKContextRef context);
 WK_EXPORT WKDatabaseManagerRef WKContextGetDatabaseManager(WKContextRef context);
 WK_EXPORT WKGeolocationManagerRef WKContextGetGeolocationManager(WKContextRef context);
diff --git a/Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.cpp b/Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.cpp
new file mode 100644
index 000000000..5a30fb71a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKIntentServiceInfo.h"
+
+#include "WKAPICast.h"
+
+#if ENABLE(WEB_INTENTS_TAG)
+#include "WebIntentServiceInfo.h"
+#endif
+
+using namespace WebKit;
+
+WKTypeID WKIntentServiceInfoGetTypeID()
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    return toAPI(WebIntentServiceInfo::APIType);
+#else
+    return 0;
+#endif
+}
+
+WKStringRef WKIntentServiceInfoCopyAction(WKIntentServiceInfoRef serviceRef)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    return toCopiedAPI(toImpl(serviceRef)->action());
+#else
+    return 0;
+#endif
+}
+
+WKStringRef WKIntentServiceInfoCopyType(WKIntentServiceInfoRef serviceRef)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    return toCopiedAPI(toImpl(serviceRef)->payloadType());
+#else
+    return 0;
+#endif
+}
+
+WKURLRef WKIntentServiceInfoCopyHref(WKIntentServiceInfoRef serviceRef)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    return toCopiedURLAPI(toImpl(serviceRef)->href());
+#else
+    return 0;
+#endif
+}
+
+WKStringRef WKIntentServiceInfoCopyTitle(WKIntentServiceInfoRef serviceRef)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    return toCopiedAPI(toImpl(serviceRef)->title());
+#else
+    return 0;
+#endif
+}
+
+WKStringRef WKIntentServiceInfoCopyDisposition(WKIntentServiceInfoRef serviceRef)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    return toCopiedAPI(toImpl(serviceRef)->disposition());
+#else
+    return 0;
+#endif
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.h b/Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.h
new file mode 100644
index 000000000..121cffde8
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKIntentServiceInfo.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKIntentServiceInfo_h
+#define WKIntentServiceInfo_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+WK_EXPORT WKTypeID WKIntentServiceInfoGetTypeID();
+WK_EXPORT WKStringRef WKIntentServiceInfoCopyAction(WKIntentServiceInfoRef serviceRef);
+WK_EXPORT WKStringRef WKIntentServiceInfoCopyType(WKIntentServiceInfoRef serviceRef);
+WK_EXPORT WKURLRef WKIntentServiceInfoCopyHref(WKIntentServiceInfoRef serviceRef);
+WK_EXPORT WKStringRef WKIntentServiceInfoCopyTitle(WKIntentServiceInfoRef serviceRef);
+WK_EXPORT WKStringRef WKIntentServiceInfoCopyDisposition(WKIntentServiceInfoRef serviceRef);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKIntentServiceInfo_h
diff --git a/Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.cpp b/Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.cpp
new file mode 100644
index 000000000..1e0733ac2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKNetworkInfoManager.h"
+
+#include "WKAPICast.h"
+#include "WebNetworkInfoManagerProxy.h"
+
+using namespace WebKit;
+
+WKTypeID WKNetworkInfoManagerGetTypeID()
+{
+#if ENABLE(NETWORK_INFO)
+    return toAPI(WebNetworkInfoManagerProxy::APIType);
+#else
+    return 0;
+#endif
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.h b/Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.h
new file mode 100644
index 000000000..efecf4ef8
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKNetworkInfoManager.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKNetworkInfoManager_h
+#define WKNetworkInfoManager_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// Provider.
+typedef void (*WKNetworkInfoProviderStartUpdatingCallback)(WKNetworkInfoManagerRef networkInfoManager, const void* clientInfo);
+typedef void (*WKNetworkInfoProviderStopUpdatingCallback)(WKNetworkInfoManagerRef networkInfoManager, const void* clientInfo);
+typedef double (*WKNetworkInfoProviderGetBandwidthCallback)(WKNetworkInfoManagerRef networkInfoManager, const void* clientInfo);
+typedef bool (*WKNetworkInfoProviderIsMeteredCallback)(WKNetworkInfoManagerRef networkInfoManager, const void* clientInfo);
+
+struct WKNetworkInfoProvider {
+    int                                                                 version;
+    const void *                                                        clientInfo;
+    WKNetworkInfoProviderStartUpdatingCallback                          startUpdating;
+    WKNetworkInfoProviderStopUpdatingCallback                           stopUpdating;
+    WKNetworkInfoProviderGetBandwidthCallback                           bandwidth;
+    WKNetworkInfoProviderIsMeteredCallback                              isMetered;
+};
+typedef struct WKNetworkInfoProvider WKNetworkInfoProvider;
+
+enum { kWKNetworkInfoProviderCurrentVersion = 0 };
+
+WK_EXPORT WKTypeID WKNetworkInfoManagerGetTypeID();
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKNetworkInfoManager_h
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.cpp b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
index c2a21b5bb..5c600350a 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.cpp
@@ -684,6 +684,13 @@ void WKPageEndPrinting(WKPageRef page)
 }
 #endif
 
+void WKPageDeliverIntentToFrame(WKPageRef page, WKFrameRef frame, WKIntentDataRef intent)
+{
+#if ENABLE(WEB_INTENTS)
+    toImpl(page)->deliverIntentToFrame(toImpl(frame), toImpl(intent));
+#endif
+}
+
 WKImageRef WKPageCreateSnapshotOfVisibleContent(WKPageRef)
 {
     return 0;
diff --git a/Source/WebKit2/UIProcess/API/C/WKPage.h b/Source/WebKit2/UIProcess/API/C/WKPage.h
index 035f51daa..12a7b63e9 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPage.h
+++ b/Source/WebKit2/UIProcess/API/C/WKPage.h
@@ -468,6 +468,8 @@ WK_EXPORT void WKPageGetContentsAsString_b(WKPageRef page, WKPageGetContentsAsSt
 typedef void (*WKPageForceRepaintFunction)(WKErrorRef, void*);
 WK_EXPORT void WKPageForceRepaint(WKPageRef page, void* context, WKPageForceRepaintFunction function);
 
+WK_EXPORT void WKPageDeliverIntentToFrame(WKPageRef page, WKFrameRef frame, WKIntentDataRef intent);
+
 /*
     Some of the more common command name strings include the following, although any WebCore EditorCommand string is supported:
     
diff --git a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
index 9fe8d6ab9..727781f01 100644
--- a/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
+++ b/Source/WebKit2/UIProcess/API/C/WKPreferences.cpp
@@ -650,12 +650,11 @@ bool WKPreferencesGetFileAccessFromFileURLsAllowed(WKPreferencesRef preferencesR
 
 void WKPreferencesSetHixie76WebSocketProtocolEnabled(WKPreferencesRef preferencesRef, bool enabled)
 {
-    toImpl(preferencesRef)->setHixie76WebSocketProtocolEnabled(enabled);
 }
 
 bool WKPreferencesGetHixie76WebSocketProtocolEnabled(WKPreferencesRef preferencesRef)
 {
-    return toImpl(preferencesRef)->hixie76WebSocketProtocolEnabled();
+    return false;
 }
 
 void WKPreferencesSetMediaPlaybackRequiresUserGesture(WKPreferencesRef preferencesRef, bool flag)
diff --git a/Source/WebKit2/UIProcess/API/C/WKVibration.cpp b/Source/WebKit2/UIProcess/API/C/WKVibration.cpp
new file mode 100644
index 000000000..e9d933ceb
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKVibration.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WKVibration.h"
+
+#include "WKAPICast.h"
+
+#if ENABLE(VIBRATION)
+#include "WebVibrationProxy.h"
+#endif
+
+using namespace WebKit;
+
+WKTypeID WKVibrationGetTypeID()
+{
+#if ENABLE(VIBRATION)
+    return toAPI(WebVibrationProxy::APIType);
+#else
+    return 0;
+#endif
+}
+
+void WKVibrationSetProvider(WKVibrationRef vibrationRef, const WKVibrationProvider* wkProvider)
+{
+#if ENABLE(VIBRATION)
+    toImpl(vibrationRef)->initializeProvider(wkProvider);
+#endif
+}
diff --git a/Source/WebKit2/UIProcess/API/C/WKVibration.h b/Source/WebKit2/UIProcess/API/C/WKVibration.h
new file mode 100644
index 000000000..f300b46e8
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/C/WKVibration.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WKVibration_h
+#define WKVibration_h
+
+#include <WebKit2/WKBase.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+// Provider.
+typedef void (*WKVibrationProviderVibrateCallback)(WKVibrationRef vibrationRef, uint64_t vibrationTime, const void* clientInfo);
+typedef void (*WKVibrationProviderCancelVibrationCallback)(WKVibrationRef vibrationRef, const void* clientInfo);
+
+struct WKVibrationProvider {
+    int                                                                 version;
+    const void *                                                        clientInfo;
+    WKVibrationProviderVibrateCallback                                  vibrate;
+    WKVibrationProviderCancelVibrationCallback                          cancelVibration;
+};
+typedef struct WKVibrationProvider WKVibrationProvider;
+
+enum { kWKVibrationProviderCurrentVersion = 0 };
+
+WK_EXPORT WKTypeID WKVibrationGetTypeID();
+
+WK_EXPORT void WKVibrationSetProvider(WKVibrationRef vibrationRef, const WKVibrationProvider* provider);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // WKVibration_h
diff --git a/Source/WebKit2/UIProcess/API/efl/BatteryProvider.cpp b/Source/WebKit2/UIProcess/API/efl/BatteryProvider.cpp
new file mode 100644
index 000000000..2bd55e211
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/BatteryProvider.cpp
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BatteryProvider.h"
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "WKAPICast.h"
+#include "WKBatteryManager.h"
+#include "WKBatteryStatus.h"
+
+using namespace WebCore;
+using namespace WebKit;
+
+static inline BatteryProviderEfl* toBatteryProvider(const void* clientInfo)
+{
+    return static_cast<BatteryProviderEfl*>(const_cast<void*>(clientInfo));
+}
+
+static void startUpdatingCallback(WKBatteryManagerRef batteryManager, const void* clientInfo)
+{
+    toBatteryProvider(clientInfo)->startUpdating();
+}
+
+static void stopUpdatingCallback(WKBatteryManagerRef batteryManager, const void* clientInfo)
+{
+    toBatteryProvider(clientInfo)->stopUpdating();
+}
+
+BatteryProvider::~BatteryProvider()
+{
+    m_provider.stopUpdating();
+}
+
+PassRefPtr<BatteryProvider> BatteryProvider::create(WKBatteryManagerRef wkBatteryManager)
+{
+    return adoptRef(new BatteryProvider(wkBatteryManager));
+}
+
+BatteryProvider::BatteryProvider(WKBatteryManagerRef wkBatteryManager)
+    : m_wkBatteryManager(wkBatteryManager)
+    , m_provider(this)
+{
+    ASSERT(wkBatteryManager);
+
+    WKBatteryProvider wkBatteryProvider = {
+        kWKBatteryProviderCurrentVersion,
+        this, // clientInfo
+        startUpdatingCallback,
+        stopUpdatingCallback
+    };
+    WKBatteryManagerSetProvider(m_wkBatteryManager.get(), &wkBatteryProvider);
+}
+
+void BatteryProvider::startUpdating()
+{
+    m_provider.startUpdating();
+}
+
+void BatteryProvider::stopUpdating()
+{
+    m_provider.stopUpdating();
+}
+
+void BatteryProvider::didChangeBatteryStatus(const AtomicString& eventType, PassRefPtr<BatteryStatus> status)
+{
+    WKRetainPtr<WKBatteryStatusRef> wkBatteryStatus(AdoptWK, WKBatteryStatusCreate(status->charging(), status->chargingTime(), status->dischargingTime(), status->level()));
+    WKBatteryManagerProviderDidChangeBatteryStatus(m_wkBatteryManager.get(), toAPI(eventType.impl()), wkBatteryStatus.get());
+}
+
+#endif // ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit2/UIProcess/API/efl/BatteryProvider.h b/Source/WebKit2/UIProcess/API/efl/BatteryProvider.h
new file mode 100644
index 000000000..e9e4cf5f0
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/BatteryProvider.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BatteryProvider_h
+#define BatteryProvider_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "BatteryProviderEfl.h"
+#include "BatteryProviderEflClient.h"
+#include "BatteryStatus.h"
+#include "WKRetainPtr.h"
+#include <WebKit2/WKBase.h>
+#include <wtf/PassRefPtr.h>
+
+class BatteryProvider : public RefCounted<BatteryProvider>, public WebCore::BatteryProviderEflClient {
+public:
+    virtual ~BatteryProvider();
+    static PassRefPtr<BatteryProvider> create(WKBatteryManagerRef);
+
+    void startUpdating();
+    void stopUpdating();
+
+private:
+    BatteryProvider(WKBatteryManagerRef);
+
+    // BatteryProviderEflClient interface.
+    virtual void didChangeBatteryStatus(const AtomicString& eventType, PassRefPtr<WebCore::BatteryStatus>);
+
+    WKRetainPtr<WKBatteryManagerRef> m_wkBatteryManager;
+    WebCore::BatteryProviderEfl m_provider;
+};
+
+#endif // ENABLE(BATTERY_STATUS)
+
+#endif // BatteryProvider_h
diff --git a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
index e143b781b..799d258e0 100644
--- a/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
+++ b/Source/WebKit2/UIProcess/API/efl/EWebKit2.h
@@ -28,6 +28,11 @@
 #define EWebKit2_h
 
 #include "ewk_context.h"
+#include "ewk_intent.h"
+#include "ewk_intent_service.h"
+#include "ewk_url_request.h"
 #include "ewk_view.h"
+#include "ewk_web_error.h"
+#include "ewk_web_resource.h"
 
 #endif // EWebKit2_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
index 90685cf92..791bc95f4 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_context.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ewk_context.h"
 
+#include "BatteryProvider.h"
 #include "WKAPICast.h"
 #include "WKRetainPtr.h"
 #include "ewk_context_private.h"
@@ -29,6 +30,9 @@ using namespace WebKit;
 
 struct _Ewk_Context {
     WKRetainPtr<WKContextRef> context;
+#if ENABLE(BATTERY_STATUS)
+    RefPtr<BatteryProvider> batteryProvider;
+#endif
 
     _Ewk_Context(WKContextRef contextRef)
     {
@@ -41,8 +45,22 @@ WKContextRef ewk_context_WKContext_get(const Ewk_Context* ewkContext)
     return ewkContext->context.get();
 }
 
+static inline Ewk_Context* createDefaultEwkContext()
+{
+    WKContextRef wkContext = WKContextGetSharedProcessContext();
+    Ewk_Context* ewkContext = new Ewk_Context(wkContext);
+
+#if ENABLE(BATTERY_STATUS)
+    WKBatteryManagerRef wkBatteryManager = WKContextGetBatteryManager(wkContext);
+    ewkContext->batteryProvider = BatteryProvider::create(wkBatteryManager);
+#endif
+
+    return ewkContext;
+}
+
 Ewk_Context* ewk_context_default_get()
 {
-    DEFINE_STATIC_LOCAL(Ewk_Context, defaultContext, (WKContextGetSharedProcessContext()));
-    return &defaultContext;
+    static Ewk_Context* defaultContext = createDefaultEwkContext();
+
+    return defaultContext;
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_intent.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_intent.cpp
new file mode 100644
index 000000000..63b9ee364
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_intent.cpp
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_intent.h"
+
+#include "WKAPICast.h"
+#include "WKArray.h"
+#include "WKDictionary.h"
+#include "WKIntentData.h"
+#include "WKRetainPtr.h"
+#include "WKString.h"
+#include "WKURL.h"
+#include "ewk_intent_private.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+/**
+ * \struct  _Ewk_Intent
+ * @brief   Contains the intent data.
+ */
+struct _Ewk_Intent {
+    unsigned int __ref; /**< the reference count of the object */
+#if ENABLE(WEB_INTENTS)
+    WKRetainPtr<WKIntentDataRef> wkIntent;
+#endif
+    const char* action;
+    const char* type;
+    const char* service;
+};
+
+#define EWK_INTENT_WK_GET_OR_RETURN(intent, wkIntent_, ...)    \
+    if (!(intent)) {                                           \
+        EINA_LOG_CRIT("intent is NULL.");                      \
+        return __VA_ARGS__;                                    \
+    }                                                          \
+    if (!(intent)->wkIntent) {                                 \
+        EINA_LOG_CRIT("intent->wkIntent is NULL.");            \
+        return __VA_ARGS__;                                    \
+    }                                                          \
+    WKIntentDataRef wkIntent_ = (intent)->wkIntent.get()
+
+void ewk_intent_ref(Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EINA_SAFETY_ON_NULL_RETURN(intent);
+    ++intent->__ref;
+#endif
+}
+
+void ewk_intent_unref(Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EINA_SAFETY_ON_NULL_RETURN(intent);
+
+    if (--intent->__ref)
+        return;
+
+    eina_stringshare_del(intent->action);
+    eina_stringshare_del(intent->type);
+    eina_stringshare_del(intent->service);
+    free(intent);
+#endif
+}
+
+const char* ewk_intent_action_get(const Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EWK_INTENT_WK_GET_OR_RETURN(intent, wkIntent, 0);
+
+    WKRetainPtr<WKStringRef> wkAction(AdoptWK, WKIntentDataCopyAction(wkIntent));
+    Ewk_Intent* ewkIntent = const_cast<Ewk_Intent*>(intent);
+    eina_stringshare_replace(&ewkIntent->action, toImpl(wkAction.get())->string().utf8().data());
+
+    return intent->action;
+#else
+    return 0;
+#endif
+}
+
+const char* ewk_intent_type_get(const Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EWK_INTENT_WK_GET_OR_RETURN(intent, wkIntent, 0);
+
+    WKRetainPtr<WKStringRef> wkType(AdoptWK, WKIntentDataCopyType(wkIntent));
+    Ewk_Intent* ewkIntent = const_cast<Ewk_Intent*>(intent);
+    eina_stringshare_replace(&ewkIntent->type, toImpl(wkType.get())->string().utf8().data());
+
+    return intent->type;
+#else
+    return 0;
+#endif
+}
+
+const char* ewk_intent_service_get(const Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EWK_INTENT_WK_GET_OR_RETURN(intent, wkIntent, 0);
+
+    WKRetainPtr<WKURLRef> wkService(AdoptWK, WKIntentDataCopyService(wkIntent));
+    Ewk_Intent* ewkIntent = const_cast<Ewk_Intent*>(intent);
+    eina_stringshare_replace(&ewkIntent->service, toImpl(wkService.get())->string().utf8().data());
+
+    return intent->service;
+#else
+    return 0;
+#endif
+}
+
+Eina_List* ewk_intent_suggestions_get(const Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EWK_INTENT_WK_GET_OR_RETURN(intent, wkIntent, 0);
+
+    Eina_List* listOfSuggestions = 0;
+    WKRetainPtr<WKArrayRef> wkSuggestions(AdoptWK, WKIntentDataCopySuggestions(wkIntent));
+    const size_t numSuggestions = WKArrayGetSize(wkSuggestions.get());
+    for (size_t i = 0; i < numSuggestions; ++i) {
+        WKURLRef wkSuggestion = static_cast<WKURLRef>(WKArrayGetItemAtIndex(wkSuggestions.get(), i));
+        listOfSuggestions = eina_list_append(listOfSuggestions, strdup(toImpl(wkSuggestion)->string().utf8().data()));
+    }
+
+    return listOfSuggestions;
+#else
+    return 0;
+#endif
+}
+
+char* ewk_intent_extra_get(const Ewk_Intent* intent, const char* key)
+{
+#if ENABLE(WEB_INTENTS)
+    EWK_INTENT_WK_GET_OR_RETURN(intent, wkIntent, 0);
+
+    WKRetainPtr<WKStringRef> keyRef = adoptWK(WKStringCreateWithUTF8CString(key));
+    WKRetainPtr<WKStringRef> wkValue(AdoptWK, WKIntentDataCopyExtra(wkIntent, keyRef.get()));
+    String value = toImpl(wkValue.get())->string();
+    if (value.isEmpty())
+        return 0;
+
+    return strdup(value.utf8().data());
+#else
+    return 0;
+#endif
+}
+
+Eina_List* ewk_intent_extra_names_get(const Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EWK_INTENT_WK_GET_OR_RETURN(intent, wkIntent, 0);
+
+    Eina_List* listOfKeys = 0;
+    WKRetainPtr<WKDictionaryRef> wkExtras(AdoptWK, WKIntentDataCopyExtras(wkIntent));
+    WKRetainPtr<WKArrayRef> wkKeys(AdoptWK, WKDictionaryCopyKeys(wkExtras.get()));
+    const size_t numKeys = WKArrayGetSize(wkKeys.get());
+    for (size_t i = 0; i < numKeys; ++i) {
+        WKStringRef wkKey = static_cast<WKStringRef>(WKArrayGetItemAtIndex(wkKeys.get(), i));
+        listOfKeys = eina_list_append(listOfKeys, strdup(toImpl(wkKey)->string().utf8().data()));
+    }
+
+    return listOfKeys;
+#else
+    return 0;
+#endif
+}
+
+#if ENABLE(WEB_INTENTS)
+Ewk_Intent* ewk_intent_new(WKIntentDataRef intentData)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(intentData, 0);
+
+    Ewk_Intent* ewkIntent = static_cast<Ewk_Intent*>(calloc(1, sizeof(Ewk_Intent)));
+    ewkIntent->__ref = 1;
+    ewkIntent->wkIntent = intentData;
+
+    return ewkIntent;
+}
+
+WKIntentDataRef ewk_intent_WKIntentDataRef_get(const Ewk_Intent* intent)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(intent, 0);
+    return intent->wkIntent.get();
+}
+#endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_intent.h b/Source/WebKit2/UIProcess/API/efl/ewk_intent.h
new file mode 100644
index 000000000..fdcfe00d4
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_intent.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_intent.h
+ * @brief   Describes the Ewk Intent API.
+ */
+
+#ifndef ewk_intent_h
+#define ewk_intent_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for _Ewk_Intent */
+typedef struct _Ewk_Intent Ewk_Intent;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param intent the intent object to increase the reference count
+ */
+EAPI void ewk_intent_ref(Ewk_Intent *intent);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count it's reached 0, the intent is freed.
+ *
+ * @param intent the intent object to decrease the reference count
+ */
+EAPI void ewk_intent_unref(Ewk_Intent *intent);
+
+/**
+ * Query action for this intent.
+ *
+ * @param intent intent item to query.
+ *
+ * @return the action pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_intent_action_get(const Ewk_Intent *intent);
+
+/**
+ * Query type for this intent.
+ *
+ * @param intent intent item to query.
+ *
+ * @return the type pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_intent_type_get(const Ewk_Intent *intent);
+
+/**
+ * Query service for this intent.
+ *
+ * @param intent intent item to query.
+ *
+ * @return the service pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_intent_service_get(const Ewk_Intent *intent);
+
+/**
+ * Query suggestions for this intent.
+ *
+ * This function provides a list of (absolute) suggested Service URLs of which the Client
+ * is aware and which can handle the intent.
+ *
+ * @param intent intent item to query.
+ *
+ * @return @c Eina_List with suggested service URLs on success, or @c 0 on failure,
+ *         the Eina_List and its items should be freed after use. Use free() to free the
+ *         items.
+ */
+EAPI Eina_List *ewk_intent_suggestions_get(const Ewk_Intent *intent);
+
+/**
+ * Retrieves the value (if any) from the extra data dictionary this intent was constructed with.
+ *
+ * @param intent intent item to query.
+ * @param key key to query in the dictionary.
+ *
+ * @return a newly allocated string or @c NULL in case of error or if the key does not exist.
+ */
+EAPI char *ewk_intent_extra_get(const Ewk_Intent *intent, const char *key);
+
+/**
+ * Retrieve a list of the names of extra metadata associated with the intent.
+ *
+ * @param intent intent item to query.
+ *
+ * @return @c Eina_List with names of extra metadata on success, or @c 0 on failure,
+ *         the Eina_List and its items should be freed after use. Use free() to free the
+ *         items.
+ */
+EAPI Eina_List *ewk_intent_extra_names_get(const Ewk_Intent *intent);
+
+#ifdef __cplusplus
+}
+#endif
+#endif // ewk_intent_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_intent_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_intent_private.h
new file mode 100644
index 000000000..0f8268930
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_intent_private.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_intent_private_h
+#define ewk_intent_private_h
+
+#if ENABLE(WEB_INTENTS)
+
+#include <WebKit2/WKBase.h>
+
+typedef struct _Ewk_Intent Ewk_Intent;
+
+Ewk_Intent* ewk_intent_new(WKIntentDataRef intentData);
+WKIntentDataRef ewk_intent_WKIntentDataRef_get(const Ewk_Intent* intent);
+
+#endif // ENABLE(WEB_INTENTS)
+
+#endif // ewk_intent_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_intent_service.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_intent_service.cpp
new file mode 100644
index 000000000..be9b84499
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_intent_service.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_intent_service.h"
+
+#include "IntentServiceInfo.h"
+#include "WKAPICast.h"
+#include "WKIntentServiceInfo.h"
+#include "WKRetainPtr.h"
+#include "WKURL.h"
+#include "ewk_intent_service_private.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+/**
+ * \struct _Ewk_Intent_Service
+ * @brief Contains the intent service data.
+ */
+struct _Ewk_Intent_Service {
+    unsigned int __ref; /**< the reference count of the object */
+#if ENABLE(WEB_INTENTS_TAG)
+    WKRetainPtr<WKIntentServiceInfoRef> wkService;
+#endif
+    const char* action;
+    const char* type;
+    const char* href;
+    const char* title;
+    const char* disposition;
+};
+
+#define EWK_INTENT_SERVICE_WK_GET_OR_RETURN(service, wkService_, ...) \
+    if (!(service)) { \
+        EINA_LOG_CRIT("service is NULL."); \
+        return __VA_ARGS__; \
+    } \
+    if (!(service)->wkService) { \
+        EINA_LOG_CRIT("service->wkService is NULL."); \
+        return __VA_ARGS__; \
+    } \
+    WKIntentServiceInfoRef wkService_ = (service)->wkService.get()
+
+void ewk_intent_service_ref(Ewk_Intent_Service* service)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    EINA_SAFETY_ON_NULL_RETURN(service);
+    ++service->__ref;
+#endif
+}
+
+void ewk_intent_service_unref(Ewk_Intent_Service* service)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    EINA_SAFETY_ON_NULL_RETURN(service);
+
+    if (--service->__ref)
+        return;
+
+    eina_stringshare_del(service->action);
+    eina_stringshare_del(service->type);
+    eina_stringshare_del(service->href);
+    eina_stringshare_del(service->title);
+    eina_stringshare_del(service->disposition);
+    free(service);
+#endif
+}
+
+const char* ewk_intent_service_action_get(const Ewk_Intent_Service* service)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    EWK_INTENT_SERVICE_WK_GET_OR_RETURN(service, wkService, 0);
+
+    WKRetainPtr<WKStringRef> wkAction(AdoptWK, WKIntentServiceInfoCopyAction(wkService));
+    Ewk_Intent_Service* ewkIntentService = const_cast<Ewk_Intent_Service*>(service);
+    eina_stringshare_replace(&ewkIntentService->action, toImpl(wkAction.get())->string().utf8().data());
+
+    return service->action;
+#else
+    return 0;
+#endif
+}
+
+const char* ewk_intent_service_type_get(const Ewk_Intent_Service* service)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    EWK_INTENT_SERVICE_WK_GET_OR_RETURN(service, wkService, 0);
+
+    WKRetainPtr<WKStringRef> wkType(AdoptWK, WKIntentServiceInfoCopyType(wkService));
+    Ewk_Intent_Service* ewkIntentService = const_cast<Ewk_Intent_Service*>(service);
+    eina_stringshare_replace(&ewkIntentService->type, toImpl(wkType.get())->string().utf8().data());
+
+    return service->type;
+#else
+    return 0;
+#endif
+}
+
+const char* ewk_intent_service_href_get(const Ewk_Intent_Service* service)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    EWK_INTENT_SERVICE_WK_GET_OR_RETURN(service, wkService, 0);
+
+    WKRetainPtr<WKURLRef> wkHref(AdoptWK, WKIntentServiceInfoCopyHref(wkService));
+    Ewk_Intent_Service* ewkIntentService = const_cast<Ewk_Intent_Service*>(service);
+    eina_stringshare_replace(&ewkIntentService->href, toImpl(wkHref.get())->string().utf8().data());
+
+    return service->href;
+#else
+    return 0;
+#endif
+}
+
+const char* ewk_intent_service_title_get(const Ewk_Intent_Service* service)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    EWK_INTENT_SERVICE_WK_GET_OR_RETURN(service, wkService, 0);
+
+    WKRetainPtr<WKStringRef> wkTitle(AdoptWK, WKIntentServiceInfoCopyTitle(wkService));
+    Ewk_Intent_Service* ewkIntentService = const_cast<Ewk_Intent_Service*>(service);
+    eina_stringshare_replace(&ewkIntentService->title, toImpl(wkTitle.get())->string().utf8().data());
+
+    return service->title;
+#else
+    return 0;
+#endif
+}
+
+const char* ewk_intent_service_disposition_get(const Ewk_Intent_Service* service)
+{
+#if ENABLE(WEB_INTENTS_TAG)
+    EWK_INTENT_SERVICE_WK_GET_OR_RETURN(service, wkService, 0);
+
+    WKRetainPtr<WKStringRef> wkDisposition(AdoptWK, WKIntentServiceInfoCopyDisposition(wkService));
+    Ewk_Intent_Service* ewkIntentService = const_cast<Ewk_Intent_Service*>(service);
+    eina_stringshare_replace(&ewkIntentService->disposition, toImpl(wkDisposition.get())->string().utf8().data());
+
+    return service->disposition;
+#else
+    return 0;
+#endif
+}
+
+#if ENABLE(WEB_INTENTS_TAG)
+Ewk_Intent_Service* ewk_intent_service_new(WKIntentServiceInfoRef wkService)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(wkService, 0);
+
+    Ewk_Intent_Service* ewkIntentService = static_cast<Ewk_Intent_Service*>(calloc(1, sizeof(Ewk_Intent_Service)));
+    ewkIntentService->__ref = 1;
+    ewkIntentService->wkService = wkService;
+
+    return ewkIntentService;
+}
+#endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_intent_service.h b/Source/WebKit2/UIProcess/API/efl/ewk_intent_service.h
new file mode 100644
index 000000000..de22f6c4c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_intent_service.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file ewk_intent_service.h
+ * @brief Describes the Ewk Intent Service API.
+ */
+
+#ifndef ewk_intent_service_h
+#define ewk_intent_service_h
+
+#include <Evas.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for _Ewk_Intent_Service */
+typedef struct _Ewk_Intent_Service Ewk_Intent_Service;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param service the intent service object to increase the reference count
+ */
+EAPI void ewk_intent_service_ref(Ewk_Intent_Service *service);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count it's reached 0, the intent service is freed.
+ *
+ * @param service the intent service object to decrease the reference count
+ */
+EAPI void ewk_intent_service_unref(Ewk_Intent_Service *service);
+
+/**
+ * Query action for this intent service.
+ *
+ * @param service service item to query.
+ *
+ * @return the action pointer, that may be @c NULL. This pointer is
+ * guaranteed to be eina_stringshare, so whenever possible
+ * save yourself some cpu cycles and use
+ * eina_stringshare_ref() instead of eina_stringshare_add() or
+ * strdup().
+ */
+EAPI const char *ewk_intent_service_action_get(const Ewk_Intent_Service *service);
+
+/**
+ * Query type for this intent service.
+ *
+ * @param service service item to query.
+ *
+ * @return the type pointer, that may be @c NULL. This pointer is
+ * guaranteed to be eina_stringshare, so whenever possible
+ * save yourself some cpu cycles and use
+ * eina_stringshare_ref() instead of eina_stringshare_add() or
+ * strdup().
+ */
+EAPI const char *ewk_intent_service_type_get(const Ewk_Intent_Service *service);
+
+/**
+ * Query URL for this intent service.
+ *
+ * @param service service item to query.
+ *
+ * @return the URL pointer, that may be @c NULL. This pointer is
+ * guaranteed to be eina_stringshare, so whenever possible
+ * save yourself some cpu cycles and use
+ * eina_stringshare_ref() instead of eina_stringshare_add() or
+ * strdup().
+ */
+EAPI const char *ewk_intent_service_href_get(const Ewk_Intent_Service *service);
+
+/**
+ * Query title for this intent service.
+ *
+ * @param service service item to query.
+ *
+ * @return the title pointer, that may be @c NULL. This pointer is
+ * guaranteed to be eina_stringshare, so whenever possible
+ * save yourself some cpu cycles and use
+ * eina_stringshare_ref() instead of eina_stringshare_add() or
+ * strdup().
+ */
+EAPI const char *ewk_intent_service_title_get(const Ewk_Intent_Service *service);
+
+/**
+ * Query disposition for this intent service.
+ *
+ * @param service service item to query.
+ *
+ * @return the disposition pointer, that may be @c NULL. This pointer is
+ * guaranteed to be eina_stringshare, so whenever possible
+ * save yourself some cpu cycles and use
+ * eina_stringshare_ref() instead of eina_stringshare_add() or
+ * strdup().
+ */
+EAPI const char *ewk_intent_service_disposition_get(const Ewk_Intent_Service *service);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // ewk_intent_service_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_intent_service_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_intent_service_private.h
new file mode 100644
index 000000000..7ff4923cc
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_intent_service_private.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_intent_service_private_h
+#define ewk_intent_service_private_h
+
+#if ENABLE(WEB_INTENTS_TAG)
+
+#include <WebKit2/WKBase.h>
+
+typedef struct _Ewk_Intent_Service Ewk_Intent_Service;
+
+Ewk_Intent_Service* ewk_intent_service_new(WKIntentServiceInfoRef wkService);
+
+#endif // ENABLE(WEB_INTENTS_TAG)
+
+#endif // ewk_intent_service_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
new file mode 100644
index 000000000..0aa874bf7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.cpp
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_url_request.h"
+
+#include "WKAPICast.h"
+#include "WKRetainPtr.h"
+#include "WKURL.h"
+#include "WKURLRequest.h"
+#include "WebURLRequest.h"
+#include "WebURLRequestEfl.h"
+#include "ewk_url_request_private.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+/**
+ * \struct  _Ewk_Url_Request
+ * @brief   Contains the URL request data.
+ */
+struct _Ewk_Url_Request {
+    unsigned int __ref; /**< the reference count of the object */
+    WKRetainPtr<WKURLRequestRef> wkRequest;
+
+    const char* url;
+    const char* first_party;
+    const char* http_method;
+};
+
+#define EWK_URL_REQUEST_WK_GET_OR_RETURN(request, wkRequest_, ...)    \
+    if (!(request)) {                                                 \
+        EINA_LOG_CRIT("request is NULL.");                            \
+        return __VA_ARGS__;                                           \
+    }                                                                 \
+    if (!(request)->wkRequest) {                                      \
+        EINA_LOG_CRIT("request->wkRequest is NULL.");                 \
+        return __VA_ARGS__;                                           \
+    }                                                                 \
+    WKURLRequestRef wkRequest_ = (request)->wkRequest.get()
+
+void ewk_url_request_ref(Ewk_Url_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN(request);
+    ++request->__ref;
+}
+
+void ewk_url_request_unref(Ewk_Url_Request* request)
+{
+    EINA_SAFETY_ON_NULL_RETURN(request);
+
+    if (--request->__ref)
+        return;
+
+    eina_stringshare_del(request->url);
+    eina_stringshare_del(request->first_party);
+    eina_stringshare_del(request->http_method);
+    free(request);
+}
+
+const char* ewk_url_request_url_get(const Ewk_Url_Request* request)
+{
+    EWK_URL_REQUEST_WK_GET_OR_RETURN(request, wkRequest, 0);
+
+    WKRetainPtr<WKURLRef> wkUrl(AdoptWK, WKURLRequestCopyURL(wkRequest));
+    Ewk_Url_Request* ewkRequest = const_cast<Ewk_Url_Request*>(request);
+    eina_stringshare_replace(&ewkRequest->url, toImpl(wkUrl.get())->string().utf8().data());
+
+    return request->url;
+}
+
+const char* ewk_request_cookies_first_party_get(const Ewk_Url_Request* request)
+{
+    EWK_URL_REQUEST_WK_GET_OR_RETURN(request, wkRequest, 0);
+
+    Ewk_Url_Request* ewkRequest = const_cast<Ewk_Url_Request*>(request);
+    eina_stringshare_replace(&ewkRequest->first_party, toImpl(wkRequest)->resourceRequest().firstPartyForCookies().string().utf8().data());
+
+    return request->first_party;
+}
+
+const char* ewk_url_request_http_method_get(const Ewk_Url_Request* request)
+{
+    EWK_URL_REQUEST_WK_GET_OR_RETURN(request, wkRequest, 0);
+
+    Ewk_Url_Request* ewkRequest = const_cast<Ewk_Url_Request*>(request);
+    eina_stringshare_replace(&ewkRequest->http_method, toImpl(wkRequest)->resourceRequest().httpMethod().utf8().data());
+
+    return request->http_method;
+}
+
+/**
+ * @internal
+ * Constructs a Ewk_Url_Request from a WKURLRequest.
+ */
+Ewk_Url_Request* ewk_url_request_new(WKURLRequestRef wkUrlRequest)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(wkUrlRequest, 0);
+
+    Ewk_Url_Request* ewkUrlRequest = static_cast<Ewk_Url_Request*>(calloc(1, sizeof(Ewk_Url_Request)));
+    ewkUrlRequest->__ref = 1;
+    ewkUrlRequest->wkRequest = wkUrlRequest;
+
+    return ewkUrlRequest;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_request.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.h
new file mode 100644
index 000000000..0150b8917
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_request.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_url_request.h
+ * @brief   Describes the Ewk URL request API.
+ */
+
+#ifndef ewk_url_request_h
+#define ewk_url_request_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for _Ewk_Url_Request */
+typedef struct _Ewk_Url_Request Ewk_Url_Request;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param request the URL request object to increase the reference count
+ */
+EAPI void ewk_url_request_ref(Ewk_Url_Request *request);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count it's reached 0, the URL request is freed.
+ *
+ * @param request the URL request object to decrease the reference count
+ */
+EAPI void ewk_url_request_unref(Ewk_Url_Request *request);
+
+/**
+ * Query URL for this request.
+ *
+ * @param request request object to query.
+ *
+ * @return the URL pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_url_request_url_get(const Ewk_Url_Request *request);
+
+/**
+ * Query first party for cookies for this request.
+ *
+ * If set, this first party URL is used to distinguish first party cookies
+ * from third party ones. This is usually set to the URL of the main document.
+ *
+ * @param request request object to query.
+ *
+ * @return the first party pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_request_cookies_first_party_get(const Ewk_Url_Request *request);
+
+/**
+ * Query HTTP method for this request.
+ *
+ * HTTP methods are defined by:
+ * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
+ *
+ * Examples of HTTP methods are "GET", "POST".
+ *
+ * @param request request object to query.
+ *
+ * @return the HTTP method pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_url_request_http_method_get(const Ewk_Url_Request *request);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // ewk_url_request_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_url_request_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_url_request_private.h
new file mode 100644
index 000000000..548b6e91e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_url_request_private.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_url_request_private_h
+#define ewk_url_request_private_h
+
+Ewk_Url_Request* ewk_url_request_new(WKURLRequestRef);
+
+#endif // ewk_url_request_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
index fe384e377..eb6b15bb5 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.cpp
@@ -30,8 +30,10 @@
 #include "WKURL.h"
 #include "ewk_context.h"
 #include "ewk_context_private.h"
+#include "ewk_intent_private.h"
 #include "ewk_view_loader_client_private.h"
 #include "ewk_view_private.h"
+#include "ewk_view_resource_load_client_private.h"
 #include <wtf/text/CString.h>
 
 using namespace WebKit;
@@ -122,7 +124,7 @@ static Eina_Bool _ewk_view_smart_focus_out(Ewk_View_Smart_Data* smartData)
 {
     EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false)
 
-    priv->pageClient->page()->viewStateDidChange(WebPageProxy::ViewWindowIsActive);
+    priv->pageClient->page()->viewStateDidChange(WebPageProxy::ViewIsFocused | WebPageProxy::ViewWindowIsActive);
     return true;
 }
 
@@ -493,6 +495,7 @@ Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef contextRef, WKPageGrou
 
     priv->pageClient = PageClientImpl::create(toImpl(contextRef), toImpl(pageGroupRef), ewkView);
     ewk_view_loader_client_attach(toAPI(priv->pageClient->page()), ewkView);
+    ewk_view_resource_load_client_attach(toAPI(priv->pageClient->page()), ewkView);
 
     return ewkView;
 }
@@ -537,6 +540,16 @@ Eina_Bool ewk_view_reload(Evas_Object* ewkView)
     return true;
 }
 
+Eina_Bool ewk_view_reload_bypass_cache(Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+
+    WKPageReloadFromOrigin(toAPI(priv->pageClient->page()));
+
+    return true;
+}
+
 Eina_Bool ewk_view_stop(Evas_Object* ewkView)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
@@ -546,6 +559,20 @@ Eina_Bool ewk_view_stop(Evas_Object* ewkView)
     return true;
 }
 
+/**
+ * @internal
+ * Load was initiated for a resource in the view.
+ *
+ * Emits signal: "resource,request,new" with pointer to resource request.
+ */
+void ewk_view_resource_load_initiated(Evas_Object* ewkView, uint64_t resourceIdentifier, Ewk_Web_Resource* resource, Ewk_Url_Request* request)
+{
+    Ewk_Web_Resource_Request resourceRequest = {resource, request};
+    // FIXME: We will need to store the resource and its identifier at some point
+    // to get the resource back from the identifier on resource load finish.
+    evas_object_smart_callback_call(ewkView, "resource,request,new", &resourceRequest);
+}
+
 const char* ewk_view_title_get(const Evas_Object* ewkView)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
@@ -568,6 +595,55 @@ void ewk_view_title_changed(Evas_Object* ewkView, const char* title)
     evas_object_smart_callback_call(ewkView, "title,changed", const_cast<char*>(title));
 }
 
+double ewk_view_load_progress_get(const Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 0);
+
+    return WKPageGetEstimatedProgress(toAPI(priv->pageClient->page()));
+}
+
+Eina_Bool ewk_view_device_pixel_ratio_set(Evas_Object* ewkView, float ratio)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+
+    priv->pageClient->page()->setCustomDeviceScaleFactor(ratio);
+    return true;
+}
+
+float ewk_view_device_pixel_ratio_get(const Evas_Object* ewkView)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 1);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, 1);
+
+    return priv->pageClient->page()->deviceScaleFactor();
+}
+
+/**
+ * @internal
+ * Reports load progress changed.
+ *
+ * Emits signal: "load,progress" with pointer to a double from 0.0 to 1.0.
+ */
+void ewk_view_load_progress_changed(Evas_Object* ewkView, double progress)
+{
+    evas_object_smart_callback_call(ewkView, "load,progress", &progress);
+}
+
+/**
+ * @internal
+ * The view received a new intent request.
+ *
+ * Emits signal: "intent,request,new" with pointer to a Ewk_Intent.
+ */
+void ewk_view_intent_request_new(Evas_Object* ewkView, const Ewk_Intent* ewkIntent)
+{
+#if ENABLE(WEB_INTENTS)
+    evas_object_smart_callback_call(ewkView, "intent,request,new", const_cast<Ewk_Intent*>(ewkIntent));
+#endif
+}
+
 void ewk_view_display(Evas_Object* ewkView, const IntRect& rect)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData);
@@ -603,6 +679,21 @@ Eina_Bool ewk_view_forward(Evas_Object* ewkView)
     return false;
 }
 
+Eina_Bool ewk_view_intent_deliver(Evas_Object* ewkView, Ewk_Intent* intent)
+{
+#if ENABLE(WEB_INTENTS)
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(intent, false);
+
+    WKPageRef wkPage = toAPI(priv->pageClient->page());
+    WKPageDeliverIntentToFrame(wkPage, WKPageGetMainFrame(wkPage), ewk_intent_WKIntentDataRef_get(intent));
+    return true;
+#else
+    return false;
+#endif
+}
+
 Eina_Bool ewk_view_back_possible(Evas_Object* ewkView)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
@@ -630,6 +721,88 @@ void ewk_view_image_data_set(Evas_Object* ewkView, void* imageData, const IntSiz
     evas_object_image_data_copy_set(smartData->image, imageData);
 }
 
+/**
+ * @internal
+ * Reports load failed with error information.
+ *
+ * Emits signal: "load,error" with pointer to Ewk_Web_Error.
+ */
+void ewk_view_load_error(Evas_Object* ewkView, const Ewk_Web_Error* error)
+{
+    evas_object_smart_callback_call(ewkView, "load,error", const_cast<Ewk_Web_Error*>(error));
+}
+
+/**
+ * @internal
+ * Reports load finished.
+ *
+ * Emits signal: "load,finished".
+ */
+void ewk_view_load_finished(Evas_Object* ewkView)
+{
+    evas_object_smart_callback_call(ewkView, "load,finished", 0);
+}
+
+/**
+ * @internal
+ * Reports view provisional load failed with error information.
+ *
+ * Emits signal: "load,provisional,failed" with pointer to Ewk_Web_Error.
+ */
+void ewk_view_load_provisional_failed(Evas_Object* ewkView, const Ewk_Web_Error* error)
+{
+    evas_object_smart_callback_call(ewkView, "load,provisional,failed", const_cast<Ewk_Web_Error*>(error));
+}
+
+/**
+ * @internal
+ * Reports view received redirect for provisional load.
+ *
+ * Emits signal: "load,provisional,redirect".
+ */
+void ewk_view_load_provisional_redirect(Evas_Object* ewkView)
+{
+    evas_object_smart_callback_call(ewkView, "load,provisional,redirect", 0);
+}
+
+/**
+ * @internal
+ * Reports view provisional load started.
+ *
+ * Emits signal: "load,provisional,started".
+ */
+void ewk_view_load_provisional_started(Evas_Object* ewkView)
+{
+    evas_object_smart_callback_call(ewkView, "load,provisional,started", 0);
+}
+
+Eina_Bool ewk_view_html_string_load(Evas_Object* ewkView, const char* html, const char* baseUrl, const char* unreachableUrl)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, false);
+    EWK_VIEW_PRIV_GET_OR_RETURN(smartData, priv, false);
+    EINA_SAFETY_ON_NULL_RETURN_VAL(html, false);
+
+    if (unreachableUrl && *unreachableUrl)
+        priv->pageClient->page()->loadAlternateHTMLString(String::fromUTF8(html), baseUrl ? String::fromUTF8(baseUrl) : "", String::fromUTF8(unreachableUrl));
+    else
+        priv->pageClient->page()->loadHTMLString(String::fromUTF8(html), baseUrl ? String::fromUTF8(baseUrl) : "");
+
+    return true;
+}
+
+#if ENABLE(WEB_INTENTS_TAG)
+/**
+ * @internal
+ * The view received a new intent service registration.
+ *
+ * Emits signal: "intent,service,register" with pointer to a Ewk_Intent_Service.
+ */
+void ewk_view_intent_service_register(Evas_Object* ewkView, const Ewk_Intent_Service* ewkIntentService)
+{
+    evas_object_smart_callback_call(ewkView, "intent,service,register", const_cast<Ewk_Intent_Service*>(ewkIntentService));
+}
+#endif // ENABLE(WEB_INTENTS_TAG)
+
 WebPageProxy* ewk_view_page_get(const Evas_Object* ewkView)
 {
     EWK_VIEW_SD_GET_OR_RETURN(ewkView, smartData, 0);
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view.h b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
index cb5b6500a..f6092a64e 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view.h
@@ -26,6 +26,15 @@
  *
  * The following signals (see evas_object_smart_callback_add()) are emitted:
  *
+ * - "intent,request,new", Ewk_Intent_Request*: reports new Web intent request.
+ * - "intent,service,register", Ewk_Intent_Service*: reports new Web intent service registration.
+ * - "load,error", const Ewk_Web_Error*: reports main frame load failed.
+ * - "load,finished", void: reports load finished.
+ * - "load,progress", double*: load progress has changed (value from 0.0 to 1.0).
+ * - "load,provisional,failed", const Ewk_Web_Error*: view provisional load failed.
+ * - "load,provisional,redirect", void: view received redirect for provisional load.
+ * - "load,provisional,started", void: view started provisional load.
+ * - "resource,request,new", const Ewk_Web_Resource_Request*: a resource request was initiated.
  * - "title,changed", const char*: title of the main frame was changed.
  */
 
@@ -33,6 +42,9 @@
 #define ewk_view_h
 
 #include "ewk_context.h"
+#include "ewk_intent.h"
+#include "ewk_url_request.h"
+#include "ewk_web_resource.h"
 #include <Evas.h>
 
 #ifdef __cplusplus
@@ -128,6 +140,19 @@ struct _Ewk_View_Smart_Data {
     } changed;
 };
 
+/// Creates a type name for _Ewk_Web_Resource_Request.
+typedef struct _Ewk_Web_Resource_Request Ewk_Web_Resource_Request;
+
+/**
+ * @brief Structure containing details about a resource request.
+ *
+ * Details given about a resource is loaded.
+ */
+struct _Ewk_Web_Resource_Request {
+    Ewk_Web_Resource *resource; /**< resource being requested */
+    Ewk_Url_Request *request; /**< URL request for the resource */
+};
+
 /**
  * Creates a new EFL WebKit view object.
  *
@@ -176,11 +201,20 @@ EAPI const char *ewk_view_uri_get(const Evas_Object *o);
  *
  * @return @c EINA_TRUE on success or @c EINA_FALSE otherwise
  *
- * @see ewk_view_reload_full()
+ * @see ewk_view_reload_bypass_cache()
  */
 EAPI Eina_Bool    ewk_view_reload(Evas_Object *o);
 
 /**
+ * Reloads the current page's document without cache.
+ *
+ * @param o view object to reload current document
+ *
+ * @return @c EINA_TRUE on success or @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_view_reload_bypass_cache(Evas_Object *o);
+
+/**
  * Asks the main frame to stop loading.
  *
  * @param o view object to stop loading
@@ -189,7 +223,16 @@ EAPI Eina_Bool    ewk_view_reload(Evas_Object *o);
  */
 EAPI Eina_Bool    ewk_view_stop(Evas_Object *o);
 
-/*
+/**
+ * Delivers a Web intent to the view's main frame.
+ *
+ * @param o view object to deliver the intent to
+ *
+ * @return @c EINA_TRUE on success or @c EINA_FALSE otherwise.
+ */
+EAPI Eina_Bool    ewk_view_intent_deliver(Evas_Object *o, Ewk_Intent *intent);
+
+/**
  * Asks the main frame to navigate back in the history.
  *
  * @param o view object to navigate back
@@ -241,6 +284,84 @@ EAPI Eina_Bool    ewk_view_forward_possible(Evas_Object *o);
  */
 EAPI const char *ewk_view_title_get(const Evas_Object *o);
 
+/**
+ * Gets the current load progress of page.
+ *
+ * The progress estimation from 0.0 to 1.0.
+ *
+ * @param o view object to get the current progress
+ *
+ * @return the load progres of page, value from 0.0 to 1.0.
+ */
+EAPI double ewk_view_load_progress_get(const Evas_Object *o);
+
+/**
+ * Loads the specified @a html string as the content of the view.
+ *
+ * External objects such as stylesheets or images referenced in the HTML
+ * document are located relative to @a baseUrl.
+ *
+ * If an @a unreachableUrl is passed it is used as the url for the loaded
+ * content. This is typically used to display error pages for a failed
+ * load.
+ *
+ * @param o view object to load the HTML into
+ * @param html HTML data to load
+ * @param baseUrl Base URL used for relative paths to external objects (optional)
+ * @param unreachableUrl URL that could not be reached (optional)
+ *
+ * @return @c EINA_TRUE if it the HTML was successfully loaded, @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_view_html_string_load(Evas_Object *o, const char *html, const char *baseUrl, const char *unreachableUrl);
+
+/**
+ * Queries the ratio between the CSS units and device pixels when the content is unscaled.
+ *
+ * When designing touch-friendly contents, knowing the approximated target size on a device
+ * is important for contents providers in order to get the intented layout and element
+ * sizes.
+ *
+ * As most first generation touch devices had a PPI of approximately 160, this became a
+ * de-facto value, when used in conjunction with the viewport meta tag.
+ *
+ * Devices with a higher PPI learning towards 240 or 320, applies a pre-scaling on all
+ * content, of either 1.5 or 2.0, not affecting the CSS scale or pinch zooming.
+ *
+ * This value can be set using this property and it is exposed to CSS media queries using
+ * the -webkit-device-pixel-ratio query.
+ *
+ * For instance, if you want to load an image without having it upscaled on a web view
+ * using a device pixel ratio of 2.0 it can be done by loading an image of say 100x100
+ * pixels but showing it at half the size.
+ *
+ * @media (-webkit-min-device-pixel-ratio: 1.5) {
+ *     .icon {
+ *         width: 50px;
+ *         height: 50px;
+ *         url: "/images/icon@2x.png"; // This is actually a 100x100 image
+ *     }
+ * }
+ *
+ * If the above is used on a device with device pixel ratio of 1.5, it will be scaled
+ * down but still provide a better looking image.
+ *
+ * @param o view object to get device pixel ratio
+ *
+ * @return the ratio between the CSS units and device pixels.
+ */
+EAPI float ewk_view_device_pixel_ratio_get(const Evas_Object *o);
+
+/**
+ * Sets the ratio between the CSS units and device pixels when the content is unscaled.
+ *
+ * @param o view object to set device pixel ratio
+ *
+ * @return @c EINA_TRUE if the device pixel ratio was set, @c EINA_FALSE otherwise
+ *
+ * @see ewk_view_device_pixel_ratio_get()
+ */
+EAPI Eina_Bool ewk_view_device_pixel_ratio_set(Evas_Object *o, float ratio);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
index e98e154c6..3c28f2984 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_loader_client.cpp
@@ -26,8 +26,14 @@
 #include "config.h"
 
 #include "WKFrame.h"
+#include "ewk_intent.h"
+#include "ewk_intent_private.h"
+#include "ewk_intent_service.h"
+#include "ewk_intent_service_private.h"
 #include "ewk_view_loader_client_private.h"
 #include "ewk_view_private.h"
+#include "ewk_web_error.h"
+#include "ewk_web_error_private.h"
 #include <wtf/text/CString.h>
 
 using namespace WebKit;
@@ -41,6 +47,82 @@ static void didReceiveTitleForFrame(WKPageRef, WKStringRef title, WKFrameRef fra
     ewk_view_title_changed(ewkView, toImpl(title)->string().utf8().data());
 }
 
+#if ENABLE(WEB_INTENTS)
+static void didReceiveIntentForFrame(WKPageRef page, WKFrameRef frame, WKIntentDataRef intent, const void* clientInfo)
+{
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    Ewk_Intent* ewkIntent = ewk_intent_new(intent);
+    ewk_view_intent_request_new(ewkView, ewkIntent);
+    ewk_intent_unref(ewkIntent);
+}
+#endif
+
+#if ENABLE(WEB_INTENTS_TAG)
+static void registerIntentServiceForFrame(WKPageRef page, WKFrameRef frame, WKIntentServiceInfoRef serviceInfo, const void *clientInfo)
+{
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    Ewk_Intent_Service* ewkIntentService = ewk_intent_service_new(serviceInfo);
+    ewk_view_intent_service_register(ewkView, ewkIntentService);
+    ewk_intent_service_unref(ewkIntentService);
+}
+#endif
+
+static void didChangeProgress(WKPageRef page, const void* clientInfo)
+{
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    ewk_view_load_progress_changed(ewkView, WKPageGetEstimatedProgress(page));
+}
+
+static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void *clientInfo)
+{
+    if (!WKFrameIsMainFrame(frame))
+        return;
+
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    ewk_view_load_finished(ewkView);
+}
+
+static void didFailLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, WKErrorRef error, WKTypeRef, const void *clientInfo)
+{
+    if (!WKFrameIsMainFrame(frame))
+        return;
+
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    Ewk_Web_Error* ewkError = ewk_web_error_new(error);
+    ewk_view_load_error(ewkView, ewkError);
+    ewk_view_load_finished(ewkView);
+    ewk_web_error_free(ewkError);
+}
+
+static void didStartProvisionalLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    if (!WKFrameIsMainFrame(frame))
+        return;
+
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    ewk_view_load_provisional_started(ewkView);
+}
+
+static void didReceiveServerRedirectForProvisionalLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    if (!WKFrameIsMainFrame(frame))
+        return;
+
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    ewk_view_load_provisional_redirect(ewkView);
+}
+
+static void didFailProvisionalLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, WKErrorRef error, WKTypeRef userData, const void* clientInfo)
+{
+    if (!WKFrameIsMainFrame(frame))
+        return;
+
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    Ewk_Web_Error* ewkError = ewk_web_error_new(error);
+    ewk_view_load_provisional_failed(ewkView, ewkError);
+    ewk_web_error_free(ewkError);
+}
+
 void ewk_view_loader_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
 {
     WKPageLoaderClient loadClient;
@@ -48,5 +130,19 @@ void ewk_view_loader_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
     loadClient.version = kWKPageLoaderClientCurrentVersion;
     loadClient.clientInfo = ewkView;
     loadClient.didReceiveTitleForFrame = didReceiveTitleForFrame;
+#if ENABLE(WEB_INTENTS)
+    loadClient.didReceiveIntentForFrame = didReceiveIntentForFrame;
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+    loadClient.registerIntentServiceForFrame = registerIntentServiceForFrame;
+#endif
+    loadClient.didStartProgress = didChangeProgress;
+    loadClient.didChangeProgress = didChangeProgress;
+    loadClient.didFinishProgress = didChangeProgress;
+    loadClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    loadClient.didFailLoadWithErrorForFrame = didFailLoadWithErrorForFrame;
+    loadClient.didStartProvisionalLoadForFrame = didStartProvisionalLoadForFrame;
+    loadClient.didReceiveServerRedirectForProvisionalLoadForFrame = didReceiveServerRedirectForProvisionalLoadForFrame;
+    loadClient.didFailProvisionalLoadWithErrorForFrame = didFailProvisionalLoadWithErrorForFrame;
     WKPageSetPageLoaderClient(pageRef, &loadClient);
 }
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
index 62598e4c0..f9f21136c 100644
--- a/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_private.h
@@ -30,12 +30,36 @@ class IntRect;
 class IntSize;
 }
 
+typedef struct _Ewk_Url_Request Ewk_Url_Request;
+typedef struct _Ewk_Web_Error Ewk_Web_Error;
+typedef struct _Ewk_Web_Resource Ewk_Web_Resource;
+#if ENABLE(WEB_INTENTS)
+typedef struct _Ewk_Intent Ewk_Intent;
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+typedef struct _Ewk_Intent_Service Ewk_Intent_Service;
+#endif
+
 void ewk_view_display(Evas_Object* ewkView, const WebCore::IntRect& rect);
 void ewk_view_image_data_set(Evas_Object* ewkView, void* imageData, const WebCore::IntSize& size);
+void ewk_view_load_error(Evas_Object* ewkView, const Ewk_Web_Error* error);
+void ewk_view_load_finished(Evas_Object* ewkView);
+void ewk_view_load_progress_changed(Evas_Object* ewkView, double progress);
+void ewk_view_load_provisional_failed(Evas_Object* ewkView, const Ewk_Web_Error* error);
+void ewk_view_load_provisional_redirect(Evas_Object* ewkView);
+void ewk_view_load_provisional_started(Evas_Object* ewkView);
 void ewk_view_title_changed(Evas_Object* ewkView, const char* title);
+void ewk_view_resource_load_initiated(Evas_Object* ewkView, uint64_t resourceIdentifier, Ewk_Web_Resource* resource, Ewk_Url_Request* request);
 
 Evas_Object* ewk_view_base_add(Evas* canvas, WKContextRef, WKPageGroupRef);
 
+#if ENABLE(WEB_INTENTS)
+void ewk_view_intent_request_new(Evas_Object* ewkView, const Ewk_Intent* ewkIntent);
+#endif
+#if ENABLE(WEB_INTENTS_TAG)
+void ewk_view_intent_service_register(Evas_Object* ewkView, const Ewk_Intent_Service* ewkIntentService);
+#endif
+
 WebKit::WebPageProxy* ewk_view_page_get(const Evas_Object* ewkView);
 
 #endif // ewk_view_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client.cpp
new file mode 100644
index 000000000..6be39a208
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WKAPICast.h"
+#include "WKFrame.h"
+#include "WKPage.h"
+#include "WKRetainPtr.h"
+#include "WKURL.h"
+#include "WKURLRequest.h"
+#include "ewk_url_request.h"
+#include "ewk_url_request_private.h"
+#include "ewk_view_private.h"
+#include "ewk_view_resource_load_client_private.h"
+#include "ewk_web_resource.h"
+#include "ewk_web_resource_private.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+static void didInitiateLoadForResource(WKPageRef, WKFrameRef wkFrame, uint64_t resourceIdentifier, WKURLRequestRef wkRequest, bool pageIsProvisionallyLoading, const void* clientInfo)
+{
+    Evas_Object* ewkView = static_cast<Evas_Object*>(const_cast<void*>(clientInfo));
+    bool isMainResource = (WKFrameIsMainFrame(wkFrame) && pageIsProvisionallyLoading);
+    WKRetainPtr<WKURLRef> wkUrl(AdoptWK, WKURLRequestCopyURL(wkRequest));
+
+    Ewk_Web_Resource* resource = ewk_web_resource_new(toImpl(wkUrl.get())->string().utf8().data(), isMainResource);
+    Ewk_Url_Request* request = ewk_url_request_new(wkRequest);
+    ewk_view_resource_load_initiated(ewkView, resourceIdentifier, resource, request);
+    ewk_web_resource_unref(resource);
+    ewk_url_request_unref(request);
+}
+
+void ewk_view_resource_load_client_attach(WKPageRef pageRef, Evas_Object* ewkView)
+{
+    WKPageResourceLoadClient wkResourceLoadClient;
+    memset(&wkResourceLoadClient, 0, sizeof(WKPageResourceLoadClient));
+    wkResourceLoadClient.version = kWKPageResourceLoadClientCurrentVersion;
+    wkResourceLoadClient.clientInfo = ewkView;
+    wkResourceLoadClient.didInitiateLoadForResource = didInitiateLoadForResource;
+
+    WKPageSetPageResourceLoadClient(pageRef, &wkResourceLoadClient);
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client_private.h
new file mode 100644
index 000000000..1f404b920
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_view_resource_load_client_private.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_view_resource_load_client_private_h
+#define ewk_view_resource_load_client_private_h
+
+#include <Evas.h>
+#include <WebKit2/WKBase.h>
+
+void ewk_view_resource_load_client_attach(WKPageRef pageRef, Evas_Object* ewkView);
+
+#endif // ewk_view_resource_load_client_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_web_error.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_web_error.cpp
new file mode 100644
index 000000000..96b08d3e5
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_web_error.cpp
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_web_error.h"
+
+#include "WKString.h"
+#include "WKURL.h"
+#include "ewk_web_error_private.h"
+#include <WKAPICast.h>
+#include <WKError.h>
+#include <WKRetainPtr.h>
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+// Copied from ErrorsGtk.h which is used by DownloadSoup.cpp.
+static const char errorDomainDownload[] = "WebKitDownloadError";
+
+struct _Ewk_Web_Error {
+    WKRetainPtr<WKErrorRef> wkError;
+
+    const char* url;
+    const char* description;
+};
+
+#define EWK_WEB_ERROR_WK_GET_OR_RETURN(error, wkError_, ...)    \
+    if (!(error)) {                                           \
+        EINA_LOG_CRIT("error is NULL.");                      \
+        return __VA_ARGS__;                                    \
+    }                                                          \
+    if (!(error)->wkError) {                                 \
+        EINA_LOG_CRIT("error->wkError is NULL.");            \
+        return __VA_ARGS__;                                    \
+    }                                                          \
+    WKErrorRef wkError_ = (error)->wkError.get()
+
+void ewk_web_error_free(Ewk_Web_Error *error)
+{
+    EINA_SAFETY_ON_NULL_RETURN(error);
+
+    eina_stringshare_del(error->url);
+    eina_stringshare_del(error->description);
+    free(error);
+}
+
+Ewk_Web_Error_Type ewk_web_error_type_get(const Ewk_Web_Error* error)
+{
+    EWK_WEB_ERROR_WK_GET_OR_RETURN(error, wkError, EWK_WEB_ERROR_TYPE_NONE);
+
+    WKRetainPtr<WKStringRef> wkDomain(AdoptWK, WKErrorCopyDomain(wkError));
+    WTF::String errorDomain = toWTFString(wkDomain.get());
+
+    if (errorDomain == String(g_quark_to_string(SOUP_HTTP_ERROR)))
+        return EWK_WEB_ERROR_TYPE_HTTP;
+    if (errorDomain == String(g_quark_to_string(G_IO_ERROR)))
+        return EWK_WEB_ERROR_TYPE_IO;
+    if (errorDomain == errorDomainDownload)
+        return EWK_WEB_ERROR_TYPE_DOWNLOAD;
+    return EWK_WEB_ERROR_TYPE_INTERNAL;
+}
+
+const char* ewk_web_error_url_get(const Ewk_Web_Error* error)
+{
+    EWK_WEB_ERROR_WK_GET_OR_RETURN(error, wkError, 0);
+
+    WKRetainPtr<WKURLRef> wkUrl(AdoptWK, WKErrorCopyFailingURL(wkError));
+    Ewk_Web_Error* ewkError = const_cast<Ewk_Web_Error*>(error);
+    eina_stringshare_replace(&ewkError->url, toImpl(wkUrl.get())->string().utf8().data());
+
+    return error->url;
+}
+
+int ewk_web_error_code_get(const Ewk_Web_Error* error)
+{
+    EWK_WEB_ERROR_WK_GET_OR_RETURN(error, wkError, 0);
+
+    return WKErrorGetErrorCode(wkError);
+}
+
+const char* ewk_web_error_description_get(const Ewk_Web_Error* error)
+{
+    EWK_WEB_ERROR_WK_GET_OR_RETURN(error, wkError, 0);
+
+    WKRetainPtr<WKStringRef> wkDescription(AdoptWK, WKErrorCopyLocalizedDescription(wkError));
+    Ewk_Web_Error* ewkError = const_cast<Ewk_Web_Error*>(error);
+    eina_stringshare_replace(&ewkError->description, toImpl(wkDescription.get())->string().utf8().data());
+
+    return error->description;
+}
+
+Eina_Bool ewk_web_error_cancellation_get(const Ewk_Web_Error* error)
+{
+    EWK_WEB_ERROR_WK_GET_OR_RETURN(error, wkError, false);
+
+    return toImpl(wkError)->platformError().isCancellation();
+}
+
+Ewk_Web_Error* ewk_web_error_new(WKErrorRef error)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(error, 0);
+
+    Ewk_Web_Error* ewkError = static_cast<Ewk_Web_Error*>(calloc(1, sizeof(Ewk_Web_Error)));
+    ewkError->wkError = error;
+
+    return ewkError;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_web_error.h b/Source/WebKit2/UIProcess/API/efl/ewk_web_error.h
new file mode 100644
index 000000000..2d9666581
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_web_error.h
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_web_error.h
+ * @brief   Describes the Web Error API.
+ */
+
+#ifndef ewk_web_error_h
+#define ewk_web_error_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for @a Ewk_Web_Error. */
+typedef struct _Ewk_Web_Error Ewk_Web_Error;
+
+/// Creates a type name for Ewk_Web_Error_Type.
+typedef enum {
+    EWK_WEB_ERROR_TYPE_NONE,
+    EWK_WEB_ERROR_TYPE_INTERNAL,
+    EWK_WEB_ERROR_TYPE_HTTP,
+    EWK_WEB_ERROR_TYPE_IO,
+    EWK_WEB_ERROR_TYPE_DOWNLOAD
+} Ewk_Web_Error_Type;
+
+/**
+ * Frees the given object.
+ *
+ * @param error the error object to free
+ */
+EAPI void ewk_web_error_free(Ewk_Web_Error *error);
+
+/**
+ * Query type for this error.
+ *
+ * @param error error object to query.
+ *
+ * @return the error type, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI Ewk_Web_Error_Type ewk_web_error_type_get(const Ewk_Web_Error *error);
+
+/**
+ * Query failing URL for this error.
+ *
+ * URL that failed loading.
+ *
+ * @param error error object to query.
+ *
+ * @return the URL pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_web_error_url_get(const Ewk_Web_Error *error);
+
+/**
+ * Query HTTP error code.
+ *
+ * @param error error object to query.
+ *
+ * @return the HTTP error code.
+ */
+EAPI int ewk_web_error_code_get(const Ewk_Web_Error *error);
+
+/**
+ * Query description for this error.
+ *
+ * @param error error object to query.
+ *
+ * @return the description pointer, that may be @c NULL. This pointer is
+ *         guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
+ */
+EAPI const char *ewk_web_error_description_get(const Ewk_Web_Error *error);
+
+/**
+ * Query if error should be treated as a cancellation.
+ *
+ * @param error error object to query.
+ *
+ * @return @c EINA_TRUE if this error should be treated as a cancellation, @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_web_error_cancellation_get(const Ewk_Web_Error *error);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // ewk_web_error_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_web_error_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_web_error_private.h
new file mode 100644
index 000000000..c9a31e50a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_web_error_private.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_web_error_private_h
+#define ewk_web_error_private_h
+
+#include <WKError.h>
+
+typedef struct _Ewk_Web_Error Ewk_Web_Error;
+
+Ewk_Web_Error* ewk_web_error_new(WKErrorRef error);
+
+#endif // ewk_web_error_private_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_web_resource.cpp b/Source/WebKit2/UIProcess/API/efl/ewk_web_resource.cpp
new file mode 100644
index 000000000..ce1ddde65
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_web_resource.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ewk_web_resource.h"
+
+#include "ewk_web_resource_private.h"
+#include <wtf/text/CString.h>
+
+struct _Ewk_Web_Resource {
+    unsigned int __ref; /**< the reference count of the object */
+    CString url;
+    bool isMainResource;
+};
+
+void ewk_web_resource_ref(Ewk_Web_Resource* resource)
+{
+    EINA_SAFETY_ON_NULL_RETURN(resource);
+
+    ++resource->__ref;
+}
+
+void ewk_web_resource_unref(Ewk_Web_Resource* resource)
+{
+    EINA_SAFETY_ON_NULL_RETURN(resource);
+
+    if (--resource->__ref)
+        return;
+
+    free(resource);
+}
+
+const char* ewk_web_resource_url_get(const Ewk_Web_Resource* resource)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(resource, 0);
+
+    return resource->url.data();
+}
+
+/**
+ * @internal
+ * Constructs a Ewk_Web_Resource.
+ */
+Ewk_Web_Resource* ewk_web_resource_new(const char* url, bool isMainResource)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(url, 0);
+
+    Ewk_Web_Resource* resource = static_cast<Ewk_Web_Resource*>(calloc(1, sizeof(Ewk_Web_Resource)));
+    resource->url = url;
+    resource->isMainResource = isMainResource;
+    resource->__ref = 1;
+
+    return resource;
+}
+
+Eina_Bool ewk_web_resource_main_resource_get(const Ewk_Web_Resource* resource)
+{
+    EINA_SAFETY_ON_NULL_RETURN_VAL(resource, false);
+
+    return resource->isMainResource;
+}
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_web_resource.h b/Source/WebKit2/UIProcess/API/efl/ewk_web_resource.h
new file mode 100644
index 000000000..6a3b0802b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_web_resource.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @file    ewk_web_resource.h
+ * @brief   Describes the Web Resource API.
+ */
+
+#ifndef ewk_web_resource_h
+#define ewk_web_resource_h
+
+#include <Eina.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** Creates a type name for @a Ewk_Web_Resource. */
+typedef struct _Ewk_Web_Resource Ewk_Web_Resource;
+
+/**
+ * Increases the reference count of the given object.
+ *
+ * @param resource the resource object to increase the reference count
+ */
+EAPI void ewk_web_resource_ref(Ewk_Web_Resource *resource);
+
+/**
+ * Decreases the reference count of the given object, possibly freeing it.
+ *
+ * When the reference count it's reached 0, the resource is freed.
+ *
+ * @param resource the resource object to decrease the reference count
+ */
+EAPI void ewk_web_resource_unref(Ewk_Web_Resource *resource);
+
+/**
+ * Query URL for this resource.
+ *
+ * @param resource resource object to query.
+ *
+ * @return the URL pointer, that may be @c NULL.
+ */
+EAPI const char *ewk_web_resource_url_get(const Ewk_Web_Resource *resource);
+
+/**
+ * Query if this is the main resource.
+ *
+ * @param resource resource object to query.
+ *
+ * @return @c EINA_TRUE if this is the main resource, @c EINA_FALSE otherwise
+ */
+EAPI Eina_Bool ewk_web_resource_main_resource_get(const Ewk_Web_Resource *resource);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // ewk_web_resource_h
diff --git a/Source/WebKit2/UIProcess/API/efl/ewk_web_resource_private.h b/Source/WebKit2/UIProcess/API/efl/ewk_web_resource_private.h
new file mode 100644
index 000000000..5b44fe19f
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/efl/ewk_web_resource_private.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ewk_web_resource_private_h
+#define ewk_web_resource_private_h
+
+typedef struct _Ewk_Web_Resource Ewk_Web_Resource;
+
+Ewk_Web_Resource* ewk_web_resource_new(const char* uri, bool isMainResource);
+
+#endif // ewk_web_resource_private_h
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
index 9e24aabb1..5e0be7d32 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.cpp
@@ -112,7 +112,9 @@ enum {
     PROP_JAVASCRIPT_CAN_ACCESS_CLIPBOARD,
     PROP_MEDIA_PLAYBACK_REQUIRES_USER_GESTURE,
     PROP_MEDIA_PLAYBACK_ALLOWS_INLINE,
-    PROP_DRAW_COMPOSITING_INDICATORS
+    PROP_DRAW_COMPOSITING_INDICATORS,
+    PROP_ENABLE_SITE_SPECIFIC_QUIRKS,
+    PROP_ENABLE_PAGE_CACHE
 };
 
 static void webKitSettingsSetProperty(GObject* object, guint propId, const GValue* value, GParamSpec* paramSpec)
@@ -237,6 +239,12 @@ static void webKitSettingsSetProperty(GObject* object, guint propId, const GValu
     case PROP_DRAW_COMPOSITING_INDICATORS:
         webkit_settings_set_draw_compositing_indicators(settings, g_value_get_boolean(value));
         break;
+    case PROP_ENABLE_SITE_SPECIFIC_QUIRKS:
+        webkit_settings_set_enable_site_specific_quirks(settings, g_value_get_boolean(value));
+        break;
+    case PROP_ENABLE_PAGE_CACHE:
+        webkit_settings_set_enable_page_cache(settings, g_value_get_boolean(value));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -365,6 +373,12 @@ static void webKitSettingsGetProperty(GObject* object, guint propId, GValue* val
     case PROP_DRAW_COMPOSITING_INDICATORS:
         g_value_set_boolean(value, webkit_settings_get_draw_compositing_indicators(settings));
         break;
+    case PROP_ENABLE_SITE_SPECIFIC_QUIRKS:
+        g_value_set_boolean(value, webkit_settings_get_enable_site_specific_quirks(settings));
+        break;
+    case PROP_ENABLE_PAGE_CACHE:
+        g_value_set_boolean(value, webkit_settings_get_enable_page_cache(settings));
+        break;
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, propId, paramSpec);
         break;
@@ -957,6 +971,45 @@ static void webkit_settings_class_init(WebKitSettingsClass* klass)
                                                          FALSE,
                                                          readWriteConstructParamFlags));
 
+    /**
+     * WebKitSettings:enable-site-specific-quirks:
+     *
+     * Whether to turn on site-specific quirks. Turning this on will
+     * tell WebKit to use some site-specific workarounds for
+     * better web compatibility. For example, older versions of
+     * MediaWiki will incorrectly send to WebKit a css file with KHTML
+     * workarounds. By turning on site-specific quirks, WebKit will
+     * special-case this and other cases to make some specific sites work.
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_ENABLE_SITE_SPECIFIC_QUIRKS,
+                                    g_param_spec_boolean("enable-site-specific-quirks",
+                                                         _("Enable Site Specific Quirks"),
+                                                         _("Enables the site-specific compatibility workarounds"),
+                                                         FALSE,
+                                                         readWriteConstructParamFlags));
+
+    /**
+     * WebKitSettings:enable-page-cache:
+     *
+     * Enable or disable the page cache. Disabling the page cache is
+     * generally only useful for special circumstances like low-memory
+     * scenarios or special purpose applications like static HTML
+     * viewers. This setting only controls the Page Cache, this cache
+     * is different than the disk-based or memory-based traditional
+     * resource caches, its point is to make going back and forth
+     * between pages much faster. For details about the different types
+     * of caches and their purposes see:
+     * http://webkit.org/blog/427/webkit-page-cache-i-the-basics/
+     */
+    g_object_class_install_property(gObjectClass,
+                                    PROP_ENABLE_PAGE_CACHE,
+                                    g_param_spec_boolean("enable-page-cache",
+                                                         _("Enable page cache"),
+                                                         _("Whether the page cache should be used"),
+                                                         TRUE,
+                                                         readWriteConstructParamFlags));
+
     g_type_class_add_private(klass, sizeof(WebKitSettingsPrivate));
 }
 
@@ -2432,3 +2485,73 @@ gboolean webkit_settings_get_draw_compositing_indicators(WebKitSettings* setting
     return WKPreferencesGetCompositingBordersVisible(settings->priv->preferences.get())
            && WKPreferencesGetCompositingRepaintCountersVisible(settings->priv->preferences.get());
 }
+
+/**
+ * webkit_settings_get_enable_site_specific_quirks:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:enable-site-specific-quirks property.
+ *
+ * Returns: %TRUE if site specific quirks are enabled or %FALSE otherwise.
+ */
+gboolean webkit_settings_get_enable_site_specific_quirks(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+
+    return WKPreferencesGetNeedsSiteSpecificQuirks(settings->priv->preferences.get());
+}
+
+/**
+ * webkit_settings_set_enable_site_specific_quirks:
+ * @settings: a #WebKitSettings
+ * @enabled: Value to be set
+ *
+ * Set the #WebKitSettings:enable-site-specific-quirks property.
+ */
+void webkit_settings_set_enable_site_specific_quirks(WebKitSettings* settings, gboolean enabled)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    bool currentValue = WKPreferencesGetNeedsSiteSpecificQuirks(priv->preferences.get());
+    if (currentValue == enabled)
+        return;
+
+    WKPreferencesSetNeedsSiteSpecificQuirks(priv->preferences.get(), enabled);
+    g_object_notify(G_OBJECT(settings), "enable-site-specific-quirks");
+}
+
+/**
+ * webkit_settings_get_enable_page_cache:
+ * @settings: a #WebKitSettings
+ *
+ * Get the #WebKitSettings:enable-page-cache property.
+ *
+ * Returns: %TRUE if page cache enabled or %FALSE otherwise.
+ */
+gboolean webkit_settings_get_enable_page_cache(WebKitSettings* settings)
+{
+    g_return_val_if_fail(WEBKIT_IS_SETTINGS(settings), FALSE);
+
+    return WKPreferencesGetPageCacheEnabled(settings->priv->preferences.get());
+}
+
+/**
+ * webkit_settings_set_enable_page_cache:
+ * @settings: a #WebKitSettings
+ * @enabled: Value to be set
+ *
+ * Set the #WebKitSettings:enable-page-cache property.
+ */
+void webkit_settings_set_enable_page_cache(WebKitSettings* settings, gboolean enabled)
+{
+    g_return_if_fail(WEBKIT_IS_SETTINGS(settings));
+
+    WebKitSettingsPrivate* priv = settings->priv;
+    bool currentValue = WKPreferencesGetPageCacheEnabled(priv->preferences.get());
+    if (currentValue == enabled)
+        return;
+
+    WKPreferencesSetPageCacheEnabled(priv->preferences.get(), enabled);
+    g_object_notify(G_OBJECT(settings), "enable-page-cache");
+}
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
index a86d6bc1e..0c719cd47 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitSettings.h
@@ -347,6 +347,21 @@ webkit_settings_get_draw_compositing_indicators                (WebKitSettings *
 WEBKIT_API void
 webkit_settings_set_draw_compositing_indicators                (WebKitSettings *settings,
                                                                 gboolean        enabled);
+
+WEBKIT_API gboolean
+webkit_settings_get_enable_site_specific_quirks                (WebKitSettings *settings);
+
+WEBKIT_API void
+webkit_settings_set_enable_site_specific_quirks                (WebKitSettings *settings,
+                                                                gboolean        enabled);
+
+WEBKIT_API gboolean
+webkit_settings_get_enable_page_cache                          (WebKitSettings *settings);
+
+WEBKIT_API void
+webkit_settings_set_enable_page_cache                          (WebKitSettings *settings,
+                                                                gboolean        enabled);
+
 G_END_DECLS
 
 #endif /* WebKitSettings_h */
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
index 372f46637..8a0625c07 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.cpp
@@ -162,11 +162,10 @@ WebKitWebContext* webkit_web_context_get_default(void)
  * these caches, including various WebCore caches.
  *
  * Browsers can improve document load speed substantially by
- * specifying WEBKIT_CACHE_MODEL_WEB_BROWSER. Applications without a
+ * specifying %WEBKIT_CACHE_MODEL_WEB_BROWSER. Applications without a
  * browsing interface can reduce memory usage substantially by
- * specifying WEBKIT_CACHE_MODEL_DOCUMENT_VIEWER. The default value is
- * WEBKIT_CACHE_MODEL_WEB_BROWSER.
- *
+ * specifying %WEBKIT_CACHE_MODEL_DOCUMENT_VIEWER. The default value is
+ * %WEBKIT_CACHE_MODEL_WEB_BROWSER.
  */
 void webkit_web_context_set_cache_model(WebKitWebContext* context, WebKitCacheModel model)
 {
@@ -221,6 +220,21 @@ WebKitCacheModel webkit_web_context_get_cache_model(WebKitWebContext* context)
     return WEBKIT_CACHE_MODEL_WEB_BROWSER;
 }
 
+/**
+ * webkit_web_context_clear_cache:
+ * @context: a #WebKitWebContext
+ *
+ * Clears all resources currently cached.
+ * See also webkit_web_context_set_cache_model().
+ */
+void webkit_web_context_clear_cache(WebKitWebContext* context)
+{
+    g_return_if_fail(WEBKIT_IS_WEB_CONTEXT(context));
+
+    WebKitWebContextPrivate* priv = context->priv;
+    WKResourceCacheManagerClearCacheForAllOrigins(WKContextGetResourceCacheManager(priv->context.get()), WKResourceCachesToClearAll);
+}
+
 typedef HashMap<WKDownloadRef, GRefPtr<WebKitDownload> > DownloadsMap;
 
 static DownloadsMap& downloadsMap()
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h
index 1325017d1..83b601a38 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebContext.h
@@ -51,7 +51,7 @@ G_BEGIN_DECLS
  * @WEBKIT_CACHE_MODEL_WEB_BROWSER: Improve document load speed substantially
  *   by caching a very large number of resources and previously viewed content.
  *
- * Enum values used for determining the webview cache model.
+ * Enum values used for determining the #WebKitWebContext cache model.
  */
 typedef enum {
     WEBKIT_CACHE_MODEL_DOCUMENT_VIEWER,
@@ -103,6 +103,9 @@ webkit_web_context_set_cache_model                  (WebKitWebContext
 WEBKIT_API WebKitCacheModel
 webkit_web_context_get_cache_model                  (WebKitWebContext              *context);
 
+WEBKIT_API void
+webkit_web_context_clear_cache                      (WebKitWebContext              *context);
+
 WEBKIT_API WebKitDownload *
 webkit_web_context_download_uri                     (WebKitWebContext              *context,
                                                      const gchar                   *uri);
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
index 94a94ca09..8bfabeec6 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.cpp
@@ -88,6 +88,7 @@ enum {
     RUN_FILE_CHOOSER,
 
     CONTEXT_MENU,
+    CONTEXT_MENU_DISMISSED,
 
     LAST_SIGNAL
 };
@@ -1043,6 +1044,22 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
                      WEBKIT_TYPE_CONTEXT_MENU,
                      GDK_TYPE_EVENT | G_SIGNAL_TYPE_STATIC_SCOPE,
                      WEBKIT_TYPE_HIT_TEST_RESULT);
+
+    /**
+     * WebKitWebView::context-menu-dismissed:
+     * @web_view: the #WebKitWebView on which the signal is emitted
+     *
+     * Emitted after #WebKitWebView::context-menu signal, if the context menu is shown,
+     * to notify that the context menu is dismissed.
+     */
+    signals[CONTEXT_MENU_DISMISSED] =
+        g_signal_new("context-menu-dismissed",
+                     G_TYPE_FROM_CLASS(webViewClass),
+                     G_SIGNAL_RUN_LAST,
+                     G_STRUCT_OFFSET(WebKitWebViewClass, context_menu_dismissed),
+                     0, 0,
+                     g_cclosure_marshal_VOID__VOID,
+                     G_TYPE_NONE, 0);
 }
 
 static bool updateReplaceContentStatus(WebKitWebView* webView, WebKitLoadEvent loadEvent)
@@ -1338,6 +1355,11 @@ static void webkitWebViewCreateAndAppendInputMethodsMenuItem(WebKitWebView* webV
     webkit_context_menu_insert(contextMenu, menuItem, unicodeMenuItemPosition);
 }
 
+static void contextMenuDismissed(GtkMenuShell*, WebKitWebView* webView)
+{
+    g_signal_emit(webView, signals[CONTEXT_MENU_DISMISSED], 0, NULL);
+}
+
 void webkitWebViewPopulateContextMenu(WebKitWebView* webView, WKArrayRef wkProposedMenu, WKHitTestResultRef wkHitTestResult)
 {
     WebKitWebViewBase* webViewBase = WEBKIT_WEB_VIEW_BASE(webView);
@@ -1360,6 +1382,8 @@ void webkitWebViewPopulateContextMenu(WebKitWebView* webView, WKArrayRef wkPropo
     webkitContextMenuPopulate(contextMenu.get(), contextMenuItems);
     contextMenuProxy->populate(contextMenuItems);
 
+    g_signal_connect(contextMenuProxy->gtkMenu(), "deactivate", G_CALLBACK(contextMenuDismissed), webView);
+
     // Clear the menu to make sure it's useless after signal emission.
     webkit_context_menu_remove_all(contextMenu.get());
 }
diff --git a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
index 9328fa12f..bac32a78e 100644
--- a/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
+++ b/Source/WebKit2/UIProcess/API/gtk/WebKitWebView.h
@@ -127,42 +127,43 @@ struct _WebKitWebView {
 struct _WebKitWebViewClass {
     WebKitWebViewBaseClass parent;
 
-    void       (* load_changed)          (WebKitWebView             *web_view,
-                                          WebKitLoadEvent            load_event);
-    gboolean   (* load_failed)           (WebKitWebView             *web_view,
-                                          WebKitLoadEvent            load_event,
-                                          const gchar               *failing_uri,
-                                          GError                    *error);
-
-    GtkWidget *(* create)                (WebKitWebView             *web_view);
-    void       (* ready_to_show)         (WebKitWebView             *web_view);
-    void       (* run_as_modal)          (WebKitWebView             *web_view);
-    void       (* close)                 (WebKitWebView             *web_view);
-
-    gboolean   (* script_dialog)         (WebKitWebView             *web_view,
-                                          WebKitScriptDialog        *dialog);
-
-    gboolean   (* decide_policy)         (WebKitWebView             *web_view,
-                                          WebKitPolicyDecision      *decision,
-                                          WebKitPolicyDecisionType   type);
-    gboolean   (* permission_request)    (WebKitWebView             *web_view,
-                                          WebKitPermissionRequest   *permission_request);
-    void       (* mouse_target_changed)  (WebKitWebView             *web_view,
-                                          WebKitHitTestResult       *hit_test_result,
-                                          guint                      modifiers);
-    gboolean   (* print_requested)       (WebKitWebView             *web_view,
-                                          WebKitPrintOperation      *print_operation);
-    void       (* resource_load_started) (WebKitWebView             *web_view,
-                                          WebKitWebResource         *resource,
-                                          WebKitURIRequest          *request);
-    gboolean   (* enter_fullscreen)      (WebKitWebView             *web_view);
-    gboolean   (* leave_fullscreen)      (WebKitWebView             *web_view);
-    gboolean   (* run_file_chooser)      (WebKitWebView             *web_view,
-                                          WebKitFileChooserRequest  *request);
-    gboolean   (* context_menu)         (WebKitWebView              *web_view,
-                                         WebKitContextMenu          *context_menu,
-                                         GdkEvent                   *event,
-                                         WebKitHitTestResult        *hit_test_result);
+    void       (* load_changed)           (WebKitWebView             *web_view,
+                                           WebKitLoadEvent            load_event);
+    gboolean   (* load_failed)            (WebKitWebView             *web_view,
+                                           WebKitLoadEvent            load_event,
+                                           const gchar               *failing_uri,
+                                           GError                    *error);
+
+    GtkWidget *(* create)                 (WebKitWebView             *web_view);
+    void       (* ready_to_show)          (WebKitWebView             *web_view);
+    void       (* run_as_modal)           (WebKitWebView             *web_view);
+    void       (* close)                  (WebKitWebView             *web_view);
+
+    gboolean   (* script_dialog)          (WebKitWebView             *web_view,
+                                           WebKitScriptDialog        *dialog);
+
+    gboolean   (* decide_policy)          (WebKitWebView             *web_view,
+                                           WebKitPolicyDecision      *decision,
+                                           WebKitPolicyDecisionType   type);
+    gboolean   (* permission_request)     (WebKitWebView             *web_view,
+                                           WebKitPermissionRequest   *permission_request);
+    void       (* mouse_target_changed)   (WebKitWebView             *web_view,
+                                           WebKitHitTestResult       *hit_test_result,
+                                           guint                      modifiers);
+    gboolean   (* print_requested)        (WebKitWebView             *web_view,
+                                           WebKitPrintOperation      *print_operation);
+    void       (* resource_load_started)  (WebKitWebView             *web_view,
+                                           WebKitWebResource         *resource,
+                                           WebKitURIRequest          *request);
+    gboolean   (* enter_fullscreen)       (WebKitWebView             *web_view);
+    gboolean   (* leave_fullscreen)       (WebKitWebView             *web_view);
+    gboolean   (* run_file_chooser)       (WebKitWebView             *web_view,
+                                           WebKitFileChooserRequest  *request);
+    gboolean   (* context_menu)           (WebKitWebView             *web_view,
+                                           WebKitContextMenu         *context_menu,
+                                           GdkEvent                  *event,
+                                           WebKitHitTestResult       *hit_test_result);
+    void       (* context_menu_dismissed) (WebKitWebView             *web_view);
 
     /* Padding for future expansion */
     void (*_webkit_reserved0) (void);
diff --git a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
index aca34df0b..ed66eb479 100644
--- a/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
+++ b/Source/WebKit2/UIProcess/API/gtk/docs/webkit2gtk-sections.txt
@@ -27,6 +27,7 @@ WebKitCacheModel
 webkit_web_context_get_default
 webkit_web_context_get_cache_model
 webkit_web_context_set_cache_model
+webkit_web_context_clear_cache
 webkit_web_context_download_uri
 webkit_web_context_get_cookie_manager
 webkit_web_context_set_additional_plugins_directory
@@ -268,6 +269,10 @@ webkit_settings_get_media_playback_allows_inline
 webkit_settings_set_media_playback_allows_inline
 webkit_settings_get_draw_compositing_indicators
 webkit_settings_set_draw_compositing_indicators
+webkit_settings_get_enable_site_specific_quirks
+webkit_settings_set_enable_site_specific_quirks
+webkit_settings_get_enable_page_cache
+webkit_settings_set_enable_page_cache
 
 <SUBSECTION Standard>
 WebKitSettingsClass
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp
index f74016006..876685712 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestContextMenu.cpp
@@ -49,11 +49,17 @@ public:
         return test->contextMenu(contextMenu, event, hitTestResult);
     }
 
+    static void contextMenuDismissedCallback(WebKitWebView*, ContextMenuTest* test)
+    {
+        test->contextMenuDismissed();
+    }
+
     ContextMenuTest()
         : m_menuPositionX(0)
         , m_menuPositionY(0)
     {
         g_signal_connect(m_webView, "context-menu", G_CALLBACK(contextMenuCallback), this);
+        g_signal_connect(m_webView, "context-menu-dismissed", G_CALLBACK(contextMenuDismissedCallback), this);
     }
 
     ~ContextMenuTest()
@@ -63,6 +69,11 @@ public:
 
     virtual bool contextMenu(WebKitContextMenu*, GdkEvent*, WebKitHitTestResult*) = 0;
 
+    virtual void contextMenuDismissed()
+    {
+        quitMainLoop();
+    }
+
     bool shouldShowInputMethodsMenu()
     {
         GtkSettings* settings = gtk_widget_get_settings(GTK_WIDGET(m_webView));
@@ -183,6 +194,18 @@ public:
         showContextMenuAtPositionAndWaitUntilFinished(0, 0);
     }
 
+    static gboolean simulateEscKeyIdleCallback(ContextMenuTest* test)
+    {
+        test->keyStroke(GDK_KEY_Escape);
+        return FALSE;
+    }
+
+    void dismissContextMenuAndWaitUntilFinished()
+    {
+        g_idle_add(reinterpret_cast<GSourceFunc>(simulateEscKeyIdleCallback), this);
+        g_main_loop_run(m_mainLoop);
+    }
+
     double m_menuPositionX;
     double m_menuPositionY;
 };
@@ -405,7 +428,6 @@ public:
         GtkMenuItem* item = getMenuItem(menu, m_itemToActivateLabel);
         gtk_menu_shell_activate_item(GTK_MENU_SHELL(menu), GTK_WIDGET(item), TRUE);
         m_itemToActivateLabel = 0;
-        quitMainLoop();
     }
 
     static gboolean activateMenuItemIdleCallback(gpointer userData)
@@ -657,6 +679,48 @@ static void testContextMenuSubMenu(ContextMenuSubmenuTest* test, gconstpointer)
     test->showContextMenuAndWaitUntilFinished();
 }
 
+class ContextMenuDismissedTest: public ContextMenuTest {
+public:
+    MAKE_GLIB_TEST_FIXTURE(ContextMenuDismissedTest);
+
+    ContextMenuDismissedTest()
+        : m_dismissed(false)
+    {
+    }
+
+    bool contextMenu(WebKitContextMenu* contextMenu, GdkEvent*, WebKitHitTestResult*)
+    {
+        quitMainLoop();
+        // Show the default context menu.
+        return false;
+    }
+
+    void contextMenuDismissed()
+    {
+        m_dismissed = true;
+        ContextMenuTest::contextMenuDismissed();
+    }
+
+    void showContextMenuAndWaitUntilDismissed()
+    {
+        showContextMenuAndWaitUntilFinished();
+        dismissContextMenuAndWaitUntilFinished();
+    }
+
+    bool m_dismissed;
+};
+
+static void testContextMenuDismissed(ContextMenuDismissedTest* test, gconstpointer)
+{
+    test->showInWindowAndWaitUntilMapped();
+
+    test->loadHtml("<html><body>WebKitGTK+ Context menu tests</body></html>", "file:///");
+    test->waitUntilLoadFinished();
+
+    test->showContextMenuAndWaitUntilDismissed();
+    g_assert(test->m_dismissed);
+}
+
 void beforeAll()
 {
     ContextMenuDefaultTest::add("WebKitWebView", "default-menu", testContextMenuDefaultMenu);
@@ -664,6 +728,7 @@ void beforeAll()
     ContextMenuCustomFullTest::add("WebKitWebView", "custom-menu", testContextMenuCustomMenu);
     ContextMenuDisabledTest::add("WebKitWebView", "disable-menu", testContextMenuDisableMenu);
     ContextMenuSubmenuTest::add("WebKitWebView", "submenu", testContextMenuSubMenu);
+    ContextMenuDismissedTest::add("WebKitWebView", "menu-dismissed", testContextMenuDismissed);
 }
 
 void afterAll()
diff --git a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
index 2cebdd995..5e6e91b09 100644
--- a/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
+++ b/Source/WebKit2/UIProcess/API/gtk/tests/TestWebKitSettings.cpp
@@ -229,6 +229,16 @@ static void testWebKitSettings(Test*, gconstpointer)
     webkit_settings_set_draw_compositing_indicators(settings, TRUE);
     g_assert(webkit_settings_get_draw_compositing_indicators(settings));
 
+    // By default, site specific quirks are disabled.
+    g_assert(!webkit_settings_get_enable_site_specific_quirks(settings));
+    webkit_settings_set_enable_site_specific_quirks(settings, TRUE);
+    g_assert(webkit_settings_get_enable_site_specific_quirks(settings));
+
+    // By default, page cache is enabled.
+    g_assert(webkit_settings_get_enable_page_cache(settings));
+    webkit_settings_set_enable_page_cache(settings, FALSE);
+    g_assert(!webkit_settings_get_enable_page_cache(settings));
+
     g_object_unref(G_OBJECT(settings));
 }
 
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
index 8af6ff40c..98da7eceb 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.h
@@ -44,6 +44,8 @@ class PageClientImpl : public PageClient {
 public:
     static PassOwnPtr<PageClientImpl> create(WKView*);
     virtual ~PageClientImpl();
+    
+    void viewWillMoveToAnotherWindow();
 
 private:
     PageClientImpl(WKView*);
diff --git a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
index 3bd702078..457ce921f 100644
--- a/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
+++ b/Source/WebKit2/UIProcess/API/mac/PageClientImpl.mm
@@ -201,6 +201,11 @@ bool PageClientImpl::isViewInWindow()
     return [m_wkView window];
 }
 
+void PageClientImpl::viewWillMoveToAnotherWindow()
+{
+    clearAllEditCommands();
+}
+
 LayerHostingMode PageClientImpl::viewLayerHostingMode()
 {
 #if HAVE(LAYER_HOSTING_IN_WINDOW_SERVER)
diff --git a/Source/WebKit2/UIProcess/API/mac/WKView.mm b/Source/WebKit2/UIProcess/API/mac/WKView.mm
index aa8dc8521..e883215fd 100644
--- a/Source/WebKit2/UIProcess/API/mac/WKView.mm
+++ b/Source/WebKit2/UIProcess/API/mac/WKView.mm
@@ -1883,6 +1883,8 @@ static NSString * const backingPropertyOldScaleFactorKey = @"NSBackingPropertyOl
     if (window == currentWindow)
         return;
     
+    _data->_pageClient->viewWillMoveToAnotherWindow();
+    
     [self removeWindowObservers];
     [self addWindowObserversForWindow:window];
 
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebkittest.cpp b/Source/WebKit2/UIProcess/API/qt/qwebkittest.cpp
index 0930708d4..1c39a53cd 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebkittest.cpp
+++ b/Source/WebKit2/UIProcess/API/qt/qwebkittest.cpp
@@ -23,9 +23,10 @@
 
 #include "QtViewportHandler.h"
 #include "qquickwebview_p_p.h"
-#include "qwindowsysteminterface_qpa.h"
 #include <QMutableListIterator>
 #include <QTouchEvent>
+#include <QWheelEvent>
+#include <qpa/qwindowsysteminterface.h>
 
 using namespace WebKit;
 
@@ -113,6 +114,24 @@ bool QWebKitTest::touchDoubleTap(QObject* item, qreal x, qreal y, int delay)
     return true;
 }
 
+bool QWebKitTest::wheelEvent(QObject* item, qreal x, qreal y, int delta, Qt::Orientation orient)
+{
+    QQuickWebView* window = qobject_cast<QQuickWebView*>(item);
+
+    if (!window) {
+        qWarning("Wheel event not accepted by receiving item");
+        return false;
+    }
+
+    QWheelEvent event(QPointF(x, y), delta, Qt::NoButton, Qt::NoModifier, orient);
+    event.setTimestamp(QDateTime::currentMSecsSinceEpoch());
+    event.setAccepted(false);
+
+    window->wheelEvent(&event);
+
+    return event.isAccepted();
+}
+
 QSize QWebKitTest::contentsSize() const
 {
     return QSize(m_webViewPrivate->pageView->contentsSize().toSize());
diff --git a/Source/WebKit2/UIProcess/API/qt/qwebkittest_p.h b/Source/WebKit2/UIProcess/API/qt/qwebkittest_p.h
index 982398d3a..c0d3e1187 100644
--- a/Source/WebKit2/UIProcess/API/qt/qwebkittest_p.h
+++ b/Source/WebKit2/UIProcess/API/qt/qwebkittest_p.h
@@ -56,6 +56,7 @@ signals:
 public slots:
     bool touchTap(QObject* item, qreal x, qreal y, int delay = -1);
     bool touchDoubleTap(QObject* item, qreal x, qreal y, int delay = -1);
+    bool wheelEvent(QObject* item, qreal x, qreal y, int delta, Qt::Orientation orient = Qt::Vertical);
 
 public:
     QWebKitTest(QQuickWebViewPrivate* webviewPrivate, QObject* parent = 0);
diff --git a/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview.cpp b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview.cpp
new file mode 100644
index 000000000..16bb567ba
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview.cpp
@@ -0,0 +1,384 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "qrawwebview_p.h"
+
+#include "Cursor.h"
+#include "DrawingAreaProxyImpl.h"
+#include "LayerTreeCoordinatorProxy.h"
+#include "NativeWebKeyboardEvent.h"
+#include "NativeWebMouseEvent.h"
+#include "NativeWebTouchEvent.h"
+#include "NativeWebWheelEvent.h"
+#include "NotImplemented.h"
+#include "WebContext.h"
+#include "WebLayerTreeRenderer.h"
+#include "WebPageGroup.h"
+#include "WebPreferences.h"
+#include "qrawwebview_p_p.h"
+#include <WebKit2/qrawwebview_p.h>
+
+void QRawWebViewPrivate::didReceiveMessageFromNavigatorQtObject(const String& message)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::didChangeViewportProperties(const WebCore::ViewportAttributes& attr)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::handleDownloadRequest(WebKit::DownloadProxy* download)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::handleAuthenticationRequiredRequest(const String& hostname, const String& realm, const String& prefilledUsername, String& username, String& password)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::handleCertificateVerificationRequest(const String& hostname, bool& ignoreErrors)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::handleProxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::registerEditCommand(PassRefPtr<WebKit::WebEditCommandProxy>, WebKit::WebPageProxy::UndoOrRedo)
+{
+    notImplemented();
+}
+
+bool QRawWebViewPrivate::canUndoRedo(WebKit::WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    notImplemented();
+    return false;
+}
+
+void QRawWebViewPrivate::executeUndoRedo(WebKit::WebPageProxy::UndoOrRedo undoOrRedo)
+{
+    notImplemented();
+}
+
+WebCore::FloatRect QRawWebViewPrivate::convertToDeviceSpace(const WebCore::FloatRect& rect)
+{
+    notImplemented();
+    return rect;
+}
+
+WebCore::FloatRect QRawWebViewPrivate::convertToUserSpace(const WebCore::FloatRect& rect)
+{
+    notImplemented();
+    return rect;
+}
+
+WebCore::IntPoint QRawWebViewPrivate::screenToWindow(const WebCore::IntPoint& point)
+{
+    notImplemented();
+    return point;
+}
+
+WebCore::IntRect QRawWebViewPrivate::windowToScreen(const WebCore::IntRect& rect)
+{
+    notImplemented();
+    return rect;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void QRawWebViewPrivate::enterAcceleratedCompositingMode(const WebKit::LayerTreeContext&)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::exitAcceleratedCompositingMode()
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::updateAcceleratedCompositingMode(const WebKit::LayerTreeContext&)
+{
+    notImplemented();
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+void QRawWebViewPrivate::updateTextInputState()
+{
+    notImplemented();
+}
+
+#if ENABLE(GESTURE_EVENTS)
+void QRawWebViewPrivate::doneWithGestureEvent(const WebKit::WebGestureEvent& event, bool wasEventHandled)
+{
+    notImplemented();
+}
+
+#endif
+void QRawWebViewPrivate::displayView()
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::scrollView(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::flashBackingStoreUpdates(const Vector<WebCore::IntRect>&)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::didFindZoomableArea(const WebCore::IntPoint& target, const WebCore::IntRect& area)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::setCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::toolTipChanged(const String&, const String& newTooltip)
+{
+    notImplemented();
+}
+
+void QRawWebViewPrivate::startDrag(const WebCore::DragData& dragData, PassRefPtr<WebKit::ShareableBitmap> dragImage)
+{
+    notImplemented();
+}
+
+PassRefPtr<WebKit::WebPopupMenuProxy> QRawWebViewPrivate::createPopupMenuProxy(WebKit::WebPageProxy* webPageProxy)
+{
+    notImplemented();
+    return PassRefPtr<WebKit::WebPopupMenuProxy>();
+}
+
+PassRefPtr<WebKit::WebContextMenuProxy> QRawWebViewPrivate::createContextMenuProxy(WebKit::WebPageProxy* webPageProxy)
+{
+    notImplemented();
+    return PassRefPtr<WebKit::WebContextMenuProxy>();
+}
+
+#if ENABLE(INPUT_TYPE_COLOR)
+PassRefPtr<WebKit::WebColorChooserProxy> QRawWebViewPrivate::createColorChooserProxy(WebKit::WebPageProxy*, const WebCore::Color& intialColor)
+{
+    notImplemented();
+    return PassRefPtr<WebKit::WebColorChooserProxy>();
+}
+#endif
+
+void QRawWebViewPrivate::pageDidRequestScroll(const WebCore::IntPoint& pos)
+{
+    m_client->viewRequestedScroll(pos);
+
+}
+void QRawWebViewPrivate::processDidCrash()
+{
+    m_client->viewProcessCrashed();
+}
+
+void QRawWebViewPrivate::didRelaunchProcess()
+{
+    m_client->viewProcessRelaunched();
+}
+
+void QRawWebViewPrivate::setViewNeedsDisplay(const WebCore::IntRect& rect)
+{
+    m_client->viewNeedsDisplay(rect);
+}
+
+void QRawWebViewPrivate::didChangeContentsSize(const WebCore::IntSize& newSize)
+{
+    m_client->viewContentSizeChanged(newSize);
+}
+
+void QRawWebViewPrivate::setCursor(const WebCore::Cursor& cursor)
+{
+    m_client->viewRequestedCursorOverride(*cursor.platformCursor());
+}
+
+#if ENABLE(TOUCH_EVENTS)
+void QRawWebViewPrivate::doneWithTouchEvent(const WebKit::NativeWebTouchEvent& event, bool wasEventHandled)
+{
+    m_client->doneWithTouchEvent(event.nativeEvent(), wasEventHandled);
+}
+#endif
+
+void QRawWebViewPrivate::doneWithKeyEvent(const WebKit::NativeWebKeyboardEvent& event, bool wasEventHandled)
+{
+    m_client->doneWithKeyEvent(event.nativeEvent(), wasEventHandled);
+}
+
+PassOwnPtr<WebKit::DrawingAreaProxy> QRawWebViewPrivate::createDrawingAreaProxy()
+{
+    return WebKit::DrawingAreaProxyImpl::create(m_webPageProxy.get());
+}
+
+QRawWebViewPrivate::QRawWebViewPrivate(WebKit::WebContext* context, WebKit::WebPageGroup* pageGroup, QRawWebViewClient* client)
+    : m_client(client)
+    , m_webPageProxy(context->createWebPage(this, pageGroup))
+{
+    m_webPageProxy->pageGroup()->preferences()->setForceCompositingMode(true);
+}
+
+QRawWebViewPrivate::~QRawWebViewPrivate()
+{
+}
+
+QRawWebView::QRawWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef, QRawWebViewClient* client)
+    : d(new QRawWebViewPrivate(WebKit::toImpl(contextRef), WebKit::toImpl(pageGroupRef), client))
+{
+}
+
+QRawWebView::~QRawWebView()
+{
+    delete d;
+}
+
+void QRawWebView::create()
+{
+    d->m_webPageProxy->initializeWebPage();
+}
+
+void QRawWebView::setTransparentBackground(bool value)
+{
+    d->m_webPageProxy->setDrawsTransparentBackground(value);
+}
+
+bool QRawWebView::transparentBackground() const
+{
+    return d->m_webPageProxy->drawsTransparentBackground();
+}
+
+void QRawWebView::setDrawBackground(bool value)
+{
+    d->m_webPageProxy->setDrawsBackground(value);
+}
+
+bool QRawWebView::drawBackground() const
+{
+    return d->m_webPageProxy->drawsBackground();
+}
+
+bool QRawWebView::isFocused() const
+{
+    return d->m_focused;
+}
+
+void QRawWebView::setFocused(bool focused)
+{
+    d->m_focused = focused;
+    d->m_webPageProxy->viewStateDidChange(WebKit::WebPageProxy::ViewIsFocused);
+}
+
+bool QRawWebView::isVisible() const
+{
+    return d->m_visible;
+}
+
+void QRawWebView::setVisible(bool visible)
+{
+    d->m_visible = visible;
+    d->m_webPageProxy->viewStateDidChange(WebKit::WebPageProxy::ViewIsVisible);
+}
+
+bool QRawWebView::isActive() const
+{
+    return d->m_active;
+}
+
+void QRawWebView::setActive(bool active)
+{
+    d->m_active = active;
+    d->m_webPageProxy->viewStateDidChange(WebKit::WebPageProxy::ViewWindowIsActive);
+}
+
+QSize QRawWebView::size() const
+{
+    return d->m_size;
+}
+
+void QRawWebView::setSize(const QSize& size)
+{
+    d->m_size = size;
+    d->m_webPageProxy->setViewportSize(size);
+
+
+    WebKit::DrawingAreaProxy* drawingArea = d->m_webPageProxy->drawingArea();
+    if (!drawingArea)
+        return;
+
+
+    drawingArea->setSize(d->m_size, WebCore::IntSize());
+    drawingArea->setVisibleContentsRect(WebCore::IntRect(WebCore::IntPoint(), d->m_size), 1 /*scale*/, WebCore::FloatPoint());
+}
+
+WKPageRef QRawWebView::pageRef()
+{
+    return toAPI(d->m_webPageProxy.get());
+}
+
+void QRawWebView::paint(const QMatrix4x4& transform, float opacity, unsigned paintFlags)
+{
+    WebKit::DrawingAreaProxy* drawingArea = d->m_webPageProxy->drawingArea();
+    if (!drawingArea)
+        return;
+
+    WebKit::LayerTreeCoordinatorProxy* coordinatorProxy = drawingArea->layerTreeCoordinatorProxy();
+    if (!coordinatorProxy)
+        return;
+
+    WebKit::WebLayerTreeRenderer* renderer = coordinatorProxy->layerTreeRenderer();
+    if (!renderer)
+        return;
+
+    renderer->setActive(true);
+    renderer->syncRemoteContent();
+
+    WebCore::FloatRect rect(0, 0, d->m_size.width(), d->m_size.height());
+
+    renderer->paintToCurrentGLContext(transform, opacity, transform.mapRect(rect), paintFlags);
+}
+
+void QRawWebView::sendKeyEvent(QKeyEvent* event)
+{
+    d->m_webPageProxy->handleKeyboardEvent(WebKit::NativeWebKeyboardEvent(event));
+}
+
+void QRawWebView::sendMouseEvent(QMouseEvent* event, int clickCount)
+{
+    d->m_webPageProxy->handleMouseEvent(WebKit::NativeWebMouseEvent(event, QTransform(), clickCount));
+}
+
+void QRawWebView::sendWheelEvent(QWheelEvent* event)
+{
+    d->m_webPageProxy->handleWheelEvent(WebKit::NativeWebWheelEvent(event, QTransform()));
+}
+
+void QRawWebView::sendTouchEvent(QTouchEvent* event)
+{
+    d->m_webPageProxy->handleTouchEvent(WebKit::NativeWebTouchEvent(event, QTransform()));
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p.h b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p.h
new file mode 100644
index 000000000..b8cba692d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p.h
@@ -0,0 +1,101 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+/*
+    This file is not part of the public Qt Api. It may change without notice at any time in future.
+    We make no commitment regarding source compatibility or binary compatibility.
+*/
+
+#ifndef qrawwebview_p_h
+#define qrawwebview_p_h
+
+#include "qwebkitglobal.h"
+
+#include <WebKit2/WKContext.h>
+#include <WebKit2/WKPage.h>
+#include <WebKit2/WKPageGroup.h>
+
+class QRect;
+class QRectF;
+class QPoint;
+class QSize;
+class QKeyEvent;
+class QMouseEvent;
+class QWheelEvent;
+class QTouchEvent;
+class QUrl;
+class QMatrix4x4;
+class QCursor;
+
+class QRawWebViewPrivate;
+
+class QRawWebViewClient {
+public:
+    virtual ~QRawWebViewClient() { }
+
+    virtual void viewNeedsDisplay(const QRect&) = 0;
+    virtual void viewRequestedScroll(const QPoint&) = 0;
+    virtual void viewProcessCrashed() = 0;
+    virtual void viewProcessRelaunched() = 0;
+    virtual void viewContentSizeChanged(const QSize&) = 0;
+    virtual void viewRequestedCursorOverride(const QCursor&) = 0;
+    virtual void doneWithKeyEvent(const QKeyEvent*, bool wasHandled) = 0;
+    virtual void doneWithTouchEvent(const QTouchEvent*, bool wasHandled) = 0;
+};
+
+class QWEBKIT_EXPORT QRawWebView {
+public:
+    QRawWebView(WKContextRef, WKPageGroupRef, QRawWebViewClient*);
+    ~QRawWebView();
+
+    void create();
+
+    void setSize(const QSize&);
+    QSize size() const;
+
+    void setFocused(bool);
+    bool isFocused() const;
+
+    void setVisible(bool);
+    bool isVisible() const;
+
+    void setActive(bool);
+    bool isActive() const;
+
+    void setTransparentBackground(bool);
+    bool transparentBackground() const;
+
+    void setDrawBackground(bool);
+    bool drawBackground() const;
+
+    // Paints on the current GL context.
+    void paint(const QMatrix4x4& transform, float opacity, unsigned paintFlags);
+
+    WKPageRef pageRef();
+
+    void sendKeyEvent(QKeyEvent*);
+    void sendMouseEvent(QMouseEvent*, int clickCount = 0);
+    void sendWheelEvent(QWheelEvent*);
+    void sendTouchEvent(QTouchEvent*);
+
+private:
+    QRawWebViewPrivate* d;
+};
+
+#endif // qrawwebview_p_h
diff --git a/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p_p.h b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p_p.h
new file mode 100644
index 000000000..0a4bf5a9e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/raw/qrawwebview_p_p.h
@@ -0,0 +1,131 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+/*
+    This file is not part of the public Qt Api. It may change without notice at any time in future.
+    We make no commitment regarding source compatibility or binary compatibility.
+*/
+
+#ifndef qrawwebview_p_p_h
+#define qrawwebview_p_p_h
+
+#include "PageClient.h"
+#include "WebContextMenuProxy.h"
+#include "WebPopupMenuProxy.h"
+#include "qrawwebview_p.h"
+
+class QRawWebViewPrivate : public WebKit::PageClient {
+public:
+
+    virtual void pageClosed() { }
+
+    virtual void setFindIndicator(PassRefPtr<WebKit::FindIndicator>, bool fadeOut, bool animate) { }
+    virtual void didCommitLoadForMainFrame(bool useCustomRepresentation) { }
+    virtual void didFinishLoadingDataForCustomRepresentation(const String& suggestedFilename, const CoreIPC::DataReference&) { }
+    virtual double customRepresentationZoomFactor() { return 1; }
+    virtual void setCustomRepresentationZoomFactor(double) { }
+    virtual void didChangeScrollbarsForMainFrame() const { }
+    virtual void findStringInCustomRepresentation(const String&, WebKit::FindOptions, unsigned maxMatchCount) { }
+    virtual void countStringMatchesInCustomRepresentation(const String&, WebKit::FindOptions, unsigned maxMatchCount) { }
+    virtual void clearAllEditCommands() { }
+
+    virtual void didReceiveMessageFromNavigatorQtObject(const String& message);
+    virtual void didChangeViewportProperties(const WebCore::ViewportAttributes& attr);
+    virtual void handleDownloadRequest(WebKit::DownloadProxy* download);
+
+    virtual void handleAuthenticationRequiredRequest(const String& hostname, const String& realm, const String& prefilledUsername, String& username, String& password);
+    virtual void handleCertificateVerificationRequest(const String& hostname, bool& ignoreErrors);
+    virtual void handleProxyAuthenticationRequiredRequest(const String& hostname, uint16_t port, const String& prefilledUsername, String& username, String& password);
+
+    virtual void registerEditCommand(PassRefPtr<WebKit::WebEditCommandProxy>, WebKit::WebPageProxy::UndoOrRedo);
+    virtual bool canUndoRedo(WebKit::WebPageProxy::UndoOrRedo undoOrRedo);
+    virtual void executeUndoRedo(WebKit::WebPageProxy::UndoOrRedo undoOrRedo);
+
+    virtual WebCore::FloatRect convertToDeviceSpace(const WebCore::FloatRect& rect);
+    virtual WebCore::FloatRect convertToUserSpace(const WebCore::FloatRect& rect);
+    virtual WebCore::IntPoint screenToWindow(const WebCore::IntPoint& point);
+    virtual WebCore::IntRect windowToScreen(const WebCore::IntRect& rect);
+
+#if USE(ACCELERATED_COMPOSITING)
+    virtual void enterAcceleratedCompositingMode(const WebKit::LayerTreeContext&);
+    virtual void exitAcceleratedCompositingMode();
+    virtual void updateAcceleratedCompositingMode(const WebKit::LayerTreeContext&);
+#endif // USE(ACCELERATED_COMPOSITING)
+
+    virtual void updateTextInputState();
+#if ENABLE(GESTURE_EVENTS)
+    virtual void doneWithGestureEvent(const WebKit::WebGestureEvent& event, bool wasEventHandled);
+#endif
+    virtual void displayView();
+    virtual void scrollView(const WebCore::IntRect& scrollRect, const WebCore::IntSize& scrollOffset);
+
+    virtual void flashBackingStoreUpdates(const Vector<WebCore::IntRect>&);
+    virtual void didFindZoomableArea(const WebCore::IntPoint& target, const WebCore::IntRect& area);
+
+    virtual void setCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves);
+    virtual void toolTipChanged(const String&, const String& newTooltip);
+
+    virtual void startDrag(const WebCore::DragData& dragData, PassRefPtr<WebKit::ShareableBitmap> dragImage);
+
+    virtual PassRefPtr<WebKit::WebPopupMenuProxy> createPopupMenuProxy(WebKit::WebPageProxy* webPageProxy);
+    virtual PassRefPtr<WebKit::WebContextMenuProxy> createContextMenuProxy(WebKit::WebPageProxy* webPageProxy);
+
+#if ENABLE(INPUT_TYPE_COLOR)
+    virtual PassRefPtr<WebKit::WebColorChooserProxy> createColorChooserProxy(WebKit::WebPageProxy*, const WebCore::Color& intialColor);
+#endif
+
+    QRawWebViewPrivate(WebKit::WebContext*, WebKit::WebPageGroup*, QRawWebViewClient*);
+    ~QRawWebViewPrivate();
+
+    // PageClient
+
+    virtual PassOwnPtr<WebKit::DrawingAreaProxy> createDrawingAreaProxy();
+
+    virtual void pageDidRequestScroll(const WebCore::IntPoint& pos);
+    virtual void processDidCrash();
+    virtual void didRelaunchProcess();
+    virtual void setViewNeedsDisplay(const WebCore::IntRect& rect);
+    virtual void didChangeContentsSize(const WebCore::IntSize& newSize);
+    virtual void setCursor(const WebCore::Cursor&);
+
+    virtual bool isViewFocused() { return m_focused; }
+    virtual bool isViewVisible() { return m_visible; }
+    virtual bool isViewWindowActive() { return m_active; }
+    virtual bool isViewInWindow() { return true; } // FIXME
+    virtual WebCore::IntSize viewSize() { return m_size; }
+
+    virtual void doneWithKeyEvent(const WebKit::NativeWebKeyboardEvent&, bool wasEventHandled);
+#if ENABLE(TOUCH_EVENTS)
+    virtual void doneWithTouchEvent(const WebKit::NativeWebTouchEvent&, bool wasEventHandled);
+#endif
+
+
+    bool m_focused;
+    bool m_visible;
+    bool m_active;
+    QSize m_size;
+
+    QRawWebViewClient* m_client;
+    WTF::RefPtr<WebKit::WebPageProxy> m_webPageProxy;
+
+private:
+    QRawWebView* q;
+};
+
+#endif // qrawwebview_p_p_h
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h b/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h
index 7f87e72dd..2262a5f1a 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/bytearraytestdata.h
@@ -21,6 +21,10 @@
 #ifndef bytearraytestdata_h
 #define bytearraytestdata_h
 
+#if 0
+#pragma qt_no_master_include
+#endif
+
 #include "qwebkitglobal.h"
 #include <QByteArray>
 #include <QObject>
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/html/bluesquare.html b/Source/WebKit2/UIProcess/API/qt/tests/html/bluesquare.html
new file mode 100644
index 000000000..f4b639621
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/html/bluesquare.html
@@ -0,0 +1,5 @@
+<body style="margin:60px">
+    <table style="border:10px solid blue; width:80px; height:80px">
+        <tr><td>&nbsp;</td></tr>
+    </table>
+</body>
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/html/redsquare.html b/Source/WebKit2/UIProcess/API/qt/tests/html/redsquare.html
new file mode 100644
index 000000000..f70d2918a
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/html/redsquare.html
@@ -0,0 +1,5 @@
+<body style="margin:20px">
+    <table style="border:10px solid red; width:160px; height:160px">
+        <tr><td>&nbsp;</td></tr>
+    </table>
+</body>
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_noBackground1.png b/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_noBackground1.png
new file mode 100644
index 000000000..c293f449e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_noBackground1.png
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_noBackground3.png b/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_noBackground3.png
new file mode 100644
index 000000000..4fa53b135
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_noBackground3.png
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_paint.png b/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_paint.png
new file mode 100644
index 000000000..68743ac9e
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/html/resources/qwkview_paint.png
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml
index 366e7c00c..b5152c2bb 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_colorChooser.qml
@@ -46,12 +46,21 @@ TestWebView {
             webView.url = Qt.resolvedUrl("../common/colorChooser.html")
             verify(webView.waitForLoadSucceeded())
 
+            while (webView.title != "Feature enabled" && webView.title != "Feature disabled")
+                wait(0)
+
             webView.featureEnabled = (webView.title == "Feature enabled")
+            if (!webView.featureEnabled)
+                return
 
             titleSpy.clear()
 
-            webView.shouldReject = false;
-            webView.shouldAcceptCurrent = false;
+            webView.shouldReject = false
+            webView.shouldAcceptCurrent = false
+        }
+
+        function cleanup() {
+            titleSpy.clear()
         }
 
         function test_accept() {
@@ -64,8 +73,8 @@ TestWebView {
             // pick a new color with the chooser.
             webView.selectedColor = "#020020"
             openColorChooser()
-            titleSpy.wait()
-            compare(titleSpy.count, 2)
+            while (titleSpy.count != 2)
+                wait(0)
             compare(webView.title, "#020020")
         }
 
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_singleFileUpload.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_singleFileUpload.qml
index 6bcd8036b..30514a3b6 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_singleFileUpload.qml
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_singleFileUpload.qml
@@ -11,18 +11,20 @@ TestWebView {
     height: 400
 
     property bool selectFile
+    property bool returnEmpty: false
     property bool acceptMultiple: false
 
     experimental.filePicker: Item {
         Component.onCompleted: {
-            var selectedFiles = ["filename1", "filename2"]
-            if (selectFile) {
+            if (returnEmpty)
+                model.accept("");
+            else if (selectFile) {
+                var selectedFiles = ["filename1", "filename2"];
                 if (acceptMultiple)
-                    model.accept(selectedFiles)
+                    model.accept(selectedFiles);
                 else
                     model.accept("acceptedfilename");
-            }
-            else
+            } else
                 model.reject();
         }
     }
@@ -57,12 +59,21 @@ TestWebView {
 
         function test_multiple() {
             webView.selectFile = true;
+            webView.returnEmpty = false;
             webView.acceptMultiple = true;
             openItemSelector()
             titleSpy.wait()
             compare(webView.title, "filename1")
         }
 
+        function test_rejectIfEmptyAccept() {
+            var oldTitle = webView.title
+            webView.selectFile = false;
+            webView.returnEmpty = true;
+            openItemSelector()
+            compare(webView.title, oldTitle)
+        }
+
         function test_reject() {
             var oldTitle = webView.title
             webView.selectFile = false;
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_wheelEventHandling.qml b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_wheelEventHandling.qml
new file mode 100644
index 000000000..d24312610
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/WebView/tst_wheelEventHandling.qml
@@ -0,0 +1,46 @@
+import QtQuick 2.0
+import QtTest 1.0
+import QtWebKit 3.0
+import QtWebKit.experimental 1.0
+import Test 1.0
+import "../common"
+
+Item {
+    TestWebView {
+        id: webView
+        width: 800
+        height: 600
+        url: Qt.resolvedUrl("../common/test4.html")
+    }
+
+    SignalSpy {
+        id: scrollSpy
+        target: webView
+        signalName: "contentYChanged"
+    }
+
+    TestCase {
+        name: "WheelEventHandling"
+
+        property variant test: webView.experimental.test
+
+        function init() {
+            webView.url = Qt.resolvedUrl("../common/test4.html")
+            verify(webView.waitForLoadSucceeded())
+            webView.contentY = 0
+        }
+
+        function test_wheelScrollEvent() {
+            scrollSpy.clear()
+            var centerPoint = Qt.point(webView.width / 2, webView.height / 2)
+            test.wheelEvent(webView, centerPoint.x, centerPoint.y, -500);
+            // The signal spy below will time out if the wheel event did not scroll the content.
+            scrollSpy.wait()
+            var position = webView.contentY
+            webView.reload()
+            verify(webView.waitForLoadSucceeded())
+            // The check below will fail if the previous position was not restored after reload.
+            verify(position == webView.contentY)
+        }
+    }
+}
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/colorChooser.html b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/colorChooser.html
index b04710ab9..b3254c3b8 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/colorChooser.html
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/colorChooser.html
@@ -1,13 +1,15 @@
 <!DOCTYPE html>
 <html>
 <head>
-<title>Feature disabled</title>
+<title>Title</title>
 <script>
 function detectInputTypeColorEnabled() {
     var element = document.getElementById('test')
     element.value = 'should sanitize';
     if (element.value != 'should sanitize')
         document.title = 'Feature enabled';
+    else
+        document.title = 'Feature disabled';
 }
 function updateTitle(element) {
     document.title = element.value;
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test4.html b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test4.html
new file mode 100644
index 000000000..e31d689d8
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qmltests/common/test4.html
@@ -0,0 +1,117 @@
+<html>
+    <head>
+        <title>Long Page To Scroll</title>
+        <style>
+            #content {
+                 margin: auto;
+                 width:  100%;
+                 background: #eeeeee;
+                 font-size: 50px;
+            }
+        </style>
+    </head>
+    <body>
+        <div id="content">
+            bla00<br/>
+            bla01<br/>
+            bla02<br/>
+            bla03<br/>
+            bla04<br/>
+            bla05<br/>
+            bla06<br/>
+            bla07<br/>
+            bla08<br/>
+            bla09<br/>
+            bla10<br/>
+            bla11<br/>
+            bla12<br/>
+            bla13<br/>
+            bla14<br/>
+            bla15<br/>
+            bla16<br/>
+            bla17<br/>
+            bla18<br/>
+            bla19<br/>
+            bla20<br/>
+            bla21<br/>
+            bla22<br/>
+            bla23<br/>
+            bla24<br/>
+            bla25<br/>
+            bla26<br/>
+            bla27<br/>
+            bla28<br/>
+            bla29<br/>
+            bla30<br/>
+            bla31<br/>
+            bla32<br/>
+            bla33<br/>
+            bla34<br/>
+            bla35<br/>
+            bla36<br/>
+            bla37<br/>
+            bla38<br/>
+            bla39<br/>
+            bla40<br/>
+            bla41<br/>
+            bla42<br/>
+            bla43<br/>
+            bla44<br/>
+            bla45<br/>
+            bla46<br/>
+            bla47<br/>
+            bla48<br/>
+            bla49<br/>
+            bla50<br/>
+            bla51<br/>
+            bla52<br/>
+            bla53<br/>
+            bla54<br/>
+            bla55<br/>
+            bla56<br/>
+            bla57<br/>
+            bla58<br/>
+            bla59<br/>
+            bla60<br/>
+            bla61<br/>
+            bla62<br/>
+            bla63<br/>
+            bla64<br/>
+            bla65<br/>
+            bla66<br/>
+            bla67<br/>
+            bla68<br/>
+            bla69<br/>
+            bla70<br/>
+            bla71<br/>
+            bla72<br/>
+            bla73<br/>
+            bla74<br/>
+            bla75<br/>
+            bla76<br/>
+            bla77<br/>
+            bla78<br/>
+            bla79<br/>
+            bla80<br/>
+            bla81<br/>
+            bla82<br/>
+            bla83<br/>
+            bla84<br/>
+            bla85<br/>
+            bla86<br/>
+            bla87<br/>
+            bla88<br/>
+            bla89<br/>
+            bla90<br/>
+            bla91<br/>
+            bla92<br/>
+            bla93<br/>
+            bla94<br/>
+            bla95<br/>
+            bla96<br/>
+            bla97<br/>
+            bla98<br/>
+            bla99<br/>
+        </div>
+    </body>
+</html>
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qrawwebview/qrawwebview.pro b/Source/WebKit2/UIProcess/API/qt/tests/qrawwebview/qrawwebview.pro
new file mode 100644
index 000000000..02dc197c7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qrawwebview/qrawwebview.pro
@@ -0,0 +1,3 @@
+include(../tests.pri)
+SOURCES += $${TARGET}.cpp
+QT += webkit-private
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/qrawwebview/tst_qrawwebview.cpp b/Source/WebKit2/UIProcess/API/qt/tests/qrawwebview/tst_qrawwebview.cpp
new file mode 100644
index 000000000..9f6888180
--- /dev/null
+++ b/Source/WebKit2/UIProcess/API/qt/tests/qrawwebview/tst_qrawwebview.cpp
@@ -0,0 +1,226 @@
+/*
+    Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#include "../util.h"
+
+#include <QImage>
+#include <QMatrix4x4>
+#include <QOpenGLContext>
+#include <QSize>
+#include <QWindow>
+#include <QtTest/QtTest>
+
+#include <WebKit2/WKContext.h>
+#include <WebKit2/WKPageGroup.h>
+#include <WebKit2/WKPreferences.h>
+#include <WebKit2/WKPreferencesPrivate.h>
+#include <WebKit2/WKStringQt.h>
+#include <WebKit2/WKURL.h>
+#include <WebKit2/qrawwebview_p.h>
+
+static WKContextRef webContext()
+{
+    static WKContextRef result = WKContextCreate();
+    return result;
+}
+
+static WKPageGroupRef createWebPageGroup(const QString& name)
+{
+    WKPageGroupRef pageGroup =WKPageGroupCreateWithIdentifier(WKStringCreateWithQString(name));
+    WKPreferencesRef preferences = WKPageGroupGetPreferences(pageGroup);
+    WKPreferencesSetAcceleratedCompositingEnabled(preferences, true);
+    WKPreferencesSetFrameFlatteningEnabled(preferences, true);
+
+    return pageGroup;
+}
+
+static WKPageGroupRef webPageGroup(const QString& name)
+{
+    static WKPageGroupRef result = createWebPageGroup(name);
+    return result;
+}
+
+class WebView : public QObject, public QRawWebViewClient {
+    Q_OBJECT
+public:
+    WebView(const QSize& size)
+    {
+        WKPageLoaderClient loaderClient;
+        memset(&loaderClient, 0, sizeof(WKPageLoaderClient));
+        loaderClient.clientInfo = this;
+        loaderClient.didFinishLoadForFrame = WebView::finishLoadForFrame;
+
+        m_webView = new QRawWebView(webContext(), webPageGroup(QString()), this);
+        WKPageSetPageLoaderClient(m_webView->pageRef(), &loaderClient);
+        m_webView->create();
+        WKPageSetUseFixedLayout(m_webView->pageRef(), true);
+
+        m_webView->setSize(size);
+        m_webView->setFocused(true);
+        m_webView->setVisible(true);
+        m_webView->setActive(true);
+    }
+
+    ~WebView() { delete m_webView; }
+
+    void load(const QString& html)
+    {
+        m_frameLoaded = false;
+        WKPageLoadURL(m_webView->pageRef(), WKURLCreateWithUTF8CString(html.toAscii().data()));
+        QVERIFY(::waitForSignal(this, SIGNAL(loaded()), 5000));
+    }
+
+    void setDrawBackground(bool value) { m_webView->setDrawBackground(value); }
+    void setTransparentBackground(bool value) { m_webView->setTransparentBackground(value); }
+
+    virtual void viewNeedsDisplay(const QRect&)
+    {
+        m_webView->paint(QMatrix4x4(), 1, 0);
+        if (m_frameLoaded)
+            emit loaded();
+    }
+
+    virtual void viewRequestedScroll(const QPoint&) { }
+    virtual void viewProcessCrashed() { }
+    virtual void viewProcessRelaunched() { }
+    virtual void viewContentSizeChanged(const QSize&) { }
+    virtual void viewRequestedCursorOverride(const QCursor&) { }
+    virtual void doneWithKeyEvent(const QKeyEvent*, bool wasHandled) { }
+    virtual void doneWithTouchEvent(const QTouchEvent*, bool wasHandled) { }
+
+    static void finishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void *clientInfo);
+
+signals:
+    void loaded();
+
+private:
+    QRawWebView* m_webView;
+    bool m_frameLoaded;
+};
+
+void WebView::finishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void *clientInfo)
+{
+    WebView* obj = static_cast<WebView*>(const_cast<void*>(clientInfo));
+    obj->m_frameLoaded = true;
+}
+
+static bool compareImages(const QImage& i1, const QImage& i2, int count)
+{
+    if (i1.size() != i2.size())
+        return false;
+    for (int x = 0; x < count; ++x) {
+        for (int y = 0; y < count; ++y) {
+            QPoint point(x * i1.width() / count, y * i1.height() / count);
+            if (i1.pixel(point) != i2.pixel(point))
+                return false;
+        }
+    }
+
+    return true;
+}
+
+class tst_qrawwebview : public QObject {
+    Q_OBJECT
+public:
+    tst_qrawwebview()
+        : m_resourceDir(QString::fromAscii(TESTS_SOURCE_DIR "/html/resources"))
+        , m_baseUrl(QUrl::fromLocalFile(TESTS_SOURCE_DIR "/html").toString())
+    { }
+
+private slots:
+    void paint() { run(&tst_qrawwebview::doPaint, m_resourceDir + "/qwkview_paint.png"); }
+    void noBackground1() { run(&tst_qrawwebview::doNoBackground1, m_resourceDir + "/qwkview_noBackground1.png"); }
+    void noBackground2() { run(&tst_qrawwebview::doNoBackground2, m_resourceDir + "/qwkview_noBackground1.png"); }
+    void noBackground3() { run(&tst_qrawwebview::doNoBackground3, m_resourceDir + "/qwkview_noBackground3.png"); }
+
+private:
+    const QString m_resourceDir;
+    const QString m_baseUrl;
+
+    void doPaint(const QSize& size);
+    void doNoBackground1(const QSize& size);
+    void doNoBackground2(const QSize& size);
+    void doNoBackground3(const QSize& size);
+
+    typedef void (tst_qrawwebview::*PaintMethod)(const QSize& size);
+    void run(PaintMethod, const QString& expectation);
+};
+
+void tst_qrawwebview::doPaint(const QSize& size)
+{
+    WebView view(size);
+    view.load(m_baseUrl + "/redsquare.html");
+}
+
+void tst_qrawwebview::doNoBackground1(const QSize& size)
+{
+    WebView view(size);
+    view.setTransparentBackground(true);
+    view.load(m_baseUrl + "/redsquare.html");
+    view.load(m_baseUrl + "/bluesquare.html");
+}
+
+void tst_qrawwebview::doNoBackground2(const QSize& size)
+{
+    WebView view1(size);
+    view1.setTransparentBackground(true);
+    view1.load(m_baseUrl + "/redsquare.html");
+
+    WebView view2(size);
+    view2.setTransparentBackground(true);
+    view2.load(m_baseUrl + "/bluesquare.html");
+}
+
+void tst_qrawwebview::doNoBackground3(const QSize& size)
+{
+    WebView view1(size);
+    view1.setTransparentBackground(false);
+    view1.load(m_baseUrl + "/redsquare.html");
+
+    WebView view2(size);
+    view2.setTransparentBackground(true);
+    view2.load(m_baseUrl + "/bluesquare.html");
+}
+
+void tst_qrawwebview::run(PaintMethod method, const QString& expectation)
+{
+
+    QWindow window;
+    window.setSurfaceType(QSurface::OpenGLSurface);
+    window.setGeometry(0, 0, 200, 200);
+    window.create();
+
+    QOpenGLContext context;
+    context.create();
+    context.makeCurrent(&window);
+
+    glViewport(0, 0, window.size().width(), window.size().height());
+    glClearColor(0, 0, 0, 0);
+    glClear(GL_COLOR_BUFFER_BIT);
+
+    (this->*method)(window.size());
+
+    QImage image(window.size(), QImage::Format_ARGB32_Premultiplied);
+    glReadPixels(0, 0, window.size().width(), window.size().height(), GL_RGBA, GL_UNSIGNED_BYTE, image.bits());
+
+    QVERIFY(compareImages(QImage(expectation), image.rgbSwapped(), 5));
+}
+
+QTEST_MAIN(tst_qrawwebview)
+
+#include "tst_qrawwebview.moc"
diff --git a/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h b/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
index 1eaa43772..6d855cf97 100644
--- a/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
+++ b/Source/WebKit2/UIProcess/API/qt/tests/testwindow.h
@@ -20,6 +20,10 @@
 #ifndef testwindow_h
 #define testwindow_h
 
+#if 0
+#pragma qt_no_master_include
+#endif
+
 #include <QResizeEvent>
 #include <QScopedPointer>
 #include <QtQuick/qquickitem.h>
diff --git a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp
index e53d4156b..ba22dda2d 100644
--- a/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp
+++ b/Source/WebKit2/UIProcess/Launcher/ProcessLauncher.cpp
@@ -33,7 +33,9 @@ namespace WebKit {
 
 static WorkQueue& processLauncherWorkQueue()
 {
-    DEFINE_STATIC_LOCAL(WorkQueue, processLauncherWorkQueue, ("com.apple.WebKit.ProcessLauncher"));
+    // Give in to VisualStudio and its 31 character thread name limit and shorten the thread name to ProcLauncher instead of class name.
+    // See createThread() in Threading.cpp.
+    DEFINE_STATIC_LOCAL(WorkQueue, processLauncherWorkQueue, ("com.apple.WebKit.ProcLauncher"));
     return processLauncherWorkQueue;
 }
 
diff --git a/Source/WebKit2/UIProcess/WebBackForwardList.cpp b/Source/WebKit2/UIProcess/WebBackForwardList.cpp
index 4a81a8765..00e8f4c01 100644
--- a/Source/WebKit2/UIProcess/WebBackForwardList.cpp
+++ b/Source/WebKit2/UIProcess/WebBackForwardList.cpp
@@ -43,17 +43,28 @@ WebBackForwardList::WebBackForwardList(WebPageProxy* page)
 
 WebBackForwardList::~WebBackForwardList()
 {
+    // A WebBackForwardList should never be destroyed unless it's associated page has been closed or is invalid.
+    ASSERT((!m_page && !m_hasCurrentIndex) || !m_page->isValid());
 }
 
 void WebBackForwardList::pageClosed()
 {
+    // We should have always started out with an m_page and we should never close the page twice.
+    ASSERT(m_page);
+
     if (m_page) {
         size_t size = m_entries.size();
-        for (size_t i = 0; i < size; ++i)
+        for (size_t i = 0; i < size; ++i) {
+            ASSERT(m_entries[i]);
+            if (!m_entries[i])
+                continue;
             m_page->backForwardRemovedItem(m_entries[i]->itemID());
+        }
     }
 
     m_page = 0;
+    m_entries.clear();
+    m_hasCurrentIndex = false;
 }
 
 void WebBackForwardList::addItem(WebBackForwardListItem* newItem)
@@ -81,15 +92,22 @@ void WebBackForwardList::addItem(WebBackForwardListItem* newItem)
             m_page->backForwardRemovedItem(m_entries[0]->itemID());
             removedItems.append(m_entries[0].release());
             m_entries.remove(0);
+
             if (m_entries.isEmpty())
                 m_hasCurrentIndex = false;
             else
                 m_currentIndex--;
         }
     } else {
-        // If we have no current item index, we should have no other entries before adding this new item.
+        // If we have no current item index we should also not have any entries.
+        ASSERT(m_entries.isEmpty());
+
+        // But just in case it does happen in practice we'll get back in to a consistent state now before adding the new item.
         size_t size = m_entries.size();
         for (size_t i = 0; i < size; ++i) {
+            ASSERT(m_entries[i]);
+            if (!m_entries[i])
+                continue;
             m_page->backForwardRemovedItem(m_entries[i]->itemID());
             removedItems.append(m_entries[i].release());
         }
@@ -97,6 +115,7 @@ void WebBackForwardList::addItem(WebBackForwardListItem* newItem)
     }
     
     if (!m_hasCurrentIndex) {
+        ASSERT(m_entries.isEmpty());
         m_currentIndex = 0;
         m_hasCurrentIndex = true;
     } else
@@ -115,7 +134,7 @@ void WebBackForwardList::goToItem(WebBackForwardListItem* item)
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
-    if (!m_entries.size() || !item)
+    if (!m_entries.size() || !item || !m_page || !m_hasCurrentIndex)
         return;
         
     unsigned index = 0;
@@ -125,8 +144,7 @@ void WebBackForwardList::goToItem(WebBackForwardListItem* item)
     }
     if (index < m_entries.size()) {
         m_currentIndex = index;
-        if (m_page)
-            m_page->didChangeBackForwardList(0, 0);
+        m_page->didChangeBackForwardList(0, 0);
     }
 }
 
@@ -134,28 +152,28 @@ WebBackForwardListItem* WebBackForwardList::currentItem()
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
-    return m_hasCurrentIndex ? m_entries[m_currentIndex].get() : 0;
+    return m_page && m_hasCurrentIndex ? m_entries[m_currentIndex].get() : 0;
 }
 
 WebBackForwardListItem* WebBackForwardList::backItem()
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
-    return m_hasCurrentIndex && m_currentIndex ? m_entries[m_currentIndex - 1].get() : 0;
+    return m_page && m_hasCurrentIndex && m_currentIndex ? m_entries[m_currentIndex - 1].get() : 0;
 }
 
 WebBackForwardListItem* WebBackForwardList::forwardItem()
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
-    return m_hasCurrentIndex && m_entries.size() && m_currentIndex < m_entries.size() - 1 ? m_entries[m_currentIndex + 1].get() : 0;
+    return m_page && m_hasCurrentIndex && m_entries.size() && m_currentIndex < m_entries.size() - 1 ? m_entries[m_currentIndex + 1].get() : 0;
 }
 
 WebBackForwardListItem* WebBackForwardList::itemAtIndex(int index)
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
-    if (!m_hasCurrentIndex)
+    if (!m_hasCurrentIndex || !m_page)
         return 0;
     
     // Do range checks without doing math on index to avoid overflow.
@@ -172,20 +190,23 @@ int WebBackForwardList::backListCount()
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
-    return !m_hasCurrentIndex ? 0 : m_currentIndex;
+    return m_page && m_hasCurrentIndex ? m_currentIndex : 0;
 }
 
 int WebBackForwardList::forwardListCount()
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
-    return !m_hasCurrentIndex ? 0 : static_cast<int>(m_entries.size()) - (m_currentIndex + 1);
+    return m_page && m_hasCurrentIndex ? m_entries.size() - (m_currentIndex + 1) : 0;
 }
 
 PassRefPtr<ImmutableArray> WebBackForwardList::backListAsImmutableArrayWithLimit(unsigned limit)
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
+    if (!m_page || !m_hasCurrentIndex)
+        return ImmutableArray::create();
+
     unsigned backListSize = static_cast<unsigned>(backListCount());
     unsigned size = std::min(backListSize, limit);
     if (!size)
@@ -195,8 +216,10 @@ PassRefPtr<ImmutableArray> WebBackForwardList::backListAsImmutableArrayWithLimit
     vector.reserveInitialCapacity(size);
 
     ASSERT(backListSize >= size);
-    for (unsigned i = backListSize - size; i < backListSize; ++i)
+    for (unsigned i = backListSize - size; i < backListSize; ++i) {
+        ASSERT(m_entries[i]);
         vector.uncheckedAppend(m_entries[i].get());
+    }
 
     return ImmutableArray::adopt(vector);
 }
@@ -205,6 +228,9 @@ PassRefPtr<ImmutableArray> WebBackForwardList::forwardListAsImmutableArrayWithLi
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
+    if (!m_page || !m_hasCurrentIndex)
+        return ImmutableArray::create();
+
     unsigned size = std::min(static_cast<unsigned>(forwardListCount()), limit);
     if (!size)
         return ImmutableArray::create();
@@ -214,8 +240,10 @@ PassRefPtr<ImmutableArray> WebBackForwardList::forwardListAsImmutableArrayWithLi
 
     unsigned last = m_currentIndex + size;
     ASSERT(last < m_entries.size());
-    for (unsigned i = m_currentIndex + 1; i <= last; ++i)
+    for (unsigned i = m_currentIndex + 1; i <= last; ++i) {
+        ASSERT(m_entries[i]);
         vector.uncheckedAppend(m_entries[i].get());
+    }
 
     return ImmutableArray::adopt(vector);
 }
@@ -225,22 +253,42 @@ void WebBackForwardList::clear()
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
     size_t size = m_entries.size();
-    if (size <= 1)
+    if (!m_page || size <= 1)
         return;
 
     RefPtr<WebBackForwardListItem> currentItem = this->currentItem();
+    Vector<RefPtr<APIObject> > removedItems;
 
-    if (m_page) {
+    if (!currentItem) {
+        // We should only ever have no current item if we also have no current item index.
+        ASSERT(!m_hasCurrentIndex);
+
+        // But just in case it does happen in practice we should get back into a consistent state now.
         for (size_t i = 0; i < size; ++i) {
-            if (m_entries[i] != currentItem)
-                m_page->backForwardRemovedItem(m_entries[i]->itemID());
+            ASSERT(m_entries[i]);
+            if (!m_entries[i])
+                continue;
+
+            m_page->backForwardRemovedItem(m_entries[i]->itemID());
+            removedItems.append(m_entries[i].release());
         }
+
+        m_entries.clear();
+        m_hasCurrentIndex = false;
+        m_page->didChangeBackForwardList(0, &removedItems);
+
+        return;
     }
 
-    Vector<RefPtr<APIObject> > removedItems;
-    removedItems.reserveCapacity(m_entries.size() - 1);
-    for (size_t i = 0; i < m_entries.size(); ++i) {
-        if (i != m_currentIndex)
+    for (size_t i = 0; i < size; ++i) {
+        ASSERT(m_entries[i]);
+        if (m_entries[i] && m_entries[i] != currentItem)
+            m_page->backForwardRemovedItem(m_entries[i]->itemID());
+    }
+
+    removedItems.reserveCapacity(size - 1);
+    for (size_t i = 0; i < size; ++i) {
+        if (i != m_currentIndex && m_hasCurrentIndex && m_entries[i])
             removedItems.append(m_entries[i].release());
     }
 
@@ -254,8 +302,7 @@ void WebBackForwardList::clear()
         m_hasCurrentIndex = false;
     }
 
-    if (m_page)
-        m_page->didChangeBackForwardList(0, &removedItems);
+    m_page->didChangeBackForwardList(0, &removedItems);
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebBackForwardList.h b/Source/WebKit2/UIProcess/WebBackForwardList.h
index 97bd2a32f..16a562d03 100644
--- a/Source/WebKit2/UIProcess/WebBackForwardList.h
+++ b/Source/WebKit2/UIProcess/WebBackForwardList.h
@@ -80,6 +80,8 @@ public:
 #if USE(CF)
     CFDictionaryRef createCFDictionaryRepresentation(WebPageProxy::WebPageProxySessionStateFilterCallback, void* context) const;
     bool restoreFromCFDictionaryRepresentation(CFDictionaryRef);
+    bool restoreFromV0CFDictionaryRepresentation(CFDictionaryRef);
+    bool restoreFromV1CFDictionaryRepresentation(CFDictionaryRef);
 #endif
 
 private:
diff --git a/Source/WebKit2/UIProcess/WebBatteryManagerProxy.cpp b/Source/WebKit2/UIProcess/WebBatteryManagerProxy.cpp
new file mode 100644
index 000000000..c3897e81c
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebBatteryManagerProxy.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebBatteryManagerProxy.h"
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "WebBatteryManagerMessages.h"
+#include "WebContext.h"
+
+namespace WebKit {
+
+PassRefPtr<WebBatteryManagerProxy> WebBatteryManagerProxy::create(WebContext* context)
+{
+    return adoptRef(new WebBatteryManagerProxy(context));
+}
+
+WebBatteryManagerProxy::WebBatteryManagerProxy(WebContext* context)
+    : m_isUpdating(false)
+    , m_context(context)
+{
+}
+
+WebBatteryManagerProxy::~WebBatteryManagerProxy()
+{
+}
+
+void WebBatteryManagerProxy::invalidate()
+{
+    stopUpdating();
+}
+
+void WebBatteryManagerProxy::initializeProvider(const WKBatteryProvider* provider)
+{
+    m_provider.initialize(provider);
+}
+
+void WebBatteryManagerProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebBatteryManagerProxyMessage(connection, messageID, arguments);
+}
+
+void WebBatteryManagerProxy::startUpdating()
+{
+    if (m_isUpdating)
+        return;
+
+    m_provider.startUpdating(this);
+    m_isUpdating = true;
+}
+
+void WebBatteryManagerProxy::stopUpdating()
+{
+    if (!m_isUpdating)
+        return;
+
+    m_provider.stopUpdating(this);
+    m_isUpdating = false;
+}
+
+void WebBatteryManagerProxy::providerDidChangeBatteryStatus(const WTF::AtomicString& eventType, WebBatteryStatus* status)
+{
+    if (!m_context)
+        return;
+
+    m_context->sendToAllProcesses(Messages::WebBatteryManager::DidChangeBatteryStatus(eventType, status->data()));
+}
+
+void WebBatteryManagerProxy::providerUpdateBatteryStatus(WebBatteryStatus* status)
+{
+    if (!m_context)
+        return;
+
+    m_context->sendToAllProcesses(Messages::WebBatteryManager::UpdateBatteryStatus(status->data()));
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit2/UIProcess/WebBatteryManagerProxy.h b/Source/WebKit2/UIProcess/WebBatteryManagerProxy.h
new file mode 100644
index 000000000..9fa5bdc43
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebBatteryManagerProxy.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebBatteryManagerProxy_h
+#define WebBatteryManagerProxy_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "APIObject.h"
+#include "MessageID.h"
+#include "WebBatteryProvider.h"
+#include <wtf/Forward.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+}
+
+namespace WebKit {
+
+class WebContext;
+class WebBatteryStatus;
+
+class WebBatteryManagerProxy : public APIObject {
+public:
+    static const Type APIType = TypeBatteryManager;
+
+    static PassRefPtr<WebBatteryManagerProxy> create(WebContext*);
+    virtual ~WebBatteryManagerProxy();
+
+    void invalidate();
+    void clearContext() { m_context = 0; }
+
+    void initializeProvider(const WKBatteryProvider*);
+
+    void providerDidChangeBatteryStatus(const WTF::AtomicString&, WebBatteryStatus*);
+    void providerUpdateBatteryStatus(WebBatteryStatus*);
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    explicit WebBatteryManagerProxy(WebContext*);
+
+    virtual Type type() const { return APIType; }
+
+    // Implemented in generated WebBatteryManagerProxyMessageReceiver.cpp
+    void didReceiveWebBatteryManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    void startUpdating();
+    void stopUpdating();
+
+    bool m_isUpdating;
+
+    WebContext* m_context;
+    WebBatteryProvider m_provider;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
+
+#endif // WebBatteryManagerProxy_h
diff --git a/Source/WebKit2/UIProcess/WebBatteryManagerProxy.messages.in b/Source/WebKit2/UIProcess/WebBatteryManagerProxy.messages.in
new file mode 100644
index 000000000..3faefa1e2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebBatteryManagerProxy.messages.in
@@ -0,0 +1,30 @@
+# Copyright (C) 2012 Intel Corporation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(BATTERY_STATUS)
+
+messages -> WebBatteryManagerProxy {
+    StartUpdating();
+    StopUpdating();
+}
+
+#endif
diff --git a/Source/WebKit2/UIProcess/WebBatteryProvider.cpp b/Source/WebKit2/UIProcess/WebBatteryProvider.cpp
new file mode 100644
index 000000000..82841601d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebBatteryProvider.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebBatteryProvider.h"
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "WKAPICast.h"
+#include "WebBatteryManagerProxy.h"
+
+namespace WebKit {
+
+void WebBatteryProvider::startUpdating(WebBatteryManagerProxy* batteryManager)
+{
+    if (!m_client.startUpdating)
+        return;
+
+    m_client.startUpdating(toAPI(batteryManager), m_client.clientInfo);
+}
+
+void WebBatteryProvider::stopUpdating(WebBatteryManagerProxy* batteryManager)
+{
+    if (!m_client.stopUpdating)
+        return;
+
+    m_client.stopUpdating(toAPI(batteryManager), m_client.clientInfo);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit2/UIProcess/WebBatteryProvider.h b/Source/WebKit2/UIProcess/WebBatteryProvider.h
new file mode 100644
index 000000000..f599068c9
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebBatteryProvider.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebBatteryProvider_h
+#define WebBatteryProvider_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "APIClient.h"
+#include "WKBatteryManager.h"
+#include <wtf/Forward.h>
+
+namespace WebKit {
+
+class WebBatteryManagerProxy;
+
+class WebBatteryProvider : public APIClient<WKBatteryProvider, kWKBatteryProviderCurrentVersion> {
+public:
+    void startUpdating(WebBatteryManagerProxy*);
+    void stopUpdating(WebBatteryManagerProxy*);
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
+
+#endif // WebBatteryProvider_h
diff --git a/Source/WebKit2/UIProcess/WebContext.cpp b/Source/WebKit2/UIProcess/WebContext.cpp
index 742aea62c..5c55636d6 100644
--- a/Source/WebKit2/UIProcess/WebContext.cpp
+++ b/Source/WebKit2/UIProcess/WebContext.cpp
@@ -66,6 +66,10 @@
 #include "BuiltInPDFView.h"
 #endif
 
+#if ENABLE(BATTERY_STATUS)
+#include "WebBatteryManagerProxy.h"
+#endif
+
 #if USE(SOUP)
 #include "WebSoupRequestManagerProxy.h"
 #endif
@@ -130,6 +134,9 @@ WebContext::WebContext(ProcessModel processModel, const String& injectedBundlePa
     , m_memorySamplerEnabled(false)
     , m_memorySamplerInterval(1400.0)
     , m_applicationCacheManagerProxy(WebApplicationCacheManagerProxy::create(this))
+#if ENABLE(BATTERY_STATUS)
+    , m_batteryManagerProxy(WebBatteryManagerProxy::create(this))
+#endif
     , m_cookieManagerProxy(WebCookieManagerProxy::create(this))
     , m_databaseManagerProxy(WebDatabaseManagerProxy::create(this))
     , m_geolocationManagerProxy(WebGeolocationManagerProxy::create(this))
@@ -157,7 +164,9 @@ WebContext::WebContext(ProcessModel processModel, const String& injectedBundlePa
 
     addLanguageChangeObserver(this, languageChanged);
 
+#if !LOG_DISABLED
     WebCore::initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
 
 #ifndef NDEBUG
     webContextCounter.increment();
@@ -179,6 +188,11 @@ WebContext::~WebContext()
     m_applicationCacheManagerProxy->invalidate();
     m_applicationCacheManagerProxy->clearContext();
 
+#if ENABLE(BATTERY_STATUS)
+    m_batteryManagerProxy->invalidate();
+    m_batteryManagerProxy->clearContext();
+#endif
+
     m_cookieManagerProxy->invalidate();
     m_cookieManagerProxy->clearContext();
 
@@ -304,7 +318,10 @@ void WebContext::ensureWebProcess()
     // Add any platform specific parameters
     platformInitializeWebProcess(parameters);
 
-    m_process->send(Messages::WebProcess::InitializeWebProcess(parameters, WebContextUserMessageEncoder(m_injectedBundleInitializationUserData.get())), 0);
+    RefPtr<APIObject> injectedBundleInitializationUserData = m_injectedBundleClient.getInjectedBundleInitializationUserData(this);
+    if (!injectedBundleInitializationUserData)
+        injectedBundleInitializationUserData = m_injectedBundleInitializationUserData;
+    m_process->send(Messages::WebProcess::InitializeWebProcess(parameters, WebContextUserMessageEncoder(injectedBundleInitializationUserData.get())), 0);
 
     for (size_t i = 0; i != m_pendingMessagesToPostToInjectedBundle.size(); ++i) {
         pair<String, RefPtr<APIObject> >& message = m_pendingMessagesToPostToInjectedBundle[i];
@@ -393,6 +410,9 @@ void WebContext::disconnectProcess(WebProcessProxy* process)
     m_downloads.clear();
 
     m_applicationCacheManagerProxy->invalidate();
+#if ENABLE(BATTERY_STATUS)
+    m_batteryManagerProxy->invalidate();
+#endif
     m_cookieManagerProxy->invalidate();
     m_databaseManagerProxy->invalidate();
     m_geolocationManagerProxy->invalidate();
@@ -726,6 +746,13 @@ void WebContext::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         return;
     }
 
+#if ENABLE(BATTERY_STATUS)
+    if (messageID.is<CoreIPC::MessageClassWebBatteryManagerProxy>()) {
+        m_batteryManagerProxy->didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+#endif
+
     if (messageID.is<CoreIPC::MessageClassWebCookieManagerProxy>()) {
         m_cookieManagerProxy->didReceiveMessage(connection, messageID, arguments);
         return;
diff --git a/Source/WebKit2/UIProcess/WebContext.h b/Source/WebKit2/UIProcess/WebContext.h
index 9a708c26e..a777dd317 100644
--- a/Source/WebKit2/UIProcess/WebContext.h
+++ b/Source/WebKit2/UIProcess/WebContext.h
@@ -48,6 +48,9 @@ namespace WebKit {
 
 class DownloadProxy;
 class WebApplicationCacheManagerProxy;
+#if ENABLE(BATTERY_STATUS)
+class WebBatteryManagerProxy;
+#endif
 class WebCookieManagerProxy;
 class WebDatabaseManagerProxy;
 class WebGeolocationManagerProxy;
@@ -103,7 +106,6 @@ public:
     DownloadProxy* download(WebPageProxy* initiatingPage, const WebCore::ResourceRequest&);
 
     void setInjectedBundleInitializationUserData(PassRefPtr<APIObject> userData) { m_injectedBundleInitializationUserData = userData; }
-    APIObject* injectedBundleInitializationUserData() const { return m_injectedBundleInitializationUserData.get(); }
 
     void postMessageToInjectedBundle(const String&, APIObject*);
 
@@ -155,6 +157,9 @@ public:
     static HashSet<String, CaseFoldingHash> pdfAndPostScriptMIMETypes();
 
     WebApplicationCacheManagerProxy* applicationCacheManagerProxy() const { return m_applicationCacheManagerProxy.get(); }
+#if ENABLE(BATTERY_STATUS)
+    WebBatteryManagerProxy* batteryManagerProxy() const { return m_batteryManagerProxy.get(); }
+#endif
     WebCookieManagerProxy* cookieManagerProxy() const { return m_cookieManagerProxy.get(); }
     WebDatabaseManagerProxy* databaseManagerProxy() const { return m_databaseManagerProxy.get(); }
     WebGeolocationManagerProxy* geolocationManagerProxy() const { return m_geolocationManagerProxy.get(); }
@@ -300,6 +305,9 @@ private:
     double m_memorySamplerInterval;
 
     RefPtr<WebApplicationCacheManagerProxy> m_applicationCacheManagerProxy;
+#if ENABLE(BATTERY_STATUS)
+    RefPtr<WebBatteryManagerProxy> m_batteryManagerProxy;
+#endif
     RefPtr<WebCookieManagerProxy> m_cookieManagerProxy;
     RefPtr<WebDatabaseManagerProxy> m_databaseManagerProxy;
     RefPtr<WebGeolocationManagerProxy> m_geolocationManagerProxy;
diff --git a/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.cpp b/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.cpp
index 24e62714f..825388b09 100644
--- a/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.cpp
+++ b/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.cpp
@@ -51,4 +51,12 @@ void WebContextInjectedBundleClient::didReceiveSynchronousMessageFromInjectedBun
     returnData = adoptRef(toImpl(returnDataRef));
 }
 
+PassRefPtr<APIObject> WebContextInjectedBundleClient::getInjectedBundleInitializationUserData(WebContext* context)
+{
+    if (!m_client.getInjectedBundleInitializationUserData)
+        return 0;
+
+    return toImpl(m_client.getInjectedBundleInitializationUserData(toAPI(context), m_client.clientInfo));
+}
+
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.h b/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.h
index 2b6ce8d86..d6b274ece 100644
--- a/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.h
+++ b/Source/WebKit2/UIProcess/WebContextInjectedBundleClient.h
@@ -39,6 +39,7 @@ class WebContextInjectedBundleClient : public APIClient<WKContextInjectedBundleC
 public:
     void didReceiveMessageFromInjectedBundle(WebContext*, const String&, APIObject*);
     void didReceiveSynchronousMessageFromInjectedBundle(WebContext*, const String&, APIObject*, RefPtr<APIObject>& returnData);
+    PassRefPtr<APIObject> getInjectedBundleInitializationUserData(WebContext*);
 };
 
 } // namespace WebKit
diff --git a/Source/WebKit2/UIProcess/WebFrameProxy.cpp b/Source/WebKit2/UIProcess/WebFrameProxy.cpp
index f97d85bb6..f60fab040 100644
--- a/Source/WebKit2/UIProcess/WebFrameProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebFrameProxy.cpp
@@ -37,10 +37,6 @@
 #include <stdio.h>
 #include <wtf/text/WTFString.h>
 
-#if ENABLE(WEB_INTENTS)
-#include "WebIntentData.h"
-#endif
-
 using namespace WebCore;
 using namespace std;
 
@@ -98,19 +94,6 @@ void WebFrameProxy::stopLoading() const
 
     m_page->process()->send(Messages::WebPage::StopLoadingFrame(m_frameID), m_page->pageID());
 }
-
-#if ENABLE(WEB_INTENTS)
-void WebFrameProxy::deliverIntent(WebIntentData* webIntentData)
-{
-    if (!m_page)
-        return;
-
-    if (!m_page->isValid())
-        return;
-
-    m_page->process()->send(Messages::WebPage::DeliverIntentToFrame(m_frameID, webIntentData->store()), m_page->pageID());
-}
-#endif
     
 bool WebFrameProxy::canProvideSource() const
 {
diff --git a/Source/WebKit2/UIProcess/WebFrameProxy.h b/Source/WebKit2/UIProcess/WebFrameProxy.h
index 1f7329b39..de5a58cb7 100644
--- a/Source/WebKit2/UIProcess/WebFrameProxy.h
+++ b/Source/WebKit2/UIProcess/WebFrameProxy.h
@@ -50,10 +50,6 @@ class WebFormSubmissionListenerProxy;
 class WebFramePolicyListenerProxy;
 class WebPageProxy;
 
-#if ENABLE(WEB_INTENTS)
-class WebIntentData;
-#endif
-
 typedef GenericCallback<WKDataRef> DataCallback;
 
 class WebFrameProxy : public APIObject {
@@ -90,10 +86,6 @@ public:
     bool isFrameSet() const { return m_isFrameSet; }
 
     LoadState loadState() const { return m_loadState; }
-
-#if ENABLE(WEB_INTENTS)
-    void deliverIntent(WebIntentData*);
-#endif
     
     void stopLoading() const;
 
diff --git a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
index b85e01383..95049a32d 100644
--- a/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
+++ b/Source/WebKit2/UIProcess/WebLayerTreeRenderer.cpp
@@ -414,8 +414,10 @@ void WebLayerTreeRenderer::ensureRootLayer()
 {
     if (m_rootLayer)
         return;
-    if (!m_textureMapper)
+    if (!m_textureMapper) {
         m_textureMapper = TextureMapper::create(TextureMapper::OpenGLMode);
+        static_cast<TextureMapperGL*>(m_textureMapper.get())->setEnableEdgeDistanceAntialiasing(true);
+    }
 
     m_rootLayer = createLayer(InvalidWebLayerID);
     m_rootLayer->setMasksToBounds(false);
diff --git a/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.cpp b/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.cpp
new file mode 100644
index 000000000..4abe2d68d
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebNetworkInfoManagerProxy.h"
+
+#if ENABLE(NETWORK_INFO)
+
+#include "WebContext.h"
+#include "WebNetworkInfo.h"
+#include "WebNetworkInfoManagerMessages.h"
+
+namespace WebKit {
+
+PassRefPtr<WebNetworkInfoManagerProxy> WebNetworkInfoManagerProxy::create(WebContext* context)
+{
+    return adoptRef(new WebNetworkInfoManagerProxy(context));
+}
+
+WebNetworkInfoManagerProxy::WebNetworkInfoManagerProxy(WebContext* context)
+    : m_isUpdating(false)
+    , m_context(context)
+{
+}
+
+WebNetworkInfoManagerProxy::~WebNetworkInfoManagerProxy()
+{
+}
+
+void WebNetworkInfoManagerProxy::invalidate()
+{
+    stopUpdating();
+}
+
+void WebNetworkInfoManagerProxy::initializeProvider(const WKNetworkInfoProvider* provider)
+{
+    m_provider.initialize(provider);
+}
+
+void WebNetworkInfoManagerProxy::providerDidChangeNetworkInformation(const AtomicString& eventType, WebNetworkInfo* networkInformation)
+{
+    if (!m_context)
+        return;
+
+    m_context->sendToAllProcesses(Messages::WebNetworkInfoManager::DidChangeNetworkInformation(eventType, networkInformation->data()));
+}
+
+void WebNetworkInfoManagerProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebNetworkInfoManagerProxyMessage(connection, messageID, arguments);
+}
+
+void WebNetworkInfoManagerProxy::startUpdating()
+{
+    if (m_isUpdating)
+        return;
+
+    m_provider.startUpdating(this);
+    m_isUpdating = true;
+}
+
+void WebNetworkInfoManagerProxy::stopUpdating()
+{
+    if (!m_isUpdating)
+        return;
+
+    m_provider.stopUpdating(this);
+    m_isUpdating = false;
+}
+
+void WebNetworkInfoManagerProxy::getBandwidth(double& bandwidth)
+{
+    bandwidth = m_provider.bandwidth(this);
+}
+
+void WebNetworkInfoManagerProxy::isMetered(bool& isMetered)
+{
+    isMetered = m_provider.isMetered(this);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
diff --git a/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.h b/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.h
new file mode 100644
index 000000000..660cba9b7
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNetworkInfoManagerProxy_h
+#define WebNetworkInfoManagerProxy_h
+
+#if ENABLE(NETWORK_INFO)
+
+#include "APIObject.h"
+#include "MessageID.h"
+#include "WebNetworkInfoProvider.h"
+#include <wtf/Forward.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class ArgumentEncoder;
+class Connection;
+}
+
+namespace WebKit {
+
+class WebContext;
+class WebNetworkInfo;
+
+class WebNetworkInfoManagerProxy : public APIObject {
+public:
+    static const Type APIType = TypeNetworkInfoManager;
+
+    static PassRefPtr<WebNetworkInfoManagerProxy> create(WebContext*);
+    virtual ~WebNetworkInfoManagerProxy();
+
+    void invalidate();
+    void clearContext() { m_context = 0; }
+
+    void initializeProvider(const WKNetworkInfoProvider*);
+
+    void providerDidChangeNetworkInformation(const WTF::AtomicString& eventType, WebNetworkInfo*);
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    explicit WebNetworkInfoManagerProxy(WebContext*);
+
+    virtual Type type() const { return APIType; }
+
+    // Implemented in generated WebNetworkInfoManagerProxyMessageReceiver.cpp
+    void didReceiveWebNetworkInfoManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+    void didReceiveSyncWebNetworkInfoManagerProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*, WTF::OwnPtr<CoreIPC::ArgumentEncoder>&);
+
+    void startUpdating();
+    void stopUpdating();
+
+    void getBandwidth(double&);
+    void isMetered(bool&);
+
+    bool m_isUpdating;
+
+    WebContext* m_context;
+    WebNetworkInfoProvider m_provider;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
+
+#endif // WebNetworkInfoManagerProxy_h
diff --git a/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.messages.in b/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.messages.in
new file mode 100644
index 000000000..b6acdc26b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebNetworkInfoManagerProxy.messages.in
@@ -0,0 +1,33 @@
+# Copyright (C) 2012 Intel Corporation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(NETWORK_INFO)
+
+messages -> WebNetworkInfoManagerProxy {
+    StartUpdating();
+    StopUpdating();
+
+    GetBandwidth() -> (double bandwidth);
+    IsMetered() -> (bool metered);
+}
+
+#endif
diff --git a/Source/WebKit2/UIProcess/WebNetworkInfoProvider.cpp b/Source/WebKit2/UIProcess/WebNetworkInfoProvider.cpp
new file mode 100644
index 000000000..47d0cee62
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebNetworkInfoProvider.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebNetworkInfoProvider.h"
+
+#if ENABLE(NETWORK_INFO)
+
+#include "WKAPICast.h"
+#include "WebNetworkInfoManagerProxy.h"
+#include <limits.h>
+
+namespace WebKit {
+
+void WebNetworkInfoProvider::startUpdating(WebNetworkInfoManagerProxy* networkInfoManager)
+{
+    if (!m_client.startUpdating)
+        return;
+
+    m_client.startUpdating(toAPI(networkInfoManager), m_client.clientInfo);
+}
+
+void WebNetworkInfoProvider::stopUpdating(WebNetworkInfoManagerProxy* networkInfoManager)
+{
+    if (!m_client.stopUpdating)
+        return;
+
+    m_client.stopUpdating(toAPI(networkInfoManager), m_client.clientInfo);
+}
+
+double WebNetworkInfoProvider::bandwidth(WebNetworkInfoManagerProxy* networkInfoManager) const
+{
+    // The spec indicates that we should return "infinity" if the bandwidth is unknown.
+    if (!m_client.bandwidth)
+        return std::numeric_limits<double>::infinity();
+
+    return m_client.bandwidth(toAPI(networkInfoManager), m_client.clientInfo);
+}
+
+bool WebNetworkInfoProvider::isMetered(WebNetworkInfoManagerProxy* networkInfoManager) const
+{
+    if (!m_client.isMetered)
+        return false;
+
+    return m_client.isMetered(toAPI(networkInfoManager), m_client.clientInfo);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
diff --git a/Source/WebKit2/UIProcess/WebNetworkInfoProvider.h b/Source/WebKit2/UIProcess/WebNetworkInfoProvider.h
new file mode 100644
index 000000000..f7205d05b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebNetworkInfoProvider.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNetworkInfoProvider_h
+#define WebNetworkInfoProvider_h
+
+#if ENABLE(NETWORK_INFO)
+
+#include "APIClient.h"
+#include "WKNetworkInfoManager.h"
+#include <wtf/Forward.h>
+
+namespace WebKit {
+
+class WebNetworkInfoManagerProxy;
+
+class WebNetworkInfoProvider : public APIClient<WKNetworkInfoProvider, kWKNetworkInfoProviderCurrentVersion> {
+public:
+    void startUpdating(WebNetworkInfoManagerProxy*);
+    void stopUpdating(WebNetworkInfoManagerProxy*);
+
+    double bandwidth(WebNetworkInfoManagerProxy*) const;
+    bool isMetered(WebNetworkInfoManagerProxy*) const;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
+
+#endif // WebNetworkInfoProvider_h
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.cpp b/Source/WebKit2/UIProcess/WebPageProxy.cpp
index b5046b299..85709ef20 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebPageProxy.cpp
@@ -1135,7 +1135,7 @@ void WebPageProxy::handleKeyboardEvent(const NativeWebKeyboardEvent& event)
     if (m_shouldSendEventsSynchronously) {
         bool handled = false;
         process()->sendSync(Messages::WebPage::KeyEventSyncForTesting(event), Messages::WebPage::KeyEventSyncForTesting::Reply(handled), m_pageID);
-        didReceiveKeyEvent(event.type(), handled);
+        didReceiveEvent(event.type(), handled);
     } else
         process()->send(Messages::WebPage::KeyEvent(event), m_pageID);
 }
@@ -1631,6 +1631,16 @@ void WebPageProxy::getSourceForFrame(WebFrameProxy* frame, PassRefPtr<StringCall
     process()->send(Messages::WebPage::GetSourceForFrame(frame->frameID(), callbackID), m_pageID);
 }
 
+#if ENABLE(WEB_INTENTS)
+void WebPageProxy::deliverIntentToFrame(WebFrameProxy* frame, WebIntentData* webIntentData)
+{
+    if (!isValid())
+        return;
+
+    process()->send(Messages::WebPage::DeliverIntentToFrame(frame->frameID(), webIntentData->store()), m_pageID);
+}
+#endif
+
 void WebPageProxy::getContentsAsString(PassRefPtr<StringCallback> prpCallback)
 {
     RefPtr<StringCallback> callback = prpCallback;
@@ -3149,42 +3159,6 @@ void WebPageProxy::setCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
     m_pageClient->setCursorHiddenUntilMouseMoves(hiddenUntilMouseMoves);
 }
 
-void WebPageProxy::didReceiveKeyEvent(uint32_t opaqueType, bool handled)
-{
-    process()->responsivenessTimer()->stop();
-
-    WebEvent::Type type = static_cast<WebEvent::Type>(opaqueType);
-
-    switch (type) {
-    case WebEvent::KeyDown:
-    case WebEvent::KeyUp:
-    case WebEvent::RawKeyDown:
-    case WebEvent::Char: {
-        LOG(KeyHandling, "WebPageProxy::didReceiveKeyEvent: %s", webKeyboardEventTypeString(type));
-
-        NativeWebKeyboardEvent event = m_keyEventQueue.first();
-        MESSAGE_CHECK(type == event.type());
-
-        m_keyEventQueue.removeFirst();
-
-        m_pageClient->doneWithKeyEvent(event, handled);
-
-        if (handled)
-            break;
-
-        if (m_uiClient.implementsDidNotHandleKeyEvent())
-            m_uiClient.didNotHandleKeyEvent(this, event);
-#if PLATFORM(WIN)
-        else
-            ::TranslateMessage(event.nativeEvent());
-#endif
-        break;
-    }
-    default:
-        ASSERT_NOT_REACHED();
-    }
-}
-
 void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
 {
     WebEvent::Type type = static_cast<WebEvent::Type>(opaqueType);
@@ -3197,6 +3171,10 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
     case WebEvent::MouseDown:
     case WebEvent::MouseUp:
     case WebEvent::Wheel:
+    case WebEvent::KeyDown:
+    case WebEvent::KeyUp:
+    case WebEvent::RawKeyDown:
+    case WebEvent::Char:
 #if ENABLE(GESTURE_EVENTS)
     case WebEvent::GestureScrollBegin:
     case WebEvent::GestureScrollEnd:
@@ -3210,8 +3188,6 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
 #endif
         process()->responsivenessTimer()->stop();
         break;
-    default:
-        ASSERT_NOT_REACHED();
     }
 
     switch (type) {
@@ -3256,6 +3232,30 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
         break;
     }
 
+    case WebEvent::KeyDown:
+    case WebEvent::KeyUp:
+    case WebEvent::RawKeyDown:
+    case WebEvent::Char: {
+        LOG(KeyHandling, "WebPageProxy::didReceiveEvent: %s", webKeyboardEventTypeString(type));
+
+        NativeWebKeyboardEvent event = m_keyEventQueue.first();
+        MESSAGE_CHECK(type == event.type());
+
+        m_keyEventQueue.removeFirst();
+
+        m_pageClient->doneWithKeyEvent(event, handled);
+
+        if (handled)
+            break;
+
+        if (m_uiClient.implementsDidNotHandleKeyEvent())
+            m_uiClient.didNotHandleKeyEvent(this, event);
+#if PLATFORM(WIN)
+        else
+            ::TranslateMessage(event.nativeEvent());
+#endif
+        break;
+    }
 #if ENABLE(TOUCH_EVENTS)
     case WebEvent::TouchStart:
     case WebEvent::TouchMove:
@@ -3273,8 +3273,6 @@ void WebPageProxy::didReceiveEvent(uint32_t opaqueType, bool handled)
         break;
     }
 #endif
-    default:
-        ASSERT_NOT_REACHED();
     }
 }
 
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.h b/Source/WebKit2/UIProcess/WebPageProxy.h
index ed99d0d80..57ab86c24 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.h
+++ b/Source/WebKit2/UIProcess/WebPageProxy.h
@@ -124,6 +124,10 @@ typedef GtkWidget* PlatformWidget;
 typedef Evas_Object* PlatformWidget;
 #endif
 
+#if ENABLE(WEB_INTENTS)
+class WebIntentData;
+#endif
+
 namespace WebKit {
 
 class NativeWebKeyboardEvent;
@@ -530,6 +534,10 @@ public:
     void runJavaScriptInMainFrame(const String&, PassRefPtr<ScriptValueCallback>);
     void forceRepaint(PassRefPtr<VoidCallback>);
 
+#if ENABLE(WEB_INTENTS)
+    void deliverIntentToFrame(WebFrameProxy*, WebIntentData*);
+#endif
+
     float headerHeight(WebFrameProxy*);
     float footerHeight(WebFrameProxy*);
     void drawHeader(WebFrameProxy*, const WebCore::FloatRect&);
@@ -909,7 +917,6 @@ private:
     void setCursorHiddenUntilMouseMoves(bool);
 
     void didReceiveEvent(uint32_t opaqueType, bool handled);
-    void didReceiveKeyEvent(uint32_t opaqueType, bool handled);
     void stopResponsivenessTimer();
 
     void voidCallback(uint64_t);
diff --git a/Source/WebKit2/UIProcess/WebPageProxy.messages.in b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
index a098ea66d..03412766d 100644
--- a/Source/WebKit2/UIProcess/WebPageProxy.messages.in
+++ b/Source/WebKit2/UIProcess/WebPageProxy.messages.in
@@ -33,7 +33,6 @@ messages -> WebPageProxy {
     UnavailablePluginButtonClicked(uint32_t pluginUnavailabilityReason, WTF::String mimeType, WTF::String url, WTF::String pluginsPageURL)
     DidChangeViewportProperties(WebCore::ViewportAttributes attributes)
     DidReceiveEvent(uint32_t type, bool handled)
-    DidReceiveKeyEvent(uint32_t type, bool handled) -> ()
     StopResponsivenessTimer()
     SetCursor(WebCore::Cursor cursor)
     SetCursorHiddenUntilMouseMoves(bool hiddenUntilMouseMoves)
diff --git a/Source/WebKit2/UIProcess/WebProcessProxy.cpp b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
index 455df4d9b..152a72e6f 100644
--- a/Source/WebKit2/UIProcess/WebProcessProxy.cpp
+++ b/Source/WebKit2/UIProcess/WebProcessProxy.cpp
@@ -307,6 +307,9 @@ void WebProcessProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC
         || messageID.is<CoreIPC::MessageClassWebContextLegacy>()
         || messageID.is<CoreIPC::MessageClassDownloadProxy>()
         || messageID.is<CoreIPC::MessageClassWebApplicationCacheManagerProxy>()
+#if ENABLE(BATTERY_STATUS)
+        || messageID.is<CoreIPC::MessageClassWebBatteryManagerProxy>()
+#endif
         || messageID.is<CoreIPC::MessageClassWebCookieManagerProxy>()
         || messageID.is<CoreIPC::MessageClassWebDatabaseManagerProxy>()
         || messageID.is<CoreIPC::MessageClassWebGeolocationManagerProxy>()
diff --git a/Source/WebKit2/UIProcess/WebVibrationProvider.cpp b/Source/WebKit2/UIProcess/WebVibrationProvider.cpp
new file mode 100644
index 000000000..095bd978b
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebVibrationProvider.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebVibrationProvider.h"
+
+#if ENABLE(VIBRATION)
+
+#include "WKAPICast.h"
+#include "WebVibrationProxy.h"
+
+namespace WebKit {
+
+void WebVibrationProvider::vibrate(WebVibrationProxy* vibration, uint64_t vibrationTime)
+{
+    if (!m_client.vibrate)
+        return;
+
+    m_client.vibrate(toAPI(vibration), vibrationTime, m_client.clientInfo);
+}
+
+void WebVibrationProvider::cancelVibration(WebVibrationProxy* vibration)
+{
+    if (!m_client.cancelVibration)
+        return;
+
+    m_client.cancelVibration(toAPI(vibration), m_client.clientInfo);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(VIBRATION)
diff --git a/Source/WebKit2/UIProcess/WebVibrationProvider.h b/Source/WebKit2/UIProcess/WebVibrationProvider.h
new file mode 100644
index 000000000..76d98a8d2
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebVibrationProvider.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebVibrationProvider_h
+#define WebVibrationProvider_h
+
+#if ENABLE(VIBRATION)
+
+#include "APIClient.h"
+#include "WKVibration.h"
+#include <wtf/Forward.h>
+
+namespace WebKit {
+
+class WebVibrationProxy;
+
+class WebVibrationProvider : public APIClient<WKVibrationProvider, kWKVibrationProviderCurrentVersion> {
+public:
+    void vibrate(WebVibrationProxy*, uint64_t vibrationTime);
+    void cancelVibration(WebVibrationProxy*);
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(VIBRATION)
+
+#endif // WebVibrationProvider_h
diff --git a/Source/WebKit2/UIProcess/WebVibrationProxy.cpp b/Source/WebKit2/UIProcess/WebVibrationProxy.cpp
new file mode 100644
index 000000000..9a5f7f264
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebVibrationProxy.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebVibrationProxy.h"
+
+#if ENABLE(VIBRATION)
+
+#include "WebContext.h"
+
+namespace WebKit {
+
+PassRefPtr<WebVibrationProxy> WebVibrationProxy::create(WebContext* context)
+{
+    return adoptRef(new WebVibrationProxy(context));
+}
+
+WebVibrationProxy::WebVibrationProxy(WebContext* context)
+    : m_context(context)
+{
+}
+
+WebVibrationProxy::~WebVibrationProxy()
+{
+}
+
+void WebVibrationProxy::invalidate()
+{
+    cancelVibration();
+}
+
+void WebVibrationProxy::initializeProvider(const WKVibrationProvider* provider)
+{
+    m_provider.initialize(provider);
+}
+
+void WebVibrationProxy::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebVibrationProxyMessage(connection, messageID, arguments);
+}
+
+void WebVibrationProxy::vibrate(uint64_t vibrationTime)
+{
+    m_provider.vibrate(this, vibrationTime);
+}
+
+void WebVibrationProxy::cancelVibration()
+{
+    m_provider.cancelVibration(this);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(VIBRATION)
diff --git a/Source/WebKit2/UIProcess/WebVibrationProxy.h b/Source/WebKit2/UIProcess/WebVibrationProxy.h
new file mode 100644
index 000000000..4e69e96fa
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebVibrationProxy.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebVibrationProxy_h
+#define WebVibrationProxy_h
+
+#if ENABLE(VIBRATION)
+
+#include "APIObject.h"
+#include "MessageID.h"
+#include "WebVibrationProvider.h"
+#include <wtf/Forward.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+}
+
+namespace WebKit {
+
+class WebContext;
+
+class WebVibrationProxy : public APIObject {
+public:
+    static const Type APIType = TypeVibration;
+
+    static PassRefPtr<WebVibrationProxy> create(WebContext*);
+    virtual ~WebVibrationProxy();
+
+    void invalidate();
+    void clearContext() { m_context = 0; }
+
+    void initializeProvider(const WKVibrationProvider*);
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    explicit WebVibrationProxy(WebContext*);
+
+    virtual Type type() const { return APIType; }
+
+    // Implemented in generated WebVibrationProxyMessageReceiver.cpp
+    void didReceiveWebVibrationProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    void vibrate(uint64_t vibrationTime);
+    void cancelVibration();
+
+    WebContext* m_context;
+    WebVibrationProvider m_provider;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(VIBRATION)
+
+#endif // WebVibrationProxy_h
diff --git a/Source/WebKit2/UIProcess/WebVibrationProxy.messages.in b/Source/WebKit2/UIProcess/WebVibrationProxy.messages.in
new file mode 100644
index 000000000..ff40b0d9f
--- /dev/null
+++ b/Source/WebKit2/UIProcess/WebVibrationProxy.messages.in
@@ -0,0 +1,30 @@
+# Copyright (C) 2012 Intel Corporation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(VIBRATION)
+
+messages -> WebVibrationProxy {
+    Vibrate(uint64_t vibrationTime);
+    CancelVibration();
+}
+
+#endif
diff --git a/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp b/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
index b4885220f..cdff34469 100644
--- a/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
+++ b/Source/WebKit2/UIProcess/cf/WebBackForwardListCF.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,6 +44,10 @@ static uint64_t generateWebBackForwardItemID()
     return uniqueHistoryItemID;
 }
 
+static CFIndex currentVersion = 1;
+DEFINE_STATIC_GETTER(CFNumberRef, SessionHistoryCurrentVersion, (CFNumberCreate(0, kCFNumberCFIndexType, &currentVersion)));
+
+DEFINE_STATIC_GETTER(CFStringRef, SessionHistoryVersionKey, (CFSTR("SessionHistoryVersion")));
 DEFINE_STATIC_GETTER(CFStringRef, SessionHistoryCurrentIndexKey, (CFSTR("SessionHistoryCurrentIndex")));
 DEFINE_STATIC_GETTER(CFStringRef, SessionHistoryEntriesKey, (CFSTR("SessionHistoryEntries")));
 DEFINE_STATIC_GETTER(CFStringRef, SessionHistoryEntryTitleKey, (CFSTR("SessionHistoryEntryTitle")));
@@ -51,23 +55,41 @@ DEFINE_STATIC_GETTER(CFStringRef, SessionHistoryEntryURLKey, (CFSTR("SessionHist
 DEFINE_STATIC_GETTER(CFStringRef, SessionHistoryEntryOriginalURLKey, (CFSTR("SessionHistoryEntryOriginalURL")));
 DEFINE_STATIC_GETTER(CFStringRef, SessionHistoryEntryDataKey, (CFSTR("SessionHistoryEntryData")));
 
+static bool extractBackForwardListEntriesFromArray(CFArrayRef, BackForwardListItemVector&);
+
+static CFDictionaryRef createEmptySessionHistoryDictionary()
+{
+    static const void* keys[1] = { SessionHistoryVersionKey() };
+    static const void* values[1] = { SessionHistoryCurrentVersion() };
+
+    return CFDictionaryCreate(0, keys, values, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+}
+
 CFDictionaryRef WebBackForwardList::createCFDictionaryRepresentation(WebPageProxy::WebPageProxySessionStateFilterCallback filter, void* context) const
 {
     ASSERT(!m_hasCurrentIndex || m_currentIndex < m_entries.size());
 
+    if (!m_hasCurrentIndex) {
+        // We represent having no current index by writing out an empty dictionary (besides the version).
+        return createEmptySessionHistoryDictionary();
+    }
+
     RetainPtr<CFMutableArrayRef> entries(AdoptCF, CFArrayCreateMutable(0, m_entries.size(), &kCFTypeArrayCallBacks));
 
     // We may need to update the current index to account for entries that are filtered by the callback.
     CFIndex currentIndex = m_currentIndex;
+    bool hasCurrentIndex = true;
 
     for (size_t i = 0; i < m_entries.size(); ++i) {
         // If we somehow ended up with a null entry then we should consider the data invalid and not save session history at all.
         ASSERT(m_entries[i]);
-        if (!m_entries[i])
+        if (!m_entries[i]) {
+            LOG(SessionState, "WebBackForwardList contained a null entry at index %lu", i);
             return 0;
+        }
 
         if (filter && !filter(toAPI(m_page), WKPageGetSessionHistoryURLValueType(), toURLRef(m_entries[i]->originalURL().impl()), context)) {
-            if (i <= static_cast<size_t>(m_currentIndex))
+            if (i <= m_currentIndex)
                 currentIndex--;
             continue;
         }
@@ -87,26 +109,62 @@ CFDictionaryRef WebBackForwardList::createCFDictionaryRepresentation(WebPageProx
         CFArrayAppendValue(entries.get(), entryDictionary.get());
     }
         
-    // If all items before and including the current item were filtered then currentIndex will be -1.
-    // Assuming we didn't start out with NoCurrentItemIndex, we should store "current" to point at the first item.
-    if (currentIndex == -1 && m_hasCurrentIndex && CFArrayGetCount(entries.get()))
-        currentIndex = 0;
-
-    // FIXME: We're relying on currentIndex == -1 to mean the exact same thing as NoCurrentItemIndex (UINT_MAX) in unsigned form.
-    // That seems implicit and fragile and we should find a better way of representing the NoCurrentItemIndex case.
-    if (!m_hasCurrentIndex || !CFArrayGetCount(entries.get()))
-        currentIndex = -1;
+    ASSERT(currentIndex == -1 || (currentIndex > -1 && currentIndex < CFArrayGetCount(entries.get())));
+    if (currentIndex < -1 || currentIndex >= CFArrayGetCount(entries.get())) {
+        LOG(SessionState, "Filtering entries to be saved resulted in an inconsistent state that we cannot represent");
+        return 0;
+    }
 
-    RetainPtr<CFNumberRef> currentIndexNumber(AdoptCF, CFNumberCreate(0, kCFNumberCFIndexType, &currentIndex));
+    // If we have an index and all items before and including the current item were filtered then currentIndex will be -1.
+    // In this case the new current index should point at the first item.
+    // It's also possible that all items were filtered so we should represent not having a current index.
+    if (currentIndex == -1) {
+        if (CFArrayGetCount(entries.get()))
+            currentIndex = 0;
+        else
+            hasCurrentIndex = false;
+    }
 
-    const void* keys[2] = { SessionHistoryCurrentIndexKey(), SessionHistoryEntriesKey() };
-    const void* values[2] = { currentIndexNumber.get(), entries.get() };
+    if (hasCurrentIndex) {
+        RetainPtr<CFNumberRef> currentIndexNumber(AdoptCF, CFNumberCreate(0, kCFNumberCFIndexType, &currentIndex));
+        const void* keys[3] = { SessionHistoryVersionKey(), SessionHistoryCurrentIndexKey(), SessionHistoryEntriesKey() };
+        const void* values[3] = { SessionHistoryCurrentVersion(), currentIndexNumber.get(), entries.get() };
+ 
+        return CFDictionaryCreate(0, keys, values, 3, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+    }
 
-    return CFDictionaryCreate(0, keys, values, 2, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+    // We represent having no current index by writing out an empty dictionary (besides the version).
+    return createEmptySessionHistoryDictionary();
 }
 
 bool WebBackForwardList::restoreFromCFDictionaryRepresentation(CFDictionaryRef dictionary)
 {
+    CFNumberRef cfVersion = (CFNumberRef)CFDictionaryGetValue(dictionary, SessionHistoryVersionKey());
+    if (!cfVersion) {
+        // v0 session history dictionaries did not contain versioning
+        return restoreFromV0CFDictionaryRepresentation(dictionary);
+    }
+    
+    if (CFGetTypeID(cfVersion) != CFNumberGetTypeID()) {
+        LOG(SessionState, "WebBackForwardList dictionary representation contains a version that is not a number");
+        return false;
+    }
+
+    CFIndex version;
+    if (!CFNumberGetValue(cfVersion, kCFNumberCFIndexType, &version)) {
+        LOG(SessionState, "WebBackForwardList dictionary representation does not have a correctly typed current version");
+        return false;
+    }
+    
+    if (version == 1)
+        return restoreFromV1CFDictionaryRepresentation(dictionary);
+    
+    LOG(SessionState, "WebBackForwardList dictionary representation has an invalid current version (%ld)", version);
+    return false;
+}
+
+bool WebBackForwardList::restoreFromV0CFDictionaryRepresentation(CFDictionaryRef dictionary)
+{
     CFNumberRef cfIndex = (CFNumberRef)CFDictionaryGetValue(dictionary, SessionHistoryCurrentIndexKey());
     if (!cfIndex || CFGetTypeID(cfIndex) != CFNumberGetTypeID()) {
         LOG(SessionState, "WebBackForwardList dictionary representation does not have a valid current index");
@@ -115,12 +173,12 @@ bool WebBackForwardList::restoreFromCFDictionaryRepresentation(CFDictionaryRef d
 
     CFIndex currentCFIndex;
     if (!CFNumberGetValue(cfIndex, kCFNumberCFIndexType, &currentCFIndex)) {
-        LOG(SessionState, "WebBackForwardList dictionary representation does not have a valid integer current index");
+        LOG(SessionState, "WebBackForwardList dictionary representation does not have a correctly typed current index");
         return false;
     }
     
     if (currentCFIndex < -1) {
-        LOG(SessionState, "WebBackForwardList dictionary representation contains a negative current index that is bogus (%ld)", currentCFIndex);
+        LOG(SessionState, "WebBackForwardList dictionary representation contains an unexpected negative current index (%ld)", currentCFIndex);
         return false;
     }
 
@@ -131,23 +189,94 @@ bool WebBackForwardList::restoreFromCFDictionaryRepresentation(CFDictionaryRef d
     }
 
     CFIndex size = CFArrayGetCount(cfEntries);
-    if (currentCFIndex < -1 || currentCFIndex >= size ) {
+    if (size < 0 || currentCFIndex >= size) {
         LOG(SessionState, "WebBackForwardList dictionary representation contains an invalid current index (%ld) for the number of entries (%ld)", currentCFIndex, size);
         return false;
     }
 
-    // FIXME: We're relying on currentIndex == -1 to mean the exact same thing as NoCurrentItemIndex (UINT_MAX) in unsigned form.
-    // That seems implicit and fragile and we should find a better way of representing the NoCurrentItemIndex case.
-    bool hasCurrentIndex = currentCFIndex > -1;
-    unsigned currentIndex = hasCurrentIndex ? static_cast<unsigned>(currentCFIndex) : 0;
+    // Version 0 session history relied on currentIndex == -1 to represent the same thing as not having a current index.
+    bool hasCurrentIndex = currentCFIndex != -1;
 
     if (!hasCurrentIndex && size) {
-        LOG(SessionState, "WebBackForwardList dictionary representation says there is no current item index, but there is a list of %ld entries - this is bogus", size);
+        LOG(SessionState, "WebBackForwardList dictionary representation says there is no current index, but there is a list of %ld entries", size);
         return false;
     }
     
-    BackForwardListItemVector newEntries;
-    newEntries.reserveCapacity(size);
+    BackForwardListItemVector entries;
+    if (!extractBackForwardListEntriesFromArray(cfEntries, entries)) {
+        // extractBackForwardListEntriesFromArray has already logged the appropriate error message.
+        return false;
+    }
+
+    ASSERT(entries.size() == static_cast<unsigned>(size));
+    
+    m_hasCurrentIndex = hasCurrentIndex;
+    m_currentIndex = m_hasCurrentIndex ? static_cast<uint32_t>(currentCFIndex) : 0;
+    m_entries = entries;
+
+    return true;
+}
+
+bool WebBackForwardList::restoreFromV1CFDictionaryRepresentation(CFDictionaryRef dictionary)
+{
+    CFNumberRef cfIndex = (CFNumberRef)CFDictionaryGetValue(dictionary, SessionHistoryCurrentIndexKey());
+    if (!cfIndex) {
+        // No current index means the dictionary represents an empty session.
+        m_hasCurrentIndex = false;
+        m_currentIndex = 0;
+        m_entries.clear();
+
+        return true;
+    }
+
+    if (CFGetTypeID(cfIndex) != CFNumberGetTypeID()) {
+        LOG(SessionState, "WebBackForwardList dictionary representation does not have a valid current index");
+        return false;
+    }
+
+    CFIndex currentCFIndex;
+    if (!CFNumberGetValue(cfIndex, kCFNumberCFIndexType, &currentCFIndex)) {
+        LOG(SessionState, "WebBackForwardList dictionary representation does not have a correctly typed current index");
+        return false;
+    }
+    
+    if (currentCFIndex < 0) {
+        LOG(SessionState, "WebBackForwardList dictionary representation contains an unexpected negative current index (%ld)", currentCFIndex);
+        return false;
+    }
+
+    CFArrayRef cfEntries = (CFArrayRef)CFDictionaryGetValue(dictionary, SessionHistoryEntriesKey());
+    if (!cfEntries || CFGetTypeID(cfEntries) != CFArrayGetTypeID()) {
+        LOG(SessionState, "WebBackForwardList dictionary representation does not have a valid list of entries");
+        return false;
+    }
+
+    CFIndex size = CFArrayGetCount(cfEntries);
+    if (currentCFIndex >= size) {
+        LOG(SessionState, "WebBackForwardList dictionary representation contains an invalid current index (%ld) for the number of entries (%ld)", currentCFIndex, size);
+        return false;
+    }
+    
+    BackForwardListItemVector entries;
+    if (!extractBackForwardListEntriesFromArray(cfEntries, entries)) {
+        // extractBackForwardListEntriesFromArray has already logged the appropriate error message.
+        return false;
+    }
+    
+    ASSERT(entries.size() == static_cast<unsigned>(size));
+    
+    m_hasCurrentIndex = true;
+    m_currentIndex = static_cast<uint32_t>(currentCFIndex);
+    m_entries = entries;
+
+    return true;
+}
+
+static bool extractBackForwardListEntriesFromArray(CFArrayRef cfEntries, BackForwardListItemVector& entries)
+{
+    CFIndex size = CFArrayGetCount(cfEntries);
+
+    entries.reserveCapacity(size);
     for (CFIndex i = 0; i < size; ++i) {
         CFDictionaryRef entryDictionary = (CFDictionaryRef)CFArrayGetValueAtIndex(cfEntries, i);
         if (!entryDictionary || CFGetTypeID(entryDictionary) != CFDictionaryGetTypeID()) {
@@ -179,12 +308,8 @@ bool WebBackForwardList::restoreFromCFDictionaryRepresentation(CFDictionaryRef d
             return false;
         }
         
-        newEntries.append(WebBackForwardListItem::create(originalURL, entryURL, entryTitle, CFDataGetBytePtr(backForwardData), CFDataGetLength(backForwardData), generateWebBackForwardItemID()));
+        entries.append(WebBackForwardListItem::create(originalURL, entryURL, entryTitle, CFDataGetBytePtr(backForwardData), CFDataGetLength(backForwardData), generateWebBackForwardItemID()));
     }
-    
-    m_entries = newEntries;
-    m_hasCurrentIndex = hasCurrentIndex;
-    m_currentIndex = currentIndex;
 
     return true;
 }
diff --git a/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.h b/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.h
index 8e187166e..144655f4d 100644
--- a/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.h
+++ b/Source/WebKit2/UIProcess/gtk/WebContextMenuProxyGtk.h
@@ -49,6 +49,7 @@ public:
     virtual void hideContextMenu();
 
     void populate(Vector<WebCore::ContextMenuItem>&);
+    GtkMenu* gtkMenu() const { return m_menu.platformDescription(); }
 
 private:
     WebContextMenuProxyGtk(GtkWidget*, WebPageProxy*);
diff --git a/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp b/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp
index 425d799ac..fac19dc8f 100644
--- a/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp
+++ b/Source/WebKit2/UIProcess/gtk/WebInspectorProxyGtk.cpp
@@ -195,8 +195,11 @@ void WebInspectorProxy::platformDetach()
         return;
 
     GRefPtr<GtkWidget> inspectorView = m_inspectorView;
-    if (!m_client.detach(this))
-        gtk_container_remove(GTK_CONTAINER(m_page->viewWidget()), m_inspectorView);
+    if (!m_client.detach(this)) {
+        GtkWidget* parent = gtk_widget_get_parent(m_inspectorView);
+        ASSERT(parent);
+        gtk_container_remove(GTK_CONTAINER(parent), m_inspectorView);
+    }
 
     if (!m_isVisible)
         return;
diff --git a/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm b/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
index b76978107..29033e421 100644
--- a/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
+++ b/Source/WebKit2/UIProcess/mac/WebPopupMenuProxyMac.mm
@@ -87,6 +87,9 @@ void WebPopupMenuProxyMac::populate(const Vector<WebPopupItem>& items, NSFont *f
             RetainPtr<NSAttributedString> string(AdoptNS, [[NSAttributedString alloc] initWithString:nsStringFromWebCoreString(items[i].m_text) attributes:attributes.get()]);
 
             [menuItem setAttributedTitle:string.get()];
+            // We set the title as well as the attributed title here. The attributed title will be displayed in the menu,
+            // but typeahead will use the non-attributed string that doesn't contain any leading or trailing whitespace.
+            [menuItem setTitle:[[string.get() string] stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]]];
             [menuItem setEnabled:items[i].m_isEnabled];
             [menuItem setToolTip:nsStringFromWebCoreString(items[i].m_toolTip)];
         }
diff --git a/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp b/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
index 3ff4f273a..3d4c4e6d6 100644
--- a/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtDialogRunner.cpp
@@ -223,6 +223,12 @@ public slots:
     void accept(const QVariant& path)
     {
         QStringList filesPath = path.toStringList();
+
+        if (filesPath.isEmpty()) {
+            emit rejected();
+            return;
+        }
+
         // For single file upload, send only the first element if there are more than one file paths
         if (!m_allowMultiple && filesPath.count() > 1)
             filesPath = QStringList(filesPath.at(0));
diff --git a/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp b/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp
index 548819e13..a1f56d189 100644
--- a/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp
+++ b/Source/WebKit2/UIProcess/qt/QtViewportHandler.cpp
@@ -238,6 +238,9 @@ void QtViewportHandler::viewportAttributesChanged(const WebCore::ViewportAttribu
 
 void QtViewportHandler::pageContentsSizeChanged(const QSize& newSize, const QSize& viewportSize)
 {
+    if (viewportSize.isEmpty())
+        return;
+
     float minimumScale = WebCore::computeMinimumScaleFactorForContentContained(m_rawAttributes, viewportSize, newSize);
 
     if (!qFuzzyCompare(minimumScale, m_rawAttributes.minimumScale)) {
diff --git a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.cpp b/Source/WebKit2/UIProcess/texmap/LayerBackingStore.cpp
index caaffe9e5..967f07513 100644
--- a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.cpp
+++ b/Source/WebKit2/UIProcess/texmap/LayerBackingStore.cpp
@@ -80,6 +80,7 @@ void LayerBackingStore::updateTile(int id, const IntRect& sourceRect, const IntR
 {
     HashMap<int, LayerBackingStoreTile>::iterator it = m_tiles.find(id);
     ASSERT(it != m_tiles.end());
+    it->second.incrementRepaintCount();
     it->second.setBackBuffer(targetRect, sourceRect, backBuffer, offset);
 }
 
@@ -95,6 +96,14 @@ PassRefPtr<BitmapTexture> LayerBackingStore::texture() const
     return PassRefPtr<BitmapTexture>();
 }
 
+static bool shouldShowTileDebugVisuals()
+{
+#if PLATFORM(QT)
+    return (qgetenv("QT_WEBKIT_SHOW_COMPOSITING_DEBUG_VISUALS") == "1");
+#endif
+    return false;
+}
+
 void LayerBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& transform, float opacity, BitmapTexture* mask)
 {
     Vector<TextureMapperTile*> tilesToPaint;
@@ -121,8 +130,20 @@ void LayerBackingStore::paintToTextureMapper(TextureMapper* textureMapper, const
         tilesToPaint.prepend(&tile);
     }
 
-    for (size_t i = 0; i < tilesToPaint.size(); ++i)
-        tilesToPaint[i]->paint(textureMapper, transform, opacity, mask);
+    // TODO: When the TextureMapper makes a distinction between some edges exposed and no edges
+    // exposed, the value passed should be an accurate reflection of the tile subset that we are
+    // passing. For now we just "estimate" since LayerBackingStore doesn't keep information about
+    // the total tiled surface rect at the moment.
+    unsigned edgesExposed = m_tiles.size() > 1 ? TextureMapper::NoEdges : TextureMapper::AllEdges;
+    for (size_t i = 0; i < tilesToPaint.size(); ++i) {
+        TextureMapperTile* tile = tilesToPaint[i];
+        tile->paint(textureMapper, transform, opacity, mask, edgesExposed);
+        static bool shouldDebug = shouldShowTileDebugVisuals();
+        if (!shouldDebug)
+            continue;
+        textureMapper->drawBorder(QColor(Qt::red), 2, tile->rect(), transform);
+        textureMapper->drawRepaintCounter(static_cast<LayerBackingStoreTile*>(tile)->repaintCount(), 8, tilesToPaint[i]->rect().location(), transform);
+    }
 }
 
 void LayerBackingStore::commitTileOperations(TextureMapper* textureMapper)
diff --git a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.h b/Source/WebKit2/UIProcess/texmap/LayerBackingStore.h
index a3e219b04..6a4f513a0 100644
--- a/Source/WebKit2/UIProcess/texmap/LayerBackingStore.h
+++ b/Source/WebKit2/UIProcess/texmap/LayerBackingStore.h
@@ -35,10 +35,13 @@ public:
     LayerBackingStoreTile(float scale = 1)
         : TextureMapperTile(WebCore::FloatRect())
         , m_scale(scale)
+        , m_repaintCount(0)
     {
     }
 
     inline float scale() const { return m_scale; }
+    inline void incrementRepaintCount() { ++m_repaintCount; }
+    inline int repaintCount() const { return m_repaintCount; }
     void swapBuffers(WebCore::TextureMapper*);
     void setBackBuffer(const WebCore::IntRect&, const WebCore::IntRect&, PassRefPtr<ShareableSurface> buffer, const WebCore::IntPoint&);
 
@@ -48,6 +51,7 @@ private:
     WebCore::IntRect m_targetRect;
     WebCore::IntPoint m_surfaceOffset;
     float m_scale;
+    int m_repaintCount;
 };
 
 class LayerBackingStore : public WebCore::TextureMapperBackingStore {
diff --git a/Source/WebKit2/WebKit2.pri b/Source/WebKit2/WebKit2.pri
index 75734521b..17d5493b0 100644
--- a/Source/WebKit2/WebKit2.pri
+++ b/Source/WebKit2/WebKit2.pri
@@ -37,6 +37,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/WebProcess \
     $$SOURCE_DIR/WebProcess/ApplicationCache \
     $$SOURCE_DIR/WebProcess/Authentication \
+    $$SOURCE_DIR/WebProcess/Battery \
     $$SOURCE_DIR/WebProcess/Cookies \
     $$SOURCE_DIR/WebProcess/Cookies/qt \
     $$SOURCE_DIR/WebProcess/Downloads \
@@ -49,6 +50,7 @@ INCLUDEPATH += \
     $$SOURCE_DIR/WebProcess/InjectedBundle/API/c \
     $$SOURCE_DIR/WebProcess/KeyValueStorage \
     $$SOURCE_DIR/WebProcess/MediaCache \
+    $$SOURCE_DIR/WebProcess/NetworkInfo \
     $$SOURCE_DIR/WebProcess/Notifications \
     $$SOURCE_DIR/WebProcess/Plugins \
     $$SOURCE_DIR/WebProcess/Plugins/Netscape \
diff --git a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
new file mode 100644
index 000000000..04dec8640
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebBatteryManager.h"
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "WebBatteryManagerProxyMessages.h"
+#include "WebPage.h"
+#include "WebProcess.h"
+#include <WebCore/BatteryController.h>
+#include <WebCore/BatteryStatus.h>
+#include <WebCore/Page.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebBatteryManager::WebBatteryManager(WebProcess* process)
+    : m_process(process)
+{
+}
+
+WebBatteryManager::~WebBatteryManager()
+{
+}
+
+void WebBatteryManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebBatteryManagerMessage(connection, messageID, arguments);
+}
+
+void WebBatteryManager::registerWebPage(WebPage* page)
+{
+    bool wasEmpty = m_pageSet.isEmpty();
+
+    m_pageSet.add(page);
+
+    if (wasEmpty)
+        m_process->connection()->send(Messages::WebBatteryManagerProxy::StartUpdating(), 0);
+}
+
+void WebBatteryManager::unregisterWebPage(WebPage* page)
+{
+    m_pageSet.remove(page);
+
+    if (m_pageSet.isEmpty())
+        m_process->connection()->send(Messages::WebBatteryManagerProxy::StopUpdating(), 0);
+}
+
+void WebBatteryManager::didChangeBatteryStatus(const WTF::AtomicString& eventType, const WebBatteryStatus::Data& data)
+{
+    RefPtr<BatteryStatus> status = BatteryStatus::create(data.isCharging, data.chargingTime, data.dischargingTime, data.level);
+
+    HashSet<WebPage*>::const_iterator it = m_pageSet.begin();
+    HashSet<WebPage*>::const_iterator end = m_pageSet.end();
+    for (; it != end; ++it) {
+        WebPage* page = *it;
+        if (page->corePage())
+            BatteryController::from(page->corePage())->didChangeBatteryStatus(eventType, status.get());
+    }
+}
+
+void WebBatteryManager::updateBatteryStatus(const WebBatteryStatus::Data& data)
+{
+    RefPtr<BatteryStatus> status = BatteryStatus::create(data.isCharging, data.chargingTime, data.dischargingTime, data.level);
+
+    HashSet<WebPage*>::const_iterator it = m_pageSet.begin();
+    HashSet<WebPage*>::const_iterator end = m_pageSet.end();
+    for (; it != end; ++it) {
+        WebPage* page = *it;
+        if (page->corePage())
+            BatteryController::from(page->corePage())->updateBatteryStatus(status.get());
+    }
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
new file mode 100644
index 000000000..509718d42
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebBatteryManager_h
+#define WebBatteryManager_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "MessageID.h"
+#include "WebBatteryStatus.h"
+#include "WebCoreArgumentCoders.h"
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/text/AtomicString.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+}
+
+namespace WebKit {
+
+class WebPage;
+class WebProcess;
+
+class WebBatteryManager {
+    WTF_MAKE_NONCOPYABLE(WebBatteryManager);
+
+public:
+    explicit WebBatteryManager(WebProcess*);
+    ~WebBatteryManager();
+
+    void registerWebPage(WebPage*);
+    void unregisterWebPage(WebPage*);
+
+    void didChangeBatteryStatus(const WTF::AtomicString& eventType, const WebBatteryStatus::Data&);
+    void updateBatteryStatus(const WebBatteryStatus::Data&);
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    // Implemented in generated WebBatteryManagerMessageReceiver.cpp
+    void didReceiveWebBatteryManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    WebProcess* m_process;
+    HashSet<WebPage*> m_pageSet;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
+
+#endif // WebBatteryManager_h
diff --git a/Source/WebKit2/WebProcess/Battery/WebBatteryManager.messages.in b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.messages.in
new file mode 100644
index 000000000..37e73ef66
--- /dev/null
+++ b/Source/WebKit2/WebProcess/Battery/WebBatteryManager.messages.in
@@ -0,0 +1,30 @@
+# Copyright (C) 2012 Intel Corporation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(BATTERY_STATUS)
+
+messages -> WebBatteryManager {
+    DidChangeBatteryStatus(AtomicString eventType, WebKit::WebBatteryStatus::Data status);
+    UpdateBatteryStatus(WebKit::WebBatteryStatus::Data status);
+}
+
+#endif
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
index c7fe682a6..07841d7cc 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePage.cpp
@@ -367,11 +367,6 @@ WKArrayRef WKBundlePageCopyTrackedRepaintRects(WKBundlePageRef pageRef)
     return toAPI(toImpl(pageRef)->trackedRepaintRects().leakRef());
 }
 
-WKStringRef WKBundlePageViewportConfigurationAsText(WKBundlePageRef pageRef, int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    return toCopiedAPI(toImpl(pageRef)->viewportConfigurationAsText(deviceDPI, deviceWidth, deviceHeight, availableWidth, availableHeight));
-}
-
 void WKBundlePageSetComposition(WKBundlePageRef pageRef, WKStringRef text, int from, int length)
 {
     toImpl(pageRef)->setCompositionForTesting(toImpl(text)->string(), from, length);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
index 6baf7860e..b7c82b811 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
+++ b/Source/WebKit2/WebProcess/InjectedBundle/API/c/WKBundlePagePrivate.h
@@ -66,8 +66,6 @@ WK_EXPORT bool WKBundlePageIsTrackingRepaints(WKBundlePageRef page);
 WK_EXPORT void WKBundlePageResetTrackedRepaints(WKBundlePageRef page);
 WK_EXPORT WKArrayRef WKBundlePageCopyTrackedRepaintRects(WKBundlePageRef page);
 
-WK_EXPORT WKStringRef WKBundlePageViewportConfigurationAsText(WKBundlePageRef, int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight);
-
 WK_EXPORT void WKBundlePageSetComposition(WKBundlePageRef page, WKStringRef text, int from, int length);
 WK_EXPORT bool WKBundlePageHasComposition(WKBundlePageRef page);
 WK_EXPORT void WKBundlePageConfirmComposition(WKBundlePageRef page);
diff --git a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
index c6e9a60b5..076d3b6c8 100644
--- a/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
+++ b/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp
@@ -156,10 +156,6 @@ void InjectedBundle::overrideBoolPreferenceForTestRunner(WebPageGroupProxy* page
 
     FOR_EACH_OVERRIDE_BOOL_PREFERENCE(OVERRIDE_PREFERENCE_AND_SET_IN_EXISTING_PAGES)
 
-#if ENABLE(WEB_SOCKETS)
-    OVERRIDE_PREFERENCE_AND_SET_IN_EXISTING_PAGES(WebKitHixie76WebSocketProtocolEnabled, UseHixie76WebSocketProtocol, hixie76WebSocketProtocolEnabled)
-#endif
-
 #undef OVERRIDE_PREFERENCE_AND_SET_IN_EXISTING_PAGES
 #undef FOR_EACH_OVERRIDE_BOOL_PREFERENCE
 }
@@ -409,7 +405,7 @@ void InjectedBundle::garbageCollectJavaScriptObjectsOnAlternateThreadForDebuggin
 
 size_t InjectedBundle::javaScriptObjectsCount()
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     return JSDOMWindow::commonJSGlobalData()->heap.objectCount();
 }
 
@@ -418,8 +414,8 @@ void InjectedBundle::reportException(JSContextRef context, JSValueRef exception)
     if (!context || !exception)
         return;
 
-    JSLock lock(JSC::SilenceAssertionsOnly);
     JSC::ExecState* execState = toJS(context);
+    JSLockHolder lock(execState);
 
     // Make sure the context has a DOMWindow global object, otherwise this context didn't originate from a Page.
     if (!toJSDOMWindow(execState->lexicalGlobalObject()))
diff --git a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
new file mode 100644
index 000000000..8c10371fd
--- /dev/null
+++ b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebNetworkInfoManager.h"
+
+#if ENABLE(NETWORK_INFO)
+
+#include "WebNetworkInfoManagerProxyMessages.h"
+#include "WebPage.h"
+#include "WebProcess.h"
+#include <WebCore/NetworkInfo.h>
+#include <WebCore/NetworkInfoController.h>
+#include <limits.h>
+
+using namespace WebCore;
+
+namespace WebKit {
+
+WebNetworkInfoManager::WebNetworkInfoManager(WebProcess* process)
+    : m_process(process)
+{
+}
+
+WebNetworkInfoManager::~WebNetworkInfoManager()
+{
+}
+
+void WebNetworkInfoManager::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::MessageID messageID, CoreIPC::ArgumentDecoder* arguments)
+{
+    didReceiveWebNetworkInfoManagerMessage(connection, messageID, arguments);
+}
+
+void WebNetworkInfoManager::registerWebPage(WebPage* page)
+{
+    bool wasEmpty = m_pageSet.isEmpty();
+
+    m_pageSet.add(page);
+
+    if (wasEmpty)
+        m_process->connection()->send(Messages::WebNetworkInfoManagerProxy::StartUpdating(), 0);
+}
+
+void WebNetworkInfoManager::unregisterWebPage(WebPage* page)
+{
+    m_pageSet.remove(page);
+
+    if (m_pageSet.isEmpty())
+        m_process->connection()->send(Messages::WebNetworkInfoManagerProxy::StopUpdating(), 0);
+}
+
+double WebNetworkInfoManager::bandwidth(WebPage* page) const
+{
+    // The spec indicates that we should return "infinity" if the bandwidth is unknown.
+    double bandwidth = std::numeric_limits<double>::infinity();
+    m_process->connection()->sendSync(Messages::WebNetworkInfoManagerProxy::GetBandwidth(), Messages::WebNetworkInfoManagerProxy::GetBandwidth::Reply(bandwidth), page->pageID());
+    return bandwidth;
+}
+
+bool WebNetworkInfoManager::metered(WebPage* page) const
+{
+    bool metered = false;
+    m_process->connection()->sendSync(Messages::WebNetworkInfoManagerProxy::IsMetered(), Messages::WebNetworkInfoManagerProxy::IsMetered::Reply(metered), page->pageID());
+    return metered;
+}
+
+void WebNetworkInfoManager::didChangeNetworkInformation(const AtomicString& eventType, const WebNetworkInfo::Data& data)
+{
+    RefPtr<NetworkInfo> networkInformation = NetworkInfo::create(data.bandwidth, data.metered);
+
+    HashSet<WebPage*>::const_iterator it = m_pageSet.begin();
+    HashSet<WebPage*>::const_iterator end = m_pageSet.end();
+    for (; it != end; ++it) {
+        WebPage* page = *it;
+        if (page->corePage())
+            NetworkInfoController::from(page->corePage())->didChangeNetworkInformation(eventType, networkInformation.get());
+    }
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
diff --git a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
new file mode 100644
index 000000000..d3dab844c
--- /dev/null
+++ b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNetworkInfoManager_h
+#define WebNetworkInfoManager_h
+
+#if ENABLE(NETWORK_INFO)
+
+#include "MessageID.h"
+#include "WebCoreArgumentCoders.h"
+#include "WebNetworkInfo.h"
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/text/AtomicString.h>
+
+namespace CoreIPC {
+class ArgumentDecoder;
+class Connection;
+}
+
+namespace WebKit {
+
+class WebProcess;
+class WebPage;
+
+class WebNetworkInfoManager {
+    WTF_MAKE_NONCOPYABLE(WebNetworkInfoManager);
+public:
+    explicit WebNetworkInfoManager(WebProcess*);
+    ~WebNetworkInfoManager();
+
+    void registerWebPage(WebPage*);
+    void unregisterWebPage(WebPage*);
+
+    double bandwidth(WebPage*) const;
+    bool metered(WebPage*) const;
+
+    void didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+private:
+    // Implemented in generated WebNetworkInfoManagerMessageReceiver.cpp
+    void didReceiveWebNetworkInfoManagerMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*);
+
+    void didChangeNetworkInformation(const AtomicString& eventType, const WebNetworkInfo::Data&);
+
+    WebProcess* m_process;
+    HashSet<WebPage*> m_pageSet;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
+
+#endif // WebNetworkInfoManager_h
diff --git a/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.messages.in b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.messages.in
new file mode 100644
index 000000000..acc840c44
--- /dev/null
+++ b/Source/WebKit2/WebProcess/NetworkInfo/WebNetworkInfoManager.messages.in
@@ -0,0 +1,29 @@
+# Copyright (C) 2012 Intel Corporation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#if ENABLE(NETWORK_INFO)
+
+messages -> WebNetworkInfoManager {
+    DidChangeNetworkInformation(AtomicString eventType, WebKit::WebNetworkInfo::Data networkInformation);
+}
+
+#endif
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
index dc597c63c..54fec0c1a 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp
@@ -37,6 +37,7 @@
 #include <JavaScriptCore/JSLock.h>
 #include <JavaScriptCore/ObjectPrototype.h>
 #include <WebCore/IdentifierRep.h>
+#include <WebCore/JSDOMWindowBase.h>
 #include <wtf/Assertions.h>
 #include <wtf/text/WTFString.h>
 
@@ -125,7 +126,7 @@ JSValue JSNPObject::callMethod(ExecState* exec, NPIdentifier methodName)
     VOID_TO_NPVARIANT(result);
     
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         returnValue = m_npObject->_class->invoke(m_npObject, methodName, arguments.data(), argumentCount, &result);
         NPRuntimeObjectMap::moveGlobalExceptionToExecState(exec);
     }
@@ -165,7 +166,7 @@ JSC::JSValue JSNPObject::callObject(JSC::ExecState* exec)
     VOID_TO_NPVARIANT(result);
 
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         returnValue = m_npObject->_class->invokeDefault(m_npObject, arguments.data(), argumentCount, &result);
         NPRuntimeObjectMap::moveGlobalExceptionToExecState(exec);
     }
@@ -205,7 +206,7 @@ JSValue JSNPObject::callConstructor(ExecState* exec)
     VOID_TO_NPVARIANT(result);
     
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         returnValue = m_npObject->_class->construct(m_npObject, arguments.data(), argumentCount, &result);
         NPRuntimeObjectMap::moveGlobalExceptionToExecState(exec);
     }
@@ -340,7 +341,7 @@ void JSNPObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, J
     NPRuntimeObjectMap::PluginProtector protector(thisObject->m_objectMap);
 
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         thisObject->m_npObject->_class->setProperty(thisObject->m_npObject, npIdentifier, &variant);
 
         NPRuntimeObjectMap::moveGlobalExceptionToExecState(exec);
@@ -380,7 +381,7 @@ bool JSNPObject::deleteProperty(ExecState* exec, NPIdentifier propertyName)
     NPRuntimeObjectMap::PluginProtector protector(m_objectMap);
 
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 
         // FIXME: Should we throw an exception if removeProperty returns false?
         if (!m_npObject->_class->removeProperty(m_npObject, propertyName))
@@ -413,7 +414,7 @@ void JSNPObject::getOwnPropertyNames(JSObject* object, ExecState* exec, Property
     NPRuntimeObjectMap::PluginProtector protector(thisObject->m_objectMap);
     
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
 
         // FIXME: Should we throw an exception if enumerate returns false?
         if (!thisObject->m_npObject->_class->enumerate(thisObject->m_npObject, &identifiers, &identifierCount))
@@ -461,7 +462,7 @@ JSValue JSNPObject::propertyGetter(ExecState* exec, JSValue slotBase, PropertyNa
     
     bool returnValue;
     {
-        JSLock::DropAllLocks dropAllLocks(SilenceAssertionsOnly);
+        JSLock::DropAllLocks dropAllLocks(JSDOMWindowBase::commonJSGlobalData());
         NPIdentifier npIdentifier = npIdentifierFromIdentifier(propertyName);
         returnValue = thisObj->m_npObject->_class->getProperty(thisObj->m_npObject, npIdentifier, &result);
         
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
index 4cea7e5fa..1fadc177f 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp
@@ -99,7 +99,7 @@ bool NPJSObject::hasMethod(NPIdentifier methodName)
     if (!exec)
         return false;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     JSValue value = m_jsObject->get(exec, identifierFromIdentifierRep(exec, identifierRep));    
     exec->clearException();
@@ -119,7 +119,7 @@ bool NPJSObject::invoke(NPIdentifier methodName, const NPVariant* arguments, uin
     if (!exec)
         return false;
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     JSValue function = m_jsObject->get(exec, identifierFromIdentifierRep(exec, identifierRep));
     return invoke(exec, m_objectMap->globalObject(), function, arguments, argumentCount, result);
@@ -131,7 +131,7 @@ bool NPJSObject::invokeDefault(const NPVariant* arguments, uint32_t argumentCoun
     if (!exec)
         return false;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     JSValue function = m_jsObject.get();
     return invoke(exec, m_objectMap->globalObject(), function, arguments, argumentCount, result);
@@ -145,7 +145,7 @@ bool NPJSObject::hasProperty(NPIdentifier identifier)
     if (!exec)
         return false;
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     bool result;
     if (identifierRep->isString())
@@ -165,7 +165,7 @@ bool NPJSObject::getProperty(NPIdentifier propertyName, NPVariant* result)
     if (!exec)
         return false;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue jsResult;
     if (identifierRep->isString())
         jsResult = m_jsObject->get(exec, identifierFromIdentifierRep(exec, identifierRep));
@@ -185,7 +185,7 @@ bool NPJSObject::setProperty(NPIdentifier propertyName, const NPVariant* value)
     if (!exec)
         return false;
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     JSValue jsValue = m_objectMap->convertNPVariantToJSValue(exec, m_objectMap->globalObject(), *value);
     if (identifierRep->isString()) {
@@ -206,7 +206,7 @@ bool NPJSObject::removeProperty(NPIdentifier propertyName)
     if (!exec)
         return false;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     if (identifierRep->isString()) {
         Identifier identifier = identifierFromIdentifierRep(exec, identifierRep);
         
@@ -235,7 +235,7 @@ bool NPJSObject::enumerate(NPIdentifier** identifiers, uint32_t* identifierCount
     if (!exec)
         return false;
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     PropertyNameArray propertyNames(exec);
     m_jsObject->methodTable()->getPropertyNames(m_jsObject.get(), exec, propertyNames, ExcludeDontEnumProperties);
@@ -257,7 +257,7 @@ bool NPJSObject::construct(const NPVariant* arguments, uint32_t argumentCount, N
     if (!exec)
         return false;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     ConstructData constructData;
     ConstructType constructType = getConstructData(m_jsObject.get(), constructData);
diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
index 8f037aeab..2b115f1e4 100644
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
@@ -139,7 +139,7 @@ JSValue NPRuntimeObjectMap::convertNPVariantToJSValue(JSC::ExecState* exec, JSC:
 
 void NPRuntimeObjectMap::convertJSValueToNPVariant(ExecState* exec, JSValue value, NPVariant& variant)
 {
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
 
     VOID_TO_NPVARIANT(variant);
     
@@ -186,7 +186,7 @@ bool NPRuntimeObjectMap::evaluate(NPObject* npObject, const String&scriptString,
 
     ExecState* exec = globalObject->globalExec();
     
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     JSValue thisValue = getOrCreateJSObject(globalObject.get(), npObject);
 
     globalObject->globalData().timeoutChecker.start();
@@ -266,7 +266,7 @@ void NPRuntimeObjectMap::moveGlobalExceptionToExecState(ExecState* exec)
         return;
 
     {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(exec);
         throwError(exec, createError(exec, stringToUString(globalExceptionString())));
     }
     
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.cpp
new file mode 100644
index 000000000..8ed4dde03
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebBatteryClient.h"
+
+#if ENABLE(BATTERY_STATUS)
+
+#include "WebBatteryManager.h"
+#include "WebPage.h"
+#include "WebProcess.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebBatteryClient::setController(WebCore::BatteryController*)
+{
+    // We provide an empty implementation for this method so that
+    // it compiles. We don't need it since WebBatteryManager
+    // retrieves the controller directly from the page by calling
+    // BatteryController::from().
+}
+
+void WebBatteryClient::startUpdating()
+{
+    WebProcess::shared().batteryManager().registerWebPage(m_page);
+}
+
+void WebBatteryClient::stopUpdating()
+{
+    WebProcess::shared().batteryManager().unregisterWebPage(m_page);
+}
+
+void WebBatteryClient::batteryControllerDestroyed()
+{
+    WebProcess::shared().batteryManager().unregisterWebPage(m_page);
+    delete this;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.h
new file mode 100644
index 000000000..0e5c70ed4
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebBatteryClient.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebBatteryClient_h
+#define WebBatteryClient_h
+
+#if ENABLE(BATTERY_STATUS)
+
+#include <WebCore/BatteryClient.h>
+
+namespace WebKit {
+
+class WebPage;
+
+class WebBatteryClient : public WebCore::BatteryClient {
+public:
+    WebBatteryClient(WebPage* page)
+        : m_page(page)
+    {
+    }
+
+    virtual ~WebBatteryClient() { }
+
+private:
+    virtual void setController(WebCore::BatteryController*) OVERRIDE;
+    virtual void startUpdating() OVERRIDE;
+    virtual void stopUpdating() OVERRIDE;
+    virtual void batteryControllerDestroyed() OVERRIDE;
+
+    WebPage* m_page;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(BATTERY_STATUS)
+
+#endif // WebBatteryClient_h
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
index 18e04db80..44eccffe8 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebChromeClient.h
@@ -220,6 +220,11 @@ private:
     virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) OVERRIDE { }
 #endif
 
+#if ENABLE(CUSTOM_SCHEME_HANDLER)
+    virtual CustomHandlersState isProtocolHandlerRegistered(const String&, const String&, const String&) { return CustomHandlersDeclined; }
+    virtual void unregisterProtocolHandler(const String&, const String&, const String&) { }
+#endif
+
     String m_cachedToolTip;
     mutable RefPtr<WebFrame> m_cachedFrameSetLargestFrame;
     mutable bool m_cachedMainFrameHasHorizontalScrollbar;
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.cpp
new file mode 100644
index 000000000..7a9546b94
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebNetworkInfoClient.h"
+
+#if ENABLE(NETWORK_INFO)
+
+#include "WebNetworkInfoManager.h"
+#include "WebPage.h"
+#include "WebProcess.h"
+
+namespace WebKit {
+
+WebNetworkInfoClient::~WebNetworkInfoClient()
+{
+}
+
+double WebNetworkInfoClient::bandwidth() const
+{
+    return WebProcess::shared().networkInfoManager().bandwidth(m_page);
+}
+
+bool WebNetworkInfoClient::metered() const
+{
+    return WebProcess::shared().networkInfoManager().metered(m_page);
+}
+
+void WebNetworkInfoClient::startUpdating()
+{
+    WebProcess::shared().networkInfoManager().registerWebPage(m_page);
+}
+
+void WebNetworkInfoClient::stopUpdating()
+{
+    WebProcess::shared().networkInfoManager().unregisterWebPage(m_page);
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.h
new file mode 100644
index 000000000..0ac02e55e
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebNetworkInfoClient.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebNetworkInfoClient_h
+#define WebNetworkInfoClient_h
+
+#if ENABLE(NETWORK_INFO)
+
+#include <WebCore/NetworkInfoClient.h>
+
+namespace WebKit {
+
+class WebPage;
+
+class WebNetworkInfoClient : public WebCore::NetworkInfoClient {
+public:
+    WebNetworkInfoClient(WebPage* page)
+        : m_page(page)
+    {
+    }
+
+    virtual ~WebNetworkInfoClient();
+
+private:
+    virtual double bandwidth() const OVERRIDE;
+    virtual bool metered() const OVERRIDE;
+
+    virtual void startUpdating() OVERRIDE;
+    virtual void stopUpdating() OVERRIDE;
+
+    WebPage* m_page;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(NETWORK_INFO)
+
+#endif // WebNetworkInfoClient_h
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.cpp
new file mode 100644
index 000000000..f635df45f
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebVibrationClient.h"
+
+#if ENABLE(VIBRATION)
+
+#include "WebPage.h"
+#include "WebProcess.h"
+#include "WebVibrationProxyMessages.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebVibrationClient::vibrate(const uint64_t& vibrationTime)
+{
+    WebProcess::shared().connection()->send(Messages::WebVibrationProxy::Vibrate(vibrationTime), m_page->pageID());
+}
+
+void WebVibrationClient::cancelVibration()
+{
+    WebProcess::shared().connection()->send(Messages::WebVibrationProxy::CancelVibration(), m_page->pageID());
+}
+
+void WebVibrationClient::vibrationDestroyed()
+{
+    delete this;
+}
+
+} // namespace WebKit
+
+#endif // ENABLE(VIBRATION)
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.h b/Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.h
new file mode 100644
index 000000000..e71db2895
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/WebVibrationClient.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebVibrationClient_h
+#define WebVibrationClient_h
+
+#if ENABLE(VIBRATION)
+
+#include <WebCore/VibrationClient.h>
+
+namespace WebKit {
+
+class WebPage;
+
+class WebVibrationClient : public WebCore::VibrationClient {
+public:
+    WebVibrationClient(WebPage* page)
+        : m_page(page)
+    {
+    }
+
+    virtual ~WebVibrationClient() { }
+
+private:
+    virtual void vibrate(const uint64_t& vibrationTime) OVERRIDE;
+    virtual void cancelVibration() OVERRIDE;
+    virtual void vibrationDestroyed() OVERRIDE;
+
+    WebPage* m_page;
+};
+
+} // namespace WebKit
+
+#endif // ENABLE(VIBRATION)
+
+#endif // WebVibrationClient_h
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebErrorsEfl.cpp b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebErrorsEfl.cpp
index 417823612..dda93722a 100644
--- a/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebErrorsEfl.cpp
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/efl/WebErrorsEfl.cpp
@@ -26,7 +26,8 @@
 #include "config.h"
 #include "WebErrors.h"
 
-#include <WebCore/NotImplemented.h>
+#include "WKError.h"
+#include "WebError.h"
 #include <WebCore/ResourceError.h>
 #include <WebCore/ResourceRequest.h>
 #include <WebCore/ResourceResponse.h>
@@ -35,46 +36,47 @@ using namespace WebCore;
 
 namespace WebKit {
 
+// FIXME: Export following error codes so that application can understand.
+// We should establish Efl port's error system because application cannot understand those local define.
+// See https://bugs.webkit.org/show_bug.cgi?id=90783 for detail.
+enum {
+    kWKErrorCodeCancelled =                             300,
+    kWKErrorCodeFileDoesNotExist =                      301,
+};
+
 ResourceError cancelledError(const ResourceRequest& request)
 {
-    notImplemented();
-    return ResourceError();
+    return ResourceError(WebError::webKitErrorDomain(), kWKErrorCodeCancelled, request.url().string(), "Request cancelled");
 }
 
 ResourceError blockedError(const ResourceRequest& request)
 {
-    notImplemented();
-    return ResourceError();
+    return ResourceError(WebError::webKitErrorDomain(), kWKErrorCodeCannotUseRestrictedPort, request.url().string(), "Request blocked");
 }
 
 ResourceError cannotShowURLError(const ResourceRequest& request)
 {
-    notImplemented();
-    return ResourceError();
+    return ResourceError(WebError::webKitErrorDomain(), kWKErrorCodeCannotShowURL, request.url().string(), "Cannot show URL");
 }
 
 ResourceError interruptedForPolicyChangeError(const ResourceRequest& request)
 {
-    notImplemented();
-    return ResourceError();
+    return ResourceError(WebError::webKitErrorDomain(), kWKErrorCodeFrameLoadInterruptedByPolicyChange, request.url().string(), "Frame load interrupted by policy change");
 }
 
 ResourceError cannotShowMIMETypeError(const ResourceResponse& response)
 {
-    notImplemented();
-    return ResourceError();
+    return ResourceError(WebError::webKitErrorDomain(), kWKErrorCodeCannotShowMIMEType, response.url().string(), "Cannot show mimetype");
 }
 
 ResourceError fileDoesNotExistError(const ResourceResponse& response)
 {
-    notImplemented();
-    return ResourceError();
+    return ResourceError(WebError::webKitErrorDomain(), kWKErrorCodeFileDoesNotExist, response.url().string(), "File does not exist");
 }
 
 ResourceError pluginWillHandleLoadError(const ResourceResponse& response)
 {
-    notImplemented();
-    return ResourceError();
+    return ResourceError(WebError::webKitErrorDomain(), kWKErrorCodePlugInWillHandleLoad, response.url().string(), "Plugin will handle load");
 }
 
 } // namespace WebKit
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebSystemInterface.h b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebSystemInterface.h
new file mode 100644
index 000000000..eec0cbb1a
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebSystemInterface.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright 2006 Apple Computer, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+
+void InitWebCoreSystemInterfaceForWK2();
diff --git a/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebSystemInterface.mm b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebSystemInterface.mm
new file mode 100644
index 000000000..1a0c0f60f
--- /dev/null
+++ b/Source/WebKit2/WebProcess/WebCoreSupport/qt/WebSystemInterface.mm
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebSystemInterface.h"
+
+// Needed for builds not using PCH to expose BUILDING_ macros, see bug 32753.
+#include <wtf/Platform.h>
+
+#import <WebCoreSystemInterface.h>
+#import <WebKitSystemInterface.h>
+
+#define INIT(function) wk##function = WK##function
+
+void InitWebCoreSystemInterfaceForWK2(void)
+{
+    static bool didInit;
+    if (didInit)
+        return;
+
+    INIT(QTIncludeOnlyModernMediaFileTypes);
+    INIT(QTMovieDataRate);
+    INIT(QTMovieDisableComponent);
+    INIT(QTMovieMaxTimeLoaded);
+    INIT(QTMovieMaxTimeLoadedChangeNotification);
+    INIT(QTMovieMaxTimeSeekable);
+    INIT(QTMovieGetType);
+    INIT(QTMovieHasClosedCaptions);
+    INIT(QTMovieResolvedURL);
+    INIT(QTMovieSetShowClosedCaptions);
+    INIT(QTMovieSelectPreferredAlternates);
+    INIT(QTMovieViewSetDrawSynchronously);
+    INIT(QTGetSitesInMediaDownloadCache);
+    INIT(QTClearMediaDownloadCacheForSite);
+    INIT(QTClearMediaDownloadCache);
+    INIT(CreateMediaUIBackgroundView);
+    INIT(CreateMediaUIControl);
+    INIT(WindowSetAlpha);
+    INIT(WindowSetScaledFrame);
+
+    didInit = true;
+}
diff --git a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
index db2ed4128..f36fc0238 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp
@@ -642,7 +642,7 @@ JSValueRef WebFrame::jsWrapperForWorld(InjectedBundleNodeHandle* nodeHandle, Inj
     JSDOMWindow* globalObject = m_coreFrame->script()->globalObject(world->coreWorld());
     ExecState* exec = globalObject->globalExec();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     return toRef(exec, toJS(exec, globalObject, nodeHandle->coreNode()));
 }
 
@@ -654,7 +654,7 @@ JSValueRef WebFrame::jsWrapperForWorld(InjectedBundleRangeHandle* rangeHandle, I
     JSDOMWindow* globalObject = m_coreFrame->script()->globalObject(world->coreWorld());
     ExecState* exec = globalObject->globalExec();
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     return toRef(exec, toJS(exec, globalObject, rangeHandle->coreRange()));
 }
 
@@ -671,7 +671,7 @@ JSValueRef WebFrame::computedStyleIncludingVisitedInfo(JSObjectRef element)
 
     RefPtr<CSSComputedStyleDeclaration> style = CSSComputedStyleDeclaration::create(static_cast<JSElement*>(toJS(element))->impl(), true);
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(exec);
     return toRef(exec, toJS(exec, globalObject, style.get()));
 }
 
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
index b4e19bfe7..37d1e0702 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.cpp
@@ -126,6 +126,10 @@
 #endif
 #endif
 
+#if ENABLE(BATTERY_STATUS)
+#include "WebBatteryClient.h"
+#endif
+
 #if ENABLE(WEB_INTENTS)
 #include "IntentData.h"
 #endif
@@ -262,6 +266,9 @@ WebPage::WebPage(uint64_t pageID, const WebPageCreationParameters& parameters)
     
     m_page = adoptPtr(new Page(pageClients));
 
+#if ENABLE(BATTERY_STATUS)
+    WebCore::provideBatteryTo(m_page.get(), new WebBatteryClient(this));
+#endif
 #if ENABLE(GEOLOCATION)
     WebCore::provideGeolocationTo(m_page.get(), new WebGeolocationClient(this));
 #endif
@@ -868,18 +875,12 @@ void WebPage::setResizesToContentsUsingLayoutSize(const IntSize& targetLayoutSiz
     if (view->fixedLayoutSize() == targetLayoutSize)
         return;
 
-    // Always reset even when empty.
-    view->setFixedLayoutSize(targetLayoutSize);
-
     m_page->settings()->setAcceleratedCompositingForFixedPositionEnabled(true);
     m_page->settings()->setFixedElementsLayoutRelativeToFrame(true);
     m_page->settings()->setFixedPositionCreatesStackingContext(true);
 
-    // Schedule a layout to use the new target size.
-    if (!view->layoutPending()) {
-        view->setNeedsLayout();
-        view->scheduleRelayout();
-    }
+    // Always reset even when empty. This also takes care of the relayout.
+    setFixedLayoutSize(targetLayoutSize);
 }
 
 void WebPage::resizeToContentsIfNeeded()
@@ -918,7 +919,7 @@ void WebPage::sendViewportAttributesChanged()
     int deviceWidth = (settings->deviceWidth() > 0) ? settings->deviceWidth() : m_viewportSize.width();
     int deviceHeight = (settings->deviceHeight() > 0) ? settings->deviceHeight() : m_viewportSize.height();
 
-    ViewportAttributes attr = computeViewportAttributes(m_page->viewportArguments(), minimumLayoutFallbackWidth, deviceWidth, deviceHeight, static_cast<int>(160 * m_page->deviceScaleFactor()), m_viewportSize);
+    ViewportAttributes attr = computeViewportAttributes(m_page->viewportArguments(), minimumLayoutFallbackWidth, deviceWidth, deviceHeight, m_page->deviceScaleFactor(), m_viewportSize);
 
     setResizesToContentsUsingLayoutSize(IntSize(static_cast<int>(attr.layoutSize.width()), static_cast<int>(attr.layoutSize.height())));
     send(Messages::WebPageProxy::DidChangeViewportProperties(attr));
@@ -1080,7 +1081,7 @@ void WebPage::setUseFixedLayout(bool fixed)
 
     view->setUseFixedLayout(fixed);
     if (!fixed)
-        view->setFixedLayoutSize(IntSize());
+        setFixedLayoutSize(IntSize());
 }
 
 void WebPage::setFixedLayoutSize(const IntSize& size)
@@ -1439,7 +1440,7 @@ void WebPage::keyEvent(const WebKeyboardEvent& keyboardEvent)
     if (!handled)
         handled = performDefaultBehaviorForKeyEvent(keyboardEvent);
 
-    sendSync(Messages::WebPageProxy::DidReceiveKeyEvent(static_cast<uint32_t>(keyboardEvent.type()), handled), Messages::WebPageProxy::DidReceiveKeyEvent::Reply());
+    send(Messages::WebPageProxy::DidReceiveEvent(static_cast<uint32_t>(keyboardEvent.type()), handled));
 }
 
 void WebPage::keyEventSyncForTesting(const WebKeyboardEvent& keyboardEvent, bool& handled)
@@ -1813,7 +1814,7 @@ void WebPage::runJavaScriptInMainFrame(const String& script, uint64_t callbackID
     RefPtr<SerializedScriptValue> serializedResultValue;
     CoreIPC::DataReference dataReference;
 
-    JSLock lock(SilenceAssertionsOnly);
+    JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
     if (JSValue resultValue = m_mainFrame->coreFrame()->script()->executeScript(script, true).jsValue()) {
         if ((serializedResultValue = SerializedScriptValue::create(m_mainFrame->jsContext(), toRef(m_mainFrame->coreFrame()->script()->globalObject(mainThreadNormalWorld())->globalExec(), resultValue), 0)))
             dataReference = serializedResultValue->data();
@@ -2043,10 +2044,6 @@ void WebPage::updatePreferences(const WebPreferencesStore& store)
     settings->setAVFoundationEnabled(store.getBoolValueForKey(WebPreferencesKey::isAVFoundationEnabledKey()));
 #endif
 
-#if ENABLE(WEB_SOCKETS)
-    settings->setUseHixie76WebSocketProtocol(store.getBoolValueForKey(WebPreferencesKey::hixie76WebSocketProtocolEnabledKey()));
-#endif
-
 #if ENABLE(WEB_AUDIO)
     settings->setWebAudioEnabled(store.getBoolValueForKey(WebPreferencesKey::webAudioEnabledKey()));
 #endif
@@ -3119,15 +3116,6 @@ void WebPage::simulateMouseMotion(WebCore::IntPoint position, double time)
     mouseEvent(WebMouseEvent(WebMouseEvent::MouseMove, WebMouseEvent::NoButton, position, position, 0, 0, 0, 0, WebMouseEvent::Modifiers(), time));
 }
 
-String WebPage::viewportConfigurationAsText(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    ViewportArguments arguments = mainFrame()->document()->viewportArguments();
-    ViewportAttributes attrs = WebCore::computeViewportAttributes(arguments, /* default layout width for non-mobile pages */ 980, deviceWidth, deviceHeight, deviceDPI, IntSize(availableWidth, availableHeight));
-    WebCore::restrictMinimumScaleFactorToViewportSize(attrs, IntSize(availableWidth, availableHeight));
-    WebCore::restrictScaleFactorToInitialScaleIfNotUserScalable(attrs);
-    return String::format("viewport size %dx%d scale %f with limits [%f, %f] and userScalable %f\n", static_cast<int>(attrs.layoutSize.width()), static_cast<int>(attrs.layoutSize.height()), attrs.initialScale, attrs.minimumScale, attrs.maximumScale, attrs.userScalable);
-}
-
 void WebPage::setCompositionForTesting(const String& compositionString, uint64_t from, uint64_t length)
 {
     Frame* frame = m_page->focusController()->focusedOrMainFrame();
diff --git a/Source/WebKit2/WebProcess/WebPage/WebPage.h b/Source/WebKit2/WebProcess/WebPage/WebPage.h
index 1a13b6ce7..b9dac9137 100644
--- a/Source/WebKit2/WebProcess/WebPage/WebPage.h
+++ b/Source/WebKit2/WebProcess/WebPage/WebPage.h
@@ -528,7 +528,6 @@ public:
     void simulateMouseDown(int button, WebCore::IntPoint, int clickCount, WKEventModifiers, double time);
     void simulateMouseUp(int button, WebCore::IntPoint, int clickCount, WKEventModifiers, double time);
     void simulateMouseMotion(WebCore::IntPoint, double time);
-    String viewportConfigurationAsText(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight);
 
 #if ENABLE(CONTEXT_MENUS)
     void contextMenuShowing() { m_isShowingContextMenu = true; }
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
index c42866feb..1b91de84f 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.cpp
@@ -27,6 +27,8 @@
 #include "config.h"
 #include "LayerTreeHostGtk.h"
 
+#if USE(TEXTURE_MAPPER_GL)
+
 #include "DrawingAreaImpl.h"
 #include "TextureMapperGL.h"
 #include "WebPage.h"
@@ -392,3 +394,5 @@ void LayerTreeHostGtk::cancelPendingLayerFlush()
 }
 
 } // namespace WebKit
+
+#endif
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
index b454925cb..060570b64 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/LayerTreeHostGtk.h
@@ -27,6 +27,8 @@
 #ifndef LayerTreeHostGtk_h
 #define LayerTreeHostGtk_h
 
+#if USE(TEXTURE_MAPPER_GL)
+
 #include "LayerTreeContext.h"
 #include "LayerTreeHost.h"
 #include "TextureMapperLayer.h"
@@ -104,4 +106,6 @@ private:
 
 } // namespace WebKit
 
+#endif
+
 #endif // LayerTreeHostGtk_h
diff --git a/Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp b/Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp
index 2897dd9fa..a02891cc1 100644
--- a/Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp
+++ b/Source/WebKit2/WebProcess/WebPage/gtk/WebPageGtk.cpp
@@ -55,7 +55,9 @@ void WebPage::platformInitialize()
     GOwnPtr<gchar> plugID(atk_plug_get_id(ATK_PLUG(m_accessibilityObject)));
     send(Messages::WebPageProxy::BindAccessibilityTree(String(plugID.get())));
 
+#if USE(TEXTURE_MAPPER_GL)
     m_nativeWindowHandle = 0;
+#endif
 }
 
 void WebPage::updateAccessibilityTree()
diff --git a/Source/WebKit2/WebProcess/WebProcess.cpp b/Source/WebKit2/WebProcess/WebProcess.cpp
index 2b0382dba..3a9940442 100644
--- a/Source/WebKit2/WebProcess/WebProcess.cpp
+++ b/Source/WebKit2/WebProcess/WebProcess.cpp
@@ -80,6 +80,10 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RandomNumber.h>
 
+#if ENABLE(NETWORK_INFO)
+#include "WebNetworkInfoManagerMessages.h"
+#endif
+
 #if !OS(WINDOWS)
 #include <unistd.h>
 #endif
@@ -145,6 +149,12 @@ WebProcess::WebProcess()
 #endif
     , m_textCheckerState()
     , m_geolocationManager(this)
+#if ENABLE(BATTERY_STATUS)
+    , m_batteryManager(this)
+#endif
+#if ENABLE(NETWORK_INFO)
+    , m_networkInfoManager(this)
+#endif
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     , m_notificationManager(this)
 #endif
@@ -161,7 +171,9 @@ WebProcess::WebProcess()
     WebPlatformStrategies::initialize();
 #endif // USE(PLATFORM_STRATEGIES)
 
+#if !LOG_DISABLED
     WebCore::initializeLoggingChannelsIfNecessary();
+#endif // !LOG_DISABLED
 }
 
 void WebProcess::initialize(CoreIPC::Connection::Identifier serverIdentifier, RunLoop* runLoop)
@@ -631,6 +643,20 @@ void WebProcess::didReceiveMessage(CoreIPC::Connection* connection, CoreIPC::Mes
         return;
     }
 
+#if ENABLE(BATTERY_STATUS)
+    if (messageID.is<CoreIPC::MessageClassWebBatteryManager>()) {
+        m_batteryManager.didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+#endif
+
+#if ENABLE(NETWORK_INFO)
+    if (messageID.is<CoreIPC::MessageClassWebNetworkInfoManager>()) {
+        m_networkInfoManager.didReceiveMessage(connection, messageID, arguments);
+        return;
+    }
+#endif
+
     if (messageID.is<CoreIPC::MessageClassWebIconDatabaseProxy>()) {
         m_iconDatabaseProxy.didReceiveMessage(connection, messageID, arguments);
         return;
@@ -920,7 +946,7 @@ void WebProcess::getWebCoreStatistics(uint64_t callbackID)
     
     // Gather JavaScript statistics.
     {
-        JSLock lock(SilenceAssertionsOnly);
+        JSLockHolder lock(JSDOMWindow::commonJSGlobalData());
         data.statisticsNumbers.set("JavaScriptObjectsCount", JSDOMWindow::commonJSGlobalData()->heap.objectCount());
         data.statisticsNumbers.set("JavaScriptGlobalObjectsCount", JSDOMWindow::commonJSGlobalData()->heap.globalObjectCount());
         data.statisticsNumbers.set("JavaScriptProtectedObjectsCount", JSDOMWindow::commonJSGlobalData()->heap.protectedObjectCount());
diff --git a/Source/WebKit2/WebProcess/WebProcess.h b/Source/WebKit2/WebProcess/WebProcess.h
index 986ce36a5..090d4d82d 100644
--- a/Source/WebKit2/WebProcess/WebProcess.h
+++ b/Source/WebKit2/WebProcess/WebProcess.h
@@ -57,6 +57,14 @@ class QNetworkAccessManager;
 #include <dispatch/dispatch.h>
 #endif
 
+#if ENABLE(BATTERY_STATUS)
+#include "WebBatteryManager.h"
+#endif
+
+#if ENABLE(NETWORK_INFO)
+#include "WebNetworkInfoManager.h"
+#endif
+
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
 #include "WebNotificationManager.h"
 #endif
@@ -142,6 +150,14 @@ public:
 
     // Geolocation
     WebGeolocationManager& geolocationManager() { return m_geolocationManager; }
+
+#if ENABLE(BATTERY_STATUS)
+    WebBatteryManager& batteryManager() { return m_batteryManager; }
+#endif
+
+#if ENABLE(NETWORK_INFO)
+    WebNetworkInfoManager& networkInfoManager() { return m_networkInfoManager; }
+#endif
     
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     WebNotificationManager& notificationManager() { return m_notificationManager; }
@@ -286,6 +302,12 @@ private:
 
     TextCheckerState m_textCheckerState;
     WebGeolocationManager m_geolocationManager;
+#if ENABLE(BATTERY_STATUS)
+    WebBatteryManager m_batteryManager;
+#endif
+#if ENABLE(NETWORK_INFO)
+    WebNetworkInfoManager m_networkInfoManager;
+#endif
 #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)
     WebNotificationManager m_notificationManager;
 #endif
diff --git a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
index 08f3bb547..92d3516a5 100644
--- a/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
+++ b/Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp
@@ -74,9 +74,6 @@ WK_EXPORT int WebProcessMainEfl(int argc, char* argv[])
         soup_uri_free(proxyUri);
     }
 
-    soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_SNIFFER);
-    soup_session_add_feature_by_type(session, SOUP_TYPE_CONTENT_DECODER);
-
     int socket = atoi(argv[1]);
     WebProcess::shared().initialize(socket, RunLoop::main());
     RunLoop::run();
diff --git a/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp b/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
index 99eb68185..cb72cb9be 100644
--- a/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
+++ b/Source/WebKit2/WebProcess/qt/WebProcessMainQt.cpp
@@ -40,6 +40,9 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "WebGraphicsLayer.h"
 #endif
+#if USE(QTKIT)
+#include "WebSystemInterface.h"
+#endif
 
 #ifndef NDEBUG
 #if !OS(WINDOWS)
@@ -148,6 +151,10 @@ Q_DECL_EXPORT int WebProcessMainQt(QGuiApplication* app)
     JSC::initializeThreading();
     WTF::initializeMainThread();
     RunLoop::initializeMainRunLoop();
+    
+#if USE(QTKIT)
+    InitWebCoreSystemInterfaceForWK2();
+#endif
 
     // Create the connection.
     if (app->arguments().size() <= 1) {
diff --git a/Source/WebKit2/win/WebKit2.def b/Source/WebKit2/win/WebKit2.def
index ed03bcc6b..864f6ec59 100644
--- a/Source/WebKit2/win/WebKit2.def
+++ b/Source/WebKit2/win/WebKit2.def
@@ -184,13 +184,13 @@ EXPORTS
         ?getLocationAndLengthFromRange@TextIterator@WebCore@@SA_NPAVElement@2@PBVRange@2@AAI2@Z
         ?inputTag@HTMLNames@WebCore@@3VQualifiedName@2@B
         ?instrumentingAgentsForPage@InspectorInstrumentation@WebCore@@CAPAVInstrumentingAgents@2@PAVPage@2@@Z
+        ?isActiveInsertionPoint@WebCore@@YA_NPBVNode@1@@Z
         ?isCSSExclusionsEnabled@RuntimeEnabledFeatures@WebCore@@0_NA
         ?isPreloaded@CachedResourceLoader@WebCore@@QBE_NABVString@WTF@@@Z
         ?jsArray@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@PAVJSDOMGlobalObject@1@V?$PassRefPtr@VDOMStringList@WebCore@@@WTF@@@Z
         ?lastChangeWasUserEdit@HTMLTextFormControlElement@WebCore@@QBE_NXZ
         ?markersFor@DocumentMarkerController@WebCore@@QAE?AV?$Vector@PAVDocumentMarker@WebCore@@$0A@@WTF@@PAVNode@2@VMarkerTypes@DocumentMarker@2@@Z
         ?nextSibling@ComposedShadowTreeWalker@WebCore@@QAEXXZ
-        ??0ComposedShadowTreeWalker@WebCore@@QAE@PBVNode@1@W4Policy@01@@Z
         ?firstChild@ComposedShadowTreeWalker@WebCore@@QAEXXZ
         ?lastChild@ComposedShadowTreeWalker@WebCore@@QAEXXZ
         ?next@ComposedShadowTreeWalker@WebCore@@QAEXXZ
@@ -261,7 +261,12 @@ EXPORTS
         ?webkitDidEnterFullScreenForElement@Document@WebCore@@QAEXPAVElement@2@@Z
         ?webkitWillExitFullScreenForElement@Document@WebCore@@QAEXPAVElement@2@@Z
         ?webkitDidExitFullScreenForElement@Document@WebCore@@QAEXPAVElement@2@@Z
+        ?restrictScaleFactorToInitialScaleIfNotUserScalable@WebCore@@YAXAAUViewportAttributes@1@@Z
+        ?restrictMinimumScaleFactorToViewportSize@WebCore@@YAXAAUViewportAttributes@1@VIntSize@1@@Z
+        ?computeViewportAttributes@WebCore@@YA?AUViewportAttributes@1@UViewportArguments@1@HHHMVIntSize@1@@Z
+        ?viewportArguments@Page@WebCore@@QBE?AUViewportArguments@2@XZ
         ?isPageBoxVisible@Document@WebCore@@QAE_NH@Z
+        ?isActive@InsertionPoint@WebCore@@QBE_NXZ
         ?suspendAnimations@AnimationController@WebCore@@QAEXXZ
         ?resumeAnimations@AnimationController@WebCore@@QAEXXZ
         ?setAllowsRoundingHacks@TextRun@WebCore@@SAX_N@Z
diff --git a/Source/WebKit2/win/WebKit2CFLite.def b/Source/WebKit2/win/WebKit2CFLite.def
index ed6ecce86..dfcbcdd03 100644
--- a/Source/WebKit2/win/WebKit2CFLite.def
+++ b/Source/WebKit2/win/WebKit2CFLite.def
@@ -177,13 +177,13 @@ EXPORTS
         ?getLocationAndLengthFromRange@TextIterator@WebCore@@SA_NPAVElement@2@PBVRange@2@AAI2@Z
         ?inputTag@HTMLNames@WebCore@@3VQualifiedName@2@B
         ?instrumentingAgentsForPage@InspectorInstrumentation@WebCore@@CAPAVInstrumentingAgents@2@PAVPage@2@@Z
+        ?isActiveInsertionPoint@WebCore@@YA_NPBVNode@1@@Z
         ?isCSSExclusionsEnabled@RuntimeEnabledFeatures@WebCore@@0_NA
         ?isPreloaded@CachedResourceLoader@WebCore@@QBE_NABVString@WTF@@@Z
         ?jsArray@WebCore@@YA?AVJSValue@JSC@@PAVExecState@3@PAVJSDOMGlobalObject@1@V?$PassRefPtr@VDOMStringList@WebCore@@@WTF@@@Z
         ?lastChangeWasUserEdit@HTMLTextFormControlElement@WebCore@@QBE_NXZ
         ?markersFor@DocumentMarkerController@WebCore@@QAE?AV?$Vector@PAVDocumentMarker@WebCore@@$0A@@WTF@@PAVNode@2@VMarkerTypes@DocumentMarker@2@@Z
         ?nextSibling@ComposedShadowTreeWalker@WebCore@@QAEXXZ
-        ??0ComposedShadowTreeWalker@WebCore@@QAE@PBVNode@1@W4Policy@01@@Z
         ?firstChild@ComposedShadowTreeWalker@WebCore@@QAEXXZ
         ?lastChild@ComposedShadowTreeWalker@WebCore@@QAEXXZ
         ?next@ComposedShadowTreeWalker@WebCore@@QAEXXZ
@@ -250,7 +250,12 @@ EXPORTS
         ?willDetachPage@FrameDestructionObserver@WebCore@@UAEXXZ
         ?nodesFromRect@Document@WebCore@@QBE?AV?$PassRefPtr@VNodeList@WebCore@@@WTF@@HHIIII_N0@Z
         ?selectionStartHasMarkerFor@Editor@WebCore@@QBE_NW4MarkerType@DocumentMarker@2@HH@Z
+        ?restrictScaleFactorToInitialScaleIfNotUserScalable@WebCore@@YAXAAUViewportAttributes@1@@Z
+        ?restrictMinimumScaleFactorToViewportSize@WebCore@@YAXAAUViewportAttributes@1@VIntSize@1@@Z
+        ?computeViewportAttributes@WebCore@@YA?AUViewportAttributes@1@UViewportArguments@1@HHHMVIntSize@1@@Z
+        ?viewportArguments@Page@WebCore@@QBE?AUViewportArguments@2@XZ
         ?isPageBoxVisible@Document@WebCore@@QAE_NH@Z
+        ?isActive@InsertionPoint@WebCore@@QBE_NXZ
         ?suspendAnimations@AnimationController@WebCore@@QAEXXZ
         ?resumeAnimations@AnimationController@WebCore@@QAEXXZ
         ?setAllowsRoundingHacks@TextRun@WebCore@@SAX_N@Z
diff --git a/Source/api.pri b/Source/api.pri
index 7ae29fc5a..00c9fe1aa 100644
--- a/Source/api.pri
+++ b/Source/api.pri
@@ -11,10 +11,20 @@ WEBKIT_DESTDIR = $${ROOT_BUILD_DIR}/lib
 
 haveQt(5) {
     # Use Qt5's module system
-    load(qt_module)
+    load(qt_build_config)
     MODULE = webkit
-    MODULE_PRI = $$QT.webkit.module_pri
-    CONFIG += module
+    MODULE_PRI = ../Tools/qmake/qt_webkit.pri
+
+    # ---------------- Custom developer-build handling -------------------
+    #
+    # The assumption for Qt developer builds is that the module file
+    # will be put into qtbase/mkspecs/modules, and the libraries into
+    # qtbase/lib, with rpath/install_name set to the Qt lib dir.
+    #
+    # For WebKit we don't want that behavior for the libraries, as we want
+    # them to be self-contained in the WebKit build dir.
+    #
+    CONFIG += force_independent
 
     BASE_TARGET = $$TARGET
 
@@ -31,65 +41,6 @@ haveQt(5) {
     # Allow doing a debug-only build of WebKit (not supported by Qt)
     macx:!debug_and_release:debug: TARGET = $$BASE_TARGET
 
-    # ---------------- Custom developer-build handling -------------------
-    #
-    # The assumption for Qt developer builds is that the module file
-    # will be put into qtbase/mkspecs/modules, and the libraries into
-    # qtbase/lib, with rpath/install_name set to the Qt lib dir.
-    #
-    # For WebKit we don't want that behavior for the libraries, as we want
-    # them to be self-contained in the WebKit build dir. To achive that we
-    # trick Qt into thinking it's not a developer build, but setting QTDIR
-    # to a bogus path in default_pre.prf.
-    #
-    # We still want the module file to live in the Qt dir so the module can
-    # be used by setting QT += webkit, so we copy the file manually. We also
-    # have to make sure the rpath/install_name of the libraries are relative
-    # to the webkit build dir.
-
-    !build_pass {
-        # Make a more accessible copy of the module forward file
-        # in the WebKit build directory.
-        convenience_module_path = $$toSystemPath($${ROOT_BUILD_DIR})$${QMAKE_DIR_SEP}modules
-        module_filename = $$basename(QT.webkit.module_pri)
-
-        # The QMAKE_EXTRA_MODULE_FORWARDS might contain more than one path,
-        # so we iterate the paths and find one that matches our build dir.
-        for(module_forward, QMAKE_EXTRA_MODULE_FORWARDS) {
-            in_build_dir = $$find(module_forward, ^$${ROOT_BUILD_DIR})
-            !isEmpty(in_build_dir) {
-                webkit_module_forward = $$module_forward
-                break()
-            }
-        }
-
-        isEmpty(webkit_module_forward) {
-            warning(Could not resolve QMAKE_EXTRA_MODULE_FORWARDS path!)
-        } else {
-            make_module_fwd_convenience.target = $$convenience_module_path$${QMAKE_DIR_SEP}$$module_filename
-            make_module_fwd_convenience.commands = $$QMAKE_MKDIR $$convenience_module_path \
-                && echo \"include($$webkit_module_forward$${QMAKE_DIR_SEP}$$module_filename)\" > $$convenience_module_path$${QMAKE_DIR_SEP}$$module_filename
-            make_module_fwd_convenience.depends = $$webkit_module_forward$${QMAKE_DIR_SEP}$$module_filename
-
-            QMAKE_EXTRA_TARGETS += make_module_fwd_convenience
-            DEFAULT_TARGETS += make_module_fwd_convenience
-        }
-
-        qt_developer_build {
-            # Copy the module forward file into Qt so that the module
-            # is immediately accessible.
-            qt_modules_path = $$[QT_INSTALL_PREFIX]$${QMAKE_DIR_SEP}mkspecs$${QMAKE_DIR_SEP}modules
-
-            copy_module_fwd_file.target = $$qt_modules_path$${QMAKE_DIR_SEP}$$module_filename
-            copy_module_fwd_file.commands = $$QMAKE_COPY  $$toSystemPath($$QMAKE_EXTRA_MODULE_FORWARDS)$${QMAKE_DIR_SEP}$$module_filename $$qt_modules_path
-            # FIXME: Add dependendy that ensures we copy the forward file if the target is updated
-            copy_module_fwd_file.depends = $$QMAKE_EXTRA_MODULE_FORWARDS$${QMAKE_DIR_SEP}$$module_filename
-
-            QMAKE_EXTRA_TARGETS += copy_module_fwd_file
-            DEFAULT_TARGETS += copy_module_fwd_file
-        }
-    }
-
     # Make sure the install_name of the QtWebKit library point to webkit
     macx {
         # We do our own absolute path so that we can trick qmake into
@@ -124,8 +75,6 @@ haveQt(5) {
 
 runSyncQt() # Generate forwarding headers for the QtWebKit API
 
-load(features)
-
 WEBKIT += wtf
 
 !v8:WEBKIT += javascriptcore
@@ -134,7 +83,6 @@ WEBKIT += webcore
 
 !no_webkit2 {
     WEBKIT += webkit2
-    QT += declarative
 
     # Ensure that changes to the WebKit1 and WebKit2 API will trigger a qmake of this
     # file, which in turn runs syncqt to update the forwarding headers.
diff --git a/Source/autotools/symbols.filter b/Source/autotools/symbols.filter
index 4470defb8..a60721a64 100644
--- a/Source/autotools/symbols.filter
+++ b/Source/autotools/symbols.filter
@@ -82,11 +82,13 @@ _ZN7WebCore24ComposedShadowTreeWalker11nextSiblingEv;
 _ZN7WebCore24ComposedShadowTreeWalker4nextEv;
 _ZN7WebCore24ComposedShadowTreeWalker8previousEv;
 _ZN7WebCore24ComposedShadowTreeWalker9lastChildEv;
-_ZN7WebCore24ComposedShadowTreeWalkerC1EPKNS_4NodeENS0_6PolicyE;
 _ZN7WebCore24DocumentMarkerController10markersForEPNS_4NodeENS_14DocumentMarker11MarkerTypesE;
+_ZN7WebCore25computeViewportAttributesENS_17ViewportArgumentsEiiifNS_7IntSizeE;
 _ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELj0EEE;
 _ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELm0EEE;
+_ZN7WebCore40restrictMinimumScaleFactorToViewportSizeERNS_18ViewportAttributesENS_7IntSizeE;
 _ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_13DOMStringListE;
+_ZN7WebCore50restrictScaleFactorToInitialScaleIfNotUserScalableERNS_18ViewportAttributesE;
 _ZN7WebCore6JSNode10putVirtualEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE;
 _ZN7WebCore6JSNode20visitChildrenVirtualERN3JSC11SlotVisitorE;
 _ZN7WebCore6JSNode6s_infoE;
@@ -104,6 +106,7 @@ _ZNK7WebCore11HistoryItem6targetEv;
 _ZNK7WebCore4Node11textContentEb;
 _ZNK7WebCore4Node31numberOfScopedHTMLStyleChildrenEv;
 _ZNK7WebCore4Node9treeScopeEv;
+_ZNK7WebCore4Page17viewportArgumentsEv;
 _ZNK7WebCore12RenderObject23absoluteBoundingBoxRectEb;
 _ZNK7WebCore16HTMLInputElement14suggestedValueEv;
 _ZNK7WebCore17JSDOMGlobalObject22scriptExecutionContextEv;
@@ -163,6 +166,7 @@ _ZN7WebCore8Document34webkitWillExitFullScreenForElementEPNS_7ElementE;
 _ZN7WebCore8Document35webkitWillEnterFullScreenForElementEPNS_7ElementE;
 _ZN7WebCore17JSDOMGlobalObject6s_infoE;
 _ZN7WebCore7TextRun22setAllowsRoundingHacksEb;
+_ZNK7WebCore14InsertionPoint8isActiveEv;
 local:
 _Z*;
 cti*;
diff --git a/Source/cmake/FindEFL.cmake b/Source/cmake/FindEFL.cmake
index 1466f8b2c..054b86b19 100644
--- a/Source/cmake/FindEFL.cmake
+++ b/Source/cmake/FindEFL.cmake
@@ -1,20 +1,20 @@
 INCLUDE(FindPkgConfig)
 
 PKG_CHECK_MODULES (EDJE REQUIRED edje>=1.0.0)
-PKG_CHECK_MODULES (ECORE REQUIRED ecore>=1.0.0)
+PKG_CHECK_MODULES (ECORE REQUIRED ecore>=1.2.0)
 PKG_CHECK_MODULES (ECORE_EVAS REQUIRED ecore-evas>=1.0.0)
 PKG_CHECK_MODULES (EFLDEPS REQUIRED
-  eina>=1.0.999.63568
+  eina>=1.2.0
   evas>=1.0.0
-  ecore>=1.0.999.59763
+  ecore>=1.2.0
   ecore-file>=1.0.0
   ecore-evas>=1.0.999.59763
   edje>=1.0.0
   eukit>=1.1.0
   edbus>=1.1.0
   ecore-input>=1.0.0
-  eeze>=1.1.99)
-PKG_CHECK_MODULES (EINA REQUIRED eina>=1.0.0)
+  eeze>=1.2.99)
+PKG_CHECK_MODULES (EINA REQUIRED eina>=1.2.0)
 PKG_CHECK_MODULES (ECORE_X ecore-x>=1.0.0)
 PKG_CHECK_MODULES (EVAS REQUIRED evas>=1.0.0)
 PKG_CHECK_MODULES (EUKIT REQUIRED eukit>=1.1.0)
diff --git a/Source/cmake/OptionsBlackBerry.cmake b/Source/cmake/OptionsBlackBerry.cmake
index a04ac31b2..af18cc1e9 100644
--- a/Source/cmake/OptionsBlackBerry.cmake
+++ b/Source/cmake/OptionsBlackBerry.cmake
@@ -37,7 +37,10 @@ IF (ADDITIONAL_SYSTEM_INCLUDE_PATH)
     ENDIF ()
 ENDIF ()
 
-IF (ENABLE_DRT)
+IF (PUBLIC_BUILD)
+    ADD_DEFINITIONS(-DPUBLIC_BUILD=1)
+    message("*** PUBLIC BUILD ***")
+ELSE (PUBLIC_BUILD)
     message("*** DRT is ENABLED ***")
 ENDIF ()
 
@@ -138,6 +141,7 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_ANIMATION_API ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_ASSEMBLER_WX_EXCLUSIVE ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BATTERY_STATUS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BLOB ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CUSTOM_SCHEME_HANDLER ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_DEVICE_ORIENTATION ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_DRAG_SUPPORT OFF)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_DOWNLOAD_ATTRIBUTE ON)
@@ -150,14 +154,17 @@ WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_INPUT_TYPE_COLOR ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_LEGACY_NOTIFICATIONS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_LEGACY_WEBKIT_BLOB_BUILDER ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MEDIA_STREAM ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MICRODATA ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_NOTIFICATIONS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_ORIENTATION_EVENTS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_PAGE_POPUP ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_PAGE_VISIBILITY_API ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_REGISTER_PROTOCOL_HANDLER ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_REPAINT_THROTTLING ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_REQUEST_ANIMATION_FRAME ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SHARED_WORKERS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_SMOOTH_SCROLLING ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_STYLE_SCOPED ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_TOUCH_EVENTS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_VIBRATION ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_VIDEO ON)
diff --git a/Source/cmake/OptionsEfl.cmake b/Source/cmake/OptionsEfl.cmake
index 3b26e52af..32ea38363 100644
--- a/Source/cmake/OptionsEfl.cmake
+++ b/Source/cmake/OptionsEfl.cmake
@@ -16,6 +16,12 @@ ADD_DEFINITIONS(-DWTF_PLATFORM_EFL=1)
 SET(WTF_PLATFORM_EFL 1)
 
 # -----------------------------------------------------------------------------
+# Enable CTest for the public API unit testing
+# -----------------------------------------------------------------------------
+ENABLE_TESTING()
+SET(ENABLE_API_TESTS ON)
+
+# -----------------------------------------------------------------------------
 # Determine which font backend will be used
 # -----------------------------------------------------------------------------
 SET(ALL_FONT_BACKENDS freetype pango)
@@ -70,13 +76,18 @@ WEBKIT_OPTION_BEGIN()
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BATTERY_STATUS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_BLOB ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_IMAGE_SET ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CSS_VARIABLES ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_CUSTOM_SCHEME_HANDLER ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_DATALIST ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_DRAG_SUPPORT ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_FAST_MOBILE_SCROLLING ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_FILTERS ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_FULLSCREEN_API ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_GAMEPAD ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_GLIB_SUPPORT ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_INPUT_TYPE_COLOR ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_LEGACY_WEBKIT_BLOB_BUILDER ON)
+WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_MICRODATA ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_NETSCAPE_PLUGIN_API OFF)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_NETWORK_INFO ON)
 WEBKIT_OPTION_DEFAULT_PORT_VALUE(ENABLE_PAGE_VISIBILITY_API ON)
diff --git a/Source/cmake/WebKitFeatures.cmake b/Source/cmake/WebKitFeatures.cmake
index 9cdd83219..5cf3586cf 100644
--- a/Source/cmake/WebKitFeatures.cmake
+++ b/Source/cmake/WebKitFeatures.cmake
@@ -21,9 +21,11 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_CSP_NEXT "Toggle Content Security Policy 1.1 support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS3_FLEXBOX "Toggle CSS3 Flexbox support" ON)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_BOX_DECORATION_BREAK "Toggle Box Decoration Break (CSS Backgrounds and Borders) support" ON)
+    WEBKIT_OPTION_DEFINE(ENABLE_CSS_EXCLUSIONS "Toggle CSS Exclusion support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_FILTERS "Toggle CSS Filters support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_IMAGE_RESOLUTION "Toggle CSS image-resolution support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_IMAGE_SET "Toggle CSS image-set support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_CSS_REGIONS "Toggle CSS regions support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_SHADERS "Toggle CSS Shaders (within CSS Filters) support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CSS_VARIABLES "Toggle CSS Variables support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_CUSTOM_SCHEME_HANDLER "Toggle Custom Scheme Handler support" OFF)
@@ -31,7 +33,8 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_DATA_TRANSFER_ITEMS "Toggle HTML5 data transfer items support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_DETAILS "Toggle HTML5 details support" ON)
     WEBKIT_OPTION_DEFINE(ENABLE_DEVICE_ORIENTATION "Toggle DeviceOrientation support" OFF)
-    WEBKIT_OPTION_DEFINE(ENABLE_DIRECTORY_UPLOAD "Toogle Directory upload support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_DIALOG_ELEMENT "Toggle Dialog Element support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_DIRECTORY_UPLOAD "Toggle Directory upload support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_DOWNLOAD_ATTRIBUTE "Toggle download attribute support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_DRAG_SUPPORT "Toggle Drag Support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_FAST_MOBILE_SCROLLING "Toogle Fast Mobile Scrolling support" OFF)
@@ -62,6 +65,7 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_LEGACY_VIEWPORT_ADAPTION "Toogle legacy viewport adaption" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_LEGACY_WEBKIT_BLOB_BUILDER "Toggle Legacy WebKit Blob Builder Support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_LINK_PREFETCH "Toggle pre fetching support" OFF)
+    WEBKIT_OPTION_DEFINE(ENABLE_LINK_PRERENDER "Toggle pre rendering support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_MATHML "Toggle MathML support" ON)
     WEBKIT_OPTION_DEFINE(ENABLE_MEDIA_SOURCE "Toggle Media Source support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_MEDIA_STATISTICS "Toggle Media Statistics support" OFF)
@@ -89,6 +93,7 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_SVG "Toggle SVG support" ON)
     WEBKIT_OPTION_DEFINE(ENABLE_SVG_DOM_OBJC_BINDINGS "Toggle SVG DOM Objective-C bindings support (implies SVG support)" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_SVG_FONTS "Toggle SVG fonts support (imples SVG support)" ON)
+    WEBKIT_OPTION_DEFINE(ENABLE_TEXT_AUTOSIZING "Toggle Text auto sizing support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_TOUCH_EVENTS "Toggle Touch Events support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_TOUCH_ICON_LOADING "Toggle Touch Icon Loading Support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_UNDO_MANAGER "Toggle Undo Manager support" OFF)
@@ -104,8 +109,8 @@ MACRO (WEBKIT_OPTION_BEGIN)
     WEBKIT_OPTION_DEFINE(ENABLE_WORKERS "Toggle Web Workers support" OFF)
     WEBKIT_OPTION_DEFINE(ENABLE_XSLT "Toggle XSLT support" ON)
     WEBKIT_OPTION_DEFINE(USE_SYSTEM_MALLOC "Toggle system allocator instead of TCmalloc" OFF)
-    WEBKIT_OPTION_DEFINE(USE_TILED_BACKING_STORE "Toggle Tiled Backing Store support" OFF)
-    WEBKIT_OPTION_DEFINE(USE_WTFURL "Toogle the use of WTFURL for URL parsing" OFF)
+    WEBKIT_OPTION_DEFINE(WTF_USE_TILED_BACKING_STORE "Toggle Tiled Backing Store support" OFF)
+    WEBKIT_OPTION_DEFINE(WTF_USE_WTFURL "Toogle the use of WTFURL for URL parsing" OFF)
 ENDMACRO ()
 
 MACRO (WEBKIT_OPTION_END)
diff --git a/Source/cmake/WebKitMacros.cmake b/Source/cmake/WebKitMacros.cmake
index 38cf34e55..ed8eb5d32 100644
--- a/Source/cmake/WebKitMacros.cmake
+++ b/Source/cmake/WebKitMacros.cmake
@@ -24,6 +24,40 @@ MACRO (ADD_SOURCE_DEPENDENCIES _source _deps)
 ENDMACRO ()
 
 
+# Helper macro which wraps generate-bindings.pl script.
+#   _output_source is a list name which will contain generated sources.(eg. WebCore_SOURCES)
+#   _input_files are IDL files to generate.
+#   _base_dir is base directory where script is called.
+#   _idl_includes is value of --include argument. (eg. --include=${WEBCORE_DIR}/bindings/js)
+#   _features is a value of --defines argument.
+#   _destination is a value of --outputDir argument.
+#   _prefix is a prefix of output files. (eg. JS - it makes JSXXX.cpp JSXXX.h from XXX.idl)
+#   _generator is a value of --generator argument.
+#   _supplemental_dependency_file is a value of --supplementalDependencyFile. (optional)
+MACRO (GENERATE_BINDINGS _output_source _input_files _base_dir _idl_includes _features _destination _prefix _generator)
+    SET(BINDING_GENERATOR ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl)
+
+    SET(_supplemental_dependency_file ${ARGN})
+    IF (_supplemental_dependency_file)
+        SET(_supplemental_dependency --supplementalDependencyFile ${_supplemental_dependency_file})
+    ENDIF ()
+
+    FOREACH (_file ${_input_files})
+        GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
+
+        ADD_CUSTOM_COMMAND(
+            OUTPUT ${_destination}/${_prefix}${_name}.cpp ${_destination}/${_prefix}${_name}.h
+            MAIN_DEPENDENCY ${_file}
+            DEPENDS ${BINDING_GENERATOR} ${SCRIPTS_BINDINGS} ${_supplemental_dependency_file}
+            COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${BINDING_GENERATOR} --defines "${_features}" --generator ${_generator} ${_idl_includes} --outputDir "${_destination}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${_supplemental_dependency} ${_file}
+            WORKING_DIRECTORY ${_base_dir}
+            VERBATIM)
+
+        LIST(APPEND ${_output_source} ${_destination}/${_prefix}${_name}.cpp)
+    ENDFOREACH ()
+ENDMACRO ()
+
+
 MACRO (GENERATE_FONT_NAMES _infile)
     SET(NAMES_GENERATOR ${WEBCORE_DIR}/dom/make_names.pl)
     SET(_arguments  --fonts ${_infile})
diff --git a/Source/cmake/gtest/CMakeLists.txt b/Source/cmake/gtest/CMakeLists.txt
new file mode 100644
index 000000000..eb123c671
--- /dev/null
+++ b/Source/cmake/gtest/CMakeLists.txt
@@ -0,0 +1,22 @@
+# This is an alternative CMakeLists.txt to the experimental one
+# shipped with the original package. It builds only the essential
+# for our tests. The WebKit version of gtest needs access to some
+# headers from WTF and JSC for configuration.
+
+INCLUDE_DIRECTORIES(${THIRDPARTY_DIR}/gtest
+    ${THIRDPARTY_DIR}/gtest/include
+    ${JAVASCRIPTCORE_DIR}
+    ${WTF_DIR}
+)
+
+SET(GTEST_DIR "${THIRDPARTY_DIR}/gtest")
+
+ADD_LIBRARY(gtest
+    ${GTEST_DIR}/src/gtest.cc
+    ${GTEST_DIR}/src/gtest-death-test.cc
+    ${GTEST_DIR}/src/gtest-filepath.cc
+    ${GTEST_DIR}/src/gtest_main.cc
+    ${GTEST_DIR}/src/gtest-port.cc
+    ${GTEST_DIR}/src/gtest-test-part.cc
+    ${GTEST_DIR}/src/gtest-typed-test.cc
+)
diff --git a/Source/cmakeconfig.h.cmake b/Source/cmakeconfig.h.cmake
index acf20edd9..515823221 100644
--- a/Source/cmakeconfig.h.cmake
+++ b/Source/cmakeconfig.h.cmake
@@ -16,16 +16,19 @@
 #cmakedefine01 ENABLE_CSP_NEXT
 #cmakedefine01 ENABLE_CSS3_FLEXBOX
 #cmakedefine01 ENABLE_CSS_BOX_DECORATION_BREAK
+#cmakedefine01 ENABLE_CSS_EXCLUSIONS
 #cmakedefine01 ENABLE_CSS_IMAGE_RESOLUTION
 #cmakedefine01 ENABLE_CSS_IMAGE_SET
+#cmakedefine01 ENABLE_CSS_REGIONS
+#cmakedefine01 ENABLE_CSS_VARIABLES
 #cmakedefine01 ENABLE_CUSTOM_SCHEME_HANDLER
 #cmakedefine01 ENABLE_DATALIST
 #cmakedefine01 ENABLE_DATA_TRANSFER_ITEMS
 #cmakedefine01 ENABLE_DETAILS
 #cmakedefine01 ENABLE_DEVICE_ORIENTATION
+#cmakedefine01 ENABLE_DIALOG_ELEMENT
 #cmakedefine01 ENABLE_DOWNLOAD_ATTRIBUTE
 #cmakedefine01 ENABLE_DRAG_SUPPORT
-#cmakedefine01 ENABLE_DRT
 #cmakedefine01 ENABLE_EVENT_MODE_METATAGS
 #cmakedefine01 ENABLE_FAST_MOBILE_SCROLLING
 #cmakedefine01 ENABLE_FILE_SYSTEM
@@ -33,6 +36,7 @@
 #cmakedefine01 ENABLE_FIXED_REPORTED_SIZE
 #cmakedefine01 ENABLE_FTPDIR
 #cmakedefine01 ENABLE_FULLSCREEN_API
+#cmakedefine01 ENABLE_GAMEPAD
 #cmakedefine01 ENABLE_GEOLOCATION
 #cmakedefine01 ENABLE_GLIB_SUPPORT
 #cmakedefine01 ENABLE_ICONDATABASE
@@ -50,6 +54,8 @@
 #cmakedefine01 ENABLE_JAVASCRIPT_DEBUGGER
 #cmakedefine01 ENABLE_JIT
 #cmakedefine01 ENABLE_LEGACY_NOTIFICATIONS
+#cmakedefine01 ENABLE_LINK_PREFETCH
+#cmakedefine01 ENABLE_LINK_PRERENDER
 #cmakedefine01 ENABLE_LEGACY_WEBKIT_BLOB_BUILDER
 #cmakedefine01 ENABLE_MATHML
 #cmakedefine01 ENABLE_MEDIA_STREAM
@@ -70,8 +76,10 @@
 #cmakedefine01 ENABLE_SHARED_WORKERS
 #cmakedefine01 ENABLE_SMOOTH_SCROLLING
 #cmakedefine01 ENABLE_SQL_DATABASE
+#cmakedefine01 ENABLE_STYLE_SCOPED
 #cmakedefine01 ENABLE_SVG
 #cmakedefine01 ENABLE_SVG_FONTS
+#cmakedefine01 ENABLE_TEXT_AUTOSIZING
 #cmakedefine01 ENABLE_TOUCH_EVENTS
 #cmakedefine01 ENABLE_TOUCH_ICON_LOADING
 #cmakedefine01 ENABLE_UNDO_MANAGER
@@ -88,5 +96,7 @@
 #cmakedefine01 ENABLE_WORKERS
 #cmakedefine01 ENABLE_XSLT
 #cmakedefine01 USE_SYSTEM_MALLOC
+#cmakedefine01 WTF_USE_TILED_BACKING_STORE
+#cmakedefine01 WTF_USE_WTFURL
 
 #endif /* CMAKECONFIG_H */
diff --git a/Source/sync.profile b/Source/sync.profile
index 8ff631ee8..c55c58871 100644
--- a/Source/sync.profile
+++ b/Source/sync.profile
@@ -6,13 +6,4 @@
 );
 %classnames = (
 );
-%mastercontent = (
-    "core" => "#include <QtCore/QtCore>\n",
-    "gui" => "#include <QtGui/QtGui>\n",
-    "network" => "#include <QtNetwork/QtNetwork>\n",
-    "script" => "#include <QtScript/QtScript>\n",
-);
-%modulepris = (
-    "QtWebKit" => "$basedir/../Tools/qmake/qt_webkit.pri",
-);
 @ignore_for_master_contents = ( "qwebscriptworld.h", "testwindow.h", "util.h", "bytearraytestdata.h" );
diff --git a/Source/tests.pri b/Source/tests.pri
index 5d2eb6b97..0042fc5fa 100644
--- a/Source/tests.pri
+++ b/Source/tests.pri
@@ -7,8 +7,6 @@
 TEMPLATE = subdirs
 CONFIG += ordered
 
-load(features)
-
 WEBKIT_TESTS_DIR = $$PWD/WebKit/qt/tests
 
 SUBDIRS += \
@@ -50,5 +48,6 @@ SUBDIRS += \
         $$WEBKIT2_TESTS_DIR/inspectorserver \
         $$WEBKIT2_TESTS_DIR/publicapi \
         $$WEBKIT2_TESTS_DIR/qquickwebview \
-        $$WEBKIT2_TESTS_DIR/qmltests
+        $$WEBKIT2_TESTS_DIR/qmltests \
+        $$WEBKIT2_TESTS_DIR/qrawwebview
 }
diff --git a/Tools/.gitignore b/Tools/.gitignore
index f53720b52..2f4adec9a 100644
--- a/Tools/.gitignore
+++ b/Tools/.gitignore
@@ -2,3 +2,5 @@ Scripts/webkitpy/thirdparty/autoinstalled
 
 # Ignore files generated by the Qt build-system:
 qmake/.build-hint
+
+Tools.sln
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/buildbot.tac b/Tools/BuildSlaveSupport/build.webkit.org-config/buildbot.tac
index 1a53acfdf..e5b45a913 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/buildbot.tac
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/buildbot.tac
@@ -2,10 +2,11 @@
 from twisted.application import service
 from buildbot.master import BuildMaster
 
-basedir = r'/buildbot/webkit'
+basedir = r'/var/buildbot'
 configfile = r'master.cfg'
-rotateLength = 1000000
-maxRotatedFiles = None
+rotateLength = 10000000
+maxRotatedFiles = 100
+umask = 022
 
 application = service.Application('buildmaster')
 try:
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index 9e57d323e..8000d5eda 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -216,8 +216,11 @@ class UploadBuiltProduct(transfer.FileUpload):
     masterdest = WithProperties("archives/%(fullPlatform)s-%(architecture)s-%(configuration)s/%(got_revision)s.zip")
     haltOnFailure = True
 
-    def __init__(self):
-        transfer.FileUpload.__init__(self, self.slavesrc, self.masterdest, mode=0644)
+    def __init__(self, **kwargs):
+        kwargs['slavesrc'] = self.slavesrc
+        kwargs['masterdest'] = self.masterdest
+        kwargs['mode'] = 0644
+        transfer.FileUpload.__init__(self, **kwargs)
 
 
 class DownloadBuiltProduct(shell.ShellCommand):
@@ -487,6 +490,13 @@ class RunBindingsTests(shell.Test):
     command = ["python", "./Tools/Scripts/run-bindings-tests"]
 
 
+class RunEflAPITests(shell.Test):
+    name = "API tests"
+    description = ["API tests running"]
+    descriptionDone = ["API tests"]
+    command = ["perl", "./Tools/Scripts/run-efl-tests", WithProperties("--%(configuration)s")]
+
+
 class RunGtkAPITests(shell.Test):
     name = "API tests"
     description = ["API tests running"]
@@ -633,8 +643,11 @@ class UploadTestResults(transfer.FileUpload):
     slavesrc = "layout-test-results.zip"
     masterdest = WithProperties("public_html/results/%(buildername)s/r%(got_revision)s (%(buildnumber)s).zip")
 
-    def __init__(self):
-        transfer.FileUpload.__init__(self, self.slavesrc, self.masterdest, mode=0644)
+    def __init__(self, **kwargs):
+        kwargs['slavesrc'] = self.slavesrc
+        kwargs['masterdest'] = self.masterdest
+        kwargs['mode'] = 0644
+        transfer.FileUpload.__init__(self, **kwargs)
 
 
 class ExtractTestResults(master.MasterShellCommand):
@@ -642,14 +655,15 @@ class ExtractTestResults(master.MasterShellCommand):
     resultDirectory = WithProperties("public_html/results/%(buildername)s/r%(got_revision)s (%(buildnumber)s)")
     descriptionDone = ["uploaded results"]
 
-    def __init__(self):
-        master.MasterShellCommand.__init__(self, "")
+    def __init__(self, **kwargs):
+        kwargs['command'] = ""
+        master.MasterShellCommand.__init__(self, **kwargs)
 
     def resultDirectoryURL(self):
         return self.build.getProperties().render(self.resultDirectory).replace("public_html/", "/") + "/"
 
     def start(self):
-        self.command = ["ditto", "-k", "-x", "-V", self.build.getProperties().render(self.zipFile), self.build.getProperties().render(self.resultDirectory)]
+        self.command = ["unzip", self.build.getProperties().render(self.zipFile), "-d", self.build.getProperties().render(self.resultDirectory)]
         return master.MasterShellCommand.start(self)
 
     def addCustomURLs(self):
@@ -671,29 +685,29 @@ class ExtractTestResultsAndLeaks(ExtractTestResults):
 class Factory(factory.BuildFactory):
     def __init__(self, platform, configuration, architectures, buildOnly):
         factory.BuildFactory.__init__(self)
-        self.addStep(ConfigureBuild, platform=platform, configuration=configuration, architecture=" ".join(architectures), buildOnly=buildOnly)
+        self.addStep(ConfigureBuild(platform=platform, configuration=configuration, architecture=" ".join(architectures), buildOnly=buildOnly))
         self.addStep(CheckOutSource())
         # There are multiple Qt slaves running on same machines, so buildslaves shouldn't kill the processes of other slaves.
         if not platform.startswith("qt"):
-            self.addStep(KillOldProcesses)
+            self.addStep(KillOldProcesses())
         if platform == "win":
-            self.addStep(InstallWin32Dependencies)
+            self.addStep(InstallWin32Dependencies())
         if platform.startswith("chromium"):
-            self.addStep(InstallChromiumDependencies)
+            self.addStep(InstallChromiumDependencies())
         if platform == "gtk":
-            self.addStep(InstallGtkDependencies)
+            self.addStep(InstallGtkDependencies())
         if platform == "efl":
-            self.addStep(InstallEflDependencies)
+            self.addStep(InstallEflDependencies())
 
 
 class BuildFactory(Factory):
     def __init__(self, platform, configuration, architectures, triggers=None):
         Factory.__init__(self, platform, configuration, architectures, True)
-        self.addStep(CompileWebKit)
+        self.addStep(CompileWebKit())
         if triggers:
-            self.addStep(ArchiveBuiltProduct)
-            self.addStep(UploadBuiltProduct)
-            self.addStep(trigger.Trigger, schedulerNames=triggers)
+            self.addStep(ArchiveBuiltProduct())
+            self.addStep(UploadBuiltProduct())
+            self.addStep(trigger.Trigger(schedulerNames=triggers))
 
 def unitTestsSupported(configuration, platform):
     if platform.startswith('mac') and configuration == "release":
@@ -710,28 +724,30 @@ class TestFactory(Factory):
     def __init__(self, platform, configuration, architectures):
         Factory.__init__(self, platform, configuration, architectures, False)
         if platform.startswith("chromium"):
-            self.addStep(CleanupChromiumCrashLogs)
-        self.addStep(DownloadBuiltProduct)
-        self.addStep(ExtractBuiltProduct)
+            self.addStep(CleanupChromiumCrashLogs())
+        self.addStep(DownloadBuiltProduct())
+        self.addStep(ExtractBuiltProduct())
         if not platform.startswith("chromium"):
-            self.addStep(RunJavaScriptCoreTests, buildJSCTool=False)
+            self.addStep(RunJavaScriptCoreTests(buildJSCTool=False))
         if platform.startswith("chromium"):
-            self.addStep(RunChromiumWebKitUnitTests)
-        self.addStep(self.TestClass, buildJSCTool=(platform != 'win'))
+            self.addStep(RunChromiumWebKitUnitTests())
+        self.addStep(self.TestClass(buildJSCTool=(platform != 'win')))
 
         if unitTestsSupported(configuration, platform): 
-            self.addStep(RunUnitTests)
-        self.addStep(RunPythonTests)
+            self.addStep(RunUnitTests())
+        self.addStep(RunPythonTests())
         # Chromium Win runs in non-Cygwin environment, which is not yet fit
         # for running tests. This can be removed once bug 48166 is fixed.
         if platform != "chromium-win":
-            self.addStep(RunPerlTests)
-            self.addStep(RunBindingsTests)
-        self.addStep(ArchiveTestResults)
-        self.addStep(UploadTestResults)
-        self.addStep(self.ExtractTestResultsClass)
+            self.addStep(RunPerlTests())
+            self.addStep(RunBindingsTests())
+        self.addStep(ArchiveTestResults())
+        self.addStep(UploadTestResults())
+        self.addStep(self.ExtractTestResultsClass())
+        if platform == "efl":
+            self.addStep(RunEflAPITests)
         if platform == "gtk":
-            self.addStep(RunGtkAPITests)
+            self.addStep(RunGtkAPITests())
         if platform.startswith("qt"):
             self.addStep(RunQtAPITests)
 
@@ -742,31 +758,33 @@ class BuildAndTestFactory(Factory):
         Factory.__init__(self, platform, configuration, architectures, False, **kwargs)
         if platform.startswith("chromium"):
             self.addStep(CleanupChromiumCrashLogs)
-        self.addStep(CompileWebKit)
+        self.addStep(CompileWebKit())
         if not platform.startswith("chromium"):
-            self.addStep(RunJavaScriptCoreTests)
+            self.addStep(RunJavaScriptCoreTests())
         if platform.startswith("chromium"):
             self.addStep(RunChromiumWebKitUnitTests)
-        self.addStep(self.TestClass)
+        self.addStep(self.TestClass())
         if unitTestsSupported(configuration, platform): 
-            self.addStep(RunUnitTests)
-        self.addStep(RunPythonTests)
+            self.addStep(RunUnitTests())
+        self.addStep(RunPythonTests())
         # Chromium Win runs in non-Cygwin environment, which is not yet fit
         # for running tests. This can be removed once bug 48166 is fixed.
         if platform != "chromium-win":
-            self.addStep(RunPerlTests)
-            self.addStep(RunBindingsTests)
-        self.addStep(ArchiveTestResults)
-        self.addStep(UploadTestResults)
-        self.addStep(self.ExtractTestResultsClass)
+            self.addStep(RunPerlTests())
+            self.addStep(RunBindingsTests())
+        self.addStep(ArchiveTestResults())
+        self.addStep(UploadTestResults())
+        self.addStep(self.ExtractTestResultsClass())
+        if platform == "efl":
+            self.addStep(RunEflAPITests)
         if platform == "gtk":
-            self.addStep(RunGtkAPITests)
+            self.addStep(RunGtkAPITests())
         if platform.startswith("qt"):
-            self.addStep(RunQtAPITests)
+            self.addStep(RunQtAPITests())
         if triggers:
-            self.addStep(ArchiveBuiltProduct)
-            self.addStep(UploadBuiltProduct)
-            self.addStep(trigger.Trigger, schedulerNames=triggers)
+            self.addStep(ArchiveBuiltProduct())
+            self.addStep(UploadBuiltProduct())
+            self.addStep(trigger.Trigger(schedulerNames=triggers))
 
 class BuildAndTestLeaksFactory(BuildAndTestFactory):
     TestClass = RunWebKitLeakTests
@@ -781,23 +799,23 @@ class BuildAndPerfTestFactory(Factory):
         Factory.__init__(self, platform, configuration, architectures, False, **kwargs)
         if platform.startswith("chromium"):
             self.addStep(CleanupChromiumCrashLogs)
-        self.addStep(CompileWebKit)
-        self.addStep(RunAndUploadPerfTests)
+        self.addStep(CompileWebKit())
+        self.addStep(RunAndUploadPerfTests())
 
 class BuildAndPerfTestWebKit2Factory(Factory):
     def __init__(self, platform, configuration, architectures, **kwargs):
         Factory.__init__(self, platform, configuration, architectures, False, **kwargs)
         if platform.startswith("chromium"):
             self.addStep(CleanupChromiumCrashLogs)
-        self.addStep(CompileWebKit)
-        self.addStep(RunAndUploadPerfTestsWebKit2)
+        self.addStep(CompileWebKit())
+        self.addStep(RunAndUploadPerfTestsWebKit2())
 
 class DownloadAndPerfTestFactory(Factory):
     def __init__(self, platform, configuration, architectures, **kwargs):
         Factory.__init__(self, platform, configuration, architectures, False, **kwargs)
-        self.addStep(DownloadBuiltProduct)
-        self.addStep(ExtractBuiltProduct)
-        self.addStep(RunAndUploadPerfTests)
+        self.addStep(DownloadBuiltProduct())
+        self.addStep(ExtractBuiltProduct())
+        self.addStep(RunAndUploadPerfTests())
 
 class DownloadAndPerfTestWebKit2Factory(Factory):
     def __init__(self, platform, configuration, architectures, **kwargs):
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py b/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
index 101451fc9..813ff22d6 100755
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
@@ -328,6 +328,29 @@ Tests that timed out:
 """)
 
 
+class BuildStepsConstructorTest(unittest.TestCase):
+    # "Passing a BuildStep subclass to factory.addStep is deprecated. Please pass a BuildStep instance instead.  Support will be dropped in v0.8.7."
+    # It checks if all builder's all buildsteps can be insantiated after migration.
+    # https://bugs.webkit.org/show_bug.cgi?id=89001
+    # http://buildbot.net/buildbot/docs/0.8.6p1/manual/customization.html#writing-buildstep-constructors
+
+    @staticmethod
+    def generateTests():
+        for builderNumber, builder in enumerate(c['builders']):
+            for stepNumber, step in enumerate(builder['factory'].steps):
+                builderName = builder['name'].encode('ascii', 'ignore')
+                setattr(BuildStepsConstructorTest, 'test_builder%02d_step%02d' % (builderNumber, stepNumber), BuildStepsConstructorTest.createTest(builderName, step))
+
+    @staticmethod
+    def createTest(builderName, step):
+        def doTest(self):
+            try:
+                buildStepFactory, kwargs = step
+                buildStepFactory(**kwargs)
+            except TypeError as e:
+                buildStepName = str(buildStepFactory).split('.')[-1]
+                self.fail("Error during instantiation %s buildstep for %s builder: %s\n" % (buildStepName, builderName, e))
+        return doTest
 
 # FIXME: We should run this file as part of test-webkitpy.
 # Unfortunately test-webkitpy currently requires that unittests
@@ -336,4 +359,5 @@ Tests that timed out:
 # so for now this is a stand-alone test harness.
 if __name__ == '__main__':
     BuildBotConfigLoader().load_config('master.cfg')
+    BuildStepsConstructorTest.generateTests()
     unittest.main()
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
index b0a6836cb..6c405ed17 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js
@@ -67,9 +67,6 @@ config.kPlatforms = {
             'Webkit Linux': {version: 'lucid', is64bit: true},
             'Webkit Linux 32': {version: 'lucid'},
             'Webkit Linux (dbg)': {version: 'lucid', is64bit: true, debug: true},
-            'Webkit Mac10.5': {version: 'leopard'},
-            'Webkit Mac10.5 (dbg)(1)': {version: 'leopard', debug: true},
-            'Webkit Mac10.5 (dbg)(2)': {version: 'leopard', debug: true},
             'Webkit Mac10.6': {version: 'snowleopard'},
             'Webkit Mac10.6 (dbg)': {version: 'snowleopard', debug: true},
             'Webkit Mac10.7': {version: 'lion'},
@@ -113,6 +110,27 @@ config.kPlatforms = {
             return builderName.indexOf('GTK') != -1;
         },
     },
+    'qt' : {
+        label : 'Qt',
+        buildConsoleURL: 'http://build.webkit.org',
+        layoutTestResultsURL: 'http://build.webkit.org/results',
+        waterfallURL: 'http://build.webkit.org/waterfall',
+        builders: {
+            'Qt Linux Release' : {version : '32-bit release'},
+        },
+        haveBuilderAccumulatedResults : false,
+        useDirectoryListingForOldBuilds: false,
+        useFlakinessDashboard: false,
+        resultsDirectoryNameFromBuilderName: function(builderName) {
+            return encodeURIComponent(builderName);
+        },
+        resultsDirectoryForBuildNumber: function(buildNumber, revision) {
+            return encodeURIComponent('r' + revision + ' (' + buildNumber + ')');
+        },
+        builderApplies: function(builderName) {
+            return builderName.indexOf('Qt') != -1;
+        },
+    },
 };
 
 config.kTracURL = 'http://trac.webkit.org';
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js
index 0a4baae9c..a5fa5643a 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js
@@ -27,23 +27,54 @@ var net = net || {};
 
 (function () {
 
-net.post = $.post;
-net.get = $.get;
-net.ajax = $.ajax;
+// FIXME: Excise this last bit of jquery ajax code.
+// There are callers that depend on automatically parsing the content as JSON or XML
+// based off the content-type. Instead we should add net.json and net.xml for those cases.
+net.get = function(url, success)
+{
+    $.get(url, success);
+};
+
+net.ajax = function(options)
+{
+    var xhr = new XMLHttpRequest();
+    var method = options.type || 'GET';
+    var async = true;
+    xhr.open(method, options.url, async);
+    xhr.onload = function() {
+        if (xhr.status == 200 && options.success)
+            options.success(xhr.responseText);
+        else if (xhr.status != 200 && options.error)
+            options.error();
+    };
+    xhr.onerror = function() {
+        if (options.error)
+            options.error();
+    };
+    var data = options.data || null;
+    if (data)
+        xhr.setRequestHeader("content-type","application/x-www-form-urlencoded");
+    xhr.send(data);
+};
+
+net.post = function(url, data, success)
+{
+    net.ajax({
+        url: url,
+        type: 'POST',
+        data: data,
+        success: success,
+    });
+
+};
 
 net.probe = function(url, options)
 {
-    $.ajax({
+    net.ajax({
         url: url,
         type: 'HEAD',
-        success: function() {
-            if (options.success)
-                options.success.call();
-        },
-        error: function() {
-            if (options.error)
-                options.error.call();
-        },
+        success: options.success,
+        error: options.error,
     });
 };
 
@@ -52,12 +83,12 @@ net.probe = function(url, options)
 // by setting CORS headers.
 net.jsonp = function(url, callback)
 {
-    $.ajax({
+    net.ajax({
         url: url,
         success: function(jsonp) {
             callback(base.parseJSONP(jsonp));
         },
-        error: function(request, textStatus, errorThrown) {
+        error: function() {
             callback({});
         },
     });
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures_unittests.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures_unittests.js
index 7e5197e63..0d14c28a5 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures_unittests.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures_unittests.js
@@ -93,13 +93,13 @@ test('FailureGrid', 10, function() {
             '<tr class="BUILDING" style="display: none; "><td><span>BUILDING</span></td><td></td><td></td></tr>' +
         '</tbody>' +
     '</table>');
-    grid.update({'Webkit Mac10.5': { actual: 'IMAGE+TEXT'}});
+    grid.update({'Webkit Mac10.6': { actual: 'IMAGE+TEXT'}});
     equal(grid.outerHTML, '<table class="failures">' +
         '<thead><tr><td>type</td><td>release</td><td>debug</td></tr></thead>' +
         '<tbody>' +
             '<tr class="IMAGE+TEXT">' +
                 '<td><span>IMAGE+TEXT</span></td>' +
-                '<td><a class="failing-builder" target="_blank" href="http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.5"><span class="version">leopard</span></a></td>' +
+                '<td><a class="failing-builder" target="_blank" href="http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.6"><span class="version">snowleopard</span></a></td>' +
                 '<td></td>' +
             '</tr>' +
             '<tr class="TEXT" style="">' +
@@ -110,13 +110,13 @@ test('FailureGrid', 10, function() {
             '<tr class="BUILDING" style="display: none; "><td><span>BUILDING</span></td><td></td><td></td></tr>' +
         '</tbody>' +
     '</table>');
-    grid.update({'Webkit Mac10.5': { actual: 'IMAGE+TEXT'}});
+    grid.update({'Webkit Mac10.6': { actual: 'IMAGE+TEXT'}});
     equal(grid.outerHTML, '<table class="failures">' +
         '<thead><tr><td>type</td><td>release</td><td>debug</td></tr></thead>' +
         '<tbody>' +
             '<tr class="IMAGE+TEXT" style="">' +
                 '<td><span>IMAGE+TEXT</span></td>' +
-                '<td><a class="failing-builder" target="_blank" href="http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.5"><span class="version">leopard</span></a></td>' +
+                '<td><a class="failing-builder" target="_blank" href="http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.6"><span class="version">snowleopard</span></a></td>' +
                 '<td></td>' +
             '</tr>' +
             '<tr class="TEXT" style="">' +
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/notifications_unittests.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/notifications_unittests.js
index ba2d98be2..f86930568 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/notifications_unittests.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/notifications_unittests.js
@@ -240,7 +240,7 @@ test('FailingTestsSummary', 12, function() {
             '</ul>' +
         '</div>');
 
-    testFailures.updateBuilderResults({'Webkit Mac10.5': { actual: 'BUILDING'}});
+    testFailures.updateBuilderResults({'Webkit Mac10.6': { actual: 'BUILDING'}});
     equal(testFailures.innerHTML,
         '<div class="how">' +
             '<time class="relative">10 minutes ago</time>' +
@@ -254,7 +254,7 @@ test('FailingTestsSummary', 12, function() {
                     '</tr>' +
                     '<tr class="BUILDING" style="">' +
                         '<td><span>BUILDING</span></td>' +
-                        '<td><a class="failing-builder" target="_blank" href="http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.5"><span class="version">leopard</span></a></td>' +
+                        '<td><a class="failing-builder" target="_blank" href="http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.6"><span class="version">snowleopard</span></a></td>' +
                         '<td></td>' +
                     '</tr>' +
                 '</tbody>' +
diff --git a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui_unittests.js b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui_unittests.js
index a86177d63..74de3e41c 100644
--- a/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui_unittests.js
+++ b/Tools/BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui_unittests.js
@@ -54,7 +54,7 @@ test("ui.onebar", 3, function() {
     onebar = new ui.onebar();
     onebar.attach();
     equal(onebar.innerHTML,
-        '<div><select id="platform-picker"><option>Apple</option><option>Chromium</option><option>GTK</option></select></div>' +
+        '<div><select id="platform-picker"><option>Apple</option><option>Chromium</option><option>GTK</option><option>Qt</option></select></div>' +
         '<ul class="ui-tabs-nav ui-helper-reset ui-helper-clearfix ui-widget-header ui-corner-all">' +
             '<li class="ui-state-default ui-corner-top ui-tabs-selected ui-state-active"><a href="#unexpected">Unexpected Failures</a></li>' +
             '<li class="ui-state-default ui-corner-top"><a href="#expected">Expected Failures</a></li>' +
diff --git a/Tools/BuildSlaveSupport/built-product-archive b/Tools/BuildSlaveSupport/built-product-archive
index 67f2da365..ae67e21b7 100644
--- a/Tools/BuildSlaveSupport/built-product-archive
+++ b/Tools/BuildSlaveSupport/built-product-archive
@@ -144,10 +144,10 @@ def archiveBuiltProduct(configuration, platform):
         if platform == 'qt' or platform == 'efl':
             neededDirectories = ["bin", "lib"]
         elif platform == 'gtk':
-            neededDirectories = ["Programs", ".libs"]
+            neededDirectories = ["Programs", ".libs", "Libraries"]
 
         for dirname in neededDirectories:
-            fromDir = os.path.join(configurationBuildDirectory, dirname, "*")
+            fromDir = os.path.join(configurationBuildDirectory, dirname, ".")
             toDir = os.path.join(thinDirectory, dirname)
             os.makedirs(toDir)
             if subprocess.call('cp -R %s %s' % (fromDir, toDir), shell=True):
@@ -166,7 +166,8 @@ def archiveBuiltProduct(configuration, platform):
 
         removeDirectoryIfExists(thinDirectory)
         copyBuildFiles(configurationBuildDirectory, thinDirectory,
-            ['.svn', '*.a', '*.d', '*.dSYM', '*.o', '*.ilk', '*.lib', '*.idb', 'BuildLog.htm', '*.obj', '*.pdb'])
+            ['.svn', '*.a', '*.d', '*.dSYM', '*.o', '*.ilk', '*.lib', '*.idb', 'BuildLog.htm', '*.obj',
+            '*.pdb', '*.pch', '*.tlog', '*.lastbuildstate'])
         if createZip(thinDirectory, configuration):
             return 1
 
diff --git a/Tools/BuildSlaveSupport/gtk/daemontools-buildbot.conf b/Tools/BuildSlaveSupport/gtk/daemontools-buildbot.conf
index 31a6d6394..06af29f7b 100644
--- a/Tools/BuildSlaveSupport/gtk/daemontools-buildbot.conf
+++ b/Tools/BuildSlaveSupport/gtk/daemontools-buildbot.conf
@@ -40,5 +40,6 @@ ccache_path="/usr/lib/ccache"
 #
 env_CFLAGS="-pipe"
 env_CXXFLAGS="-pipe"
+env_LDFLAGS="-no-install -no-fast-install"
 env_WEBKIT_TESTFONTS="/home/${buildbot_user}/testfonts"
 
diff --git a/Tools/CMakeLists.txt b/Tools/CMakeLists.txt
index ea7521841..e9fc7e3bd 100644
--- a/Tools/CMakeLists.txt
+++ b/Tools/CMakeLists.txt
@@ -1,3 +1,7 @@
+IF (ENABLE_WEBKIT2)
+    ADD_SUBDIRECTORY(WebKitTestRunner)
+ENDIF ()
+
 IF ("${PORT}" STREQUAL "Efl")
     IF (ENABLE_WEBKIT)
         ADD_SUBDIRECTORY(DumpRenderTree/efl)
diff --git a/Tools/ChangeLog b/Tools/ChangeLog
index 1dc9b1808..8f8d602ef 100644
--- a/Tools/ChangeLog
+++ b/Tools/ChangeLog
@@ -1,9 +1,1739 @@
-2012-06-19  Joel Dillon <joel.dillon@codethink.co.uk>  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+2012-07-11  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        First commit; moving myself to commiters.
+
+        Unreviewed.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-07-11  Balazs Ankes  <bank@inf.u-szeged.hu>
+
+        webkit-patch land should automatically add svn:mime-type for .png files
+        https://bugs.webkit.org/show_bug.cgi?id=75825
+
+        Reviewed by Dirk Pranke.
+
+        Refactor the png.py to avoid code duplication.
+
+        * Scripts/webkitpy/common/checksvnconfigfile.py: Added.
+        (check):
+        (config_file_path):
+        (errorstr_autoprop):
+        (errorstr_png):
+        * Scripts/webkitpy/style/checkers/png.py:
+        (PNGChecker.check):
+        * Scripts/webkitpy/tool/commands/download.py:
+        (Land):
+        * Scripts/webkitpy/tool/steps/__init__.py:
+        * Scripts/webkitpy/tool/steps/addsvnmimetypeforpng.py: Added.
+        (AddSvnMimetypeForPng):
+        (AddSvnMimetypeForPng.__init__):
+        (AddSvnMimetypeForPng.run):
+        (AddSvnMimetypeForPng._check_pngs):
+        * Scripts/webkitpy/tool/steps/addsvnmimetypeforpng_unittest.py: Added.
+        (MockSCMDetector):
+        (MockSCMDetector.__init__):
+        (MockSCMDetector.display_name):
+        (AddSvnMimetypeForPngTest):
+        (AddSvnMimetypeForPngTest.test_run):
+
+2012-07-11  Hayato Ito  <hayato@chromium.org>
+
+        Unreviewed gardening.
+        One more fix for r122292.
+
+        * TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp:
+
+2012-07-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122301.
+        http://trac.webkit.org/changeset/122301
+        https://bugs.webkit.org/show_bug.cgi?id=90947
+
+        Android builder started to fail (Requested by hayato on
+        #webkit).
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] Merge final nits to DumpRenderTree.gyp for Android
+        https://bugs.webkit.org/show_bug.cgi?id=90920
+
+        Reviewed by Tony Chang.
+
+        This patch contains the last few small changes to DumpRenderTree.gyp
+        from the chromium-android branch. After this change, this file will be
+        fully merged.
+
+        * DumpRenderTree/DumpRenderTree.gyp/DumpRenderTree.gyp:
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        [Chromium-Android] Add apk test targets for webkit_unit_tests and TestWebKitAPI
+        https://bugs.webkit.org/show_bug.cgi?id=90918
+
+        Reviewed by Tony Chang.
+
+        The rules are similar to what we have added for DumpRenderTree apk.
+        All references to gtest_target_type can be removed once we enable APK
+        tests on the all bots.
+
+        * TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp:
+
+2012-07-10  Kenneth Russell  <kbr@google.com>
+
+        Add --no-build option to perf test runner
+        https://bugs.webkit.org/show_bug.cgi?id=90916
+
+        Reviewed by Ryosuke Niwa.
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner._parse_args):
+            Support --no-build option to perf tests, as in layout tests.
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        EWSTools should be able to build a chromium-ews bot from scratch
+        https://bugs.webkit.org/show_bug.cgi?id=90912
+
+        Reviewed by Eric Seidel.
+
+        I've been using this script to kick off the build process for the
+        chromium-ews bots on Google Compute Engine.
+
+        * EWSTools/GoogleComputeEngine: Added.
+        * EWSTools/GoogleComputeEngine/build-chromium-ews.sh: Added.
+
+2012-07-10  Alec Flett  <alecflett@chromium.org>
+
+        Add alecflett to the list of committers
+        https://bugs.webkit.org/show_bug.cgi?id=90903
+
+        Reviewed by Ojan Vafai.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-07-10  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        Unreviewed fix of webkitpy unittest break about chromium_android.py
+        caused by r122251.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidDriverTest.test_cmd_line):
+
+2012-07-10  Ojan Vafai  <ojan@chromium.org>
+
+        webkit-patch rebaseline doesn't work for audio/pixel tests
+        https://bugs.webkit.org/show_bug.cgi?id=90905
+
+        Reviewed by Adam Barth.
+
+        We just need to pass the correct suffix list to rebaseline-test-internal
+        and optimize-baselines. By default, pass all suffixes.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (Rebaseline):
+        (Rebaseline.__init__):
+        (Rebaseline._suffixes_to_update):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline_multiple_builders_and_tests_command_line):
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        Remove LayoutTestController and WebKitTestRunner support for Hixie76 WebSockets
+        https://bugs.webkit.org/show_bug.cgi?id=90853
+
+        Reviewed by Eric Seidel.
+
+        WebKit no longer implements the Hixie76 version of the WebSocket
+        protocol. We don't need to support it in our test framework.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset):
+        (WebPreferences::applyTo):
+        * DumpRenderTree/chromium/WebPreferences.h:
+        (WebPreferences):
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::WebPage::resetSettings):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::overridePreference):
+        * DumpRenderTree/win/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+
+2012-07-10  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Fix typos in chromium_android.py in r151492
+        https://bugs.webkit.org/show_bug.cgi?id=90904
+
+        Reviewed by Ojan Vafai.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.setup_test_run):
+
+2012-07-10  Xianzhu Wang  <wangxianzhu@chromium.org>
+
+        [Chromium-Android] Use setup_test_runner() instead of start_helper() to setup test environment
+        https://bugs.webkit.org/show_bug.cgi?id=90894
+
+        Reviewed by Adam Barth.
+
+        start_helper() is actually start_pixel_test_helper() since r115601 (bug 81729).
+        Should use setup_test_runner() to setup test environment for chromium-android.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.setup_test_run): Renamed from start_helper(). Added cache cleanup code.
+        (ChromiumAndroidPort.clean_up_test_run): Renamed from stop_helper().
+        (ChromiumAndroidPort._path_to_helper): Returns None as we don't have a helper now.
+        (ChromiumAndroidPort):
+        (ChromiumAndroidPort._path_to_forwarder): Original _path_to_helper().
+        (ChromiumAndroidPort._push_executable):
+        (ChromiumAndroidDriver.__init__):
+        (ChromiumAndroidDriver.cmd_line):
+
+2012-07-09  Ojan Vafai  <ojan@chromium.org>
+
+        Improve webkit-patch rebaseline to work for more cases
+        https://bugs.webkit.org/show_bug.cgi?id=90504
+
+        Reviewed by Adam Barth.
+
+        -Makes it work for the build.chromium.org bots.
+        -Lets you rebaseline all builders instead of just one.
+        -Lets you pass in the builders or tests to rebaseline.
+
+        * Scripts/webkitpy/common/host.py:
+        (Host.buildbot_for_builder_name):
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        (Builder.__init__):
+        (Builder.latest_layout_test_results):
+        Provide a way to get to the LayoutTestResults of the latest build.
+        Most of the time we only need to get the latest one and the Chromium bots
+        only expose the full_results.json file for the latest build.
+
+        (Builder):
+        (Builder._fetch_file_from_results):
+        (Builder.fetch_layout_test_results):
+        Move these functions into Builder so that Builder and Build can both
+        fetch layout test results.
+
+        (Build.results_zip_url):
+        (Build.layout_test_results):
+        * Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py:
+        (BuilderTest.test_latest_layout_test_results):
+        (BuildTest.test_layout_test_results):
+        * Scripts/webkitpy/common/system/user.py:
+        (User.prompt_with_multiple_lists):
+        Prompt with multiple sublists, but still have a global numbering.
+        This lets the build.chromium.org bots be clearly separated from the
+        build.webkit.org bots, which helps understand the builder names.
+
+        (User):
+        (User._wait_on_list_response):
+        (User.prompt_with_list):
+        * Scripts/webkitpy/common/system/user_unittest.py:
+        (UserTest.test_prompt_with_multiple_lists):
+        (UserTest.test_prompt_with_multiple_lists.run_prompt_test):
+        (UserTest.test_prompt_with_multiple_lists.run_prompt_test.mock_raw_input):
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.is_chromium):
+        Provide a way to tell if a port is a Chromium port that doesn't involve string
+        manipulation on the port name or builder name.
+
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        (builder_path_from_name):
+        (all_builder_names):
+        Memoizing here is incorrect because the test override _exact_matches,
+        so these can return different values. In either case, I'm pretty sure these
+        are not remotely hot codepaths. I manually inspected all call sites and they're
+        all in high-level calls (e.g. execute calls for webkit-patch commands) and not
+        called in a loop.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort.is_chromium):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineTest._results_url):
+        (AbstractParallelRebaselineCommand.__init__):
+        (Rebaseline.__init__):
+        (Rebaseline):
+        (Rebaseline._builders_to_pull_from):
+        (Rebaseline._tests_to_update):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline.mock_builders_to_pull_from):
+        (test_rebaseline):
+        (test_rebaseline_command_line_flags):
+        (test_rebaseline_multiple_builders):
+        (test_rebaseline_multiple_builders.mock_builders_to_pull_from):
+        (test_rebaseline_multiple_builders.mock_tests_to_update):
+        (test_rebaseline_multiple_builders_and_tests_command_line):
+        * Scripts/webkitpy/tool/mocktool.py:
+        (MockTool.irc):
+        (MockTool):
+        (MockTool.buildbot_for_builder_name):
+
+2012-07-10  Alice Cheng  <alice_cheng@apple.com>
+
+        Editing: Reproducible crasher when pasting a 0x0 image into Mail
+        https://bugs.webkit.org/show_bug.cgi?id=90640
+        <rdar://problem/11141920>
+
+        Reviewed by Brady Eidson.
+
+        Test cases for the patch. 0x0 images don't get a resource representation in the WebArchive, so we need a null check.
+
+        * TestWebKitAPI/Tests/mac/0.png: Added.
+        * TestWebKitAPI/Tests/mac/WebViewCanPasteZeroPng.mm: Added.
+        (TestWebKitAPI):
+        (TestWebKitAPI::TEST):
+
+2012-07-10  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        WebSurroundingText layout tests should use the same code path as the rest of the feature.
+        https://bugs.webkit.org/show_bug.cgi?id=90807
+
+        Reviewed by Adam Barth.
+
+        Make the textSurroundingNode method take a pair of point coordinates
+        instead of a node offset.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::textSurroundingNode):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController):
+
+2012-07-10  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] REGRESSION(r122175): It broke the Windows build
+        https://bugs.webkit.org/show_bug.cgi?id=90850
+
+        Reviewed by Noam Rosenthal.
+
+        * qmake/mkspecs/features/features.prf: Disable USE(3D_GRAPHICS) on Windows temporarily until proper fix.
+
+2012-07-10  János Badics  <jbadics@inf.u-szeged.hu>
+
+        [Qt][NRWT] Enable cascaded TestExpectations
+        https://bugs.webkit.org/show_bug.cgi?id=89108
+
+        Reviewed by Dirk Pranke.
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort.expectations_files):
+        * Scripts/webkitpy/layout_tests/port/qt_unittest.py:
+        (QtPortTest._assert_expectations_files):
+        (QtPortTest.test_expectations_files):
+
+2012-07-10  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] WebKit DRT and WTR fail to build due to undefined reference to WTF::MD5::*
+        https://bugs.webkit.org/show_bug.cgi?id=90868
+
+        Unreviewed EFL build fix.
+
+        Correct CMake configuration to have EFL's DRT and WebKitTestRunner link
+        WTF library. This is needed to resolve undefined reference to WTF::MD5::*.
+
+        * DumpRenderTree/efl/CMakeLists.txt:
+        * WebKitTestRunner/PlatformEfl.cmake:
+
+2012-07-10  Adam Barth  <abarth@webkit.org>
+
+        LayoutTestController.dumpConfigurationForViewport should move to Internals
+        https://bugs.webkit.org/show_bug.cgi?id=45652
+
+        Reviewed by Eric Seidel.
+
+        Remove dumpConfigurationForViewport from LayoutTestController. This API
+        has been replaced by an API on Internals that does the same thing in a
+        port-agnostic way.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController):
+        * DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp:
+        * DumpRenderTree/efl/LayoutTestControllerEfl.cpp:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        (LayoutTestController):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-09  Kent Tamura  <tkent@chromium.org>
+
+        Improve the boilerplate generated by prepare-ChangeLog
+        https://bugs.webkit.org/show_bug.cgi?id=89560
+
+        Reviewed by Ryosuke Niwa.
+
+        Produce the following boilerplate:
+
+        > 2012-06-20  Kent Tamura  <tkent@chromium.org>
+        >
+        >         Need a short description (Oops!).
+        >         Need the bug URL (Oops!).
+        >
+        >         Reviewed by NOBODY (Oops!).
+        >
+        >         Additional information of the change such as approach, rationale. Please add per-function descriptions below. (Oops!).
+        >
+        >         No new tests (Oops!).
+
+        * Scripts/prepare-ChangeLog:
+        (generateNewChangeLogs): Generate the updated template.
+        * Scripts/webkitpy/common/checkout/changelog.py:
+        (ChangeLog.update_with_unreviewed_message):
+        Update the pattern for the beginning of the boilerplate.
+        (ChangeLog.set_short_description_and_bug_url):
+        - Use self._changelog_indent
+        - Update the pattern for the description line
+        - Skip the bug boilerplate.
+        We substitute the specified bug URL to the description boilerplate
+        because we need to add it even if the bug URL boilerplate is missing.
+        * Scripts/webkitpy/common/checkout/changelog_unittest.py: Update the boilerplate data.
+        (test_set_short_description_and_bug_url):
+        - Update the description boilerplate.
+        - Add a test for a case with both of the description boilerplace and the
+          bug URL boilerplate.
+        * Scripts/webkitpy/tool/steps/preparechangelog_unittest.py:
+        (PrepareChangeLogTest.test_ensure_bug_url): Update the expected boilerplate.
+
+2012-07-09  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Shared code that is guarded with ENABLE(WEBGL) should be guarded with USE()
+        https://bugs.webkit.org/show_bug.cgi?id=90506
+
+        Reviewed by Martin Robinson.
+
+        Always enable the WTF_USE_3D_GRAPHICS flag in features.prf if we're compiling with Qt5
+        or if the OpenGL module is enabled.
+
+        * qmake/mkspecs/features/features.prf:
+
+2012-07-09  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Consider closing unused localStorage database after a timeout.
+        https://bugs.webkit.org/show_bug.cgi?id=90713
+
+        For a localStorage, if there is no active document referencing to it for certain amount of time (300 seconds),
+        we can close the underlying sqlite database.
+
+        Reviewed by Brady Eidson.
+
+        * DumpRenderTree/LayoutTestController.cpp: add a JS method setStorageDatabaseIdleInterval to testRunner
+            to set a different timeout value for closing localStorage database.
+        (setStorageDatabaseIdleIntervalCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        (LayoutTestController):
+        * DumpRenderTree/efl/LayoutTestControllerEfl.cpp:
+        (LayoutTestController::setStorageDatabaseIdleInterval): add empty method.
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setStorageDatabaseIdleInterval): ditto.
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::setStorageDatabaseIdleInterval): ditto.
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::setStorageDatabaseIdleInterval): ditto.
+
+2012-07-09  Adam Klein  <adamk@chromium.org>
+
+        Rename WebCore::WebKitMutationObserver to WebCore::MutationObserver
+        https://bugs.webkit.org/show_bug.cgi?id=90810
+
+        Reviewed by Ojan Vafai.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+
+2012-07-09  Mihai Parparita  <mihaip@chromium.org>
+
+        Handle missing results in TestResultsServer better
+        https://bugs.webkit.org/show_bug.cgi?id=90816
+
+        Reviewed by Ojan Vafai.
+
+        If we can't load the results JSON, don't try to wrap it with the JSONP
+        callback invocation.
+
+        * TestResultServer/handlers/testfilehandler.py:
+        (GetFile.get):
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122124.
+        http://trac.webkit.org/changeset/122124
+        https://bugs.webkit.org/show_bug.cgi?id=90815
+
+        It broke NRWT on Qt (Requested by Ossy_HOME on #webkit).
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort._skipped_file_search_paths):
+        * Scripts/webkitpy/layout_tests/port/qt_unittest.py:
+        (QtPortTest._assert_skipped_path):
+        (QtPortTest.test_skipped_file_search_path):
+
+2012-07-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Implement dumpFrameScrollPosition in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=89356
+
+        Reviewed by Martin Robinson.
+
+        Implement dumpFrameScrollPosition, acquiring the scroll position
+        through WebKitDOMDOMWindow of the WebKitDOMDocument loaded in the frame
+        whose scroll position is being dumped.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (dumpFrameScrollPosition):
+
+2012-07-09  János Badics  <jbadics@inf.u-szeged.hu>
+
+        [Qt][NRWT] Enable cascaded TestExpectations
+        https://bugs.webkit.org/show_bug.cgi?id=89108
+
+        Reviewed by Dirk Pranke.
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort.expectations_files):
+        * Scripts/webkitpy/layout_tests/port/qt_unittest.py:
+        (QtPortTest._assert_expectations_files):
+        (QtPortTest.test_expectations_files):
+
+2012-07-09  Dan Bernstein  <mitz@apple.com>
+
+        Fixed clean builds of the All target in the DumpRenderTree project.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj: Let Xcode know that the
+        DumpRenderTree Perl Support target depends on the DumpRenderTree target.
+
+2012-07-09  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Unskip the CSS Regions layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=90771
+
+        Reviewed by Martin Robinson.
+
+        Use the DumpRenderTreeSupportGtk method for enabling the CSS Regions,
+        calling it when resetting the defaults in DumpRenderTree or when the
+        settings value is overriden through the testRunner.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::overridePreference):
+
+2012-07-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r122107.
+        http://trac.webkit.org/changeset/122107
+        https://bugs.webkit.org/show_bug.cgi?id=90794
+
+        Build failure on Mac debug bots (Requested by falken_ on
+        #webkit).
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-09  Matt Falkenhagen  <falken@chromium.org>
+
+        Add ENABLE_DIALOG_ELEMENT and skeleton files
+        https://bugs.webkit.org/show_bug.cgi?id=90521
+
+        Reviewed by Kent Tamura.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-08  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, rolling out r122076.
+        http://trac.webkit.org/changeset/122076
+        https://bugs.webkit.org/show_bug.cgi?id=89560
+
+        Broke sheriffbot rollout
+
+        * Scripts/prepare-ChangeLog:
+        (generateNewChangeLogs):
+
+2012-07-08  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Update the description of LayoutTestController::textSurroundingElement
+        https://bugs.webkit.org/show_bug.cgi?id=90620
+
+        Reviewed by Adam Barth.
+
+        Rename and fix the description of the method as its behaviour changed
+        during the review of https://bugs.webkit.org/show_bug.cgi?id=82461
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::textSurroundingNode):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController):
+
+2012-07-08  Kent Tamura  <tkent@chromium.org>
+
+        Improve the template generated by prepare-ChangeLog
+        https://bugs.webkit.org/show_bug.cgi?id=89560
+
+        Reviewed by Ryosuke Niwa.
+
+        Produce the following template:
+
+        > 2012-06-20  Kent Tamura  <tkent@chromium.org>
+        >
+        >         Need a short description (Oops!).
+        >         Need the bug URL (Oops!).
+        >
+        >         Reviewed by Ryosuke Niwa.
+        >
+        >         Additional information of the change such as approach, rationale. Please add per-function descriptions below. (Oops!).
+        >
+        >         No new tests (Oops!).
+
+        * Scripts/prepare-ChangeLog:
+        (generateNewChangeLogs):
+
+2012-07-08  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        [wx] Unreviewed. Fix notificaitons directory path after notifications move.
+
+        * waf/build/settings.py:
+
+2012-07-07  Nuno Lopes  <nlopes@apple.com>
+
+        Fix build with recent clang.
+        https://bugs.webkit.org/show_bug.cgi?id=90712
+
+        Reviewed by Alexey Proskuryakov.
+
+        * TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionBasic_Bundle.cpp:
+        (DOMWindowExtensionBasic):
+        * TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionNoCache_Bundle.cpp:
+        (DOMWindowExtensionNoCache):
+        * TestWebKitAPI/Tests/WebKit2/DocumentStartUserScriptAlertCrash_Bundle.cpp:
+        (TestWebKitAPI::DocumentStartUserScriptAlertCrashTest::initialize):
+
+2012-07-06  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add a configuration option for disabling unstable features in releases
+        https://bugs.webkit.org/show_bug.cgi?id=87995
+
+        Reviewed by Martin Robinson.
+
+        Pass the --enable-unstable-features flag when building the Gtk port through build-webkit.
+
+        * Scripts/webkitdirs.pm:
+        (buildAutotoolsProject):
+
+2012-07-06  Jessie Berlin  <jberlin@apple.com>
+
+        WKContext should ask for its initialization data when it needs it so the client doesn't have
+        to keep it up to date.
+        https://bugs.webkit.org/show_bug.cgi?id=90627
+
+        Reviewed by Anders Carlsson.
+
+        Add tests and update other WKContextInjectedBundleClients.
+
+        * MiniBrowser/mac/AppDelegate.m:
+        (-[BrowserAppDelegate init]):
+        Updated for the change to WKContextInjectedBundleClient.
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize):
+        Ditto.
+
+        * TestWebKitAPI/PlatformUtilities.cpp:
+        (TestWebKitAPI::Util::createInitializationDictionaryForInjectedBundleTest):
+        Moved the logic to create the initialization dictionary here ...
+        (TestWebKitAPI::Util::createContextForInjectedBundleTest):
+        ... from here so that it can be used without automatically using
+        WKContextSetInitializationUserDataForInjectedBundle.
+        * TestWebKitAPI/PlatformUtilities.h:
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        Add the new test files.
+        * TestWebKitAPI/GNUmakefile.am:
+        Ditto.
+
+        * TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback.cpp: Added.
+        (TestWebKitAPI::didReceiveMessageFromInjectedBundle):
+        Check that the message received from the injected bundle matches the user data it was
+        initialized with.
+        (TestWebKitAPI::getInjectedBundleInitializationUserData):
+        Return the user data that the injected bundle should be initialized with.
+        (TestWebKitAPI::TEST):
+        Set up WKContextInjectedBundleClient and load a page.
+        * TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback_Bundle.cpp: Added.
+        (TestWebKitAPI::GetInjectedBundleInitializationUserDataCallbackTest::initialize):
+        Send the initialization user data back up to the UI Process.
+
+        * TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins.cpp: Added.
+        (TestWebKitAPI::didReceiveMessageFromInjectedBundle):
+        Check that the message received from the injected bundle matches the user data it was
+        initialized with in the callback.
+        (TestWebKitAPI::getInjectedBundleInitializationUserData):
+        Return the user data that the injected bundle should be initialized with.
+        (TestWebKitAPI::TEST):
+        Set up the context and use WKContextSetInitializationUserDataForInjectedBundle to set the
+        initialization user data (which should be overridden by the user data returned in
+        getInjectedBundleInitializationUserData).
+        * TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp: Added.
+        (TestWebKitAPI::InjectedBundleInitializationUserDataCallbackWinsTest::initialize):
+        Send the initialization user data back up to the UI Process.
+
+2012-07-06  Dongwoo Im  <dw.im@samsung.com>
+
+        [EFL][GTK] jhbuild : Disable pixman demos build depending on GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=90593
+
+        Reviewed by Philippe Normand.
+
+        * efl/jhbuild.modules: Give '--enable-gtk=no' option to pixman.
+        * gtk/jhbuild.modules: Give '--enable-gtk=no' option to pixman.
+
+2012-07-06  Luciano Wolf <luciano.wolf@openbossa.org>
+
+        [Qt] DumpRenderTree does not use 'monospace' font when directed
+        https://bugs.webkit.org/show_bug.cgi?id=85203
+
+        The test fonts used for Qt tests were moved to the Liberation font family.
+
+        Due to this change we are skipping tons of tests. They will be gradually
+        unskipped in batches, ASAP.
+
+        Also, the now unneeded special font configuration for Qt5 WK1 was removed.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DumpRenderTree/qt/QtInitializeTestFonts.cpp:
+        (WebKit::initializeTestFonts):
+
+2012-07-06  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Buildfix for newer Qt5
+        https://bugs.webkit.org/show_bug.cgi?id=90519
+
+        Reviewed by Tor Arne Vestbø.
+
+        * MiniBrowser/qt/MiniBrowser.pro: We also need to depend on gui-private in the MiniBrowser to get access to these headers.
+        * MiniBrowser/qt/MiniBrowserApplication.h: Include qpa/qwindowsysteminterface.h instead of deprecated qwindowsysteminterface_qpa.h
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp: Include qpa/qwindowsysteminterface.h instead of deprecated qwindowsysteminterface_qpa.h
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Make use of Qt5 qmake's changed makefile recursion behavior
+
+        When not using the -r option, qmake now interleaves qmake and make calls,
+        so we don't need custom logic for this. There's also an option to supress
+        the effect of the -r option, which we use to make WebKit.pro the only
+        project file parsed in a recursive qmake-run.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/default_post.prf:
+        * qmake/mkspecs/features/functions.prf:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove custom qmake logic for module creation
+
+        Qmake now has the necessary hooks to cleanly override the build locations.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/default_pre.prf:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Add top-level .qmake.conf
+
+        With Qt5, this makes setting $QMAKEPATH externally unnecessary.
+
+        The magic in the perl scripts to set QMAKEPATH is still there, as it doesn't
+        hurt, and is still required for Qt4.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/default_pre.prf:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Unify qtFeatureDefaults code paths
+
+        There's no reason to run qmake on features.prf directly anymore, as we
+        can selectivly run configure tests in the project file now.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Scripts/webkitdirs.pm:
+        (qtFeatureDefaults):
+        * qmake/configure.pri:
+        * qmake/mkspecs/features/features.prf:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Don't let qt_webkit.pri proclaim its own location
+
+        This won't work any more with recent Qt5 versions, as the forwarding
+        pri is created by qt_module_config, which needs MODULE_PRI to be set
+        up already.
+
+        We also need to load build_config, not qt_module.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/qt_webkit.pri:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Remove redundant CONFIG+=module
+
+        qt_module_config takes care of that.
+
+        In api.pri we are actually testing the flag ourselves, so now we need to
+        test a related flag qt_module_config sets instead.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/default_post.prf:
+
+2012-07-06  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Switch to new-style Qt 5 configure tests
+
+        Use explicit project file action instead of syncqt magic.
+
+        https://bugs.webkit.org/show_bug.cgi?id=90461
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Scripts/webkitdirs.pm:
+        (buildQMakeProjects):
+        * qmake/configure.pri: Copied from Tools/qmake/configure.pro.
+        * qmake/configure.pro:
+        * qmake/mkspecs/features/default_pre.prf:
+        * qmake/mkspecs/features/features.prf:
+        * qmake/sync.profile: Removed.
+
+2012-07-05  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        Add Jason Liu to committers.py.
+        https://bugs.webkit.org/show_bug.cgi?id=90654
+
+        Unreviewed.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-07-05  Benjamin Poulain  <bpoulain@apple.com>
+
+        Double release of resources if the load is canceled in a callback of ResourceLoader::didFinishLoading
+        https://bugs.webkit.org/show_bug.cgi?id=90431
+
+        Reviewed by Anders Carlsson.
+
+        Add a Mac API test.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.html: Added.
+        * TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.mm: Added.
+        (-[CancelLoadFromResourceLoadDelegate webView:resource:didFinishLoadingFromDataSource:]):
+        (-[CancelLoadFromResourceLoadDelegateFrameLoadDelegate webView:didFinishLoadForFrame:]):
+        (TestWebKitAPI):
+        (TestWebKitAPI::TEST):
+
+2012-07-05  Dave Tharp  <dtharp@codeaurora.org>
+
+        Adding myself as committer to committers.py
+
+        Unreviewed.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-07-05  Alexey Proskuryakov  <ap@apple.com>
+
+        [Mac][WK2] Enable HTTPS tests
+        https://bugs.webkit.org/show_bug.cgi?id=90600
+
+        Reviewed by Brady Eidson.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm: (dumpRenderTree): Removed a misleading comment.
+        It explained why we were doing this here instead of a frame load delegate, but that's
+        just history, not an explanation of why we need this code.
+
+        * WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm: (WTR::InjectedBundle::platformInitialize):
+        Ignore certificate errors for localhost and 127.0.0.1. Since this is only needed
+        for tests, it seems appropriate to have platform specific solutions in every WTR,
+        and not add a WebKit2 API.
+
+2012-07-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove rpath-hacks in qt_webkit.pri
+
+        Having it in qt_webkit.pri meant that all client apps would inherit the rpath,
+        even if they were not using QtWebKit.
+
+        This is a regression for people who build client apps against a non-installed
+        QtWebKit, as the client app will be missing a rpath to the standalone WebKit
+        build dir. This can be solved by LD_LIBRARY_PATH or custom QMAKE_RPATHDIR
+        logic, until the real issue is fixed in Qt.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * qmake/mkspecs/features/rpath.prf:
+        * qmake/qt_webkit.pri:
+
+2012-07-05  Dongwoo Im  <dw.im@samsung.com>
+
+        [EFL] Enable the CUSTOM_SCHEME_HANDLER feature as default.
+        https://bugs.webkit.org/show_bug.cgi?id=88608
+
+        Reviewed by Hajime Morita.
+
+        * Scripts/webkitperl/FeatureList.pm: Enable the CUSTOM_SCHEME_HANDLER feature as default.
+
+2012-07-05  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        [Wk2][EFL] EFL needs a WebKitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=87659
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add an implementation of WebKitTestRunner for Efl port.
+
+        * CMakeLists.txt: Includes WebKitTestRunner build script.
+        * Scripts/build-webkittestrunner: Added knowledge of WebKitTestRunner/Efl.
+        * Scripts/webkitpy/layout_tests/port/efl.py: Ditto.
+        (EflPort.setup_environ_for_server):
+        * WebKitTestRunner/CMakeLists.txt: Added.
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        * WebKitTestRunner/InjectedBundle/efl/ActivateFontsEfl.cpp: Added.
+        * WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp: Added.
+        * WebKitTestRunner/InjectedBundle/efl/LayoutTestControllerEfl.cpp: Added.
+        * WebKitTestRunner/PlatformEfl.cmake: Added.
+        * WebKitTestRunner/PlatformWebView.h:
+        * WebKitTestRunner/TestController.cpp:
+        * WebKitTestRunner/config.h: Added knowledge of WebKitTestRunner/Efl.
+        * WebKitTestRunner/efl/PlatformWebViewEfl.cpp: Added.
+        * WebKitTestRunner/efl/TestControllerEfl.cpp: Added.
+        * WebKitTestRunner/efl/main.cpp: Added.
+        (main):
+
+2012-07-05  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Ewk_View needs API to load HTML data
+        https://bugs.webkit.org/show_bug.cgi?id=90540
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Update EFL MiniBrowser to catch the "load,error" signal
+        on the view and display an error page.
+
+        * MiniBrowser/efl/main.c:
+        (on_error):
+        (browserCreate):
+
+2012-07-05  Sergio Villar Senin  <svillar@igalia.com>
+
+        Hidden dirs are not copied when creating the built product archive
+        https://bugs.webkit.org/show_bug.cgi?id=90559
+
+        Reviewed by Carlos Garcia Campos.
+
+        Hidden dirs are not copied inside the built product archive
+        because the recursive copy command was ignoring them. We need those
+        hidden directories for the GTK WebKit2 testing bot to work fine.
+
+        * BuildSlaveSupport/built-product-archive:
+        (archiveBuiltProduct): replaced "*" by "." to include hidden
+        dirs/files.
+
+2012-07-04  Yoshifumi Inoue  <yosin@chromium.org>
+
+        Unreviewed Chromium gardening, Disable always failed python tests on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=90587
+
+        PortTest.qt_linux and mac_lion are always failed on Chromium Windows at
+        creating child process.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (PortTest.disabled_test_qt_linux):
+        (PortTest.disabled_test_mac_lion):
+
+2012-07-04  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Tools] webkit_unittest.py got assertion
+        https://bugs.webkit.org/show_bug.cgi?id=90579
+
+        Reviewed by Hajime Morita.
+
+        This patch updates expectation of assertion in test_skipped_directories_for_symbols().
+        r121874 added new (exclude) directory (inspector/styles/variables), however it didn't
+        update one of two assertions.
+
+        * Scripts/webkitpy/layout_tests/port/webkit_unittest.py:
+
+2012-07-04  Balazs Ankes  <bank@inf.u-szeged.hu>
+
+        webkit-patch should add reviewer if "Reviewed by NOBODY ..." is missing
+        https://bugs.webkit.org/show_bug.cgi?id=67935
+
+        Reviewed by Ryosuke Niwa.
+
+        * Scripts/webkitpy/common/checkout/changelog.py:
+        (ChangeLog.set_reviewer):
+        * Scripts/webkitpy/common/checkout/changelog_unittest.py:
+        (test_set_reviewer):
+        (test_set_short_description_and_bug_url):
+
+2012-07-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121862.
+        http://trac.webkit.org/changeset/121862
+        https://bugs.webkit.org/show_bug.cgi?id=90569
+
+        It broke built-product-archive for GTK, Qt and EFL (Requested
+        by svillar on #webkit).
+
+        * BuildSlaveSupport/built-product-archive:
+        (archiveBuiltProduct):
+
+2012-07-04  Sergio Villar Senin  <svillar@igalia.com>
+
+        Hidden dirs are not copied when creating the built product archive
+        https://bugs.webkit.org/show_bug.cgi?id=90559
+
+        Reviewed by Carlos Garcia Campos.
+
+        Hidden dirs are not copied inside the built product archive because
+        the recursive copy command was ignoring them. We need those hidden
+        directories for the GTK WebKit2 testing bot to work fine.
+
+        * BuildSlaveSupport/built-product-archive:
+        (archiveBuiltProduct): removed the trailing "*" from the copy
+        command.
+
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing.
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitperl/FeatureList.pm:
+        * qmake/mkspecs/features/features.pri:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Replace deprecated IN_PWD with PWD
+
+        Reviewed by Csaba Osztrogonác.
+
+        * qmake/mkspecs/features/default_pre.prf:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Don't try to build WTR twice
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Tools.pro:
+
+2012-07-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121821.
+        http://trac.webkit.org/changeset/121821
+        https://bugs.webkit.org/show_bug.cgi?id=90551
+
+        This patch did not receive a high-quality review and has a
+        number of errors (Requested by abarth on #webkit).
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        (Build.results_url):
+        * Scripts/webkitpy/common/net/buildbot/chromiumbuildbot.py:
+        (ChromiumBuilder.accumulated_results_url):
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractParallelRebaselineCommand.__init__):
+        (Rebaseline):
+        (Rebaseline._builder_to_pull_from):
+        (Rebaseline._tests_to_update):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline.mock_builder_to_pull_from):
+        (test_rebaseline):
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Get rid of un-needed QT += declarative for Qt 5
+
+        The declarative module has been renamed to quick1 in Qt 5, and the
+        engine-only module for Qt 5 is named 'qml'. For many of the instances
+        we could just remove 'declarative', since the project file was only
+        used for Qt5/WebKit2 builds. In the other cases the module was wrapped
+        in a haveQt(4) scope.
+
+        Reviewed by Csaba Osztrogonác.
+
+        * MiniBrowser/qt/MiniBrowser.pro:
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/Target.pri:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove a few un-needed load(features) after r121777
+
+        The features are computed by configure.pro and cached in .qmake.cache.
+
+        Reviewed by Jocelyn Turcotte..
+
+        * MiniBrowser/qt/raw/Target.pri:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Use haveQtModule() in project files instead of manual checks
+
+        Reviewed by Jocelyn Turcotte.
+
+        * qmake/mkspecs/features/default_pre.prf:
+        * qmake/mkspecs/features/features.prf:
+
+2012-07-04  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix haveQtModule() check
+
+        Without {} brackets we were pulling out the value of the module.name variable.
+
+        Reviewed by Jocelyn Turcotte.
+
+        * qmake/mkspecs/features/functions.prf:
+
+2012-07-04  Sergio Villar Senin  <svillar@igalia.com>
+
+        [WK2] [GTK] WK2 testing bot unable to find the InjectedBundle library
+        https://bugs.webkit.org/show_bug.cgi?id=90541
+
+        Reviewed by Carlos Garcia Campos.
+
+        We must add the contents of WebKitBuild/*/Libraries/ directory to
+        the file to be uploaded to b.w.o to successfully run WebKit2 tests
+        in the WebKit2 testing bot.
+
+        * BuildSlaveSupport/built-product-archive:
+        (archiveBuiltProduct): appended Libraries to the list of
+        neededDirectories.
+
+2012-07-04  Sergio Villar Senin  <svillar@igalia.com>
+
+        [GTK] WebKit2 testing bot unable to find the build directory
+        https://bugs.webkit.org/show_bug.cgi?id=90523
+
+        Reviewed by Carlos Garcia Campos.
+
+        The presence of GNUmakefile was used to determine whether a given
+        directory was a valid build directory or not. That's not correct for
+        testing bots as we export only the minimum required stuff to run the
+        tests.
+
+        * gtk/common.py:
+        (get_build_path.is_valid_build_directory): added an extra check.:
+
+2012-07-04  Joe Thomas  <joethomas@motorola.com>
+
+        Adding myself to committers list.
+
+        Unreviewed.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [WK2][EFL] Ewk_View should report the load progress
+        https://bugs.webkit.org/show_bug.cgi?id=90457
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Update EFL MiniBrowser so that it listens for the
+        "load,progress" on the Ewk_View and updates its
+        window title accordingly.
+
+        * MiniBrowser/efl/main.c:
+        (title_set):
+        (on_title_changed):
+        (on_progress):
+        (browserCreate):
+
+2012-07-03  Dirk Pranke  <dpranke@chromium.org>
+
+        disable failing mock-chromium-mac python unit tests
+
+        Unreviewed, build fix.
+
+        Disable these tests until I can figure out why they're failing
+        on the bots.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (PortTest.disabled_test_chromium_mac_lion):
+        (PortTest.disabled_test_chromium_mac_lion_in_test_shell_mode):
+
+2012-07-03  Ian Vollick  <vollick@chromium.org>
+
+        Add vollick to the list of committers
+        https://bugs.webkit.org/show_bug.cgi?id=90512
+
+        Reviewed by Adrienne Walker.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-07-03  Ojan Vafai  <ojan@chromium.org>
+
+        Improve webkit-patch rebaseline to work for more cases
+        https://bugs.webkit.org/show_bug.cgi?id=90504
+
+        Reviewed by Dirk Pranke.
+
+        -Makes it work for the build.chromium.org bots.
+        -Lets you rebaseline all builders instead of just one.
+        -Lets you pass in the builder or test to rebaseline.
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        (Build.results_url):
+        Make this work for build.chromium.org builders as well.
+
+        * Scripts/webkitpy/common/net/buildbot/chromiumbuildbot.py:
+        (ChromiumBuilder):
+        (ChromiumBuilder.latest_cached_build):
+        ChromiumBuilder doesn't support large parts of the Builder interface.
+        This provides the bare minimum for this patch to work. Eventually,
+        we should create a single interface that can be supported for both
+        sets of buildbots.
+
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        (builder_path_from_name):
+        (all_builder_names):
+        memoizing here is incorrect because the test override _exact_matches,
+        so these can return different values. In either case, I'm pretty sure these
+        are not remotely hot codepaths.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractParallelRebaselineCommand.__init__):
+        (Rebaseline):
+        (Rebaseline.__init__):
+        (Rebaseline._builders_to_pull_from):
+        (Rebaseline._builder_with_name):
+        (Rebaseline._tests_to_update):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline.mock_builders_to_pull_from):
+        (test_rebaseline):
+        (test_rebaseline_command_line_flags):
+        (test_rebaseline_multiple_builders):
+        (test_rebaseline_multiple_builders.mock_builders_to_pull_from):
+        (test_rebaseline_multiple_builders.mock_tests_to_update):
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Enable CSS variables support at compile time
+        https://bugs.webkit.org/show_bug.cgi?id=90448
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Turn on CSS_VARIABLES flag by default on EFL port.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-03  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up exception handling and make sure we log some more failures
+        https://bugs.webkit.org/show_bug.cgi?id=90503
+
+        Reviewed by Ojan Vafai.
+
+        There were several places where exceptions weren't getting
+        logged, most notably if you passed a bad value to --platform.
+        This change tests that and cleans things up a bit; more cleanup
+        will be possible when we rework the manager_worker_broker code.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (_BrokerConnection.raise_exception):
+        (_InlineWorkerConnection.raise_exception):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (Worker.run):
+        (Worker.kill_driver):
+        * Scripts/webkitpy/layout_tests/port/factory.py:
+        (PortFactory.get):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (run):
+        (main):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_unsupported_platfrom):
+
+2012-07-03  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: fix mock port
+        https://bugs.webkit.org/show_bug.cgi?id=90500
+
+        Reviewed by Ojan Vafai.
+
+        The MockDRT code was never updated when we switched the chromium
+        ports to using "drt mode" by default. This change updates that
+        code, fixes a typo in the chromium port that went undetected
+        (default_test_timeout_ms -> default_timeout_ms), and adds tests
+        that actually exercise some of the mock ports. These tests are
+        useful in that they will exercise the port-specific code in an
+        end-to-end-manner, but they are a bit slow for some reason (>1s
+        each) that I need to look into.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumDriver.stop):
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.default_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (TestChromiumAndroidPort.test_default_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/mock_drt.py:
+        (main):
+        (parse_options):
+        (MockTestShell):
+        (MockTestShell.output_for_test):
+        * Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py:
+        (MockDRTTest.assertTest):
+        (MockTestShellTest):
+        (MockTestShellTest.make_drt):
+        (MockTestShellTest.test_test_shell_parse_options):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (PortTest):
+        (PortTest.assert_mock_port_works):
+        (PortTest.test_chromium_mac_lion):
+        (PortTest.test_chromium_mac_lion_in_test_shell_mode):
+        (PortTest.test_qt_linux):
+        (PortTest.test_mac_lion):
+
+2012-07-03  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: make the worker class stand alone with a cleaner interface
+        https://bugs.webkit.org/show_bug.cgi?id=90409
+
+        Reviewed by Ojan Vafai.
+
+        Currently the Worker class derives from AbstractWorker, which is
+        kind of crufty and awkward; it would be better if we did not
+        rely on shared state.
+
+        This change changes that so that Worker derives from object, and
+        exposes the following interface:
+          __init__() - called in the manager process
+          safe_init() - called in the worker process to initialize
+            unpicklable state
+          handle() - a single routine to handle all messages
+          cleanup() - called so the worker can clean up
+
+        Also, all of the "administrative" messages that are handled by
+        the worker (notification of start/stop/etc.) move into
+        manager_worker_broker - this reduces worker.py to just handling
+        the mechanics of actually running each test.
+
+        For the moment, we do this by creating Yet Another wrapper/proxy
+        class in manager_worker_broker, but this will get simpler
+        shortly when the rest of m_w_b is cleaned up.
+
+        With this change worker is now in its new form but there will be
+        a follow-on change that cleans up some names and other minor
+        things.
+
+        This change is again mostly just moving things around and should
+        be covered by the (updated) existing tests.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (get):
+        (AbstractWorker.__init__):
+        (AbstractWorker.run):
+        (AbstractWorker):
+        (AbstractWorker.handle_stop):
+        (AbstractWorker.handle_test_list):
+        (AbstractWorker.yield_to_broker):
+        (AbstractWorker.post_message):
+        (_WorkerConnection.__init__):
+        (_Process.run):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (_TestWorker):
+        (_TestWorker.__init__):
+        (_TestWorker.name):
+        (_TestWorker.cleanup):
+        (_TestWorker.handle):
+        (_TestWorker.safe_init):
+        (_TestWorker.stop):
+        (_TestsMixin.handle_finished_test):
+        (_TestsMixin.setUp):
+        (_TestsMixin.test_cancel):
+        (_TestsMixin.test_done):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (Worker):
+        (Worker.__init__):
+        (Worker.safe_init):
+        (Worker.handle):
+
+2012-07-03  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: moving child process logging code into manager_worker_broker
+        https://bugs.webkit.org/show_bug.cgi?id=90408
+
+        Reviewed by Ojan Vafai.
+
+        Users of manager_worker_broker should not have to be aware of
+        whether they're in the same process or different processes and
+        configure logging themselves; mwb should hide this complexity.
+        We can't quite do this completely/correctly yet, since the
+        manager expects to get a list of messages to log, but this
+        change fixes the worker side of it, at least.
+
+        This is just moving code around, there is no new functionality
+        and this should be covered by existing tests.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (AbstractWorker.__init__):
+        (_WorkerConnection.__init__):
+        (_WorkerConnection.post_message):
+        (_WorkerConnection):
+        (_WorkerConnection.set_up_logging):
+        (_WorkerConnection.clean_up_logging):
+        (_InlineWorkerConnection.run):
+        (_MultiProcessWorkerConnection.run):
+        (_WorkerLogHandler):
+        (_WorkerLogHandler.__init__):
+        (_WorkerLogHandler.emit):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (_TestWorker.run):
+        (_TestsMixin.handle_done):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (Worker.__init__):
+        (Worker.run):
+        (Worker._run_test):
+        (Worker.cleanup):
+        (Worker.run_single_test):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Don't archive build files generated by VS2010
+        https://bugs.webkit.org/show_bug.cgi?id=90493
+
+        Reviewed by Ojan Vafai.
+
+        In particular, the pch (pre compiled header) files are gigantic, making
+        release.zip almost a 1gb in size.
+
+        * BuildSlaveSupport/built-product-archive:
+        (archiveBuiltProduct):
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Unreviewed, update .gitignore to handle VS2010 files.
+
+        * .gitignore:
+        * DumpRenderTree/DumpRenderTree.gyp/.gitignore:
+        * TestWebKitAPI/TestWebKitAPI.gyp/.gitignore:
+
+2012-07-03  Ojan Vafai  <ojan@chromium.org>
+
+        Have webkit-patch rebaseline use rebaseline-test-internal
+        https://bugs.webkit.org/show_bug.cgi?id=90491
+
+        Reviewed by Dirk Pranke.
+
+        This lets it handle new files, reduces duplicate code and lays the
+        groundwork for making rebaseline have a richer interface.
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot_mock.py:
+        (MockBuild):
+        (MockBuild.__init__):
+        (MockBuilder.build):
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractParallelRebaselineCommand._files_to_add):
+        (Rebaseline):
+        (Rebaseline._builder_to_pull_from):
+        (Rebaseline._tests_to_update):
+        (Rebaseline.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_overrides_are_included_correctly):
+        (test_rebaseline):
+        (test_rebaseline.mock_builder_to_pull_from):
+        (test_rebaseline.mock_tests_to_update):
+
+2012-07-03  Ojan Vafai  <ojan@chromium.org>
+
+        Rename rebaseline-test to rebaseline-test-internal
+        https://bugs.webkit.org/show_bug.cgi?id=90485
+
+        Reviewed by Adam Barth.
+
+        It's now only used by other rebaseline commands. It's still useful to leave it
+        as it's own command to aid in debugging when something goes wrong. In a followup
+        patch, I'll make webkit-patch rebaseline cover any use-cases that rebaseline-test
+        might have covered.
+
+        We no longer need the --print-scm-changes option since the only caller always passes
+        that option in.
+
+        Also, make all the arguments command-line flags instead. Simplifies the code
+        a bit in my opinion.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineTest):
+        (RebaselineTest.__init__):
+        (RebaselineTest.execute):
+        (AbstractParallelRebaselineCommand._rebaseline_commands):
+        (RebaselineExpectations.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline_all):
+
+2012-07-03  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WTR] Get rid of using DumpRenderTreeSupportQt
+        https://bugs.webkit.org/show_bug.cgi?id=90262
+
+        Unreviewed build fix.
+
+        Reverting r121550 manually because it caused build
+        break on ARM and Mac. It turned out that the Qt build
+        system is too broken for this change now, first we have
+        to address two issues:
+            * symbol hiding was forbidden accidentally on x86 Linux
+            * Qt lacks a separate library for test support
+
+        * Tools.pro:
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::resetAfterTest):
+        (WTR::InjectedBundlePage::didClearWindowForFrame):
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+
+2012-07-03  Tony Chang  <tony@chromium.org>
+
+        [chromium] Handle trailing backslash on %VSINSTALLDIR%
+        https://bugs.webkit.org/show_bug.cgi?id=90410
+
+        Reviewed by Ojan Vafai.
+
+        * Scripts/webkitdirs.pm:
+        (buildChromiumVisualStudioProject): Handle VSINSTALLDIR ending in a backslash, the backslash escapes the closing double quote.
+
+2012-07-02  Ojan Vafai  <ojan@chromium.org>
+
+        Make the skia_test_expectations.txt file optional.
+        https://bugs.webkit.org/show_bug.cgi?id=90400
+
+        Reviewed by Dirk Pranke.
+
+        It used to be optional. This regressed at some point. It's important that it be
+        optional so that webkit-patch commands work in a pure-webkit checkout for chromium bots.
+        Specifically, this was breaking webkit-patch rebaseline-test when it would go to update
+        TestExpectations.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort.expectations_files):
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        (ChromiumDriverTest.test_expectations_dict):
+
+2012-07-03  Raphael Kubo da Costa  <rakuco@webkit.org>
+
+        [jhbuild][EFL] Bump libffi dependency.
+        https://bugs.webkit.org/show_bug.cgi?id=85373
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Update libffi to 3.0.11, which fixes the build on some platforms
+        where 3.0.10 had problems.
+
+        * efl/jhbuild.modules:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable microdata support for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90429
+
+        Reviewed by Rob Buis.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * QtTestBrowser/QtTestBrowser.pro:
+        * Scripts/webkitdirs.pm:
+        (qtFeatureDefaults):
+        (buildQMakeProjects):
+        * Tools.pro:
+        * WebKitTestRunner/InjectedBundle/DerivedSources.pri:
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/Target.pri:
+        * qmake/.qmake.conf: Added.
+        * qmake/configure.pro:
+        * qmake/mkspecs/features/default_post.prf:
+        * qmake/mkspecs/features/default_pre.prf:
+        * qmake/mkspecs/features/features.prf:
+
+2012-07-03  Nico Weber  <thakis@chromium.org>
+
+        -Wunused-private-field cleanup, linux edition
+        https://bugs.webkit.org/show_bug.cgi?id=90463
+
+        Reviewed by Stephen White.
+
+        * DumpRenderTree/chromium/DRTDevToolsAgent.h:
+        * DumpRenderTree/chromium/GamepadController.h:
+        (GamepadController):
+        * DumpRenderTree/chromium/NotificationPresenter.h:
+        (NotificationPresenter::NotificationPresenter):
+        (NotificationPresenter):
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121766.
+        http://trac.webkit.org/changeset/121766
+        https://bugs.webkit.org/show_bug.cgi?id=90465
+
+        It caused flakey build errors on the bots (Requested by Ossy
+        on #webkit).
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * QtTestBrowser/QtTestBrowser.pro:
+        * Scripts/webkitdirs.pm:
+        (qtFeatureDefaults):
+        (buildQMakeProjects):
+        * Tools.pro:
+        * WebKitTestRunner/InjectedBundle/DerivedSources.pri:
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/Target.pri:
+        * qmake/.qmake.conf: Removed.
+        * qmake/configure.pro:
+        * qmake/mkspecs/features/default_post.prf:
+        * qmake/mkspecs/features/default_pre.prf:
+        * qmake/mkspecs/features/features.prf:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable Custom Scheme Handlers for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-03  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable RegisterProtocolHandler for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90422
+
+        Reviewed by Rob Buis.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-03  Thiago Marcos P. Santos  <thiago.santos@intel.com>
+
+        [EFL] Add run API tests as a step on the build bots
+        https://bugs.webkit.org/show_bug.cgi?id=87252
+
+        Reviewed by Daniel Bates.
+
+        Run EFL API test suite on the build bots.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (RunEflAPITests):
+        (TestFactory.__init__):
+        (BuildAndTestFactory.__init__):
+        * Scripts/run-efl-tests: Added.
+
+2012-07-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Make use of .qmake.cache for caching features
+
+        Instead of loading() features from the files that need them (and re-running
+        a bunch of checks), we now run feature detection as part of configure.pro,
+        and have build-webkit write the computed feature-defines and CONFIG to
+        .qmake.cache, which is then loaded by qmake _before_ even defaults_pre
+        when building WebKit.pro.
+
+        At some point we'll be able to selectivly prevent running of config tests
+        in configure.pro, which means we don't need a separate code-path for
+        the build-webkit --help case.
+
+        We should also move the code in build-webkit that now uses .webkit.config
+        to detect clean builds, to use .qmake.cache, since we now store the same
+        thing there.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * QtTestBrowser/QtTestBrowser.pro:
+        * Scripts/webkitdirs.pm:
+        (qtFeatureDefaults):
+        (buildQMakeProjects):
+        * Tools.pro:
+        * WebKitTestRunner/InjectedBundle/DerivedSources.pri:
+        * WebKitTestRunner/InjectedBundle/Target.pri:
+        * WebKitTestRunner/Target.pri:
+        * qmake/.qmake.conf: Added.
+        * qmake/configure.pro:
+        * qmake/mkspecs/features/default_post.prf:
+        * qmake/mkspecs/features/default_pre.prf:
+        * qmake/mkspecs/features/features.prf:
+
+2012-07-03  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>  Joel Dillon <joel.dillon@codethink.co.uk>
 
         [Qt][Win] Fix broken QtWebKit5.lib linking
         https://bugs.webkit.org/show_bug.cgi?id=88321
 
-        Reviewed by NOBODY (OOPS!).
+        Reviewed by Kenneth Rohde Christiansen.
 
         On windows the import/export definition is part of the symbol's signature.
         Define STATICALLY_LINKED_WITH_$$library for each dependend module
@@ -16,6 +1746,1409 @@
         * DumpRenderTree/qt/DumpRenderTree.pro:
         * qmake/mkspecs/features/default_post.prf:
 
+2012-07-03  Szilard Ledan  <szledan@inf.u-szeged.hu>
+
+        master.cfg cleanup, pass BuildStep instances instead of BuildStep subclasses
+        https://bugs.webkit.org/show_bug.cgi?id=89001
+
+        Reviewed by Csaba Osztrogonác.
+
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg:
+        (UploadBuiltProduct.__init__):
+        (UploadTestResults.__init__):
+        (ExtractTestResults.__init__):
+        (Factory.__init__):
+        (BuildFactory.__init__):
+        (TestFactory.__init__):
+        (BuildAndTestFactory.__init__):
+        (BuildAndPerfTestFactory.__init__):
+        (BuildAndPerfTestWebKit2Factory.__init__):
+        (DownloadAndPerfTestFactory.__init__):
+
+2012-07-03  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        Update unit test after r121724.
+        https://bugs.webkit.org/show_bug.cgi?id=90444
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Scripts/webkitpy/tool/servers/gardeningserver_unittest.py:
+        (GardeningServerTest.test_rebaseline_new_port):
+
+2012-07-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121749.
+        http://trac.webkit.org/changeset/121749
+        https://bugs.webkit.org/show_bug.cgi?id=90441
+
+        Tests crash on the paralel NRWT Qt bot (Requested by Ossy on
+        #webkit).
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort._build_driver):
+        * Scripts/webkitpy/layout_tests/port/xvfbdriver.py:
+        (XvfbDriver._start):
+        (XvfbDriver._start.x_filter):
+        (XvfbDriver.stop):
+
+2012-07-03  Kristóf Kosztyó  <kkristof@inf.u-szeged.hu>
+
+        [NRWT] XvfbDriver should choose the next free display
+        https://bugs.webkit.org/show_bug.cgi?id=88414
+
+        Reviewed by Dirk Pranke.
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort._driver_class):
+        * Scripts/webkitpy/layout_tests/port/xvfbdriver.py:
+        (XvfbDriver.__init__):
+        (XvfbDriver._start):
+        (XvfbDriver._start.next_free_id):
+        (XvfbDriver.stop):
+
+2012-07-03  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Enable MICRODATA support
+        https://bugs.webkit.org/show_bug.cgi?id=90377
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Turn on MICRODATA flag for EFL port by default.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-02  George Staikos  <staikos@webkit.org>
+
+        [BlackBerry] Enable scoped style for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=90418
+
+        Reviewed by Rob Buis.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-07-02  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Use PUBLIC_BUILD to enable/disable DRT
+        https://bugs.webkit.org/show_bug.cgi?id=90271
+
+        Reviewed by George Staikos.
+
+        RIM PR #154707
+
+        Currently DRT code will be compiled only if ENABLE_DRT is set, and it's not
+        defined by default.
+        We should enable DRT by default unless PUBLIC_BUILD is set. In this way we don't
+        need to rebuild webkit before running DRT.
+
+        * Scripts/webkitdirs.pm:
+        (blackberryCMakeArguments):
+
+2012-07-02  Ojan Vafai  <ojan@chromium.org>
+
+        webkit-patch rebaseline-expectations should share code with rebaseline-all
+        https://bugs.webkit.org/show_bug.cgi?id=90413
+
+        Reviewed by Dirk Pranke.
+
+        Make them share code. In addition to reducing code duplication this makes
+        rebaseline-expectations considerably faster by rebaselining in parallel.
+
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (AbstractParallelRebaselineCommand):
+        (AbstractParallelRebaselineCommand._run_webkit_patch):
+        (AbstractParallelRebaselineCommand._rebaseline):
+        (RebaselineJson):
+        (RebaselineJson.execute):
+        (RebaselineExpectations):
+        (RebaselineExpectations._update_expectations_file):
+        (RebaselineExpectations._tests_to_rebaseline):
+        (RebaselineExpectations._add_tests_to_rebaseline_for_port):
+        (RebaselineExpectations.execute):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline_all):
+        (test_rebaseline_expectations.run_in_parallel):
+        (test_rebaseline_expectations):
+
+2012-07-02  Xiaobo Wang  <xbwang@torchmobile.com.cn>
+
+        [BlackBerry] Update DumpRenderTree to have it work interactively in parallel
+        https://bugs.webkit.org/show_bug.cgi?id=88326
+
+        Reviewed by Rob Buis.
+
+        1. Test name is sent to torch-launcher via PPS message(from host machine).
+           So we get test list by monitoring and receiving PPS message instead of
+           reading file index.drt.
+        2. Torch-launcher create a <test file>.done file when it finished a test.
+        3. We don't need to search for Ref-tests in DumpRenderTree.cpp any more. NRWT
+           will get them for us.
+
+        * DumpRenderTree/blackberry/DumpRenderTree.cpp:
+        (BlackBerry::WebKit::DumpRenderTree::DumpRenderTree):
+        (BlackBerry::WebKit::DumpRenderTree::doneDrt):
+        (BlackBerry::WebKit::DumpRenderTree::runRemainingTests):
+        (BlackBerry::WebKit::DumpRenderTree::ensurePPS):
+        (WebKit):
+        (BlackBerry::WebKit::DumpRenderTree::handlePPSData):
+        (BlackBerry::WebKit::DumpRenderTree::waitForTest):
+        (BlackBerry::WebKit::DumpRenderTree::runTests):
+        (BlackBerry::WebKit::DumpRenderTree::dump):
+        * DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h:
+        (DumpRenderTree):
+
+2012-07-02  Adam Barth  <abarth@webkit.org>
+
+        Remove flashplugin-installer from the EWS image because it causes some tests to crash
+        https://bugs.webkit.org/show_bug.cgi?id=90403
+
+        Reviewed by Tony Chang.
+
+        * EWSTools/cold-boot.sh:
+
+2012-07-02  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        [Chromium] Implement a Layout Test for editing/SurroundingText
+        https://bugs.webkit.org/show_bug.cgi?id=82461
+
+        Reviewed by Ryosuke Niwa.
+
+        Add a new method to the layout test controller in order to retrieve the
+        text surrounding a provided element.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::textSurroundingElement):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController):
+
+2012-07-02  Ojan Vafai  <ojan@chromium.org>
+
+        Delete unused rebaseline method in gardeningserver.py
+        https://bugs.webkit.org/show_bug.cgi?id=90396
+
+        Reviewed by Eric Seidel.
+
+        As best I can tell, the only usage was in this unittest.
+
+        * Scripts/webkitpy/tool/servers/gardeningserver.py:
+        (GardeningHTTPRequestHandler.updateexpectations):
+        * Scripts/webkitpy/tool/servers/gardeningserver_unittest.py:
+        (GardeningServerTest.test_rebaseline_new_port):
+
+2012-07-02  Csaba Osztrogonác  <ossy@webkit.org>
+
+        REGRESSION(r121497): It switched off and broke many unittests
+        https://bugs.webkit.org/show_bug.cgi?id=90371
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
+        (ChromiumMacPortTest): Use snowleopard as os_version instead of leopard, because it isn't supported anymore.
+        * Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py:
+        (ChromiumPortTestCase.test_all_test_configurations): Remove leopard testcases, because it isn't supported anymore.
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase): Inherit class PortTestCase from unittest.TestCase instead of object.
+
+2012-07-02  Ojan Vafai  <ojan@chromium.org>
+
+        Move rebaseline-all command from the gardening-server down into webkit-patch
+        https://bugs.webkit.org/show_bug.cgi?id=90395
+
+        Reviewed by Adam Barth.
+
+        This is just moving code. It it in preparation for making rebaseline-expectations
+        use the same code in order to get the parallelism benefits and reduces the amount
+        of code we have for doing rebaselines.
+
+        * Scripts/webkitpy/common/checkout/checkout_unittest.py:
+        (CheckoutTest.test_apply_patch):
+        Updated due to the change to executive_mock.
+        * Scripts/webkitpy/common/system/executive_mock.py:
+        (MockExecutive.run_command):
+        Update to print out the input passed to stdin.
+        * Scripts/webkitpy/tool/commands/download_unittest.py:
+        Updated due to executive_mock change.
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineAll):
+        (RebaselineAll._run_webkit_patch):
+        (RebaselineAll._builders_to_fetch_from):
+        (RebaselineAll._rebaseline_commands):
+        (RebaselineAll._files_to_add):
+        (RebaselineAll._optimize_baselines):
+        (RebaselineAll._rebaseline):
+        (RebaselineAll.execute):
+        All this code is just copy-pasted except for mechanical changes
+        (e.g. self.server.tool --> self._tool) and the reading in of the 
+        JSON from stdin instead of the post body.
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline_all):
+        Copied the test-case out of gardeningserver_unittest.py.
+        * Scripts/webkitpy/tool/servers/gardeningserver.py:
+        (GardeningHTTPRequestHandler):
+        (GardeningHTTPRequestHandler.rebaseline):
+        (GardeningHTTPRequestHandler.rebaselineall):
+        * Scripts/webkitpy/tool/servers/gardeningserver_unittest.py:
+        (GardeningServerTest.test_rebaselineall):
+        (GardeningServerTest.test_rebaselineall.run_command):
+
+2012-07-02  Ojan Vafai  <ojan@chromium.org>
+
+        Remove Leopard support from the flakiness dashboard
+        https://bugs.webkit.org/show_bug.cgi?id=90390
+
+        Reviewed by Adam Barth.
+
+        * TestResultServer/static-dashboards/flakiness_dashboard.js:
+        (nonChromiumPlatform):
+        (chromiumPlatform):
+        * TestResultServer/static-dashboards/flakiness_dashboard_unittests.js:
+        (test):
+        * TestResultServer/static-dashboards/run-embedded-unittests.html:
+        * TestResultServer/static-dashboards/run-unittests.html:
+
+2012-07-02  Ojan Vafai  <ojan@chromium.org>
+
+        Fix posting from garden-o-matic. This broke in moving away from jquery's ajax method
+        in http://trac.webkit.org/changeset/121617.
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js:
+
+2012-07-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Read fonts path when running layout tests from alternative fonts dir when main dir doesn't exist
+        https://bugs.webkit.org/show_bug.cgi?id=89437
+
+        Reviewed by Martin Robinson.
+
+        If main fonts directory doesn't exist, try with an alternative
+        fonts directory at build directory.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (getOutputDir):
+        (getFontsPath):
+        (initializeFonts):
+        * WebKitTestRunner/InjectedBundle/gtk/ActivateFontsGtk.cpp:
+        (WTR::getOutputDir):
+        (WTR):
+        (WTR::getFontsPath):
+        (WTR::inititializeFontConfigSetting):
+
+2012-07-02  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] Don't run the tests with jhbuild wrapper if it's already running under jhbuild
+        https://bugs.webkit.org/show_bug.cgi?id=89435
+
+        Reviewed by Martin Robinson.
+
+        * Scripts/new-run-webkit-tests: Don't run the tests with the
+        jhbuild wrapper if there isn't a Dependencies directory inside the
+        build directory.
+
+2012-06-29  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Simplify detection of non-installed module file
+
+        Has the additional advantage that we do not rely on additional information.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/qt_webkit.pri:
+
+2012-07-01  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Add Gamepad support
+        https://bugs.webkit.org/show_bug.cgi?id=90170
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Scripts/webkitperl/FeatureList.pm: Turn on GAMEPAD flag
+        by default for EFL port.
+        * efl/jhbuild.modules: Bump dependency versions of EFL libs
+        since the latest Eeze is required for gamepad support.
+
+2012-07-01  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Using the default start cylinder for fdisk causes a warning about the
+        partition not starting on physical sector boundary.  The Ubuntu forums
+        recommend using a number that's divisible by 8, which is what we do in
+        this patch.
+
+        * EWSTools/cold-boot.sh:
+
+2012-07-01  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        It turns out we need to use Ubuntu 10.04 to get the right image results
+        for chromium-linux. This patch updates our scripts to be compatible
+        with Ubuntu 10.04.
+
+        * EWSTools/cold-boot.sh:
+            - fdisk doesn't have p and 1 as default commands in 10.04.
+        * EWSTools/start-queue.sh:
+            - git doesn't understanding the -B argument in 10.04. We've been
+              using this change locally on the EC2 bots for a while.
+
+2012-07-01  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        * EWSTools/boot.sh:
+            - We need to start the screen in detached mode so that we can run
+              it remotely via ssh.
+
+2012-07-01  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        * EWSTools/cold-boot.sh:
+            - Turns out we need to sudo this command in order for it to
+              actually dimiss the EULA screen. :)
+
+2012-06-29  Adam Barth  <abarth@webkit.org>
+
+        Turns out we need zip too.
+
+        * EWSTools/cold-boot.sh:
+
+2012-06-29  Adam Barth  <abarth@webkit.org>
+
+        Add a cold-boot.sh script for the EWS
+        https://bugs.webkit.org/show_bug.cgi?id=90330
+
+        Unreviewed.
+
+        * EWSTools/cold-boot.sh: Added.
+            - This script can take us from a cold GCE instance to a running EWS
+              bot in one fell swoop.
+        * EWSTools/start-queue.sh:
+            - The if-block at the top of this script was causing trouble. I
+              removed it from the bots a while ago. Now that we're using SVN to
+              cold-boot the EWS bots, we need to make this change in the repo.
+
+2012-06-29  Luiz Agostini  <luiz.agostini@nokia.com>
+
+        [Qt][WK2] Private non-QtQuick API
+        https://bugs.webkit.org/show_bug.cgi?id=84532
+
+        MiniBrowserRaw is an usage example for the QRawWebView API.
+        It is only an example and is not fully implemented.
+
+        Reviewed by Noam Rosenthal.
+
+        * MiniBrowser/qt/raw/DerivedSources.pri: Added.
+        * MiniBrowser/qt/raw/MiniBrowserRaw.pro: Added.
+        * MiniBrowser/qt/raw/Target.pri: Added.
+        * MiniBrowser/qt/raw/View.cpp: Added.
+        * MiniBrowser/qt/raw/View.h: Added.
+        * Scripts/webkitpy/style/checker.py:
+        * Tools.pro:
+
+2012-06-29  Ojan Vafai  <ojan@chromium.org>
+
+        Remove leopard bots from garden-o-matic
+        https://bugs.webkit.org/show_bug.cgi?id=90328
+
+        Reviewed by Adam Barth.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/failures_unittests.js:
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui/notifications_unittests.js:
+
+2012-06-29  Ojan Vafai  <ojan@chromium.org>
+
+        garden-o-matic broken: TypeError: 'undefined' is not an object (evaluating 'buildLocations[currentIndex].url')
+        https://bugs.webkit.org/show_bug.cgi?id=90243
+
+        Reviewed by Dirk Pranke.
+
+        jQuery was trying to be too smart and parsing the jsonp as json because of it's content-type.
+        Excise jQuery and just use XHR directly since it's easier to maintain something where we control it
+        all.
+
+        Not really sure how to unittest this. I tested it all manually of course.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/net.js:
+        Made net.ajax a drop-in replacement for the features of $.ajax that we were using.
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/ui_unittests.js:
+        Not related to this patch, but figured I'd update the failing test while I was at it.
+
+2012-06-29  Yaron Friedman  <yfriedman@chromium.org>
+
+        Fix layout test runner for Android after https://bugs.webkit.org/show_bug.cgi?id=88134
+        https://bugs.webkit.org/show_bug.cgi?id=90309
+
+        Reviewed by Adam Barth.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_android.py:
+        (ChromiumAndroidPort.start_http_server):
+
+2012-06-29  James Weatherall  <wez@chromium.org>
+
+        NPObjectWrapper may not address all window script object lifetime issues
+        https://bugs.webkit.org/show_bug.cgi?id=85679
+
+        TestNetscapePlugin now has a leak-window-scriptable-object test which takes a reference to the window script object, and a second reference to it via the "self" property, and does not release those references. This is used to simulate a leaky plugin in layout tests of the NPAPI scripting interface glue code.
+
+        Reviewed by Nate Chapin.
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+        (PluginTest::NPN_GetProperty):
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.h:
+        (PluginTest):
+        * DumpRenderTree/TestNetscapePlugIn/Tests/LeakWindowScriptableObject.cpp: Added.
+        (LeakWindowScriptableObject):
+        (LeakWindowScriptableObject::LeakWindowScriptableObject):
+        (LeakWindowScriptableObject::NPP_New):
+
+2012-06-29  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: add comment about how determine_full_port_name() works for apple ports, fix -wk2 bug
+        https://bugs.webkit.org/show_bug.cgi?id=90314
+
+        Reviewed by Ojan Vafai.
+
+        Add comments and fix a bug in how we would handle the mac-wk2
+        and win-wk2 port names after confusion around in bug 90312 :).
+
+        * Scripts/webkitpy/layout_tests/port/apple.py:
+        (ApplePort.determine_full_port_name):
+
+2012-06-29  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: remove support for mac leopard from chromium configurations
+        https://bugs.webkit.org/show_bug.cgi?id=90313
+
+        Reviewed by Tony Chang.
+
+        Google has shipped the last version of Chrome that will support
+        Mac OS 10.5 (Leopard), and we no longer have bots that run this
+        configuration, so we're removing support for it.
+
+        A subsequent change will remove the baselines in platform/chromium-mac-leopard.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py:
+        (BaselineOptimizerTest.test_complex_shadowing):
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort):
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        (ChromiumMacPort):
+        * Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
+        (ChromiumMacPortTest.test_versions):
+        * Scripts/webkitpy/layout_tests/port/factory_unittest.py:
+        (FactoryTest.test_mac):
+        (FactoryTest.test_chromium_mac):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (test_rebaseline_and_copy_test_with_lion_result):
+
+2012-06-29  Ojan Vafai  <ojan@chromium.org>
+
+        Fix optimize-baselines to not move baselines from win to win-7sp0
+        https://bugs.webkit.org/show_bug.cgi?id=90312
+
+        Reviewed by Dirk Pranke.
+
+        It used to consider win-7sp0 as the common directory for all the Apple
+        windows ports and incorrectly move results out of win.
+
+        * Scripts/webkitpy/common/checkout/baselineoptimizer.py:
+        * Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py:
+        (BaselineOptimizerTest.test_win_does_not_drop_to_win_7sp0):
+        (BaselineOptimizerTest.test_common_directory_includes_root):
+
+2012-06-28  Ojan Vafai  <ojan@chromium.org>
+
+        Fix rebaselining for Qt and Apple ports
+        https://bugs.webkit.org/show_bug.cgi?id=90204
+
+        Reviewed by Dirk Pranke.
+
+        -Apporpriately put wk2 results in the -wk2 directories.
+        -Since Qt and Apple-Win don't have bots that correspond to the
+        platform/qt and platform/win directories, we need to fudge it
+        and always put the results in those directories for those ports.
+
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        (rebaseline_override_dir):
+        * Scripts/webkitpy/layout_tests/port/factory.py:
+        (_builder_options):
+        Identify webkit2 builders by the WK2 in the builder name.
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineTest._baseline_directory):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        (TestRebaseline.test_baseline_directory):
+
+2012-06-29  Zoltan Horvath  <zoltan@webkit.org>
+
+        Add support for --force parameter to run-performance-tests
+        https://bugs.webkit.org/show_bug.cgi?id=90279
+
+        Reviewed by Dirk Pranke.
+
+        It's helpful to be able to run tests from the Skipped list of the performance tests.
+
+        * Scripts/webkitpy/performance_tests/perftestsrunner.py:
+        (PerfTestsRunner._parse_args):
+        (PerfTestsRunner._collect_tests):
+        * Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py: Add test.
+        (test_collect_tests_with_skipped_list):
+
+2012-06-29  Tony Chang  <tony@chromium.org>
+
+        [GTK] Enable CSS grid layout LayoutTests on GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=90226
+
+        Reviewed by Martin Robinson.
+
+        This feature is disabled via Settings by default, but for testing,
+        we enable it using layoutTestController.overridePreferences. Add the
+        necessary plumbing for DRT.
+
+        WTR already works because support was added for Apple Mac earlier.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues): Feature is off by default.
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::overridePreference): Add handling of WebKitCSSGridLayoutEnabled.
+
+2012-06-29  Ádám Kallai  <kadam@inf.u-szeged.hu>
+
+        [Qt] Added Qt port for garden-o-matic.
+        https://bugs.webkit.org/show_bug.cgi?id=82719
+
+        Reviewed by Adam Barth.
+
+        * BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:
+        (.):
+
+2012-06-29  Balazs Kelemen  <kbalazs@webkit.org>
+
+        [Qt][WTR] Get rid of using DumpRenderTreeSupportQt
+        https://bugs.webkit.org/show_bug.cgi?id=90262
+
+        Reviewed by Alexey Proskuryakov.
+
+        Now that we decided to not support v8 in WebKit2
+        we can get rid of using DumpRenderTreeSupportQt
+        in WebKitTestRunner.
+
+        * Tools.pro:
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::resetAfterTest):
+        (WTR::InjectedBundlePage::didClearWindowForFrame):
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+
+2012-06-29  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Revert r121540, it broke most Qt builds
+
+        * qmake/mkspecs/features/default_post.prf:
+        * qmake/mkspecs/features/functions.prf:
+
+2012-06-29  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Make build-webkit reject uknown configurations, eg. --profile
+
+        The qmake-based buildsystem doesn't support it.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Scripts/webkitdirs.pm:
+        (buildQMakeProjects):
+
+2012-06-29  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Don't add Qt module dependencies in features.prf
+
+        The required dependencies are already added in WebCore.pri.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/features.prf:
+
+2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Use LIBS_PRIVATE instead of putting dependencies into LIBS
+
+        Reviewed by Tor Arne Vestbø..
+
+        * qmake/mkspecs/features/default_post.prf:
+        * qmake/mkspecs/features/functions.prf:
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        DOMHTMLCollection::item may return a wrong element after namedItem is called
+        https://bugs.webkit.org/show_bug.cgi?id=90240
+
+        Reviewed by Antti Koivisto.
+
+        Add a WebKit API test since namedItem is not used in the JS/V8 binding code.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.html: Copied from Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.html.
+        * TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.mm: Copied from Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.mm.
+        (TestWebKitAPI::TEST):
+
+2012-06-28  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: remove the 'google-chrome' port code
+        https://bugs.webkit.org/show_bug.cgi?id=88824
+
+        Reviewed by Ojan Vafai.
+
+        NRWT now supports passing additional baseline directories
+        and expectations files on the command line, so there's no need
+        to support the concept of a 'google-chrome' port directly.
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.path_to_test_expectations_file):
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        (ChromiumMacPort.__init__):
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        (ChromiumWinPort.__init__):
+        * Scripts/webkitpy/layout_tests/port/factory.py:
+        (PortFactory):
+        * Scripts/webkitpy/layout_tests/port/factory_unittest.py:
+        (FactoryTest.test_win):
+        * Scripts/webkitpy/layout_tests/port/google_chrome.py: Removed.
+        * Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py: Removed.
+
+2012-06-28  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up how arguments are passed to workers
+        https://bugs.webkit.org/show_bug.cgi?id=90126
+
+        Reviewed by Ojan Vafai.
+
+        The way arguments are passed to workers has been crufty. It
+        turns out it can be a lot cleaner via two things:
+        1) using a factory method instead of instantiating objects
+        directly in manager_worker_broker removes the need for passing
+        'worker arguments' to the broker.
+        2) it turns out that since mock hosts and test ports are purely
+        in-memory constructions, they can be pickled and passed to child
+        workers, meaning that the worker no longer needs hacky code to
+        pass the port in a special case or to guess what to do if we
+        don't have a host - all of the test-specific logic can move to
+        the test file, where we can stub out the mock host's
+        port_factory to return the same already-created port when it
+        needs to be shared.
+
+        This change also moves WorkerException to manager_worker_broker.py
+        where it belongs, and removes several useless tests that were
+        just a maintenance burden (and would've needed rewriting when we
+        change the rest of the broker implementation).
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._run_tests.worker_factory):
+        (Manager._run_tests):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py:
+        (get):
+        (WorkerException):
+        (AbstractWorker.__init__):
+        (_ManagerConnection.__init__):
+        (_ManagerConnection.start_worker):
+        (_InlineManager.__init__):
+        (_InlineManager.start_worker):
+        (_MultiProcessManager._can_pickle_host):
+        (_MultiProcessManager):
+        (_MultiProcessManager.start_worker):
+        (_WorkerConnection.__init__):
+        (_InlineWorkerConnection.__init__):
+        (_InlineWorkerConnection.join):
+        (_InlineWorkerConnection.run):
+        (_Process.run):
+        (_MultiProcessWorkerConnection.__init__):
+        (_MultiProcessWorkerConnection.start):
+        (_MultiProcessWorkerConnection):
+        (_MultiProcessWorkerConnection.run):
+        * Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py:
+        (_TestWorker.__init__):
+        (_TestWorker.run):
+        (_TestsMixin.test_name):
+        (_TestsMixin.test_cancel):
+        (_TestsMixin.test_done):
+        (_TestsMixin.test_unknown_message):
+        (InlineBrokerTests.setUp):
+        (MultiProcessBrokerTests.setUp):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (Worker.__init__):
+        (Worker.run):
+        * Scripts/webkitpy/layout_tests/controllers/worker_unittest.py: Removed.
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (passing_run):
+        (logging_run):
+        (run_and_capture):
+        (MainTest.test_child_processes_2):
+        (MainTest.test_child_processes_min):
+        (MainTest.test_exception_raised):
+        (MainTest.test_keyboard_interrupt):
+        (MainTest.test_retrying_and_flaky_tests):
+        (MainTest.test_run_order__inline):
+
+2012-06-28  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: don't try to catch worker exceptions in run_webkit_tests.__main__
+        https://bugs.webkit.org/show_bug.cgi?id=90125
+
+        Reviewed by Ojan Vafai.
+
+        It turns out run_webkit_tests.py wasn't really using
+        WorkerException and the catch we had for it was pointless. I've
+        removed the symbol import and moved it to the integration tests
+        where it is needed. Eventually the definition of the exception
+        moves to the broker module, and so minimizing the number of
+        users of it is a good thing.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py:
+        (MainTest.test_exception_raised):
+
+2012-06-28  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: clean up passing of log messages between processes
+        https://bugs.webkit.org/show_bug.cgi?id=90123
+
+        Reviewed by Ojan Vafai.
+
+        It turns out log messages are perfectly picklable by themselves
+        and contain the process id of the process that generated the
+        message, so if we just pass the record from the worker to the
+        manager and call logger.handle() in the manager, everything just
+        works :).
+
+        The change is covered by existing tests.
+
+        * Scripts/webkitpy/layout_tests/controllers/manager.py:
+        (Manager._log_messages):
+        * Scripts/webkitpy/layout_tests/controllers/worker.py:
+        (_WorkerLogHandler.emit):
+        * Scripts/webkitpy/layout_tests/views/metered_stream.py:
+        (MeteredStream.__init__):
+        (_LogHandler.emit):
+
+2012-06-28  Dirk Pranke  <dpranke@chromium.org>
+
+        add a pylint wrapper for linting python code
+        https://bugs.webkit.org/show_bug.cgi?id=90232
+
+        Reviewed by Adam Barth.
+
+        Currently we use 'pep8' to check python code in
+        check-webkit-style. pep8 is fast but simple; pylint is slower
+        but has much more robust linting capabilities and will catch
+        variable typos and all sorts of other things. Eventually we
+        should switch check-webkit-style to use this, but our code is
+        far from linting now so it needs to be cleaned up first.
+
+        This change adds the infrastructure and a wrapper so we can
+        start doing that.
+
+        * Scripts/lint-webkitpy: Added.
+        * Scripts/webkitpy/pylintrc: Added.
+        * Scripts/webkitpy/thirdparty/__init__.py:
+        (AutoinstallImportHook.find_module):
+        (AutoinstallImportHook._install_pylint):
+
+2012-06-28  Tony Chang  <tony@chromium.org>
+
+        [GTK] Use WEBKITOUTPUTDIR to find fonts in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=90215
+
+        Reviewed by Martin Robinson.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeFonts): Check for WEBKITOUTPUTDIR first.
+        * Scripts/webkitpy/layout_tests/port/gtk.py:
+        (GtkPort.setup_environ_for_server): Copy the environment variable to the child process.
+        * WebKitTestRunner/InjectedBundle/gtk/ActivateFontsGtk.cpp:
+        (WTR::inititializeFontConfigSetting): Check for WEBKITOUTPUTDIR first.
+
+2012-06-28  Dirk Pranke  <dpranke@chromium.org>
+
+        derive ChromiumPort from WebKitPort in NRWT in order to support skipping tests if symbols are missing
+        https://bugs.webkit.org/show_bug.cgi?id=89706
+
+        Reviewed by Ojan Vafai.
+
+        Try again to land the change first landed in r121363. This patch
+        adds a bunch more tests and reworks the handling of
+        port-specific default values for --pixel-tests and --time-out-ms
+        to be more consistent (adding a default_pixel_tests() method,
+        pushing the webkit default_timeout_ms() value up into base.py,
+        and overriding it properly in the chromium and apple mac ports.
+
+        Also change the logic in
+        run_webkit_tests._setup_derived_options() to not second-guess
+        what the port wants the timeout value to be for debug builds;
+        computing this in two different places led to several bugs.
+
+        This change also changes the Chromium unittest ports to derive
+        from ChromiumPortTestCase instead of PortTestCase, so that we
+        ensure that we're running the same tests on all port variants
+        more easily. There's more cleanup that can be done here, but
+        this is good enough for now
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.default_pixel_tests):
+        (Port):
+        (Port.default_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort):
+        (ChromiumPort.__init__):
+        (ChromiumPort.default_pixel_tests):
+        (ChromiumPort.default_timeout_ms):
+        (ChromiumPort.driver_name):
+        (ChromiumPort._driver_class):
+        (ChromiumPort._missing_symbol_to_skipped_tests):
+        (ChromiumPort.skipped_layout_tests):
+        (ChromiumPort.setup_test_run):
+        (ChromiumPort._path_to_image_diff):
+        (ChromiumPort._convert_path):
+        * Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py:
+        (ChromiumAndroidPortTest):
+        (ChromiumAndroidPortTest.test_expectations_files):
+        * Scripts/webkitpy/layout_tests/port/chromium_linux.py:
+        (ChromiumLinuxPort._modules_to_search_for_symbols):
+        * Scripts/webkitpy/layout_tests/port/chromium_linux_unittest.py:
+        (ChromiumLinuxPortTest):
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        (ChromiumMacPort._modules_to_search_for_symbols):
+        * Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py:
+        (ChromiumMacPortTest):
+        * Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py:
+        split off from chromium_unittest.
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        (ChromiumWinPort._modules_to_search_for_symbols):
+        * Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py:
+        (ChromiumWinTest):
+        * Scripts/webkitpy/layout_tests/port/mac.py:
+        (MacPort.default_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/mac_unittest.py:
+        (MacTest.test_default_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/mock_drt.py:
+        (MockDRTPort.start_http_server):
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        (PortTestCase.test_default_timeout_ms):
+        (PortTestCase):
+        (PortTestCase.test_default_pixel_tests):
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        (TestPort.default_pixel_tests):
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitPort._modules_to_search_for_symbols):
+        (WebKitPort):
+        (WebKitPort._symbols_string):
+        (WebKitPort._skipped_tests_for_unsupported_features):
+        * Scripts/webkitpy/layout_tests/port/webkit_unittest.py:
+        (TestWebKitPort._symbols_string):
+        (TestWebKitPort._tests_for_disabled_features):
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        (_set_up_derived_options):
+
+2012-06-28  Joshua Bell  <jsbell@chromium.org>
+
+        run-bindings-tests should return non-zero exit code on test failure
+        https://bugs.webkit.org/show_bug.cgi?id=90205
+
+        Reviewed by Adam Barth.
+
+        * Scripts/run-bindings-tests:
+        (main):
+
+2012-06-28  Terry Anderson  <tdanderson@chromium.org>
+
+        [chromium] Reset the device scale factor to 1 before each test is run
+        https://bugs.webkit.org/show_bug.cgi?id=90212
+
+        Reviewed by Adam Barth.
+
+        Some tests change the device scale factor, so this needs to be reset to
+        1.0 at the start of each test to avoid test flakiness.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::reset):
+
+2012-06-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Cleanup HTMLFormCollection
+        https://bugs.webkit.org/show_bug.cgi?id=90111
+
+        Reviewed by Andreas Kling.
+
+        Add a WebKit API test using copy-paste design pattern per kling's request.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.html: Added.
+        * TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.mm: Added.
+        (-[HTMLFormCollectionNamedItemTest webView:didFinishLoadForFrame:]):
+        (TestWebKitAPI):
+        (TestWebKitAPI::TEST):
+
+2012-06-28  Tim Horton  <timothy_horton@apple.com>
+
+        [mac] WKTR windows still don't stay off screen sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=90214
+        <rdar://problem/11760263>
+
+        Reviewed by Simon Fraser.
+
+        In some cases, the system itself will consult [WebKitTestRunnerWindow frame], so we should refrain from
+        overriding it and instead provide a different method to use when we want the web-facing "fake" window origin
+        (for PlatformWebView::windowFrame()).
+
+        * WebKitTestRunner/mac/PlatformWebViewMac.mm:
+        (-[WebKitTestRunnerWindow frameRespectingFakeOrigin]):
+        (WTR::PlatformWebView::windowFrame):
+
+2012-06-28  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] Add unit tests for GtkInputMethodFilter
+        https://bugs.webkit.org/show_bug.cgi?id=88698
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add unit tests for GtkInputMethodFilter in the WebCore platform layer.
+        This change adds the TestGtk test suite which will be used for all non-API
+        layer GTK unit tests.
+
+        * TestWebKitAPI/GNUmakefile.am: Update the build to include the new tests.
+        * TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp: Added.
+        (TestWebKitAPI::PlatformWebView::PlatformWebView): Remove the call to gtk_init here
+        as it's now in main.cpp.
+        * TestWebKitAPI/gtk/main.cpp: Change the g_type_init call to gtk_init, because now
+        a majority of all unit tests depend on GTK+ being initialized.
+
+2012-06-28  Christophe Dumez  <christophe.dumez@intel.com>
+
+        [EFL] Enable support for HTML5 datalist
+        https://bugs.webkit.org/show_bug.cgi?id=90157
+
+        Reviewed by Martin Robinson.
+
+        Turn on DATALIST flag by default on EFL port to
+        support HTML5 datalist tag.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-06-28  Tony Chang  <tony@chromium.org>
+
+        Enable CSS grid layout LayoutTests on platform Mac
+        https://bugs.webkit.org/show_bug.cgi?id=90113
+
+        Reviewed by Ojan Vafai.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues): Reset the value to NO between tests.
+
+2012-06-28  Mike Fenton  <mifenton@rim.com>
+
+        [BlackBerry] Add watchlist options for Blackberry and editing.
+        https://bugs.webkit.org/show_bug.cgi?id=90193
+
+        Unreviewed.
+
+        Add BlackBerry and Editing watchlist and monitor them.
+
+        * Scripts/webkitpy/common/config/watchlist:
+
+2012-06-28  Tim Horton  <timothy_horton@apple.com>
+
+        Unreviewed, upgrade myself to a reviewer!
+
+        http://www.webkit.org/blog/2082/tim-horton-is-now-a-webkit-reviewer/
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-06-28  Terry Anderson  <tdanderson@chromium.org>
+
+        [Chromium] Chromium's LayoutTestController is missing setBackingScaleFactor
+        https://bugs.webkit.org/show_bug.cgi?id=83635
+
+        Reviewed by Adam Barth.
+
+        Added InvokeCallbackTask, a new derived class of MethodTask. When
+        setBackingScaleFactor is called, a call to setDeviceScaleFactor in
+        WebView is made and then postTask is used to invoke the callback
+        function specified in testRunner.setBackingScaleFactor. 
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (InvokeCallbackTask):
+        (InvokeCallbackTask::InvokeCallbackTask):
+        (InvokeCallbackTask::runIfValid):
+        (LayoutTestController::setBackingScaleFactor):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        (LayoutTestController):
+
+2012-06-28  Ojan Vafai  <ojan@chromium.org>
+
+        Make rebaseline-test and rebaseline-expectations work for non-Chromium ports
+        https://bugs.webkit.org/show_bug.cgi?id=90186
+
+        Reviewed by Adam Barth.
+
+        This makes rebaselining work for all ports that have a TestExpectations file
+        in the tree. I didn't test other ports.
+
+        This doesn't address 100% of the problem. The rebaseline code puts the expectations
+        in the most specific directory and relies on optimize-baselines to merge baselines
+        appropriately. This only works if every platform directory has an equivalent bot
+        that runs the tests, which is not true for most ports.
+
+        * Scripts/webkitpy/common/net/buildbot/buildbot.py:
+        (Builder._revision_and_build_for_filename):
+        Some bots have filenames that aren't revision/build number pairs
+        e.g. they are random junk like aQhxvx. Handle this gracefully.
+        (Builder._fetch_revision_to_build_map):
+        (Builder._file_info_list_to_revision_to_build_list):
+        * Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py:
+        (BuilderTest.test_build_and_revision_for_filename):
+        (BuilderTest.test_file_info_list_to_revision_to_build_list):
+        * Scripts/webkitpy/layout_tests/port/builders.py:
+        Update the list of builders. This list needs to be kept up
+        to date for the rebaseline tool to work.
+        * Scripts/webkitpy/tool/commands/rebaseline.py:
+        (RebaselineTest._results_url):
+        (RebaselineExpectations._run_webkit_patch):
+        (RebaselineExpectations._rebaseline_port):
+        * Scripts/webkitpy/tool/commands/rebaseline_unittest.py:
+        Qt port uses qmake to determine the right version. Systems without qmake correctly fallback
+        to a specific version.
+
+2012-06-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][NRWT] Fix baseline and skipped file search path.
+        https://bugs.webkit.org/show_bug.cgi?id=89882
+
+        Unreviewed trivial typo fix after r121430.
+
+        * Scripts/webkitpy/layout_tests/port/qt_unittest.py:
+        (QtPortTest._assert_search_path):
+        (QtPortTest._assert_skipped_path):
+
+2012-06-28  János Badics  <jbadics@inf.u-szeged.hu>
+
+        [Qt][NRWT] Fix baseline and skipped file search path.
+        https://bugs.webkit.org/show_bug.cgi?id=89882
+
+        Reviewed by Csaba Osztrogonác.
+
+        * Scripts/webkitpy/layout_tests/port/qt.py:
+        (QtPort._search_paths):
+        (QtPort):
+        (QtPort.baseline_search_path):
+        (QtPort._skipped_file_search_paths):
+        * Scripts/webkitpy/layout_tests/port/qt_unittest.py:
+        (QtPortTest):
+        (QtPortTest._assert_skipped_path):
+        (QtPortTest.test_baseline_search_path):
+        (QtPortTest.test_skipped_file_search_path):
+
+2012-06-28  Alexander Pavlov  <apavlov@chromium.org>
+
+        [Qt] inspector/styles/inject-stylesheet.html makes 4 tests flakey (TEXT PASS)
+        https://bugs.webkit.org/show_bug.cgi?id=90167
+
+        Reviewed by Csaba Osztrogonác.
+
+        DRT should remove user stylesheets from the page group when resetting before running another test.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::resetToConsistentStateBeforeTesting):
+
+2012-06-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt][DRT] Reset AcceleratedCompositingEnabled between tests
+        https://bugs.webkit.org/show_bug.cgi?id=90164
+
+        Reviewed by Simon Hausmann.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::WebPage::resetSettings):
+
+2012-06-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Restore original value of mock scrollbars between tests
+        https://bugs.webkit.org/show_bug.cgi?id=90155
+
+        Reviewed by Simon Hausmann.
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::WebPage::resetSettings):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::setMockScrollbarsEnabled):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        (LayoutTestController):
+
+2012-06-27  Mark Rowe  <mrowe@apple.com>
+
+        <http://webkit.org/b/90096> Building within Xcode sometimes does a full rebuild after building via build-webkit
+
+        We need to ensure that build-webkit uses the same setting for SHARED_PRECOMPS_DIR
+        as what Xcode itself will use when building, otherwise switching between the two
+        can result in the precompiled headers being rebuilt and thus the entire world
+        rebuilding.
+
+        Reviewed by Dan Bernstein.
+
+        * Scripts/webkitdirs.pm:
+        (determineBaseProductDir):
+
+2012-06-27  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r121363, r121367, r121384, and
+        r121390.
+        http://trac.webkit.org/changeset/121363
+        http://trac.webkit.org/changeset/121367
+        http://trac.webkit.org/changeset/121384
+        http://trac.webkit.org/changeset/121390
+        https://bugs.webkit.org/show_bug.cgi?id=90134
+
+        It broke debug NRWT on GTK and on Qt (Requested by Ossy_NIGHT
+        on #webkit).
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort):
+        (ChromiumPort.__init__):
+        (ChromiumPort._check_file_exists):
+        (ChromiumPort.default_results_directory):
+        (ChromiumPort._driver_class):
+        (ChromiumPort._build_path):
+        (ChromiumPort._path_to_image_diff):
+        * Scripts/webkitpy/layout_tests/port/chromium_linux.py:
+        (ChromiumLinuxPort.baseline_search_path):
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        (ChromiumMacPort.baseline_search_path):
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        (ChromiumPortTest):
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        (ChromiumWinPort.baseline_search_path):
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitPort.__init__):
+        (WebKitPort._webcore_symbols_string):
+        (WebKitPort._skipped_tests_for_unsupported_features):
+        * Scripts/webkitpy/layout_tests/port/webkit_unittest.py:
+        (TestWebKitPort._webcore_symbols_string):
+        (WebKitPortUnitTests.test_default_options):
+
+2012-06-27  Dirk Pranke  <dpranke@chromium.org>
+
+        Fix typo in r121384 :(
+
+        Unreviewed, build fix.
+
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitPort.default_test_timeout_ms):
+
+2012-06-27  Dirk Pranke  <dpranke@chromium.org>
+
+        nrwt: default timeout for debug bots broke in r121363
+        https://bugs.webkit.org/show_bug.cgi?id=90112
+
+        Unreviewed, build fix.
+
+        I forgot to account for release and debug having different
+        default values :(.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort.default_test_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitPort):
+        (WebKitPort.default_test_timeout_ms):
+        * Scripts/webkitpy/layout_tests/port/webkit_unittest.py:
+        (WebKitPortUnitTests.test_default_options):
+
+2012-06-27  Dirk Pranke  <dpranke@chromium.org>
+
+        webkitpy: fix a couple of issues running under cygwin
+        https://bugs.webkit.org/show_bug.cgi?id=90035
+
+        Reviewed by Eric Seidel.
+
+        These were causing unit tests to fail on cygwin (apple win bot).
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/performance_tests/perftest.py:
+
+2012-06-27  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] DumpRenderTree on Android should call SkUseTestFontConfigFile once available
+        https://bugs.webkit.org/show_bug.cgi?id=89801
+
+        Reviewed by Nate Chapin.
+
+        Let's call SkUseTestFontConfigFile now that it exists.
+
+        * DumpRenderTree/chromium/TestShellAndroid.cpp:
+        (platformInit):
+
+2012-06-27  Dirk Pranke  <dpranke@chromium.org>
+
+        Fix typo introduced in r121363.
+
+        Unreviewed, build fix.
+
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitPort._symbols_string):
+
+2012-06-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Moving from committers to reviewers :-)
+
+        Rubber stamped by Filip Pizlo.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2012-06-27  Dirk Pranke  <dpranke@chromium.org>
+
+        Derive ChromiumPort from WebKitPort to add support for missing symbols to skip tests
+        https://bugs.webkit.org/show_bug.cgi?id=89706
+
+        Reviewed by Adam Barth.
+
+        Based on the original patch by Raymond Toy.
+
+        This patch changes ChromiumPort to derive from webkit.WebKitPort
+        instead of base.Port. This is a long-awaited change and a
+        precursor to merging base.Port and webkit.WebKitPort, but is
+        driven by the desire to dynamically detect whether the MP3 and
+        AAC codecs are compiled into DRT on Chromium, for which we
+        wanted to re-use the existing logic in WebKit port for determine
+        what to skip at compile time.
+
+        Most of the changes are shuffling things around so that we don't
+        change any other logic and so we override the necessary methods
+        in WebKitPort (and try to follow the same method definition
+        order where possible).
+
+        Also, on the Chromium port the mp3 and aac codecs are actually
+        defined in a separate library, so scanning webcore isn't
+        sufficient. This patch generalizes the symbol lookup to handle
+        multiple libraries, and uses different libraries as appropriate
+        for Chromium.
+
+        The only functional/visible changes should be in the value
+        returned for skipped_layout_tests().
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        (ChromiumPort):
+        (ChromiumPort.__init__):
+        (ChromiumPort.driver_name):
+        (ChromiumPort._driver_class):
+        (ChromiumPort._missing_symbol_to_skipped_tests):
+        (ChromiumPort.skipped_layout_tests):
+        (ChromiumPort.setup_test_run):
+        (ChromiumPort._path_to_image_diff):
+        (ChromiumPort._convert_path):
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        (ChromiumPortTest.test_missing_symbol_to_skipped_tests):
+        * Scripts/webkitpy/layout_tests/port/chromium_linux.py:
+        (ChromiumLinuxPort._modules_to_search_for_symbols):
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        (ChromiumLinuxPort._modules_to_search_for_symbols):
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        (ChromiumLinuxPort._modules_to_search_for_symbols):
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        (WebKitPort):
+        (WebKitPort.__init__):
+        (WebKitPort._symbols_string):
+        (WebKitPort._modules_to_search_for_symbols):
+
+2012-06-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] REGRESSION(r121339): It broke the build on the Qt Windows bots
+        https://bugs.webkit.org/show_bug.cgi?id=90081
+
+        Buildfix for Qt 4.8 Windows. Use the former path for Qt 4.8, and the newer one for Qt 5.
+
+        Reviewed by Noam Rosenthal.
+
+        * qmake/mkspecs/features/features.prf:
+
+2012-06-27  Sergio Villar Senin  <svillar@igalia.com>
+
+        [WK2] [GTK] WebKit2 testing bot fails to run tests due to missing files
+        https://bugs.webkit.org/show_bug.cgi?id=90061
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Add "-no-install -no-fast-install" to the LDFLAGS in bots. With
+        this flag libtool tells the linker to set the rpath for the output
+        file to the full path of the .libs directory, instead of using a
+        wrapper script to set up the LD_LIBRARY_PATH. This will allow us
+        to directly reuse builds in the pure testing bots.
+
+        * BuildSlaveSupport/gtk/daemontools-buildbot.conf:
+
+2012-06-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] No need to save and restore TEMPLATE in a function
+
+        This was a leftover from when the logic was not in its own function scope.
+
+        QMAKE_FRAMEWORK_BUNDLE_NAME on the other hand is exported in qtLibraryTarget, which
+        will surprisingly affect the global scope as well, so we have to save and restore it.
+
+        Original patch by Oswald Buddenhagen <oswald.buddenhagen@nokia.com> on 2012-06-27
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/functions.prf:
+
+2012-06-27  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        [Qt] Fix lookup location for sqlite sources
+
+        Don't look in the install dir - we are unlikely to find anything there
+        unless we are doing a developer build.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * qmake/mkspecs/features/features.prf:
+
+2012-06-27  Zan Dobersek  <zandobersek@gmail.com>
+
+        [Gtk] Add support for the Gamepad API
+        https://bugs.webkit.org/show_bug.cgi?id=87503
+
+        Reviewed by Carlos Garcia Campos.
+
+        Enable the gamepad support for the GTK port.
+
+        * Scripts/webkitperl/FeatureList.pm:
+
+2012-06-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Fix gcc build after r121302
+        https://bugs.webkit.org/show_bug.cgi?id=90055
+
+        Reviewed by Mark Rowe.
+
+        Assume RTTI is always disabled so that gtest builds on XCode 3.2.6.
+
+        It appears that gcc doesn't like window.get().* inside a template so replace that by [window.get() *] instead.
+
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm:
+        (TestWebKitAPI::AcceptsFirstMouse::runTest):
+
+2012-06-27  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Add master.cfg unittest to help migration - pass BuildStep instances instead of BuildStep subclasses
+        https://bugs.webkit.org/show_bug.cgi?id=89564
+
+        Reviewed by Tony Chang.
+
+        * BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py:
+        (BuildStepsConstructorTest):
+        (BuildStepsConstructorTest.generateTests):
+        (BuildStepsConstructorTest.createTest):
+        (BuildStepsConstructorTest.createTest.doTest):
+
 2012-06-26  Mark Hahnenberg  <mhahnenberg@apple.com>
 
         Add support for preciseTime() to WebKitTestRunner
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gyp/.gitignore b/Tools/DumpRenderTree/DumpRenderTree.gyp/.gitignore
index 72f70a29c..2ca14bf1e 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gyp/.gitignore
+++ b/Tools/DumpRenderTree/DumpRenderTree.gyp/.gitignore
@@ -2,4 +2,5 @@
 *.mk
 *.sln
 *.vcproj*
+*.vcxproj*
 *.xcodeproj*
diff --git a/Tools/DumpRenderTree/DumpRenderTree.gypi b/Tools/DumpRenderTree/DumpRenderTree.gypi
index 5412a199e..a414fd25a 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.gypi
+++ b/Tools/DumpRenderTree/DumpRenderTree.gypi
@@ -80,6 +80,7 @@
             'TestNetscapePlugIn/Tests/GetURLWithJavaScriptURL.cpp',
             'TestNetscapePlugIn/Tests/GetURLWithJavaScriptURLDestroyingPlugin.cpp',
             'TestNetscapePlugIn/Tests/GetUserAgentWithNullNPPFromNPPNew.cpp',
+            'TestNetscapePlugIn/Tests/LeakWindowScriptableObject.cpp',
             'TestNetscapePlugIn/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp',
             'TestNetscapePlugIn/Tests/NPRuntimeRemoveProperty.cpp',
             'TestNetscapePlugIn/Tests/NullNPPGetValuePointer.cpp',
diff --git a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
index 1b96e077e..7249a09bc 100644
--- a/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
+++ b/Tools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
@@ -174,6 +174,13 @@
 			remoteGlobalIDString = 2D403EB2150871F9005358D2;
 			remoteInfo = LayoutTestHelper;
 		};
+		378C802315AB589B00746821 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 08FB7793FE84155DC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 9340994A08540CAE007F3BC8;
+			remoteInfo = DumpRenderTree;
+		};
 		5DC82A6F1023C93D00FD1D3B /* PBXContainerItemProxy */ = {
 			isa = PBXContainerItemProxy;
 			containerPortal = 08FB7793FE84155DC02AAC07 /* Project object */;
@@ -739,6 +746,7 @@
 			buildToolPath = make;
 			buildWorkingDirectory = "$(SRCROOT)/mac/PerlSupport";
 			dependencies = (
+				378C802415AB589B00746821 /* PBXTargetDependency */,
 			);
 			name = "DumpRenderTree Perl Support";
 			passBuildSettingsInEnvironment = 1;
@@ -967,6 +975,11 @@
 			target = 2D403EB2150871F9005358D2 /* LayoutTestHelper */;
 			targetProxy = 2D403F201508736C005358D2 /* PBXContainerItemProxy */;
 		};
+		378C802415AB589B00746821 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 9340994A08540CAE007F3BC8 /* DumpRenderTree */;
+			targetProxy = 378C802315AB589B00746821 /* PBXContainerItemProxy */;
+		};
 		5DC82A701023C93D00FD1D3B /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = 5DC82A661023C8DE00FD1D3B /* DumpRenderTree Perl Support */;
diff --git a/Tools/DumpRenderTree/LayoutTestController.cpp b/Tools/DumpRenderTree/LayoutTestController.cpp
index cd01d1c3b..3548c8b77 100644
--- a/Tools/DumpRenderTree/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/LayoutTestController.cpp
@@ -160,29 +160,6 @@ static JSValueRef dumpChildFrameScrollPositionsCallback(JSContextRef context, JS
     return JSValueMakeUndefined(context);
 }
 
-static JSValueRef dumpConfigurationForViewportCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    if (argumentCount < 2)
-        return JSValueMakeUndefined(context);
-
-
-    double deviceDPI = JSValueToNumber(context, arguments[0], exception);
-    ASSERT(!*exception);
-    double deviceWidth = JSValueToNumber(context, arguments[1], exception);
-    ASSERT(!*exception);
-    double deviceHeight = JSValueToNumber(context, arguments[2], exception);
-    ASSERT(!*exception);
-    double availableWidth = JSValueToNumber(context, arguments[3], exception);
-    ASSERT(!*exception);
-    double availableHeight = JSValueToNumber(context, arguments[4], exception);
-    ASSERT(!*exception);
-
-    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    controller->dumpConfigurationForViewport(static_cast<int>(deviceDPI), static_cast<int>(deviceWidth), static_cast<int>(deviceHeight), static_cast<int>(availableWidth), static_cast<int>(availableHeight));
-
-    return JSValueMakeUndefined(context);
-}
-
 static JSValueRef dumpDatabaseCallbacksCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -2225,6 +2202,20 @@ static JSValueRef setHasCustomFullScreenBehaviorCallback(JSContextRef context, J
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef setStorageDatabaseIdleIntervalCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 1)
+        return JSValueMakeUndefined(context);
+
+    double interval = JSValueToNumber(context, arguments[0], exception);
+    ASSERT(!*exception);
+
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setStorageDatabaseIdleInterval(interval);
+
+    return JSValueMakeUndefined(context);
+}
+
 static void layoutTestControllerObjectFinalize(JSObjectRef object)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(object));
@@ -2306,7 +2297,6 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "dumpBackForwardList", dumpBackForwardListCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpChildFrameScrollPositions", dumpChildFrameScrollPositionsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpChildFramesAsText", dumpChildFramesAsTextCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-        { "dumpConfigurationForViewport", dumpConfigurationForViewportCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpDOMAsWebArchive", dumpDOMAsWebArchiveCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpDatabaseCallbacks", dumpDatabaseCallbacksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "dumpEditingCallbacks", dumpEditingCallbacksCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -2445,6 +2435,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "setBackingScaleFactor", setBackingScaleFactorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "preciseTime", preciseTimeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "setHasCustomFullScreenBehavior", setHasCustomFullScreenBehaviorCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "setStorageDatabaseIdleInterval", setStorageDatabaseIdleIntervalCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0 }
     };
 
diff --git a/Tools/DumpRenderTree/LayoutTestController.h b/Tools/DumpRenderTree/LayoutTestController.h
index 54ca9278a..33bb16cdd 100644
--- a/Tools/DumpRenderTree/LayoutTestController.h
+++ b/Tools/DumpRenderTree/LayoutTestController.h
@@ -327,8 +327,6 @@ public:
 
     void abortModal();
 
-    void dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight);
-
     static void setSerializeHTTPLoads(bool serialize);
 
     // The following API test functions should probably be moved to platform-specific 
@@ -366,6 +364,8 @@ public:
     void setHasCustomFullScreenBehavior(bool value) { m_customFullScreenBehavior = value; }
     bool hasCustomFullScreenBehavior() const { return m_customFullScreenBehavior; }
 
+    void setStorageDatabaseIdleInterval(double);
+
 private:
     LayoutTestController(const std::string& testPathOrURL, const std::string& expectedPixelHash);
 
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
index 65dcaecd3..a3e97831b 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
@@ -208,6 +208,11 @@ void PluginTest::NPN_ReleaseObject(NPObject* npObject)
     browser->releaseobject(npObject);
 }
 
+bool PluginTest::NPN_GetProperty(NPObject* npObject, NPIdentifier propertyName, NPVariant* value)
+{
+    return browser->getproperty(m_npp, npObject, propertyName, value);
+}
+
 bool PluginTest::NPN_RemoveProperty(NPObject* npObject, NPIdentifier propertyName)
 {
     return browser->removeproperty(m_npp, npObject, propertyName);
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
index e83e82cfe..e7cd90326 100644
--- a/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
@@ -65,7 +65,6 @@ public:
     virtual NPError NPP_DestroyStream(NPStream*, NPReason);
     virtual int32_t NPP_WriteReady(NPStream*);
     virtual int32_t NPP_Write(NPStream*, int32_t offset, int32_t len, void* buffer);
-    
     virtual int16_t NPP_HandleEvent(void* event);
     virtual bool NPP_URLNotify(const char* url, NPReason, void* notifyData);
     virtual NPError NPP_GetValue(NPPVariable, void* value);
@@ -87,6 +86,7 @@ public:
     NPObject* NPN_CreateObject(NPClass*);
     NPObject* NPN_RetainObject(NPObject*);
     void NPN_ReleaseObject(NPObject*);
+    bool NPN_GetProperty(NPObject*, NPIdentifier propertyName, NPVariant* value);
     bool NPN_RemoveProperty(NPObject*, NPIdentifier propertyName);
 
 #ifdef XP_MACOSX
diff --git a/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/LeakWindowScriptableObject.cpp b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/LeakWindowScriptableObject.cpp
new file mode 100644
index 000000000..93f52a28e
--- /dev/null
+++ b/Tools/DumpRenderTree/TestNetscapePlugIn/Tests/LeakWindowScriptableObject.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PluginTest.h"
+
+using namespace std;
+
+class LeakWindowScriptableObject : public PluginTest {
+public:
+    LeakWindowScriptableObject(NPP npp, const string& identifier)
+        : PluginTest(npp, identifier)
+    {
+    }
+
+private:
+    virtual NPError NPP_New(NPMIMEType pluginType, uint16_t mode, int16_t argc, char *argn[], char *argv[], NPSavedData *saved)
+    {
+        // Get a new reference to the window script object.
+        NPObject* window;
+        if (NPN_GetValue(NPNVWindowNPObject, &window) != NPERR_NO_ERROR) {
+            log("Fail: Cannot fetch window script object");
+            return NPERR_NO_ERROR;
+        }
+
+        // Get another reference to the same object via window.self.
+        NPIdentifier self_name = NPN_GetStringIdentifier("self");
+        NPVariant window_self_variant;
+        if (!NPN_GetProperty(window, self_name, &window_self_variant)) {
+            log("Fail: Cannot query window.self");
+            return NPERR_NO_ERROR;
+        }
+        if (!NPVARIANT_IS_OBJECT(window_self_variant)) {
+            log("Fail: window.self is not an object");
+            return NPERR_NO_ERROR;
+        }
+
+        // Leak both references to the window script object.
+        return NPERR_NO_ERROR;
+    }
+};
+
+static PluginTest::Register<LeakWindowScriptableObject> leakWindowScriptableObject("leak-window-scriptable-object");
diff --git a/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp b/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp
index a19742c33..11f390e3b 100644
--- a/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp
@@ -61,6 +61,7 @@
 #include "WebPageClient.h"
 #include "WorkQueue.h"
 #include "WorkQueueItem.h"
+#include <BlackBerryPlatformLayoutTest.h>
 #include <WebSettings.h>
 #include <stdio.h>
 #include <sys/stat.h>
@@ -156,13 +157,12 @@ DumpRenderTree::DumpRenderTree(BlackBerry::WebKit::WebPage* page)
     , m_waitToDumpWatchdogTimer(this, &DumpRenderTree::waitToDumpWatchdogTimerFired)
     , m_workTimer(this, &DumpRenderTree::processWork)
     , m_acceptsEditing(true)
-    , m_runningRefTests(false)
 {
+    const char* workerNumber = getenv("WORKER_NUMBER") ? getenv("WORKER_NUMBER") : "0";
     String sdcardPath = SDCARD_PATH;
     m_resultsDir = sdcardPath + "/results/";
-    m_indexFile = sdcardPath + "/index.drt";
-    m_doneFile = sdcardPath + "/done";
-    m_currentTestFile = sdcardPath + "/current.drt";
+    m_doneFile = sdcardPath + "/done" + workerNumber;
+    m_currentTestFile = sdcardPath + "/current" + workerNumber + ".drt";
     m_page->resetVirtualViewportOnCommitted(false);
     m_page->setVirtualViewportSize(800, 600);
     s_currentInstance = this;
@@ -200,36 +200,13 @@ void DumpRenderTree::doneDrt()
 {
     fclose(stdout);
     fclose(stderr);
+    unlink(getPPSPath().c_str());
 
     // Notify the external world that we're done.
     createFile(m_doneFile);
     (m_page->client())->notifyRunLayoutTestsFinished();
 }
 
-void DumpRenderTree::getRefTests(const String& testName)
-{
-    if (m_runningRefTests)
-        return;
-
-    const char* suffixes[] = {"-expected", "-expected-mismatch"};
-    const int countofSuffixes = sizeof(suffixes) / sizeof(const char*);
-    // FIXME: Currently we only have ref tests with .html extension, you many need to add more
-    // when they have more extensions(.htm, .shtml, .xhtml, etc.).
-    const char* extensions[] = {".html", ".svg"};
-    const int countofExtensions = sizeof(extensions) / sizeof(const char*);
-    String layoutDir = kSDCLayoutTestsURI + 7; // 7: strlen("file://"), layoutDir: "/developer/LayoutTests/"
-
-    size_t iEnd = testName.reverseFind('.');
-
-    String nameWithoutExtension = testName.substring(0, iEnd);
-    for (int i = 0; i < countofSuffixes; ++i)
-        for (int j = 0; j < countofExtensions; ++j) {
-            String candidateFile = layoutDir + nameWithoutExtension + suffixes[i] + extensions[j];
-            if (!access(candidateFile.utf8().data(), F_OK))
-                m_refTests.append(nameWithoutExtension + suffixes[i] + extensions[j]);
-        }
-}
-
 void DumpRenderTree::runCurrentTest()
 {
     if (isHTTPTest(m_currentTest->utf8().data())) {
@@ -247,20 +224,17 @@ void DumpRenderTree::runRemainingTests()
     fflush(stderr);
 
     if (m_currentTest >= m_tests.end() - 1) {
-        // Run ref-tests after real tests were finished
-        if (!m_runningRefTests && !m_refTests.isEmpty()) {
-            m_tests.clear();
-            m_tests.append(m_refTests);
-            m_refTests.clear();
+        m_tests.clear();
+        if (m_bufferedTests.size() > 0) {
+            m_tests.append(m_bufferedTests);
+            m_bufferedTests.clear();
             m_currentTest = m_tests.begin();
-            m_runningRefTests = true;
-        } else {
-            doneDrt();
-            return;
+            runCurrentTest();
         }
-    } else
-        m_currentTest++;
+        return;
+    }
 
+    m_currentTest++;
     runCurrentTest();
 }
 
@@ -346,20 +320,35 @@ void DumpRenderTree::runTests()
 {
     m_gcController = new GCController();
     m_accessibilityController = new AccessibilityController();
-    getTestsToRun();
+    if (!ensurePPS()) {
+        fprintf(stderr, "Failed to open PPS file '%s', error=%d\n", getPPSPath().c_str(), errno);
+        (m_page->client())->notifyRunLayoutTestsFinished();
+        return;
+    }
 
     mainFrame = DumpRenderTreeSupport::corePage(m_page)->mainFrame();
 
-    m_currentTest = m_tests.begin();
+    // Get Test file name from PPS: /pps/services/drt/input
+    // Example: test_file::fast/js/arguments.html
+    waitForTest();
+}
 
-    if (m_currentTest == m_tests.end()) {
+void DumpRenderTree::addTest(const char* testFile)
+{
+    String test(testFile);
+    if (test == "#DONE")
         doneDrt();
-        return;
+    else if (!test.isEmpty()) {
+        if (m_tests.isEmpty()) {
+            // No test is being run, initialize iterator and start test
+            m_tests.append(test);
+            m_currentTest = m_tests.begin();
+            runCurrentTest();
+        } else
+            m_bufferedTests.append(test);
     }
-    runCurrentTest();
 }
 
-
 String DumpRenderTree::dumpFramesAsText(WebCore::Frame* frame)
 {
     String s;
@@ -395,28 +384,6 @@ bool DumpRenderTree::isHTTPTest(const String& test)
             && testLower.substring(lenHttpTestSyntax, strlen(localTestSyntax)) != localTestSyntax;
 }
 
-void DumpRenderTree::getTestsToRun()
-{
-    Vector<String> files;
-
-    FILE* fd = fopen(m_indexFile.utf8().data(), "r");
-    fseek(fd, 0, SEEK_END);
-    int size = ftell(fd);
-    fseek(fd, 0, SEEK_SET);
-    OwnArrayPtr<char> buf = adoptArrayPtr(new char[size]);
-    fread(buf.get(), 1, size, fd);
-    fclose(fd);
-    String s(buf.get(), size);
-    s.split("\n", files);
-
-    m_tests = files;
-
-    // Find ref-tests for each of the real tests, one test may have multiple expected ref-tests
-    // and multiple mismatch ref-tests.
-    for (Vector<String>::iterator iter = files.begin(); files.end() != iter; ++iter)
-        getRefTests(*iter);
-}
-
 void DumpRenderTree::invalidateAnyPreviousWaitToDumpWatchdog()
 {
     m_waitToDumpWatchdogTimer.stop();
@@ -511,6 +478,9 @@ static String dumpBackForwardListForWebView()
 
 void DumpRenderTree::dump()
 {
+    if (testDone)
+        return;
+
     invalidateAnyPreviousWaitToDumpWatchdog();
 
     String dumpFile = m_resultsDir + *m_currentTest + ".dump";
@@ -533,6 +503,9 @@ void DumpRenderTree::dump()
     String crashFile = dumpFile + ".crash";
     unlink(crashFile.utf8().data());
 
+    String doneFile =  m_resultsDir + *m_currentTest + ".done";
+    createFile(doneFile);
+
     testDone = true;
     runRemainingTests();
 }
diff --git a/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h b/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h
index c6eba9d19..4ca9a3f2d 100644
--- a/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h
+++ b/Tools/DumpRenderTree/blackberry/DumpRenderTreeBlackBerry.h
@@ -21,9 +21,11 @@
 
 #include "BlackBerryGlobal.h"
 
+
 #include "DumpRenderTreeClient.h"
 #include "PlatformString.h"
 #include "Timer.h"
+#include <BlackBerryPlatformLayoutTest.h>
 #include <FindOptions.h>
 #include <wtf/Vector.h>
 
@@ -45,7 +47,7 @@ namespace BlackBerry {
 namespace WebKit {
 class WebPage;
 
-class DumpRenderTree : public BlackBerry::WebKit::DumpRenderTreeClient {
+class DumpRenderTree : public BlackBerry::WebKit::DumpRenderTreeClient, public BlackBerry::Platform::LayoutTestClient {
 public:
     DumpRenderTree(WebPage*);
     virtual ~DumpRenderTree();
@@ -104,11 +106,12 @@ public:
     void setSelectTrailingWhitespaceEnabled(bool enabled) { s_selectTrailingWhitespaceEnabled = enabled; }
     bool didReceiveAuthenticationChallenge(WebCore::Credential&);
 
+    // BlackBerry::Platform::BlackBerryPlatformLayoutTestClient method
+    virtual void addTest(const char* testFile);
 private:
     void runTest(const String& url);
     void runTests();
     void runCurrentTest();
-    void getRefTests(const String& testName);
 
     void processWork(WebCore::Timer<DumpRenderTree>*);
 
@@ -119,7 +122,6 @@ private:
     void locationChangeForFrame(WebCore::Frame*);
 
     void doneDrt();
-    void getTestsToRun();
     bool isHTTPTest(const String& test);
     String renderTreeDump() const;
     void resetToConsistentStateBeforeTesting();
@@ -129,10 +131,9 @@ private:
 
     Vector<String> m_tests;
     Vector<String>::iterator m_currentTest;
-    Vector<String> m_refTests; // Reference tests for current test
+    Vector<String> m_bufferedTests;
 
     String m_resultsDir;
-    String m_indexFile;
     String m_doneFile;
     String m_currentHttpTest;
     String m_currentTestFile;
@@ -146,7 +147,6 @@ private:
 
     bool m_acceptsEditing;
     bool m_loadFinished;
-    bool m_runningRefTests;
     static bool s_selectTrailingWhitespaceEnabled;
 };
 }
diff --git a/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
index ceadb7a63..1982b5a6c 100644
--- a/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
+++ b/Tools/DumpRenderTree/blackberry/LayoutTestControllerBlackBerry.cpp
@@ -740,14 +740,6 @@ int LayoutTestController::numberOfPendingGeolocationPermissionRequests()
     return DumpRenderTreeSupport::numberOfPendingGeolocationPermissionRequests(BlackBerry::WebKit::DumpRenderTree::currentInstance()->page());
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    if (!mainFrame)
-        return;
-
-    DumpRenderTreeSupport::dumpConfigurationForViewport(mainFrame, deviceDPI, deviceWidth, deviceHeight, availableWidth, availableHeight);
-}
-
 bool LayoutTestController::findString(JSContextRef context, JSStringRef target, JSObjectRef optionsArray)
 {
     WebCore::FindOptions options = 0;
diff --git a/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h b/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h
index f3564bd78..ea6e5aea6 100644
--- a/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h
+++ b/Tools/DumpRenderTree/chromium/DRTDevToolsAgent.h
@@ -88,7 +88,6 @@ private:
     TaskList m_taskList;
     DRTDevToolsClient* m_drtDevToolsClient;
     int m_routingID;
-    WebKit::WebDevToolsAgent* m_webDevToolsAgent;
     WebKit::WebView* m_webView;
 };
 
diff --git a/Tools/DumpRenderTree/chromium/GamepadController.cpp b/Tools/DumpRenderTree/chromium/GamepadController.cpp
index d00b953d5..b38dfa0c5 100644
--- a/Tools/DumpRenderTree/chromium/GamepadController.cpp
+++ b/Tools/DumpRenderTree/chromium/GamepadController.cpp
@@ -35,8 +35,7 @@
 
 using namespace WebKit;
 
-GamepadController::GamepadController(TestShell* shell)
-    : m_shell(shell)
+GamepadController::GamepadController(TestShell*)
 {
     bindMethod("connect", &GamepadController::connect);
     bindMethod("disconnect", &GamepadController::disconnect);
diff --git a/Tools/DumpRenderTree/chromium/GamepadController.h b/Tools/DumpRenderTree/chromium/GamepadController.h
index 414228855..5a6f40d5d 100644
--- a/Tools/DumpRenderTree/chromium/GamepadController.h
+++ b/Tools/DumpRenderTree/chromium/GamepadController.h
@@ -59,8 +59,6 @@ private:
     void setAxisData(const CppArgumentList&, CppVariant*);
     void fallbackCallback(const CppArgumentList&, CppVariant*);
 
-    TestShell* m_shell;
-
     WebKit::WebGamepads internalData;
 };
 
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
index 06f146c1c..d5c9019b8 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.cpp
@@ -38,9 +38,7 @@
 #include "TestShell.h"
 #include "WebAnimationController.h"
 #include "WebBindings.h"
-#include "WebWorkerInfo.h"
 #include "WebConsoleMessage.h"
-#include "platform/WebData.h"
 #include "WebDeviceOrientation.h"
 #include "WebDeviceOrientationClientMock.h"
 #include "WebDocument.h"
@@ -58,12 +56,15 @@
 #include "WebPrintParams.h"
 #include "WebScriptSource.h"
 #include "WebSecurityPolicy.h"
-#include "platform/WebSerializedScriptValue.h"
 #include "WebSettings.h"
-#include "platform/WebSize.h"
-#include "platform/WebURL.h"
+#include "WebSurroundingText.h"
 #include "WebView.h"
 #include "WebViewHost.h"
+#include "WebWorkerInfo.h"
+#include "platform/WebData.h"
+#include "platform/WebSerializedScriptValue.h"
+#include "platform/WebSize.h"
+#include "platform/WebURL.h"
 #include "v8/include/v8.h"
 #include "webkit/support/webkit_support.h"
 #include <algorithm>
@@ -72,11 +73,8 @@
 #include <cstdlib>
 #include <limits>
 #include <sstream>
-#include <wtf/text/WTFString.h>
-
-#if OS(WINDOWS)
 #include <wtf/OwnArrayPtr.h>
-#endif
+#include <wtf/text/WTFString.h>
 
 #if OS(LINUX) || OS(ANDROID)
 #include "linux/WebFontRendering.h"
@@ -221,6 +219,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setScrollbarPolicy", &LayoutTestController::setScrollbarPolicy);
     bindMethod("setSelectTrailingWhitespaceEnabled", &LayoutTestController::setSelectTrailingWhitespaceEnabled);
     bindMethod("setTextSubpixelPositioning", &LayoutTestController::setTextSubpixelPositioning);
+    bindMethod("setBackingScaleFactor", &LayoutTestController::setBackingScaleFactor);
     bindMethod("setSmartInsertDeleteEnabled", &LayoutTestController::setSmartInsertDeleteEnabled);
     bindMethod("setStopProvisionalFrameLoads", &LayoutTestController::setStopProvisionalFrameLoads);
     bindMethod("setTabKeyCyclesThroughElements", &LayoutTestController::setTabKeyCyclesThroughElements);
@@ -277,7 +276,8 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setFixedLayoutSize", &LayoutTestController::setFixedLayoutSize);
     bindMethod("selectionAsMarkup", &LayoutTestController::selectionAsMarkup);
     bindMethod("setHasCustomFullScreenBehavior", &LayoutTestController::setHasCustomFullScreenBehavior);
-    
+    bindMethod("textSurroundingNode", &LayoutTestController::textSurroundingNode);
+
     // The fallback method is called when an unknown method is invoked.
     bindFallbackMethod(&LayoutTestController::fallbackMethod);
 
@@ -652,6 +652,7 @@ void LayoutTestController::reset()
         m_shell->webView()->removeAllUserContent();
         WebKit::WebSize empty;
         m_shell->webView()->disableAutoResizeMode();
+        m_shell->webView()->setDeviceScaleFactor(1);
     }
     m_dumpAsText = false;
     m_dumpAsAudio = false;
@@ -1579,8 +1580,6 @@ void LayoutTestController::overridePreference(const CppArgumentList& arguments,
         prefs->allowDisplayOfInsecureContent = cppVariantToBool(value);
     else if (key == "WebKitAllowRunningInsecureContent")
         prefs->allowRunningOfInsecureContent = cppVariantToBool(value);
-    else if (key == "WebKitHixie76WebSocketProtocolEnabled")
-        prefs->hixie76WebSocketProtocolEnabled = cppVariantToBool(value);
     else if (key == "WebKitCSSCustomFilterEnabled")
         prefs->cssCustomFilterEnabled = cppVariantToBool(value);
     else if (key == "WebKitWebAudioEnabled") {
@@ -2211,6 +2210,40 @@ void LayoutTestController::setTextSubpixelPositioning(const CppArgumentList& arg
     result->setNull();
 }
 
+class InvokeCallbackTask : public MethodTask<LayoutTestController> {
+public:
+    InvokeCallbackTask(LayoutTestController* object, PassOwnArrayPtr<CppVariant> callbackArguments, uint32_t numberOfArguments)
+        : MethodTask<LayoutTestController>(object)
+        , m_callbackArguments(callbackArguments)
+        , m_numberOfArguments(numberOfArguments)
+    {
+    }
+
+    virtual void runIfValid()
+    {
+        CppVariant invokeResult;
+        m_callbackArguments[0].invokeDefault(m_callbackArguments.get(), m_numberOfArguments, invokeResult);
+    }
+
+private:
+    OwnArrayPtr<CppVariant> m_callbackArguments;
+    uint32_t m_numberOfArguments;
+};
+
+void LayoutTestController::setBackingScaleFactor(const CppArgumentList& arguments, CppVariant* result)
+{
+    if (arguments.size() < 2 || !arguments[0].isNumber() || !arguments[1].isObject())
+        return;
+    
+    float value = arguments[0].value.doubleValue;
+    m_shell->webView()->setDeviceScaleFactor(value);
+
+    OwnArrayPtr<CppVariant> callbackArguments = adoptArrayPtr(new CppVariant[1]);
+    callbackArguments[0].set(arguments[1]);
+    result->setNull();
+    postTask(new InvokeCallbackTask(this, callbackArguments.release(), 1));
+}
+
 void LayoutTestController::setPluginsEnabled(const CppArgumentList& arguments, CppVariant* result)
 {
     if (arguments.size() > 0 && arguments[0].isBool()) {
@@ -2310,3 +2343,27 @@ void LayoutTestController::setPointerLockWillFailSynchronously(const CppArgument
     result->setNull();
 }
 #endif
+
+void LayoutTestController::textSurroundingNode(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+    if (arguments.size() < 4 || !arguments[0].isObject() || !arguments[1].isNumber() || !arguments[2].isNumber() || !arguments[3].isNumber())
+        return;
+
+    WebNode node;
+    if (!WebBindings::getNode(arguments[0].value.objectValue, &node))
+        return;
+
+    if (node.isNull() || !node.isTextNode())
+        return;
+
+    WebPoint point(arguments[1].toInt32(), arguments[2].toInt32());
+    unsigned maxLength = arguments[3].toInt32();
+
+    WebSurroundingText surroundingText;
+    surroundingText.initialize(node, point, maxLength);
+    if (surroundingText.isNull())
+        return;
+
+    result->set(surroundingText.textContent().utf8());
+}
diff --git a/Tools/DumpRenderTree/chromium/LayoutTestController.h b/Tools/DumpRenderTree/chromium/LayoutTestController.h
index af39b2ef6..08c724410 100644
--- a/Tools/DumpRenderTree/chromium/LayoutTestController.h
+++ b/Tools/DumpRenderTree/chromium/LayoutTestController.h
@@ -453,6 +453,15 @@ public:
     // resulting in the changed setting being ignored.
     void setTextSubpixelPositioning(const CppArgumentList&, CppVariant*);
 
+    // Used to set the device scale factor.
+    void setBackingScaleFactor(const CppArgumentList&, CppVariant*);
+
+    // Retrieves the text surrounding a position in a text node.
+    // Expects the first argument to be a text node, the second and third to be
+    // point coordinates relative to the node and the fourth the maximum text
+    // length to retrieve.
+    void textSurroundingNode(const CppArgumentList&, CppVariant*);
+
 public:
     // The following methods are not exposed to JavaScript.
     void setWorkQueueFrozen(bool frozen) { m_workQueue.setFrozen(frozen); }
diff --git a/Tools/DumpRenderTree/chromium/NotificationPresenter.h b/Tools/DumpRenderTree/chromium/NotificationPresenter.h
index b33df9138..5fed178da 100644
--- a/Tools/DumpRenderTree/chromium/NotificationPresenter.h
+++ b/Tools/DumpRenderTree/chromium/NotificationPresenter.h
@@ -43,7 +43,7 @@ class TestShell;
 // A class that implements WebNotificationPresenter for DRT.
 class NotificationPresenter : public WebKit::WebNotificationPresenter {
 public:
-    explicit NotificationPresenter(TestShell* shell) : m_shell(shell) { }
+    explicit NotificationPresenter(TestShell*) { }
     virtual ~NotificationPresenter();
 
     // Called by the LayoutTestController to simulate a user granting permission.
@@ -62,9 +62,6 @@ public:
     void reset() { m_allowedOrigins.clear(); }
 
 private:
-    // Non-owned pointer. The NotificationPresenter is owned by the test shell.
-    TestShell* m_shell;
-
     // Set of allowed origins.
     HashSet<WTF::String> m_allowedOrigins;
 
diff --git a/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp b/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
index f4cbf5e1f..bc0acaad9 100644
--- a/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
+++ b/Tools/DumpRenderTree/chromium/TestShellAndroid.cpp
@@ -102,9 +102,7 @@ void redirectToFile(FILE* stream, const char* path, const char* mode)
 void platformInit(int* argc, char*** argv)
 {
     // Initialize skia with customized font config files.
-    // FIXME: Add this call once SkUseTestFontConfigFile is added to Skia and
-    // visible to WebKit. See https://bugs.webkit.org/show_bug.cgi?id=89801
-    // SkUseTestFontConfigFile(fontMainConfigFile, fontFallbackConfigFile, fontsDir);
+    SkUseTestFontConfigFile(fontMainConfigFile, fontFallbackConfigFile, fontsDir);
 
     const char* inFIFO = 0;
     const char* outFIFO = 0;
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.cpp b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
index a779ee9c3..c4de0abc1 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.cpp
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.cpp
@@ -116,7 +116,6 @@ void WebPreferences::reset()
     deferred2dCanvasEnabled = false;
     acceleratedPaintingEnabled = false;
     forceCompositingMode = false;
-    hixie76WebSocketProtocolEnabled = true;
     mediaPlaybackRequiresUserGesture = false;
     mockScrollbarsEnabled = false;
     cssCustomFilterEnabled = false;
@@ -225,7 +224,6 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setAccelerated2dCanvasEnabled(accelerated2dCanvasEnabled);
     settings->setDeferred2dCanvasEnabled(deferred2dCanvasEnabled);
     settings->setAcceleratedPaintingEnabled(acceleratedPaintingEnabled);
-    settings->setHixie76WebSocketProtocolEnabled(hixie76WebSocketProtocolEnabled);
     settings->setMediaPlaybackRequiresUserGesture(mediaPlaybackRequiresUserGesture);
     settings->setMockScrollbarsEnabled(mockScrollbarsEnabled);
 
diff --git a/Tools/DumpRenderTree/chromium/WebPreferences.h b/Tools/DumpRenderTree/chromium/WebPreferences.h
index d42f9b075..c36553b35 100644
--- a/Tools/DumpRenderTree/chromium/WebPreferences.h
+++ b/Tools/DumpRenderTree/chromium/WebPreferences.h
@@ -109,7 +109,6 @@ struct WebPreferences {
     bool accelerated2dCanvasEnabled;
     bool deferred2dCanvasEnabled;
     bool acceleratedPaintingEnabled;
-    bool hixie76WebSocketProtocolEnabled;
     bool mediaPlaybackRequiresUserGesture;
     bool mockScrollbarsEnabled;
     bool cssCustomFilterEnabled;
diff --git a/Tools/DumpRenderTree/efl/CMakeLists.txt b/Tools/DumpRenderTree/efl/CMakeLists.txt
index 0a8fd065b..e1dacf901 100644
--- a/Tools/DumpRenderTree/efl/CMakeLists.txt
+++ b/Tools/DumpRenderTree/efl/CMakeLists.txt
@@ -29,6 +29,7 @@ SET(DumpRenderTree_LIBRARIES
     ${WebCoreTestSupport_LIBRARY_NAME}
     ${WebCore_LIBRARY_NAME}
     ${WebKit_LIBRARY_NAME}
+    ${WTF_LIBRARY_NAME}
     ${CAIRO_LIBRARIES}
     ${ECORE_X_LIBRARIES}
     ${EDJE_LIBRARIES}
diff --git a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
index 070af8c14..3352fe678 100644
--- a/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
+++ b/Tools/DumpRenderTree/efl/LayoutTestControllerEfl.cpp
@@ -833,14 +833,6 @@ void LayoutTestController::abortModal()
     notImplemented();
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    DumpRenderTreeSupportEfl::dumpConfigurationForViewport(browser->mainView(),
-            deviceDPI,
-            WebCore::IntSize(deviceWidth, deviceHeight),
-            WebCore::IntSize(availableWidth, availableHeight));
-}
-
 void LayoutTestController::setSerializeHTTPLoads(bool serialize)
 {
     DumpRenderTreeSupportEfl::setSerializeHTTPLoads(serialize);
@@ -928,3 +920,8 @@ void LayoutTestController::deliverWebIntent(JSStringRef action, JSStringRef type
 {
     DumpRenderTreeSupportEfl::deliverWebIntent(browser->mainFrame(), action, type, data);
 }
+
+void LayoutTestController::setStorageDatabaseIdleInterval(double)
+{
+    notImplemented();
+}
diff --git a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
index 19b966695..8e3c44ec3 100644
--- a/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -123,7 +123,29 @@ static bool shouldEnableDeveloperExtras(const string& pathOrURL)
 
 void dumpFrameScrollPosition(WebKitWebFrame* frame)
 {
+    WebKitDOMDocument* document = webkit_web_frame_get_dom_document(frame);
+    if (!document)
+        return;
+
+    WebKitDOMDOMWindow* domWindow = webkit_dom_document_get_default_view(document);
+    if (!domWindow)
+        return;
+
+    glong x = webkit_dom_dom_window_get_page_x_offset(domWindow);
+    glong y = webkit_dom_dom_window_get_page_y_offset(domWindow);
+
+    if (abs(x) > 0 || abs(y) > 0) {
+        if (webkit_web_frame_get_parent(frame))
+            printf("frame '%s' ", webkit_web_frame_get_name(frame));
+        printf("scrolled to %ld,%ld\n", x, y);
+    }
 
+    if (gLayoutTestController->dumpChildFrameScrollPositions()) {
+        GSList* children = DumpRenderTreeSupportGtk::getFrameChildren(frame);
+        for (GSList* child = children; child; child = g_slist_next(child))
+            dumpFrameScrollPosition(static_cast<WebKitWebFrame*>(child->data));
+        g_slist_free(children);
+    }
 }
 
 void displayWebView()
@@ -169,6 +191,32 @@ CString getTopLevelPath()
     return TOP_LEVEL_DIR;
 }
 
+CString getOutputDir()
+{
+    const char* webkitOutputDir = g_getenv("WEBKITOUTPUTDIR");
+    if (webkitOutputDir)
+        return webkitOutputDir;
+
+    CString topLevelPath = getTopLevelPath();
+    GOwnPtr<char> outputDir(g_build_filename(topLevelPath.data(), "WebKitBuild", NULL));
+    return outputDir.get();
+}
+
+static CString getFontsPath()
+{
+    CString webkitOutputDir = getOutputDir();
+    GOwnPtr<char> fontsPath(g_build_filename(webkitOutputDir.data(), "Dependencies", "Root", "webkitgtk-test-fonts", NULL));
+    if (g_file_test(fontsPath.get(), static_cast<GFileTest>(G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR)))
+        return fontsPath.get();
+
+    // Try alternative fonts path.
+    fontsPath.set(g_build_filename(webkitOutputDir.data(), "webkitgtk-test-fonts", NULL));
+    if (g_file_test(fontsPath.get(), static_cast<GFileTest>(G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR)))
+        return fontsPath.get();
+
+    return CString();
+}
+
 static void initializeFonts(const char* testURL = 0)
 {
 #if PLATFORM(X11)
@@ -190,18 +238,16 @@ static void initializeFonts(const char* testURL = 0)
     if (!FcConfigParseAndLoad(config, reinterpret_cast<FcChar8*>(fontConfigFilename.get()), true))
         g_error("Couldn't load font configuration file from: %s", fontConfigFilename.get());
 
-    CString topLevelPath = getTopLevelPath();
-    GOwnPtr<char> fontsPath(g_build_filename(topLevelPath.data(), "WebKitBuild", "Dependencies",
-                                             "Root", "webkitgtk-test-fonts", NULL));
-    if (!g_file_test(fontsPath.get(), static_cast<GFileTest>(G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR)))
-        g_error("Could not locate test fonts at %s. Is WEBKIT_TOP_LEVEL set?", fontsPath.get());
+    CString fontsPath = getFontsPath();
+    if (fontsPath.isNull())
+        g_error("Could not locate test fonts at %s. Is WEBKIT_TOP_LEVEL set?", fontsPath.data());
 
     GOwnPtr<GError> error;
-    GOwnPtr<GDir> fontsDirectory(g_dir_open(fontsPath.get(), 0, &error.outPtr()));
+    GOwnPtr<GDir> fontsDirectory(g_dir_open(fontsPath.data(), 0, &error.outPtr()));
     while (const char* directoryEntry = g_dir_read_name(fontsDirectory.get())) {
         if (!g_str_has_suffix(directoryEntry, ".ttf") && !g_str_has_suffix(directoryEntry, ".otf"))
             continue;
-        GOwnPtr<gchar> fontPath(g_build_filename(fontsPath.get(), directoryEntry, NULL));
+        GOwnPtr<gchar> fontPath(g_build_filename(fontsPath.data(), directoryEntry, NULL));
         if (!FcConfigAppFontAddFile(config, reinterpret_cast<const FcChar8*>(fontPath.get())))
             g_error("Could not load font at %s!", fontPath.get());
 
@@ -466,7 +512,8 @@ static void resetDefaultsToConsistentValues()
 
     DumpRenderTreeSupportGtk::resetGeolocationClientMock(webView);
 
-    DumpRenderTreeSupportGtk::setHixie76WebSocketProtocolEnabled(webView, true);
+    DumpRenderTreeSupportGtk::setCSSGridLayoutEnabled(webView, false);
+    DumpRenderTreeSupportGtk::setCSSRegionsEnabled(webView, true);
 }
 
 static bool useLongRunningServerMode(int argc, char *argv[])
diff --git a/Tools/DumpRenderTree/gtk/EventSender.cpp b/Tools/DumpRenderTree/gtk/EventSender.cpp
index 102bb660f..4cc2ab34b 100644
--- a/Tools/DumpRenderTree/gtk/EventSender.cpp
+++ b/Tools/DumpRenderTree/gtk/EventSender.cpp
@@ -35,7 +35,6 @@
 
 #include "DumpRenderTree.h"
 #include "WebCoreSupport/DumpRenderTreeSupportGtk.h"
-#include "WebKitMutationObserver.h"
 #include <GOwnPtrGtk.h>
 #include <GRefPtrGtk.h>
 #include <GtkVersioning.h>
diff --git a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 72d69fa0a..2eb899d61 100644
--- a/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/Tools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -801,12 +801,15 @@ void LayoutTestController::overridePreference(JSStringRef key, JSStringRef value
     else if (g_str_equal(originalName.get(), "WebKitTabToLinksPreferenceKey")) {
         DumpRenderTreeSupportGtk::setLinksIncludedInFocusChain(booleanFromValue(valueAsString.get()));
         return;
-    } else if (g_str_equal(originalName.get(), "WebKitHixie76WebSocketProtocolEnabled")) {
-        DumpRenderTreeSupportGtk::setHixie76WebSocketProtocolEnabled(webkit_web_frame_get_web_view(mainFrame), booleanFromValue(valueAsString.get()));
-        return;
     } else if (g_str_equal(originalName.get(), "WebKitPageCacheSupportsPluginsPreferenceKey")) {
         DumpRenderTreeSupportGtk::setPageCacheSupportsPlugins(webkit_web_frame_get_web_view(mainFrame), booleanFromValue(valueAsString.get()));
         return;
+    } else if (g_str_equal(originalName.get(), "WebKitCSSGridLayoutEnabled")) {
+        DumpRenderTreeSupportGtk::setCSSGridLayoutEnabled(webkit_web_frame_get_web_view(mainFrame), booleanFromValue(valueAsString.get()));
+        return;
+    } else if (g_str_equal(originalName.get(), "WebKitCSSRegionsEnabled")) {
+        DumpRenderTreeSupportGtk::setCSSRegionsEnabled(webkit_web_frame_get_web_view(mainFrame), booleanFromValue(valueAsString.get()));
+        return;
     } else {
         fprintf(stderr, "LayoutTestController::overridePreference tried to override "
                 "unknown preference '%s'.\n", originalName.get());
@@ -937,13 +940,6 @@ void LayoutTestController::abortModal()
 {
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    WebKitWebView* webView = webkit_web_frame_get_web_view(mainFrame);
-    ASSERT(webView);
-    DumpRenderTreeSupportGtk::dumpConfigurationForViewport(webView, deviceDPI, deviceWidth, deviceHeight, availableWidth, availableHeight);
-}
-
 void LayoutTestController::setSerializeHTTPLoads(bool serialize)
 {
     DumpRenderTreeSupportGtk::setSerializeHTTPLoads(serialize);
@@ -1004,3 +1000,8 @@ void LayoutTestController::deliverWebIntent(JSStringRef, JSStringRef, JSStringRe
 {
     // FIXME: Implement this.
 }
+
+void LayoutTestController::setStorageDatabaseIdleInterval(double)
+{
+    // FIXME: Implement this.
+}
diff --git a/Tools/DumpRenderTree/mac/DumpRenderTree.mm b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
index 271683f7a..dd0eff44b 100644
--- a/Tools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/Tools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -661,9 +661,9 @@ static void resetDefaultsToConsistentValues()
 #endif
     [preferences setWebGLEnabled:NO];
     [preferences setCSSRegionsEnabled:YES];
+    [preferences setCSSGridLayoutEnabled:NO];
     [preferences setUsePreHTML5ParserQuirks:NO];
     [preferences setAsynchronousSpellCheckingEnabled:NO];
-    [preferences setHixie76WebSocketProtocolEnabled:NO];
     [preferences setMockScrollbarsEnabled:YES];
 
 #if ENABLE(WEB_AUDIO)
@@ -861,8 +861,6 @@ void dumpRenderTree(int argc, const char *argv[])
     [[NSURLCache sharedURLCache] removeAllCachedResponses];
     [WebCache empty];
 
-    // <http://webkit.org/b/31200> In order to prevent extra frame load delegate logging being generated if the first test to use SSL
-    // is set to log frame load delegate calls we ignore SSL certificate errors on localhost and 127.0.0.1.
     [NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:@"localhost"];
     [NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:@"127.0.0.1"];
 
diff --git a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index 884572e9b..f360c061a 100644
--- a/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/Tools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -201,6 +201,11 @@ void LayoutTestController::deleteAllLocalStorage()
     [[WebStorageManager sharedWebStorageManager] deleteAllOrigins];
 }
 
+void LayoutTestController::setStorageDatabaseIdleInterval(double interval)
+{
+    [WebStorageManager setStorageDatabaseIdleInterval:interval];
+}
+
 JSValueRef LayoutTestController::originsWithLocalStorage(JSContextRef context)
 {
     return originsArrayToJS(context, [[WebStorageManager sharedWebStorageManager] origins]);
@@ -1118,11 +1123,6 @@ void LayoutTestController::abortModal()
     [NSApp abortModal];
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int /*deviceDPI*/, int /*deviceWidth*/, int /*deviceHeight*/, int /*availableWidth*/, int /*availableHeight*/)
-{
-
-}
-
 void LayoutTestController::setSerializeHTTPLoads(bool serialize)
 {
     [WebView _setLoadResourcesSerially:serialize];
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTree.pro b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
index 327dc3a79..f47fb4344 100644
--- a/Tools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/Tools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -9,8 +9,6 @@ TEMPLATE = app
 TARGET = DumpRenderTree
 DESTDIR = $$ROOT_BUILD_DIR/bin
 
-load(features)
-
 WEBKIT += wtf webcore
 !v8: WEBKIT += javascriptcore
 
diff --git a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index 9d0ae62ac..12d659a51 100755
--- a/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/Tools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -191,10 +191,12 @@ void WebPage::resetSettings()
     settings()->resetAttribute(QWebSettings::ZoomTextOnly);
     settings()->resetAttribute(QWebSettings::CSSRegionsEnabled);
     settings()->resetAttribute(QWebSettings::CSSGridLayoutEnabled);
+    settings()->resetAttribute(QWebSettings::AcceleratedCompositingEnabled);
 
     m_drt->layoutTestController()->setCaretBrowsingEnabled(false);
     m_drt->layoutTestController()->setAuthorAndUserStylesEnabled(true);
     m_drt->layoutTestController()->setFrameFlatteningEnabled(false);
+    m_drt->layoutTestController()->setMockScrollbarsEnabled(false);
     m_drt->layoutTestController()->setSmartInsertDeleteEnabled(true);
     m_drt->layoutTestController()->setSelectTrailingWhitespaceEnabled(false);
     m_drt->layoutTestController()->setDefersLoading(false);
@@ -206,7 +208,6 @@ void WebPage::resetSettings()
     settings()->setUserStyleSheetUrl(QUrl()); // reset to default
 
     DumpRenderTreeSupportQt::setMinimumTimerInterval(this, DumpRenderTreeSupportQt::defaultMinimumTimerInterval());
-    DumpRenderTreeSupportQt::setHixie76WebSocketProtocolEnabled(this, DumpRenderTreeSupportQt::defaultHixie76WebSocketProtocolEnabled());
 
     DumpRenderTreeSupportQt::resetInternalsObject(mainFrame());
 
@@ -536,10 +537,11 @@ void DumpRenderTree::resetToConsistentStateBeforeTesting(const QUrl& url)
 #ifndef QT_NO_UNDOSTACK
     m_page->undoStack()->clear();
 #endif
-    
+
     clearHistory(m_page);
     DumpRenderTreeSupportQt::scalePageBy(m_page->mainFrame(), 1, QPoint(0, 0));
     DumpRenderTreeSupportQt::clearFrameName(m_page->mainFrame());
+    DumpRenderTreeSupportQt::removeUserStyleSheets(m_page);
 
     m_page->mainFrame()->setScrollBarPolicy(Qt::Vertical, Qt::ScrollBarAsNeeded);
     m_page->mainFrame()->setScrollBarPolicy(Qt::Horizontal, Qt::ScrollBarAsNeeded);
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index b8f998947..bc88cb48f 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -258,12 +258,6 @@ QString LayoutTestController::pathToLocalResource(const QString& url)
     return url;
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    QString res = DumpRenderTreeSupportQt::viewportAsText(m_drt->webPage(), deviceDPI, QSize(deviceWidth, deviceHeight), QSize(availableWidth, availableHeight));
-    fputs(qPrintable(res), stdout);
-}
-
 void LayoutTestController::dumpEditingCallbacks()
 {
     qDebug() << ">>>dumpEditingCallbacks";
@@ -442,6 +436,11 @@ void LayoutTestController::setFrameFlatteningEnabled(bool enabled)
     DumpRenderTreeSupportQt::setFrameFlatteningEnabled(m_drt->webPage(), enabled);
 }
 
+void LayoutTestController::setMockScrollbarsEnabled(bool enabled)
+{
+    DumpRenderTreeSupportQt::setMockScrollbarsEnabled(m_drt->webPage(), enabled);
+}
+
 void LayoutTestController::goBack()
 {
     DumpRenderTreeSupportQt::goBack(m_drt->webPage());
@@ -673,8 +672,6 @@ void LayoutTestController::overridePreference(const QString& name, const QVarian
         settings->setAttribute(QWebSettings::CSSGridLayoutEnabled, value.toBool());
     else if (name == "WebKitHyperlinkAuditingEnabled")
         settings->setAttribute(QWebSettings::HyperlinkAuditingEnabled, value.toBool());
-    else if (name == "WebKitHixie76WebSocketProtocolEnabled")
-        DumpRenderTreeSupportQt::setHixie76WebSocketProtocolEnabled(m_topLoadingFrame->page(), value.toBool());
     else if (name == "WebKitAcceleratedCompositingEnabled")
         settings->setAttribute(QWebSettings::AcceleratedCompositingEnabled, value.toBool());
     else
diff --git a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
index 88b57cffa..b54f2f7e8 100644
--- a/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/Tools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -120,7 +120,6 @@ public slots:
     void dumpResourceResponseMIMETypes();
     void dumpWillCacheResponse();
     void dumpHistoryCallbacks();
-    void dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight);
     void setWillSendRequestReturnsNullOnRedirect(bool enabled);
     void setWillSendRequestReturnsNull(bool enabled);
     void setWillSendRequestClearHeader(const QStringList& headers);
@@ -154,6 +153,7 @@ public slots:
     void removeAllVisitedLinks();
     void setMediaType(const QString& type);
     void setFrameFlatteningEnabled(bool enable);
+    void setMockScrollbarsEnabled(bool enable);
     void setAllowUniversalAccessFromFileURLs(bool enable);
     void setAllowFileAccessFromFileURLs(bool enable);
     void setAppCacheMaximumSize(unsigned long long quota);
diff --git a/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp b/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp
index 7ae5e22a3..c69347e8d 100644
--- a/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp
+++ b/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp
@@ -62,17 +62,8 @@ void initializeTestFonts()
                );
     }
 
-    QByteArray configFile;
+    QByteArray configFile = fontDir + "/fonts.conf";
     FcConfig* config = FcConfigCreate();
-    // The resolving of default font families was altered in Qt5 with 2cc5442 (qtbase),
-    // we use this hack to keep resolving to the same font Qt4 did for serif while
-    // supporting both versions.
-#if HAVE(QT5)
-    configFile = fontDir + "/fonts-qt5-wk1.conf";
-    if (!FcConfigParseAndLoad(config, reinterpret_cast<const FcChar8*>(configFile.constData()), FcTrue))
-        qFatal("Couldn't load font configuration file");
-#endif
-    configFile = fontDir + "/fonts.conf";
     if (!FcConfigParseAndLoad(config, reinterpret_cast<const FcChar8*>(configFile.constData()), FcTrue))
         qFatal("Couldn't load font configuration file");
     if (!FcConfigAppFontAddDir(config, reinterpret_cast<const FcChar8*>(fontDir.data())))
diff --git a/Tools/DumpRenderTree/win/DumpRenderTree.cpp b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
index a6f583f60..f402a02ca 100644
--- a/Tools/DumpRenderTree/win/DumpRenderTree.cpp
+++ b/Tools/DumpRenderTree/win/DumpRenderTree.cpp
@@ -866,7 +866,6 @@ static void resetDefaultsToConsistentValues(IWebPreferences* preferences)
         prefsPrivate->setFrameFlatteningEnabled(FALSE);
         prefsPrivate->setOfflineWebApplicationCacheEnabled(TRUE);
         prefsPrivate->setLoadsSiteIconsIgnoringImageLoadingPreference(FALSE);
-        prefsPrivate->setHixie76WebSocketProtocolEnabled(FALSE);
     }
     setAlwaysAcceptCookies(false);
 
diff --git a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index 9d03abc77..ce27ad320 100644
--- a/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/Tools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -1374,11 +1374,6 @@ void LayoutTestController::abortModal()
 {
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int /*deviceDPI*/, int /*deviceWidth*/, int /*deviceHeight*/, int /*availableWidth*/, int /*availableHeight*/)
-{
-    // FIXME: Implement this.
-}
-
 void LayoutTestController::setSerializeHTTPLoads(bool)
 {
     // FIXME: Implement.
@@ -1483,3 +1478,8 @@ void LayoutTestController::deliverWebIntent(JSStringRef, JSStringRef, JSStringRe
 {
     // FIXME: Implement this.
 }
+
+void LayoutTestController::setStorageDatabaseIdleInterval(double)
+{
+    // FIXME: Implement this.
+}
diff --git a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index e0c05843d..5935eab25 100644
--- a/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/Tools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -531,11 +531,6 @@ void LayoutTestController::abortModal()
 {
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int /*deviceDPI*/, int /*deviceWidth*/, int /*deviceHeight*/, int /*availableWidth*/, int /*availableHeight*/)
-{
-    // FIXME: Implement
-}
-
 JSRetainPtr<JSStringRef> LayoutTestController::pageProperty(const char* propertyName, int pageNumber) const
 {
     // FIXME: Implement
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/worker_unittest.py b/Tools/EWSTools/GoogleComputeEngine/build-chromium-ews.sh
index ebb4e7a5b..eb9355b53 100644..100755
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/worker_unittest.py
+++ b/Tools/EWSTools/GoogleComputeEngine/build-chromium-ews.sh
@@ -1,3 +1,4 @@
+#!/bin/sh
 # Copyright (c) 2012 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -26,29 +27,23 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import unittest
+if [[ $# -ne 1 ]];then
+echo "Usage: build-cr-linux-ews.sh BOT_NUMBER"
+exit 1
+fi
 
-from webkitpy.layout_tests.controllers.worker import Worker, WorkerArguments
-from webkitpy.tool.mocktool import MockOptions
+QUEUE_TYPE=chromium-ews
+BOT_ID=gce-cr-linux-$1
+BUGZILLA_USERNAME=webkit.review.bot@gmail.com
+read -s -p "Bugzilla Password: " BUGZILLA_PASSWORD && echo
 
+# FIXME: We should use gcutil to find a zone that's actually up.
+ZONE=us-east-b
+IMAGE=projects/google/images/ubuntu-10-04-v20120621
 
-class FakeConnection(object):
-    def run_message_loop(self):
-        pass
+gcutil addinstance $BOT_ID --machine_type=standard-4-cpu-ephemeral-disk --image=$IMAGE --zone=$ZONE --wait_until_running
 
-    def post_message(self, message_name, *message_args):
-        pass
+echo "Sleeping for 30s to let the server spin up ssh..."
+sleep 30
 
-
-class WorkerTest(unittest.TestCase):
-    def test_default_platform_in_worker(self):
-        # This checks that we got a port and didn't raise an exception
-        # if we didn't specify a port with the --platform flag.
-        worker_connection = FakeConnection()
-        worker = Worker(worker_connection, WorkerArguments(1, '/tmp', MockOptions(platform=None, print_options=None, verbose=False, batch_size=0)))
-        worker._set_up_host_and_port()
-        self.assertNotEquals(worker._port, None)
-
-
-if __name__ == '__main__':
-    unittest.main()
+gcutil ssh $BOT_ID "sudo apt-get install subversion -y && svn checkout http://svn.webkit.org/repository/webkit/trunk/Tools/EWSTools tools && cd tools && bash cold-boot.sh $QUEUE_TYPE $BOT_ID $BUGZILLA_USERNAME $BUGZILLA_PASSWORD"
diff --git a/Tools/EWSTools/boot.sh b/Tools/EWSTools/boot.sh
index 733441ea2..fb5aadde0 100755
--- a/Tools/EWSTools/boot.sh
+++ b/Tools/EWSTools/boot.sh
@@ -27,4 +27,4 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-screen -c ~/tools/screen-config
+screen -d -m -c ~/tools/screen-config
diff --git a/Tools/EWSTools/cold-boot.sh b/Tools/EWSTools/cold-boot.sh
new file mode 100755
index 000000000..5cf625840
--- /dev/null
+++ b/Tools/EWSTools/cold-boot.sh
@@ -0,0 +1,75 @@
+#!/bin/sh
+# Copyright (c) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+if [[ $# -ne 4 ]];then
+echo "Usage: cold-boot.sh QUEUE_TYPE BOT_ID BUGZILLA_USERNAME BUGZILLA_PASSWORD"
+exit 1
+fi
+
+# Format the disk
+cat <<EOF | sudo fdisk /dev/vdb
+n
+p
+1
+8
+
+w
+EOF
+
+sudo mkfs.ext4 /dev/vdb1
+sudo mount /dev/vdb1 /mnt
+
+echo ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true | sudo debconf-set-selections
+
+curl http://src.chromium.org/svn/trunk/src/build/install-build-deps.sh > install-build-deps.sh
+bash install-build-deps.sh --no-prompt
+sudo apt-get install xvfb screen zip -y
+
+# install-build-deps.sh will install flashplugin-installer, which causes some plug-in tests to crash.
+sudo apt-get remove flashplugin-installer -y
+
+cd /mnt
+sudo mkdir -p git
+sudo chown $USER git
+sudo chgrp $USER git
+cd git
+
+git clone http://git.chromium.org/external/Webkit.git
+mv Webkit webkit-$1
+cd webkit-$1
+
+cat >> .git/config <<EOF
+[bugzilla]
+	username = $3
+	password = $4
+EOF
+
+cd ~/tools
+echo "screen -t kr ./start-queue.sh" $1 $2 > screen-config
+bash boot.sh
diff --git a/Tools/EWSTools/start-queue.sh b/Tools/EWSTools/start-queue.sh
index 791e6d0d0..801de996f 100755
--- a/Tools/EWSTools/start-queue.sh
+++ b/Tools/EWSTools/start-queue.sh
@@ -27,18 +27,6 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-if [[ $# -ne 2 ]];then
-echo "Usage: start-queue.sh QUEUE_NAME BOT_ID"
-echo
-echo "QUEUE_NAME will be passed as a command to webkit-patch"
-echo "QUEUE_NAME will also be used as the path to the queue: /mnt/git/webkit-QUEUE_NAME"
-echo "BOT_ID may not have spaces. It will appear as the bots name on queues.webkit.org"
-echo
-echo "For example, to run the mac-ews on a machine we're calling 'eseidel-cq-sf' run:"
-echo "start-queue.sh mac-ews eseidel-cq-sf"
-exit 1
-fi
-
 QUEUE_NAME=$1
 BOT_ID=$2
 
@@ -50,7 +38,9 @@ do
   git clean -f # Remove any left-over layout test results, added files, etc.
   git rebase --abort # If we got killed during a git rebase, we need to clean up.
   git fetch origin # Avoid updating the working copy to a stale revision.
-  git checkout origin/master -fB master # Re-create master from origin/master.
+  git checkout origin/master -f
+  git branch -D master
+  git checkout origin/master -b master
 
   # Most queues auto-update as part of their normal operation, but updating
   # here makes sure that we get the latest version of the master process.
diff --git a/Tools/MiniBrowser/efl/main.c b/Tools/MiniBrowser/efl/main.c
index 73c253bea..f1614aa35 100644
--- a/Tools/MiniBrowser/efl/main.c
+++ b/Tools/MiniBrowser/efl/main.c
@@ -26,6 +26,7 @@
 static const int DEFAULT_WIDTH = 800;
 static const int DEFAULT_HEIGHT = 600;
 static const char DEFAULT_URL[] = "http://www.google.com/";
+static const char APP_NAME[] = "EFL MiniBrowser";
 
 #define info(format, args...)       \
     do {                            \
@@ -87,12 +88,55 @@ on_key_down(void *data, Evas *e, Evas_Object *obj, void *event_info)
 }
 
 static void
+title_set(Ecore_Evas *ee, const char *title, int progress)
+{
+    Eina_Strbuf* buffer;
+
+    if (!title || !*title) {
+        ecore_evas_title_set(ee, APP_NAME);
+        return;
+    }
+
+    buffer = eina_strbuf_new();
+    if (progress < 100)
+        eina_strbuf_append_printf(buffer, "%s (%d%%) - %s", title, progress, APP_NAME);
+    else
+        eina_strbuf_append_printf(buffer, "%s - %s", title, APP_NAME);
+
+    ecore_evas_title_set(ee, eina_strbuf_string_get(buffer));
+    eina_strbuf_free(buffer);
+}
+
+static void
 on_title_changed(void *user_data, Evas_Object *webview, void *event_info)
 {
     MiniBrowser *app = (MiniBrowser *)user_data;
     const char *title = (const char *)event_info;
 
-    ecore_evas_title_set(app->ee, title);
+    title_set(app->ee, title, 100);
+}
+
+static void
+on_progress(void *user_data, Evas_Object *webview, void *event_info)
+{
+    MiniBrowser *app = (MiniBrowser *)user_data;
+    double progress = *(double *)event_info;
+
+    title_set(app->ee, ewk_view_title_get(app->browser), progress * 100);
+}
+
+static void
+on_error(void *user_data, Evas_Object *webview, void *event_info)
+{
+    Eina_Strbuf* buffer;
+    const Ewk_Web_Error *error = (const Ewk_Web_Error *)event_info;
+
+    buffer = eina_strbuf_new();
+    eina_strbuf_append_printf(buffer, "<html><body><div style=\"color:#ff0000\">ERROR!</div><br><div>Code: %d<br>Description: %s<br>URL: %s</div></body</html>",
+                              ewk_web_error_code_get(error), ewk_web_error_description_get(error), ewk_web_error_url_get(error));
+
+    ewk_view_html_string_load(webview, eina_strbuf_string_get(buffer), 0, ewk_web_error_url_get(error));
+    eina_strbuf_free(buffer);
 }
 
 static MiniBrowser *browserCreate(const char *url)
@@ -101,7 +145,7 @@ static MiniBrowser *browserCreate(const char *url)
 
     app->ee = ecore_evas_new(0, 0, 0, DEFAULT_WIDTH, DEFAULT_HEIGHT, 0);
 
-    ecore_evas_title_set(app->ee, "EFL MiniBrowser");
+    ecore_evas_title_set(app->ee, APP_NAME);
     ecore_evas_callback_resize_set(app->ee, on_ecore_evas_resize);
     ecore_evas_borderless_set(app->ee, 0);
     ecore_evas_show(app->ee);
@@ -121,6 +165,8 @@ static MiniBrowser *browserCreate(const char *url)
     app->browser = ewk_view_add(app->evas);
     evas_object_name_set(app->browser, "browser");
 
+    evas_object_smart_callback_add(app->browser, "load,error", on_error, app);
+    evas_object_smart_callback_add(app->browser, "load,progress", on_progress, app);
     evas_object_smart_callback_add(app->browser, "title,changed", on_title_changed, app);
 
     evas_object_event_callback_add(app->browser, EVAS_CALLBACK_KEY_DOWN, on_key_down, app);
diff --git a/Tools/MiniBrowser/mac/AppDelegate.m b/Tools/MiniBrowser/mac/AppDelegate.m
index 03a751123..c8d7f8d0a 100644
--- a/Tools/MiniBrowser/mac/AppDelegate.m
+++ b/Tools/MiniBrowser/mac/AppDelegate.m
@@ -141,7 +141,8 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
             kWKContextInjectedBundleClientCurrentVersion,
             0,      /* clientInfo */
             didRecieveMessageFromInjectedBundle,
-            0
+            0,      /* didReceiveSynchronousMessageFromInjectedBundle */
+            0       /* getInjectedBundleInitializationUserData */
         };
         WKContextSetInjectedBundleClient(_processContext, &bundleClient);
         WKContextSetHistoryClient(_processContext, &historyClient);
diff --git a/Tools/MiniBrowser/qt/MiniBrowser.pro b/Tools/MiniBrowser/qt/MiniBrowser.pro
index f7b83cf15..d54efad2f 100644
--- a/Tools/MiniBrowser/qt/MiniBrowser.pro
+++ b/Tools/MiniBrowser/qt/MiniBrowser.pro
@@ -22,7 +22,7 @@ HEADERS += \
 TARGET = MiniBrowser
 DESTDIR = $${ROOT_BUILD_DIR}/bin
 
-QT += network declarative quick quick-private webkit webkit-private
+QT += network gui-private quick quick-private webkit webkit-private
 macx: QT += xml
 
 RESOURCES += MiniBrowser.qrc
diff --git a/Tools/MiniBrowser/qt/MiniBrowserApplication.h b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
index 7d3c7a4ae..aa6ecdef3 100644
--- a/Tools/MiniBrowser/qt/MiniBrowserApplication.h
+++ b/Tools/MiniBrowser/qt/MiniBrowserApplication.h
@@ -36,7 +36,7 @@
 #include <QGuiApplication>
 #include <QTouchEvent>
 #include <QUrl>
-#include "qwindowsysteminterface_qpa.h"
+#include <qpa/qwindowsysteminterface.h>
 
 class BrowserWindow;
 
diff --git a/Tools/MiniBrowser/qt/raw/DerivedSources.pri b/Tools/MiniBrowser/qt/raw/DerivedSources.pri
new file mode 100644
index 000000000..dc4d2f4ff
--- /dev/null
+++ b/Tools/MiniBrowser/qt/raw/DerivedSources.pri
@@ -0,0 +1,6 @@
+TEMPLATE = derived
+
+# Make sure forwarded headers needed by this project are present
+fwheader_generator.commands = perl $${ROOT_WEBKIT_DIR}/Source/WebKit2/Scripts/generate-forwarding-headers.pl $${ROOT_WEBKIT_DIR}/Tools/WebKitTestRunner $${ROOT_BUILD_DIR}/Source/include qt
+fwheader_generator.depends  = $${ROOT_WEBKIT_DIR}/Source/WebKit2/Scripts/generate-forwarding-headers.pl
+GENERATORS += fwheader_generator
diff --git a/Tools/MiniBrowser/qt/raw/MiniBrowserRaw.pro b/Tools/MiniBrowser/qt/raw/MiniBrowserRaw.pro
new file mode 100644
index 000000000..0503104c0
--- /dev/null
+++ b/Tools/MiniBrowser/qt/raw/MiniBrowserRaw.pro
@@ -0,0 +1,9 @@
+TEMPLATE = subdirs
+CONFIG += ordered
+
+derived_sources.file = DerivedSources.pri
+target.file = Target.pri
+
+SUBDIRS = derived_sources target
+
+addStrictSubdirOrderBetween(derived_sources, target)
diff --git a/Tools/MiniBrowser/qt/raw/Target.pri b/Tools/MiniBrowser/qt/raw/Target.pri
new file mode 100644
index 000000000..ff9052f2a
--- /dev/null
+++ b/Tools/MiniBrowser/qt/raw/Target.pri
@@ -0,0 +1,14 @@
+TEMPLATE = app
+TARGET = MiniBrowserRaw
+
+HEADERS += \
+    View.h
+
+SOURCES += \
+    View.cpp
+
+DESTDIR = $${ROOT_BUILD_DIR}/bin
+
+QT = core gui network webkit
+
+WEBKIT += wtf javascriptcore webkit2
diff --git a/Tools/MiniBrowser/qt/raw/View.cpp b/Tools/MiniBrowser/qt/raw/View.cpp
new file mode 100644
index 000000000..a7b0aa8f9
--- /dev/null
+++ b/Tools/MiniBrowser/qt/raw/View.cpp
@@ -0,0 +1,137 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "View.h"
+
+#include <QDebug>
+#include <QExposeEvent>
+#include <QGuiApplication>
+#include <QKeyEvent>
+#include <QMatrix4x4>
+#include <QResizeEvent>
+#include <QUrl>
+
+#include <WebKit2/WKContext.h>
+#include <WebKit2/WKPageGroup.h>
+#include <WebKit2/WKPreferences.h>
+#include <WebKit2/WKPreferencesPrivate.h>
+#include <WebKit2/WKStringQt.h>
+#include <WebKit2/WKURL.h>
+
+
+static WKContextRef createWebContext()
+{
+    return WKContextCreate();
+}
+
+static WKPageGroupRef createWebPageGroup(const QString& name)
+{
+    WKPageGroupRef pageGroup =WKPageGroupCreateWithIdentifier(WKStringCreateWithQString(name));
+    WKPreferencesRef preferences = WKPageGroupGetPreferences(pageGroup);
+    WKPreferencesSetAcceleratedCompositingEnabled(preferences, true);
+    WKPreferencesSetFrameFlatteningEnabled(preferences, true);
+
+    return pageGroup;
+}
+
+View::~View()
+{
+    delete m_context;
+    delete m_webView;
+}
+
+View::View(const QString& url)
+    : m_url(url)
+    , m_active(false)
+{
+    setSurfaceType(OpenGLSurface);
+    setGeometry(50, 50, 980, 600);
+    setWindowFlags(Qt::Window | Qt::WindowTitleHint);
+    create();
+
+    m_context = new QOpenGLContext;
+    m_context->create();
+
+    m_webView = new QRawWebView(createWebContext(), createWebPageGroup(QString()), this);
+    m_webView->create();
+    WKPageSetUseFixedLayout(m_webView->pageRef(), true);
+}
+
+
+void View::exposeEvent(QExposeEvent* event)
+{
+    if (!m_active) {
+        m_active = true;
+        WKPageLoadURL(m_webView->pageRef(), WKURLCreateWithUTF8CString(m_url.toAscii().data()));
+
+        m_webView->setFocused(true);
+        m_webView->setVisible(true);
+        m_webView->setActive(true);
+    }
+}
+
+void View::resizeEvent(QResizeEvent* event)
+{
+    m_webView->setSize(event->size());
+}
+
+void View::timerEvent(QTimerEvent* event)
+{
+    if (event->timerId() == m_paintTimer.timerId()) {
+        m_paintTimer.stop();
+        m_context->makeCurrent(this);
+        m_webView->paint(QMatrix4x4(), 1, 0);
+        m_context->swapBuffers(this);
+    }
+}
+
+void View::viewNeedsDisplay(const QRect&)
+{
+    if (!m_paintTimer.isActive())
+        m_paintTimer.start(0, this);
+}
+
+void View::viewRequestedCursorOverride(const QCursor& cursor)
+{
+    QGuiApplication::setOverrideCursor(cursor);
+}
+
+void View::doneWithKeyEvent(const QKeyEvent* event, bool wasHandled)
+{
+    if (wasHandled || event->isAccepted())
+        return;
+
+    switch (event->key()) {
+    case Qt::Key_Backspace: {
+        WKPageRef page = m_webView->pageRef();
+        if (WKPageCanGoBack(page))
+            WKPageGoBack(page);
+        break;
+    }
+    }
+}
+
+int main(int argc, char** argv)
+{
+    QGuiApplication app(argc, argv);
+
+    View view(app.arguments().size() > 1 ? app.arguments().at(1) : QString::fromAscii("http://www.google.com"));
+    view.show();
+    return app.exec();
+}
diff --git a/Tools/MiniBrowser/qt/raw/View.h b/Tools/MiniBrowser/qt/raw/View.h
new file mode 100644
index 000000000..6de7a25e2
--- /dev/null
+++ b/Tools/MiniBrowser/qt/raw/View.h
@@ -0,0 +1,67 @@
+/*
+    Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef View_h
+#define View_h
+
+#include <QBasicTimer>
+#include <QOpenGLContext>
+#include <QWindow>
+#include <WebKit2/qrawwebview_p.h>
+
+
+class View :  public QWindow, private QRawWebViewClient {
+public:
+    View(const QString& url);
+    ~View();
+
+public: // WKViewClient
+    virtual void viewNeedsDisplay(const QRect&);
+    virtual void viewRequestedScroll(const QPoint&) { }
+    virtual void viewProcessCrashed() { }
+    virtual void viewProcessRelaunched() { }
+    virtual void viewContentSizeChanged(const QSize&) { }
+    virtual void viewRequestedCursorOverride(const QCursor&);
+    virtual void doneWithKeyEvent(const QKeyEvent*, bool wasHandled);
+    virtual void doneWithTouchEvent(const QTouchEvent*, bool wasHandled) { }
+
+protected:
+    virtual void exposeEvent(QExposeEvent*);
+    virtual void resizeEvent(QResizeEvent*);
+
+    virtual void keyPressEvent(QKeyEvent* event) { m_webView->sendKeyEvent(event); }
+    virtual void keyReleaseEvent(QKeyEvent* event) { m_webView->sendKeyEvent(event); }
+
+    virtual void mouseDoubleClickEvent(QMouseEvent* event) { m_webView->sendMouseEvent(event, 2); }
+    virtual void mouseMoveEvent(QMouseEvent* event) { m_webView->sendMouseEvent(event); }
+    virtual void mousePressEvent(QMouseEvent* event) { m_webView->sendMouseEvent(event, 1); }
+    virtual void mouseReleaseEvent(QMouseEvent* event) { m_webView->sendMouseEvent(event); }
+
+private:
+    QRawWebView* m_webView;
+    QOpenGLContext *m_context;
+    QBasicTimer m_paintTimer;
+
+    QString m_url;
+    bool m_active;
+
+    virtual void timerEvent(QTimerEvent*);
+};
+
+#endif // View_h
diff --git a/Tools/QtTestBrowser/QtTestBrowser.pro b/Tools/QtTestBrowser/QtTestBrowser.pro
index 3bff49062..6c9352cbc 100644
--- a/Tools/QtTestBrowser/QtTestBrowser.pro
+++ b/Tools/QtTestBrowser/QtTestBrowser.pro
@@ -11,8 +11,6 @@ INCLUDEPATH += \
     $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/ \
     $${ROOT_WEBKIT_DIR}/Source/WTF
 
-load(features)
-
 SOURCES += \
     $${ROOT_WEBKIT_DIR}/Tools/DumpRenderTree/qt/QtInitializeTestFonts.cpp \
     locationedit.cpp \
diff --git a/Tools/Scripts/build-webkittestrunner b/Tools/Scripts/build-webkittestrunner
index f03c1799a..e5b23545b 100755
--- a/Tools/Scripts/build-webkittestrunner
+++ b/Tools/Scripts/build-webkittestrunner
@@ -63,7 +63,7 @@ if (isAppleMacWebKit()) {
     $result = buildXCodeProject("WebKitTestRunner", $clean, XcodeOptions(), @ARGV);
 } elsif (isAppleWinWebKit()) {
     $result = buildVisualStudioProject("WebKitTestRunner.sln", $clean);
-} elsif (isQt() || isGtk()) {
+} elsif (isQt() || isGtk() || isEfl()) {
     # Qt and GTK+ build everything in one shot. No need to build anything here.
     $result = 0;
 } else {
diff --git a/Tools/Scripts/lint-webkitpy b/Tools/Scripts/lint-webkitpy
new file mode 100755
index 000000000..0fbbd73ca
--- /dev/null
+++ b/Tools/Scripts/lint-webkitpy
@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+# Copyright (c) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+import sys
+
+from webkitpy.thirdparty.autoinstalled.pylint import lint
+
+script_dir = os.path.abspath(os.path.dirname(__file__))
+if not script_dir in sys.path:
+    sys.path.append(script_dir)
+
+pylintrc = os.path.join(script_dir, 'webkitpy', 'pylintrc')
+lint.Run(['--rcfile', pylintrc, '-f', 'parseable' ] + sys.argv[1:])
diff --git a/Tools/Scripts/new-run-webkit-tests b/Tools/Scripts/new-run-webkit-tests
index 1c3d3b159..c771fd61a 100755
--- a/Tools/Scripts/new-run-webkit-tests
+++ b/Tools/Scripts/new-run-webkit-tests
@@ -53,7 +53,7 @@ if __name__ == '__main__':
     # Wrap the NRWT process in the jhbuild environment so DRT or WKTR
     # doesn't need to do it and their process id as reported by
     # subprocess.Popen is not jhbuild's.
-    if '--gtk' in sys.argv[1:]:
+    if '--gtk' in sys.argv[1:] and os.path.exists(os.path.join(script_dir, '..', '..', 'WebKitBuild', 'Dependencies')):
         cmd.insert(1, os.path.join(script_dir, '..', 'gtk', 'run-with-jhbuild'))
 
     proc = subprocess.Popen(cmd, env=env)
diff --git a/Tools/Scripts/prepare-ChangeLog b/Tools/Scripts/prepare-ChangeLog
index df687dc2c..cb91c598c 100755
--- a/Tools/Scripts/prepare-ChangeLog
+++ b/Tools/Scripts/prepare-ChangeLog
@@ -493,18 +493,19 @@ sub generateNewChangeLogs($$$$$$$$$$$)
 
         print CHANGE_LOG normalizeLineEndings($description . "\n", $endl) if $description;
 
-        $bugDescription = "Need a short description and bug URL (OOPS!)" unless $bugDescription;
+        $bugDescription = "Need a short description (OOPS!).\n        Need the bug URL (OOPS!)." unless $bugDescription;
         print CHANGE_LOG normalizeLineEndings("        $bugDescription\n", $endl) if $bugDescription;
         print CHANGE_LOG normalizeLineEndings("        $bugURL\n", $endl) if $bugURL;
         print CHANGE_LOG normalizeLineEndings("\n", $endl);
 
         print CHANGE_LOG normalizeLineEndings("        Reviewed by $reviewer.\n\n", $endl);
+        print CHANGE_LOG normalizeLineEndings("        Additional information of the change such as approach, rationale. Please add per-function descriptions below (OOPS!).\n\n", $endl);
 
         if ($prefix =~ m/WebCore/ || `pwd` =~ m/WebCore/) {
             if (@$addedRegressionTests) {
                 print CHANGE_LOG normalizeLineEndings(testListForChangeLog(sort @$addedRegressionTests), $endl);
             } else {
-                print CHANGE_LOG normalizeLineEndings("        No new tests. (OOPS!)\n\n", $endl);
+                print CHANGE_LOG normalizeLineEndings("        No new tests (OOPS!).\n\n", $endl);
             }
         }
 
diff --git a/Tools/Scripts/run-bindings-tests b/Tools/Scripts/run-bindings-tests
index 627f176de..a0785e405 100755
--- a/Tools/Scripts/run-bindings-tests
+++ b/Tools/Scripts/run-bindings-tests
@@ -51,7 +51,7 @@ def main(argv):
 
     from webkitpy.bindings.main import BindingsTests
 
-    BindingsTests(reset_results, generators, executive.Executive()).main()
+    return BindingsTests(reset_results, generators, executive.Executive()).main()
 
 
 if __name__ == '__main__':
diff --git a/Tools/Scripts/run-efl-tests b/Tools/Scripts/run-efl-tests
new file mode 100755
index 000000000..4a95f50c6
--- /dev/null
+++ b/Tools/Scripts/run-efl-tests
@@ -0,0 +1,40 @@
+#!/usr/bin/perl -w
+# Copyright (C) 2012 Intel Corporation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Intel Corporation nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+use strict;
+use FindBin;
+use lib $FindBin::Bin;
+use webkitdirs;
+
+setConfiguration();
+
+# Tell CTest to dump gtest output in case of failure.
+$ENV{CTEST_OUTPUT_ON_FAILURE} = "1";
+
+buildCMakeProjectOrExit(0, "Efl", undef, "test", cmakeBasedPortArguments());
diff --git a/Tools/Scripts/webkitdirs.pm b/Tools/Scripts/webkitdirs.pm
index ae634d175..1da09471b 100755
--- a/Tools/Scripts/webkitdirs.pm
+++ b/Tools/Scripts/webkitdirs.pm
@@ -206,8 +206,12 @@ sub determineBaseProductDir
                 my $buildLocationType = join '', readXcodeUserDefault("CustomBuildLocationType");
                 # FIXME: Read CustomBuildIntermediatesPath and set OBJROOT accordingly.
                 $baseProductDir = readXcodeUserDefault("CustomBuildProductsPath") if $buildLocationType eq "Absolute";
-                $setSharedPrecompsDir = 1;
             }
+
+            # DeterminedByTargets corresponds to a setting of "Legacy" in Xcode.
+            # It is the only build location style for which SHARED_PRECOMPS_DIR is not
+            # overridden when building from within Xcode.
+            $setSharedPrecompsDir = 1 if $buildLocationStyle ne "DeterminedByTargets";
         }
 
         if (!defined($baseProductDir)) {
@@ -226,9 +230,8 @@ sub determineBaseProductDir
         }
     }
 
-    if (!defined($baseProductDir)) { # Port-spesific checks failed, use default
+    if (!defined($baseProductDir)) { # Port-specific checks failed, use default
         $baseProductDir = "$sourceDir/WebKitBuild";
-        undef $setSharedPrecompsDir;
     }
 
     if (isBlackBerry()) {
@@ -819,26 +822,39 @@ sub qtFeatureDefaults
 
     my $originalCwd = getcwd();
 
-    my $file;
+    my $file = File::Spec->catfile($qmakepath, "configure.pro");
     my @buildArgs;
+    my $qconfigs;
 
     if (@_) {
         @buildArgs = (@buildArgs, @{$_[0]});
+        $qconfigs = $_[1];
         my $dir = File::Spec->catfile(productDir(), "Tools", "qmake");
         File::Path::mkpath($dir);
         chdir $dir or die "Failed to cd into " . $dir . "\n";
-        $file = File::Spec->catfile($qmakepath, "configure.pro");
     } else {
         # Do a quick check of the features without running the config tests
-        $file = File::Spec->catfile($qmakepath, "mkspecs", "features", "features.prf");
-        push @buildArgs, "CONFIG+=compute_defaults";
+        push @buildArgs, "CONFIG+=quick_check";
     }
 
-    my $defaults = `$qmakecommand @buildArgs $file 2>&1`;
+    my @defaults = `$qmakecommand @buildArgs -nocache $file 2>&1`;
 
     my %qtFeatureDefaults;
-    while ($defaults =~ m/(\S+?)=(\S+?)/gi) {
-        $qtFeatureDefaults{$1}=$2;
+    for (@defaults) {
+        if (/ DEFINES: /) {
+            while (/(\S+?)=(\S+?)/gi) {
+                $qtFeatureDefaults{$1}=$2;
+            }
+        } elsif (/ CONFIG:(.*)$/) {
+            if (@_) {
+                $$qconfigs = $1;
+            }
+        } elsif (/Done computing defaults/) {
+            print "\n";
+            last;
+        } elsif (@_) {
+            print $_;
+        }
     }
 
     chdir $originalCwd;
@@ -976,7 +992,7 @@ sub blackberryCMakeArguments()
     }
 
     push @cmakeExtraOptions, "-DCMAKE_SKIP_RPATH='ON'" if isDarwin();
-    push @cmakeExtraOptions, "-DENABLE_DRT=1" if $ENV{"ENABLE_DRT"};
+    push @cmakeExtraOptions, "-DPUBLIC_BUILD=1" if $ENV{"PUBLIC_BUILD"};
     push @cmakeExtraOptions, "-DENABLE_GLES2=1" unless $ENV{"DISABLE_GLES2"};
 
     my @includeSystemDirectories;
@@ -2050,6 +2066,9 @@ sub buildAutotoolsProject($@)
         push @buildArgs, "--disable-debug";
     }
 
+    # Enable unstable features when building through build-webkit.
+    push @buildArgs, "--enable-unstable-features";
+
     # We might need to update jhbuild dependencies.
     my $needUpdate = 0;
     if (jhbuildConfigurationChanged()) {
@@ -2227,6 +2246,7 @@ sub buildQMakeProjects
     my ($projects, $clean, @buildParams) = @_;
 
     my @buildArgs = ();
+    my $qconfigs = "";
 
     my $make = qtMakeCommand($qmakebin);
     my $makeargs = "";
@@ -2273,6 +2293,8 @@ sub buildQMakeProjects
     } elsif ($passedConfig =~ m/release/i) {
         push @buildArgs, "CONFIG+=release";
         push @buildArgs, "CONFIG-=debug";
+    } elsif ($passedConfig) {
+        die "Build type $passedConfig is not supported with --qt.\n";
     }
     push @buildArgs, "CONFIG-=debug_and_release" if ($passedConfig && isDarwin());
 
@@ -2281,7 +2303,7 @@ sub buildQMakeProjects
     File::Path::mkpath($dir);
     chdir $dir or die "Failed to cd into " . $dir . "\n";
 
-    my %defines = qtFeatureDefaults(\@buildArgs);
+    my %defines = qtFeatureDefaults(\@buildArgs, \$qconfigs);
 
     my $svnRevision = currentSVNRevision();
 
@@ -2290,6 +2312,8 @@ sub buildQMakeProjects
     my $pathToDefinesCache = File::Spec->catfile($dir, ".webkit.config");
     my $pathToOldDefinesFile = File::Spec->catfile($dir, "defaults.txt");
 
+    # FIXME: Get rid of .webkit.config and defaults.txt and move all the logic to .qmake.cache
+
     # Ease transition to new build layout
     if (-e $pathToOldDefinesFile) {
         print "Old build layout detected";
@@ -2349,16 +2373,23 @@ sub buildQMakeProjects
             File::Path::rmtree($dir);
             File::Path::mkpath($dir);
             chdir $dir or die "Failed to cd into " . $dir . "\n";
-
-            # After removing WebKitBuild directory, we have to call qtFeatureDefaults()
-            # to run config tests and generate the removed Tools/qmake/.qmake.cache again.
-            qtFeatureDefaults(\@buildArgs);
         #}
 
         # Still trigger an incremental build
         $buildHint = "incremental";
     }
 
+    if ($buildHint eq "incremental") {
+        my $qmakeDefines = "DEFINES +=";
+        foreach my $key (sort keys %defines) {
+            $qmakeDefines .= " \\\n    $key=$defines{$key}";
+        }
+        open(QMAKE_CACHE, ">.qmake.cache") or die "Cannot create .qmake.cache!\n";
+        print QMAKE_CACHE "CONFIG += webkit_configured $qconfigs\n";
+        print QMAKE_CACHE $qmakeDefines."\n";
+        close(QMAKE_CACHE);
+    }
+
     # Save config up-front so we can detect changes to the build config even
     # when the user re-configures after aborting the build.
     open(DEFAULTS, ">$pathToDefinesCache");
@@ -2496,6 +2527,7 @@ sub buildChromiumVisualStudioProject($$)
     } else {
         $vsInstallDir = "$programFilesPath/Microsoft Visual Studio 8";
     }
+    $vsInstallDir =~ s,\\,/,g;
     $vsInstallDir = `cygpath "$vsInstallDir"` if isCygwin();
     chomp $vsInstallDir;
     $vcBuildPath = "$vsInstallDir/Common7/IDE/devenv.com";
diff --git a/Tools/Scripts/webkitperl/FeatureList.pm b/Tools/Scripts/webkitperl/FeatureList.pm
index 0f033ac55..ca3b9e3d6 100644
--- a/Tools/Scripts/webkitperl/FeatureList.pm
+++ b/Tools/Scripts/webkitperl/FeatureList.pm
@@ -62,11 +62,11 @@ my (
     $datalistSupport,
     $detailsSupport,
     $deviceOrientationSupport,
+    $dialogElementSupport,
     $directoryUploadSupport,
     $downloadAttributeSupport,
     $fileSystemSupport,
     $filtersSupport,
-    $fontBoostingSupport,
     $ftpDirSupport,
     $fullscreenAPISupport,
     $gamepadSupport,
@@ -116,6 +116,7 @@ my (
     $svgFontsSupport,
     $svgSupport,
     $systemMallocSupport,
+    $textAutosizingSupport,
     $tiledBackingStoreSupport,
     $touchEventsSupport,
     $touchIconLoadingSupport,
@@ -175,13 +176,13 @@ my @features = (
       define => "ENABLE_CSS_SHADERS", default => isAppleMacWebKit(), value => \$cssShadersSupport },
 
     { option => "css-variables", desc => "Toggle CSS Variable support",
-      define => "ENABLE_CSS_VARIABLES", default => 0, value => \$cssVariablesSupport },
+      define => "ENABLE_CSS_VARIABLES", default => isEfl(), value => \$cssVariablesSupport },
 
     { option => "custom-scheme-handler", desc => "Toggle Custom Scheme Handler support",
-      define => "ENABLE_CUSTOM_SCHEME_HANDLER", default => 0, value => \$customSchemeHandlerSupport },
+      define => "ENABLE_CUSTOM_SCHEME_HANDLER", default => (isBlackBerry() || isEfl()), value => \$customSchemeHandlerSupport },
 
     { option => "datalist", desc => "Toggle Datalist support",
-      define => "ENABLE_DATALIST", default => 0, value => \$datalistSupport },
+      define => "ENABLE_DATALIST", default => isEfl(), value => \$datalistSupport },
 
     { option => "data-transfer-items", desc => "Toggle Data Transfer Items support",
       define => "ENABLE_DATA_TRANSFER_ITEMS", default => 0, value => \$dataTransferItemsSupport },
@@ -192,7 +193,10 @@ my @features = (
     { option => "device-orientation", desc => "Toggle Device Orientation support",
       define => "ENABLE_DEVICE_ORIENTATION", default => isBlackBerry(), value => \$deviceOrientationSupport },
 
-    { option => "directory-upload", desc => "Toogle Directory Upload support",
+    { option => "dialog", desc => "Toggle Dialog Element support",
+      define => "ENABLE_DIALOG_ELEMENT", default => 0, value => \$dialogElementSupport },
+
+    { option => "directory-upload", desc => "Toggle Directory Upload support",
       define => "ENABLE_DIRECTORY_UPLOAD", default => 0, value => \$directoryUploadSupport },
 
     { option => "download-attribute", desc => "Toggle Download Attribute support",
@@ -204,9 +208,6 @@ my @features = (
     { option => "filters", desc => "Toggle Filters support",
       define => "ENABLE_FILTERS", default => (isAppleWebKit() || isGtk() || isQt() || isEfl() || isBlackBerry()), value => \$filtersSupport },
 
-    { option => "font-boosting", desc => "Toggle Font Boosting support",
-      define => "ENABLE_FONT_BOOSTING", default => 0, value => \$fontBoostingSupport },
-
     { option => "ftpdir", desc => "Toggle FTP Directory support",
       define => "ENABLE_FTPDIR", default => !isWinCE(), value => \$ftpDirSupport },
 
@@ -214,7 +215,7 @@ my @features = (
       define => "ENABLE_FULLSCREEN_API", default => (isAppleMacWebKit() || isEfl() || isGtk() || isBlackBerry() || isQt()), value => \$fullscreenAPISupport },
 
     { option => "gamepad", desc => "Toggle Gamepad support",
-      define => "ENABLE_GAMEPAD", default => 0, value => \$gamepadSupport },
+      define => "ENABLE_GAMEPAD", default => (isEfl() || isGtk()), value => \$gamepadSupport },
 
     { option => "geolocation", desc => "Toggle Geolocation support",
       define => "ENABLE_GEOLOCATION", default => (isAppleWebKit() || isGtk() || isBlackBerry()), value => \$geolocationSupport },
@@ -292,7 +293,7 @@ my @features = (
       define => "ENABLE_MHTML", default => 0, value => \$mhtmlSupport },
 
     { option => "microdata", desc => "Toggle Microdata support",
-      define => "ENABLE_MICRODATA", default => 0, value => \$microdataSupport },
+      define => "ENABLE_MICRODATA", default => (isEfl() || isBlackBerry()), value => \$microdataSupport },
 
     { option => "mutation-observers", desc => "Toggle Mutation Observers support",
       define => "ENABLE_MUTATION_OBSERVERS", default => 1, value => \$mutationObserversSupport },
@@ -319,7 +320,7 @@ my @features = (
       define => "ENABLE_QUOTA", default => 0, value => \$quotaSupport },
 
     { option => "register-protocol-handler", desc => "Toggle Register Protocol Handler support",
-      define => "ENABLE_REGISTER_PROTOCOL_HANDLER", default => isEfl(), value => \$registerProtocolHandlerSupport },
+      define => "ENABLE_REGISTER_PROTOCOL_HANDLER", default => (isBlackBerry() || isEfl()), value => \$registerProtocolHandlerSupport },
 
     { option => "request-animation-frame", desc => "Toggle Request Animation Frame support",
       define => "ENABLE_REQUEST_ANIMATION_FRAME", default => (isAppleMacWebKit() || isGtk() || isEfl() || isBlackBerry()), value => \$requestAnimationFrameSupport },
@@ -337,7 +338,7 @@ my @features = (
       define => "ENABLE_SQL_DATABASE", default => 1, value => \$sqlDatabaseSupport },
 
     { option => "style-scoped", desc => "Toggle Style Scoped support",
-      define => "ENABLE_STYLE_SCOPED", default => 0, value => \$styleScopedSupport },
+      define => "ENABLE_STYLE_SCOPED", default => isBlackBerry(), value => \$styleScopedSupport },
 
     { option => "svg", desc => "Toggle SVG support",
       define => "ENABLE_SVG", default => 1, value => \$svgSupport },
@@ -351,6 +352,9 @@ my @features = (
     { option => "system-malloc", desc => "Toggle system allocator instead of TCmalloc",
       define => "USE_SYSTEM_MALLOC", default => isWinCE(), value => \$systemMallocSupport },
 
+    { option => "text-autosizing", desc => "Toggle Text Autosizing support",
+      define => "ENABLE_TEXT_AUTOSIZING", default => 0, value => \$textAutosizingSupport },
+
     { option => "tiled-backing-store", desc => "Toggle Tiled Backing Store support",
       define => "WTF_USE_TILED_BACKING_STORE", default => isQt(), value => \$tiledBackingStoreSupport },
 
diff --git a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
index 8ae0bb9b9..d244045ac 100644
--- a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
+++ b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer.py
@@ -52,6 +52,7 @@ def _baseline_search_hypergraph(host):
 
 _VIRTUAL_PORTS = {
     'mac-future': ['LayoutTests/platform/mac-future', 'LayoutTests/platform/mac', 'LayoutTests'],
+    'win-future': ['LayoutTests/platform/win-future', 'LayoutTests/platform/win', 'LayoutTests'],
     'qt-unknown': ['LayoutTests/platform/qt-unknown', 'LayoutTests/platform/qt', 'LayoutTests'],
 }
 
diff --git a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
index 414cc06df..9ba6ff1f2 100644
--- a/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
+++ b/Tools/Scripts/webkitpy/common/checkout/baselineoptimizer_unittest.py
@@ -119,6 +119,21 @@ class BaselineOptimizerTest(unittest.TestCase):
             'LayoutTests/platform/qt': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
         })
 
+    def test_win_does_not_drop_to_win_7sp0(self):
+        self._assertOptimization({
+            'LayoutTests/platform/win': '1',
+            'LayoutTests/platform/mac': '2',
+            'LayoutTests/platform/gtk': '3',
+            'LayoutTests/platform/qt': '4',
+            'LayoutTests/platform/chromium': '5',
+        }, {
+            'LayoutTests/platform/win': '1',
+            'LayoutTests/platform/mac': '2',
+            'LayoutTests/platform/gtk': '3',
+            'LayoutTests/platform/qt': '4',
+            'LayoutTests/platform/chromium': '5',
+        })
+
     def test_common_directory_includes_root(self):
         # Note: The resulting directories are "wrong" in the sense that
         # enacting this plan would change semantics. However, this test case
@@ -138,7 +153,7 @@ class BaselineOptimizerTest(unittest.TestCase):
             'LayoutTests/platform/chromium-win': '23a30302a6910f8a48b1007fa36f3e3158341834',
             'LayoutTests': '9c876f8c3e4cc2aef9519a6c1174eb3432591127',
             'LayoutTests/platform/chromium-mac': '23a30302a6910f8a48b1007fa36f3e3158341834',
-            'LayoutTests/platform/chromium-mac': '23a30302a6910f8a48b1007fa36f3e3158341834',
+            'LayoutTests/platform/chromium': '1',
         }, {
             'LayoutTests/platform/chromium': '23a30302a6910f8a48b1007fa36f3e3158341834',
             'LayoutTests': '9c876f8c3e4cc2aef9519a6c1174eb3432591127',
@@ -153,7 +168,6 @@ class BaselineOptimizerTest(unittest.TestCase):
             'LayoutTests/platform/chromium-win': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
             'LayoutTests/platform/mac': '5daa78e55f05d9f0d1bb1f32b0cd1bc3a01e9364',
             'LayoutTests/platform/chromium-win-xp': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
-            'LayoutTests/platform/chromium-mac-leopard': '65e7d42f8b4882b29d46dc77bb879dd41bc074dc',
             'LayoutTests/platform/mac-lion': '7ad045ece7c030e2283c5d21d9587be22bcba56e',
             'LayoutTests/platform/chromium-win': 'f83af9732ce74f702b8c9c4a3d9a4c6636b8d3bd',
             'LayoutTests/platform/win-xp': '5b1253ef4d5094530d5f1bc6cdb95c90b446bec7',
@@ -162,7 +176,6 @@ class BaselineOptimizerTest(unittest.TestCase):
             'LayoutTests/platform/chromium-win': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
             'LayoutTests/platform/mac': '5daa78e55f05d9f0d1bb1f32b0cd1bc3a01e9364',
             'LayoutTests/platform/chromium-win-xp': '462d03b9c025db1b0392d7453310dbee5f9a9e74',
-            'LayoutTests/platform/chromium-mac-leopard': '65e7d42f8b4882b29d46dc77bb879dd41bc074dc',
             'LayoutTests/platform/mac-lion': '7ad045ece7c030e2283c5d21d9587be22bcba56e',
             'LayoutTests/platform/chromium-win': 'f83af9732ce74f702b8c9c4a3d9a4c6636b8d3bd',
             'LayoutTests/platform/win-xp': '5b1253ef4d5094530d5f1bc6cdb95c90b446bec7',
diff --git a/Tools/Scripts/webkitpy/common/checkout/changelog.py b/Tools/Scripts/webkitpy/common/checkout/changelog.py
index f30fd2c2d..ae7b71fc0 100644
--- a/Tools/Scripts/webkitpy/common/checkout/changelog.py
+++ b/Tools/Scripts/webkitpy/common/checkout/changelog.py
@@ -327,7 +327,7 @@ class ChangeLog(object):
 
     def update_with_unreviewed_message(self, message):
         first_boilerplate_line_regexp = re.compile(
-                "%sNeed a short description and bug URL \(OOPS!\)" % self._changelog_indent)
+                "%sNeed a short description \(OOPS!\)\." % self._changelog_indent)
         removing_boilerplate = False
         # inplace=1 creates a backup file and re-directs stdout to the file
         for line in fileinput.FileInput(self.path, inplace=1):
@@ -345,12 +345,33 @@ class ChangeLog(object):
                 print line,
 
     def set_reviewer(self, reviewer):
-        # inplace=1 creates a backup file and re-directs stdout to the file
-        for line in fileinput.FileInput(self.path, inplace=1):
-            # Trailing comma suppresses printing newline
-            print line.replace("NOBODY (OOPS!)", reviewer.encode("utf-8")),
+        latest_entry = self.latest_entry()
+        latest_entry_contents = latest_entry.contents()
+        reviewer_text = latest_entry.reviewer()
+        found_nobody = re.search("NOBODY\s*\(OOPS!\)", latest_entry_contents, re.MULTILINE)
+
+        if not found_nobody and not reviewer_text:
+            bug_url_number_of_items = len(re.findall(config_urls.bug_url_long, latest_entry_contents, re.MULTILINE))
+            bug_url_number_of_items += len(re.findall(config_urls.bug_url_short, latest_entry_contents, re.MULTILINE))
+            for line in fileinput.FileInput(self.path, inplace=1):
+                found_bug_url = re.search(config_urls.bug_url_long, line)
+                if not found_bug_url:
+                    found_bug_url = re.search(config_urls.bug_url_short, line)
+                print line,
+                if found_bug_url:
+                    if bug_url_number_of_items == 1:
+                        print "\n        Reviewed by %s." % (reviewer.encode("utf-8"))
+                    bug_url_number_of_items -= 1
+        else:
+            # inplace=1 creates a backup file and re-directs stdout to the file
+            for line in fileinput.FileInput(self.path, inplace=1):
+                # Trailing comma suppresses printing newline
+                print line.replace("NOBODY (OOPS!)", reviewer.encode("utf-8")),
 
     def set_short_description_and_bug_url(self, short_description, bug_url):
-        message = "%s\n        %s" % (short_description, bug_url)
+        message = "%s\n%s%s" % (short_description, self._changelog_indent, bug_url)
+        bug_boilerplate = "%sNeed the bug URL (OOPS!).\n" % self._changelog_indent
         for line in fileinput.FileInput(self.path, inplace=1):
-            print line.replace("Need a short description and bug URL (OOPS!)", message.encode("utf-8")),
+            line = line.replace("Need a short description (OOPS!).", message.encode("utf-8"))
+            if line != bug_boilerplate:
+                print line,
diff --git a/Tools/Scripts/webkitpy/common/checkout/changelog_unittest.py b/Tools/Scripts/webkitpy/common/checkout/changelog_unittest.py
index d2040bf2e..9591744d1 100644
--- a/Tools/Scripts/webkitpy/common/checkout/changelog_unittest.py
+++ b/Tools/Scripts/webkitpy/common/checkout/changelog_unittest.py
@@ -489,15 +489,54 @@ class ChangeLogTest(unittest.TestCase):
     # FIXME: We really should be getting this from prepare-ChangeLog itself.
     _new_entry_boilerplate = '''2009-08-19  Eric Seidel  <eric@webkit.org>
 
-        Need a short description and bug URL (OOPS!)
+        Need a short description (OOPS!).
+        Need the bug URL (OOPS!).
 
         Reviewed by NOBODY (OOPS!).
 
         * Scripts/bugzilla-tool:
 '''
 
+    _new_entry_boilerplate_with_bugurl = '''2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        Need a short description (OOPS!).
+        https://bugs.webkit.org/show_bug.cgi?id=12345
+
+        Reviewed by NOBODY (OOPS!).
+
+        * Scripts/bugzilla-tool:
+'''
+
+    _new_entry_boilerplate_with_multiple_bugurl = '''2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        Need a short description (OOPS!).
+        https://bugs.webkit.org/show_bug.cgi?id=12345
+        http://webkit.org/b/12345
+
+        Reviewed by NOBODY (OOPS!).
+
+        * Scripts/bugzilla-tool:
+'''
+
+    _new_entry_boilerplate_without_reviewer_line = '''2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        Need a short description (OOPS!).
+        https://bugs.webkit.org/show_bug.cgi?id=12345
+
+        * Scripts/bugzilla-tool:
+'''
+
+    _new_entry_boilerplate_without_reviewer_multiple_bugurl = '''2009-08-19  Eric Seidel  <eric@webkit.org>
+
+        Need a short description (OOPS!).
+        https://bugs.webkit.org/show_bug.cgi?id=12345
+        http://webkit.org/b/12345
+
+        * Scripts/bugzilla-tool:
+'''
+
     def test_set_reviewer(self):
-        changelog_contents = u"%s\n%s" % (self._new_entry_boilerplate, self._example_changelog)
+        changelog_contents = u"%s\n%s" % (self._new_entry_boilerplate_with_bugurl, self._example_changelog)
         changelog_path = self._write_tmp_file_with_contents(changelog_contents.encode("utf-8"))
         reviewer_name = 'Test Reviewer'
         ChangeLog(changelog_path).set_reviewer(reviewer_name)
@@ -506,14 +545,41 @@ class ChangeLogTest(unittest.TestCase):
         os.remove(changelog_path)
         self.assertEquals(actual_contents.splitlines(), expected_contents.splitlines())
 
+        changelog_contents_without_reviewer_line = u"%s\n%s" % (self._new_entry_boilerplate_without_reviewer_line, self._example_changelog)
+        changelog_path = self._write_tmp_file_with_contents(changelog_contents_without_reviewer_line.encode("utf-8"))
+        ChangeLog(changelog_path).set_reviewer(reviewer_name)
+        actual_contents = self._read_file_contents(changelog_path, "utf-8")
+        os.remove(changelog_path)
+        self.assertEquals(actual_contents.splitlines(), expected_contents.splitlines())
+
+        changelog_contents_without_reviewer_line = u"%s\n%s" % (self._new_entry_boilerplate_without_reviewer_multiple_bugurl, self._example_changelog)
+        changelog_path = self._write_tmp_file_with_contents(changelog_contents_without_reviewer_line.encode("utf-8"))
+        ChangeLog(changelog_path).set_reviewer(reviewer_name)
+        actual_contents = self._read_file_contents(changelog_path, "utf-8")
+        changelog_contents = u"%s\n%s" % (self._new_entry_boilerplate_with_multiple_bugurl, self._example_changelog)
+        expected_contents = changelog_contents.replace('NOBODY (OOPS!)', reviewer_name)
+        os.remove(changelog_path)
+        self.assertEquals(actual_contents.splitlines(), expected_contents.splitlines())
+
     def test_set_short_description_and_bug_url(self):
-        changelog_contents = u"%s\n%s" % (self._new_entry_boilerplate, self._example_changelog)
+        changelog_contents = u"%s\n%s" % (self._new_entry_boilerplate_with_bugurl, self._example_changelog)
         changelog_path = self._write_tmp_file_with_contents(changelog_contents.encode("utf-8"))
         short_description = "A short description"
         bug_url = "http://example.com/b/2344"
         ChangeLog(changelog_path).set_short_description_and_bug_url(short_description, bug_url)
         actual_contents = self._read_file_contents(changelog_path, "utf-8")
         expected_message = "%s\n        %s" % (short_description, bug_url)
-        expected_contents = changelog_contents.replace("Need a short description and bug URL (OOPS!)", expected_message)
+        expected_contents = changelog_contents.replace("Need a short description (OOPS!).", expected_message)
+        os.remove(changelog_path)
+        self.assertEquals(actual_contents.splitlines(), expected_contents.splitlines())
+
+        changelog_contents = u"%s\n%s" % (self._new_entry_boilerplate, self._example_changelog)
+        changelog_path = self._write_tmp_file_with_contents(changelog_contents.encode("utf-8"))
+        short_description = "A short description 2"
+        bug_url = "http://example.com/b/2345"
+        ChangeLog(changelog_path).set_short_description_and_bug_url(short_description, bug_url)
+        actual_contents = self._read_file_contents(changelog_path, "utf-8")
+        expected_message = "%s\n        %s" % (short_description, bug_url)
+        expected_contents = changelog_contents.replace("Need a short description (OOPS!).\n        Need the bug URL (OOPS!).", expected_message)
         os.remove(changelog_path)
         self.assertEquals(actual_contents.splitlines(), expected_contents.splitlines())
diff --git a/Tools/Scripts/webkitpy/common/checkout/checkout_unittest.py b/Tools/Scripts/webkitpy/common/checkout/checkout_unittest.py
index 78d25cb31..e9c2cddda 100644
--- a/Tools/Scripts/webkitpy/common/checkout/checkout_unittest.py
+++ b/Tools/Scripts/webkitpy/common/checkout/checkout_unittest.py
@@ -259,5 +259,5 @@ class CheckoutTest(unittest.TestCase):
         mock_patch = Mock()
         mock_patch.contents = lambda: "foo"
         mock_patch.reviewer = lambda: None
-        expected_stderr = "MOCK run_command: ['svn-apply', '--force'], cwd=/mock-checkout\n"
+        expected_stderr = "MOCK run_command: ['svn-apply', '--force'], cwd=/mock-checkout, input=foo\n"
         OutputCapture().assert_outputs(self, checkout.apply_patch, [mock_patch], expected_stderr=expected_stderr)
diff --git a/Tools/Scripts/webkitpy/common/checksvnconfigfile.py b/Tools/Scripts/webkitpy/common/checksvnconfigfile.py
new file mode 100644
index 000000000..e6165f64b
--- /dev/null
+++ b/Tools/Scripts/webkitpy/common/checksvnconfigfile.py
@@ -0,0 +1,65 @@
+# Copyright (C) 2012 Balazs Ankes (bank@inf.u-szeged.hu) University of Szeged
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# This file is used by:
+# webkitpy/tool/steps/addsvnmimetypeforpng.py
+# webkitpy/style/checkers/png.py
+
+import os
+import re
+
+
+def check(host, fs):
+    """
+    check the svn config file
+    return with three logical value:
+    is svn config file missing, is auto-props missing, is the svn:mime-type for png missing
+    """
+
+    cfg_file_path = config_file_path(host, fs)
+
+    try:
+        config_file = fs.read_text_file(cfg_file_path)
+    except IOError:
+        return (True, True, True)
+
+    errorcode_autoprop = not re.search("^\s*enable-auto-props\s*=\s*yes", config_file, re.MULTILINE)
+    errorcode_png = not re.search("^\s*\*\.png\s*=\s*svn:mime-type=image/png", config_file, re.MULTILINE)
+
+    return (False, errorcode_autoprop, errorcode_png)
+
+
+def config_file_path(host, fs):
+    if host.platform.is_win():
+        config_file_path = fs.join(os.environ['APPDATA'], "Subversion", "config")
+    else:
+        config_file_path = fs.join(fs.expanduser("~"), ".subversion", "config")
+    return config_file_path
+
+
+def errorstr_autoprop(config_file_path):
+    return 'Have to enable auto props in the subversion config file (%s "enable-auto-props = yes"). ' % config_file_path
+
+
+def errorstr_png(config_file_path):
+    return 'Have to set the svn:mime-type in the subversion config file (%s "*.png = svn:mime-type=image/png").' % config_file_path
diff --git a/Tools/Scripts/webkitpy/common/config/committers.py b/Tools/Scripts/webkitpy/common/config/committers.py
index cdbd3e15b..f31510022 100644
--- a/Tools/Scripts/webkitpy/common/config/committers.py
+++ b/Tools/Scripts/webkitpy/common/config/committers.py
@@ -110,10 +110,8 @@ contributors_who_are_not_committers = [
     Contributor("Adam Kallai", "kadam@inf.u-szeged.hu", 'kadam'),
     Contributor("Aharon Lanin", "aharon@google.com"),
     Contributor("Alan Stearns", "stearns@adobe.com", 'astearns'),
-    Contributor("Alec Flett", ["alecflett@chromium.org", "alecflett@google.com"], "alecf"),
     Contributor("Alexandre Elias", "aelias@chromium.org"),
     Contributor("Alexey Marinichev", ["amarinichev@chromium.org", "amarinichev@google.com"], "amarinichev"),
-    Contributor("Allan Sandfeld Jensen", ["allan.jensen@nokia.com", "kde@carewolf.com", "sandfeld@kde.org"], "carewolf"),
     Contributor("Andras Piroska", "pandras@inf.u-szeged.hu", "andris88"),
     Contributor("Anne van Kesteren", "annevankesteren+webkit@gmail.com", "annevk"),
     Contributor("Annie Sullivan", "sullivan@chromium.org", "annie"),
@@ -122,7 +120,6 @@ contributors_who_are_not_committers = [
     Contributor("Brian Salomon", "bsalomon@google.com"),
     Contributor("Commit Queue", "commit-queue@webkit.org"),
     Contributor("Daniel Sievers", "sievers@chromium.org"),
-    Contributor("Dave Tharp", "dtharp@codeaurora.org", "dtharp"),
     Contributor("David Barr", "davidbarr@chromium.org", "barrbrain"),
     Contributor("David Dorwin", "ddorwin@chromium.org", "ddorwin"),
     Contributor("David Reveman", "reveman@chromium.org", "reveman"),
@@ -136,7 +133,6 @@ contributors_who_are_not_committers = [
     Contributor("Gregg Tavares", ["gman@google.com", "gman@chromium.org"], "gman"),
     Contributor("Hao Zheng", "zhenghao@chromium.org"),
     Contributor("Ian Hickson", "ian@hixie.ch", "hixie"),
-    Contributor("Ian Vollick", "vollick@chromium.org", "vollick"),
     Contributor("Janos Badics", "jbadics@inf.u-szeged.hu", 'dicska'),
     Contributor("Jing Zhao", "jingzhao@chromium.org"),
     Contributor("John Bates", ["jbates@google.com", "jbates@chromium.org"], "jbates"),
@@ -179,11 +175,13 @@ committers_unable_to_review = [
     Committer("Adam Langley", "agl@chromium.org", "agl"),
     Committer("Ademar de Souza Reis Jr", ["ademar.reis@gmail.com", "ademar@webkit.org"], "ademar"),
     Committer("Albert J. Wong", "ajwong@chromium.org"),
+    Committer("Alec Flett", ["alecflett@chromium.org", "alecflett@google.com"], "alecf"),
     Committer(u"Alexander F\u00e6r\u00f8y", ["ahf@0x90.dk", "alexander.faeroy@nokia.com"], "ahf"),
     Committer("Alexander Kellett", ["lypanov@mac.com", "a-lists001@lypanov.net", "lypanov@kde.org"], "lypanov"),
     Committer("Alexander Pavlov", "apavlov@chromium.org", "apavlov"),
     Committer("Alexandru Chiculita", "achicu@adobe.com", "achicu"),
     Committer("Alice Boxhall", "aboxhall@chromium.org", "aboxhall"),
+    Committer("Allan Sandfeld Jensen", ["allan.jensen@nokia.com", "kde@carewolf.com", "sandfeld@kde.org"], "carewolf"),
     Committer("Alok Priyadarshi", "alokp@chromium.org", "alokp"),
     Committer("Ami Fischman", ["fischman@chromium.org", "fischman@google.com"], "fischman"),
     Committer("Amruth Raj", "amruthraj@motorola.com", "amruthraj"),
@@ -224,6 +222,7 @@ committers_unable_to_review = [
     Committer("Dana Jansens", "danakj@chromium.org", "danakj"),
     Committer("Daniel Cheng", "dcheng@chromium.org", "dcheng"),
     Committer("Dave Barton", "dbarton@mathscribe.com", "dbarton"),
+    Committer("Dave Tharp", "dtharp@codeaurora.org", "dtharp"),
     Committer("David Grogan", ["dgrogan@chromium.org", "dgrogan@google.com"], "dgrogan"),
     Committer("David Smith", ["catfish.man@gmail.com", "dsmith@webkit.org"], "catfishman"),
     Committer("Diego Gonzalez", ["diegohcg@webkit.org", "diego.gonzalez@openbossa.org"], "diegohcg"),
@@ -256,6 +255,7 @@ committers_unable_to_review = [
     Committer("Hironori Bono", "hbono@chromium.org", "hbono"),
     Committer("Helder Correia", "helder.correia@nokia.com", "helder"),
     Committer("Hin-Chung Lam", ["hclam@google.com", "hclam@chromium.org"]),
+    Committer("Ian Vollick", "vollick@chromium.org", "vollick"),
     Committer("Igor Trindade Oliveira", ["igor.oliveira@webkit.org", "igor.o@sisa.samsung.com"], "igoroliveira"),
     Committer("Ilya Sherman", "isherman@chromium.org", "isherman"),
     Committer("Ilya Tikhonovsky", "loislo@chromium.org", "loislo"),
@@ -267,6 +267,7 @@ committers_unable_to_review = [
     Committer("James Kozianski", ["koz@chromium.org", "koz@google.com"], "koz"),
     Committer("James Simonsen", "simonjam@chromium.org", "simonjam"),
     Committer("Jarred Nicholls", ["jarred@webkit.org", "jarred@sencha.com"], "jarrednicholls"),
+    Committer("Jason Liu", ["jason.liu@torchmobile.com.cn", "jasonliuwebkit@gmail.com"], "jasonliu"),
     Committer("Jay Civelli", "jcivelli@chromium.org", "jcivelli"),
     Committer("Jeff Miller", "jeffm@apple.com", "jeffm7"),
     Committer("Jeffrey Pfau", ["jeffrey@endrift.com", "jpfau@apple.com"], "jpfau"),
@@ -277,6 +278,7 @@ committers_unable_to_review = [
     Committer("Jesus Sanchez-Palencia", ["jesus@webkit.org", "jesus.palencia@openbossa.org"], "jeez_"),
     Committer("Jia Pu", "jpu@apple.com"),
     Committer("Jochen Eisinger", "jochen@chromium.org", "jochen__"),
+    Committer("Joe Thomas", "joethomas@motorola.com", "joethomas"),
     Committer("John Abd-El-Malek", "jam@chromium.org", "jam"),
     Committer("John Gregg", ["johnnyg@google.com", "johnnyg@chromium.org"], "johnnyg"),
     Committer("John Knottenbelt", "jknotten@chromium.org", "jknotten"),
@@ -312,7 +314,6 @@ committers_unable_to_review = [
     Committer("Mahesh Kulkarni", ["mahesh.kulkarni@nokia.com", "maheshk@webkit.org"], "maheshk"),
     Committer("Marcus Voltis Bulach", "bulach@chromium.org"),
     Committer("Mario Sanchez Prada", ["msanchez@igalia.com", "mario@webkit.org"], "msanchez"),
-    Committer("Mark Hahnenberg", "mhahnenberg@apple.com"),
     Committer("Mary Wu", ["mary.wu@torchmobile.com.cn", "wwendy2007@gmail.com"], "marywu"),
     Committer("Matt Delaney", "mdelaney@apple.com"),
     Committer("Matt Lilek", ["mlilek@apple.com", "webkit@mattlilek.com", "pewtermoose@webkit.org"], "pewtermoose"),
@@ -365,7 +366,6 @@ committers_unable_to_review = [
     Committer("Steve Lacey", "sjl@chromium.org", "stevela"),
     Committer("Takashi Toyoshima", "toyoshim@chromium.org", "toyoshim"),
     Committer("Thomas Sepez", "tsepez@chromium.org", "tsepez"),
-    Committer("Tim Horton", "timothy_horton@apple.com", "thorton"),
     Committer("Tom Zakrajsek", "tomz@codeaurora.org", "tomz"),
     Committer("Tommy Widenflycht", "tommyw@google.com", "tommyw"),
     Committer("Trey Matteson", "trey@usa.net", "trey"),
@@ -483,6 +483,7 @@ reviewers_list = [
     Reviewer("Levi Weintraub", ["leviw@chromium.org", "leviw@google.com", "lweintraub@apple.com"], "leviw"),
     Reviewer("Luiz Agostini", ["luiz@webkit.org", "luiz.agostini@openbossa.org"], "lca"),
     Reviewer("Maciej Stachowiak", "mjs@apple.com", "othermaciej"),
+    Reviewer("Mark Hahnenberg", "mhahnenberg@apple.com", "mhahnenberg"),
     Reviewer("Mark Rowe", "mrowe@apple.com", "bdash"),
     Reviewer("Martin Robinson", ["mrobinson@webkit.org", "mrobinson@igalia.com", "martin.james.robinson@gmail.com"], "mrobinson"),
     Reviewer("Michael Saboff", "msaboff@apple.com", "msaboff"),
@@ -507,6 +508,7 @@ reviewers_list = [
     Reviewer("Steve Falkenburg", "sfalken@apple.com", "sfalken"),
     Reviewer("Tim Omernick", "timo@apple.com"),
     Reviewer("Timothy Hatcher", ["timothy@apple.com", "timothy@hatcher.name"], "xenon"),
+    Reviewer("Tim Horton", "timothy_horton@apple.com", "thorton"),
     Reviewer("Tony Chang", "tony@chromium.org", "tony^work"),
     Reviewer("Tony Gentilcore", "tonyg@chromium.org", "tonyg-cr"),
     Reviewer(u"Tor Arne Vestb\u00f8", ["vestbo@webkit.org", "tor.arne.vestbo@nokia.com"], "torarne"),
diff --git a/Tools/Scripts/webkitpy/common/config/watchlist b/Tools/Scripts/webkitpy/common/config/watchlist
index 5d5f59061..c11656322 100755
--- a/Tools/Scripts/webkitpy/common/config/watchlist
+++ b/Tools/Scripts/webkitpy/common/config/watchlist
@@ -157,13 +157,35 @@
         },
         "MathML": {
             "filename": r"(Source|LayoutTests|Websites)/.*mathml",
-        }
+        },
+        "Editing": {
+            "filename": r"Source/WebCore/editing/",
+        },
+        "BlackBerry": {
+            "filename": r"Source/WebKit/blackberry/"
+                        r"|Source/WebCore/page/blackberry"
+                        r"|Source/WebCore/history/blackberry"
+                        r"|Source/WebCore/plugins/blackberry"
+                        r"|Source/WebCore/editing/blackberry"
+                        r"|Source/WebCore/Resources/blackberry"
+                        r"|Source/WebCore/platform/image-decoders/blackberry"
+                        r"|Source/WebCore/platform/blackberry"
+                        r"|Source/WebCore/platform/text/blackberry"
+                        r"|Source/WebCore/platform/network/blackberry"
+                        r"|Source/WebCore/platform/graphics/blackberry"
+                        r"|Source/WTF/wtf/blackberry"
+                        r"|ManualTests/blackberry"
+                        r"|Tools/DumpRenderTree/blackberry"
+                        r"|LayoutTests/platform/blackberry",
+        },
+
     },
     "CC_RULES": {
         # Note: All email addresses listed must be registered with bugzilla.
         # Specifically, levin@chromium.org and levin+threading@chromium.org are
         # two different accounts as far as bugzilla is concerned.
         "AppleMacPublicApi": [ "timothy@apple.com" ],
+        "BlackBerry": [ "mifenton@rim.com" ],
         "CMake": [ "rakuco@webkit.org", ],
         "CSS": [ "alexis.menard@openbossa.org", "macpherson@chromium.org", "cmarcelo@webkit.org" ],
         "ChromiumDumpRenderTree": [ "tkent@chromium.org", ],
@@ -171,7 +193,8 @@
         "ChromiumPublicApi": [ "abarth@webkit.org", "dglazkov@chromium.org", "fishd@chromium.org", "jamesr@chromium.org", "tkent+wkapi@chromium.org" ],
         "DOMAttributes": [ "cmarcelo@webkit.org", ],
         "EFL": [ "rakuco@webkit.org", ],
-        "Forms": [ "tkent@chromium.org", ],
+        "Editing": [ "mifenton@rim.com" ],
+        "Forms": [ "tkent@chromium.org", "mifenton@rim.com" ],
         "FrameLoader": [ "abarth@webkit.org", "japhet@chromium.org", "jochen@chromium.org" ],
         "GStreamerGraphics": [ "alexis.menard@openbossa.org", "pnormand@igalia.com", "gns@gnome.org", "mrobinson@webkit.org" ],
         "GtkWebKit2PublicAPI": [ "cgarcia@igalia.com", "gns@gnome.org", "mrobinson@webkit.org" ],
diff --git a/Tools/Scripts/webkitpy/common/host.py b/Tools/Scripts/webkitpy/common/host.py
index 083120227..53889657b 100644
--- a/Tools/Scripts/webkitpy/common/host.py
+++ b/Tools/Scripts/webkitpy/common/host.py
@@ -138,6 +138,11 @@ class Host(SystemHost):
     def checkout(self):
         return self._checkout
 
+    def buildbot_for_builder_name(self, name):
+        if self.port_factory.get_from_builder_name(name).is_chromium():
+            return self.chromium_buildbot()
+        return self.buildbot
+
     @memoized
     def chromium_buildbot(self):
         return ChromiumBuildBot()
diff --git a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
index 159b0077d..adb5a3d2c 100644
--- a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
+++ b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot.py
@@ -33,6 +33,7 @@ import urllib
 import urllib2
 
 import webkitpy.common.config.urls as config_urls
+from webkitpy.common.memoized import memoized
 from webkitpy.common.net.failuremap import FailureMap
 from webkitpy.common.net.layouttestresults import LayoutTestResults
 from webkitpy.common.net.networktransaction import NetworkTransaction
@@ -65,6 +66,31 @@ class Builder(object):
     def accumulated_results_url(self):
         return None
 
+    def latest_layout_test_results_url(self):
+        return self.accumulated_results_url() or self.latest_cached_build().results_url();
+
+    @memoized
+    def latest_layout_test_results(self):
+        return self.fetch_layout_test_results(self.latest_layout_test_results_url())
+
+    def _fetch_file_from_results(self, results_url, file_name):
+        # It seems this can return None if the url redirects and then returns 404.
+        result = urllib2.urlopen("%s/%s" % (results_url, file_name))
+        if not result:
+            return None
+        # urlopen returns a file-like object which sometimes works fine with str()
+        # but sometimes is a addinfourl object.  In either case calling read() is correct.
+        return result.read()
+
+    def fetch_layout_test_results(self, results_url):
+        # FIXME: This should cache that the result was a 404 and stop hitting the network.
+        results_file = NetworkTransaction(convert_404_to_None=True).run(lambda: self._fetch_file_from_results(results_url, "full_results.json"))
+        if not results_file:
+            results_file = NetworkTransaction(convert_404_to_None=True).run(lambda: self._fetch_file_from_results(results_url, "results.html"))
+
+        # results_from_string accepts either ORWT html or NRWT json.
+        return LayoutTestResults.results_from_string(results_file)
+
     def url_encoded_name(self):
         return urllib.quote(self._name)
 
@@ -120,6 +146,8 @@ class Builder(object):
     def _revision_and_build_for_filename(self, filename):
         # Example: "r47483 (1)/" or "r47483 (1).zip"
         match = self.file_name_regexp.match(filename)
+        if not match:
+            return None
         return (int(match.group("revision")), int(match.group("build_number")))
 
     def _fetch_revision_to_build_map(self):
@@ -135,10 +163,18 @@ class Builder(object):
         except urllib2.HTTPError, error:
             if error.code != 404:
                 raise
+            _log.debug("Revision/build list failed to load.")
             result_files = []
+        return dict(self._file_info_list_to_revision_to_build_list(result_files))
 
+    def _file_info_list_to_revision_to_build_list(self, file_info_list):
         # This assumes there was only one build per revision, which is false but we don't care for now.
-        return dict([self._revision_and_build_for_filename(file_info["filename"]) for file_info in result_files])
+        revisions_and_builds = []
+        for file_info in file_info_list:
+            revision_and_build = self._revision_and_build_for_filename(file_info["filename"])
+            if revision_and_build:
+                revisions_and_builds.append(revision_and_build)
+        return revisions_and_builds
 
     def _revision_to_build_map(self):
         if not self._revision_to_build_number:
@@ -219,7 +255,6 @@ class Build(object):
         self._number = build_number
         self._revision = revision
         self._is_green = is_green
-        self._layout_test_results = None
 
     @staticmethod
     def build_url(builder, build_number):
@@ -235,27 +270,9 @@ class Build(object):
     def results_zip_url(self):
         return "%s.zip" % self.results_url()
 
-    def _fetch_file_from_results(self, file_name):
-        # It seems this can return None if the url redirects and then returns 404.
-        result = urllib2.urlopen("%s/%s" % (self.results_url(), file_name))
-        if not result:
-            return None
-        # urlopen returns a file-like object which sometimes works fine with str()
-        # but sometimes is a addinfourl object.  In either case calling read() is correct.
-        return result.read()
-
+    @memoized
     def layout_test_results(self):
-        if self._layout_test_results:
-            return self._layout_test_results
-
-        # FIXME: This should cache that the result was a 404 and stop hitting the network.
-        results_file = NetworkTransaction(convert_404_to_None=True).run(lambda: self._fetch_file_from_results("full_results.json"))
-        if not results_file:
-            results_file = NetworkTransaction(convert_404_to_None=True).run(lambda: self._fetch_file_from_results("results.html"))
-
-        # results_from_string accepts either ORWT html or NRWT json.
-        self._layout_test_results = LayoutTestResults.results_from_string(results_file)
-        return self._layout_test_results
+        return self._builder.fetch_layout_test_results(self.results_url())
 
     def builder(self):
         return self._builder
diff --git a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_mock.py b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_mock.py
index 966fd5fc6..f8ec49b7b 100644
--- a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_mock.py
+++ b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_mock.py
@@ -27,6 +27,12 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
+class MockBuild(object):
+    def __init__(self, build_number, revision, is_green):
+        self._number = build_number
+        self._revision = revision
+        self._is_green = is_green
+
 class MockBuilder(object):
     def __init__(self, name):
         self._name = name
@@ -34,12 +40,18 @@ class MockBuilder(object):
     def name(self):
         return self._name
 
+    def build(self, build_number):
+        return MockBuild(build_number=build_number, revision=1234, is_green=False)
+
     def results_url(self):
         return "http://example.com/builders/%s/results" % self.name()
 
     def accumulated_results_url(self):
         return "http://example.com/f/builders/%s/results/layout-test-results" % self.name()
 
+    def latest_layout_test_results_url(self):
+        return self.accumulated_results_url()
+
     def force_build(self, username, comments):
         log("MOCK: force_build: name=%s, username=%s, comments=%s" % (
             self._name, username, comments))
diff --git a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py
index 355786ae0..69f864889 100644
--- a/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py
+++ b/Tools/Scripts/webkitpy/common/net/buildbot/buildbot_unittest.py
@@ -48,7 +48,10 @@ class BuilderTest(unittest.TestCase):
                 is_green=build_number < 4
             )
             results = [self._mock_test_result(testname) for testname in failure(build_number)]
-            build._layout_test_results = LayoutTestResults(results)
+            layout_test_results = LayoutTestResults(results)
+            def mock_layout_test_results():
+                return layout_test_results
+            build.layout_test_results = mock_layout_test_results
             return build
         self.builder._fetch_build = _mock_fetch_build
 
@@ -57,6 +60,11 @@ class BuilderTest(unittest.TestCase):
         self.builder = Builder(u"Test Builder \u2661", self.buildbot)
         self._install_fetch_build(lambda build_number: ["test1", "test2"])
 
+    def test_latest_layout_test_results(self):
+        self.builder.fetch_layout_test_results = lambda results_url: LayoutTestResults([self._mock_test_result(testname) for testname in ["test1", "test2"]])
+        self.builder.accumulated_results_url = lambda: "http://dummy_url.org"
+        self.assertTrue(self.builder.latest_layout_test_results())
+
     def test_find_regression_window(self):
         regression_window = self.builder.find_regression_window(self.builder.build(10))
         self.assertEqual(regression_window.build_before_failure().revision(), 1003)
@@ -112,10 +120,20 @@ class BuilderTest(unittest.TestCase):
         expectations = {
             "r47483 (1)/" : (47483, 1),
             "r47483 (1).zip" : (47483, 1),
+            "random junk": None,
         }
         for filename, revision_and_build in expectations.items():
             self.assertEqual(self.builder._revision_and_build_for_filename(filename), revision_and_build)
 
+    def test_file_info_list_to_revision_to_build_list(self):
+        file_info_list = [
+            {"filename": "r47483 (1)/"},
+            {"filename": "r47483 (1).zip"},
+            {"filename": "random junk"},
+        ]
+        builds_and_revisions_list = [(47483, 1), (47483, 1)]
+        self.assertEqual(self.builder._file_info_list_to_revision_to_build_list(file_info_list), builds_and_revisions_list)
+
     def test_fetch_build(self):
         buildbot = BuildBot()
         builder = Builder(u"Test Builder \u2661", buildbot)
@@ -137,8 +155,8 @@ class BuildTest(unittest.TestCase):
     def test_layout_test_results(self):
         buildbot = BuildBot()
         builder = Builder(u"Foo Builder (test)", buildbot)
+        builder._fetch_file_from_results = lambda results_url, file_name: None
         build = Build(builder, None, None, None)
-        build._fetch_file_from_results = lambda file_name: None
         # Test that layout_test_results() returns None if the fetch fails.
         self.assertEqual(build.layout_test_results(), None)
 
diff --git a/Tools/Scripts/webkitpy/common/system/executive_mock.py b/Tools/Scripts/webkitpy/common/system/executive_mock.py
index a15c3654d..cfe989968 100644
--- a/Tools/Scripts/webkitpy/common/system/executive_mock.py
+++ b/Tools/Scripts/webkitpy/common/system/executive_mock.py
@@ -88,7 +88,10 @@ class MockExecutive(object):
             env_string = ""
             if env:
                 env_string = ", env=%s" % env
-            log("MOCK run_command: %s, cwd=%s%s" % (args, cwd, env_string))
+            input_string = ""
+            if input:
+                input_string = ", input=%s" % input
+            log("MOCK run_command: %s, cwd=%s%s%s" % (args, cwd, env_string, input_string))
         output = "MOCK output of child process"
         if self._should_throw:
             raise ScriptError("MOCK ScriptError", output=output)
diff --git a/Tools/Scripts/webkitpy/common/system/user.py b/Tools/Scripts/webkitpy/common/system/user.py
index e20405912..262b97944 100644
--- a/Tools/Scripts/webkitpy/common/system/user.py
+++ b/Tools/Scripts/webkitpy/common/system/user.py
@@ -74,14 +74,20 @@ class User(object):
         return cls.prompt(message, repeat=repeat, raw_input=getpass.getpass)
 
     @classmethod
-    def prompt_with_list(cls, list_title, list_items, can_choose_multiple=False, raw_input=raw_input):
+    def prompt_with_multiple_lists(cls, list_title, subtitles, lists, can_choose_multiple=False, raw_input=raw_input):
+        item_index = 0
+        cumulated_list = []
         print list_title
-        i = 0
-        for item in list_items:
-            i += 1
-            print "%2d. %s" % (i, item)
+        for i in range(len(subtitles)):
+            print "\n" + subtitles[i]
+            for item in lists[i]:
+                item_index += 1
+                print "%2d. %s" % (item_index, item)
+            cumulated_list += lists[i]
+        return cls._wait_on_list_response(cumulated_list, can_choose_multiple, raw_input)
 
-        # Loop until we get valid input
+    @classmethod
+    def _wait_on_list_response(cls, list_items, can_choose_multiple, raw_input):
         while True:
             if can_choose_multiple:
                 response = cls.prompt("Enter one or more numbers (comma-separated), or \"all\": ", raw_input=raw_input)
@@ -99,6 +105,15 @@ class User(object):
                     continue
                 return list_items[result]
 
+    @classmethod
+    def prompt_with_list(cls, list_title, list_items, can_choose_multiple=False, raw_input=raw_input):
+        print list_title
+        i = 0
+        for item in list_items:
+            i += 1
+            print "%2d. %s" % (i, item)
+        return cls._wait_on_list_response(list_items, can_choose_multiple, raw_input)
+
     def edit(self, files):
         editor = os.environ.get("EDITOR") or "vi"
         args = shlex.split(editor)
diff --git a/Tools/Scripts/webkitpy/common/system/user_unittest.py b/Tools/Scripts/webkitpy/common/system/user_unittest.py
index 7ec9b34e4..8b7cc1c0c 100644
--- a/Tools/Scripts/webkitpy/common/system/user_unittest.py
+++ b/Tools/Scripts/webkitpy/common/system/user_unittest.py
@@ -51,6 +51,32 @@ class UserTest(unittest.TestCase):
             return None
         self.assertEqual(User.prompt("input", repeat=self.repeatsRemaining, raw_input=mock_raw_input), None)
 
+    def test_prompt_with_multiple_lists(self):
+        def run_prompt_test(inputs, expected_result, can_choose_multiple=False):
+            def mock_raw_input(message):
+                return inputs.pop(0)
+            output_capture = OutputCapture()
+            actual_result = output_capture.assert_outputs(
+                self,
+                User.prompt_with_multiple_lists,
+                args=["title", ["subtitle1", "subtitle2"], [["foo", "bar"], ["foobar", "barbaz"]]],
+                kwargs={"can_choose_multiple": can_choose_multiple, "raw_input": mock_raw_input},
+                expected_stdout="title\n\nsubtitle1\n 1. foo\n 2. bar\n\nsubtitle2\n 3. foobar\n 4. barbaz\n")
+            self.assertEqual(actual_result, expected_result)
+            self.assertEqual(len(inputs), 0)
+
+        run_prompt_test(["1"], "foo")
+        run_prompt_test(["badinput", "2"], "bar")
+        run_prompt_test(["3"], "foobar")
+        run_prompt_test(["4"], "barbaz")
+
+        run_prompt_test(["1,2"], ["foo", "bar"], can_choose_multiple=True)
+        run_prompt_test(["  1,  2   "], ["foo", "bar"], can_choose_multiple=True)
+        run_prompt_test(["all"], ["foo", "bar", 'foobar', 'barbaz'], can_choose_multiple=True)
+        run_prompt_test([""], ["foo", "bar", 'foobar', 'barbaz'], can_choose_multiple=True)
+        run_prompt_test(["  "], ["foo", "bar", 'foobar', 'barbaz'], can_choose_multiple=True)
+        run_prompt_test(["badinput", "all"], ["foo", "bar", 'foobar', 'barbaz'], can_choose_multiple=True)
+
     def test_prompt_with_list(self):
         def run_prompt_test(inputs, expected_result, can_choose_multiple=False):
             def mock_raw_input(message):
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
index a63c1efb8..f2fed3f4a 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager.py
@@ -266,9 +266,7 @@ class TestRunInterruptedException(Exception):
         return self.__class__, (self.reason,)
 
 
-class WorkerException(Exception):
-    """Raised when we receive an unexpected/unknown exception from a worker."""
-    pass
+WorkerException = manager_worker_broker.WorkerException
 
 
 class TestShard(object):
@@ -771,25 +769,17 @@ class Manager(object):
         num_workers = min(num_workers, len(all_shards))
         self._log_num_workers(num_workers, len(all_shards), len(locked_shards))
 
-        manager_connection = manager_worker_broker.get(num_workers, self, worker.Worker)
+        def worker_factory(worker_connection, worker_number):
+            return worker.Worker(worker_connection, worker_number, self.results_directory(), self._options)
+
+        manager_connection = manager_worker_broker.get(num_workers, self, worker_factory, self._port.host)
 
         if self._options.dry_run:
             return (keyboard_interrupted, interrupted, thread_timings, self._group_stats, self._all_results)
 
         self._printer.print_update('Starting %s ...' % grammar.pluralize('worker', num_workers))
         for worker_number in xrange(num_workers):
-            worker_arguments = worker.WorkerArguments(worker_number, self.results_directory(), self._options)
-            worker_connection = manager_connection.start_worker(worker_arguments)
-            if num_workers == 1:
-                # FIXME: We need to be able to share a port with the work so
-                # that some of the tests can query state on the port; ideally
-                # we'd rewrite the tests so that this wasn't necessary.
-                #
-                # Note that this only works because in the inline case
-                # the worker hasn't really started yet and won't start
-                # running until we call run_message_loop(), below.
-                worker_connection.set_inline_arguments(self._port)
-
+            worker_connection = manager_connection.start_worker(worker_number)
             worker_state = _WorkerState(worker_number, worker_connection)
             self._worker_states[worker_connection.name()] = worker_state
 
@@ -1515,7 +1505,7 @@ class Manager(object):
 
     def _log_messages(self, messages):
         for message in messages:
-            self._printer.writeln(*message)
+            logging.root.handle(message)
 
     def _log_worker_stack(self, stack):
         webkitpydir = self._port.path_from_webkit_base('Tools', 'Scripts', 'webkitpy') + self._filesystem.sep
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py
index 7047d939c..f7baced0a 100755
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker.py
@@ -69,12 +69,15 @@ import cPickle
 import logging
 import multiprocessing
 import optparse
+import os
 import Queue
 import sys
 import traceback
 
 
+from webkitpy.common.host import Host
 from webkitpy.common.system import stack_utils
+from webkitpy.layout_tests.views import metered_stream
 
 
 _log = logging.getLogger(__name__)
@@ -87,15 +90,15 @@ MANAGER_TOPIC = 'managers'
 ANY_WORKER_TOPIC = 'workers'
 
 
-def get(max_workers, client, worker_class):
+def get(max_workers, client, worker_factory, host=None):
     """Return a connection to a manager/worker message_broker
 
     Args:
         max_workers - max # of workers to run concurrently.
         client - BrokerClient implementation to dispatch
             replies to.
-        worker_class - type of workers to create. This class should override
-            the methods in AbstractWorker.
+        worker_factory: factory method for creating objects that implement the Worker interface.
+        host: optional picklable host object that can be passed to workers for testing.
     Returns:
         A handle to an object that will talk to a message broker configured
         for the normal manager/worker communication."""
@@ -107,7 +110,12 @@ def get(max_workers, client, worker_class):
         manager_class = _MultiProcessManager
 
     broker = _Broker(queue_class)
-    return manager_class(broker, client, worker_class)
+    return manager_class(broker, client, worker_factory, host)
+
+
+class WorkerException(Exception):
+    """Raised when we receive an unexpected/unknown exception from a worker."""
+    pass
 
 
 class BrokerClient(object):
@@ -247,30 +255,25 @@ class _BrokerConnection(object):
                                   message_name, *message_args)
 
     def raise_exception(self, exc_info):
-        # Since tracebacks aren't picklable, send the extracted stack instead.
+        # Since tracebacks aren't picklable, send the extracted stack instead,
+        # but at least log the full traceback.
         exception_type, exception_value, exception_traceback = sys.exc_info()
-        stack_utils.log_traceback(_log.debug, exception_traceback)
+        stack_utils.log_traceback(_log.error, exception_traceback)
         stack = traceback.extract_tb(exception_traceback)
         self._broker.post_message(self._client, self._post_topic, 'exception', exception_type, exception_value, stack)
 
 
 class AbstractWorker(BrokerClient):
-    def __init__(self, worker_connection, worker_arguments=None):
-        """The constructor should be used to do any simple initialization
-        necessary, but should not do anything that creates data structures
-        that cannot be Pickled or sent across processes (like opening
-        files or sockets). Complex initialization should be done at the
-        start of the run() call.
-
-        Args:
-            worker_connection - handle to the _BrokerConnection object creating
-                the worker and that can be used for messaging.
-            worker_arguments - (optional, Picklable) object passed to the worker from the manager"""
+    def __init__(self, worker_connection, worker_number):
         BrokerClient.__init__(self)
+        self.worker = None
         self._worker_connection = worker_connection
-        self._name = 'worker'
+        self._worker_number = worker_number
+        self._name = 'worker/%d' % worker_number
         self._done = False
         self._canceled = False
+        self._options = optparse.Values({'verbose': False})
+        self.host = None
 
     def name(self):
         return self._name
@@ -281,10 +284,14 @@ class AbstractWorker(BrokerClient):
     def stop_handling_messages(self):
         self._done = True
 
-    def run(self):
+    def run(self, host):
         """Callback for the worker to start executing. Typically does any
         remaining initialization and then calls broker_connection.run_message_loop()."""
         exception_msg = ""
+        self.host = host
+
+        self.worker.safe_init()
+        _log.debug('%s starting' % self._name)
 
         try:
             self._worker_connection.run_message_loop()
@@ -299,6 +306,18 @@ class AbstractWorker(BrokerClient):
             self._worker_connection.raise_exception(sys.exc_info())
         finally:
             _log.debug("%s done with message loop%s" % (self._name, exception_msg))
+            try:
+                self.worker.cleanup()
+            finally:
+                # Make sure we post a done so that we can flush the log messages
+                # and clean up properly even if we raise an exception in worker.cleanup().
+                self._worker_connection.post_message('done')
+
+    def handle_stop(self, source):
+        self._done = True
+
+    def handle_test_list(self, source, list_name, test_list):
+        self.worker.handle('test_list', source, list_name, test_list)
 
     def cancel(self):
         """Called when possible to indicate to the worker to stop processing
@@ -306,44 +325,33 @@ class AbstractWorker(BrokerClient):
         method being called, so clients should not rely solely on this."""
         self._canceled = True
 
+    def yield_to_broker(self):
+        self._worker_connection.yield_to_broker()
 
-class _ManagerConnection(_BrokerConnection):
-    def __init__(self, broker, client, worker_class):
-        """Base initialization for all Manager objects.
+    def post_message(self, *args):
+        self._worker_connection.post_message(*args)
 
-        Args:
-            broker: handle to the message_broker object
-            client: callback object (the caller)
-            worker_class: class object to use to create workers.
-        """
-        _BrokerConnection.__init__(self, broker, client, MANAGER_TOPIC, ANY_WORKER_TOPIC)
-        self._worker_class = worker_class
 
-    def start_worker(self, worker_arguments=None):
-        """Starts a new worker.
+class _ManagerConnection(_BrokerConnection):
+    def __init__(self, broker, client, worker_factory, host):
+        _BrokerConnection.__init__(self, broker, client, MANAGER_TOPIC, ANY_WORKER_TOPIC)
+        self._worker_factory = worker_factory
+        self._host = host
 
-        Args:
-            worker_arguments - an optional Picklable object that is passed to the worker constructor
-        """
+    def start_worker(self, worker_number):
         raise NotImplementedError
 
 
 class _InlineManager(_ManagerConnection):
-    def __init__(self, broker, client, worker_class):
-        _ManagerConnection.__init__(self, broker, client, worker_class)
+    def __init__(self, broker, client, worker_factory, host):
+        _ManagerConnection.__init__(self, broker, client, worker_factory, host)
         self._inline_worker = None
 
-    def start_worker(self, worker_arguments=None):
-        self._inline_worker = _InlineWorkerConnection(self._broker,
-            self._client, self._worker_class, worker_arguments)
+    def start_worker(self, worker_number):
+        host = self._host
+        self._inline_worker = _InlineWorkerConnection(host, self._broker, self._client, self._worker_factory, worker_number)
         return self._inline_worker
 
-    def set_inline_arguments(self, arguments=None):
-        # Note that this method only exists here, and not on all
-        # ManagerConnections; calling this method on a MultiProcessManager
-        # will deliberately result in a runtime error.
-        self._inline_worker.set_inline_arguments(arguments)
-
     def run_message_loop(self, delay_secs=None):
         # Note that delay_secs is ignored in this case since we can't easily
         # implement it.
@@ -352,16 +360,34 @@ class _InlineManager(_ManagerConnection):
 
 
 class _MultiProcessManager(_ManagerConnection):
-    def start_worker(self, worker_arguments=None):
-        worker_connection = _MultiProcessWorkerConnection(self._broker,
-            self._worker_class, worker_arguments)
+    def _can_pickle_host(self):
+        try:
+            cPickle.dumps(self._host)
+            return True
+        except TypeError:
+            return False
+
+    def start_worker(self, worker_number):
+        host = None
+        if self._can_pickle_host():
+            host = self._host
+        worker_connection = _MultiProcessWorkerConnection(host, self._broker, self._worker_factory, worker_number)
         worker_connection.start()
         return worker_connection
 
 
 class _WorkerConnection(_BrokerConnection):
-    def __init__(self, broker, worker_class, worker_arguments=None):
-        self._client = worker_class(self, worker_arguments)
+    def __init__(self, host, broker, worker_factory, worker_number):
+        # FIXME: keeping track of the differences between the WorkerConnection, the AbstractWorker, and the
+        # actual Worker (created by worker_factory) is very confusing, but this all gets better when
+        # _WorkerConnection and AbstractWorker get merged.
+        self._client = AbstractWorker(self, worker_number)
+        self._worker = worker_factory(self._client, worker_number)
+        self._client.worker = self._worker
+        self._host = host
+        self._log_messages = []
+        self._logger = None
+        self._log_handler = None
         _BrokerConnection.__init__(self, broker, self._client, ANY_WORKER_TOPIC, MANAGER_TOPIC)
 
     def name(self):
@@ -379,10 +405,37 @@ class _WorkerConnection(_BrokerConnection):
     def yield_to_broker(self):
         pass
 
+    def post_message(self, *args):
+        # FIXME: This is a hack until we can remove the log_messages arg from the manager.
+        if args[0] in ('finished_test', 'done'):
+            log_messages = self._log_messages
+            self._log_messages = []
+            args = args + tuple([log_messages])
+        super(_WorkerConnection, self).post_message(*args)
+
+    def set_up_logging(self):
+        self._logger = logging.root
+        # The unix multiprocessing implementation clones the MeteredStream log handler
+        # into the child process, so we need to remove it to avoid duplicate logging.
+        for h in self._logger.handlers:
+            # log handlers don't have names until python 2.7.
+            if getattr(h, 'name', '') == metered_stream.LOG_HANDLER_NAME:
+                self._logger.removeHandler(h)
+                break
+        self._logger.setLevel(logging.DEBUG if self._client._options.verbose else logging.INFO)
+        self._log_handler = _WorkerLogHandler(self)
+        self._logger.addHandler(self._log_handler)
+
+    def clean_up_logging(self):
+        if self._log_handler and self._logger:
+            self._logger.removeHandler(self._log_handler)
+        self._log_handler = None
+        self._logger = None
+
 
 class _InlineWorkerConnection(_WorkerConnection):
-    def __init__(self, broker, manager_client, worker_class, worker_arguments):
-        _WorkerConnection.__init__(self, broker, worker_class, worker_arguments)
+    def __init__(self, host, broker, manager_client, worker_factory, worker_number):
+        _WorkerConnection.__init__(self, host, broker, worker_factory, worker_number)
         self._alive = False
         self._manager_client = manager_client
 
@@ -395,13 +448,10 @@ class _InlineWorkerConnection(_WorkerConnection):
     def join(self, timeout):
         assert not self._alive
 
-    def set_inline_arguments(self, arguments):
-        self._client.set_inline_arguments(arguments)
-
     def run(self):
         self._alive = True
         try:
-            self._client.run()
+            self._client.run(self._host)
         finally:
             self._alive = False
 
@@ -411,8 +461,11 @@ class _InlineWorkerConnection(_WorkerConnection):
     def raise_exception(self, exc_info):
         # Since the worker is in the same process as the manager, we can
         # raise the exception directly, rather than having to send it through
-        # the queue. This allows us to preserve the traceback.
-        raise exc_info[0], exc_info[1], exc_info[2]
+        # the queue. This allows us to preserve the traceback, but we log
+        # it anyway for consistency with the multiprocess case.
+        exception_type, exception_value, exception_traceback = sys.exc_info()
+        stack_utils.log_traceback(_log.error, exception_traceback)
+        raise exception_type, exception_value, exception_traceback
 
 
 class _Process(multiprocessing.Process):
@@ -422,12 +475,14 @@ class _Process(multiprocessing.Process):
         self._client = client
 
     def run(self):
-        self._client.run()
+        if not self._worker_connection._host:
+            self._worker_connection._host = Host()
+        self._worker_connection.run()
 
 
 class _MultiProcessWorkerConnection(_WorkerConnection):
-    def __init__(self, broker, worker_class, worker_arguments):
-        _WorkerConnection.__init__(self, broker, worker_class, worker_arguments)
+    def __init__(self, host, broker, worker_factory, worker_number):
+        _WorkerConnection.__init__(self, host, broker, worker_factory, worker_number)
         self._proc = _Process(self, self._client)
 
     def cancel(self):
@@ -441,3 +496,20 @@ class _MultiProcessWorkerConnection(_WorkerConnection):
 
     def start(self):
         self._proc.start()
+
+    def run(self):
+        self.set_up_logging()
+        try:
+            self._client.run(self._host)
+        finally:
+            self.clean_up_logging()
+
+
+class _WorkerLogHandler(logging.Handler):
+    def __init__(self, worker):
+        logging.Handler.__init__(self)
+        self._worker = worker
+        self._pid = os.getpid()
+
+    def emit(self, record):
+        self._worker._log_messages.append(record)
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py
index 046425664..d7c3714d8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/manager_worker_broker_unittest.py
@@ -44,8 +44,7 @@ starting_queue = None
 stopping_queue = None
 
 
-WORKER_NAME = 'TestWorker'
-
+WORKER_NAME = 'worker/1'
 
 def make_broker(manager, max_workers, start_queue=None, stop_queue=None):
     global starting_queue
@@ -55,35 +54,34 @@ def make_broker(manager, max_workers, start_queue=None, stop_queue=None):
     return manager_worker_broker.get(max_workers, manager, _TestWorker)
 
 
-class _TestWorker(manager_worker_broker.AbstractWorker):
-    def __init__(self, worker_connection, worker_arguments=None):
-        super(_TestWorker, self).__init__(worker_connection)
-        self._name = WORKER_NAME
+class _TestWorker(object):
+    def __init__(self, caller, worker_number):
+        self._caller = caller
         self._thing_to_greet = 'everybody'
         self._starting_queue = starting_queue
         self._stopping_queue = stopping_queue
+        self._options = optparse.Values({'verbose': False})
 
-    def set_inline_arguments(self, thing_to_greet):
-        self._thing_to_greet = thing_to_greet
+    def name(self):
+        return WORKER_NAME
 
-    def handle_stop(self, src):
-        self.stop_handling_messages()
+    def cleanup(self):
+        pass
 
-    def handle_test(self, src, an_int, a_str):
+    def handle(self, message, src, an_int, a_str):
         assert an_int == 1
         assert a_str == "hello, world"
-        self._worker_connection.post_message('test', 2, 'hi, ' + self._thing_to_greet)
+        self._caller.post_message('finished_test', 2)
 
-    def run(self):
+    def safe_init(self):
         if self._starting_queue:
             self._starting_queue.put('')
 
         if self._stopping_queue:
             self._stopping_queue.get()
-        try:
-            super(_TestWorker, self).run()
-        finally:
-            self._worker_connection.post_message('done')
+
+    def stop(self):
+        self._caller.post_message('done')
 
 
 class FunctionTests(unittest.TestCase):
@@ -107,19 +105,17 @@ class _TestsMixin(object):
     def is_done(self):
         return self._done
 
-    def handle_done(self, src):
+    def handle_done(self, src, log_messages):
         self._done = True
 
-    def handle_test(self, src, an_int, a_str):
+    def handle_finished_test(self, src, an_int, log_messages):
         self._an_int = an_int
-        self._a_str = a_str
 
     def handle_exception(self, src, exception_type, exception_value, stack):
         raise exception_type(exception_value)
 
     def setUp(self):
         self._an_int = None
-        self._a_str = None
         self._broker = None
         self._done = False
         self._exception = None
@@ -131,7 +127,7 @@ class _TestsMixin(object):
 
     def test_name(self):
         self.make_broker()
-        worker = self._broker.start_worker()
+        worker = self._broker.start_worker(1)
         self.assertEquals(worker.name(), WORKER_NAME)
         worker.cancel()
         worker.join(0.1)
@@ -140,8 +136,8 @@ class _TestsMixin(object):
 
     def test_cancel(self):
         self.make_broker()
-        worker = self._broker.start_worker()
-        self._broker.post_message('test', 1, 'hello, world')
+        worker = self._broker.start_worker(1)
+        self._broker.post_message('test_list', 1, 'hello, world')
         worker.cancel()
         worker.join(0.1)
         self.assertFalse(worker.is_alive())
@@ -149,20 +145,19 @@ class _TestsMixin(object):
 
     def test_done(self):
         self.make_broker()
-        worker = self._broker.start_worker()
-        self._broker.post_message('test', 1, 'hello, world')
+        worker = self._broker.start_worker(1)
+        self._broker.post_message('test_list', 1, 'hello, world')
         self._broker.post_message('stop')
         self._broker.run_message_loop()
         worker.join(0.5)
         self.assertFalse(worker.is_alive())
         self.assertTrue(self.is_done())
         self.assertEqual(self._an_int, 2)
-        self.assertEqual(self._a_str, 'hi, everybody')
         self._broker.cleanup()
 
     def test_unknown_message(self):
         self.make_broker()
-        worker = self._broker.start_worker()
+        worker = self._broker.start_worker(1)
         self._broker.post_message('unknown')
         try:
             self._broker.run_message_loop()
@@ -181,15 +176,6 @@ class InlineBrokerTests(_TestsMixin, unittest.TestCase):
         _TestsMixin.setUp(self)
         self._max_workers = 1
 
-    def test_inline_arguments(self):
-        self.make_broker()
-        worker = self._broker.start_worker()
-        worker.set_inline_arguments('me')
-        self._broker.post_message('test', 1, 'hello, world')
-        self._broker.post_message('stop')
-        self._broker.run_message_loop()
-        self.assertEquals(self._a_str, 'hi, me')
-
 
 # FIXME: https://bugs.webkit.org/show_bug.cgi?id=54520.
 if sys.platform not in ('cygwin', 'win32'):
@@ -200,35 +186,6 @@ if sys.platform not in ('cygwin', 'win32'):
             self._max_workers = 2
 
 
-class InterfaceTest(unittest.TestCase):
-    # These tests mostly exist to pacify coverage.
-
-    # FIXME: There must be a better way to do this and also verify
-    # that classes do implement every abstract method in an interface.
-    def test_brokerclient_is_abstract(self):
-        # Test that all the base class methods are abstract and have the
-        # signature we expect.
-        obj = manager_worker_broker.BrokerClient()
-        self.assertRaises(NotImplementedError, obj.is_done)
-        self.assertRaises(NotImplementedError, obj.name)
-
-    def test_managerconnection_is_abstract(self):
-        # Test that all the base class methods are abstract and have the
-        # signature we expect.
-        broker = make_broker(self, 1)
-        obj = manager_worker_broker._ManagerConnection(broker._broker, self, None)
-        self.assertRaises(NotImplementedError, obj.start_worker)
-
-    def test_workerconnection_is_abstract(self):
-        # Test that all the base class methods are abstract and have the
-        # signature we expect.
-        broker = make_broker(self, 1)
-        obj = manager_worker_broker._WorkerConnection(broker._broker, _TestWorker, None)
-        self.assertRaises(NotImplementedError, obj.cancel)
-        self.assertRaises(NotImplementedError, obj.is_alive)
-        self.assertRaises(NotImplementedError, obj.join, None)
-
-
 class MessageTest(unittest.TestCase):
     def test__no_body(self):
         msg = manager_worker_broker._Message('src', 'topic_name', 'message_name', None)
diff --git a/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py b/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
index d321b5a41..c68915916 100644
--- a/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
+++ b/Tools/Scripts/webkitpy/layout_tests/controllers/worker.py
@@ -29,36 +29,27 @@
 """Handle messages from the Manager and executes actual tests."""
 
 import logging
-import os
-import sys
 import threading
 import time
 
-from webkitpy.common.host import Host
-from webkitpy.layout_tests.controllers import manager_worker_broker
 from webkitpy.layout_tests.controllers import single_test_runner
 from webkitpy.layout_tests.models import test_expectations
 from webkitpy.layout_tests.models import test_results
-from webkitpy.layout_tests.views import metered_stream
 
 
 _log = logging.getLogger(__name__)
 
 
-class WorkerArguments(object):
-    def __init__(self, worker_number, results_directory, options):
-        self.worker_number = worker_number
-        self.results_directory = results_directory
-        self.options = options
+class Worker(object):
+    def __init__(self, worker_connection, worker_number, results_directory, options):
+        self._worker_connection = worker_connection
+        self._worker_number = worker_number
+        self._name = 'worker/%d' % worker_number
+        self._results_directory = results_directory
+        self._options = options
 
-
-class Worker(manager_worker_broker.AbstractWorker):
-    def __init__(self, worker_connection, worker_arguments):
-        super(Worker, self).__init__(worker_connection, worker_arguments)
-        self._worker_number = worker_arguments.worker_number
-        self._name = 'worker/%d' % self._worker_number
-        self._results_directory = worker_arguments.results_directory
-        self._options = worker_arguments.options
+        # The remaining fields are initialized in safe_init()
+        self._host = None
         self._port = None
         self._batch_size = None
         self._batch_count = None
@@ -66,70 +57,24 @@ class Worker(manager_worker_broker.AbstractWorker):
         self._driver = None
         self._tests_run_file = None
         self._tests_run_filename = None
-        self._log_messages = []
-        self._logger = None
-        self._log_handler = None
 
     def __del__(self):
         self.cleanup()
 
     def safe_init(self):
-        """This method should only be called when it is is safe for the mixin
-        to create state that can't be Pickled.
+        """This method is called when it is safe for the object to create state that
+        does not need to be pickled (usually this means it is called in a child process)."""
+        self._host = self._worker_connection.host
+        self._filesystem = self._host.filesystem
+        self._port = self._host.port_factory.get(self._options.platform, self._options)
 
-        This routine exists so that the mixin can be created and then marshaled
-        across into a child process."""
-        self._filesystem = self._port.host.filesystem
         self._batch_count = 0
         self._batch_size = self._options.batch_size or 0
         tests_run_filename = self._filesystem.join(self._results_directory, "tests_run%d.txt" % self._worker_number)
         self._tests_run_file = self._filesystem.open_text_file_for_writing(tests_run_filename)
 
-    def _set_up_logging(self):
-        self._logger = logging.getLogger()
-
-        # The unix multiprocessing implementation clones the MeteredStream log handler
-        # into the child process, so we need to remove it to avoid duplicate logging.
-        for h in self._logger.handlers:
-            # log handlers don't have names until python 2.7.
-            if getattr(h, 'name', '') == metered_stream.LOG_HANDLER_NAME:
-                self._logger.removeHandler(h)
-                break
-
-        self._logger.setLevel(logging.DEBUG if self._options.verbose else logging.INFO)
-        self._log_handler = _WorkerLogHandler(self)
-        self._logger.addHandler(self._log_handler)
-
-    def _set_up_host_and_port(self):
-        options = self._options
-        if options.platform and 'test' in options.platform:
-            # It is lame to import mocks into real code, but this allows us to use the test port in multi-process tests as well.
-            from webkitpy.common.host_mock import MockHost
-            host = MockHost()
-        else:
-            host = Host()
-        self._port = host.port_factory.get(options.platform, options)
-
-    def set_inline_arguments(self, port):
-        self._port = port
-
-    def run(self):
-        if not self._port:
-            # We are running in a child process and need to initialize things.
-            self._set_up_logging()
-            self._set_up_host_and_port()
-
-        self.safe_init()
-        try:
-            _log.debug("%s starting" % self._name)
-            super(Worker, self).run()
-        finally:
-            self.kill_driver()
-            _log.debug("%s exiting" % self._name)
-            self.cleanup()
-            self._worker_connection.post_message('done', self._log_messages)
-
-    def handle_test_list(self, src, list_name, test_list):
+    def handle(self, name, source, list_name, test_list):
+        assert name == 'test_list'
         start_time = time.time()
         num_tests = 0
         for test_input in test_list:
@@ -141,9 +86,6 @@ class Worker(manager_worker_broker.AbstractWorker):
         elapsed_time = time.time() - start_time
         self._worker_connection.post_message('finished_list', list_name, num_tests, elapsed_time)
 
-    def handle_stop(self, src):
-        self.stop_handling_messages()
-
     def _update_test_input(self, test_input):
         test_input.reference_files = self._port.reference_files(test_input.test_name)
         if test_input.reference_files:
@@ -164,9 +106,7 @@ class Worker(manager_worker_broker.AbstractWorker):
         result = self.run_test_with_timeout(test_input, test_timeout_sec)
 
         elapsed_time = time.time() - start
-        log_messages = self._log_messages
-        self._log_messages = []
-        self._worker_connection.post_message('finished_test', result, elapsed_time, log_messages)
+        self._worker_connection.post_message('finished_test', result, elapsed_time)
 
         self.clean_up_after_test(test_input, result)
 
@@ -176,10 +116,6 @@ class Worker(manager_worker_broker.AbstractWorker):
         if self._tests_run_file:
             self._tests_run_file.close()
             self._tests_run_file = None
-        if self._log_handler and self._logger:
-            self._logger.removeHandler(self._log_handler)
-        self._log_handler = None
-        self._logger = None
 
     def timeout(self, test_input):
         """Compute the appropriate timeout value for a test."""
@@ -198,10 +134,13 @@ class Worker(manager_worker_broker.AbstractWorker):
         return thread_timeout_sec
 
     def kill_driver(self):
-        if self._driver:
+        # Be careful about how and when we kill the driver; if driver.stop()
+        # raises an exception, this routine may get re-entered via __del__.
+        driver = self._driver
+        self._driver = None
+        if driver:
             _log.debug("%s killing driver" % self._name)
-            self._driver.stop()
-            self._driver = None
+            driver.stop()
 
     def run_test_with_timeout(self, test_input, timeout):
         if self._options.run_singly:
@@ -296,13 +235,3 @@ class Worker(manager_worker_broker.AbstractWorker):
     def run_single_test(self, driver, test_input):
         return single_test_runner.run_single_test(self._port, self._options,
             test_input, driver, self._name)
-
-
-class _WorkerLogHandler(logging.Handler):
-    def __init__(self, worker):
-        logging.Handler.__init__(self)
-        self._worker = worker
-        self._pid = os.getpid()
-
-    def emit(self, record):
-        self._worker._log_messages.append(tuple([record.getMessage(), record.created, self._pid]))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/apple.py b/Tools/Scripts/webkitpy/layout_tests/port/apple.py
index 8807d40d7..5e8b8b829 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/apple.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/apple.py
@@ -51,11 +51,16 @@ class ApplePort(WebKitPort):
 
     @classmethod
     def determine_full_port_name(cls, host, options, port_name):
+        # If the port_name matches the (badly named) cls.port_name, that
+        # means that they passed 'mac' or 'win' and didn't specify a version.
+        # That convention means that we're supposed to use the version currently
+        # being run, so this won't work if you're not on mac or win (respectively).
+        # If you're not on the o/s in question, you must specify a full version or -future (cf. above).
         if port_name == cls.port_name:
             assert port_name == host.platform.os_name
             return cls.port_name + '-' + host.platform.os_version
         if port_name == cls.port_name + '-wk2':
-            assert port_name == host.platform.os_name
+            assert port_name == host.platform.os_name + '-wk2'
             return cls.port_name + '-' + host.platform.os_version + '-wk2'
         return port_name
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/base.py b/Tools/Scripts/webkitpy/layout_tests/port/base.py
index 0fa7e3f3f..fbf0b930b 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/base.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/base.py
@@ -136,8 +136,12 @@ class Port(object):
         self._reftest_list = {}
         self._results_directory = None
 
-    def default_test_timeout_ms(self):
-        return 6 * 1000
+    def default_pixel_tests(self):
+        # FIXME: Disable until they are run by default on build.webkit.org.
+        return False
+
+    def default_timeout_ms(self):
+        return 35 * 1000
 
     def wdiff_available(self):
         if self._wdiff_available is None:
@@ -650,6 +654,9 @@ class Port(object):
                 return True
         return False
 
+    def is_chromium(self):
+        return False
+
     def name(self):
         """Returns a name that uniquely identifies this particular type of port
         (e.g., "mac-snowleopard" or "chromium-linux-x86_x64" and can be passed
@@ -693,7 +700,7 @@ class Port(object):
 
         # test_expectations are always in mac/ not mac-leopard/ by convention, hence we use port_name instead of name().
         port_name = self.port_name
-        if port_name.startswith('chromium') or port_name.startswith('google-chrome'):
+        if port_name.startswith('chromium'):
             port_name = 'chromium'
 
         return self._filesystem.join(self._webkit_baseline_path(port_name), 'TestExpectations')
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/builders.py b/Tools/Scripts/webkitpy/layout_tests/port/builders.py
index 3ad45be17..21fcc9801 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/builders.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/builders.py
@@ -44,25 +44,31 @@ _exact_matches = {
     "Webkit Linux": {"port_name": "chromium-linux-x86_64", "specifiers": set(["linux", "x86_64", "release"])},
     "Webkit Linux 32": {"port_name": "chromium-linux-x86", "specifiers": set(["linux", "x86"])},
     "Webkit Linux (dbg)": {"port_name": "chromium-linux-x86_64", "specifiers": set(["linux", "debug"])},
-    "Webkit Mac10.5": {"port_name": "chromium-mac-leopard", "specifiers": set(["leopard"])},
-    "Webkit Mac10.5 (dbg)(1)": {"port_name": "chromium-mac-leopard", "specifiers": set(["leopard", "debug"])},
-    "Webkit Mac10.5 (dbg)(2)": {"port_name": "chromium-mac-leopard", "specifiers": set(["leopard", "debug"])},
     "Webkit Mac10.6": {"port_name": "chromium-mac-snowleopard", "specifiers": set(["snowleopard"])},
     "Webkit Mac10.6 (dbg)": {"port_name": "chromium-mac-snowleopard", "specifiers": set(["snowleopard", "debug"])},
     "Webkit Mac10.7": {"port_name": "chromium-mac-lion", "specifiers": set(["lion"])},
 
     # These builders are on build.webkit.org.
-    "Apple Lion Release WK1 (Tests)": {"port_name": "mac-lion", "specifiers": set(["lion"])},
-    "Apple Lion Debug WK1 (Tests)": {"port_name": "mac-lion", "specifiers": set(["lion", "debug"])},
+    # FIXME: Remove rebaseline_override_dir once there is an Apple buildbot that corresponds to platform/mac (i.e. a Mountain Lion bot).
+    "Apple Lion Release WK1 (Tests)": {"port_name": "mac-lion", "specifiers": set(["lion"]), "rebaseline_override_dir": "mac"},
+    "Apple Lion Debug WK1 (Tests)": {"port_name": "mac-lion", "specifiers": set(["lion", "debug"]), "rebaseline_override_dir": "mac"},
     "Apple Lion Release WK2 (Tests)": {"port_name": "mac-lion", "specifiers": set(["lion", "wk2"])},
     "Apple Lion Debug WK2 (Tests)": {"port_name": "mac-lion", "specifiers": set(["lion", "wk2", "debug"])},
 
     "Apple Win XP Debug (Tests)": {"port_name": "win-xp", "specifiers": set(["win", "debug"])},
-    "Apple Win 7 Release (Tests)": {"port_name": "win-xp", "specifiers": set(["win"])},
+    # FIXME: Remove rebaseline_override_dir once there is an Apple buildbot that corresponds to platform/win.
+    "Apple Win 7 Release (Tests)": {"port_name": "win-7sp0", "specifiers": set(["win"]), "rebaseline_override_dir": "win"},
 
-    "GTK Linux 32-bit Debug": {"port_name": "gtk", "specifiers": set(["gtk"])},
-    "Qt Linux Release": {"port_name": "qt-linux", "specifiers": set(["win", "linux", "mac"])},
-    "EFL Linux Release": {"port_name": "efl", "specifiers": set(["efl"])},
+    "GTK Linux 32-bit Release": {"port_name": "gtk", "specifiers": set(["gtk", "x86", "release"])},
+    "GTK Linux 64-bit Debug": {"port_name": "gtk", "specifiers": set(["gtk", "x86_64", "debug"])},
+    "GTK Linux 64-bit Release": {"port_name": "gtk", "specifiers": set(["gtk", "x86_64", "release"])},
+    "GTK Linux 64-bit Release WK2 (Tests)": {"port_name": "gtk", "specifiers": set(["gtk", "x86_64", "wk2", "release"])},
+
+    # FIXME: Remove rebaseline_override_dir once there are Qt bots for all the platform/qt-* directories.
+    "Qt Linux Release": {"port_name": "qt-linux", "specifiers": set(["win", "linux", "mac"]), "rebaseline_override_dir": "qt"},
+
+    "EFL Linux 64-bit Debug": {"port_name": "efl", "specifiers": set(["efl", "debug"])},
+    "EFL Linux 64-bit Release": {"port_name": "efl", "specifiers": set(["efl", "release"])},
 }
 
 
@@ -70,7 +76,6 @@ _fuzzy_matches = {
     # These builders are on build.webkit.org.
     r"SnowLeopard": "mac-snowleopard",
     r"Apple Lion": "mac-lion",
-    r"Leopard": "mac-leopard",
     r"Windows": "win",
     r"GTK": "gtk",
     r"Qt": "qt",
@@ -81,8 +86,6 @@ _fuzzy_matches = {
 
 
 _ports_without_builders = [
-    "google-chrome-linux32",
-    "google-chrome-linux64",
     "qt-mac",
     "qt-win",
     "qt-wk2",
@@ -93,12 +96,10 @@ def builder_path_from_name(builder_name):
     return re.sub(r'[\s().]', '_', builder_name)
 
 
-@memoized
 def all_builder_names():
     return sorted(set(_exact_matches.keys()))
 
 
-@memoized
 def all_port_names():
     return sorted(set(map(lambda x: x["port_name"], _exact_matches.values()) + _ports_without_builders))
 
@@ -107,6 +108,10 @@ def coverage_specifiers_for_builder_name(builder_name):
     return _exact_matches[builder_name].get("specifiers", set())
 
 
+def rebaseline_override_dir(builder_name):
+    return _exact_matches[builder_name].get("rebaseline_override_dir", None)
+
+
 def port_name_for_builder_name(builder_name):
     if builder_name in _exact_matches:
         return _exact_matches[builder_name]["port_name"]
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
index 5aad94c0f..24f7efa0f 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium.py
@@ -39,20 +39,20 @@ import sys
 import time
 
 from webkitpy.common.system import executive
+from webkitpy.common.system.path import cygpath
 from webkitpy.layout_tests.models.test_configuration import TestConfiguration
 from webkitpy.layout_tests.port.base import Port, VirtualTestSuite
 from webkitpy.layout_tests.port.driver import DriverOutput
-from webkitpy.layout_tests.port.webkit import WebKitDriver
+from webkitpy.layout_tests.port.webkit import WebKitPort, WebKitDriver
 
 
 _log = logging.getLogger(__name__)
 
 
-class ChromiumPort(Port):
+class ChromiumPort(WebKitPort):
     """Abstract base class for Chromium implementations of the Port class."""
 
     ALL_SYSTEMS = (
-        ('leopard', 'x86'),
         ('snowleopard', 'x86'),
         ('lion', 'x86'),
         ('xp', 'x86'),
@@ -70,7 +70,7 @@ class ChromiumPort(Port):
     ]
 
     CONFIGURATION_SPECIFIER_MACROS = {
-        'mac': ['leopard', 'snowleopard', 'lion'],
+        'mac': ['snowleopard', 'lion'],
         'win': ['xp', 'win7'],
         'linux': ['lucid'],
         'android': ['icecreamsandwich'],
@@ -106,10 +106,21 @@ class ChromiumPort(Port):
             return module_path[0:offset]
 
     def __init__(self, host, port_name, **kwargs):
-        Port.__init__(self, host, port_name, **kwargs)
+        super(ChromiumPort, self).__init__(host, port_name, **kwargs)
         # All sub-classes override this, but we need an initial value for testing.
         self._chromium_base_dir_path = None
 
+    def is_chromium(self):
+        return True
+
+    def default_pixel_tests(self):
+        return True
+
+    def default_timeout_ms(self):
+        if self.get_option('configuration') == 'Debug':
+            return 12 * 1000
+        return 6 * 1000
+
     def _check_file_exists(self, path_to_file, file_description,
                            override_step=None, logging=True):
         """Verify the file is present where expected or log an error.
@@ -129,6 +140,11 @@ class ChromiumPort(Port):
             return False
         return True
 
+    def driver_name(self):
+        # FIXME: merge this with Port.driver_name, WebKitPort.driver_name
+        if self.get_option('driver_name'):
+            return self.get_option('driver_name')
+        return 'DumpRenderTree'
 
     def check_build(self, needs_http):
         result = True
@@ -256,6 +272,20 @@ class ChromiumPort(Port):
         except AssertionError:
             return self._build_path(self.get_option('configuration'), 'layout-test-results')
 
+    def _driver_class(self):
+        return ChromiumDriver
+
+    def _missing_symbol_to_skipped_tests(self):
+        # FIXME: Should WebKitPort have these definitions also?
+        return {
+            "ff_mp3_decoder": ["webaudio/codec-tests/mp3"],
+            "ff_aac_decoder": ["webaudio/codec-tests/aac"],
+        }
+
+    def skipped_layout_tests(self, test_list):
+        # FIXME: Merge w/ WebKitPort.skipped_layout_tests()
+        return set(self._skipped_tests_for_unsupported_features(test_list))
+
     def setup_test_run(self):
         # Delete the disk cache if any to ensure a clean test run.
         dump_render_tree_binary_path = self._path_to_driver()
@@ -264,9 +294,6 @@ class ChromiumPort(Port):
         if self._filesystem.exists(cachedir):
             self._filesystem.rmtree(cachedir)
 
-    def _driver_class(self):
-        return ChromiumDriver
-
     def start_helper(self):
         helper_path = self._path_to_helper()
         if helper_path:
@@ -321,7 +348,13 @@ class ChromiumPort(Port):
     ])
 
     def expectations_files(self):
-        paths = [self.path_to_test_expectations_file(), self.path_from_chromium_base('skia', 'skia_test_expectations.txt')]
+        paths = [self.path_to_test_expectations_file()]
+        skia_expectations_path = self.path_from_chromium_base('skia', 'skia_test_expectations.txt')
+        if self._filesystem.exists(skia_expectations_path):
+            paths.append(skia_expectations_path)
+        else:
+            _log.warning("Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.")
+
         builder_name = self.get_option('builder_name', 'DUMMY_BUILDER_NAME')
         if builder_name == 'DUMMY_BUILDER_NAME' or '(deps)' in builder_name or builder_name in self.try_builder_names:
             paths.append(self.path_from_chromium_base('webkit', 'tools', 'layout_tests', 'test_expectations.txt'))
@@ -365,6 +398,10 @@ class ChromiumPort(Port):
     def _build_path(self, *comps):
         return self._static_build_path(self._filesystem, self.get_option('build_directory'), self.path_from_chromium_base(), self.path_from_webkit_base(), *comps)
 
+    def _path_to_image_diff(self):
+        binary_name = 'ImageDiff'
+        return self._build_path(self.get_option('configuration'), binary_name)
+
     def _check_driver_build_up_to_date(self, configuration):
         if configuration in ('Debug', 'Release'):
             try:
@@ -400,10 +437,6 @@ class ChromiumPort(Port):
             return cygpath(path)
         return path
 
-    def _path_to_image_diff(self):
-        binary_name = 'ImageDiff'
-        return self._build_path(self.get_option('configuration'), binary_name)
-
 
 class ChromiumDriver(WebKitDriver):
     KILL_TIMEOUT_DEFAULT = 3.0
@@ -663,7 +696,7 @@ class ChromiumDriver(WebKitDriver):
             self._proc.stderr.close()
         time_out_ms = self._port.get_option('time_out_ms')
         if time_out_ms and not self._no_timeout:
-            timeout_ratio = float(time_out_ms) / self._port.default_test_timeout_ms()
+            timeout_ratio = float(time_out_ms) / self._port.default_timeout_ms()
             kill_timeout_seconds = self.KILL_TIMEOUT_DEFAULT * timeout_ratio if timeout_ratio > 1.0 else self.KILL_TIMEOUT_DEFAULT
         else:
             kill_timeout_seconds = self.KILL_TIMEOUT_DEFAULT
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
index 75b9932db..2a1877407 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android.py
@@ -57,7 +57,9 @@ DEVICE_DRT_STAMP_PATH = DEVICE_DRT_DIR + 'DumpRenderTree.stamp'
 
 DRT_APP_PACKAGE = 'org.chromium.native_test'
 DRT_ACTIVITY_FULL_NAME = DRT_APP_PACKAGE + '/.ChromeNativeTestActivity'
-DRT_APP_FILE_DIR = '/data/user/0/' + DRT_APP_PACKAGE + '/files/'
+DRT_APP_DIR = '/data/user/0/' + DRT_APP_PACKAGE + '/'
+DRT_APP_FILES_DIR = DRT_APP_DIR + 'files/'
+DRT_APP_CACHE_DIR = DRT_APP_DIR + 'cache/'
 
 # This only works for single core devices so far.
 # FIXME: Find a solution for multi-core devices.
@@ -178,7 +180,7 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
             self._adb_command += shlex.split(adb_args)
         self._drt_retry_after_killed = 0
 
-    def default_test_timeout_ms(self):
+    def default_timeout_ms(self):
         # Android platform has less computing power than desktop platforms.
         # Using 10 seconds allows us to pass most slow tests which are not
         # marked as slow tests on desktop platforms.
@@ -214,7 +216,7 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         return True
 
     # FIXME: Remove this function when chromium-android is fully upstream.
-    def expectations_files(self):   
+    def expectations_files(self):
         android_expectations_file = self.path_from_webkit_base('LayoutTests', 'platform', 'chromium', 'test_expectations_android.txt')
         return super(ChromiumAndroidPort, self).expectations_files() + [android_expectations_file]
 
@@ -227,7 +229,7 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         expectations = chromium.ChromiumPort.test_expectations(self)
         return expectations.replace('LINUX ', 'LINUX ANDROID ')
 
-    def start_http_server(self, additional_dirs=None):
+    def start_http_server(self, additional_dirs=None, number_of_servers=0):
         # The http server runs during the whole testing period, so ignore this call.
         pass
 
@@ -235,7 +237,7 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         # Same as start_http_server().
         pass
 
-    def start_helper(self):
+    def setup_test_run(self):
         self._run_adb_command(['root'])
         self._setup_performance()
         # Required by webkit_support::GetWebKitRootDirFilePath().
@@ -249,13 +251,17 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         self._push_fonts()
         self._synchronize_datetime()
 
+        # Delete the disk cache if any to ensure a clean test run.
+        # This is like what's done in ChromiumPort.setup_test_run but on the device.
+        self._run_adb_command(['shell', 'rm', '-r', DRT_APP_CACHE_DIR])
+
         # Start the HTTP server so that the device can access the test cases.
         chromium.ChromiumPort.start_http_server(self, additional_dirs={TEST_PATH_PREFIX: self.layout_tests_dir()})
 
         _log.debug('Starting forwarder')
-        cmd = self._run_adb_command(['shell', '%s %s' % (DEVICE_FORWARDER_PATH, FORWARD_PORTS)])
+        self._run_adb_command(['shell', '%s %s' % (DEVICE_FORWARDER_PATH, FORWARD_PORTS)])
 
-    def stop_helper(self):
+    def clean_up_test_run(self):
         # Leave the forwarder and tests httpd server there because they are
         # useful for debugging and do no harm to subsequent tests.
         self._teardown_performance()
@@ -284,6 +290,9 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
         return self._build_path(configuration, 'DumpRenderTree_apk/DumpRenderTree-debug.apk')
 
     def _path_to_helper(self):
+        return None
+
+    def _path_to_forwarder(self):
         return self._build_path(self.get_option('configuration'), 'forwarder')
 
     def _path_to_image_diff(self):
@@ -320,7 +329,7 @@ class ChromiumAndroidPort(chromium.ChromiumPort):
 
     def _push_executable(self):
         drt_host_path = self._path_to_driver()
-        forwarder_host_path = self._path_to_helper()
+        forwarder_host_path = self._path_to_forwarder()
         host_stamp = int(float(max(os.stat(drt_host_path).st_mtime,
                                    os.stat(forwarder_host_path).st_mtime)))
         device_stamp = int(float(self._run_adb_command([
@@ -452,9 +461,9 @@ class ChromiumAndroidDriver(chromium.ChromiumDriver):
 
     def __init__(self, port, worker_number, pixel_tests, no_timeout=False):
         chromium.ChromiumDriver.__init__(self, port, worker_number, pixel_tests, no_timeout)
-        self._in_fifo_path = DRT_APP_FILE_DIR + 'DumpRenderTree.in'
-        self._out_fifo_path = DRT_APP_FILE_DIR + 'DumpRenderTree.out'
-        self._err_file_path = DRT_APP_FILE_DIR + 'DumpRenderTree.err'
+        self._in_fifo_path = DRT_APP_FILES_DIR + 'DumpRenderTree.in'
+        self._out_fifo_path = DRT_APP_FILES_DIR + 'DumpRenderTree.out'
+        self._err_file_path = DRT_APP_FILES_DIR + 'DumpRenderTree.err'
         self._restart_after_killed = False
         self._read_fifo_proc = None
 
@@ -467,7 +476,7 @@ class ChromiumAndroidDriver(chromium.ChromiumDriver):
         cmd = []
         for param in original_cmd:
             if param.startswith('--pixel-tests='):
-                self._device_image_path = DRT_APP_FILE_DIR + self._port.host.filesystem.basename(self._image_path)
+                self._device_image_path = DRT_APP_FILES_DIR + self._port.host.filesystem.basename(self._image_path)
                 param = '--pixel-tests=' + self._device_image_path
             cmd.append(param)
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
index e0d308267..8544b020c 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_android_unittest.py
@@ -26,6 +26,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import optparse
 import StringIO
 import unittest
 
@@ -35,11 +36,11 @@ from webkitpy.common.system.systemhost_mock import MockSystemHost
 from webkitpy.thirdparty.mock import Mock
 
 from webkitpy.layout_tests.port import chromium_android
-from webkitpy.layout_tests.port import port_testcase
+from webkitpy.layout_tests.port import chromium_port_testcase
 from webkitpy.layout_tests.port import Port
 
 
-class ChromiumAndroidPortTest(port_testcase.PortTestCase):
+class ChromiumAndroidPortTest(chromium_port_testcase.ChromiumPortTestCase):
     port_name = 'chromium-android'
     port_maker = chromium_android.ChromiumAndroidPort
     mock_logcat = ''
@@ -49,6 +50,15 @@ class ChromiumAndroidPortTest(port_testcase.PortTestCase):
         self.assertTrue(port.get_option('enable_hardware_gpu'))
         self.assertEquals(port.baseline_path(), port._webkit_baseline_path('chromium-android'))
 
+    def test_default_timeout_ms(self):
+        self.assertEquals(self.make_port(options=optparse.Values({'configuration': 'Release'})).default_timeout_ms(), 10000)
+        self.assertEquals(self.make_port(options=optparse.Values({'configuration': 'Debug'})).default_timeout_ms(), 10000)
+
+    def test_expectations_files(self):
+        # FIXME: override this test temporarily while we're still upstreaming the android port and
+        # using a custom expectations file.
+        pass
+
     @staticmethod
     def mock_run_command_fn(args):
         if args[1] == 'shell':
@@ -123,9 +133,9 @@ class ChromiumAndroidDriverTest(unittest.TestCase):
     def test_cmd_line(self):
         cmd_line = self.driver.cmd_line(True, ['--a'])
         self.assertTrue('--a' in cmd_line)
-        self.assertTrue('--in-fifo=' + chromium_android.DRT_APP_FILE_DIR + 'DumpRenderTree.in' in cmd_line)
-        self.assertTrue('--out-fifo=' + chromium_android.DRT_APP_FILE_DIR + 'DumpRenderTree.out' in cmd_line)
-        self.assertTrue('--err-file=' + chromium_android.DRT_APP_FILE_DIR + 'DumpRenderTree.err' in cmd_line)
+        self.assertTrue('--in-fifo=' + chromium_android.DRT_APP_FILES_DIR + 'DumpRenderTree.in' in cmd_line)
+        self.assertTrue('--out-fifo=' + chromium_android.DRT_APP_FILES_DIR + 'DumpRenderTree.out' in cmd_line)
+        self.assertTrue('--err-file=' + chromium_android.DRT_APP_FILES_DIR + 'DumpRenderTree.err' in cmd_line)
 
     def test_read_prompt(self):
         self.driver._proc = Mock()  # FIXME: This should use a tighter mock.
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
index f26bea431..e54078d2b 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
@@ -110,6 +110,9 @@ class ChromiumLinuxPort(chromium.ChromiumPort):
         port_names = self.FALLBACK_PATHS[self._architecture]
         return map(self._webkit_baseline_path, port_names)
 
+    def _modules_to_search_for_symbols(self):
+        return [self._build_path(self.get_option('configuration'), 'libffmpegsumo.so')]
+
     def check_build(self, needs_http):
         result = chromium.ChromiumPort.check_build(self, needs_http)
         if not result:
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux_unittest.py
index e0ef728bd..9094d7458 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_linux_unittest.py
@@ -33,10 +33,10 @@ from webkitpy.common.system.systemhost_mock import MockSystemHost
 from webkitpy.tool.mocktool import MockOptions
 
 from webkitpy.layout_tests.port import chromium_linux
-from webkitpy.layout_tests.port import port_testcase
+from webkitpy.layout_tests.port import chromium_port_testcase
 
 
-class ChromiumLinuxPortTest(port_testcase.PortTestCase):
+class ChromiumLinuxPortTest(chromium_port_testcase.ChromiumPortTestCase):
     port_name = 'chromium-linux'
     port_maker = chromium_linux.ChromiumLinuxPort
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
index f748cd18a..df1ac7b58 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
@@ -39,17 +39,10 @@ _log = logging.getLogger(__name__)
 
 
 class ChromiumMacPort(chromium.ChromiumPort):
-    SUPPORTED_OS_VERSIONS = ('leopard', 'snowleopard', 'lion', 'future')
+    SUPPORTED_OS_VERSIONS = ('snowleopard', 'lion', 'future')
     port_name = 'chromium-mac'
 
     FALLBACK_PATHS = {
-        'leopard': [
-            'chromium-mac-leopard',
-            'chromium-mac-snowleopard',
-            'chromium-mac',
-            'chromium',
-            'mac',
-        ],
         'snowleopard': [
             'chromium-mac-snowleopard',
             'chromium-mac',
@@ -78,16 +71,16 @@ class ChromiumMacPort(chromium.ChromiumPort):
 
     def __init__(self, host, port_name, **kwargs):
         chromium.ChromiumPort.__init__(self, host, port_name, **kwargs)
-
-        # We're a little generic here because this code is reused by the
-        # 'google-chrome' port as well as the 'mock-' and 'dryrun-' ports.
-        self._version = port_name[port_name.index('-mac-') + len('-mac-'):]
+        self._version = port_name[port_name.index('chromium-mac-') + len('chromium-mac-'):]
         assert self._version in self.SUPPORTED_OS_VERSIONS
 
     def baseline_search_path(self):
         fallback_paths = self.FALLBACK_PATHS
         return map(self._webkit_baseline_path, fallback_paths[self._version])
 
+    def _modules_to_search_for_symbols(self):
+        return [self._build_path(self.get_option('configuration'), 'ffmpegsumo.so')]
+
     def check_build(self, needs_http):
         result = chromium.ChromiumPort.check_build(self, needs_http)
         if not result:
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py
index 77cee2b32..87904a804 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_mac_unittest.py
@@ -29,13 +29,13 @@
 import unittest
 
 from webkitpy.layout_tests.port import chromium_mac
-from webkitpy.layout_tests.port import port_testcase
+from webkitpy.layout_tests.port import chromium_port_testcase
 from webkitpy.tool.mocktool import MockOptions
 
 
-class ChromiumMacPortTest(port_testcase.PortTestCase):
+class ChromiumMacPortTest(chromium_port_testcase.ChromiumPortTestCase):
     os_name = 'mac'
-    os_version = 'leopard'
+    os_version = 'snowleopard'
     port_name = 'chromium-mac'
     port_maker = chromium_mac.ChromiumMacPort
 
@@ -44,12 +44,7 @@ class ChromiumMacPortTest(port_testcase.PortTestCase):
         self.assertEquals(expected, port.name())
 
     def test_versions(self):
-        self.assertTrue(self.make_port().name() in ('chromium-mac-leopard', 'chromium-mac-snowleopard', 'chromium-mac-lion', 'chromium-mac-future'))
-
-        self.assert_name(None, 'leopard', 'chromium-mac-leopard')
-        self.assert_name('chromium-mac', 'leopard', 'chromium-mac-leopard')
-        self.assert_name('chromium-mac-leopard', 'leopard', 'chromium-mac-leopard')
-        self.assert_name('chromium-mac-leopard', 'snowleopard', 'chromium-mac-leopard')
+        self.assertTrue(self.make_port().name() in ('chromium-mac-snowleopard', 'chromium-mac-lion', 'chromium-mac-future'))
 
         self.assert_name(None, 'snowleopard', 'chromium-mac-snowleopard')
         self.assert_name('chromium-mac', 'snowleopard', 'chromium-mac-snowleopard')
@@ -67,9 +62,6 @@ class ChromiumMacPortTest(port_testcase.PortTestCase):
         self.assertRaises(AssertionError, self.assert_name, None, 'tiger', 'should-raise-assertion-so-this-value-does-not-matter')
 
     def test_baseline_path(self):
-        port = self.make_port(port_name='chromium-mac-leopard')
-        self.assertEquals(port.baseline_path(), port._webkit_baseline_path('chromium-mac-leopard'))
-
         port = self.make_port(port_name='chromium-mac-snowleopard')
         self.assertEquals(port.baseline_path(), port._webkit_baseline_path('chromium-mac-snowleopard'))
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py
new file mode 100644
index 000000000..697c27242
--- /dev/null
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_port_testcase.py
@@ -0,0 +1,205 @@
+# Copyright (C) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.common.system import logtesting
+from webkitpy.common.system.executive_mock import MockExecutive2
+from webkitpy.common.system.systemhost_mock import MockSystemHost
+from webkitpy.tool.mocktool import MockOptions
+
+import chromium_android
+import chromium_linux
+import chromium_mac
+import chromium_win
+
+from webkitpy.layout_tests.models.test_configuration import TestConfiguration
+from webkitpy.layout_tests.port import port_testcase
+
+
+class ChromiumPortTestCase(port_testcase.PortTestCase):
+
+    def test_default_timeout_ms(self):
+        self.assertEquals(self.make_port(options=MockOptions(configuration='Release')).default_timeout_ms(), 6000)
+        self.assertEquals(self.make_port(options=MockOptions(configuration='Debug')).default_timeout_ms(), 12000)
+
+    def test_default_pixel_tests(self):
+        self.assertEquals(self.make_port().default_pixel_tests(), True)
+
+    def test_missing_symbol_to_skipped_tests(self):
+        # Test that we get the chromium skips and not the webkit default skips
+        port = self.make_port()
+        skip_dict = port._missing_symbol_to_skipped_tests()
+        self.assertTrue('ff_mp3_decoder' in skip_dict)
+        self.assertFalse('WebGLShader' in skip_dict)
+
+    def test_all_test_configurations(self):
+        """Validate the complete set of configurations this port knows about."""
+        port = self.make_port()
+        self.assertEquals(set(port.all_test_configurations()), set([
+            TestConfiguration('icecreamsandwich', 'x86', 'debug'),
+            TestConfiguration('icecreamsandwich', 'x86', 'release'),
+            TestConfiguration('snowleopard', 'x86', 'debug'),
+            TestConfiguration('snowleopard', 'x86', 'release'),
+            TestConfiguration('lion', 'x86', 'debug'),
+            TestConfiguration('lion', 'x86', 'release'),
+            TestConfiguration('xp', 'x86', 'debug'),
+            TestConfiguration('xp', 'x86', 'release'),
+            TestConfiguration('win7', 'x86', 'debug'),
+            TestConfiguration('win7', 'x86', 'release'),
+            TestConfiguration('lucid', 'x86', 'debug'),
+            TestConfiguration('lucid', 'x86', 'release'),
+            TestConfiguration('lucid', 'x86_64', 'debug'),
+            TestConfiguration('lucid', 'x86_64', 'release'),
+        ]))
+
+    class TestMacPort(chromium_mac.ChromiumMacPort):
+        def __init__(self, options=None):
+            options = options or MockOptions()
+            chromium_mac.ChromiumMacPort.__init__(self, MockSystemHost(os_name='mac', os_version='leopard'), 'chromium-mac-leopard', options=options)
+
+        def default_configuration(self):
+            self.default_configuration_called = True
+            return 'default'
+
+    class TestAndroidPort(chromium_android.ChromiumAndroidPort):
+        def __init__(self, options=None):
+            options = options or MockOptions()
+            chromium_win.ChromiumAndroidPort.__init__(self, MockSystemHost(os_name='android', os_version='icecreamsandwich'), 'chromium-android', options=options)
+
+        def default_configuration(self):
+            self.default_configuration_called = True
+            return 'default'
+
+    class TestLinuxPort(chromium_linux.ChromiumLinuxPort):
+        def __init__(self, options=None):
+            options = options or MockOptions()
+            chromium_linux.ChromiumLinuxPort.__init__(self, MockSystemHost(os_name='linux', os_version='lucid'), 'chromium-linux-x86', options=options)
+
+        def default_configuration(self):
+            self.default_configuration_called = True
+            return 'default'
+
+    class TestWinPort(chromium_win.ChromiumWinPort):
+        def __init__(self, options=None):
+            options = options or MockOptions()
+            chromium_win.ChromiumWinPort.__init__(self, MockSystemHost(os_name='win', os_version='xp'), 'chromium-win-xp', options=options)
+
+        def default_configuration(self):
+            self.default_configuration_called = True
+            return 'default'
+
+    def test_default_configuration(self):
+        mock_options = MockOptions()
+        port = ChromiumPortTestCase.TestLinuxPort(options=mock_options)
+        self.assertEquals(mock_options.configuration, 'default')
+        self.assertTrue(port.default_configuration_called)
+
+        mock_options = MockOptions(configuration=None)
+        port = ChromiumPortTestCase.TestLinuxPort(mock_options)
+        self.assertEquals(mock_options.configuration, 'default')
+        self.assertTrue(port.default_configuration_called)
+
+    def test_diff_image(self):
+        class TestPort(ChromiumPortTestCase.TestLinuxPort):
+            def _path_to_image_diff(self):
+                return "/path/to/image_diff"
+
+        port = ChromiumPortTestCase.TestLinuxPort()
+        mock_image_diff = "MOCK Image Diff"
+
+        def mock_run_command(args):
+            port._filesystem.write_binary_file(args[4], mock_image_diff)
+            return 1
+
+        # Images are different.
+        port._executive = MockExecutive2(run_command_fn=mock_run_command)
+        self.assertEquals(mock_image_diff, port.diff_image("EXPECTED", "ACTUAL")[0])
+
+        # Images are the same.
+        port._executive = MockExecutive2(exit_code=0)
+        self.assertEquals(None, port.diff_image("EXPECTED", "ACTUAL")[0])
+
+        # There was some error running image_diff.
+        port._executive = MockExecutive2(exit_code=2)
+        exception_raised = False
+        try:
+            port.diff_image("EXPECTED", "ACTUAL")
+        except ValueError, e:
+            exception_raised = True
+        self.assertFalse(exception_raised)
+
+    def test_expectations_files(self):
+        port = self.make_port()
+        port.port_name = 'chromium'
+
+        expectations_path = port.path_to_test_expectations_file()
+        chromium_overrides_path = port.path_from_chromium_base(
+            'webkit', 'tools', 'layout_tests', 'test_expectations.txt')
+        skia_overrides_path = port.path_from_chromium_base(
+            'skia', 'skia_test_expectations.txt')
+
+        port._filesystem.write_text_file(skia_overrides_path, 'dummay text')
+
+        port._options.builder_name = 'DUMMY_BUILDER_NAME'
+        self.assertEquals(port.expectations_files(), [expectations_path, skia_overrides_path, chromium_overrides_path])
+
+        port._options.builder_name = 'builder (deps)'
+        self.assertEquals(port.expectations_files(), [expectations_path, skia_overrides_path, chromium_overrides_path])
+
+        # A builder which does NOT observe the Chromium test_expectations,
+        # but still observes the Skia test_expectations...
+        port._options.builder_name = 'builder'
+        self.assertEquals(port.expectations_files(), [expectations_path, skia_overrides_path])
+
+    def test_expectations_ordering(self):
+        # since we don't implement self.port_name in ChromiumPort.
+        pass
+
+
+class ChromiumPortLoggingTest(logtesting.LoggingTestCase):
+    def test_check_sys_deps(self):
+        port = ChromiumPortTestCase.TestLinuxPort()
+
+        # Success
+        port._executive = MockExecutive2(exit_code=0)
+        self.assertTrue(port.check_sys_deps(needs_http=False))
+
+        # Failure
+        port._executive = MockExecutive2(exit_code=1,
+            output='testing output failure')
+        self.assertFalse(port.check_sys_deps(needs_http=False))
+        self.assertLog([
+            'ERROR: System dependencies check failed.\n',
+            'ERROR: To override, invoke with --nocheck-sys-deps\n',
+            'ERROR: \n',
+            'ERROR: testing output failure\n'])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
index 492deedf2..0c49112ba 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
@@ -27,26 +27,20 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 import StringIO
-import sys
 import time
 import unittest
 
 from webkitpy.common.system import logtesting
-from webkitpy.common.system.executive_mock import MockExecutive, MockExecutive2
-from webkitpy.common.system.filesystem_mock import MockFileSystem
+from webkitpy.common.system.executive_mock import MockExecutive2
 from webkitpy.common.system.systemhost_mock import MockSystemHost
 from webkitpy.layout_tests.port.config_mock import MockConfig
 from webkitpy.thirdparty.mock import Mock
 from webkitpy.tool.mocktool import MockOptions
 
 import chromium
-import chromium_android
-import chromium_linux
 import chromium_mac
-import chromium_win
 
-from webkitpy.layout_tests.models.test_configuration import TestConfiguration
-from webkitpy.layout_tests.port import port_testcase
+from webkitpy.layout_tests.port import chromium_port_testcase
 from webkitpy.layout_tests.port.driver import DriverInput
 
 
@@ -176,149 +170,20 @@ class ChromiumDriverTest(unittest.TestCase):
         self.driver._start(True, [])
         self.assertFalse(self.port._filesystem.isdir(last_tmpdir))
 
-class ChromiumPortTest(port_testcase.PortTestCase):
-    port_name = 'chromium-mac'
-    port_maker = chromium.ChromiumPort
-
-    def test_all_test_configurations(self):
-        """Validate the complete set of configurations this port knows about."""
-        port = self.make_port()
-        self.assertEquals(set(port.all_test_configurations()), set([
-            TestConfiguration('icecreamsandwich', 'x86', 'debug'),
-            TestConfiguration('icecreamsandwich', 'x86', 'release'),
-            TestConfiguration('leopard', 'x86', 'debug'),
-            TestConfiguration('leopard', 'x86', 'release'),
-            TestConfiguration('snowleopard', 'x86', 'debug'),
-            TestConfiguration('snowleopard', 'x86', 'release'),
-            TestConfiguration('lion', 'x86', 'debug'),
-            TestConfiguration('lion', 'x86', 'release'),
-            TestConfiguration('xp', 'x86', 'debug'),
-            TestConfiguration('xp', 'x86', 'release'),
-            TestConfiguration('win7', 'x86', 'debug'),
-            TestConfiguration('win7', 'x86', 'release'),
-            TestConfiguration('lucid', 'x86', 'debug'),
-            TestConfiguration('lucid', 'x86', 'release'),
-            TestConfiguration('lucid', 'x86_64', 'debug'),
-            TestConfiguration('lucid', 'x86_64', 'release'),
-        ]))
-
-    def test_driver_cmd_line(self):
-        # Override this test since ChromiumPort doesn't implement driver_cmd_line().
-        pass
-
-    def test_check_build(self):
-        # Override this test since ChromiumPort doesn't implement _path_to_driver().
-        pass
-
-    def test_check_wdiff(self):
-        # Override this test since ChromiumPort doesn't implement _path_to_driver().
-        pass
-
-    class TestMacPort(chromium_mac.ChromiumMacPort):
-        def __init__(self, options=None):
-            options = options or MockOptions()
-            chromium_mac.ChromiumMacPort.__init__(self, MockSystemHost(os_name='mac', os_version='leopard'), 'chromium-mac-leopard', options=options)
-
-        def default_configuration(self):
-            self.default_configuration_called = True
-            return 'default'
-
-    class TestAndroidPort(chromium_android.ChromiumAndroidPort):
-        def __init__(self, options=None):
-            options = options or MockOptions()
-            chromium_win.ChromiumAndroidPort.__init__(self, MockSystemHost(os_name='android', os_version='icecreamsandwich'), 'chromium-android', options=options)
-
-        def default_configuration(self):
-            self.default_configuration_called = True
-            return 'default'
-
-    class TestLinuxPort(chromium_linux.ChromiumLinuxPort):
-        def __init__(self, options=None):
-            options = options or MockOptions()
-            chromium_linux.ChromiumLinuxPort.__init__(self, MockSystemHost(os_name='linux', os_version='lucid'), 'chromium-linux-x86', options=options)
-
-        def default_configuration(self):
-            self.default_configuration_called = True
-            return 'default'
-
-    class TestWinPort(chromium_win.ChromiumWinPort):
-        def __init__(self, options=None):
-            options = options or MockOptions()
-            chromium_win.ChromiumWinPort.__init__(self, MockSystemHost(os_name='win', os_version='xp'), 'chromium-win-xp', options=options)
-
-        def default_configuration(self):
-            self.default_configuration_called = True
-            return 'default'
-
-    def test_default_configuration(self):
-        mock_options = MockOptions()
-        port = ChromiumPortTest.TestLinuxPort(options=mock_options)
-        self.assertEquals(mock_options.configuration, 'default')
-        self.assertTrue(port.default_configuration_called)
-
-        mock_options = MockOptions(configuration=None)
-        port = ChromiumPortTest.TestLinuxPort(mock_options)
-        self.assertEquals(mock_options.configuration, 'default')
-        self.assertTrue(port.default_configuration_called)
-
-    def test_diff_image(self):
-        class TestPort(ChromiumPortTest.TestLinuxPort):
-            def _path_to_image_diff(self):
-                return "/path/to/image_diff"
-
-        port = ChromiumPortTest.TestLinuxPort()
-        mock_image_diff = "MOCK Image Diff"
-
-        def mock_run_command(args):
-            port._filesystem.write_binary_file(args[4], mock_image_diff)
-            return 1
-
-        # Images are different.
-        port._executive = MockExecutive2(run_command_fn=mock_run_command)
-        self.assertEquals(mock_image_diff, port.diff_image("EXPECTED", "ACTUAL")[0])
-
-        # Images are the same.
-        port._executive = MockExecutive2(exit_code=0)
-        self.assertEquals(None, port.diff_image("EXPECTED", "ACTUAL")[0])
-
-        # There was some error running image_diff.
-        port._executive = MockExecutive2(exit_code=2)
-        exception_raised = False
-        try:
-            port.diff_image("EXPECTED", "ACTUAL")
-        except ValueError, e:
-            exception_raised = True
-        self.assertFalse(exception_raised)
-
-    def test_expectations_files(self):
-        port = self.make_port()
-        port.port_name = 'chromium'
-
-        expectations_path = port.path_to_test_expectations_file()
-        chromium_overrides_path = port.path_from_chromium_base(
-            'webkit', 'tools', 'layout_tests', 'test_expectations.txt')
-        skia_overrides_path = port.path_from_chromium_base(
-            'skia', 'skia_test_expectations.txt')
+    def test_expectations_dict(self):
+        self.port._filesystem.write_text_file('/mock-checkout/LayoutTests/platform/chromium/TestExpectations', 'upstream')
+        self.port._filesystem.write_text_file('/mock-checkout/Source/WebKit/chromium/webkit/tools/layout_tests/test_expectations.txt', 'downstream')
+        self.assertEquals('\n'.join(self.port.expectations_dict().values()), 'upstream\ndownstream')
 
-        port._options.builder_name = 'DUMMY_BUILDER_NAME'
-        self.assertEquals(port.expectations_files(), [expectations_path, skia_overrides_path, chromium_overrides_path])
-
-        port._options.builder_name = 'builder (deps)'
-        self.assertEquals(port.expectations_files(), [expectations_path, skia_overrides_path, chromium_overrides_path])
-
-        # A builder which does NOT observe the Chromium test_expectations,
-        # but still observes the Skia test_expectations...
-        port._options.builder_name = 'builder'
-        self.assertEquals(port.expectations_files(), [expectations_path, skia_overrides_path])
-
-    def test_expectations_ordering(self):
-        # since we don't implement self.port_name in ChromiumPort.
-        pass
+        self.port._filesystem.write_text_file(self.port.path_from_chromium_base('skia', 'skia_test_expectations.txt'), 'skia')
+        self.assertEquals('\n'.join(self.port.expectations_dict().values()), 'upstream\nskia\ndownstream')
 
 
 class ChromiumPortLoggingTest(logtesting.LoggingTestCase):
+
+    # FIXME: put this someplace more useful
     def test_check_sys_deps(self):
-        port = ChromiumPortTest.TestLinuxPort()
+        port = chromium_port_testcase.ChromiumPortTestCase.TestLinuxPort()
 
         # Success
         port._executive = MockExecutive2(exit_code=0)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
index ff58842b6..51611241c 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win.py
@@ -75,10 +75,7 @@ class ChromiumWinPort(chromium.ChromiumPort):
 
     def __init__(self, host, port_name, **kwargs):
         chromium.ChromiumPort.__init__(self, host, port_name, **kwargs)
-
-        # We're a little generic here because this code is reused by the
-        # 'google-chrome' port as well as the 'mock-' and 'dryrun-' ports.
-        self._version = port_name[port_name.index('-win-') + len('-win-'):]
+        self._version = port_name[port_name.index('chromium-win-') + len('chromium-win-'):]
         assert self._version in self.SUPPORTED_VERSIONS, "%s is not in %s" % (self._version, self.SUPPORTED_VERSIONS)
 
     def setup_environ_for_server(self, server_name=None):
@@ -106,6 +103,11 @@ class ChromiumWinPort(chromium.ChromiumPort):
         port_names = self.FALLBACK_PATHS[self.version()]
         return map(self._webkit_baseline_path, port_names)
 
+    def _modules_to_search_for_symbols(self):
+        # FIXME: we should return the path to the ffmpeg equivalents to detect if we have the mp3 and aac codecs installed.
+        # See https://bugs.webkit.org/show_bug.cgi?id=89706.
+        return []
+
     def check_build(self, needs_http):
         result = chromium.ChromiumPort.check_build(self, needs_http)
         if not result:
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py
index ac2358194..607719241 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/chromium_win_unittest.py
@@ -32,12 +32,12 @@ import unittest
 from webkitpy.common.system import outputcapture
 from webkitpy.common.system.executive_mock import MockExecutive
 from webkitpy.common.system.filesystem_mock import MockFileSystem
+from webkitpy.layout_tests.port import chromium_port_testcase
 from webkitpy.layout_tests.port import chromium_win
-from webkitpy.layout_tests.port import port_testcase
 from webkitpy.tool.mocktool import MockOptions
 
 
-class ChromiumWinTest(port_testcase.PortTestCase):
+class ChromiumWinTest(chromium_port_testcase.ChromiumPortTestCase):
     port_name = 'chromium-win'
     port_maker = chromium_win.ChromiumWinPort
     os_name = 'win'
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/efl.py b/Tools/Scripts/webkitpy/layout_tests/port/efl.py
index 8ea8a1255..5964dfe52 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/efl.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/efl.py
@@ -52,6 +52,12 @@ class EflPort(WebKitPort, PulseAudioSanitizer):
     def setup_test_run(self):
         self._unload_pulseaudio_module()
 
+    def setup_environ_for_server(self, server_name=None):
+        env = super(EflPort, self).setup_environ_for_server(server_name)
+        env['TEST_RUNNER_INJECTED_BUNDLE_FILENAME'] = self._build_path('lib', 'libTestRunnerInjectedBundle.so')
+        env['TEST_RUNNER_PLUGIN_PATH'] = self._build_path('lib')
+        return env
+
     def clean_up_test_run(self):
         self._restore_pulseaudio_module()
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/factory.py b/Tools/Scripts/webkitpy/layout_tests/port/factory.py
index 881a80bec..9b5cf27b0 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/factory.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/factory.py
@@ -60,8 +60,9 @@ def port_options(**help_strings):
 
 def _builder_options(builder_name):
     configuration = "Debug" if re.search(r"[d|D](ebu|b)g", builder_name) else "Release"
+    is_webkit2 = builder_name.find("WK2") != -1
     builder_name = builder_name
-    return optparse.Values({'builder_name': builder_name, 'configuration': configuration})
+    return optparse.Values({'builder_name': builder_name, 'configuration': configuration, 'webkit_test_runner': is_webkit2})
 
 
 class PortFactory(object):
@@ -71,10 +72,6 @@ class PortFactory(object):
         'chromium_mac.ChromiumMacPort',
         'chromium_win.ChromiumWinPort',
         'efl.EflPort',
-        'google_chrome.GoogleChromeLinux32Port',
-        'google_chrome.GoogleChromeLinux64Port',
-        'google_chrome.GoogleChromeMacPort',
-        'google_chrome.GoogleChromeWinPort',
         'gtk.GtkPort',
         'mac.MacPort',
         'mock_drt.MockDRTPort',
@@ -115,7 +112,7 @@ class PortFactory(object):
             if port_name.startswith(cls.port_name):
                 port_name = cls.determine_full_port_name(self._host, options, port_name)
                 return cls(self._host, port_name, options=options, **kwargs)
-        raise NotImplementedError('unsupported port: %s' % port_name)
+        raise NotImplementedError('unsupported platform: "%s"' % port_name)
 
     def all_port_names(self):
         """Return a list of all valid, fully-specified, "real" port names.
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/factory_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/factory_unittest.py
index 700399e28..776433f80 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/factory_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/factory_unittest.py
@@ -35,7 +35,6 @@ from webkitpy.layout_tests.port import chromium_linux
 from webkitpy.layout_tests.port import chromium_mac
 from webkitpy.layout_tests.port import chromium_win
 from webkitpy.layout_tests.port import factory
-from webkitpy.layout_tests.port import google_chrome
 from webkitpy.layout_tests.port import gtk
 from webkitpy.layout_tests.port import mac
 from webkitpy.layout_tests.port import qt
@@ -59,8 +58,8 @@ class FactoryTest(unittest.TestCase):
     def test_mac(self):
         self.assert_port(port_name='mac-leopard', cls=mac.MacPort)
         self.assert_port(port_name='mac-leopard-wk2', cls=mac.MacPort)
-        self.assert_port(port_name='mac', os_name='mac', os_version='leopard', cls=mac.MacPort)
-        self.assert_port(port_name=None,  os_name='mac', os_version='leopard', cls=mac.MacPort)
+        self.assert_port(port_name='mac', os_name='mac', os_version='lion', cls=mac.MacPort)
+        self.assert_port(port_name=None,  os_name='mac', os_version='lion', cls=mac.MacPort)
 
     def test_win(self):
         self.assert_port(port_name='win-xp', cls=win.WinPort)
@@ -69,26 +68,6 @@ class FactoryTest(unittest.TestCase):
         self.assert_port(port_name=None, os_name='win', os_version='xp', cls=win.WinPort)
         self.assert_port(port_name=None, os_name='win', os_version='xp', options=self.webkit_options, cls=win.WinPort)
 
-    def test_google_chrome(self):
-        self.assert_port(port_name='google-chrome-linux32',
-                         cls=google_chrome.GoogleChromeLinux32Port)
-        self.assert_port(port_name='google-chrome-linux64', os_name='linux', os_version='lucid',
-                         cls=google_chrome.GoogleChromeLinux64Port)
-        self.assert_port(port_name='google-chrome-linux64',
-                         cls=google_chrome.GoogleChromeLinux64Port)
-        self.assert_port(port_name='google-chrome-win-xp',
-                         cls=google_chrome.GoogleChromeWinPort)
-        self.assert_port(port_name='google-chrome-win', os_name='win', os_version='xp',
-                         cls=google_chrome.GoogleChromeWinPort)
-        self.assert_port(port_name='google-chrome-win-xp', os_name='win', os_version='xp',
-                         cls=google_chrome.GoogleChromeWinPort)
-        self.assert_port(port_name='google-chrome-mac', os_name='mac', os_version='leopard',
-                         cls=google_chrome.GoogleChromeMacPort)
-        self.assert_port(port_name='google-chrome-mac-leopard', os_name='mac', os_version='leopard',
-                         cls=google_chrome.GoogleChromeMacPort)
-        self.assert_port(port_name='google-chrome-mac-leopard',
-                         cls=google_chrome.GoogleChromeMacPort)
-
     def test_gtk(self):
         self.assert_port(port_name='gtk', cls=gtk.GtkPort)
 
@@ -96,10 +75,9 @@ class FactoryTest(unittest.TestCase):
         self.assert_port(port_name='qt', cls=qt.QtPort)
 
     def test_chromium_mac(self):
-        self.assert_port(port_name='chromium-mac-leopard', cls=chromium_mac.ChromiumMacPort)
-        self.assert_port(port_name='chromium-mac', os_name='mac', os_version='leopard',
+        self.assert_port(port_name='chromium-mac', os_name='mac', os_version='snowleopard',
                          cls=chromium_mac.ChromiumMacPort)
-        self.assert_port(port_name='chromium', os_name='mac', os_version='leopard',
+        self.assert_port(port_name='chromium', os_name='mac', os_version='lion',
                          cls=chromium_mac.ChromiumMacPort)
 
     def test_chromium_linux(self):
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/google_chrome.py b/Tools/Scripts/webkitpy/layout_tests/port/google_chrome.py
deleted file mode 100644
index 8d2df0ee9..000000000
--- a/Tools/Scripts/webkitpy/layout_tests/port/google_chrome.py
+++ /dev/null
@@ -1,107 +0,0 @@
-#!/usr/bin/env python
-# Copyright (C) 2010 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-import chromium_linux
-import chromium_mac
-import chromium_win
-
-
-def _expectations_files(port, super):
-    return super.expectations_files(port) + [port.path_from_chromium_base('webkit', 'tools', 'layout_tests', 'test_expectations_chrome.txt')]
-
-
-class GoogleChromeLinux32Port(chromium_linux.ChromiumLinuxPort):
-    port_name = 'google-chrome-linux32'
-
-    # FIXME: Make google-chrome-XXX work as a port name.
-    @classmethod
-    def determine_full_port_name(cls, host, options, port_name):
-        return 'chromium-linux-x86'
-
-    def baseline_search_path(self):
-        paths = chromium_linux.ChromiumLinuxPort.baseline_search_path(self)
-        paths.insert(0, self._webkit_baseline_path('google-chrome-linux32'))
-        return paths
-
-    def expectations_files(self):
-        return _expectations_files(self, chromium_linux.ChromiumLinuxPort)
-
-    def architecture(self):
-        return 'x86'
-
-
-class GoogleChromeLinux64Port(chromium_linux.ChromiumLinuxPort):
-    port_name = 'google-chrome-linux64'
-
-    # FIXME: Make google-chrome-XXX work as a port name.
-    @classmethod
-    def determine_full_port_name(cls, host, options, port_name):
-        return 'chromium-linux-x86_64'
-
-    def baseline_search_path(self):
-        paths = chromium_linux.ChromiumLinuxPort.baseline_search_path(self)
-        paths.insert(0, self._webkit_baseline_path('google-chrome-linux64'))
-        return paths
-
-    def expectations_files(self):
-        return _expectations_files(self, chromium_linux.ChromiumLinuxPort)
-
-    def architecture(self):
-        return 'x86_64'
-
-
-class GoogleChromeMacPort(chromium_mac.ChromiumMacPort):
-    port_name = 'google-chrome-mac'
-
-    # FIXME: Make google-chrome-XXX work as a port name.
-    @classmethod
-    def determine_full_port_name(cls, host, options, port_name):
-        return 'chromium-mac-snowleopard'
-
-    def baseline_search_path(self):
-        paths = chromium_mac.ChromiumMacPort.baseline_search_path(self)
-        paths.insert(0, self._webkit_baseline_path('google-chrome-mac'))
-        return paths
-
-    def expectations_files(self):
-        return _expectations_files(self, chromium_mac.ChromiumMacPort)
-
-
-class GoogleChromeWinPort(chromium_win.ChromiumWinPort):
-    port_name = 'google-chrome-win'
-
-    # FIXME: Make google-chrome-XXX work as a port name.
-    @classmethod
-    def determine_full_port_name(cls, host, options, port_name):
-        return 'chromium-win-win7'
-
-    def baseline_search_path(self):
-        paths = chromium_win.ChromiumWinPort.baseline_search_path(self)
-        paths.insert(0, self._webkit_baseline_path('google-chrome-win'))
-        return paths
-
-    def expectations_files(self):
-        return _expectations_files(self, chromium_win.ChromiumWinPort)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py
deleted file mode 100644
index 6d3c1a7dd..000000000
--- a/Tools/Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env python
-# Copyright (C) 2010 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-#
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-import unittest
-
-from webkitpy.common.system.systemhost_mock import MockSystemHost
-from webkitpy.layout_tests.port.factory import PortFactory
-
-
-class TestGoogleChromePort(unittest.TestCase):
-    def _verify_baseline_search_path_startswith(self, port_name, expected_platform_dirs):
-        port = PortFactory(MockSystemHost()).get(port_name=port_name)
-        actual_platform_dirs = [port._filesystem.basename(path) for path in port.baseline_search_path()]
-        self.assertEqual(expected_platform_dirs, actual_platform_dirs[0:len(expected_platform_dirs)])
-
-    def _verify_expectations_overrides(self, port_name):
-        host = MockSystemHost()
-        port = PortFactory(host).get(port_name=port_name, options=None)
-        self.assertTrue('TestExpectations' in port.expectations_files()[0])
-        self.assertTrue('skia_test_expectations.txt' in port.expectations_files()[1])
-        self.assertTrue('test_expectations_chrome.txt' in port.expectations_files()[-1])
-
-    def test_get_google_chrome_port(self):
-        self._verify_baseline_search_path_startswith('google-chrome-linux32', ['google-chrome-linux32', 'chromium-linux-x86'])
-        self._verify_baseline_search_path_startswith('google-chrome-linux64', ['google-chrome-linux64', 'chromium-linux'])
-        self._verify_baseline_search_path_startswith('google-chrome-mac', ['google-chrome-mac', 'chromium-mac-snowleopard'])
-        self._verify_baseline_search_path_startswith('google-chrome-win', ['google-chrome-win', 'chromium-win'])
-
-        self._verify_expectations_overrides('google-chrome-mac')
-        self._verify_expectations_overrides('google-chrome-win')
-        self._verify_expectations_overrides('google-chrome-linux32')
-        self._verify_expectations_overrides('google-chrome-linux64')
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/gtk.py b/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
index 26e1c84fb..6c59427f3 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/gtk.py
@@ -64,6 +64,7 @@ class GtkPort(WebKitPort, PulseAudioSanitizer):
         environment['AUDIO_RESOURCES_PATH'] = self._filesystem.join(self._config.webkit_base_dir(),
                                                                     'Source', 'WebCore', 'platform',
                                                                     'audio', 'resources')
+        self._copy_value_from_environ_if_set(environment, 'WEBKITOUTPUTDIR')
         if self.get_option('webkit_test_runner'):
             # FIXME: This is a workaround to ensure that testing with WebKitTestRunner is started with
             # a non-existing cache. This should be removed when (and if) it will be possible to properly
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac.py b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
index a3ec6a4b9..372ffb807 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac.py
@@ -65,6 +65,11 @@ class MacPort(ApplePort):
             # with MallocStackLogging enabled.
             self.set_option_default("batch_size", 1000)
 
+    def default_timeout_ms(self):
+        if self.get_option('guard_malloc'):
+            return 350 * 1000
+        return super(MacPort, self).default_timeout_ms()
+
     def _build_driver_flags(self):
         return ['ARCHS=i386'] if self.architecture() == 'x86' else []
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
index 2ebf255ae..bc7b0df44 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
@@ -45,6 +45,10 @@ class MacTest(port_testcase.PortTestCase):
         port = self.make_port(port_name=port_name, options=MockOptions(webkit_test_runner=use_webkit2))
         self.assertEqual(port._skipped_file_search_paths(), expected_paths)
 
+    def test_default_timeout_ms(self):
+        super(MacTest, self).test_default_timeout_ms()
+        self.assertEquals(self.make_port(options=MockOptions(guard_malloc=True)).default_timeout_ms(), 350000)
+
     def test_skipped_file_search_paths(self):
         self.assert_skipped_file_search_paths('mac-snowleopard', set(['mac-snowleopard', 'mac']))
         self.assert_skipped_file_search_paths('mac-leopard', set(['mac-leopard', 'mac']))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
index cc3dc7e63..a2106fdd9 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt.py
@@ -39,6 +39,7 @@ MockDRT to crash).
 
 import base64
 import logging
+import optparse
 import os
 import sys
 
@@ -51,7 +52,6 @@ if script_dir not in sys.path:
 from webkitpy.common.system.systemhost import SystemHost
 from webkitpy.layout_tests.port.driver import DriverInput, DriverOutput, DriverProxy
 from webkitpy.layout_tests.port.factory import PortFactory
-from webkitpy.tool.mocktool import MockOptions
 
 _log = logging.getLogger(__name__)
 
@@ -104,7 +104,7 @@ class MockDRTPort(object):
     def start_helper(self):
         pass
 
-    def start_http_server(self):
+    def start_http_server(self, number_of_servers):
         pass
 
     def start_websocket_server(self):
@@ -130,8 +130,8 @@ def main(argv, host, stdin, stdout, stderr):
     """Run the tests."""
 
     options, args = parse_options(argv)
-    if options.chromium:
-        drt = MockChromiumDRT(options, args, host, stdin, stdout, stderr)
+    if options.test_shell:
+        drt = MockTestShell(options, args, host, stdin, stdout, stderr)
     else:
         drt = MockDRT(options, args, host, stdin, stdout, stderr)
     return drt.run()
@@ -151,16 +151,15 @@ def parse_options(argv):
 
     pixel_tests = False
     pixel_path = None
-    chromium = False
-    if platform.startswith('chromium'):
-        chromium = True
+    test_shell = '--test-shell' in argv
+    if test_shell:
         for arg in argv:
             if arg.startswith('--pixel-tests'):
                 pixel_tests = True
                 pixel_path = arg[len('--pixel-tests='):]
     else:
         pixel_tests = '--pixel-tests' in argv
-    options = MockOptions(chromium=chromium, platform=platform, pixel_tests=pixel_tests, pixel_path=pixel_path)
+    options = optparse.Values({'test_shell': test_shell, 'platform': platform, 'pixel_tests': pixel_tests, 'pixel_path': pixel_path})
     return (options, argv)
 
 
@@ -255,7 +254,7 @@ class MockDRT(object):
         self._stderr.flush()
 
 
-class MockChromiumDRT(MockDRT):
+class MockTestShell(MockDRT):
     def input_from_line(self, line):
         vals = line.strip().split()
         if len(vals) == 3:
@@ -272,7 +271,7 @@ class MockChromiumDRT(MockDRT):
         original_test_name = test_input.test_name
         if '--enable-accelerated-2d-canvas' in self._args and 'canvas' in test_input.test_name:
             test_input.test_name = 'platform/chromium/virtual/gpu/' + test_input.test_name
-        output = super(MockChromiumDRT, self).output_for_test(test_input, is_reftest)
+        output = super(MockTestShell, self).output_for_test(test_input, is_reftest)
         test_input.test_name = original_test_name
         return output
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
index 570a9e4ad..1654e1c48 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/mock_drt_unittest.py
@@ -150,7 +150,7 @@ class MockDRTTest(unittest.TestCase):
         # We use the StringIO.buflist here instead of getvalue() because
         # the StringIO might be a mix of unicode/ascii and 8-bit strings.
         self.assertEqual(stdout.buflist, drt_output)
-        self.assertEqual(stderr.getvalue(), '' if options.chromium else '#EOF\n')
+        self.assertEqual(stderr.getvalue(), '' if options.test_shell else '#EOF\n')
 
     def test_main(self):
         host = MockSystemHost()
@@ -201,22 +201,21 @@ class MockDRTTest(unittest.TestCase):
         self.assertTest('passes/mismatch.html', True, expected_checksum='mock-checksum', expected_text='reference text\n')
 
 
-
-class MockChromiumDRTTest(MockDRTTest):
+class MockTestShellTest(MockDRTTest):
     def extra_args(self, pixel_tests):
         if pixel_tests:
             return ['--pixel-tests=/tmp/png_result0.png']
         return []
 
     def make_drt(self, options, args, host, stdin, stdout, stderr):
-        options.chromium = True
+        options.test_shell = True
 
         # We have to set these by hand because --platform test won't trigger
         # the Chromium code paths.
         options.pixel_path = '/tmp/png_result0.png'
         options.pixel_tests = True
 
-        return mock_drt.MockChromiumDRT(options, args, host, stdin, stdout, stderr)
+        return mock_drt.MockTestShell(options, args, host, stdin, stdout, stderr)
 
     def input_line(self, port, test_name, checksum=None):
         url = port.create_driver(0).test_to_uri(test_name)
@@ -251,10 +250,10 @@ class MockChromiumDRTTest(MockDRTTest):
         self.assertEquals(host.filesystem.written_files,
             {'/tmp/png_result0.png': 'image_checksum\x8a-pngtEXtchecksum\x00image_checksum-checksum'})
 
-    def test_chromium_parse_options(self):
-        options, args = mock_drt.parse_options(['--platform', 'chromium-mac',
+    def test_test_shell_parse_options(self):
+        options, args = mock_drt.parse_options(['--platform', 'chromium-mac', '--test-shell',
             '--pixel-tests=/tmp/png_result0.png'])
-        self.assertTrue(options.chromium)
+        self.assertTrue(options.test_shell)
         self.assertTrue(options.pixel_tests)
         self.assertEquals(options.pixel_path, '/tmp/png_result0.png')
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
index f37273f78..9f77832aa 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/port_testcase.py
@@ -62,6 +62,13 @@ class PortTestCase(unittest.TestCase):
         port_name = self.port_maker.determine_full_port_name(host, options, port_name)
         return self.port_maker(host, port_name, options=options, config=config, **kwargs)
 
+    def test_default_timeout_ms(self):
+        self.assertEquals(self.make_port(options=MockOptions(configuration='Release')).default_timeout_ms(), 35000)
+        self.assertEquals(self.make_port(options=MockOptions(configuration='Debug')).default_timeout_ms(), 35000)
+
+    def test_default_pixel_tests(self):
+        self.assertEquals(self.make_port().default_pixel_tests(), False)
+
     def test_driver_cmd_line(self):
         port = self.make_port()
         self.assertTrue(len(port.driver_cmd_line()))
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/qt.py b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
index 2488936fe..154cfdab8 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/qt.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/qt.py
@@ -106,7 +106,16 @@ class QtPort(WebKitPort):
             version = '4.8'
         return version
 
-    def baseline_search_path(self):
+    def _search_paths(self):
+        # Qt port uses same paths for baseline_search_path and _skipped_file_search_paths
+        #
+        # qt-5.0-wk1    qt-5.0-wk2
+        #            \/
+        #         qt-5.0    qt-4.8
+        #                \/
+        #    (qt-linux|qt-mac|qt-win)
+        #                |
+        #               qt
         search_paths = []
         version = self.qt_version()
         if '5.0' in version:
@@ -114,26 +123,27 @@ class QtPort(WebKitPort):
                 search_paths.append('qt-5.0-wk2')
             else:
                 search_paths.append('qt-5.0-wk1')
-        search_paths.append(self.name())
         if '4.8' in version:
             search_paths.append('qt-4.8')
         elif version:
             search_paths.append('qt-5.0')
+        search_paths.append(self.port_name + '-' + self.host.platform.os_name)
         search_paths.append(self.port_name)
-        return map(self._webkit_baseline_path, search_paths)
+        return search_paths
+
+    def baseline_search_path(self):
+        return map(self._webkit_baseline_path, self._search_paths())
 
     def _skipped_file_search_paths(self):
-        search_paths = set([self.port_name, self.name()])
-        version = self.qt_version()
-        if '4.8' in version:
-            search_paths.add('qt-4.8')
-        elif version:
-            search_paths.add('qt-5.0')
-            if self.get_option('webkit_test_runner'):
-                search_paths.update(['qt-5.0-wk2', 'wk2'])
-            else:
-                search_paths.add('qt-5.0-wk1')
-        return search_paths
+        skipped_path = self._search_paths()
+        if self.get_option('webkit_test_runner') and '5.0' in self.qt_version():
+            skipped_path.append('wk2')
+        return skipped_path
+
+    def expectations_files(self):
+        # expectations_files() uses the directories listed in _search_paths reversed.
+        # e.g. qt -> qt-linux -> qt-4.8
+        return list(reversed([self._filesystem.join(self._webkit_baseline_path(p), 'TestExpectations') for p in self._search_paths()]))
 
     def setup_environ_for_server(self, server_name=None):
         clean_env = WebKitPort.setup_environ_for_server(self, server_name)
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py
index 7252b9833..374b10270 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/qt_unittest.py
@@ -28,6 +28,7 @@
 
 import unittest
 import os
+from copy import deepcopy
 
 from webkitpy.common.system.executive_mock import MockExecutive, MockExecutive2
 from webkitpy.common.system.outputcapture import OutputCapture
@@ -40,8 +41,25 @@ from webkitpy.tool.mocktool import MockOptions
 class QtPortTest(port_testcase.PortTestCase):
     port_name = 'qt-mac'
     port_maker = QtPort
+    search_paths_cases = [
+        {'search_paths':['qt-4.8', 'qt-mac', 'qt'], 'os_name':'mac', 'use_webkit2':False, 'qt_version':'4.8'},
+        {'search_paths':['qt-4.8', 'qt-win', 'qt'], 'os_name':'win', 'use_webkit2':False, 'qt_version':'4.8'},
+        {'search_paths':['qt-4.8', 'qt-linux', 'qt'], 'os_name':'linux', 'use_webkit2':False, 'qt_version':'4.8'},
 
-    def _assert_search_path(self, search_paths, os_name=None, use_webkit2=False, qt_version='4.8'):
+        {'search_paths':['qt-4.8', 'qt-mac', 'qt'], 'os_name':'mac', 'use_webkit2':False},
+        {'search_paths':['qt-4.8', 'qt-win', 'qt'], 'os_name':'win', 'use_webkit2':False},
+        {'search_paths':['qt-4.8', 'qt-linux', 'qt'], 'os_name':'linux', 'use_webkit2':False},
+
+        {'search_paths':['qt-5.0-wk2', 'qt-5.0', 'qt-mac', 'qt'], 'os_name':'mac', 'use_webkit2':True, 'qt_version':'5.0'},
+        {'search_paths':['qt-5.0-wk2', 'qt-5.0', 'qt-win', 'qt'], 'os_name':'win', 'use_webkit2':True, 'qt_version':'5.0'},
+        {'search_paths':['qt-5.0-wk2', 'qt-5.0', 'qt-linux', 'qt'], 'os_name':'linux', 'use_webkit2':True, 'qt_version':'5.0'},
+
+        {'search_paths':['qt-5.0-wk1', 'qt-5.0', 'qt-mac', 'qt'], 'os_name':'mac', 'use_webkit2':False, 'qt_version':'5.0'},
+        {'search_paths':['qt-5.0-wk1', 'qt-5.0', 'qt-win', 'qt'], 'os_name':'win', 'use_webkit2':False, 'qt_version':'5.0'},
+        {'search_paths':['qt-5.0-wk1', 'qt-5.0', 'qt-linux', 'qt'], 'os_name':'linux', 'use_webkit2':False, 'qt_version':'5.0'},
+    ]
+
+    def _assert_search_path(self, search_paths, os_name, use_webkit2=False, qt_version='4.8'):
         # FIXME: Port constructors should not "parse" the port name, but
         # rather be passed components (directly or via setters).  Once
         # we fix that, this method will need a re-write.
@@ -53,6 +71,25 @@ class QtPortTest(port_testcase.PortTestCase):
         absolute_search_paths = map(port._webkit_baseline_path, search_paths)
         self.assertEquals(port.baseline_search_path(), absolute_search_paths)
 
+    def _assert_skipped_path(self, search_paths, os_name, use_webkit2=False, qt_version='4.8'):
+        host = MockSystemHost(os_name=os_name)
+        host.executive = MockExecutive2(self._qt_version(qt_version))
+        port_name = 'qt-' + os_name
+        port = self.make_port(host=host, qt_version=qt_version, port_name=port_name,
+                              options=MockOptions(webkit_test_runner=use_webkit2, platform='qt'))
+        self.assertEquals(port._skipped_file_search_paths(), search_paths)
+
+    def _assert_expectations_files(self, search_paths, os_name, use_webkit2=False, qt_version='4.8'):
+        # FIXME: Port constructors should not "parse" the port name, but
+        # rather be passed components (directly or via setters).  Once
+        # we fix that, this method will need a re-write.
+        host = MockSystemHost(os_name=os_name)
+        host.executive = MockExecutive2(self._qt_version(qt_version))
+        port_name = 'qt-' + os_name
+        port = self.make_port(host=host, qt_version=qt_version, port_name=port_name,
+                              options=MockOptions(webkit_test_runner=use_webkit2, platform='qt'))
+        self.assertEquals(port.expectations_files(), search_paths)
+
     def _qt_version(self, qt_version):
         if qt_version in '4.8':
             return 'QMake version 2.01a\nUsing Qt version 4.8.0 in /usr/local/Trolltech/Qt-4.8.2/lib'
@@ -60,21 +97,23 @@ class QtPortTest(port_testcase.PortTestCase):
             return 'QMake version 2.01a\nUsing Qt version 5.0.0 in /usr/local/Trolltech/Qt-5.0.0/lib'
 
     def test_baseline_search_path(self):
-        self._assert_search_path(['qt-mac', 'qt-4.8', 'qt'], 'mac', qt_version='4.8')
-        self._assert_search_path(['qt-win', 'qt-4.8', 'qt'], 'win', qt_version='4.8')
-        self._assert_search_path(['qt-linux', 'qt-4.8', 'qt'], 'linux', qt_version='4.8')
-
-        self._assert_search_path(['qt-mac', 'qt-4.8', 'qt'], 'mac')
-        self._assert_search_path(['qt-win', 'qt-4.8', 'qt'], 'win')
-        self._assert_search_path(['qt-linux', 'qt-4.8', 'qt'], 'linux')
-
-        self._assert_search_path(['qt-5.0-wk2', 'qt-mac', 'qt-5.0', 'qt'], 'mac', use_webkit2=True, qt_version='5.0')
-        self._assert_search_path(['qt-5.0-wk2', 'qt-win', 'qt-5.0', 'qt'], 'win', use_webkit2=True, qt_version='5.0')
-        self._assert_search_path(['qt-5.0-wk2', 'qt-linux', 'qt-5.0', 'qt'], 'linux', use_webkit2=True, qt_version='5.0')
-
-        self._assert_search_path(['qt-5.0-wk1', 'qt-mac', 'qt-5.0', 'qt'], 'mac', use_webkit2=False, qt_version='5.0')
-        self._assert_search_path(['qt-5.0-wk1', 'qt-win', 'qt-5.0', 'qt'], 'win', use_webkit2=False, qt_version='5.0')
-        self._assert_search_path(['qt-5.0-wk1', 'qt-linux', 'qt-5.0', 'qt'], 'linux', use_webkit2=False, qt_version='5.0')
+        for case in self.search_paths_cases:
+            self._assert_search_path(**case)
+
+    def test_skipped_file_search_path(self):
+        caselist = self.search_paths_cases[:]
+        for case in caselist:
+            if case['use_webkit2'] and case['qt_version'] == '5.0':
+                case['search_paths'].append("wk2")
+            self._assert_skipped_path(**case)
+
+    def test_expectations_files(self):
+        for case in self.search_paths_cases:
+            expectations_case = deepcopy(case)
+            expectations_case['search_paths'] = []
+            for path in reversed(case['search_paths']):
+                expectations_case['search_paths'].append('/mock-checkout/LayoutTests/platform/%s/TestExpectations' % (path))
+            self._assert_expectations_files(**expectations_case)
 
     def test_show_results_html_file(self):
         port = self.make_port()
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/test.py b/Tools/Scripts/webkitpy/layout_tests/port/test.py
index 2ca8ea4c3..9cf98de74 100644
--- a/Tools/Scripts/webkitpy/layout_tests/port/test.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/test.py
@@ -357,6 +357,9 @@ class TestPort(Port):
         }
         self._version = version_map[port_name]
 
+    def default_pixel_tests(self):
+        return True
+
     def _path_to_driver(self):
         # This routine shouldn't normally be called, but it is called by
         # the mock_drt Driver. We return something, but make sure it's useless.
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py b/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
index 2a1e6e819..fad6f7a5d 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/webkit.py
@@ -51,15 +51,6 @@ _log = logging.getLogger(__name__)
 
 
 class WebKitPort(Port):
-    def __init__(self, host, port_name=None, **kwargs):
-        Port.__init__(self, host, port_name=port_name, **kwargs)
-
-        # FIXME: Disable pixel tests until they are run by default on build.webkit.org.
-        self.set_option_default("pixel_tests", False)
-        # WebKit ports expect a 35s timeout, or 350s timeout when running with -g/--guard-malloc.
-        # FIXME: --guard-malloc is only supported on Mac, so this logic should be in mac.py.
-        default_time_out_seconds = 350 if self.get_option('guard_malloc') else 35
-        self.set_option_default("time_out_ms", default_time_out_seconds * 1000)
 
     def driver_name(self):
         if self.get_option('webkit_test_runner'):
@@ -264,15 +255,20 @@ class WebKitPort(Port):
     def nm_command(self):
         return 'nm'
 
-    def _webcore_symbols_string(self):
-        webcore_library_path = self._path_to_webcore_library()
-        if not webcore_library_path:
-            return None
-        try:
-            return self._executive.run_command([self.nm_command(), webcore_library_path], error_handler=Executive.ignore_error)
-        except OSError, e:
-            _log.warn("Failed to run nm: %s.  Can't determine WebCore supported features." % e)
-        return None
+    def _modules_to_search_for_symbols(self):
+        path = self._path_to_webcore_library()
+        if path:
+            return [path]
+        return []
+
+    def _symbols_string(self):
+        symbols = ''
+        for path_to_module in self._modules_to_search_for_symbols():
+            try:
+                symbols += self._executive.run_command([self.nm_command(), path_to_module], error_handler=Executive.ignore_error)
+            except OSError, e:
+                _log.warn("Failed to run nm: %s.  Can't determine supported features correctly." % e)
+        return symbols
 
     # Ports which use run-time feature detection should define this method and return
     # a dictionary mapping from Feature Names to skipped directoires.  NRWT will
@@ -302,7 +298,7 @@ class WebKitPort(Port):
             "WebCoreHas3DRendering": ["animations/3d", "transforms/3d"],
             "WebGLShader": ["fast/canvas/webgl", "compositing/webgl", "http/tests/canvas/webgl"],
             "MHTMLArchive": ["mhtml"],
-            "CSSVariableValue": ["fast/css/variables"],
+            "CSSVariableValue": ["fast/css/variables", "inspector/styles/variables"],
         }
 
     def _has_test_in_directories(self, directory_lists, test_list):
@@ -331,10 +327,10 @@ class WebKitPort(Port):
         # This is a performance optimization to avoid the calling nm.
         if self._has_test_in_directories(self._missing_symbol_to_skipped_tests().values(), test_list):
             # Runtime feature detection not supported, fallback to static dectection:
-            # Disable any tests for symbols missing from the webcore symbol string.
-            webcore_symbols_string = self._webcore_symbols_string()
-            if webcore_symbols_string is not None:
-                return reduce(operator.add, [directories for symbol_substring, directories in self._missing_symbol_to_skipped_tests().items() if symbol_substring not in webcore_symbols_string], [])
+            # Disable any tests for symbols missing from the executable or libraries.
+            symbols_string = self._symbols_string()
+            if symbols_string is not None:
+                return reduce(operator.add, [directories for symbol_substring, directories in self._missing_symbol_to_skipped_tests().items() if symbol_substring not in symbols_string], [])
 
         # Failed to get any runtime or symbol information, don't skip any tests.
         return []
diff --git a/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py b/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py
index f7e9525d6..cfec29b33 100755
--- a/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/port/webkit_unittest.py
@@ -53,7 +53,7 @@ class TestWebKitPort(WebKitPort):
     def all_test_configurations(self):
         return [self.test_configuration()]
 
-    def _webcore_symbols_string(self):
+    def _symbols_string(self):
         return self.symbols_string
 
     def _tests_for_other_platforms(self):
@@ -63,21 +63,6 @@ class TestWebKitPort(WebKitPort):
         return ["accessibility", ]
 
 
-class WebKitPortUnitTests(unittest.TestCase):
-    def test_default_options(self):
-        # The WebKit ports override new-run-webkit-test default options.
-        options = MockOptions(pixel_tests=None, time_out_ms=None)
-        port = WebKitPort(MockSystemHost(), options=options)
-        self.assertEquals(port._options.pixel_tests, False)
-        self.assertEquals(port._options.time_out_ms, 35000)
-
-        # Note that we don't override options if specified by the user.
-        options = MockOptions(pixel_tests=True, time_out_ms=6000)
-        port = WebKitPort(MockSystemHost(), options=options)
-        self.assertEquals(port._options.pixel_tests, True)
-        self.assertEquals(port._options.time_out_ms, 6000)
-
-
 class WebKitPortTest(port_testcase.PortTestCase):
     port_name = 'webkit'
     port_maker = TestWebKitPort
@@ -115,6 +100,7 @@ class WebKitPortTest(port_testcase.PortTestCase):
             "http/tests/canvas/webgl",  # Requires WebGLShader
             "mhtml",  # Requires MHTMLArchive
             "fast/css/variables",  # Requires CSS Variables
+            "inspector/styles/variables",  # Requires CSS Variables
         ])
 
         result_directories = set(TestWebKitPort(symbols_string, None)._skipped_tests_for_unsupported_features(test_list=['mathml/foo.html']))
@@ -127,7 +113,7 @@ class WebKitPortTest(port_testcase.PortTestCase):
 000000000124f670 s __ZZN7WebCore13GraphicsLayer13addChildBelowEPS0_S1_E19__PRETTY_FUNCTION__
 """
         # Note 'compositing' is not in the list of skipped directories (hence the parsing of GraphicsLayer worked):
-        expected_directories = set(['mathml', 'transforms/3d', 'compositing/webgl', 'fast/canvas/webgl', 'animations/3d', 'mhtml', 'http/tests/canvas/webgl', 'fast/css/variables'])
+        expected_directories = set(['mathml', 'transforms/3d', 'compositing/webgl', 'fast/canvas/webgl', 'animations/3d', 'mhtml', 'http/tests/canvas/webgl', 'fast/css/variables', 'inspector/styles/variables'])
         result_directories = set(TestWebKitPort(symbols_string, None)._skipped_tests_for_unsupported_features(test_list=['mathml/foo.html']))
         self.assertEqual(result_directories, expected_directories)
 
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
index 3d7b20f41..e3a13c20f 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
@@ -37,7 +37,8 @@ import signal
 import sys
 
 from webkitpy.common.host import Host
-from webkitpy.layout_tests.controllers.manager import Manager, WorkerException
+from webkitpy.common.system import stack_utils
+from webkitpy.layout_tests.controllers.manager import Manager, WorkerException, TestRunInterruptedException
 from webkitpy.layout_tests.models import test_expectations
 from webkitpy.layout_tests.port import port_options
 from webkitpy.layout_tests.views import printing
@@ -46,6 +47,14 @@ from webkitpy.layout_tests.views import printing
 _log = logging.getLogger(__name__)
 
 
+# This mirrors what the shell normally does.
+INTERRUPTED_EXIT_STATUS = signal.SIGINT + 128
+
+# This is a randomly chosen exit code that can be tested against to
+# indicate that an unexpected exception occurred.
+EXCEPTIONAL_EXIT_STATUS = 254
+
+
 def lint(port, options):
     host = port.host
     if options.platform:
@@ -119,6 +128,11 @@ def run(port, options, args, regular_output=sys.stderr, buildbot_output=sys.stdo
 
         unexpected_result_count = manager.run()
         _log.debug("Testing completed, Exit status: %d" % unexpected_result_count)
+    except Exception:
+        exception_type, exception_value, exception_traceback = sys.exc_info()
+        if exception_type not in (KeyboardInterrupt, TestRunInterruptedException, WorkerException):
+            stack_utils.log_traceback(_log.error, exception_traceback)
+        raise
     finally:
         printer.cleanup()
 
@@ -138,13 +152,10 @@ def _set_up_derived_options(port, options):
         options.configuration = port.default_configuration()
 
     if options.pixel_tests is None:
-        options.pixel_tests = True
+        options.pixel_tests = port.default_pixel_tests()
 
     if not options.time_out_ms:
-        if options.configuration == "Debug":
-            options.time_out_ms = str(2 * port.default_test_timeout_ms())
-        else:
-            options.time_out_ms = str(port.default_test_timeout_ms())
+        options.time_out_ms = str(port.default_timeout_ms())
 
     options.slow_time_out_ms = str(5 * int(options.time_out_ms))
 
@@ -436,8 +447,8 @@ def parse_args(args=None):
     return option_parser.parse_args(args)
 
 
-def main():
-    options, args = parse_args()
+def main(argv=None):
+    options, args = parse_args(argv)
     if options.platform and 'test' in options.platform:
         # It's a bit lame to import mocks into real code, but this allows the user
         # to run tests against the test platform interactively, which is useful for
@@ -446,7 +457,14 @@ def main():
         host = MockHost()
     else:
         host = Host()
-    port = host.port_factory.get(options.platform, options)
+
+    try:
+        port = host.port_factory.get(options.platform, options)
+    except NotImplementedError, e:
+        # FIXME: is this the best way to handle unsupported port names?
+        print >> sys.stderr, str(e)
+        return EXCEPTIONAL_EXIT_STATUS
+
     logging.getLogger().setLevel(logging.DEBUG if options.verbose else logging.INFO)
     return run(port, options, args)
 
@@ -454,12 +472,7 @@ def main():
 if '__main__' == __name__:
     try:
         sys.exit(main())
-    except KeyboardInterrupt:
-        # This mirrors what the shell normally does.
-        INTERRUPTED_EXIT_STATUS = signal.SIGINT + 128
-        sys.exit(INTERRUPTED_EXIT_STATUS)
-    except WorkerException:
-        # This is a randomly chosen exit code that can be tested against to
-        # indicate that an unexpected exception occurred.
-        EXCEPTIONAL_EXIT_STATUS = 254
+    except Exception, e:
+        if e.__class__ in (KeyboardInterrupt, TestRunInterruptedException):
+            sys.exit(INTERRUPTED_EXIT_STATUS)
         sys.exit(EXCEPTIONAL_EXIT_STATUS)
diff --git a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
index d5c1e14e1..c106fbf47 100755
--- a/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
+++ b/Tools/Scripts/webkitpy/layout_tests/run_webkit_tests_integrationtest.py
@@ -46,10 +46,12 @@ import unittest
 from webkitpy.common.system import outputcapture, path
 from webkitpy.common.system.crashlogs_unittest import make_mock_crash_report_darwin
 from webkitpy.common.system.systemhost import SystemHost
+from webkitpy.common.host import Host
 from webkitpy.common.host_mock import MockHost
 
 from webkitpy.layout_tests import port
 from webkitpy.layout_tests import run_webkit_tests
+from webkitpy.layout_tests.controllers.manager_worker_broker import WorkerException
 from webkitpy.layout_tests.port import Port
 from webkitpy.layout_tests.port.test import TestPort, TestDriver
 from webkitpy.test.skip import skip_if
@@ -81,18 +83,22 @@ def parse_args(extra_args=None, record_results=False, tests_included=False, new_
     return run_webkit_tests.parse_args(args)
 
 
-def passing_run(extra_args=None, port_obj=None, record_results=False, tests_included=False, host=None):
+def passing_run(extra_args=None, port_obj=None, record_results=False, tests_included=False, host=None, shared_port=True):
     options, parsed_args = parse_args(extra_args, record_results, tests_included)
     if not port_obj:
         host = host or MockHost()
         port_obj = host.port_factory.get(port_name=options.platform, options=options)
+
+    if shared_port:
+        port_obj.host.port_factory.get = lambda *args, **kwargs: port_obj
+
     buildbot_output = StringIO.StringIO()
     regular_output = StringIO.StringIO()
     res = run_webkit_tests.run(port_obj, options, parsed_args, buildbot_output=buildbot_output, regular_output=regular_output)
     return res == 0 and not regular_output.getvalue() and not buildbot_output.getvalue()
 
 
-def logging_run(extra_args=None, port_obj=None, record_results=False, tests_included=False, host=None, new_results=False):
+def logging_run(extra_args=None, port_obj=None, record_results=False, tests_included=False, host=None, new_results=False, shared_port=True):
     options, parsed_args = parse_args(extra_args=extra_args,
                                       record_results=record_results,
                                       tests_included=tests_included,
@@ -101,11 +107,13 @@ def logging_run(extra_args=None, port_obj=None, record_results=False, tests_incl
     if not port_obj:
         port_obj = host.port_factory.get(port_name=options.platform, options=options)
 
-    res, buildbot_output, regular_output = run_and_capture(port_obj, options, parsed_args)
+    res, buildbot_output, regular_output = run_and_capture(port_obj, options, parsed_args, shared_port)
     return (res, buildbot_output, regular_output, host.user)
 
 
-def run_and_capture(port_obj, options, parsed_args):
+def run_and_capture(port_obj, options, parsed_args, shared_port=True):
+    if shared_port:
+        port_obj.host.port_factory.get = lambda *args, **kwargs: port_obj
     oc = outputcapture.OutputCapture()
     try:
         oc.capture_output()
@@ -302,14 +310,14 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
     def test_child_processes_2(self):
         if self.should_test_processes:
             _, _, regular_output, _ = logging_run(
-                ['--print', 'config', '--child-processes', '2'])
+                ['--print', 'config', '--child-processes', '2'], shared_port=False)
             self.assertTrue(any(['Running 2 ' in line for line in regular_output.buflist]))
 
     def test_child_processes_min(self):
         if self.should_test_processes:
             _, _, regular_output, _ = logging_run(
                 ['--print', 'config', '--child-processes', '2', 'passes'],
-                tests_included=True)
+                tests_included=True, shared_port=False)
             self.assertTrue(any(['Running 1 ' in line for line in regular_output.buflist]))
 
     def test_dryrun(self):
@@ -333,8 +341,8 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
             ['failures/expected/exception.html', '--child-processes', '1'], tests_included=True)
 
         if self.should_test_processes:
-            self.assertRaises(run_webkit_tests.WorkerException, logging_run,
-                ['--child-processes', '2', '--force', 'failures/expected/exception.html', 'passes/text.html'], tests_included=True)
+            self.assertRaises(WorkerException, logging_run,
+                ['--child-processes', '2', '--force', 'failures/expected/exception.html', 'passes/text.html'], tests_included=True, shared_port=False)
 
     def test_full_results_html(self):
         # FIXME: verify html?
@@ -364,7 +372,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
 
         if self.should_test_processes:
             self.assertRaises(KeyboardInterrupt, logging_run,
-                ['failures/expected/keyboard.html', 'passes/text.html', '--child-processes', '2', '--force'], tests_included=True)
+                ['failures/expected/keyboard.html', 'passes/text.html', '--child-processes', '2', '--force'], tests_included=True, shared_port=False)
 
     def test_no_tests_found(self):
         res, out, err, user = logging_run(['resources'], tests_included=True)
@@ -754,6 +762,7 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
 
         # Now we test that --clobber-old-results does remove the old entries and the old retries,
         # and that we don't retry again.
+        host = MockHost()
         res, out, err, _ = logging_run(['--no-retry-failures', '--clobber-old-results', 'failures/flaky'], tests_included=True, host=host)
         self.assertEquals(res, 1)
         self.assertTrue('Clobbering old results' in err.getvalue())
@@ -763,22 +772,16 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         self.assertTrue(host.filesystem.exists('/tmp/layout-test-results/failures/flaky/text-actual.txt'))
         self.assertFalse(host.filesystem.exists('retries'))
 
-
-    # These next tests test that we run the tests in ascending alphabetical
-    # order per directory. HTTP tests are sharded separately from other tests,
-    # so we have to test both.
-    def assert_run_order(self, child_processes='1'):
-        tests_run = get_tests_run(['--child-processes', child_processes, 'passes'],
-            tests_included=True, flatten_batches=True)
+    def test_run_order__inline(self):
+        # These next tests test that we run the tests in ascending alphabetical
+        # order per directory. HTTP tests are sharded separately from other tests,
+        # so we have to test both.
+        tests_run = get_tests_run(['passes'], tests_included=True, flatten_batches=True)
         self.assertEquals(tests_run, sorted(tests_run))
 
-        tests_run = get_tests_run(['--child-processes', child_processes, 'http/tests/passes'],
-            tests_included=True, flatten_batches=True)
+        tests_run = get_tests_run(['http/tests/passes'], tests_included=True, flatten_batches=True)
         self.assertEquals(tests_run, sorted(tests_run))
 
-    def test_run_order__inline(self):
-        self.assert_run_order()
-
     def test_tolerance(self):
         class ImageDiffTestPort(TestPort):
             def diff_image(self, expected_contents, actual_contents, tolerance=None):
@@ -901,6 +904,20 @@ class MainTest(unittest.TestCase, StreamTestingMixin):
         self.assertEquals(full_results['has_wdiff'], False)
         self.assertEquals(full_results['has_pretty_patch'], False)
 
+    def test_unsupported_platform(self):
+        oc = outputcapture.OutputCapture()
+        try:
+            oc.capture_output()
+            res = run_webkit_tests.main(['--platform', 'foo'])
+        finally:
+            stdout, stderr, logs = oc.restore_output()
+
+        self.assertEquals(res, run_webkit_tests.EXCEPTIONAL_EXIT_STATUS)
+        self.assertEquals(stdout, '')
+        self.assertTrue('unsupported platform' in stderr)
+
+        # This is empty because we don't even get a chance to configure the logger before failing.
+        self.assertEquals(logs, '')
 
 class EndToEndTest(unittest.TestCase):
     def parse_full_results(self, full_results_text):
@@ -1009,5 +1026,21 @@ class RebaselineTest(unittest.TestCase, StreamTestingMixin):
             "platform/test-mac-leopard/failures/expected/missing_image", [".txt", ".png"], err)
 
 
+class PortTest(unittest.TestCase):
+    def assert_mock_port_works(self, port_name, args=[]):
+        self.assertTrue(passing_run(args + ['--platform', 'mock-' + port_name, 'fast/harness/results.html'], tests_included=True, host=Host()))
+
+    def disabled_test_chromium_mac_lion(self):
+        self.assert_mock_port_works('chromium-mac-lion')
+
+    def disabled_test_chromium_mac_lion_in_test_shell_mode(self):
+        self.assert_mock_port_works('chromium-mac-lion', args=['--additional-drt-flag=--test-shell'])
+
+    def disabled_test_qt_linux(self):
+        self.assert_mock_port_works('qt-linux')
+
+    def disabled_test_mac_lion(self):
+        self.assert_mock_port_works('mac-lion')
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
index 814437780..ec73a93ac 100644
--- a/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
+++ b/Tools/Scripts/webkitpy/layout_tests/views/metered_stream.py
@@ -58,7 +58,6 @@ class MeteredStream(object):
         self._verbose = verbose
         self._time_fn = time_fn or time.time
         self._pid = pid or os.getpid()
-
         self._isatty = self._stream.isatty()
         self._erasing = self._isatty and not verbose
         self._last_partial_line = ''
@@ -128,4 +127,4 @@ class _LogHandler(logging.Handler):
         self.name = LOG_HANDLER_NAME
 
     def emit(self, record):
-        self._meter.writeln(record.getMessage(), record.created)
+        self._meter.writeln(record.getMessage(), record.created, record.process)
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftest.py b/Tools/Scripts/webkitpy/performance_tests/perftest.py
index f76d85b1b..de63f3e8d 100644
--- a/Tools/Scripts/webkitpy/performance_tests/perftest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftest.py
@@ -40,7 +40,7 @@ import sys
 import time
 
 # Import for auto-install
-if sys.platform != 'win32':
+if sys.platform not in ('cygwin', 'win32'):
     # FIXME: webpagereplay doesn't work on win32. See https://bugs.webkit.org/show_bug.cgi?id=88279.
     import webkitpy.thirdparty.autoinstalled.webpagereplay.replay
 
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
index 9a3757128..ab4386443 100644..100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner.py
@@ -85,6 +85,8 @@ class PerfTestsRunner(object):
                 help=("The build number of the builder running this script.")),
             optparse.make_option("--build", dest="build", action="store_true", default=True,
                 help="Check to ensure the DumpRenderTree build is up-to-date (default)."),
+            optparse.make_option("--no-build", dest="build", action="store_false",
+                help="Don't check to see if the DumpRenderTree build is up-to-date."),
             optparse.make_option("--build-directory",
                 help="Path to the directory under which build files are kept (should not include configuration)"),
             optparse.make_option("--time-out-ms", default=600 * 1000,
@@ -101,6 +103,8 @@ class PerfTestsRunner(object):
                 help="Use WebKitTestRunner rather than DumpRenderTree."),
             optparse.make_option("--replay", dest="replay", action="store_true", default=False,
                 help="Run replay tests."),
+            optparse.make_option("--force", dest="skipped", action="store_true", default=False,
+                help="Run all tests, including the ones in the Skipped list."),
             ]
         return optparse.OptionParser(option_list=(perf_option_list)).parse_args(args)
 
@@ -128,7 +132,7 @@ class PerfTestsRunner(object):
         tests = []
         for path in test_files:
             relative_path = self._port.relative_perf_test_filename(path).replace('\\', '/')
-            if self._port.skips_perf_test(relative_path):
+            if self._port.skips_perf_test(relative_path) and not self._options.skipped:
                 continue
             test = PerfTestFactory.create_perf_test(self._port, relative_path, path)
             tests.append(test)
diff --git a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
index 8e1eb57ff..de3528cb1 100755
--- a/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
+++ b/Tools/Scripts/webkitpy/performance_tests/perftestsrunner_unittest.py
@@ -397,6 +397,17 @@ max 1120
         port.skipped_perf_tests = lambda: ['inspector/unsupported_test1.html', 'unsupported']
         self.assertEqual(self._collect_tests_and_sort_test_name(runner), ['inspector/test1.html', 'inspector/test2.html'])
 
+    def test_collect_tests_with_skipped_list(self):
+        runner, port = self.create_runner(args=['--force'])
+
+        self._add_file(runner, 'inspector', 'test1.html')
+        self._add_file(runner, 'inspector', 'unsupported_test1.html')
+        self._add_file(runner, 'inspector', 'test2.html')
+        self._add_file(runner, 'inspector/resources', 'resource_file.html')
+        self._add_file(runner, 'unsupported', 'unsupported_test2.html')
+        port.skipped_perf_tests = lambda: ['inspector/unsupported_test1.html', 'unsupported']
+        self.assertEqual(self._collect_tests_and_sort_test_name(runner), ['inspector/test1.html', 'inspector/test2.html', 'inspector/unsupported_test1.html', 'unsupported/unsupported_test2.html'])
+
     def test_collect_tests_with_page_load_svg(self):
         runner, port = self.create_runner()
         self._add_file(runner, 'PageLoad', 'some-svg-test.svg')
diff --git a/Tools/Scripts/webkitpy/pylintrc b/Tools/Scripts/webkitpy/pylintrc
new file mode 100644
index 000000000..dae778d63
--- /dev/null
+++ b/Tools/Scripts/webkitpy/pylintrc
@@ -0,0 +1,309 @@
+# Copyright (c) 2012 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[MASTER]
+
+# Specify a configuration file.
+#rcfile=
+
+# Python code to execute, usually for sys.path manipulation such as
+# pygtk.require().
+#init-hook=
+
+# Profiled execution.
+profile=no
+
+# Add files or directories to the blacklist. They should be base names, not
+# paths.
+ignore=CVS
+
+# Pickle collected data for later comparisons.
+persistent=yes
+
+# List of plugins (as comma separated values of python modules names) to load,
+# usually to register additional checkers.
+load-plugins=
+
+
+[MESSAGES CONTROL]
+
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time.
+#enable=
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifier separated by comma (,) or put this option
+# multiple time (only on the command line, not in the configuration file where
+# it should appear only once).
+# CHANGED:
+# C0103: Invalid name ""
+# C0111: Missing docstring
+# C0302: Too many lines in module (N)
+# I0010: Unable to consider inline option ''
+# I0011: Locally disabling WNNNN
+#
+# R0201: Method could be a function
+# R0801: Similar lines in N files
+# R0901: Too many ancestors (8/7)
+# R0902: Too many instance attributes (N/7)
+# R0903: Too few public methods (N/2)
+# R0904: Too many public methods (N/20)
+# R0911: Too many return statements (N/6)
+# R0912: Too many branches (N/12)
+# R0913: Too many arguments (N/5)
+# R0914: Too many local variables (N/15)
+# R0915: Too many statements (N/50)
+# R0921: Abstract class not referenced
+# R0922: Abstract class is only referenced 1 times
+# W0122: Use of the exec statement
+# W0141: Used builtin function ''
+# W0212: Access to a protected member X of a client class
+# W0142: Used * or ** magic
+# W0402: Uses of a deprecated module 'string'
+# W0404: 41: Reimport 'XX' (imported line NN)
+# W0511: TODO
+# W0603: Using the global statement
+# W0703: Catch "Exception"
+# W1201: Specify string format arguments as logging function parameters
+disable=C0103,C0111,C0302,I0010,I0011,R0201,R0801,R0901,R0902,R0903,R0904,R0911,R0912,R0913,R0914,R0915,R0921,R0922,W0122,W0141,W0142,W0212,W0402,W0404,W0511,W0603,W0703,W1201
+
+
+[REPORTS]
+
+# Set the output format. Available formats are text, parseable, colorized, msvs
+# (visual studio) and html
+output-format=text
+
+# Include message's id in output
+include-ids=yes
+
+# Put messages in a separate file for each module / package specified on the
+# command line instead of printing them on stdout. Reports (if any) will be
+# written in a file name "pylint_global.[txt|html]".
+files-output=no
+
+# Tells whether to display a full report or only the messages
+# CHANGED:
+reports=no
+
+# Python expression which should return a note less than 10 (10 is the highest
+# note). You have access to the variables errors warning, statement which
+# respectively contain the number of errors / warnings messages and the total
+# number of statements analyzed. This is used by the global evaluation report
+# (RP0004).
+evaluation=10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10)
+
+# Add a comment according to your evaluation note. This is used by the global
+# evaluation report (RP0004).
+comment=no
+
+
+[VARIABLES]
+
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
+
+# A regular expression matching the beginning of the name of dummy variables
+# (i.e. not used).
+dummy-variables-rgx=_|dummy
+
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid to define new builtins when possible.
+additional-builtins=
+
+
+[TYPECHECK]
+
+# Tells whether missing members accessed in mixin class should be ignored. A
+# mixin class is detected if its name ends with "mixin" (case insensitive).
+ignore-mixin-members=yes
+
+# List of classes names for which member attributes should not be checked
+# (useful for classes with attributes dynamically set).
+ignored-classes=SQLObject,twisted.internet.reactor,hashlib,google.appengine.api.memcache
+
+# When zope mode is activated, add a predefined set of Zope acquired attributes
+# to generated-members.
+zope=no
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E0201 when accessed. Python regular
+# expressions are accepted.
+generated-members=REQUEST,acl_users,aq_parent
+
+
+[MISCELLANEOUS]
+
+# List of note tags to take in consideration, separated by a comma.
+notes=FIXME,XXX,TODO
+
+
+[SIMILARITIES]
+
+# Minimum lines number of a similarity.
+min-similarity-lines=4
+
+# Ignore comments when computing similarities.
+ignore-comments=yes
+
+# Ignore docstrings when computing similarities.
+ignore-docstrings=yes
+
+
+[FORMAT]
+
+# Maximum number of characters on a single line.
+max-line-length=200
+
+# Maximum number of lines in a module
+max-module-lines=1000
+
+# String used as indentation unit. This is usually " " (4 spaces) or "\t" (1
+# tab).
+# CHANGED:
+indent-string='    '
+
+
+[BASIC]
+
+# Required attributes for module, separated by a comma
+required-attributes=
+
+# List of builtins function names that should not be used, separated by a comma
+bad-functions=map,filter,apply,input
+
+# Regular expression which should only match correct module names
+module-rgx=(([a-z_][a-z0-9_]*)|([A-Z][a-zA-Z0-9]+))$
+
+# Regular expression which should only match correct module level names
+const-rgx=(([A-Z_][A-Z0-9_]*)|(__.*__))$
+
+# Regular expression which should only match correct class names
+class-rgx=[A-Z_][a-zA-Z0-9]+$
+
+# Regular expression which should only match correct function names
+function-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression which should only match correct method names
+method-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression which should only match correct instance attribute names
+attr-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression which should only match correct argument names
+argument-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression which should only match correct variable names
+variable-rgx=[a-z_][a-z0-9_]{2,30}$
+
+# Regular expression which should only match correct list comprehension /
+# generator expression variable names
+inlinevar-rgx=[A-Za-z_][A-Za-z0-9_]*$
+
+# Good variable names which should always be accepted, separated by a comma
+good-names=i,j,k,ex,Run,_
+
+# Bad variable names which should always be refused, separated by a comma
+bad-names=foo,bar,baz,toto,tutu,tata
+
+# Regular expression which should only match functions or classes name which do
+# not require a docstring
+no-docstring-rgx=__.*__
+
+
+[DESIGN]
+
+# Maximum number of arguments for function / method
+max-args=5
+
+# Argument names that match this expression will be ignored. Default to name
+# with leading underscore
+ignored-argument-names=_.*
+
+# Maximum number of locals for function / method body
+max-locals=15
+
+# Maximum number of return / yield for function / method body
+max-returns=6
+
+# Maximum number of branch for function / method body
+max-branchs=12
+
+# Maximum number of statements in function / method body
+max-statements=50
+
+# Maximum number of parents for a class (see R0901).
+max-parents=7
+
+# Maximum number of attributes for a class (see R0902).
+max-attributes=7
+
+# Minimum number of public methods for a class (see R0903).
+min-public-methods=2
+
+# Maximum number of public methods for a class (see R0904).
+max-public-methods=20
+
+
+[CLASSES]
+
+# List of interface methods to ignore, separated by a comma. This is used for
+# instance to not check methods defines in Zope's Interface base class.
+ignore-iface-methods=isImplementedBy,deferred,extends,names,namesAndDescriptions,queryDescriptionFor,getBases,getDescriptionFor,getDoc,getName,getTaggedValue,getTaggedValueTags,isEqualOrExtendedBy,setTaggedValue,isImplementedByInstancesOf,adaptWith,is_implemented_by
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,__new__,setUp
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls
+
+
+[IMPORTS]
+
+# Deprecated modules which should not be used, separated by a comma
+deprecated-modules=regsub,string,TERMIOS,Bastion,rexec
+
+# Create a graph of every (i.e. internal and external) dependencies in the
+# given file (report RP0402 must not be disabled)
+import-graph=
+
+# Create a graph of external dependencies in the given file (report RP0402 must
+# not be disabled)
+ext-import-graph=
+
+# Create a graph of internal dependencies in the given file (report RP0402 must
+# not be disabled)
+int-import-graph=
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when being caught. Defaults to
+# "Exception"
+overgeneral-exceptions=Exception
diff --git a/Tools/Scripts/webkitpy/style/checker.py b/Tools/Scripts/webkitpy/style/checker.py
index dff790ec1..8cd8745bf 100644
--- a/Tools/Scripts/webkitpy/style/checker.py
+++ b/Tools/Scripts/webkitpy/style/checker.py
@@ -152,7 +152,8 @@ _PATH_RULES_SPECIFIER = [
       "-whitespace/declaration"]),
 
      ([# Qt's MiniBrowser has no config.h
-       "Tools/MiniBrowser/qt"],
+       "Tools/MiniBrowser/qt",
+       "Tools/MiniBrowser/qt/raw"],
       ["-build/include"]),
 
     ([# The Qt APIs use Qt/QML naming style, which includes
diff --git a/Tools/Scripts/webkitpy/style/checkers/png.py b/Tools/Scripts/webkitpy/style/checkers/png.py
index 30b7a1439..430d6f0a0 100644
--- a/Tools/Scripts/webkitpy/style/checkers/png.py
+++ b/Tools/Scripts/webkitpy/style/checkers/png.py
@@ -27,6 +27,7 @@
 import os
 import re
 
+from webkitpy.common import checksvnconfigfile
 from webkitpy.common import read_checksum_from_png
 from webkitpy.common.system.systemhost import SystemHost
 from webkitpy.common.checkout.scm.detection import SCMDetector
@@ -54,49 +55,21 @@ class PNGChecker(object):
                     self._handle_style_error(0, 'image/png', 5, "Image lacks a checksum. Generate pngs using run-webkit-tests to ensure they have a checksum.")
 
         if detection == "git":
-            config_file_path = self._config_file_path()
-            there_is_enable_line = False
-            there_is_png_line = False
-
-            try:
-                config_file = self._fs.read_text_file(config_file_path)
-            except IOError:
-                errorstr = "There is no " + config_file_path
-                self._handle_style_error(0, 'image/png', 5, errorstr)
-                return
-
-            errorstr_autoprop = "Have to enable auto props in the subversion config file (" + config_file_path + " \"enable-auto-props = yes\"). "
-            errorstr_png = "Have to set the svn:mime-type in the subversion config file (" + config_file_path + " \"*.png = svn:mime-type=image/png\")."
-
-            for line in config_file.split('\n'):
-                if not there_is_enable_line:
-                    match = re.search("^\s*enable-auto-props\s*=\s*yes", line)
-                    if match:
-                        there_is_enable_line = True
-                        errorstr_autoprop = ""
-                        continue
-
-                if not there_is_png_line:
-                    match = re.search("^\s*\*\.png\s*=\s*svn:mime-type=image/png", line)
-                    if match:
-                        there_is_png_line = True
-                        errorstr_png = ""
-                        continue
-
-            errorstr = errorstr_autoprop + errorstr_png
-            if errorstr:
-                self._handle_style_error(0, 'image/png', 5, errorstr)
+            (file_missing, autoprop_missing, png_missing) = checksvnconfigfile.check(self._host, self._fs)
+            config_file_path = checksvnconfigfile.config_file_path(self._host, self._fs)
+
+            if file_missing:
+                self._handle_style_error(0, 'image/png', 5, "There is no SVN config file. (%s)" % config_file_path)
+            elif autoprop_missing and png_missing:
+                self._handle_style_error(0, 'image/png', 5, checksvnconfigfile.errorstr_autoprop(config_file_path) + checksvnconfigfile.errorstr_png(config_file_path))
+            elif autoprop_missing:
+                self._handle_style_error(0, 'image/png', 5, checksvnconfigfile.errorstr_autoprop(config_file_path))
+            elif png_missing:
+                self._handle_style_error(0, 'image/png', 5, checksvnconfigfile.errorstr_png(config_file_path))
 
         elif detection == "svn":
             prop_get = self._detector.propget("svn:mime-type", self._file_path)
             if prop_get != "image/png":
-                errorstr = "Set the svn:mime-type property (svn propset svn:mime-type image/png " + self._file_path + ")."
+                errorstr = "Set the svn:mime-type property (svn propset svn:mime-type image/png %s)." % self._file_path
                 self._handle_style_error(0, 'image/png', 5, errorstr)
 
-    def _config_file_path(self):
-        config_file = ""
-        if self._host.platform.is_win():
-            config_file_path = self._fs.join(os.environ['APPDATA'], "Subversion\config")
-        else:
-            config_file_path = self._fs.join(self._fs.expanduser("~"), ".subversion/config")
-        return config_file_path
diff --git a/Tools/Scripts/webkitpy/thirdparty/__init__.py b/Tools/Scripts/webkitpy/thirdparty/__init__.py
index 078e18041..b1edd4d0b 100644
--- a/Tools/Scripts/webkitpy/thirdparty/__init__.py
+++ b/Tools/Scripts/webkitpy/thirdparty/__init__.py
@@ -74,6 +74,8 @@ class AutoinstallImportHook(object):
             self._install_mechanize()
         elif '.pep8' in fullname:
             self._install_pep8()
+        elif '.pylint' in fullname:
+            self._install_pylint()
         elif '.coverage' in fullname:
             self._install_coverage()
         elif '.eliza' in fullname:
@@ -93,6 +95,12 @@ class AutoinstallImportHook(object):
         self._install("http://pypi.python.org/packages/source/p/pep8/pep8-0.5.0.tar.gz#md5=512a818af9979290cd619cce8e9c2e2b",
                       "pep8-0.5.0/pep8.py")
 
+    def _install_pylint(self):
+        if not self._fs.exists(self._fs.join(_AUTOINSTALLED_DIR, "pylint")):
+            self._install('http://pypi.python.org/packages/source/p/pylint/pylint-0.25.1.tar.gz#md5=728bbc2b339bc3749af013709a7f87a5', 'pylint-0.25.1')
+            self._fs.move(self._fs.join(_AUTOINSTALLED_DIR, "pylint-0.25.1"), self._fs.join(_AUTOINSTALLED_DIR, "pylint"))
+
+
     # autoinstalled.buildbot is used by BuildSlaveSupport/build.webkit.org-config/mastercfg_unittest.py
     # and should ideally match the version of BuildBot used at build.webkit.org.
     def _install_buildbot(self):
diff --git a/Tools/Scripts/webkitpy/tool/commands/download.py b/Tools/Scripts/webkitpy/tool/commands/download.py
index 4f6b7370e..60c89208f 100644
--- a/Tools/Scripts/webkitpy/tool/commands/download.py
+++ b/Tools/Scripts/webkitpy/tool/commands/download.py
@@ -90,6 +90,7 @@ class Land(AbstractSequencedCommand):
     argument_names = "[BUGID]"
     show_in_main_help = True
     steps = [
+        steps.AddSvnMimetypeForPng,
         steps.UpdateChangeLogsWithReviewer,
         steps.ValidateReviewer,
         steps.ValidateChangeLogs, # We do this after UpdateChangeLogsWithReviewer to avoid not having to cache the diff twice.
diff --git a/Tools/Scripts/webkitpy/tool/commands/download_unittest.py b/Tools/Scripts/webkitpy/tool/commands/download_unittest.py
index 7f19fbd7a..79b729aad 100644
--- a/Tools/Scripts/webkitpy/tool/commands/download_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/download_unittest.py
@@ -136,7 +136,7 @@ MockWatchList: determine_cc_and_messages
     def test_land_cowboy(self):
         expected_stderr = """MOCK run_and_throw_if_fail: ['mock-prepare-ChangeLog', '--email=MOCK email', '--merge-base=None', 'MockFile1'], cwd=/mock-checkout
 MOCK run_and_throw_if_fail: ['mock-check-webkit-style', '--git-commit', 'MOCK git commit', '--diff-files', 'MockFile1', '--filter', '-changelog'], cwd=/mock-checkout
-MOCK run_command: ['ruby', '-I', '/mock-checkout/Websites/bugs.webkit.org/PrettyPatch', '/mock-checkout/Websites/bugs.webkit.org/PrettyPatch/prettify.rb'], cwd=None
+MOCK run_command: ['ruby', '-I', '/mock-checkout/Websites/bugs.webkit.org/PrettyPatch', '/mock-checkout/Websites/bugs.webkit.org/PrettyPatch/prettify.rb'], cwd=None, input=Patch1
 MOCK: user.open_url: file://...
 Was that diff correct?
 Building WebKit
diff --git a/Tools/Scripts/webkitpy/tool/commands/rebaseline.py b/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
index bd890cc8e..cb7254ba2 100644
--- a/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
+++ b/Tools/Scripts/webkitpy/tool/commands/rebaseline.py
@@ -32,6 +32,7 @@ import optparse
 import os.path
 import re
 import shutil
+import sys
 import urllib
 
 import webkitpy.common.config.urls as config_urls
@@ -67,26 +68,27 @@ class AbstractRebaseliningCommand(AbstractDeclarativeCommand):
 
 
 class RebaselineTest(AbstractRebaseliningCommand):
-    name = "rebaseline-test"
-    help_text = "Rebaseline a single test from a buildbot.  (Currently works only with build.chromium.org buildbots.)"
-    argument_names = "BUILDER_NAME TEST_NAME [PLATFORMS_TO_MOVE_EXISTING_BASELINES_TO]"
+    name = "rebaseline-test-internal"
+    help_text = "Rebaseline a single test from a buildbot. Only intended for use by other webkit-patch commands."
 
     def __init__(self):
         options = [
-            optparse.make_option("--print-scm-changes", action="store_true", help="Print modifcations to the scm (as a json dict) rather than actually modifying the scm"),
+            optparse.make_option("--builder", help="Builder to pull new baselines from"),
+            optparse.make_option("--platform-to-move-to", help="Platform to move existing baselines to before rebaselining. This is for dealing with bringing up new ports that interact with non-tree portions of the fallback graph."),
+            optparse.make_option("--test", help="Test to rebaseline"),
         ]
         AbstractRebaseliningCommand.__init__(self, options=options)
-        self._print_scm_changes = False
-        self._scm_changes = {}
+        self._scm_changes = {'add': []}
 
     def _results_url(self, builder_name):
-        # FIXME: Generalize this command to work with non-build.chromium.org builders.
-        builder = self._tool.chromium_buildbot().builder_with_name(builder_name)
-        return builder.accumulated_results_url()
+        return self._tool.buildbot_for_builder_name(builder_name).builder_with_name(builder_name).latest_layout_test_results_url()
 
     def _baseline_directory(self, builder_name):
         port = self._tool.port_factory.get_from_builder_name(builder_name)
-        return port.baseline_path()
+        override_dir = builders.rebaseline_override_dir(builder_name)
+        if override_dir:
+            return self._tool.filesystem.join(port.layout_tests_dir(), 'platform', override_dir)
+        return port.baseline_version_dir()
 
     def _copy_existing_baseline(self, platforms_to_move_existing_baselines_to, test_name, suffix):
         old_baselines = []
@@ -129,10 +131,7 @@ class RebaselineTest(AbstractRebaseliningCommand):
             self._add_to_scm(target_baseline)
 
     def _add_to_scm(self, path):
-        if self._print_scm_changes:
-            self._scm_changes['add'].append(path)
-        else:
-            self._tool.scm().add(path)
+        self._scm_changes['add'].append(path)
 
     def _update_expectations_file(self, builder_name, test_name):
         port = self._tool.port_factory.get_from_builder_name(builder_name)
@@ -173,16 +172,8 @@ class RebaselineTest(AbstractRebaseliningCommand):
 
     def execute(self, options, args, tool):
         self._baseline_suffix_list = options.suffixes.split(',')
-        self._print_scm_changes = options.print_scm_changes
-        self._scm_changes = {'add': [], 'delete': []}
-
-        if len(args) > 2:
-            platforms_to_move_existing_baselines_to = args[2:]
-        else:
-            platforms_to_move_existing_baselines_to = None
-        self._rebaseline_test_and_update_expectations(args[0], args[1], platforms_to_move_existing_baselines_to)
-        if self._print_scm_changes:
-            print json.dumps(self._scm_changes)
+        self._rebaseline_test_and_update_expectations(options.builder, options.test, options.platform_to_move_to)
+        print json.dumps(self._scm_changes)
 
 
 class OptimizeBaselines(AbstractRebaseliningCommand):
@@ -233,32 +224,103 @@ class AnalyzeBaselines(AbstractRebaseliningCommand):
             self._analyze_baseline(test_name)
 
 
-class RebaselineExpectations(AbstractDeclarativeCommand):
-    name = "rebaseline-expectations"
-    help_text = "Rebaselines the tests indicated in TestExpectations."
-
-    def __init__(self):
-        options = [
+class AbstractParallelRebaselineCommand(AbstractDeclarativeCommand):
+    def __init__(self, options=None):
+        options = options or []
+        options.extend([
             optparse.make_option('--no-optimize', dest='optimize', action='store_false', default=True,
                 help=('Do not optimize/de-dup the expectations after rebaselining '
                       '(default is to de-dup automatically). '
-                      'You can use "webkit-patch optimize-baselines" to optimize separately.')),
-        ]
+                      'You can use "webkit-patch optimize-baselines" to optimize separately.'))])
         AbstractDeclarativeCommand.__init__(self, options=options)
 
     def _run_webkit_patch(self, args):
         try:
             self._tool.executive.run_command([self._tool.path()] + args, cwd=self._tool.scm().checkout_root)
         except ScriptError, e:
-            pass
+            _log.error(e)
+
+    def _builders_to_fetch_from(self, builders):
+        # This routine returns the subset of builders that will cover all of the baseline search paths
+        # used in the input list. In particular, if the input list contains both Release and Debug
+        # versions of a configuration, we *only* return the Release version (since we don't save
+        # debug versions of baselines).
+        release_builders = set()
+        debug_builders = set()
+        builders_to_fallback_paths = {}
+        for builder in builders:
+            port = self._tool.port_factory.get_from_builder_name(builder)
+            if port.test_configuration().build_type == 'Release':
+                release_builders.add(builder)
+            else:
+                debug_builders.add(builder)
+        for builder in list(release_builders) + list(debug_builders):
+            port = self._tool.port_factory.get_from_builder_name(builder)
+            fallback_path = port.baseline_search_path()
+            if fallback_path not in builders_to_fallback_paths.values():
+                builders_to_fallback_paths[builder] = fallback_path
+        return builders_to_fallback_paths.keys()
+
+    def _rebaseline_commands(self, test_list):
+        path_to_webkit_patch = self._tool.path()
+        cwd = self._tool.scm().checkout_root
+        commands = []
+        for test in test_list:
+            for builder in self._builders_to_fetch_from(test_list[test]):
+                suffixes = ','.join(test_list[test][builder])
+                cmd_line = [path_to_webkit_patch, 'rebaseline-test-internal', '--suffixes', suffixes, '--builder', builder, '--test', test]
+                commands.append(tuple([cmd_line, cwd]))
+        return commands
+
+    def _files_to_add(self, command_results):
+        files_to_add = set()
+        for output in [result[1].split('\n') for result in command_results]:
+            file_added = False
+            for line in output:
+                try:
+                    files_to_add.update(json.loads(line)['add'])
+                    file_added = True
+                except ValueError, e:
+                    _log.debug('"%s" is not a JSON object, ignoring' % line)
+
+            if not file_added:
+                _log.debug('Could not add file based off output "%s"' % output)
+
+
+        return list(files_to_add)
+
+    def _optimize_baselines(self, test_list):
+        # We don't run this in parallel because modifying the SCM in parallel is unreliable.
+        for test in test_list:
+            all_suffixes = set()
+            for builder in self._builders_to_fetch_from(test_list[test]):
+                all_suffixes.update(test_list[test][builder])
+            self._run_webkit_patch(['optimize-baselines', '--suffixes', ','.join(all_suffixes), test])
+
+    def _rebaseline(self, options, test_list):
+        commands = self._rebaseline_commands(test_list)
+        command_results = self._tool.executive.run_in_parallel(commands)
+
+        files_to_add = self._files_to_add(command_results)
+        self._tool.scm().add_list(list(files_to_add))
+
+        if options.optimize:
+            self._optimize_baselines(test_list)
+
+
+class RebaselineJson(AbstractParallelRebaselineCommand):
+    name = "rebaseline-json"
+    help_text = "Rebaseline based off JSON passed to stdin. Intended to only be called from other scripts."
 
-    def _is_supported_port(self, port_name):
-        # FIXME: Support non-Chromium ports.
-        return port_name.startswith('chromium-')
+    def execute(self, options, args, tool):
+        self._rebaseline(options, json.loads(sys.stdin.read()))
+
+
+class RebaselineExpectations(AbstractParallelRebaselineCommand):
+    name = "rebaseline-expectations"
+    help_text = "Rebaselines the tests indicated in TestExpectations."
 
     def _update_expectations_file(self, port_name):
-        if not self._is_supported_port(port_name):
-            return
         port = self._tool.port_factory.get(port_name)
 
         # FIXME: This will intentionally skip over any REBASELINE expectations that were in an overrides file.
@@ -276,71 +338,89 @@ class RebaselineExpectations(AbstractDeclarativeCommand):
             tests_to_rebaseline[test] = suffixes_for_expectations(expectations.get_expectations(test))
         return tests_to_rebaseline
 
-    def _rebaseline_port(self, port_name):
-        if not self._is_supported_port(port_name):
-            return
+    def _add_tests_to_rebaseline_for_port(self, port_name):
         builder_name = builders.builder_name_for_port_name(port_name)
         if not builder_name:
             return
-        _log.info("Retrieving results for %s from %s." % (port_name, builder_name))
-        for test_name, suffixes in self._tests_to_rebaseline(self._tool.port_factory.get(port_name)).iteritems():
-            self._touched_tests.setdefault(test_name, set()).update(set(suffixes))
+        tests = self._tests_to_rebaseline(self._tool.port_factory.get(port_name)).items()
+
+        if tests:
+            _log.info("Retrieving results for %s from %s." % (port_name, builder_name))
+
+        for test_name, suffixes in tests:
             _log.info("    %s (%s)" % (test_name, ','.join(suffixes)))
-            # FIXME: we should use executive.run_in_parallel() to speed this up.
-            self._run_webkit_patch(['rebaseline-test', '--suffixes', ','.join(suffixes), builder_name, test_name])
+            if test_name not in self._test_list:
+                self._test_list[test_name] = {}
+            self._test_list[test_name][builder_name] = suffixes
 
     def execute(self, options, args, tool):
-        self._touched_tests = {}
+        self._test_list = {}
         for port_name in tool.port_factory.all_port_names():
-            self._rebaseline_port(port_name)
+            self._add_tests_to_rebaseline_for_port(port_name)
+        self._rebaseline(options, self._test_list)
+
         for port_name in tool.port_factory.all_port_names():
             self._update_expectations_file(port_name)
-        if not options.optimize:
-            return
-        for test_name, suffixes in self._touched_tests.iteritems():
-            _log.info("Optimizing baselines for %s (%s)." % (test_name, ','.join(suffixes)))
-            self._run_webkit_patch(['optimize-baselines', '--suffixes', ','.join(suffixes), test_name])
 
 
-class Rebaseline(AbstractDeclarativeCommand):
+class Rebaseline(AbstractParallelRebaselineCommand):
     name = "rebaseline"
-    help_text = "Replaces local expected.txt files with new results from build bots"
-
-    # FIXME: This should share more code with FailureReason._builder_to_explain
-    def _builder_to_pull_from(self):
-        builder_statuses = self._tool.buildbot.builder_statuses()
-        red_statuses = [status for status in builder_statuses if not status["is_green"]]
-        _log.info("%s failing" % (pluralize("builder", len(red_statuses))))
-        builder_choices = [status["name"] for status in red_statuses]
-        chosen_name = self._tool.user.prompt_with_list("Which builder to pull results from:", builder_choices)
-        # FIXME: prompt_with_list should really take a set of objects and a set of names and then return the object.
-        for status in red_statuses:
-            if status["name"] == chosen_name:
-                return (self._tool.buildbot.builder_with_name(chosen_name), status["build_number"])
-
-    def _replace_expectation_with_remote_result(self, local_file, remote_file):
-        (downloaded_file, headers) = urllib.urlretrieve(remote_file)
-        shutil.move(downloaded_file, local_file)
-
-    def _tests_to_update(self, build):
-        failing_tests = build.layout_test_results().tests_matching_failure_types([test_failures.FailureTextMismatch])
-        return self._tool.user.prompt_with_list("Which test(s) to rebaseline:", failing_tests, can_choose_multiple=True)
-
-    def _results_url_for_test(self, build, test):
-        test_base = os.path.splitext(test)[0]
-        actual_path = test_base + "-actual.txt"
-        return build.results_url() + "/" + actual_path
+    help_text = "Rebaseline tests with results from the build bots. Shows the list of failing tests on the builders if no test names are provided."
+    argument_names = "[TEST_NAMES]"
+
+    def __init__(self):
+        options = [
+            optparse.make_option("--builders", default=None, action="append", help="Comma-separated-list of builders to pull new baselines from (can also be provided multiple times)"),
+            optparse.make_option("--suffixes", default=BASELINE_SUFFIX_LIST, action="append", help="Comma-separated-list of file types to rebaseline (can also be provided multiple times)"),
+        ]
+        AbstractParallelRebaselineCommand.__init__(self, options=options)
+
+    def _builders_to_pull_from(self):
+        chromium_buildbot_builder_names = []
+        webkit_buildbot_builder_names = []
+        for name in builders.all_builder_names():
+            if self._tool.port_factory.get_from_builder_name(name).is_chromium():
+                chromium_buildbot_builder_names.append(name)
+            else:
+                webkit_buildbot_builder_names.append(name)
+
+        titles = ["build.webkit.org bots", "build.chromium.org bots"]
+        lists = [webkit_buildbot_builder_names, chromium_buildbot_builder_names]
+
+        chosen_names = self._tool.user.prompt_with_multiple_lists("Which builder to pull results from:", titles, lists, can_choose_multiple=True)
+        return [self._builder_with_name(name) for name in chosen_names]
+
+    def _builder_with_name(self, name):
+        return self._tool.buildbot_for_builder_name(name).builder_with_name(name)
+
+    def _tests_to_update(self, builder):
+        failing_tests = builder.latest_layout_test_results().tests_matching_failure_types([test_failures.FailureTextMismatch])
+        return self._tool.user.prompt_with_list("Which test(s) to rebaseline for %s:" % builder.name(), failing_tests, can_choose_multiple=True)
+
+    def _suffixes_to_update(self, options):
+        suffixes = []
+        for suffix_list in options.suffixes:
+            suffixes += suffix_list.split(",")
+        return suffixes
 
     def execute(self, options, args, tool):
-        builder, build_number = self._builder_to_pull_from()
-        build = builder.build(build_number)
-        port = tool.port_factory.get_from_builder_name(builder.name())
-
-        for test in self._tests_to_update(build):
-            results_url = self._results_url_for_test(build, test)
-            # Port operates with absolute paths.
-            expected_file = port.expected_filename(test, '.txt')
-            _log.info(test)
-            self._replace_expectation_with_remote_result(expected_file, results_url)
-
-        # FIXME: We should handle new results too.
+        if options.builders:
+            builders = []
+            for builder_names in options.builders:
+                builders += [self._builder_with_name(name) for name in builder_names.split(",")]
+        else:
+            builders = self._builders_to_pull_from()
+
+        test_list = {}
+
+        for builder in builders:
+            tests = args or self._tests_to_update(builder)
+            for test in tests:
+                if test not in test_list:
+                    test_list[test] = {}
+                test_list[test][builder.name()] = self._suffixes_to_update(options)
+
+        if options.verbose:
+            print "rebaseline-json: " + str(test_list)
+
+        self._rebaseline(options, test_list)
diff --git a/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py b/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
index 84036d46e..a3b9efaeb 100644
--- a/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/commands/rebaseline_unittest.py
@@ -32,6 +32,7 @@ from webkitpy.common.system.outputcapture import OutputCapture
 from webkitpy.thirdparty.mock import Mock
 from webkitpy.tool.commands.rebaseline import *
 from webkitpy.tool.mocktool import MockTool, MockOptions
+from webkitpy.common.net.buildbot.buildbot_mock import MockBuilder
 from webkitpy.common.system.executive_mock import MockExecutive
 
 
@@ -42,6 +43,20 @@ class TestRebaseline(unittest.TestCase):
         build = Mock()
         OutputCapture().assert_outputs(self, command._tests_to_update, [build])
 
+    def test_baseline_directory(self):
+        command = RebaselineTest()
+        tool = MockTool()
+        command.bind_to_tool(tool)
+        self.assertEqual(command._baseline_directory("Apple Win XP Debug (Tests)"), "/mock-checkout/LayoutTests/platform/win-xp")
+        self.assertEqual(command._baseline_directory("Apple Win 7 Release (Tests)"), "/mock-checkout/LayoutTests/platform/win")
+        self.assertEqual(command._baseline_directory("Apple Lion Release WK1 (Tests)"), "/mock-checkout/LayoutTests/platform/mac")
+        self.assertEqual(command._baseline_directory("Apple Lion Release WK2 (Tests)"), "/mock-checkout/LayoutTests/platform/mac-wk2")
+        self.assertEqual(command._baseline_directory("GTK Linux 32-bit Release"), "/mock-checkout/LayoutTests/platform/gtk")
+        self.assertEqual(command._baseline_directory("EFL Linux 64-bit Debug"), "/mock-checkout/LayoutTests/platform/efl")
+        self.assertEqual(command._baseline_directory("Qt Linux Release"), "/mock-checkout/LayoutTests/platform/qt")
+        self.assertEqual(command._baseline_directory("Webkit Mac10.7"), "/mock-checkout/LayoutTests/platform/chromium-mac")
+        self.assertEqual(command._baseline_directory("Webkit Mac10.6"), "/mock-checkout/LayoutTests/platform/chromium-mac-snowleopard")
+
     def test_rebaseline_updates_expectations_file_noop(self):
         command = RebaselineTest()
         tool = MockTool()
@@ -60,6 +75,7 @@ BUGA DEBUG : fast/css/large-list-of-rules-crash.html = TEXT
         expected_logs = """Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-results/userscripts/another-test-actual.png.
 Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-results/userscripts/another-test-actual.wav.
 Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
+Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
 """
         OutputCapture().assert_outputs(self, command._rebaseline_test_and_update_expectations, ["Webkit Mac10.7", "userscripts/another-test.html", None], expected_logs=expected_logs)
 
@@ -85,7 +101,7 @@ Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-resu
         OutputCapture().assert_outputs(self, command._rebaseline_test_and_update_expectations, ["Webkit Mac10.7", "userscripts/another-test.html", None], expected_logs=expected_logs)
 
         new_expectations = tool.filesystem.read_text_file(lion_port.path_to_test_expectations_file())
-        self.assertEqual(new_expectations, "BUGX LEOPARD SNOWLEOPARD : userscripts/another-test.html = IMAGE\nBUGZ LINUX : userscripts/another-test.html = IMAGE\n")
+        self.assertEqual(new_expectations, "BUGX SNOWLEOPARD : userscripts/another-test.html = IMAGE\nBUGZ LINUX : userscripts/another-test.html = IMAGE\n")
 
     def test_rebaseline_does_not_include_overrides(self):
         command = RebaselineTest()
@@ -105,7 +121,7 @@ Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-resu
         OutputCapture().assert_outputs(self, command._rebaseline_test_and_update_expectations, ["Webkit Mac10.7", "userscripts/another-test.html", None], expected_logs=expected_logs)
 
         new_expectations = tool.filesystem.read_text_file(lion_port.path_to_test_expectations_file())
-        self.assertEqual(new_expectations, "BUGX LEOPARD SNOWLEOPARD : userscripts/another-test.html = IMAGE\nBUGZ LINUX : userscripts/another-test.html = IMAGE\n")
+        self.assertEqual(new_expectations, "BUGX SNOWLEOPARD : userscripts/another-test.html = IMAGE\nBUGZ LINUX : userscripts/another-test.html = IMAGE\n")
 
     def test_rebaseline_test(self):
         command = RebaselineTest()
@@ -155,10 +171,9 @@ Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-resu
         tool.filesystem.write_text_file(os.path.join(lion_port.baseline_path(), "userscripts/another-test-expected.txt"), "Dummy expected result")
 
         expected_logs = """Copying baseline from /mock-checkout/LayoutTests/platform/chromium-mac/userscripts/another-test-expected.txt to /mock-checkout/LayoutTests/platform/chromium-mac-snowleopard/userscripts/another-test-expected.txt.
-Copying baseline from /mock-checkout/LayoutTests/platform/chromium-mac/userscripts/another-test-expected.txt to /mock-checkout/LayoutTests/platform/chromium-mac-leopard/userscripts/another-test-expected.txt.
 Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-results/userscripts/another-test-actual.txt.
 """
-        OutputCapture().assert_outputs(self, command._rebaseline_test, ["Webkit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard", "chromium-mac-leopard"], "txt"], expected_logs=expected_logs)
+        OutputCapture().assert_outputs(self, command._rebaseline_test, ["Webkit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt"], expected_logs=expected_logs)
 
     def test_rebaseline_and_copy_no_overwrite_test(self):
         command = RebaselineTest()
@@ -176,6 +191,37 @@ Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-resu
 """
         OutputCapture().assert_outputs(self, command._rebaseline_test, ["Webkit Mac10.7", "userscripts/another-test.html", ["chromium-mac-snowleopard"], "txt"], expected_logs=expected_logs)
 
+    def test_rebaseline_all(self):
+        old_exact_matches = builders._exact_matches
+        builders._exact_matches = {
+            "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
+            "MOCK builder (Debug)": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier", "debug"])},
+        }
+
+        command = RebaselineJson()
+        tool = MockTool()
+        options = MockOptions()
+        options.optimize = True
+        command.bind_to_tool(tool)
+        tool.executive = MockExecutive(should_log=True)
+
+        expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder', '--test', 'user-scripts/another-test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt,png', 'user-scripts/another-test.html'], cwd=/mock-checkout
+"""
+        OutputCapture().assert_outputs(self, command._rebaseline, [options, {"user-scripts/another-test.html":{"MOCK builder": ["txt", "png"]}}], expected_stderr=expected_stderr)
+
+        expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png', '--builder', 'MOCK builder (Debug)', '--test', 'user-scripts/another-test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt,png', 'user-scripts/another-test.html'], cwd=/mock-checkout
+"""
+        OutputCapture().assert_outputs(self, command._rebaseline, [options, {"user-scripts/another-test.html":{"MOCK builder (Debug)": ["txt", "png"]}}], expected_stderr=expected_stderr)
+
+        expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'user-scripts/another-test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'user-scripts/another-test.html'], cwd=/mock-checkout
+"""
+        OutputCapture().assert_outputs(self, command._rebaseline, [options, {"user-scripts/another-test.html":{"MOCK builder (Debug)": ["txt", "png"], "MOCK builder": ["txt"]}}], expected_stderr=expected_stderr)
+
+        builders._exact_matches = old_exact_matches
+
     def test_rebaseline_expectations(self):
         command = RebaselineExpectations()
         tool = MockTool()
@@ -189,15 +235,18 @@ Retrieving http://example.com/f/builders/Webkit Mac10.7/results/layout-test-resu
         # Don't enable logging until after we create the mock expectation files as some Port.__init__'s run subcommands.
         tool.executive = MockExecutive(should_log=True)
 
+        def run_in_parallel(commands):
+            print commands
+            return ""
+
+        tool.executive.run_in_parallel = run_in_parallel
+
         expected_logs = """Retrieving results for chromium-linux-x86 from Webkit Linux 32.
     userscripts/another-test.html (txt)
     userscripts/images.svg (png)
 Retrieving results for chromium-linux-x86_64 from Webkit Linux.
     userscripts/another-test.html (txt)
     userscripts/images.svg (png)
-Retrieving results for chromium-mac-leopard from Webkit Mac10.5.
-    userscripts/another-test.html (txt)
-    userscripts/images.svg (png)
 Retrieving results for chromium-mac-lion from Webkit Mac10.7.
     userscripts/another-test.html (txt)
     userscripts/images.svg (png)
@@ -210,36 +259,57 @@ Retrieving results for chromium-win-win7 from Webkit Win7.
 Retrieving results for chromium-win-xp from Webkit Win.
     userscripts/another-test.html (txt)
     userscripts/images.svg (png)
+Retrieving results for efl from EFL Linux 64-bit Release.
+    userscripts/another-test.html (txt)
+    userscripts/images.svg (png)
+Retrieving results for gtk from GTK Linux 64-bit Release.
+    userscripts/another-test.html (txt)
+    userscripts/images.svg (png)
+Retrieving results for mac-lion from Apple Lion Release WK1 (Tests).
+    userscripts/another-test.html (txt)
+    userscripts/images.svg (png)
+Retrieving results for qt-linux from Qt Linux Release.
+    userscripts/another-test.html (txt)
+    userscripts/images.svg (png)
+Retrieving results for win-7sp0 from Apple Win 7 Release (Tests).
+    userscripts/another-test.html (txt)
+    userscripts/images.svg (png)
+Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
+Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
+Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
+Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
+Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
+Using the chromium port without having the downstream skia_test_expectations.txt file checked out. Expectations related things might be wonky.
 """
 
-        expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt', 'Webkit Linux 32', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Linux 32', 'userscripts/images.svg'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt', 'Webkit Linux', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Linux', 'userscripts/images.svg'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt', 'Webkit Mac10.5', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Mac10.5', 'userscripts/images.svg'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt', 'Webkit Mac10.7', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Mac10.7', 'userscripts/images.svg'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt', 'Webkit Mac10.6', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Mac10.6', 'userscripts/images.svg'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt', 'Webkit Win7', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Win7', 'userscripts/images.svg'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt', 'Webkit Win', 'userscripts/another-test.html'], cwd=/mock-checkout
-MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Win', 'userscripts/images.svg'], cwd=/mock-checkout
+        expected_stdout = """[(['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Linux 32', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Linux', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Mac10.6', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Mac10.7', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Win7', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Apple Win 7 Release (Tests)', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'EFL Linux 64-bit Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Webkit Win', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'GTK Linux 64-bit Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Qt Linux Release', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'Apple Lion Release WK1 (Tests)', '--test', 'userscripts/another-test.html'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Linux 32', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Linux', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Mac10.6', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Mac10.7', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Win7', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Apple Win 7 Release (Tests)', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'EFL Linux 64-bit Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Webkit Win', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'GTK Linux 64-bit Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Qt Linux Release', '--test', 'userscripts/images.svg'], '/mock-checkout'), (['echo', 'rebaseline-test-internal', '--suffixes', 'png', '--builder', 'Apple Lion Release WK1 (Tests)', '--test', 'userscripts/images.svg'], '/mock-checkout')]
 """
 
-        command._tests_to_rebaseline = lambda port: {'userscripts/another-test.html': set(['txt']), 'userscripts/images.svg': set(['png'])}
-        OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=False), [], tool], expected_logs=expected_logs, expected_stderr=expected_stderr)
+        expected_stderr = """MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+"""
 
-        expected_logs_with_optimize = expected_logs + (
-            "Optimizing baselines for userscripts/another-test.html (txt).\n"
-            "Optimizing baselines for userscripts/images.svg (png).\n")
-        expected_stderr_with_optimize = expected_stderr + (
-            "MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'userscripts/another-test.html'], cwd=/mock-checkout\n"
-            "MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'png', 'userscripts/images.svg'], cwd=/mock-checkout\n")
+        command._tests_to_rebaseline = lambda port: {'userscripts/another-test.html': set(['txt']), 'userscripts/images.svg': set(['png'])}
+        OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=False), [], tool], expected_logs=expected_logs, expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+
+        expected_stderr_with_optimize = """MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'userscripts/another-test.html'], cwd=/mock-checkout
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'png', 'userscripts/images.svg'], cwd=/mock-checkout
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+MOCK run_command: ['qmake', '-v'], cwd=None
+"""
 
         command._tests_to_rebaseline = lambda port: {'userscripts/another-test.html': set(['txt']), 'userscripts/images.svg': set(['png'])}
-        OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True), [], tool], expected_logs=expected_logs_with_optimize, expected_stderr=expected_stderr_with_optimize)
+        OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True), [], tool], expected_logs=expected_logs, expected_stdout=expected_stdout, expected_stderr=expected_stderr_with_optimize)
 
     def test_overrides_are_included_correctly(self):
         command = RebaselineExpectations()
@@ -262,3 +332,151 @@ MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'png', 'Webkit Win',
         port._filesystem.write_text_file(port.layout_tests_dir() + '/userscripts/another-test.html', '')
         self.assertEquals(command._tests_to_rebaseline(port), {'userscripts/another-test.html': set(['txt'])})
         self.assertEquals(port._filesystem.read_text_file(expectations_path), expectations_contents)
+
+    def test_rebaseline(self):
+        old_exact_matches = builders._exact_matches
+        try:
+            builders._exact_matches = {
+                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
+            }
+
+            command = Rebaseline()
+            tool = MockTool()
+            command.bind_to_tool(tool)
+
+            for port_name in tool.port_factory.all_port_names():
+                port = tool.port_factory.get(port_name)
+                for path in port.expectations_files():
+                    tool.filesystem.write_text_file(path, '')
+
+            tool.executive = MockExecutive(should_log=True)
+
+            def mock_builders_to_pull_from():
+                return [MockBuilder('MOCK builder')]
+
+            def mock_tests_to_update(build):
+                return ['mock/path/to/test.html']
+
+            command._builders_to_pull_from = mock_builders_to_pull_from
+            command._tests_to_update = mock_tests_to_update
+
+            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder': ['txt']}}
+"""
+
+            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'mock/path/to/test.html'], cwd=/mock-checkout
+"""
+
+            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=None, suffixes=["txt"], verbose=True), [], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+
+        finally:
+            builders._exact_matches = old_exact_matches
+
+    def test_rebaseline_command_line_flags(self):
+        old_exact_matches = builders._exact_matches
+        try:
+            builders._exact_matches = {
+                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
+            }
+
+            command = Rebaseline()
+            tool = MockTool()
+            command.bind_to_tool(tool)
+
+            for port_name in tool.port_factory.all_port_names():
+                port = tool.port_factory.get(port_name)
+                for path in port.expectations_files():
+                    tool.filesystem.write_text_file(path, '')
+
+            tool.executive = MockExecutive(should_log=True)
+
+            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder': ['txt']}}
+"""
+
+            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'mock/path/to/test.html'], cwd=/mock-checkout
+"""
+
+            builder = "MOCK builder"
+            test = "mock/path/to/test.html"
+            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=[builder], suffixes=["txt"], verbose=True), [test], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+
+        finally:
+            builders._exact_matches = old_exact_matches
+
+    def test_rebaseline_multiple_builders(self):
+        old_exact_matches = builders._exact_matches
+        try:
+            builders._exact_matches = {
+                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
+                "MOCK builder2": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier2"])},
+            }
+
+            command = Rebaseline()
+            tool = MockTool()
+            command.bind_to_tool(tool)
+
+            for port_name in tool.port_factory.all_port_names():
+                port = tool.port_factory.get(port_name)
+                for path in port.expectations_files():
+                    tool.filesystem.write_text_file(path, '')
+
+            tool.executive = MockExecutive(should_log=True)
+
+            def mock_builders_to_pull_from():
+                return [MockBuilder('MOCK builder'), MockBuilder('MOCK builder2')]
+
+            def mock_tests_to_update(build):
+                return ['mock/path/to/test.html']
+
+            command._builders_to_pull_from = mock_builders_to_pull_from
+            command._tests_to_update = mock_tests_to_update
+
+            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder2': ['txt'], 'MOCK builder': ['txt']}}
+"""
+
+            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder2', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'txt', 'mock/path/to/test.html'], cwd=/mock-checkout
+"""
+
+            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=None, suffixes=["txt"], verbose=True), [], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+
+        finally:
+            builders._exact_matches = old_exact_matches
+
+    def test_rebaseline_multiple_builders_and_tests_command_line(self):
+        old_exact_matches = builders._exact_matches
+        try:
+            builders._exact_matches = {
+                "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
+                "MOCK builder2": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier2"])},
+                "MOCK builder3": {"port_name": "test-mac-snowleopard", "specifiers": set(["mock-specifier2"])},
+            }
+
+            command = Rebaseline()
+            tool = MockTool()
+            command.bind_to_tool(tool)
+
+            for port_name in tool.port_factory.all_port_names():
+                port = tool.port_factory.get(port_name)
+                for path in port.expectations_files():
+                    tool.filesystem.write_text_file(path, '')
+
+            tool.executive = MockExecutive(should_log=True)
+
+            expected_stdout = """rebaseline-json: {'mock/path/to/test.html': {'MOCK builder2': ['txt', 'png', 'wav'], 'MOCK builder': ['txt', 'png', 'wav'], 'MOCK builder3': ['txt', 'png', 'wav']}, 'mock/path/to/test2.html': {'MOCK builder2': ['txt', 'png', 'wav'], 'MOCK builder': ['txt', 'png', 'wav'], 'MOCK builder3': ['txt', 'png', 'wav']}}
+"""
+
+            expected_stderr = """MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png,wav', '--builder', 'MOCK builder2', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png,wav', '--builder', 'MOCK builder', '--test', 'mock/path/to/test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png,wav', '--builder', 'MOCK builder2', '--test', 'mock/path/to/test2.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'rebaseline-test-internal', '--suffixes', 'txt,png,wav', '--builder', 'MOCK builder', '--test', 'mock/path/to/test2.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'wav,txt,png', 'mock/path/to/test.html'], cwd=/mock-checkout
+MOCK run_command: ['echo', 'optimize-baselines', '--suffixes', 'wav,txt,png', 'mock/path/to/test2.html'], cwd=/mock-checkout
+"""
+
+            OutputCapture().assert_outputs(self, command.execute, [MockOptions(optimize=True, builders=["MOCK builder,MOCK builder2", "MOCK builder3"], suffixes=["txt", "png,wav"], verbose=True), ["mock/path/to/test.html", "mock/path/to/test2.html"], tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
+
+        finally:
+            builders._exact_matches = old_exact_matches
diff --git a/Tools/Scripts/webkitpy/tool/mocktool.py b/Tools/Scripts/webkitpy/tool/mocktool.py
index 21ee91fc9..b8f0976bc 100644
--- a/Tools/Scripts/webkitpy/tool/mocktool.py
+++ b/Tools/Scripts/webkitpy/tool/mocktool.py
@@ -29,6 +29,7 @@
 import threading
 
 from webkitpy.common.host_mock import MockHost
+from webkitpy.common.net.buildbot.buildbot_mock import MockBuildBot
 from webkitpy.common.net.statusserver_mock import MockStatusServer
 from webkitpy.common.net.irc.irc_mock import MockIRC
 
@@ -82,3 +83,6 @@ class MockTool(MockHost):
 
     def irc(self):
         return self._irc
+
+    def buildbot_for_builder_name(self, name):
+        return MockBuildBot()
diff --git a/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py b/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
index bfe003fe9..947bf1d88 100644
--- a/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
+++ b/Tools/Scripts/webkitpy/tool/servers/gardeningserver.py
@@ -140,79 +140,7 @@ class GardeningHTTPRequestHandler(ReflectionHandler):
         self._expectations_updater().update_expectations(self._read_entity_body_as_json())
         self._serve_text('success')
 
-    def rebaseline(self):
-        builder = self.query['builder'][0]
-        command = [ 'rebaseline-test' ]
-
-        if 'suffixes' in self.query:
-            command.append('--suffixes')
-            command.append(self.query['suffixes'][0])
-
-        command.append(builder)
-        command.append(self.query['test'][0])
-
-        command.extend(builders.fallback_port_names_for_new_port(builder))
-        self._run_webkit_patch(command)
-        self._serve_text('success')
-
-    def _builders_to_fetch_from(self, builders):
-        # This routine returns the subset of builders that will cover all of the baseline search paths
-        # used in the input list. In particular, if the input list contains both Release and Debug
-        # versions of a configuration, we *only* return the Release version (since we don't save
-        # debug versions of baselines).
-        release_builders = set()
-        debug_builders = set()
-        builders_to_fallback_paths = {}
-        for builder in builders:
-            port = self.server.tool.port_factory.get_from_builder_name(builder)
-            if port.test_configuration().build_type == 'Release':
-                release_builders.add(builder)
-            else:
-                debug_builders.add(builder)
-        for builder in list(release_builders) + list(debug_builders):
-            port = self.server.tool.port_factory.get_from_builder_name(builder)
-            fallback_path = port.baseline_search_path()
-            if fallback_path not in builders_to_fallback_paths.values():
-                builders_to_fallback_paths[builder] = fallback_path
-        return builders_to_fallback_paths.keys()
-
-    def _rebaseline_commands(self, test_list):
-        path_to_webkit_patch = self.server.tool.path()
-        cwd = self.server.tool.scm().checkout_root
-        commands = []
-        for test in test_list:
-            for builder in self._builders_to_fetch_from(test_list[test]):
-                suffixes = ','.join(test_list[test][builder])
-                cmd_line = [path_to_webkit_patch, 'rebaseline-test', '--print-scm-changes', '--suffixes', suffixes, builder, test]
-                commands.append(tuple([cmd_line, cwd]))
-        return commands
-
-    def _files_to_add(self, command_results):
-        files_to_add = set()
-        for output in [result[1] for result in command_results]:
-            try:
-                files_to_add.update(json.loads(output)['add'])
-            except ValueError, e:
-                _log.warning('"%s" is not a JSON object, ignoring' % output)
-
-        return list(files_to_add)
-
-    def _optimize_baselines(self, test_list):
-        # We don't run this in parallel because modifying the SCM in parallel is unreliable.
-        for test in test_list:
-            all_suffixes = set()
-            for builder in self._builders_to_fetch_from(test_list[test]):
-                all_suffixes.update(test_list[test][builder])
-            self._run_webkit_patch(['optimize-baselines', '--suffixes', ','.join(all_suffixes), test])
-
     def rebaselineall(self):
-        test_list = self._read_entity_body_as_json()
-
-        commands = self._rebaseline_commands(test_list)
-        command_results = self.server.tool.executive.run_in_parallel(commands)
-
-        files_to_add = self._files_to_add(command_results)
-        self.server.tool.scm().add_list(list(files_to_add))
-
-        self._optimize_baselines(test_list)
+        command = ['rebaseline-json']
+        self.server.tool.executive.run_command([self.server.tool.path()] + command, input=self.read_entity_body(), cwd=self.server.tool.scm().checkout_root)
         self._serve_text('success')
diff --git a/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py b/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py
index 4cc772ca2..166d191ac 100644
--- a/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/servers/gardeningserver_unittest.py
@@ -69,7 +69,7 @@ class TestGardeningHTTPRequestHandler(GardeningHTTPRequestHandler):
     def _expectations_updater(self):
         return GardeningExpectationsUpdater(self.server.tool, TestPortFactory.create())
 
-    def _read_entity_body(self):
+    def read_entity_body(self):
         return self.body if self.body else ''
 
     def _serve_text(self, text):
@@ -183,32 +183,26 @@ class GardeningServerTest(unittest.TestCase):
         self._post_to_path("/rollout?revision=2314&reason=MOCK+rollout+reason", expected_stderr=expected_stderr, expected_stdout=expected_stdout)
 
     def test_rebaselineall(self):
-        builders._exact_matches = {
-            "MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"])},
-            "MOCK builder (Debug)": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier", "debug"])},
-        }
-        expected_stderr = "MOCK run_command: ['echo', 'rebaseline-test', '--print-scm-changes', '--suffixes', u'%s', u'%s', u'user-scripts/another-test.html'], cwd=/mock-checkout\nMOCK run_command: ['echo', 'optimize-baselines', '--suffixes', u'%s', u'user-scripts/another-test.html'], cwd=/mock-checkout\n"
+        expected_stderr = "MOCK run_command: ['echo', 'rebaseline-json'], cwd=/mock-checkout, input={\"user-scripts/another-test.html\":{\"%s\": [%s]}}\n"
         expected_stdout = "== Begin Response ==\nsuccess\n== End Response ==\n"
         server = MockServer()
 
         self.output = ['{"add": [], "delete": []}', '']
 
-        def run_command(args, cwd=None, **kwargs):
-            print >> sys.stderr, "MOCK run_command: %s, cwd=%s" % (args, cwd)
+        def run_command(args, cwd=None, input=None, **kwargs):
+            print >> sys.stderr, "MOCK run_command: %s, cwd=%s, input=%s" % (args, cwd, input)
             return self.output.pop(0)
 
         server.tool.executive.run_command = run_command
-        self._post_to_path("/rebaselineall", body='{"user-scripts/another-test.html":{"MOCK builder": ["txt","png"]}}', expected_stderr=expected_stderr % ('txt,png', 'MOCK builder', 'txt,png'), expected_stdout=expected_stdout, server=server)
+        self._post_to_path("/rebaselineall", body='{"user-scripts/another-test.html":{"MOCK builder": ["txt","png"]}}', expected_stderr=expected_stderr % ('MOCK builder', '"txt","png"'), expected_stdout=expected_stdout, server=server)
 
-        self._post_to_path("/rebaselineall", body='{"user-scripts/another-test.html":{"MOCK builder (Debug)": ["txt","png"]}}', expected_stderr=expected_stderr % ('txt,png', 'MOCK builder (Debug)', 'txt,png'), expected_stdout=expected_stdout)
-
-        self._post_to_path("/rebaselineall", body='{"user-scripts/another-test.html":{"MOCK builder (Debug)": ["txt","png"], "MOCK builder": ["txt"]}}', expected_stderr=expected_stderr % ('txt', 'MOCK builder', 'txt'), expected_stdout=expected_stdout)
+        self._post_to_path("/rebaselineall", body='{"user-scripts/another-test.html":{"MOCK builder (Debug)": ["txt","png"]}}', expected_stderr=expected_stderr % ('MOCK builder (Debug)', '"txt","png"'), expected_stdout=expected_stdout)
 
     def test_rebaseline_new_port(self):
         builders._exact_matches = {"MOCK builder": {"port_name": "test-mac-leopard", "specifiers": set(["mock-specifier"]), "move_overwritten_baselines_to": ["mock-port-fallback", "mock-port-fallback2"]}}
-        expected_stderr = "MOCK run_command: ['echo', 'rebaseline-test', '--suffixes', 'txt,png', 'MOCK builder', 'user-scripts/another-test.html', 'mock-port-fallback', 'mock-port-fallback2'], cwd=/mock-checkout\n"
+        expected_stderr = 'MOCK run_command: [\'echo\', \'rebaseline-json\'], cwd=/mock-checkout, input={"user-scripts/another-test.html":{"MOCK builder": ["txt","png"]}}\n'
         expected_stdout = "== Begin Response ==\nsuccess\n== End Response ==\n"
-        self._post_to_path("/rebaseline?builder=MOCK+builder&test=user-scripts/another-test.html&suffixes=txt,png", expected_stderr=expected_stderr, expected_stdout=expected_stdout)
+        self._post_to_path("/rebaselineall", body='{"user-scripts/another-test.html":{"MOCK builder": ["txt","png"]}}', expected_stderr=expected_stderr, expected_stdout=expected_stdout)
 
     def test_updateexpectations(self):
         expected_stderr = ""
diff --git a/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py b/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
index 6a3f207be..24bb2771a 100644
--- a/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
+++ b/Tools/Scripts/webkitpy/tool/servers/reflectionhandler.py
@@ -59,12 +59,12 @@ class ReflectionHandler(BaseHTTPServer.BaseHTTPRequestHandler):
     def do_POST(self):
         self._handle_request()
 
-    def _read_entity_body(self):
+    def read_entity_body(self):
         length = int(self.headers.getheader('content-length'))
         return self.rfile.read(length)
 
     def _read_entity_body_as_json(self):
-        return json.loads(self._read_entity_body())
+        return json.loads(self.read_entity_body())
 
     def _handle_request(self):
         if "?" in self.path:
diff --git a/Tools/Scripts/webkitpy/tool/steps/__init__.py b/Tools/Scripts/webkitpy/tool/steps/__init__.py
index aca9706f5..56429e8fe 100644
--- a/Tools/Scripts/webkitpy/tool/steps/__init__.py
+++ b/Tools/Scripts/webkitpy/tool/steps/__init__.py
@@ -27,6 +27,7 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 # FIXME: Is this the right way to do this?
+from webkitpy.tool.steps.addsvnmimetypeforpng import AddSvnMimetypeForPng
 from webkitpy.tool.steps.applypatch import ApplyPatch
 from webkitpy.tool.steps.applypatchwithlocalcommit import ApplyPatchWithLocalCommit
 from webkitpy.tool.steps.applywatchlist import ApplyWatchList
diff --git a/Tools/Scripts/webkitpy/tool/steps/addsvnmimetypeforpng.py b/Tools/Scripts/webkitpy/tool/steps/addsvnmimetypeforpng.py
new file mode 100644
index 000000000..73bec15db
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/steps/addsvnmimetypeforpng.py
@@ -0,0 +1,77 @@
+# Copyright (C) 2012 Balazs Ankes (bank@inf.u-szeged.hu) University of Szeged
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from webkitpy.tool.steps.abstractstep import AbstractStep
+from webkitpy.common import checksvnconfigfile
+from webkitpy.common.system.deprecated_logging import log
+from webkitpy.common.checkout.scm.detection import SCMDetector
+from webkitpy.common.system.systemhost import SystemHost
+
+
+class AddSvnMimetypeForPng(AbstractStep):
+    def __init__(self, tool, options, host=None, scm=None):
+        self._tool = tool
+        self._options = options
+        self._host = host or SystemHost()
+        self._fs = self._host.filesystem
+        self._detector = scm or SCMDetector(self._fs, self._host.executive).detect_scm_system(self._fs.getcwd())
+
+    def run(self, state):
+        png_files = self._check_pngs(self._changed_files(state))
+
+        if png_files:
+            detection = self._detector.display_name()
+
+            if detection == "git":
+                (file_missing, autoprop_missing, png_missing) = checksvnconfigfile.check(self._host, self._fs)
+                config_file_path = checksvnconfigfile.config_file_path(self._host, self._fs)
+
+                if file_missing:
+                    log("There is no SVN config file. The svn:mime-type of pngs won't set.")
+                    if not self._tool.user.confirm("Are you sure you want to continue?", default="n"):
+                        self._exit(1)
+                elif autoprop_missing and png_missing:
+                    log(checksvnconfigfile.errorstr_autoprop(config_file_path) + checksvnconfigfile.errorstr_png(config_file_path))
+                    if not self._tool.user.confirm("Do you want to continue?", default="n"):
+                        self._exit(1)
+                elif autoprop_missing:
+                    log(checksvnconfigfile.errorstr_autoprop(config_file_path))
+                    if not self._tool.user.confirm("Do you want to continue?", default="n"):
+                        self._exit(1)
+                elif png_missing:
+                    log(checksvnconfigfile.errorstr_png(config_file_path))
+                    if not self._tool.user.confirm("Do you want to continue?", default="n"):
+                        self._exit(1)
+
+            elif detection == "svn":
+                for filename in png_files:
+                    if self._detector.exists(filename) and self._detector.propget('svn:mime-type', filename) != 'image/png':
+                        print "Adding image/png mime-type to %s" % filename
+                        self._detector.propset('svn:mime-type', 'image/png', filename)
+
+    def _check_pngs(self, changed_files):
+        png_files = []
+        for filename in changed_files:
+            if filename.endswith('.png'):
+                png_files.append(filename)
+        return png_files
diff --git a/Tools/Scripts/webkitpy/tool/steps/addsvnmimetypeforpng_unittest.py b/Tools/Scripts/webkitpy/tool/steps/addsvnmimetypeforpng_unittest.py
new file mode 100644
index 000000000..221c6bc94
--- /dev/null
+++ b/Tools/Scripts/webkitpy/tool/steps/addsvnmimetypeforpng_unittest.py
@@ -0,0 +1,58 @@
+# Copyright (C) 2012 Balazs Ankes (bank@inf.u-szeged.hu) University of Szeged
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.tool.steps.addsvnmimetypeforpng import AddSvnMimetypeForPng
+from webkitpy.common.system.filesystem_mock import MockFileSystem
+from webkitpy.tool.mocktool import MockOptions, MockTool
+from webkitpy.common.system.systemhost_mock import MockSystemHost
+from webkitpy.common.system.outputcapture import OutputCapture
+
+
+class MockSCMDetector(object):
+
+    def __init__(self, scm):
+        self._scm = scm
+
+    def display_name(self):
+        return self._scm
+
+
+class AddSvnMimetypeForPngTest(unittest.TestCase):
+    def test_run(self):
+        capture = OutputCapture()
+        options = MockOptions(git_commit='MOCK git commit')
+
+        files = {'/Users/mock/.subversion/config': 'enable-auto-props = yes\n*.png = svn:mime-type=image/png'}
+        fs = MockFileSystem(files)
+        scm = MockSCMDetector('git')
+
+        step = AddSvnMimetypeForPng(MockTool(), options, MockSystemHost(os_name='linux', filesystem=fs), scm)
+        state = {
+            "changed_files": ["test.png", "test.txt"],
+        }
+        try:
+            capture.assert_outputs(self, step.run, [state])
+        except SystemExit, e:
+            self.assertEquals(e.code, 1)
diff --git a/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py b/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py
index ffed201d2..847dc2f93 100644
--- a/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py
+++ b/Tools/Scripts/webkitpy/tool/steps/preparechangelog_unittest.py
@@ -52,6 +52,6 @@ class PrepareChangeLogTest(changelog_unittest.ChangeLogTest):
         capture.assert_outputs(self, step.run, [state])
         actual_contents = self._read_file_contents(changelog_path, "utf-8")
         expected_message = "Example title\n        http://example.com/1234"
-        expected_contents = changelog_contents.replace("Need a short description and bug URL (OOPS!)", expected_message)
+        expected_contents = changelog_contents.replace("Need a short description (OOPS!).\n        Need the bug URL (OOPS!).", expected_message)
         os.remove(changelog_path)
         self.assertEquals(actual_contents.splitlines(), expected_contents.splitlines())
diff --git a/Tools/TestResultServer/handlers/testfilehandler.py b/Tools/TestResultServer/handlers/testfilehandler.py
index 263d16808..3b4286378 100644
--- a/Tools/TestResultServer/handlers/testfilehandler.py
+++ b/Tools/TestResultServer/handlers/testfilehandler.py
@@ -203,7 +203,10 @@ class GetFile(webapp.RequestHandler):
         else:
             json, date = self._get_file_content(master, builder, test_type, name)
 
-        self._serve_json(_replace_jsonp_callback(json, callback_name), date)
+        if json:
+            json = _replace_jsonp_callback(json, callback_name)
+
+        self._serve_json(json, date)
 
 
 class Upload(webapp.RequestHandler):
diff --git a/Tools/TestResultServer/static-dashboards/flakiness_dashboard.js b/Tools/TestResultServer/static-dashboards/flakiness_dashboard.js
index 5c390c8f8..40b8839fa 100644
--- a/Tools/TestResultServer/static-dashboards/flakiness_dashboard.js
+++ b/Tools/TestResultServer/static-dashboards/flakiness_dashboard.js
@@ -40,9 +40,9 @@ var GPU_RESULTS_BASE_PATH = 'http://chromium-browser-gpu-tests.commondatastorage
 
 // FIXME: These platform names should probably be changed to match the directories in LayoutTests/platform
 // instead of matching the values we use in the TestExpectations file.
-var PLATFORMS = ['LION', 'SNOWLEOPARD', 'LEOPARD', 'XP', 'VISTA', 'WIN7', 'LUCID', 'APPLE_LION', 'APPLE_LEOPARD', 'APPLE_SNOWLEOPARD', 'APPLE_XP', 'APPLE_WIN7', 'GTK_LINUX', 'QT_LINUX'];
+var PLATFORMS = ['LION', 'SNOWLEOPARD', 'XP', 'VISTA', 'WIN7', 'LUCID', 'APPLE_LION', 'APPLE_SNOWLEOPARD', 'APPLE_XP', 'APPLE_WIN7', 'GTK_LINUX', 'QT_LINUX'];
 var PLATFORM_UNIONS = {
-    'MAC': ['LEOPARD', 'SNOWLEOPARD', 'LION'],
+    'MAC': ['SNOWLEOPARD', 'LION'],
     'WIN': ['XP', 'WIN7'],
     'LINUX': ['LUCID']
 }
@@ -55,7 +55,6 @@ var PLATFORM_FALLBACKS = {
     'MAC': 'ALL',
     'LION': 'MAC',
     'SNOWLEOPARD': 'MAC',
-    'LEOPARD': 'MAC',
     'LINUX': 'ALL',
     'LUCID': 'LINUX'
 };
@@ -258,8 +257,6 @@ function nonChromiumPlatform(builderNameUpperCase)
         return 'APPLE_LION';
     if (stringContains(builderNameUpperCase, 'SNOWLEOPARD'))
         return 'APPLE_SNOWLEOPARD';
-    if (stringContains(builderNameUpperCase, 'LEOPARD'))
-        return 'APPLE_LEOPARD';
     if (stringContains(builderNameUpperCase, 'WINDOWS 7'))
         return 'APPLE_WIN7';
     if (stringContains(builderNameUpperCase, 'WINDOWS XP'))
@@ -273,8 +270,6 @@ function nonChromiumPlatform(builderNameUpperCase)
 function chromiumPlatform(builderNameUpperCase)
 {
     if (stringContains(builderNameUpperCase, 'MAC')) {
-        if (stringContains(builderNameUpperCase, '10.5'))
-            return 'LEOPARD';
         if (stringContains(builderNameUpperCase, '10.7'))
             return 'LION';
         // The webkit.org 'Chromium Mac Release (Tests)' bot runs SnowLeopard.
@@ -2272,7 +2267,6 @@ function hideLegend()
 var g_fallbacksMap = {};
 g_fallbacksMap['WIN-XP'] = ['chromium-win-xp', 'chromium-win', 'chromium', 'mac'];
 g_fallbacksMap['WIN-7'] = ['chromium-win', 'chromium', 'mac'];
-g_fallbacksMap['MAC-LEOPARD'] = ['chromium-mac-leopard', 'chromium-mac-snowleopard', 'chromium-mac', 'chromium', 'mac'];
 g_fallbacksMap['MAC-SNOWLEOPARD'] = ['chromium-mac-snowleopard', 'chromium-mac', 'chromium', 'mac'];
 g_fallbacksMap['MAC-LION'] = ['chromium-mac', 'chromium', 'mac'];
 g_fallbacksMap['LINUX-32'] = ['chromium-linux-x86', 'chromium-linux', 'chromium-win', 'chromium', 'mac'];
diff --git a/Tools/TestResultServer/static-dashboards/flakiness_dashboard_unittests.js b/Tools/TestResultServer/static-dashboards/flakiness_dashboard_unittests.js
index e8d1ca85d..fec4c4d2c 100644
--- a/Tools/TestResultServer/static-dashboards/flakiness_dashboard_unittests.js
+++ b/Tools/TestResultServer/static-dashboards/flakiness_dashboard_unittests.js
@@ -125,11 +125,11 @@ test('overrideJustBuildType', 12, function() {
     runExpectationsTest('Webkit Win (dbg)(3)', test, 'FAIL PASS TIMEOUT', 'WONTFIX');
     runExpectationsTest('Webkit Linux', test, 'FAIL PASS TIMEOUT', 'WONTFIX');
     runExpectationsTest('Webkit Linux (dbg)(3)', test, 'CRASH', 'LINUX DEBUG');
-    runExpectationsTest('Webkit Mac10.5', test, 'FAIL', 'WONTFIX MAC');
-    runExpectationsTest('Webkit Mac10.5 (dbg)(3)', test, 'FAIL', 'WONTFIX MAC');
+    runExpectationsTest('Webkit Mac10.7', test, 'FAIL', 'WONTFIX MAC');
+    runExpectationsTest('Webkit Mac10.7 (dbg)(3)', test, 'FAIL', 'WONTFIX MAC');
 });
 
-test('platformAndBuildType', 86, function() {
+test('platformAndBuildType', 76, function() {
     var runPlatformAndBuildTypeTest = function(builder, expectedPlatform, expectedBuildType) {
         g_perBuilderPlatformAndBuildType = {};
         buildInfo = platformAndBuildType(builder);
@@ -154,9 +154,6 @@ test('platformAndBuildType', 86, function() {
     runPlatformAndBuildTypeTest('Webkit Linux 32', 'LUCID', 'RELEASE');
     runPlatformAndBuildTypeTest('Webkit Linux (dbg)(1)', 'LUCID', 'DEBUG');
     runPlatformAndBuildTypeTest('Webkit Linux (dbg)(2)', 'LUCID', 'DEBUG');
-    runPlatformAndBuildTypeTest('Webkit Mac10.5', 'LEOPARD', 'RELEASE');
-    runPlatformAndBuildTypeTest('Webkit Mac10.5 (dbg)(1)', 'LEOPARD', 'DEBUG');
-    runPlatformAndBuildTypeTest('Webkit Mac10.5 (dbg)(2)', 'LEOPARD', 'DEBUG');
     runPlatformAndBuildTypeTest('Webkit Mac10.6', 'SNOWLEOPARD', 'RELEASE');
     runPlatformAndBuildTypeTest('Webkit Mac10.6 (dbg)', 'SNOWLEOPARD', 'DEBUG');
     runPlatformAndBuildTypeTest('XP Tests', 'XP', 'RELEASE');
@@ -171,8 +168,6 @@ test('platformAndBuildType', 86, function() {
     // FIXME: These platforms should match whatever we use in the TestExpectations format.
     runPlatformAndBuildTypeTest('Lion Release (Tests)', 'APPLE_LION', 'RELEASE');
     runPlatformAndBuildTypeTest('Lion Debug (Tests)', 'APPLE_LION', 'DEBUG');
-    runPlatformAndBuildTypeTest('Leopard Intel Release (Tests)', 'APPLE_LEOPARD', 'RELEASE');
-    runPlatformAndBuildTypeTest('Leopard Intel Debug (Tests)', 'APPLE_LEOPARD', 'DEBUG');
     runPlatformAndBuildTypeTest('SnowLeopard Intel Release (Tests)', 'APPLE_SNOWLEOPARD', 'RELEASE');
     runPlatformAndBuildTypeTest('SnowLeopard Intel Leaks', 'APPLE_SNOWLEOPARD', 'RELEASE');
     runPlatformAndBuildTypeTest('SnowLeopard Intel Debug (Tests)', 'APPLE_SNOWLEOPARD', 'DEBUG');
@@ -190,12 +185,12 @@ test('platformAndBuildType', 86, function() {
 });
 
 test('realModifiers', 3, function() {
-    equal(realModifiers('BUGFOO LINUX LEOPARD WIN DEBUG SLOW'), 'SLOW');
+    equal(realModifiers('BUGFOO LINUX LION WIN DEBUG SLOW'), 'SLOW');
     equal(realModifiers('BUGFOO LUCID MAC XP RELEASE SKIP'), 'SKIP');
     equal(realModifiers('BUGFOO'), '');
 });
 
-test('allTestsWithSamePlatformAndBuildType', 14, function() {
+test('allTestsWithSamePlatformAndBuildType', 12, function() {
     // FIXME: test that allTestsWithSamePlatformAndBuildType actually returns the right set of tests.
     for (var i = 0; i < PLATFORMS.length; i++)
         ok(g_allTestsByPlatformAndBuildType[PLATFORMS[i]]);
@@ -245,7 +240,7 @@ test('getExpectations', 11, function() {
     var expectations = getExpectations('foo/test2.html', 'LUCID', 'RELEASE');
     equal(JSON.stringify(expectations), '{"modifiers":"BUG456","expectations":"FAIL"}');
 
-    var expectations = getExpectations('foo/test2.html', 'LEOPARD', 'DEBUG');
+    var expectations = getExpectations('foo/test2.html', 'LION', 'DEBUG');
     equal(JSON.stringify(expectations), '{"modifiers":"BUG456","expectations":"FAIL"}');
 
     var expectations = getExpectations('foo/test2.html', 'LUCID', 'DEBUG');
@@ -263,7 +258,7 @@ test('getExpectations', 11, function() {
     var expectations = getExpectations('http/tests/appcache/interrupted-update.html', 'WIN7', 'RELEASE');
     equal(JSON.stringify(expectations), '{"modifiers":"WIN7","expectations":"TIMEOUT"}');
 
-    var expectations = getExpectations('http/tests/appcache/interrupted-update.html', 'LEOPARD', 'RELEASE');
+    var expectations = getExpectations('http/tests/appcache/interrupted-update.html', 'LION', 'RELEASE');
     equal(JSON.stringify(expectations), '{"modifiers":"MAC LINUX XP","expectations":"FAIL"}');
 
     var expectations = getExpectations('http/tests/appcache/interrupted-update.html', 'LUCID', 'RELEASE');
@@ -370,7 +365,7 @@ test('htmlForIndividualTestOnAllBuildersWithResultsLinks', 1, function() {
         '<div class=skipped-builder-list>' +
             '<div class=skipped-builder>Webkit Linux</div>' +
             '<div class=skipped-builder>Webkit Linux (dbg)</div>' +
-            '<div class=skipped-builder>Webkit Mac10.5</div>' +
+            '<div class=skipped-builder>Webkit Mac10.7</div>' +
             '<div class=skipped-builder>Webkit Win</div>' +
         '</div>' +
         '<div class=expectations test=dummytest.html>' +
@@ -402,7 +397,7 @@ test('htmlForIndividualTestOnAllBuildersWithResultsLinksWebkitMaster', 1, functi
         '<div class=skipped-builder-list>' +
             '<div class=skipped-builder>Webkit Linux</div>' +
             '<div class=skipped-builder>Webkit Linux (dbg)</div>' +
-            '<div class=skipped-builder>Webkit Mac10.5</div>' +
+            '<div class=skipped-builder>Webkit Mac10.7</div>' +
             '<div class=skipped-builder>Webkit Win</div>' +
         '</div>' +
         '<div class=expectations test=dummytest.html>' +
@@ -501,7 +496,7 @@ test('generateChromiumDepsFyiGpuBuildersFromBuilderList', 1, function() {
 test('generateChromiumTipOfTreeGpuBuildersFromBuilderList', 1, function() {
     var builderList = ["Chrome Frame Tests", "GPU Linux (NVIDIA)", "GPU Linux (dbg) (NVIDIA)", "GPU Mac", "GPU Mac (dbg)", "GPU Win7 (NVIDIA)", "GPU Win7 (dbg) (NVIDIA)", "Linux Perf",
         "Linux Tests", "Linux Valgrind", "Mac Builder (dbg)", "Mac10.6 Perf", "Mac10.6 Tests", "Vista Perf", "Vista Tests", "Webkit Linux", "Webkit Linux ASAN", "Webkit Linux (dbg)", "Webkit Linux (deps)",
-        "Webkit Linux 32", "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)", "Webkit Mac10.5", "Webkit Mac10.5 (dbg)(1)", "Webkit Mac10.5 (dbg)(2)",
+        "Webkit Linux 32", "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)",
         "Webkit Mac10.6", "Webkit Mac10.6 (dbg)", "Webkit Mac10.6 (deps)", "Webkit Mac10.7", "Webkit Win", "Webkit Win (dbg)(1)", "Webkit Win (dbg)(2)",
         "Webkit Win (deps)", "Webkit Win Builder", "Webkit Win Builder (dbg)", "Webkit Win Builder (deps)", "Webkit Win7", "Win (dbg)", "Win Builder"];
     var expectedBuilders = [["GPU Linux (NVIDIA)", 2], ["GPU Linux (dbg) (NVIDIA)"], ["GPU Mac"], ["GPU Mac (dbg)"], ["GPU Win7 (NVIDIA)"], ["GPU Win7 (dbg) (NVIDIA)"]];
@@ -526,10 +521,10 @@ test('generateWebkitBuildersFromBuilderList', 1, function() {
 test('generateChromiumWebkitTipOfTreeBuildersFromBuilderList', 1, function() {
     var builderList = ["Chrome Frame Tests", "GPU Linux (NVIDIA)", "GPU Linux (dbg) (NVIDIA)", "GPU Mac", "GPU Mac (dbg)", "GPU Win7 (NVIDIA)", "GPU Win7 (dbg) (NVIDIA)", "Linux Perf", "Linux Tests",
         "Linux Valgrind", "Mac Builder (dbg)", "Mac10.6 Perf", "Mac10.6 Tests", "Vista Perf", "Vista Tests", "Webkit Linux", "Webkit Linux ASAN",  "Webkit Linux (dbg)", "Webkit Linux (deps)", "Webkit Linux 32",
-        "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)", "Webkit Mac10.5", "Webkit Mac10.5 (dbg)(1)", "Webkit Mac10.5 (dbg)(2)", "Webkit Mac10.6", "Webkit Mac10.6 (dbg)",
+        "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)", "Webkit Mac10.6", "Webkit Mac10.6 (dbg)",
         "Webkit Mac10.6 (deps)", "Webkit Mac10.7", "Webkit Win", "Webkit Win (dbg)(1)", "Webkit Win (dbg)(2)", "Webkit Win (deps)", "Webkit Win Builder", "Webkit Win Builder (dbg)",
         "Webkit Win Builder (deps)", "Webkit Win7", "Win (dbg)", "Win Builder"];
-    var expectedBuilders = [["Webkit Linux", 2], ["Webkit Linux (dbg)"], ["Webkit Linux 32"], ["Webkit Mac10.5"], ["Webkit Mac10.5 (dbg)(1)"], ["Webkit Mac10.5 (dbg)(2)"], ["Webkit Mac10.6"],
+    var expectedBuilders = [["Webkit Linux", 2], ["Webkit Linux (dbg)"], ["Webkit Linux 32"], ["Webkit Mac10.6"],
         ["Webkit Mac10.6 (dbg)"], ["Webkit Mac10.7"], ["Webkit Win"], ["Webkit Win (dbg)(1)"], ["Webkit Win (dbg)(2)"], ["Webkit Win7"]];
     deepEqual(generateBuildersFromBuilderList(builderList, isChromiumWebkitTipOfTreeTestRunner), expectedBuilders);
 });
@@ -537,7 +532,7 @@ test('generateChromiumWebkitTipOfTreeBuildersFromBuilderList', 1, function() {
 test('generateChromiumWebkitDepsBuildersFromBuilderList', 1, function() {
     var builderList = ["Chrome Frame Tests", "GPU Linux (NVIDIA)", "GPU Linux (dbg) (NVIDIA)", "GPU Mac", "GPU Mac (dbg)", "GPU Win7 (NVIDIA)", "GPU Win7 (dbg) (NVIDIA)", "Linux Perf", "Linux Tests",
         "Linux Valgrind", "Mac Builder (dbg)", "Mac10.6 Perf", "Mac10.6 Tests", "Vista Perf", "Vista Tests", "Webkit Linux", "Webkit Linux ASAN",  "Webkit Linux (dbg)", "Webkit Linux (deps)", "Webkit Linux 32",
-        "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)", "Webkit Mac10.5", "Webkit Mac10.5 (dbg)(1)", "Webkit Mac10.5 (dbg)(2)", "Webkit Mac10.6", "Webkit Mac10.6 (dbg)",
+        "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)", "Webkit Mac10.6", "Webkit Mac10.6 (dbg)",
         "Webkit Mac10.6 (deps)", "Webkit Mac10.7", "Webkit Win", "Webkit Win (dbg)(1)", "Webkit Win (dbg)(2)", "Webkit Win (deps)", "Webkit Win Builder", "Webkit Win Builder (dbg)",
         "Webkit Win Builder (deps)", "Webkit Win7", "Win (dbg)", "Win Builder"];
     var expectedBuilders = [["Webkit Linux (deps)", 2], ["Webkit Mac10.6 (deps)"], ["Webkit Win (deps)"]];
@@ -547,15 +542,15 @@ test('generateChromiumWebkitDepsBuildersFromBuilderList', 1, function() {
 test('generateChromiumDepsGTestBuildersFromBuilderList', 1, function() {
     var builderList = ["Android Builder", "Chrome Frame Tests (ie6)", "Chrome Frame Tests (ie7)", "Chrome Frame Tests (ie8)", "Interactive Tests (dbg)", "Linux", "Linux Builder (dbg)",
         "Linux Builder (dbg)(shared)", "Linux Builder x64", "Linux Clang (dbg)", "Linux Sync", "Linux Tests (dbg)(1)", "Linux Tests (dbg)(2)", "Linux Tests (dbg)(shared)", "Linux Tests x64",
-        "Linux x64", "Mac", "Mac 10.5 Tests (dbg)(1)", "Mac 10.5 Tests (dbg)(2)", "Mac 10.5 Tests (dbg)(3)", "Mac 10.5 Tests (dbg)(4)", "Mac 10.6 Tests (dbg)(1)", "Mac 10.6 Tests (dbg)(2)",
-        "Mac 10.6 Tests (dbg)(3)", "Mac 10.6 Tests (dbg)(4)", "Mac Builder", "Mac Builder (dbg)", "Mac10.5 Tests (1)", "Mac10.5 Tests (2)", "Mac10.5 Tests (3)", "Mac10.6 Sync",
+        "Linux x64", "Mac", "Mac 10.6 Tests (dbg)(1)", "Mac 10.6 Tests (dbg)(2)",
+        "Mac 10.6 Tests (dbg)(3)", "Mac 10.6 Tests (dbg)(4)", "Mac Builder", "Mac Builder (dbg)", "Mac10.6 Sync",
         "Mac10.6 Tests (1)", "Mac10.6 Tests (2)", "Mac10.6 Tests (3)", "NACL Tests", "NACL Tests (x64)", "Vista Tests (1)", "Vista Tests (2)", "Vista Tests (3)", "Win", "Win Aura",
         "Win Builder", "Win Builder (dbg)", "Win Builder 2010 (dbg)", "Win7 Sync", "Win7 Tests (1)", "Win7 Tests (2)", "Win7 Tests (3)", "Win7 Tests (dbg)(1)", "Win7 Tests (dbg)(2)",
         "Win7 Tests (dbg)(3)", "Win7 Tests (dbg)(4)", "Win7 Tests (dbg)(5)", "Win7 Tests (dbg)(6)", "XP Tests (1)", "XP Tests (2)", "XP Tests (3)", "XP Tests (dbg)(1)", "XP Tests (dbg)(2)",
         "XP Tests (dbg)(3)", "XP Tests (dbg)(4)", "XP Tests (dbg)(5)", "XP Tests (dbg)(6)"];
-    var expectedBuilders = [["Interactive Tests (dbg)", 2], ["Linux Tests (dbg)(1)"], ["Linux Tests (dbg)(2)"], ["Linux Tests (dbg)(shared)"], ["Linux Tests x64"], ["Mac 10.5 Tests (dbg)(1)"],
-        ["Mac 10.5 Tests (dbg)(2)"], ["Mac 10.5 Tests (dbg)(3)"], ["Mac 10.5 Tests (dbg)(4)"], ["Mac 10.6 Tests (dbg)(1)"], ["Mac 10.6 Tests (dbg)(2)"], ["Mac 10.6 Tests (dbg)(3)"],
-        ["Mac 10.6 Tests (dbg)(4)"], ["Mac10.5 Tests (1)"], ["Mac10.5 Tests (2)"], ["Mac10.5 Tests (3)"], ["Mac10.6 Tests (1)"], ["Mac10.6 Tests (2)"], ["Mac10.6 Tests (3)"], ["NACL Tests"],
+    var expectedBuilders = [["Interactive Tests (dbg)", 2], ["Linux Tests (dbg)(1)"], ["Linux Tests (dbg)(2)"], ["Linux Tests (dbg)(shared)"], ["Linux Tests x64"],
+        ["Mac 10.6 Tests (dbg)(1)"], ["Mac 10.6 Tests (dbg)(2)"], ["Mac 10.6 Tests (dbg)(3)"],
+        ["Mac 10.6 Tests (dbg)(4)"], ["Mac10.6 Tests (1)"], ["Mac10.6 Tests (2)"], ["Mac10.6 Tests (3)"], ["NACL Tests"],
         ["NACL Tests (x64)"], ["Vista Tests (1)"], ["Vista Tests (2)"], ["Vista Tests (3)"], ["Win7 Tests (1)"], ["Win7 Tests (2)"], ["Win7 Tests (3)"], ["Win7 Tests (dbg)(1)"],
         ["Win7 Tests (dbg)(2)"], ["Win7 Tests (dbg)(3)"], ["Win7 Tests (dbg)(4)"], ["Win7 Tests (dbg)(5)"], ["Win7 Tests (dbg)(6)"], ["XP Tests (1)"], ["XP Tests (2)"], ["XP Tests (3)"],
         ["XP Tests (dbg)(1)"], ["XP Tests (dbg)(2)"], ["XP Tests (dbg)(3)"], ["XP Tests (dbg)(4)"], ["XP Tests (dbg)(5)"], ["XP Tests (dbg)(6)"]];
@@ -572,7 +567,7 @@ test('generateChromiumDepsCrosGTestBuildersFromBuilderList', 1, function() {
 test('generateChromiumTipOfTreeGTestBuildersFromBuilderList', 1, function() {
     var builderList = ["Chrome Frame Tests", "GPU Linux (NVIDIA)", "GPU Linux (dbg) (NVIDIA)", "GPU Mac", "GPU Mac (dbg)", "GPU Win7 (NVIDIA)", "GPU Win7 (dbg) (NVIDIA)", "Linux Perf",
         "Linux Tests", "Linux Valgrind", "Mac Builder (dbg)", "Mac10.6 Perf", "Mac10.6 Tests", "Vista Perf", "Vista Tests", "Webkit Linux", "Webkit Linux (dbg)", "Webkit Linux (deps)",
-        "Webkit Linux 32", "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)", "Webkit Mac10.5", "Webkit Mac10.5 (dbg)(1)", "Webkit Mac10.5 (dbg)(2)",
+        "Webkit Linux 32", "Webkit Mac Builder", "Webkit Mac Builder (dbg)", "Webkit Mac Builder (deps)",
         "Webkit Mac10.6", "Webkit Mac10.6 (dbg)", "Webkit Mac10.6 (deps)", "Webkit Mac10.7", "Webkit Win", "Webkit Win (dbg)(1)", "Webkit Win (dbg)(2)",
         "Webkit Win (deps)", "Webkit Win Builder", "Webkit Win Builder (dbg)", "Webkit Win Builder (deps)", "Webkit Win7", "Win (dbg)", "Win Builder"];
     var expectedBuilders = [['Linux Tests', BuilderGroup.DEFAULT_BUILDER], ['Mac10.6 Tests'], ['Vista Tests'], ['Win (dbg)']];
diff --git a/Tools/TestResultServer/static-dashboards/run-embedded-unittests.html b/Tools/TestResultServer/static-dashboards/run-embedded-unittests.html
index dc633ca79..835be21da 100644
--- a/Tools/TestResultServer/static-dashboards/run-embedded-unittests.html
+++ b/Tools/TestResultServer/static-dashboards/run-embedded-unittests.html
@@ -56,7 +56,7 @@ window.parent = null;
 <script>
 window.location.href = '#useTestData=true';
 var builderGroup = '@ToT - chromium.org';
-var builders = {'Webkit Linux': '', 'Webkit Linux (dbg)': '', 'Webkit Mac10.5': '', 'Webkit Win': ''};
+var builders = {'Webkit Linux': '', 'Webkit Linux (dbg)': '', 'Webkit Mac10.7': '', 'Webkit Win': ''};
 onBuilderListLoad(LAYOUT_TESTS_BUILDER_GROUPS, isChromiumWebkitTipOfTreeTestRunner, CHROMIUM_WEBKIT_BUILDER_MASTER, builderGroup, BuilderGroup.TOT_WEBKIT, builders);
 initBuilders();
 </script>
diff --git a/Tools/TestResultServer/static-dashboards/run-unittests.html b/Tools/TestResultServer/static-dashboards/run-unittests.html
index 5fd81d5ad..e6879d931 100644
--- a/Tools/TestResultServer/static-dashboards/run-unittests.html
+++ b/Tools/TestResultServer/static-dashboards/run-unittests.html
@@ -53,7 +53,7 @@ function g_handleBuildersListLoaded() {};
 <script>
 window.location.href = '#useTestData=true';
 var groupName = '@ToT - chromium.org';
-var builders = {'Webkit Linux': '', 'Webkit Linux (dbg)': '', 'Webkit Mac10.5': '', 'Webkit Win': ''};
+var builders = {'Webkit Linux': '', 'Webkit Linux (dbg)': '', 'Webkit Mac10.7': '', 'Webkit Win': ''};
 LAYOUT_TESTS_BUILDER_GROUPS[groupName] = new BuilderGroup(BuilderGroup.TOT_WEBKIT);
 LAYOUT_TESTS_BUILDER_GROUPS[groupName].expectedGroups = 4;
 onBuilderListLoad(LAYOUT_TESTS_BUILDER_GROUPS, isChromiumWebkitTipOfTreeTestRunner, CHROMIUM_WEBKIT_BUILDER_MASTER, groupName, BuilderGroup.TOT_WEBKIT, builders);
diff --git a/Tools/TestWebKitAPI/Configurations/Base.xcconfig b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
index 5f5094f34..e64af3b1f 100644
--- a/Tools/TestWebKitAPI/Configurations/Base.xcconfig
+++ b/Tools/TestWebKitAPI/Configurations/Base.xcconfig
@@ -26,7 +26,7 @@
 CLANG_WARN_CXX0X_EXTENSIONS = NO;
 HEADER_SEARCH_PATHS = ${BUILT_PRODUCTS_DIR}/usr/local/include $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders $(WEBCORE_PRIVATE_HEADERS_DIR)/icu;
 FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
-GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) ENABLE_DASHBOARD_SUPPORT WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST GTEST_HAS_TR1_TUPLE=0;
+GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) ENABLE_DASHBOARD_SUPPORT WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST GTEST_HAS_TR1_TUPLE=0 GTEST_HAS_RTTI=0;
 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym;
 PREBINDING = NO
 GCC_C_LANGUAGE_STANDARD = gnu99
diff --git a/Tools/TestWebKitAPI/GNUmakefile.am b/Tools/TestWebKitAPI/GNUmakefile.am
index 6b3968ceb..f79574378 100644
--- a/Tools/TestWebKitAPI/GNUmakefile.am
+++ b/Tools/TestWebKitAPI/GNUmakefile.am
@@ -24,7 +24,8 @@ Libraries_libTestWebKitAPIMain_la_CPPFLAGS = \
 	-I$(top_builddir)/DerivedSources/WebKit2/include \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags) \
-	$(GLIB_CFLAGS)
+	$(GLIB_CFLAGS) \
+	$(GTK_CFLAGS)
 
 noinst_PROGRAMS += \
 	Programs/TestWebKitAPI/TestWTF
@@ -32,7 +33,6 @@ noinst_PROGRAMS += \
 Programs_TestWebKitAPI_TestWTF_CPPFLAGS = \
 	$(Libraries_libTestWebKitAPIMain_la_CPPFLAGS) \
 	$(GLIB_LIBS) \
-	$(GTK_CFLAGS) \
 	$(CAIRO_CFLAGS) \
 	$(LIBSOUP_CFLAGS)
 
@@ -62,6 +62,32 @@ Programs_TestWebKitAPI_TestWTF_SOURCES = \
 	Tools/TestWebKitAPI/Tests/WTF/VectorReverse.cpp \
 	Tools/TestWebKitAPI/WTFStringUtilities.h
 
+noinst_PROGRAMS += \
+	Programs/TestWebKitAPI/TestGtk
+
+Programs_TestWebKitAPI_TestGtk_CPPFLAGS = \
+	$(Programs_TestWebKitAPI_TestWTF_CPPFLAGS) \
+	$(webcore_cppflags) \
+	$(webcoregtk_cppflags) \
+	$(CAIRO_CFLAGS) \
+	$(LIBSOUP_CFLAGS)
+
+Programs_TestWebKitAPI_TestGtk_LDADD = \
+	$(Programs_TestWebKitAPI_TestWTF_LDADD) \
+	libjavascriptcoregtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
+	libwebkitgtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la
+
+Programs_TestWebKitAPI_TestGtk_LDFLAGS = \
+	$(Programs_TestWebKitAPI_TestWTF_LDFLAGS)
+
+Programs_TestWebKitAPI_TestGtk_SOURCES = \
+	Source/WebCore/platform/graphics/IntRect.cpp \
+	Source/WebCore/platform/graphics/cairo/IntRectCairo.cpp \
+	Source/WebCore/platform/graphics/gtk/IntRectGtk.cpp \
+	Source/WebCore/platform/gtk/GtkInputMethodFilter.cpp \
+	Tools/TestWebKitAPI/config.h \
+	Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp
+
 if ENABLE_WEBKIT2
 noinst_PROGRAMS += \
 	Programs/TestWebKitAPI/TestWebKit2
@@ -99,8 +125,10 @@ Programs_TestWebKitAPI_TestWebKit2_SOURCES = \
 	Tools/TestWebKitAPI/Tests/WebKit2/ForceRepaint.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypeHTML.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypePNG.cpp \
+	Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/HitTestResultNodeHandle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic.cpp \
+	Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/LoadAlternateHTMLStringWithNonDirectoryURL.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/LoadCanceledNoServerRedirectCallback.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/MouseMoveAfterCrash.cpp \
@@ -139,8 +167,10 @@ Libraries_libTestWebKitAPIInjectedBundle_la_SOURCES = \
 	Tools/TestWebKitAPI/Tests/WebKit2/DocumentStartUserScriptAlertCrash_Bundle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionBasic_Bundle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionNoCache_Bundle.cpp \
+	Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback_Bundle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/HitTestResultNodeHandle_Bundle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic_Bundle.cpp \
+	Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/LoadCanceledNoServerRedirectCallback_Bundle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/MouseMoveAfterCrash_Bundle.cpp \
 	Tools/TestWebKitAPI/Tests/WebKit2/NewFirstVisuallyNonEmptyLayout_Bundle.cpp \
diff --git a/Tools/TestWebKitAPI/PlatformUtilities.cpp b/Tools/TestWebKitAPI/PlatformUtilities.cpp
index ec20dc1e0..1ded2a94c 100644
--- a/Tools/TestWebKitAPI/PlatformUtilities.cpp
+++ b/Tools/TestWebKitAPI/PlatformUtilities.cpp
@@ -40,20 +40,25 @@ WKContextRef createContextWithInjectedBundle()
     return context;
 }
 
-WKContextRef createContextForInjectedBundleTest(const std::string& testName, WKTypeRef userData)
+WKDictionaryRef createInitializationDictionaryForInjectedBundleTest(const std::string& testName, WKTypeRef userData)
 {
-    WKRetainPtr<WKStringRef> injectedBundlePath(AdoptWK, createInjectedBundlePath());
-    WKContextRef context = WKContextCreateWithInjectedBundlePath(injectedBundlePath.get());
+    WKMutableDictionaryRef initializationDictionary = WKMutableDictionaryCreate();
 
-    WKRetainPtr<WKMutableDictionaryRef> initializationDictionary(AdoptWK, WKMutableDictionaryCreate());
-    
     WKRetainPtr<WKStringRef> testNameKey(AdoptWK, WKStringCreateWithUTF8CString("TestName"));
     WKRetainPtr<WKStringRef> testNameString(AdoptWK, WKStringCreateWithUTF8CString(testName.c_str()));
-    WKDictionaryAddItem(initializationDictionary.get(), testNameKey.get(), testNameString.get());
+    WKDictionaryAddItem(initializationDictionary, testNameKey.get(), testNameString.get());
 
     WKRetainPtr<WKStringRef> userDataKey(AdoptWK, WKStringCreateWithUTF8CString("UserData"));
-    WKDictionaryAddItem(initializationDictionary.get(), userDataKey.get(), userData);
+    WKDictionaryAddItem(initializationDictionary, userDataKey.get(), userData);
+
+    return initializationDictionary;
+}
+
+WKContextRef createContextForInjectedBundleTest(const std::string& testName, WKTypeRef userData)
+{
+    WKContextRef context = createContextWithInjectedBundle();
 
+    WKRetainPtr<WKDictionaryRef> initializationDictionary(AdoptWK, createInitializationDictionaryForInjectedBundleTest(testName, userData));
     WKContextSetInitializationUserDataForInjectedBundle(context, initializationDictionary.get());
 
     return context;
diff --git a/Tools/TestWebKitAPI/PlatformUtilities.h b/Tools/TestWebKitAPI/PlatformUtilities.h
index c3ea21e28..10da84d33 100644
--- a/Tools/TestWebKitAPI/PlatformUtilities.h
+++ b/Tools/TestWebKitAPI/PlatformUtilities.h
@@ -51,6 +51,7 @@ void sleep(double seconds);
 
 WKContextRef createContextWithInjectedBundle();
 WKContextRef createContextForInjectedBundleTest(const std::string&, WKTypeRef userData = 0);
+WKDictionaryRef createInitializationDictionaryForInjectedBundleTest(const std::string&, WKTypeRef userData);
 
 WKStringRef createInjectedBundlePath();
 WKURLRef createURLForResource(const char* resource, const char* extension);
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.gyp/.gitignore b/Tools/TestWebKitAPI/TestWebKitAPI.gyp/.gitignore
index 72f70a29c..2ca14bf1e 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.gyp/.gitignore
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.gyp/.gitignore
@@ -2,4 +2,5 @@
 *.mk
 *.sln
 *.vcproj*
+*.vcxproj*
 *.xcodeproj*
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp b/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp
index 9f6681dfe..6f5fba2d8 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.gyp/TestWebKitAPI.gyp
@@ -82,8 +82,61 @@
                         '<(source_dir)/WebKit/chromium/src/ChromiumCurrentTime.cpp', 
                         '<(source_dir)/WebKit/chromium/src/ChromiumThreading.cpp', 
                     ], 
-                }], 
-            ], 
+                }],
+                ['OS=="android" and gtest_target_type == "shared_library"', {
+                    'type': 'shared_library',
+                    'dependencies': [
+                        '<(chromium_src_dir)/testing/android/native_test.gyp:native_test_native_code',
+                    ],
+                }],
+            ],
         }, 
     ], # targets
+    'conditions': [
+        ['OS=="android" and gtest_target_type == "shared_library"', {
+            # Wrap libTestWebKitAPI.so into an android apk for execution.
+            'targets': [{
+                'target_name': 'TestWebKitAPI_apk',
+                'type': 'none',
+                'dependencies': [
+                    '<(chromium_src_dir)/base/base.gyp:base_java',
+                    'TestWebKitAPI',
+                ],
+                'variables': {
+                    'input_shlib_path': '<(SHARED_LIB_DIR)/<(SHARED_LIB_PREFIX)TestWebKitAPI<(SHARED_LIB_SUFFIX)',
+                    'input_jars_paths': [
+                        '<(PRODUCT_DIR)/lib.java/chromium_base.jar',
+                    ],
+                },
+                # Part of the following was copied from <(chromium_src_dir)/build/apk_test.gpyi.
+                # Not including it because gyp include doesn't support variable in path or under
+                # conditions. And we also have some different requirements.
+                'actions': [{
+                    'action_name': 'apk_TestWebKitAPI',
+                    'message': 'Building TestWebKitAPI test apk.',
+                    'inputs': [
+                        '<(chromium_src_dir)/testing/android/AndroidManifest.xml',
+                        '<(chromium_src_dir)/testing/android/generate_native_test.py',
+                        '<(input_shlib_path)',
+                        '<@(input_jars_paths)',
+                    ],
+                    'outputs': [
+                        '<(PRODUCT_DIR)/TestWebKitAPI_apk/TestWebKitAPI-debug.apk',
+                    ],
+                    'action': [
+                        '<(chromium_src_dir)/testing/android/generate_native_test.py',
+                        '--native_library',
+                        '<(input_shlib_path)',
+                        '--jars',
+                        '"<@(input_jars_paths)"',
+                        '--output',
+                        '<(PRODUCT_DIR)/TestWebKitAPI_apk',
+                        '--ant-args',
+                        '-DPRODUCT_DIR=<(ant_build_out)',
+                        '--ant-compile'
+                    ],
+                }],
+            }],
+        }],
+    ],
 }
diff --git a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
index 628a59586..f5ff80418 100644
--- a/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
+++ b/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
@@ -19,6 +19,8 @@
 		1ADBEFAE130C689C00D61D19 /* ForceRepaint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ADBEFAD130C689C00D61D19 /* ForceRepaint.cpp */; };
 		1ADBEFE3130C6AA100D61D19 /* simple-accelerated-compositing.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 1ADBEFBC130C6A0100D61D19 /* simple-accelerated-compositing.html */; };
 		1AEDE22613E5E7E700E62FE8 /* InjectedBundleControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1AEDE22413E5E7A000E62FE8 /* InjectedBundleControllerMac.mm */; };
+		26DF5A5E15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 26DF5A5D15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm */; };
+		26DF5A6315A2A27E003689C2 /* CancelLoadFromResourceLoadDelegate.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 26DF5A6115A2A22B003689C2 /* CancelLoadFromResourceLoadDelegate.html */; };
 		333B9CE21277F23100FEFCE3 /* PreventEmptyUserAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 333B9CE11277F23100FEFCE3 /* PreventEmptyUserAgent.cpp */; };
 		33BE5AF5137B5A6C00705813 /* MouseMoveAfterCrash.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33BE5AF4137B5A6C00705813 /* MouseMoveAfterCrash.cpp */; };
 		33BE5AF9137B5AAE00705813 /* MouseMoveAfterCrash_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33BE5AF8137B5AAE00705813 /* MouseMoveAfterCrash_Bundle.cpp */; };
@@ -71,6 +73,10 @@
 		93F1DB5714DB1B840024C362 /* NewFirstVisuallyNonEmptyLayoutFails_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F1DB5614DB1B840024C362 /* NewFirstVisuallyNonEmptyLayoutFails_Bundle.cpp */; };
 		93F7E86C14DC8E4D00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F7E86B14DC8E4D00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames.cpp */; };
 		93F7E86F14DC8E5C00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F7E86E14DC8E5B00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp */; };
+		9B26FC6C159D061000CC3765 /* HTMLFormCollectionNamedItem.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9B26FC6B159D061000CC3765 /* HTMLFormCollectionNamedItem.mm */; };
+		9B26FCCA159D16DE00CC3765 /* HTMLFormCollectionNamedItem.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9B26FCB4159D15E700CC3765 /* HTMLFormCollectionNamedItem.html */; };
+		9B4F8FA4159D52B1002D9F94 /* HTMLCollectionNamedItem.mm in Sources */ = {isa = PBXBuildFile; fileRef = 9B4F8FA3159D52B1002D9F94 /* HTMLCollectionNamedItem.mm */; };
+		9B4F8FA7159D52DD002D9F94 /* HTMLCollectionNamedItem.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9B4F8FA6159D52CA002D9F94 /* HTMLCollectionNamedItem.html */; };
 		A7A966DB140ECCC8005EF9B4 /* CheckedArithmeticOperations.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7A966DA140ECCC8005EF9B4 /* CheckedArithmeticOperations.cpp */; };
 		B55F11A01516834F00915916 /* AttributedString.mm in Sources */ = {isa = PBXBuildFile; fileRef = B55F119F1516834F00915916 /* AttributedString.mm */; };
 		B55F11B71517D03300915916 /* attributedStringCustomFont.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = B55F11B01517A2C400915916 /* attributedStringCustomFont.html */; };
@@ -148,6 +154,10 @@
 		E1220DCA155B28AA0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = E1220DC9155B287D0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html */; };
 		E490296814E2E3A4002BEDD1 /* TypingStyleCrash.mm in Sources */ = {isa = PBXBuildFile; fileRef = E490296714E2E3A4002BEDD1 /* TypingStyleCrash.mm */; };
 		F3FC3EE313678B7300126A65 /* libgtest.a in Frameworks */ = {isa = PBXBuildFile; fileRef = F3FC3EE213678B7300126A65 /* libgtest.a */; };
+		F660AA0D15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F660AA0C15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp */; };
+		F660AA1115A5F631003A1243 /* GetInjectedBundleInitializationUserDataCallback_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F660AA0F15A5F624003A1243 /* GetInjectedBundleInitializationUserDataCallback_Bundle.cpp */; };
+		F660AA1315A619C9003A1243 /* InjectedBundleInitializationUserDataCallbackWins.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F660AA1215A619C8003A1243 /* InjectedBundleInitializationUserDataCallbackWins.cpp */; };
+		F660AA1515A61ABF003A1243 /* InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F660AA1415A61ABF003A1243 /* InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp */; };
 		F6F3F29113342FEB00A6BF19 /* CookieManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6F3F29013342FEB00A6BF19 /* CookieManager.cpp */; };
 		F6F49C6915545C8E0007F39D /* DOMWindowExtensionNoCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6F49C6715545C8D0007F39D /* DOMWindowExtensionNoCache.cpp */; };
 		F6F49C6B15545CA70007F39D /* DOMWindowExtensionNoCache_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F6F49C6615545C8D0007F39D /* DOMWindowExtensionNoCache_Bundle.cpp */; };
@@ -185,7 +195,10 @@
 				B55F11BE15191A0600915916 /* Ahem.ttf in Copy Resources */,
 				B55F11B71517D03300915916 /* attributedStringCustomFont.html in Copy Resources */,
 				76E182DF154767E600F1FADD /* auto-submitting-form.html in Copy Resources */,
+				26DF5A6315A2A27E003689C2 /* CancelLoadFromResourceLoadDelegate.html in Copy Resources */,
 				5142B2731517C8C800C32B19 /* ContextMenuCanCopyURL.html in Copy Resources */,
+				9B4F8FA7159D52DD002D9F94 /* HTMLCollectionNamedItem.html in Copy Resources */,
+				9B26FCCA159D16DE00CC3765 /* HTMLFormCollectionNamedItem.html in Copy Resources */,
 				E1220DCA155B28AA0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html in Copy Resources */,
 				517E7E04151119C100D0B008 /* MemoryCachePruneWithinResourceLoadDelegate.html in Copy Resources */,
 				379028B914FAC24C007E6B43 /* acceptsFirstMouse.html in Copy Resources */,
@@ -225,6 +238,8 @@
 		1ADBEFAD130C689C00D61D19 /* ForceRepaint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ForceRepaint.cpp; sourceTree = "<group>"; };
 		1ADBEFBC130C6A0100D61D19 /* simple-accelerated-compositing.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "simple-accelerated-compositing.html"; sourceTree = "<group>"; };
 		1AEDE22413E5E7A000E62FE8 /* InjectedBundleControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = InjectedBundleControllerMac.mm; sourceTree = "<group>"; };
+		26DF5A5D15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = CancelLoadFromResourceLoadDelegate.mm; sourceTree = "<group>"; };
+		26DF5A6115A2A22B003689C2 /* CancelLoadFromResourceLoadDelegate.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = CancelLoadFromResourceLoadDelegate.html; sourceTree = "<group>"; };
 		333B9CE11277F23100FEFCE3 /* PreventEmptyUserAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PreventEmptyUserAgent.cpp; sourceTree = "<group>"; };
 		33BE5AF4137B5A6C00705813 /* MouseMoveAfterCrash.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MouseMoveAfterCrash.cpp; sourceTree = "<group>"; };
 		33BE5AF8137B5AAE00705813 /* MouseMoveAfterCrash_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MouseMoveAfterCrash_Bundle.cpp; sourceTree = "<group>"; };
@@ -279,6 +294,10 @@
 		93F1DB5614DB1B840024C362 /* NewFirstVisuallyNonEmptyLayoutFails_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NewFirstVisuallyNonEmptyLayoutFails_Bundle.cpp; sourceTree = "<group>"; };
 		93F7E86B14DC8E4D00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NewFirstVisuallyNonEmptyLayoutFrames.cpp; sourceTree = "<group>"; };
 		93F7E86E14DC8E5B00C84A99 /* NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NewFirstVisuallyNonEmptyLayoutFrames_Bundle.cpp; sourceTree = "<group>"; };
+		9B26FC6B159D061000CC3765 /* HTMLFormCollectionNamedItem.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = HTMLFormCollectionNamedItem.mm; sourceTree = "<group>"; };
+		9B26FCB4159D15E700CC3765 /* HTMLFormCollectionNamedItem.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = HTMLFormCollectionNamedItem.html; sourceTree = "<group>"; };
+		9B4F8FA3159D52B1002D9F94 /* HTMLCollectionNamedItem.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = HTMLCollectionNamedItem.mm; sourceTree = "<group>"; };
+		9B4F8FA6159D52CA002D9F94 /* HTMLCollectionNamedItem.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = HTMLCollectionNamedItem.html; sourceTree = "<group>"; };
 		A7A966DA140ECCC8005EF9B4 /* CheckedArithmeticOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CheckedArithmeticOperations.cpp; path = WTF/CheckedArithmeticOperations.cpp; sourceTree = "<group>"; };
 		B55F119F1516834F00915916 /* AttributedString.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = AttributedString.mm; sourceTree = "<group>"; };
 		B55F11B01517A2C400915916 /* attributedStringCustomFont.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = attributedStringCustomFont.html; sourceTree = "<group>"; };
@@ -370,6 +389,10 @@
 		E1220DC9155B287D0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = MemoryCacheDisableWithinResourceLoadDelegate.html; sourceTree = "<group>"; };
 		E490296714E2E3A4002BEDD1 /* TypingStyleCrash.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TypingStyleCrash.mm; sourceTree = "<group>"; };
 		F3FC3EE213678B7300126A65 /* libgtest.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libgtest.a; sourceTree = BUILT_PRODUCTS_DIR; };
+		F660AA0C15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetInjectedBundleInitializationUserDataCallback.cpp; sourceTree = "<group>"; };
+		F660AA0F15A5F624003A1243 /* GetInjectedBundleInitializationUserDataCallback_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetInjectedBundleInitializationUserDataCallback_Bundle.cpp; sourceTree = "<group>"; };
+		F660AA1215A619C8003A1243 /* InjectedBundleInitializationUserDataCallbackWins.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleInitializationUserDataCallbackWins.cpp; sourceTree = "<group>"; };
+		F660AA1415A61ABF003A1243 /* InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp; sourceTree = "<group>"; };
 		F6F3F29013342FEB00A6BF19 /* CookieManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CookieManager.cpp; sourceTree = "<group>"; };
 		F6F49C6615545C8D0007F39D /* DOMWindowExtensionNoCache_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowExtensionNoCache_Bundle.cpp; sourceTree = "<group>"; };
 		F6F49C6715545C8D0007F39D /* DOMWindowExtensionNoCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowExtensionNoCache.cpp; sourceTree = "<group>"; };
@@ -528,10 +551,14 @@
 				1ADBEFAD130C689C00D61D19 /* ForceRepaint.cpp */,
 				BCBD370F125AA2EB00D2C29F /* FrameMIMETypeHTML.cpp */,
 				BCBD3760125ABCFE00D2C29F /* FrameMIMETypePNG.cpp */,
+				F660AA0C15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp */,
+				F660AA0F15A5F624003A1243 /* GetInjectedBundleInitializationUserDataCallback_Bundle.cpp */,
 				4BFDFFA8131477770061F24B /* HitTestResultNodeHandle.cpp */,
 				4BFDFFA61314776C0061F24B /* HitTestResultNodeHandle_Bundle.cpp */,
 				BC575AAC126E83B9006F0F12 /* InjectedBundleBasic.cpp */,
 				BC575AAF126E83C8006F0F12 /* InjectedBundleBasic_Bundle.cpp */,
+				F660AA1215A619C8003A1243 /* InjectedBundleInitializationUserDataCallbackWins.cpp */,
+				F660AA1415A61ABF003A1243 /* InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp */,
 				52CB47401448FB9300873995 /* LoadAlternateHTMLStringWithNonDirectoryURL.cpp */,
 				33DC8910141953A300747EF7 /* LoadCanceledNoServerRedirectCallback.cpp */,
 				33DC89131419579F00747EF7 /* LoadCanceledNoServerRedirectCallback_Bundle.cpp */,
@@ -653,11 +680,14 @@
 				C07E6CB013FD737C0038B22B /* Resources */,
 				379028B514FABD92007E6B43 /* AcceptsFirstMouse.mm */,
 				B55F119F1516834F00915916 /* AttributedString.mm */,
+				26DF5A5D15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm */,
 				5142B2701517C88B00C32B19 /* ContextMenuCanCopyURL.mm */,
 				37DC678B140D7C5000ABCCDB /* DOMRangeOfString.mm */,
 				C07E6CAE13FD67650038B22B /* DynamicDeviceScaleFactor.mm */,
 				3776BC62150946BC0043A66D /* DeviceScaleFactorInDashboardRegions.mm */,
 				939BA91614103412001A01BD /* DeviceScaleFactorOnBack.mm */,
+				9B4F8FA3159D52B1002D9F94 /* HTMLCollectionNamedItem.mm */,
+				9B26FC6B159D061000CC3765 /* HTMLFormCollectionNamedItem.mm */,
 				C507E8A614C6545B005D6B3B /* InspectorBar.mm */,
 				E1220D9F155B25480013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.mm */,
 				517E7DFB15110EA600D0B008 /* MemoryCachePruneWithinResourceLoadDelegate.mm */,
@@ -679,8 +709,11 @@
 				B55F11B9151916E600915916 /* Ahem.ttf */,
 				B55F11B01517A2C400915916 /* attributedStringCustomFont.html */,
 				379028B814FABE49007E6B43 /* acceptsFirstMouse.html */,
+				26DF5A6115A2A22B003689C2 /* CancelLoadFromResourceLoadDelegate.html */,
 				5142B2721517C89100C32B19 /* ContextMenuCanCopyURL.html */,
 				37DC678F140D7D3A00ABCCDB /* DOMRangeOfString.html */,
+				9B4F8FA6159D52CA002D9F94 /* HTMLCollectionNamedItem.html */,
+				9B26FCB4159D15E700CC3765 /* HTMLFormCollectionNamedItem.html */,
 				E1220DC9155B287D0013E2FC /* MemoryCacheDisableWithinResourceLoadDelegate.html */,
 				517E7E031511187500D0B008 /* MemoryCachePruneWithinResourceLoadDelegate.html */,
 				C07E6CB113FD738A0038B22B /* devicePixelRatio.html */,
@@ -891,6 +924,11 @@
 				F6F49C6915545C8E0007F39D /* DOMWindowExtensionNoCache.cpp in Sources */,
 				51E93017156B13E1004C99DF /* WKPageGetScaleFactorNotZero.cpp in Sources */,
 				52B8CF9615868CF000281053 /* SetDocumentURI.mm in Sources */,
+				9B26FC6C159D061000CC3765 /* HTMLFormCollectionNamedItem.mm in Sources */,
+				9B4F8FA4159D52B1002D9F94 /* HTMLCollectionNamedItem.mm in Sources */,
+				26DF5A5E15A29BAA003689C2 /* CancelLoadFromResourceLoadDelegate.mm in Sources */,
+				F660AA0D15A5F061003A1243 /* GetInjectedBundleInitializationUserDataCallback.cpp in Sources */,
+				F660AA1315A619C9003A1243 /* InjectedBundleInitializationUserDataCallbackWins.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -923,6 +961,8 @@
 				51393E221523952D005F39C5 /* DOMWindowExtensionBasic_Bundle.cpp in Sources */,
 				76E182DD1547569100F1FADD /* WillSendSubmitEvent_Bundle.cpp in Sources */,
 				F6F49C6B15545CA70007F39D /* DOMWindowExtensionNoCache_Bundle.cpp in Sources */,
+				F660AA1115A5F631003A1243 /* GetInjectedBundleInitializationUserDataCallback_Bundle.cpp in Sources */,
+				F660AA1515A61ABF003A1243 /* InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionBasic_Bundle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionBasic_Bundle.cpp
index bb5b1eb68..98bfab35a 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionBasic_Bundle.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionBasic_Bundle.cpp
@@ -81,7 +81,6 @@ private:
     void sendExtensionStateMessage();
     void sendBundleMessage(const char*);
 
-    WKBundlePageGroupRef m_pageGroup;
     WKBundleRef m_bundle;
     ExtensionRecord m_extensionRecords[6];
     HashMap<WKBundleDOMWindowExtensionRef, int> m_extensionToRecordMap;
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionNoCache_Bundle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionNoCache_Bundle.cpp
index fcc0c72f6..8f6cd7b37 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionNoCache_Bundle.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/DOMWindowExtensionNoCache_Bundle.cpp
@@ -80,7 +80,6 @@ private:
     void sendExtensionStateMessage();
     void sendBundleMessage(const char*);
 
-    WKBundlePageGroupRef m_pageGroup;
     WKBundleRef m_bundle;
     ExtensionRecord m_extensionRecords[10];
     HashMap<WKBundleDOMWindowExtensionRef, int> m_extensionToRecordMap;
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/DocumentStartUserScriptAlertCrash_Bundle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/DocumentStartUserScriptAlertCrash_Bundle.cpp
index 3aa290981..30805f759 100644
--- a/Tools/TestWebKitAPI/Tests/WebKit2/DocumentStartUserScriptAlertCrash_Bundle.cpp
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/DocumentStartUserScriptAlertCrash_Bundle.cpp
@@ -48,9 +48,6 @@ public:
         WKRetainPtr<WKStringRef> source(AdoptWK, WKStringCreateWithUTF8CString("alert('an alert');"));
         WKBundleAddUserScript(bundle, pageGroup, WKBundleScriptWorldNormalWorld(), source.get(), 0, 0, 0, kWKInjectAtDocumentStart, kWKInjectInAllFrames);
     }
-
-private:
-    WKBundlePageGroupRef m_pageGroup;
 };
 
 static InjectedBundleTest::Register<DocumentStartUserScriptAlertCrashTest> registrar("DocumentStartUserScriptAlertCrashTest");
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback.cpp
new file mode 100644
index 000000000..4bfe87949
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool done;
+
+static void didReceiveMessageFromInjectedBundle(WKContextRef context, WKStringRef, WKTypeRef messageBody, const void* clientInfo)
+{
+    EXPECT_WK_STREQ("Extra initialization data", static_cast<WKStringRef>(messageBody));
+    done = true;
+}
+
+static WKTypeRef getInjectedBundleInitializationUserData(WKContextRef context, const void* clientInfo)
+{
+    return Util::createInitializationDictionaryForInjectedBundleTest("GetInjectedBundleInitializationUserDataCallbackTest",  Util::toWK("Extra initialization data").get());
+}
+
+TEST(WebKit2, GetInjectedBundleInitializationUserDataCallback)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, Util::createContextWithInjectedBundle());
+
+    WKContextInjectedBundleClient injectedBundleClient;
+    memset(&injectedBundleClient, 0, sizeof(injectedBundleClient));
+    injectedBundleClient.version = 1;
+    injectedBundleClient.clientInfo = 0;
+    injectedBundleClient.didReceiveMessageFromInjectedBundle = didReceiveMessageFromInjectedBundle;
+    injectedBundleClient.getInjectedBundleInitializationUserData = getInjectedBundleInitializationUserData;
+    WKContextSetInjectedBundleClient(context.get(), &injectedBundleClient);
+
+    PlatformWebView webView(context.get());
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("simple", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&done);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback_Bundle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback_Bundle.cpp
new file mode 100644
index 000000000..97500b59b
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/GetInjectedBundleInitializationUserDataCallback_Bundle.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedBundleTest.h"
+#include "PlatformUtilities.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+class GetInjectedBundleInitializationUserDataCallbackTest : public InjectedBundleTest {
+public:
+    GetInjectedBundleInitializationUserDataCallbackTest(const std::string& identifier)
+        : InjectedBundleTest(identifier)
+    {
+    }
+
+    virtual void initialize(WKBundleRef bundle, WKTypeRef userData)
+    {
+        WKBundlePostMessage(bundle, Util::toWK("Return the userData").get(), userData);
+    }
+};
+
+static InjectedBundleTest::Register<GetInjectedBundleInitializationUserDataCallbackTest> registrar("GetInjectedBundleInitializationUserDataCallbackTest");
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins.cpp
new file mode 100644
index 000000000..360cf39db
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool done;
+
+static void didReceiveMessageFromInjectedBundle(WKContextRef context, WKStringRef, WKTypeRef messageBody, const void* clientInfo)
+{
+    EXPECT_WK_STREQ("Set in the getInjectedBundleInitializationUserData callback", static_cast<WKStringRef>(messageBody));
+    done = true;
+}
+
+static WKTypeRef getInjectedBundleInitializationUserData(WKContextRef context, const void* clientInfo)
+{
+    return Util::createInitializationDictionaryForInjectedBundleTest("InjectedBundleInitializationUserDataCallbackWinsTest",  Util::toWK("Set in the getInjectedBundleInitializationUserData callback").get());
+}
+
+TEST(WebKit2, InjectedBundleInitializationUserDataCallbackWins)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, Util::createContextWithInjectedBundle());
+    WKRetainPtr<WKDictionaryRef> initializationDictionary(AdoptWK, Util::createInitializationDictionaryForInjectedBundleTest("InjectedBundleInitializationUserDataCallbackWinsTest",  Util::toWK("Set with WKContextSetInitializationUserDataForInjectedBundle").get()));
+    WKContextSetInitializationUserDataForInjectedBundle(context.get(), initializationDictionary.get());
+
+    WKContextInjectedBundleClient injectedBundleClient;
+    memset(&injectedBundleClient, 0, sizeof(injectedBundleClient));
+    injectedBundleClient.version = 1;
+    injectedBundleClient.clientInfo = 0;
+    injectedBundleClient.didReceiveMessageFromInjectedBundle = didReceiveMessageFromInjectedBundle;
+    injectedBundleClient.getInjectedBundleInitializationUserData = getInjectedBundleInitializationUserData;
+    WKContextSetInjectedBundleClient(context.get(), &injectedBundleClient);
+
+    PlatformWebView webView(context.get());
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("simple", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&done);
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp
new file mode 100644
index 000000000..36708a4d7
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/WebKit2/InjectedBundleInitializationUserDataCallbackWins_Bundle.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedBundleTest.h"
+#include "PlatformUtilities.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+class InjectedBundleInitializationUserDataCallbackWinsTest : public InjectedBundleTest {
+public:
+    InjectedBundleInitializationUserDataCallbackWinsTest(const std::string& identifier)
+        : InjectedBundleTest(identifier)
+    {
+    }
+
+    virtual void initialize(WKBundleRef bundle, WKTypeRef userData)
+    {
+        WKBundlePostMessage(bundle, Util::toWK("Return the userData").get(), userData);
+    }
+};
+
+static InjectedBundleTest::Register<InjectedBundleInitializationUserDataCallbackWinsTest> registrar("InjectedBundleInitializationUserDataCallbackWinsTest");
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp b/Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp
new file mode 100644
index 000000000..c2bdcce4b
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/gtk/InputMethodFilter.cpp
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "GtkInputMethodFilter.h"
+#include "WTFStringUtilities.h"
+#include <gtk/gtk.h>
+#include <wtf/gobject/GOwnPtr.h>
+#include <wtf/gobject/GRefPtr.h>
+#include <wtf/text/CString.h>
+
+using namespace WebCore;
+
+namespace TestWebKitAPI {
+
+class TestInputMethodFilter : public GtkInputMethodFilter {
+public:
+    TestInputMethodFilter()
+        : m_testWindow(gtk_window_new(GTK_WINDOW_POPUP))
+    {
+        gtk_widget_show(m_testWindow.get());
+        setWidget(m_testWindow.get());
+
+        // Focus in is necessary to activate the default input method in the multicontext.
+        notifyFocusedIn();
+    }
+
+    Vector<String>& events() { return m_events; }
+
+    void sendKeyEventToFilter(unsigned int gdkKeyValue, GdkEventType type, unsigned int modifiers = 0)
+    {
+        GdkEvent* event = gdk_event_new(type);
+        event->key.keyval = gdkKeyValue;
+        event->key.state = modifiers;
+        event->key.window = gtk_widget_get_window(m_testWindow.get());
+        event->key.time = GDK_CURRENT_TIME;
+        g_object_ref(event->key.window);
+
+#ifndef GTK_API_VERSION_2
+        gdk_event_set_device(event, gdk_device_manager_get_client_pointer(gdk_display_get_device_manager(gdk_display_get_default())));
+#endif
+
+        GOwnPtr<GdkKeymapKey> keys;
+        gint nKeys;
+        if (gdk_keymap_get_entries_for_keyval(gdk_keymap_get_default(), gdkKeyValue, &keys.outPtr(), &nKeys))
+            event->key.hardware_keycode = keys.get()[0].keycode;
+
+        filterKeyEvent(&event->key);
+        gdk_event_free(event);
+    }
+
+    void sendPressAndReleaseKeyEventPairToFilter(unsigned int gdkKeyValue, unsigned int modifiers = 0)
+    {
+        sendKeyEventToFilter(gdkKeyValue, GDK_KEY_PRESS, modifiers);
+        sendKeyEventToFilter(gdkKeyValue, GDK_KEY_RELEASE, modifiers);
+    }
+
+protected:
+    virtual bool sendSimpleKeyEvent(GdkEventKey* event, WTF::String eventString)
+    {
+        const char* eventType = event->type == GDK_KEY_RELEASE ? "release" : "press";
+        if (!eventString.isNull())
+            m_events.append(String::format("sendSimpleKeyEvent type=%s keycode=%x text='%s'", eventType, event->keyval, eventString.utf8().data()));
+        else
+            m_events.append(String::format("sendSimpleKeyEvent type=%s keycode=%x", eventType, event->keyval));
+
+        return true;
+    }
+
+    virtual bool sendKeyEventWithCompositionResults(GdkEventKey* event, ResultsToSend resultsToSend)
+    {
+        const char* eventType = event->type == GDK_KEY_RELEASE ? "release" : "press";
+        m_events.append(String::format("sendKeyEventWithCompositionResults type=%s keycode=%u", eventType, event->keyval));
+
+        if (resultsToSend & Composition && !m_confirmedComposition.isNull())
+            confirmCompositionText(m_confirmedComposition);
+        if (resultsToSend & Preedit && !m_preedit.isNull())
+            setPreedit(m_preedit, m_cursorOffset);
+
+        return true;
+    }
+
+    virtual bool canEdit()
+    {
+        return true;
+    }
+
+    virtual void confirmCompositionText(String text)
+    {
+        m_events.append(String::format("confirmComposition '%s'", text.utf8().data()));
+    }
+
+    virtual void confirmCurrentComposition()
+    {
+        m_events.append(String("confirmCurrentcomposition"));
+    }
+
+    virtual void cancelCurrentComposition()
+    {
+        m_events.append(String("cancelCurrentComposition"));
+    }
+
+    virtual void setPreedit(String preedit, int cursorOffset)
+    {
+        m_events.append(String::format("setPreedit text='%s' cursorOffset=%i", preedit.utf8().data(), cursorOffset));
+    }
+
+private:
+    GRefPtr<GtkWidget> m_testWindow;
+    Vector<String> m_events;
+};
+
+TEST(GTK, GtkInputMethodFilterSimple)
+{
+    TestInputMethodFilter inputMethodFilter;
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_g);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_t);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_k);
+
+    const Vector<String>& events = inputMethodFilter.events();
+
+    ASSERT_EQ(6, events.size());
+    ASSERT_EQ(String("sendSimpleKeyEvent type=press keycode=67 text='g'"), events[0]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=67"), events[1]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=press keycode=74 text='t'"), events[2]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=74"), events[3]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=press keycode=6b text='k'"), events[4]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=6b"), events[5]);
+}
+
+TEST(GTK, GtkInputMethodFilterUnicodeSequence)
+{
+    TestInputMethodFilter inputMethodFilter;
+
+    // This is simple unicode hex entry of the characters, u, 0, 0, f, 4 pressed with
+    // the shift and controls keys held down. In reality, these values are not typical
+    // of an actual hex entry, because they'd be transformed by the shift modifier according
+    // to the keyboard layout. For instance, on a US keyboard a 0 with the shift key pressed
+    // is a right parenthesis. Using these values prevents having to work out what the
+    // transformed characters are based on the current keyboard layout.
+    inputMethodFilter.sendKeyEventToFilter(GDK_KEY_Control_L, GDK_KEY_PRESS);
+    inputMethodFilter.sendKeyEventToFilter(GDK_KEY_Shift_L, GDK_KEY_PRESS, GDK_CONTROL_MASK);
+
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_U, GDK_SHIFT_MASK | GDK_CONTROL_MASK);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_0, GDK_SHIFT_MASK | GDK_CONTROL_MASK);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_0, GDK_SHIFT_MASK | GDK_CONTROL_MASK);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_F, GDK_SHIFT_MASK | GDK_CONTROL_MASK);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_4, GDK_SHIFT_MASK | GDK_CONTROL_MASK);
+
+    inputMethodFilter.sendKeyEventToFilter(GDK_KEY_Shift_L, GDK_KEY_RELEASE, GDK_CONTROL_MASK | GDK_SHIFT_MASK);
+    inputMethodFilter.sendKeyEventToFilter(GDK_KEY_Control_L, GDK_KEY_RELEASE, GDK_CONTROL_MASK);
+
+    const Vector<String>& events = inputMethodFilter.events();
+    ASSERT_EQ(21, events.size());
+    ASSERT_EQ(String("sendSimpleKeyEvent type=press keycode=ffe3"), events[0]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=press keycode=ffe1"), events[1]);
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=85"), events[2]);
+    ASSERT_EQ(String("setPreedit text='u' cursorOffset=1"), events[3]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=55"), events[4]);
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=48"), events[5]);
+    ASSERT_EQ(String("setPreedit text='u0' cursorOffset=2"), events[6]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=30"), events[7]);
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=48"), events[8]);
+    ASSERT_EQ(String("setPreedit text='u00' cursorOffset=3"), events[9]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=30"), events[10]);
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=70"), events[11]);
+    ASSERT_EQ(String("setPreedit text='u00F' cursorOffset=4"), events[12]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=46"), events[13]);
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=52"), events[14]);
+    ASSERT_EQ(String("setPreedit text='u00F4' cursorOffset=5"), events[15]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=34"), events[16]);
+    ASSERT_EQ(String("confirmComposition 'ô'"), events[17]);
+    ASSERT_EQ(String("setPreedit text='' cursorOffset=0"), events[18]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=ffe1"), events[19]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=ffe3"), events[20]);
+}
+
+TEST(GTK, GtkInputMethodFilterComposeKey)
+{
+    TestInputMethodFilter inputMethodFilter;
+
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_Multi_key);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_apostrophe);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_o);
+
+    const Vector<String>& events = inputMethodFilter.events();
+    ASSERT_EQ(5, events.size());
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=39"), events[0]);
+    ASSERT_EQ(String("setPreedit text='' cursorOffset=0"), events[1]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=27"), events[2]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=press keycode=6f text='ó'"), events[3]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=6f"), events[4]);
+}
+
+typedef void (*GetPreeditStringCallback) (GtkIMContext*, gchar**, PangoAttrList**, int*);
+static void temporaryGetPreeditStringOverride(GtkIMContext*, char** string, PangoAttrList** attrs, int* cursorPosition)
+{
+    *string = g_strdup("preedit of doom, bringer of cheese");
+    *cursorPosition = 3;
+}
+
+TEST(GTK, GtkInputMethodFilterContextEventsWithoutKeyEvents)
+{
+    TestInputMethodFilter inputMethodFilter;
+
+    // This is a bit of a hack to avoid mocking out the entire InputMethodContext, by
+    // simply replacing the get_preedit_string virtual method for the length of this test.
+    GtkIMContext* context = inputMethodFilter.context();
+    GtkIMContextClass* contextClass = GTK_IM_CONTEXT_GET_CLASS(context);
+    GetPreeditStringCallback previousCallback = contextClass->get_preedit_string;
+    contextClass->get_preedit_string = temporaryGetPreeditStringOverride;
+
+    g_signal_emit_by_name(context, "preedit-changed");
+    g_signal_emit_by_name(context, "commit", "commit text");
+
+    contextClass->get_preedit_string = previousCallback;
+
+    const Vector<String>& events = inputMethodFilter.events();
+    ASSERT_EQ(6, events.size());
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=16777215"), events[0]);
+    ASSERT_EQ(String("setPreedit text='preedit of doom, bringer of cheese' cursorOffset=3"), events[1]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=ffffff"), events[2]);
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=16777215"), events[3]);
+    ASSERT_EQ(String("confirmComposition 'commit text'"), events[4]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=ffffff"), events[5]);
+}
+
+static bool gSawContextReset = false;
+typedef void (*ResetCallback) (GtkIMContext*);
+static void temporaryResetOverride(GtkIMContext*)
+{
+    gSawContextReset = true;
+}
+
+static void verifyCanceledComposition(const Vector<String>& events)
+{
+    ASSERT_EQ(4, events.size());
+    ASSERT_EQ(String("sendKeyEventWithCompositionResults type=press keycode=39"), events[0]);
+    ASSERT_EQ(String("setPreedit text='' cursorOffset=0"), events[1]);
+    ASSERT_EQ(String("sendSimpleKeyEvent type=release keycode=27"), events[2]);
+    ASSERT_EQ(String("confirmCurrentcomposition"), events[3]);
+    ASSERT(gSawContextReset);
+}
+
+TEST(GTK, GtkInputMethodFilterContextFocusOutDuringOngoingComposition)
+{
+    TestInputMethodFilter inputMethodFilter;
+
+    // See comment above about this technique.
+    GtkIMContext* context = inputMethodFilter.context();
+    GtkIMContextClass* contextClass = GTK_IM_CONTEXT_GET_CLASS(context);
+    ResetCallback previousCallback = contextClass->reset;
+    contextClass->reset = temporaryResetOverride;
+
+    gSawContextReset = false;
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_Multi_key);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_apostrophe);
+    inputMethodFilter.notifyFocusedOut();
+
+    verifyCanceledComposition(inputMethodFilter.events());
+
+    contextClass->reset = previousCallback;
+}
+
+TEST(GTK, GtkInputMethodFilterContextMouseClickDuringOngoingComposition)
+{
+    TestInputMethodFilter inputMethodFilter;
+
+    // See comment above about this technique.
+    GtkIMContext* context = inputMethodFilter.context();
+    GtkIMContextClass* contextClass = GTK_IM_CONTEXT_GET_CLASS(context);
+    ResetCallback previousCallback = contextClass->reset;
+    contextClass->reset = temporaryResetOverride;
+
+    gSawContextReset = false;
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_Multi_key);
+    inputMethodFilter.sendPressAndReleaseKeyEventPairToFilter(GDK_KEY_apostrophe);
+    inputMethodFilter.notifyMouseButtonPress();
+
+    verifyCanceledComposition(inputMethodFilter.events());
+
+    contextClass->reset = previousCallback;
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/mac/0.png b/Tools/TestWebKitAPI/Tests/mac/0.png
new file mode 100644
index 000000000..649d1adf5
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/0.png
diff --git a/Tools/TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm b/Tools/TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm
index 2c3fe2877..bc2f786f8 100644
--- a/Tools/TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm
+++ b/Tools/TestWebKitAPI/Tests/mac/AcceptsFirstMouse.mm
@@ -48,16 +48,16 @@ template <typename View>
 void AcceptsFirstMouse::runTest(View view)
 {
     RetainPtr<NSWindow> window(AdoptNS, [[NSWindow alloc] initWithContentRect:view.frame styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:YES]);
-    [window.get().contentView addSubview:view];
+    [[window.get() contentView] addSubview:view];
 
     CGFloat viewHeight = view.bounds.size.height;
 
     NSPoint pointInsideSelection = NSMakePoint(50, viewHeight - 50);
-    NSEvent *mouseEventInsideSelection = [NSEvent mouseEventWithType:NSLeftMouseDown location:pointInsideSelection modifierFlags:0 timestamp:0 windowNumber:window.get().windowNumber context:nil eventNumber:0 clickCount:1 pressure:1];
+    NSEvent *mouseEventInsideSelection = [NSEvent mouseEventWithType:NSLeftMouseDown location:pointInsideSelection modifierFlags:0 timestamp:0 windowNumber:[window.get() windowNumber] context:nil eventNumber:0 clickCount:1 pressure:1];
     EXPECT_TRUE([[view hitTest:pointInsideSelection] acceptsFirstMouse:mouseEventInsideSelection]);
 
     NSPoint pointOutsideSelection = NSMakePoint(50, viewHeight - 150);
-    NSEvent *mouseEventOutsideSelection = [NSEvent mouseEventWithType:NSLeftMouseDown location:pointOutsideSelection modifierFlags:0 timestamp:0 windowNumber:window.get().windowNumber context:nil eventNumber:0 clickCount:1 pressure:1];
+    NSEvent *mouseEventOutsideSelection = [NSEvent mouseEventWithType:NSLeftMouseDown location:pointOutsideSelection modifierFlags:0 timestamp:0 windowNumber:[window.get() windowNumber] context:nil eventNumber:0 clickCount:1 pressure:1];
     EXPECT_FALSE([[view hitTest:pointInsideSelection] acceptsFirstMouse:mouseEventOutsideSelection]);
 }
 
diff --git a/Tools/TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.html b/Tools/TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.html
new file mode 100644
index 000000000..efa4d1e37
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.html
@@ -0,0 +1,8 @@
+<script>
+    function cancelLoadAndJumpToBlank() {
+        window.stop();
+        window.location = "about:blank";
+    }
+</script>
+<img src="Ahem.ttf">
+<script src="about:blank"></script>
\ No newline at end of file
diff --git a/Tools/TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.mm b/Tools/TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.mm
new file mode 100644
index 000000000..3729eb53c
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/CancelLoadFromResourceLoadDelegate.mm
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "PlatformUtilities.h"
+#import <wtf/RetainPtr.h>
+
+@interface CancelLoadFromResourceLoadDelegate : NSObject {
+    size_t resourceCount;
+}
+
+@end
+
+@implementation CancelLoadFromResourceLoadDelegate
+
+- (void)webView:(WebView *)sender resource:(id)identifier didFinishLoadingFromDataSource:(WebDataSource *)dataSource
+{
+    // Break the load once we have loaded the <script> and <img>.
+    ++resourceCount;
+    if (resourceCount > 2)
+        [sender stringByEvaluatingJavaScriptFromString:@"cancelLoadAndJumpToBlank()"];
+}
+@end
+
+
+static bool didFinishLoad = false;
+
+@interface CancelLoadFromResourceLoadDelegateFrameLoadDelegate : NSObject
+@end
+
+@implementation CancelLoadFromResourceLoadDelegateFrameLoadDelegate
+- (void)webView:(WebView *)sender didFinishLoadForFrame:(WebFrame *)frame
+{
+    if ([[sender mainFrameURL] isEqualToString:@"about:blank"])
+        didFinishLoad = true;
+}
+@end
+
+namespace TestWebKitAPI {
+
+TEST(WebKit1, CancelLoadFromResourceLoadDelegate)
+{
+    NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
+
+    RetainPtr<WebView> webView(AdoptNS, [[WebView alloc] initWithFrame:NSMakeRect(0, 0, 120, 200) frameName:nil groupName:nil]);
+
+    RetainPtr<CancelLoadFromResourceLoadDelegate> resourceLoadDelegate(AdoptNS, [[CancelLoadFromResourceLoadDelegate alloc] init]);
+    webView.get().resourceLoadDelegate = resourceLoadDelegate.get();
+    RetainPtr<CancelLoadFromResourceLoadDelegateFrameLoadDelegate> frameLoadDelegate(AdoptNS, [[CancelLoadFromResourceLoadDelegateFrameLoadDelegate alloc] init]);
+    webView.get().frameLoadDelegate = frameLoadDelegate.get();
+
+    [[webView.get() mainFrame] loadRequest:[NSURLRequest requestWithURL:[[NSBundle mainBundle] URLForResource:@"CancelLoadFromResourceLoadDelegate" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"]]];
+
+    Util::run(&didFinishLoad);
+
+    [pool drain];
+    // If we finished without crashing, the test passed.
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.html b/Tools/TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.html
new file mode 100644
index 000000000..c0205b63e
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+<input type="text" id="idForTwoTextFields" value="firstItem">
+<input type="text" id="idForTwoTextFields" value="secondItem">
+<img name="nameForTwoImages" title="thirdItem">
+<img name="nameForTwoImages" title="fourthItem">
+</body>
+</html>
diff --git a/Tools/TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.mm b/Tools/TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.mm
new file mode 100644
index 000000000..50aafeeba
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/HTMLCollectionNamedItem.mm
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <wtf/RetainPtr.h>
+
+#import <WebKit/DOM.h>
+#import <WebKit/WebViewPrivate.h>
+
+@interface HTMLCollectionNamedItemTest : NSObject {
+}
+@end
+
+static bool didFinishLoad;
+
+@implementation HTMLCollectionNamedItemTest
+
+- (void)webView:(WebView *)sender didFinishLoadForFrame:(WebFrame *)frame
+{
+    didFinishLoad = true;
+}
+@end
+
+namespace TestWebKitAPI {
+
+TEST(WebKit1, HTMLCollectionNamedItemTest)
+{
+    RetainPtr<WebView> webView(AdoptNS, [[WebView alloc] initWithFrame:NSMakeRect(0, 0, 120, 200) frameName:nil groupName:nil]);
+    RetainPtr<HTMLCollectionNamedItemTest> testController(AdoptNS, [HTMLCollectionNamedItemTest new]);
+
+    webView.get().frameLoadDelegate = testController.get();
+    [[webView.get() mainFrame] loadRequest:[NSURLRequest requestWithURL:[[NSBundle mainBundle]
+        URLForResource:@"HTMLCollectionNamedItem" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"]]];
+
+    Util::run(&didFinishLoad);
+    didFinishLoad = false;
+
+    DOMDocument *document = webView.get().mainFrameDocument;
+    RetainPtr<DOMHTMLCollection> collection = [[document body] children];
+
+    EXPECT_EQ([collection.get() length], (unsigned)4);
+    EXPECT_WK_STREQ([[collection.get() item:0] value], @"firstItem");
+    EXPECT_WK_STREQ([[collection.get() item:1] value], @"secondItem");
+    EXPECT_WK_STREQ([[collection.get() namedItem:@"idForTwoTextFields"] value], @"firstItem");
+    EXPECT_WK_STREQ([[collection.get() item:1] value], @"secondItem");
+    EXPECT_WK_STREQ([[collection.get() item:0] value], @"firstItem");
+
+    EXPECT_WK_STREQ([(DOMHTMLElement*)[collection.get() item:2] title], @"thirdItem");
+    EXPECT_WK_STREQ([(DOMHTMLElement*)[collection.get() item:3] title], @"fourthItem");
+    EXPECT_WK_STREQ([(DOMHTMLElement*)[collection.get() namedItem:@"nameForTwoImages"] title], @"thirdItem");
+    EXPECT_WK_STREQ([(DOMHTMLElement*)[collection.get() item:3] title], @"fourthItem");
+    EXPECT_WK_STREQ([(DOMHTMLElement*)[collection.get() item:2] title], @"thirdItem");
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.html b/Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.html
new file mode 100644
index 000000000..8439f2c27
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+<form>
+    <input type="text" name="nameForTwoTextFields" value="firstItem">
+    <input type="text" name="nameForTwoTextFields" value="secondItem">
+</form>
+</body>
+</html>
diff --git a/Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.mm b/Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.mm
new file mode 100644
index 000000000..cf2da2dfb
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/HTMLFormCollectionNamedItem.mm
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <wtf/RetainPtr.h>
+
+#import <WebKit/DOM.h>
+#import <WebKit/WebViewPrivate.h>
+
+@interface HTMLFormCollectionNamedItemTest : NSObject {
+}
+@end
+
+static bool didFinishLoad;
+
+@implementation HTMLFormCollectionNamedItemTest
+
+- (void)webView:(WebView *)sender didFinishLoadForFrame:(WebFrame *)frame
+{
+    didFinishLoad = true;
+}
+@end
+
+namespace TestWebKitAPI {
+
+TEST(WebKit1, HTMLFormCollectionNamedItemTest)
+{
+    RetainPtr<WebView> webView(AdoptNS, [[WebView alloc] initWithFrame:NSMakeRect(0, 0, 120, 200) frameName:nil groupName:nil]);
+    RetainPtr<HTMLFormCollectionNamedItemTest> testController(AdoptNS, [HTMLFormCollectionNamedItemTest new]);
+
+    webView.get().frameLoadDelegate = testController.get();
+    [[webView.get() mainFrame] loadRequest:[NSURLRequest requestWithURL:[[NSBundle mainBundle]
+        URLForResource:@"HTMLFormCollectionNamedItem" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"]]];
+
+    Util::run(&didFinishLoad);
+    didFinishLoad = false;
+
+    DOMDocument *document = webView.get().mainFrameDocument;
+    DOMHTMLFormElement *form = (DOMHTMLFormElement *)[document querySelector:@"form"];
+    RetainPtr<DOMHTMLCollection> collection = [form elements];
+
+    EXPECT_EQ([collection.get() length], (unsigned)2);
+    EXPECT_WK_STREQ([[collection.get() item:0] value], @"firstItem");
+    EXPECT_WK_STREQ([[collection.get() item:1] value], @"secondItem");
+    EXPECT_WK_STREQ([[collection.get() namedItem:@"nameForTwoTextFields"] value], @"firstItem");
+    EXPECT_WK_STREQ([[collection.get() item:1] value], @"secondItem");
+    EXPECT_WK_STREQ([[collection.get() item:0] value], @"firstItem");
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/Tests/mac/WebViewCanPasteZeroPng.mm b/Tools/TestWebKitAPI/Tests/mac/WebViewCanPasteZeroPng.mm
new file mode 100644
index 000000000..5049fb3af
--- /dev/null
+++ b/Tools/TestWebKitAPI/Tests/mac/WebViewCanPasteZeroPng.mm
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "PlatformUtilities.h"
+#import "WTFStringUtilities.h"
+
+#import <WebKit/WebViewPrivate.h>
+#import <WebKit/DOM.h>
+
+namespace TestWebKitAPI {
+
+TEST(WebKit1, WebViewCanPasteZeroPng)
+{
+    WebView *webView = [[WebView alloc] initWithFrame:NSZeroRect frameName:nil groupName:nil];
+    [webView setEditable:YES];
+    
+    //pasting a 0x0 image as pdf board type. Referring to <rdar://problem/11141920>
+    [[NSPasteboard generalPasteboard] declareTypes:[NSArray arrayWithObject:NSPDFPboardType] owner:nil];
+    [[[NSBundle mainBundle] URLForResource:@"0" withExtension:@"png" subdirectory:@"TestWebKitAPI.resources"] writeToPasteboard:[NSPasteboard generalPasteboard]];
+    [webView paste:nil];
+    
+    [webView release];
+}
+
+} // namespace TestWebKitAPI
diff --git a/Tools/TestWebKitAPI/gtk/PlatformWebViewGtk.cpp b/Tools/TestWebKitAPI/gtk/PlatformWebViewGtk.cpp
index 84d740776..ba6fab048 100644
--- a/Tools/TestWebKitAPI/gtk/PlatformWebViewGtk.cpp
+++ b/Tools/TestWebKitAPI/gtk/PlatformWebViewGtk.cpp
@@ -34,7 +34,6 @@ namespace TestWebKitAPI {
 
 PlatformWebView::PlatformWebView(WKContextRef contextRef, WKPageGroupRef pageGroupRef)
 {
-    gtk_init(0, 0);
     m_window = gtk_window_new(GTK_WINDOW_TOPLEVEL);
     m_view = WKViewCreate(contextRef, pageGroupRef);
     gtk_container_add(GTK_CONTAINER(m_window), GTK_WIDGET(m_view));
diff --git a/Tools/TestWebKitAPI/gtk/main.cpp b/Tools/TestWebKitAPI/gtk/main.cpp
index 56099ccc9..1b7fef64f 100644
--- a/Tools/TestWebKitAPI/gtk/main.cpp
+++ b/Tools/TestWebKitAPI/gtk/main.cpp
@@ -26,11 +26,11 @@
 #include "config.h"
 #include "TestsController.h"
 
-#include <glib-object.h>
+#include <gtk/gtk.h>
 
 int main(int argc, char** argv)
 {
-    g_type_init();
+    gtk_init(&argc, &argv);
 
     return TestWebKitAPI::TestsController::shared().run(argc, argv) ? EXIT_SUCCESS : EXIT_FAILURE;
 }
diff --git a/Tools/Tools.pro b/Tools/Tools.pro
index 63c993be6..68922d2bf 100644
--- a/Tools/Tools.pro
+++ b/Tools/Tools.pro
@@ -7,8 +7,6 @@
 TEMPLATE = subdirs
 CONFIG += ordered
 
-load(features)
-
 !no_webkit1 {
     SUBDIRS += QtTestBrowser/QtTestBrowser.pro
     SUBDIRS += DumpRenderTree/qt/DumpRenderTree.pro
@@ -16,9 +14,11 @@ load(features)
 }
 
 !no_webkit2 {
-    SUBDIRS += MiniBrowser/qt/MiniBrowser.pro
     # WTR's InjectedBundle depends currently on WK1's DumpRenderTreeSupport
     !no_webkit1: SUBDIRS += WebKitTestRunner/WebKitTestRunner.pro
+
+    SUBDIRS += MiniBrowser/qt/MiniBrowser.pro
+    SUBDIRS += MiniBrowser/qt/raw/MiniBrowserRaw.pro
 }
 
 # FIXME: with Qt 5 the test plugin cause some trouble during layout tests.
@@ -35,8 +35,7 @@ OTHER_FILES = \
     $$files(Scripts/webkitpy/*.py, true) \
     $$files(Scripts/webkitperl/*.p[l|m], true) \
     qmake/README \
-    qmake/configure.pro \
-    qmake/sync.profile \
+    qmake/configure.* \
     qmake/qt_webkit.pri \
     qmake/config.tests/README \
     qmake/config.tests/fontconfig/* \
diff --git a/Tools/WebKitTestRunner/CMakeLists.txt b/Tools/WebKitTestRunner/CMakeLists.txt
new file mode 100644
index 000000000..4cc050150
--- /dev/null
+++ b/Tools/WebKitTestRunner/CMakeLists.txt
@@ -0,0 +1,87 @@
+SET(WEBKIT_TESTRUNNER_DIR "${TOOLS_DIR}/WebKitTestRunner")
+SET(WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR "${TOOLS_DIR}/WebKitTestRunner/InjectedBundle")
+
+FILE(MAKE_DIRECTORY ${DERIVED_SOURCES_DIR}/InjectedBundle)
+
+SET(WebKitTestRunner_SOURCES
+    ${WEBKIT_TESTRUNNER_DIR}/CyclicRedundancyCheck.cpp
+    ${WEBKIT_TESTRUNNER_DIR}/PixelDumpSupport.cpp
+    ${WEBKIT_TESTRUNNER_DIR}/TestController.cpp
+    ${WEBKIT_TESTRUNNER_DIR}/TestInvocation.cpp
+)
+
+SET(WebKitTestRunner_LIBRARIES
+    ${JavaScriptCore_LIBRARY_NAME}
+    ${WebCore_LIBRARY_NAME}
+    ${WebCoreTestSupport_LIBRARY_NAME}
+    ${WebKit2_LIBRARY_NAME}
+)
+
+SET(WebKitTestRunner_INCLUDE_DIRECTORIES
+    ${WEBKIT_TESTRUNNER_DIR}
+    ${WEBKIT_TESTRUNNER_DIR}/InjectedBundle
+    ${WEBKIT_TESTRUNNER_DIR}/InjectedBundle/Bindings
+    ${JAVASCRIPTCORE_DIR}
+    ${JAVASCRIPTCORE_DIR}/ForwardingHeaders
+    ${WEBCORE_DIR}/editing
+    ${WEBCORE_DIR}/platform
+    ${WEBCORE_DIR}/platform/graphics
+    ${WEBCORE_DIR}/platform/network
+    ${WEBCORE_DIR}/platform/text
+    ${WEBCORE_DIR}/testing/js
+    ${WEBKIT2_DIR}/Shared
+    ${WEBKIT2_DIR}/Shared/API/c
+    ${WEBKIT2_DIR}/UIProcess
+    ${WEBKIT2_DIR}/UIProcess/API/C/efl
+    ${WEBKIT2_DIR}/UIProcess/API/C/soup
+    ${WTF_DIR}
+    ${DERIVED_SOURCES_WEBCORE_DIR}/include
+    ${DERIVED_SOURCES_WEBKIT2_DIR}/include
+    ${DERIVED_SOURCES_DIR}/InjectedBundle
+    ${CMAKE_BINARY_DIR}
+    ${CMAKE_SOURCE_DIR}/Source
+    ${LIBSOUP24_INCLUDE_DIRS}
+)
+
+SET(WebKitTestRunnerInjectedBundle_SOURCES
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/AccessibilityController.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/AccessibilityTextMarker.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/AccessibilityTextMarkerRange.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/AccessibilityUIElement.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/EventSendingController.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/GCController.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/InjectedBundle.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/InjectedBundleMain.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/InjectedBundlePage.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/LayoutTestController.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/TextInputController.cpp
+
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/Bindings/JSWrapper.cpp
+)
+
+FILE(GLOB WebKitTestRunnerInjectedBundle_IDL_FILES "${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/Bindings/*.idl")
+
+GENERATE_BINDINGS(WebKitTestRunnerInjectedBundle_SOURCES
+    "${WebKitTestRunnerInjectedBundle_IDL_FILES}"
+    "${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/Bindings"
+    "--include=${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/Bindings"
+    ""
+    ${DERIVED_SOURCES_DIR}/InjectedBundle JS TestRunner
+    )
+
+INCLUDE_IF_EXISTS(${WEBKIT_TESTRUNNER_DIR}/Platform${PORT}.cmake)
+
+INCLUDE_DIRECTORIES(${WebKitTestRunner_INCLUDE_DIRECTORIES})
+
+ADD_LIBRARY(TestRunnerInjectedBundle SHARED ${WebKitTestRunnerInjectedBundle_SOURCES})
+TARGET_LINK_LIBRARIES(TestRunnerInjectedBundle ${WebKitTestRunner_LIBRARIES})
+
+ADD_EXECUTABLE(WebKitTestRunner ${WebKitTestRunner_SOURCES})
+TARGET_LINK_LIBRARIES(WebKitTestRunner ${WebKitTestRunner_LIBRARIES})
+
+IF (WebKitTestRunner_LINK_FLAGS)
+    ADD_TARGET_PROPERTIES(WebKitTestRunner LINK_FLAGS ${WebKitTestRunner_LINK_FLAGS})
+ENDIF ()
+
+ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${ForwardingHeadersForWebKitTestRunner_NAME})
+ADD_DEPENDENCIES(${WebKit2_LIBRARY_NAME} ${ForwardingNetworkHeadersForWebKitTestRunner_NAME})
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl b/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
index 7a2a488eb..240221287 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
+++ b/Tools/WebKitTestRunner/InjectedBundle/Bindings/LayoutTestController.idl
@@ -44,7 +44,6 @@ module WTR {
         void dumpFullScreenCallbacks();
         void dumpFrameLoadCallbacks();
         void dumpProgressFinishedCallback();
-        void dumpConfigurationForViewport(in int deviceDPI, in int deviceWidth, in int deviceHeight, in int availableWidth, in int availableHeight);
 
         // Special options.
         void keepWebHistory();
diff --git a/Tools/WebKitTestRunner/InjectedBundle/DerivedSources.pri b/Tools/WebKitTestRunner/InjectedBundle/DerivedSources.pri
index 651ad22d4..07cdc6719 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/DerivedSources.pri
+++ b/Tools/WebKitTestRunner/InjectedBundle/DerivedSources.pri
@@ -11,8 +11,6 @@
 sanitizedFile = $$toSanitizedPath($$_FILE_)
 equals(sanitizedFile, $$toSanitizedPath($$_PRO_FILE_)):TEMPLATE = derived
 
-load(features)
-
 IDL_BINDINGS += \
     Bindings/AccessibilityController.idl \
     Bindings/AccessibilityTextMarker.idl \
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
index 31f97f28c..1ee9c38f9 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
@@ -523,11 +523,6 @@ void LayoutTestController::resetPageVisibility()
     WKBundleSetPageVisibilityState(InjectedBundle::shared().bundle(), InjectedBundle::shared().page()->page(), WebCore::PageVisibilityStateVisible, /* isInitialState */ true);
 }
 
-void LayoutTestController::dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight)
-{
-    InjectedBundle::shared().stringBuilder()->append(toWTFString(adoptWK(WKBundlePageViewportConfigurationAsText(InjectedBundle::shared().page()->page(), deviceDPI, deviceWidth, deviceHeight, availableWidth, availableHeight))));
-}
-
 typedef WTF::HashMap<unsigned, JSValueRef> CallbackMap;
 static CallbackMap& callbackMap()
 {
diff --git a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
index 6aedacc43..a3e33eff3 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
+++ b/Tools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
@@ -43,6 +43,9 @@ typedef UINT_PTR PlatformTimerRef;
 typedef QTimer PlatformTimerRef;
 #elif PLATFORM(GTK)
 typedef unsigned int PlatformTimerRef;
+#elif PLATFORM(EFL)
+typedef struct _Ecore_Timer Ecore_Timer;
+typedef Ecore_Timer* PlatformTimerRef;
 #endif
 
 namespace WTR {
@@ -74,7 +77,6 @@ public:
     void dumpTitleChanges() { m_dumpTitleChanges = true; }
     void dumpFullScreenCallbacks() { m_dumpFullScreenCallbacks = true; }
     void dumpFrameLoadCallbacks() { setShouldDumpFrameLoadCallbacks(true); }
-    void dumpConfigurationForViewport(int deviceDPI, int deviceWidth, int deviceHeight, int availableWidth, int availableHeight);
     void dumpProgressFinishedCallback() { setShouldDumpProgressFinishedCallback(true); }
 
     void setShouldDumpFrameLoadCallbacks(bool value) { m_dumpFrameLoadCallbacks = value; }
diff --git a/Tools/WebKitTestRunner/InjectedBundle/Target.pri b/Tools/WebKitTestRunner/InjectedBundle/Target.pri
index 7d382ac97..1a117de89 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/Target.pri
+++ b/Tools/WebKitTestRunner/InjectedBundle/Target.pri
@@ -50,9 +50,7 @@ HEADERS += \
 
 DESTDIR = $${ROOT_BUILD_DIR}/lib
 
-QT += declarative widgets webkit
-
-load(features)
+QT += widgets webkit
 
 WEBKIT += wtf javascriptcore webcore
 
diff --git a/Tools/WebKitTestRunner/InjectedBundle/efl/ActivateFontsEfl.cpp b/Tools/WebKitTestRunner/InjectedBundle/efl/ActivateFontsEfl.cpp
new file mode 100644
index 000000000..7785f7799
--- /dev/null
+++ b/Tools/WebKitTestRunner/InjectedBundle/efl/ActivateFontsEfl.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ActivateFonts.h"
+
+#include "FontManagement.h"
+
+namespace WTR {
+
+void activateFonts()
+{
+    addFontsToEnvironment();
+}
+
+} // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp b/Tools/WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp
new file mode 100644
index 000000000..961d043f7
--- /dev/null
+++ b/Tools/WebKitTestRunner/InjectedBundle/efl/InjectedBundleEfl.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "InjectedBundle.h"
+
+#include <WebCore/NotImplemented.h>
+
+namespace WTR {
+
+void InjectedBundle::platformInitialize(WKTypeRef)
+{
+    notImplemented();
+}
+
+} // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/efl/LayoutTestControllerEfl.cpp b/Tools/WebKitTestRunner/InjectedBundle/efl/LayoutTestControllerEfl.cpp
new file mode 100644
index 000000000..b1b6f844a
--- /dev/null
+++ b/Tools/WebKitTestRunner/InjectedBundle/efl/LayoutTestControllerEfl.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "LayoutTestController.h"
+
+#include "InjectedBundle.h"
+#include <Ecore.h>
+
+namespace WTR {
+
+static Eina_Bool waitToDumpWatchdogTimerCallback(void*)
+{
+    InjectedBundle::shared().layoutTestController()->waitToDumpWatchdogTimerFired();
+    return false;
+}
+
+void LayoutTestController::platformInitialize()
+{
+    m_waitToDumpWatchdogTimer = 0;
+}
+
+void LayoutTestController::invalidateWaitToDumpWatchdogTimer()
+{
+    if (!m_waitToDumpWatchdogTimer)
+        return;
+
+    ecore_timer_del(m_waitToDumpWatchdogTimer);
+    m_waitToDumpWatchdogTimer = 0;
+}
+
+void LayoutTestController::initializeWaitToDumpWatchdogTimerIfNeeded()
+{
+    if (m_waitToDumpWatchdogTimer)
+        return;
+
+    m_waitToDumpWatchdogTimer = ecore_timer_loop_add(waitToDumpWatchdogTimerInterval,
+                                                     waitToDumpWatchdogTimerCallback, 0);
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::pathToLocalResource(JSStringRef url)
+{
+    return url;
+}
+
+JSRetainPtr<JSStringRef> LayoutTestController::platformName()
+{
+    JSRetainPtr<JSStringRef> platformName(Adopt, JSStringCreateWithUTF8CString("efl"));
+    return platformName;
+}
+
+} // namespace WTR
diff --git a/Tools/WebKitTestRunner/InjectedBundle/gtk/ActivateFontsGtk.cpp b/Tools/WebKitTestRunner/InjectedBundle/gtk/ActivateFontsGtk.cpp
index c97ca928f..c843591fa 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/gtk/ActivateFontsGtk.cpp
+++ b/Tools/WebKitTestRunner/InjectedBundle/gtk/ActivateFontsGtk.cpp
@@ -66,6 +66,32 @@ static CString getTopLevelPath()
     return absoluteTopLevelPath.get();
 }
 
+CString getOutputDir()
+{
+    const char* webkitOutputDir = g_getenv("WEBKITOUTPUTDIR");
+    if (webkitOutputDir)
+        return webkitOutputDir;
+
+    CString topLevelPath = getTopLevelPath();
+    GOwnPtr<char> outputDir(g_build_filename(topLevelPath.data(), "WebKitBuild", NULL));
+    return outputDir.get();
+}
+
+static CString getFontsPath()
+{
+    CString webkitOutputDir = getOutputDir();
+    GOwnPtr<char> fontsPath(g_build_filename(webkitOutputDir.data(), "Dependencies", "Root", "webkitgtk-test-fonts", NULL));
+    if (g_file_test(fontsPath.get(), static_cast<GFileTest>(G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR)))
+        return fontsPath.get();
+
+    // Try alternative fonts path.
+    fontsPath.set(g_build_filename(webkitOutputDir.data(), "webkitgtk-test-fonts", NULL));
+    if (g_file_test(fontsPath.get(), static_cast<GFileTest>(G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR)))
+        return fontsPath.get();
+
+    return CString();
+}
+
 void inititializeFontConfigSetting()
 {
     FcInit();
@@ -86,18 +112,16 @@ void inititializeFontConfigSetting()
     if (!FcConfigParseAndLoad(config, reinterpret_cast<FcChar8*>(fontConfigFilename.get()), true))
         g_error("Couldn't load font configuration file from: %s", fontConfigFilename.get());
 
-    CString topLevelPath = getTopLevelPath();
-    GOwnPtr<char> fontsPath(g_build_filename(topLevelPath.data(), "WebKitBuild", "Dependencies",
-                                             "Root", "webkitgtk-test-fonts", NULL));
-    if (!g_file_test(fontsPath.get(), static_cast<GFileTest>(G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR)))
-        g_error("Could not locate test fonts at %s. Is WEBKIT_TOP_LEVEL set?", fontsPath.get());
+    CString fontsPath = getFontsPath();
+    if (fontsPath.isNull())
+        g_error("Could not locate test fonts at %s. Is WEBKIT_TOP_LEVEL set?", fontsPath.data());
 
     GOwnPtr<GError> error;
-    GOwnPtr<GDir> fontsDirectory(g_dir_open(fontsPath.get(), 0, &error.outPtr()));
+    GOwnPtr<GDir> fontsDirectory(g_dir_open(fontsPath.data(), 0, &error.outPtr()));
     while (const char* directoryEntry = g_dir_read_name(fontsDirectory.get())) {
         if (!g_str_has_suffix(directoryEntry, ".ttf") && !g_str_has_suffix(directoryEntry, ".otf"))
             continue;
-        GOwnPtr<gchar> fontPath(g_build_filename(fontsPath.get(), directoryEntry, NULL));
+        GOwnPtr<gchar> fontPath(g_build_filename(fontsPath.data(), directoryEntry, NULL));
         if (!FcConfigAppFontAddFile(config, reinterpret_cast<const FcChar8*>(fontPath.get())))
             g_error("Could not load font at %s!", fontPath.get());
     }
diff --git a/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm b/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm
index e5499b80a..419064fdb 100644
--- a/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm
+++ b/Tools/WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm
@@ -27,6 +27,11 @@
 
 #import <Foundation/Foundation.h>
 
+@interface NSURLRequest (PrivateThingsWeShouldntReallyUse)
++(void)setAllowsAnyHTTPSCertificate:(BOOL)allow forHost:(NSString *)host;
+@end
+
+
 namespace WTR {
 
 void InjectedBundle::platformInitialize(WKTypeRef)
@@ -44,7 +49,10 @@ void InjectedBundle::platformInitialize(WKTypeRef)
         [NSArray arrayWithObject:@"en"],  @"AppleLanguages",
         nil];
 
-    [[NSUserDefaults standardUserDefaults] setVolatileDomain:dict forName:NSArgumentDomain];    
+    [[NSUserDefaults standardUserDefaults] setVolatileDomain:dict forName:NSArgumentDomain];
+
+    [NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:@"localhost"];
+    [NSURLRequest setAllowsAnyHTTPSCertificate:YES forHost:@"127.0.0.1"];
 }
 
 } // namespace WTR
diff --git a/Tools/WebKitTestRunner/PlatformEfl.cmake b/Tools/WebKitTestRunner/PlatformEfl.cmake
new file mode 100644
index 000000000..e43febd1a
--- /dev/null
+++ b/Tools/WebKitTestRunner/PlatformEfl.cmake
@@ -0,0 +1,59 @@
+LIST(APPEND WebKitTestRunner_LINK_FLAGS
+    ${ECORE_X_LDFLAGS}
+    ${EDJE_LDFLAGS}
+    ${EFLDEPS_LDFLAGS}
+    ${EVAS_LDFLAGS}
+    ${LIBSOUP24_LDFLAGS}
+)
+
+ADD_CUSTOM_TARGET(forwarding-headersEflForWebKitTestRunner
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT_TESTRUNNER_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include efl
+)
+SET(ForwardingHeadersForWebKitTestRunner_NAME forwarding-headersEflForWebKitTestRunner)
+
+ADD_CUSTOM_TARGET(forwarding-headersSoupForWebKitTestRunner
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT2_DIR}/Scripts/generate-forwarding-headers.pl ${WEBKIT_TESTRUNNER_DIR} ${DERIVED_SOURCES_WEBKIT2_DIR}/include soup
+)
+SET(ForwardingNetworkHeadersForWebKitTestRunner_NAME forwarding-headersSoupForWebKitTestRunner)
+
+LIST(APPEND WebKitTestRunner_SOURCES
+    ${WEBKIT_TESTRUNNER_DIR}/cairo/TestInvocationCairo.cpp
+
+    ${WEBKIT_TESTRUNNER_DIR}/efl/PlatformWebViewEfl.cpp
+    ${WEBKIT_TESTRUNNER_DIR}/efl/TestControllerEfl.cpp
+    ${WEBKIT_TESTRUNNER_DIR}/efl/main.cpp
+)
+
+LIST(APPEND WebKitTestRunner_INCLUDE_DIRECTORIES
+    ${TOOLS_DIR}/DumpRenderTree/efl/
+    "${WTF_DIR}/wtf/gobject"
+
+    ${CAIRO_INCLUDE_DIRS}
+    ${ECORE_X_INCLUDE_DIRS}
+    ${EFLDEPS_INCLUDE_DIRS}
+    ${EVAS_INCLUDE_DIRS}
+    ${Glib_INCLUDE_DIRS}
+)
+
+LIST(APPEND WebKitTestRunner_LIBRARIES
+    ${CAIRO_LIBRARIES}
+    ${ECORE_X_LIBRARIES}
+    ${EDJE_LIBRARIES}
+    ${EFLDEPS_LIBRARIES}
+    ${Glib_LIBRARIES}
+    ${WTF_LIBRARY_NAME}
+)
+
+LIST(APPEND WebKitTestRunnerInjectedBundle_SOURCES
+    ${TOOLS_DIR}/DumpRenderTree/efl/FontManagement.cpp
+
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/efl/ActivateFontsEfl.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/efl/InjectedBundleEfl.cpp
+    ${WEBKIT_TESTRUNNER_INJECTEDBUNDLE_DIR}/efl/LayoutTestControllerEfl.cpp
+)
+
+# FIXME: DOWNLOADED_FONTS_DIR should not hardcode the directory
+# structure. See <https://bugs.webkit.org/show_bug.cgi?id=81475>.
+ADD_DEFINITIONS(-DFONTS_CONF_DIR="${TOOLS_DIR}/DumpRenderTree/gtk/fonts"
+                -DDOWNLOADED_FONTS_DIR="${CMAKE_SOURCE_DIR}/WebKitBuild/Dependencies/Source/webkitgtk-test-fonts-0.0.3"
+                -DDATA_DIR="${THEME_BINARY_DIR}")
diff --git a/Tools/WebKitTestRunner/PlatformWebView.h b/Tools/WebKitTestRunner/PlatformWebView.h
index 0e8c6b5b2..a8cf0d66c 100644
--- a/Tools/WebKitTestRunner/PlatformWebView.h
+++ b/Tools/WebKitTestRunner/PlatformWebView.h
@@ -51,6 +51,11 @@ typedef HWND PlatformWindow;
 typedef struct _GtkWidget GtkWidget;
 typedef WKViewRef PlatformWKView;
 typedef GtkWidget* PlatformWindow;
+#elif PLATFORM(EFL)
+typedef struct _Evas_Object Evas_Object;
+typedef struct _Ecore_Evas Ecore_Evas;
+typedef Evas_Object* PlatformWKView;
+typedef Ecore_Evas* PlatformWindow;
 #endif
 
 namespace WTR {
diff --git a/Tools/WebKitTestRunner/Target.pri b/Tools/WebKitTestRunner/Target.pri
index b9e7a8bdd..b3b5c2c33 100644
--- a/Tools/WebKitTestRunner/Target.pri
+++ b/Tools/WebKitTestRunner/Target.pri
@@ -25,9 +25,7 @@ SOURCES += \
 
 DESTDIR = $${ROOT_BUILD_DIR}/bin
 
-QT = core gui widgets network declarative testlib quick quick-private webkit
-
-load(features)
+QT = core gui widgets network testlib quick quick-private webkit
 
 WEBKIT += wtf javascriptcore webkit2
 
diff --git a/Tools/WebKitTestRunner/TestController.cpp b/Tools/WebKitTestRunner/TestController.cpp
index fd6885793..3c10ac170 100644
--- a/Tools/WebKitTestRunner/TestController.cpp
+++ b/Tools/WebKitTestRunner/TestController.cpp
@@ -42,7 +42,7 @@
 #include <WebKit2/WKPagePrivateMac.h>
 #endif
 
-#if PLATFORM(MAC) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(MAC) || PLATFORM(QT) || PLATFORM(GTK) || PLATFORM(EFL)
 #include "EventSenderProxy.h"
 #endif
 
@@ -319,7 +319,8 @@ void TestController::initialize(int argc, const char* argv[])
         kWKContextInjectedBundleClientCurrentVersion,
         this,
         didReceiveMessageFromInjectedBundle,
-        didReceiveSynchronousMessageFromInjectedBundle
+        didReceiveSynchronousMessageFromInjectedBundle,
+        0 // getInjectedBundleInitializationUserData
     };
     WKContextSetInjectedBundleClient(m_context.get(), &injectedBundleClient);
 
diff --git a/Tools/WebKitTestRunner/config.h b/Tools/WebKitTestRunner/config.h
index 23a3ad7b0..11577cd60 100644
--- a/Tools/WebKitTestRunner/config.h
+++ b/Tools/WebKitTestRunner/config.h
@@ -25,12 +25,18 @@
 #ifndef WebKitTestRunner_config_h
 #define WebKitTestRunner_config_h
 
+#if defined (BUILDING_WITH_CMAKE)
+#include "cmakeconfig.h"
+#endif
+
 #include <wtf/Platform.h>
 #include <wtf/ExportMacros.h>
 #if USE(JSC)
 #include <runtime/JSExportMacros.h>
 #endif
 
+#include <WebKit2/WebKit2.h>
+
 #if PLATFORM(WIN)
 #define WTF_USE_CF 1 
 #if defined(WIN_CAIRO)
diff --git a/Tools/WebKitTestRunner/efl/PlatformWebViewEfl.cpp b/Tools/WebKitTestRunner/efl/PlatformWebViewEfl.cpp
new file mode 100644
index 000000000..f17820d91
--- /dev/null
+++ b/Tools/WebKitTestRunner/efl/PlatformWebViewEfl.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PlatformWebView.h"
+
+#include "WebKit2/WKAPICast.h"
+#include <Ecore_Evas.h>
+
+using namespace WebKit;
+
+namespace WTR {
+
+static bool useX11Window = false;
+
+static Ecore_Evas* initEcoreEvas()
+{
+    Ecore_Evas* ecoreEvas = useX11Window ? ecore_evas_new(0, 0, 0, 800, 600, 0) : ecore_evas_buffer_new(800, 600);
+    if (!ecoreEvas)
+        return 0;
+
+    ecore_evas_title_set(ecoreEvas, "EFL WebKitTestRunner");
+    ecore_evas_show(ecoreEvas);
+
+    return ecoreEvas;
+}
+
+PlatformWebView::PlatformWebView(WKContextRef context, WKPageGroupRef pageGroup)
+{
+    m_window = initEcoreEvas();
+    Evas* evas = ecore_evas_get(m_window);
+    m_view = toImpl(WKViewCreate(evas, context, pageGroup));
+    m_windowIsKey = false;
+}
+
+PlatformWebView::~PlatformWebView()
+{
+    evas_object_del(m_view);
+    ecore_evas_free(m_window);
+}
+
+void PlatformWebView::resizeTo(unsigned width, unsigned height)
+{
+    evas_object_resize(m_view, width, height);
+}
+
+WKPageRef PlatformWebView::page()
+{
+    return WKViewGetPage(toAPI(m_view));
+}
+
+void PlatformWebView::focus()
+{
+}
+
+WKRect PlatformWebView::windowFrame()
+{
+    return WKRectMake(0, 0, 0, 0);
+}
+
+void PlatformWebView::setWindowFrame(WKRect frame)
+{
+    evas_object_move(m_view, frame.origin.x, frame.origin.y);
+    resizeTo(frame.size.width, frame.size.height);
+}
+
+void PlatformWebView::addChromeInputField()
+{
+}
+
+void PlatformWebView::removeChromeInputField()
+{
+}
+
+void PlatformWebView::makeWebViewFirstResponder()
+{
+}
+
+WKRetainPtr<WKImageRef> PlatformWebView::windowSnapshotImage()
+{
+    // FIXME: implement to capture pixels in the UI process,
+    // which may be necessary to capture things like 3D transforms.
+    return 0;
+}
+
+} // namespace WTR
+
diff --git a/Tools/WebKitTestRunner/efl/TestControllerEfl.cpp b/Tools/WebKitTestRunner/efl/TestControllerEfl.cpp
new file mode 100644
index 000000000..9dc2dfc77
--- /dev/null
+++ b/Tools/WebKitTestRunner/efl/TestControllerEfl.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TestController.h"
+
+#include <Ecore.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <wtf/Platform.h>
+#include <wtf/text/WTFString.h>
+
+namespace WTR {
+
+static Ecore_Timer* timer = 0;
+
+static Eina_Bool timerFired(void*)
+{
+    timer = 0;
+    ecore_main_loop_quit();
+    return ECORE_CALLBACK_CANCEL;
+}
+
+void TestController::notifyDone()
+{
+    if (!timer)
+        return;
+
+    ecore_timer_del(timer);
+    timer = 0;
+    ecore_main_loop_quit();
+}
+
+void TestController::platformInitialize()
+{
+}
+
+void TestController::platformRunUntil(bool&, double timeout)
+{
+    timer = ecore_timer_loop_add(timeout, timerFired, 0);
+    ecore_main_loop_begin();
+}
+
+static const char* getEnvironmentVariableOrExit(const char* variableName)
+{
+    const char* value = getenv(variableName);
+    if (!value) {
+        fprintf(stderr, "%s environment variable not found\n", variableName);
+        exit(0);
+    }
+
+    return value;
+}
+
+void TestController::initializeInjectedBundlePath()
+{
+    const char* bundlePath = getEnvironmentVariableOrExit("TEST_RUNNER_INJECTED_BUNDLE_FILENAME");
+    m_injectedBundlePath = WKStringCreateWithUTF8CString(bundlePath);
+}
+
+void TestController::initializeTestPluginDirectory()
+{
+    const char* pluginPath = getEnvironmentVariableOrExit("TEST_RUNNER_PLUGIN_PATH");
+    m_testPluginDirectory = WKStringCreateWithUTF8CString(pluginPath);
+}
+
+void TestController::platformInitializeContext()
+{
+}
+
+void TestController::runModal(PlatformWebView*)
+{
+    // FIXME: Need to implement this to test showModalDialog.
+}
+
+const char* TestController::platformLibraryPathForTesting()
+{
+    return 0;
+}
+
+} // namespace WTR
diff --git a/Tools/WebKitTestRunner/efl/main.cpp b/Tools/WebKitTestRunner/efl/main.cpp
new file mode 100644
index 000000000..42e0af286
--- /dev/null
+++ b/Tools/WebKitTestRunner/efl/main.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2012 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this program; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#include "TestController.h"
+#include <Ecore.h>
+#include <Ecore_Evas.h>
+#include <Edje.h>
+#include <glib-object.h>
+#include <glib.h>
+
+#ifdef HAVE_ECORE_X
+#include <Ecore_X.h>
+#endif
+
+int main(int argc, char** argv)
+{
+    g_type_init();
+
+    if (!ecore_evas_init())
+        return 1;
+
+    if (!edje_init()) {
+        ecore_evas_shutdown();
+        return 1;
+    }
+
+#ifdef HAVE_ECORE_X
+    if (!ecore_x_init(0)) {
+        ecore_evas_shutdown();
+        edje_shutdown();
+        return 1;
+    }
+#endif
+
+    // Prefer the not installed web and plugin processes.
+    WTR::TestController controller(argc, const_cast<const char**>(argv));
+
+#ifdef HAVE_ECORE_X
+    ecore_x_shutdown();
+#endif
+
+    edje_shutdown();
+    ecore_evas_shutdown();
+
+    return 0;
+}
+
diff --git a/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm b/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm
index d8b5bf7b4..c9bcc3d2a 100644
--- a/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm
+++ b/Tools/WebKitTestRunner/mac/PlatformWebViewMac.mm
@@ -72,15 +72,16 @@
     [super setFrame:NSMakeRect(currentFrame.origin.x, currentFrame.origin.y, windowFrame.size.width, windowFrame.size.height) display:displayViews];
 }
 
-- (NSRect)frame
+- (NSRect)frameRespectingFakeOrigin
 {
-    NSRect currentFrame = [super frame];
+    NSRect currentFrame = [self frame];
 
     if (_shouldUseFakeOrigin)
         return NSMakeRect(_fakeOrigin.x, _fakeOrigin.y, currentFrame.size.width, currentFrame.size.height);
 
     return currentFrame;
 }
+
 @end
 
 namespace WTR {
@@ -126,7 +127,7 @@ void PlatformWebView::focus()
 
 WKRect PlatformWebView::windowFrame()
 {
-    NSRect frame = [m_window frame];
+    NSRect frame = [m_window frameRespectingFakeOrigin];
 
     WKRect wkFrame;
     wkFrame.origin.x = frame.origin.x;
diff --git a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
index 0211df5d3..b26e20515 100644
--- a/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
+++ b/Tools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
@@ -34,7 +34,7 @@
 #include <QEventLoop>
 #include <QQmlProperty>
 #include <QtQuick/QQuickView>
-#include <qwindowsysteminterface_qpa.h>
+#include <qpa/qwindowsysteminterface.h>
 
 namespace WTR {
 
diff --git a/Tools/efl/jhbuild.modules b/Tools/efl/jhbuild.modules
index 9811ec271..9084d79fe 100644
--- a/Tools/efl/jhbuild.modules
+++ b/Tools/efl/jhbuild.modules
@@ -51,7 +51,8 @@
     </branch>
   </autotools>
 
-  <autotools id="pixman" autogen-sh="configure">
+  <autotools id="pixman" autogen-sh="configure"
+             autogenargs="--enable-gtk=no">
     <branch module="releases/pixman-0.24.0.tar.gz" version="0.24.0"
             repo="cairographics.org"
             hash="sha256:a5647c7158f103eedff5fba799018f4169f6b26b573ab7685812ebc9a1c5d2e4"
@@ -70,10 +71,10 @@
   </autotools>
 
   <autotools id="libffi" autogen-sh="configure">
-    <branch module="/pub/libffi/libffi-3.0.10.tar.gz" version="3.0.10"
+    <branch module="/pub/libffi/libffi-3.0.11.tar.gz" version="3.0.11"
              repo="sourceware.org"
-             hash="sha256:f01eb9027e9eb56aeaeef636649877756d475d714ef8b47f627f65bc5f3b492f"
-             md5sum="79390673f5d07a8fb342bc09b5055b6f"/>
+             hash="sha256:70bfb01356360089aa97d3e71e3edf05d195599fd822e922e50d46a0055a6283"
+             md5sum="f69b9693227d976835b4857b1ba7d0e3"/>
   </autotools>
 
   <tarball id="freetype6">
@@ -160,13 +161,13 @@
   <autotools id="eina" >
     <branch module="eina"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
   </autotools>
 
   <autotools id="embryo">
     <branch module="embryo"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
     <dependencies>
       <dep package="eina"/>
     </dependencies>
@@ -175,13 +176,13 @@
   <autotools id="evas">
     <branch module="evas"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
   </autotools>
 
   <autotools id="ecore">
     <branch module="ecore"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
     <dependencies>
       <dep package="eina"/>
       <dep package="evas"/>
@@ -191,7 +192,7 @@
   <autotools id="eet">
     <branch module="eet"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
     <dependencies>
       <dep package="eina"/>
     </dependencies>
@@ -200,7 +201,7 @@
   <autotools id="edje">
     <branch module="edje"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
     <dependencies>
       <dep package="eet"/>
       <dep package="ecore"/>
@@ -212,7 +213,7 @@
   <autotools id="e_dbus">
     <branch module="e_dbus"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
     <dependencies>
       <dep package="ecore"/>
       <dep package="eina"/>
@@ -222,7 +223,7 @@
   <autotools id="eeze">
     <branch module="eeze"
             repo="enlightenment.org"
-            revision="68629"/>
+            revision="73027"/>
     <dependencies>
       <dep package="ecore"/>
       <dep package="eina"/>
diff --git a/Tools/gtk/common.py b/Tools/gtk/common.py
index 220a8cf62..7b057e7d1 100644
--- a/Tools/gtk/common.py
+++ b/Tools/gtk/common.py
@@ -40,7 +40,8 @@ def get_build_path():
         return build_dir
 
     def is_valid_build_directory(path):
-        return os.path.exists(os.path.join(path, 'GNUmakefile'))
+        return os.path.exists(os.path.join(path, 'GNUmakefile')) or \
+            os.path.exists(os.path.join(path, 'Programs', 'DumpRenderTree'))
 
     if len(sys.argv[1:]) > 1 and os.path.exists(sys.argv[-1]) and is_valid_build_directory(sys.argv[-1]):
         return sys.argv[-1]
diff --git a/Tools/gtk/jhbuild.modules b/Tools/gtk/jhbuild.modules
index 3306d74ee..81322f25d 100644
--- a/Tools/gtk/jhbuild.modules
+++ b/Tools/gtk/jhbuild.modules
@@ -58,7 +58,8 @@
     </branch>
   </autotools>
 
-  <autotools id="pixman" autogen-sh="configure">
+  <autotools id="pixman" autogen-sh="configure"
+             autogenargs="--enable-gtk=no">
     <branch module="releases/pixman-0.24.0.tar.gz" version="0.24.0"
             repo="cairographics.org"
             hash="sha256:a5647c7158f103eedff5fba799018f4169f6b26b573ab7685812ebc9a1c5d2e4"
diff --git a/Tools/qmake/.qmake.conf b/Tools/qmake/.qmake.conf
new file mode 100644
index 000000000..2f0dc8976
--- /dev/null
+++ b/Tools/qmake/.qmake.conf
@@ -0,0 +1,2 @@
+# This file is only here to isolate the configure project
+# from the rest of the tree.
diff --git a/Tools/qmake/configure.pri b/Tools/qmake/configure.pri
new file mode 100644
index 000000000..8c009fd20
--- /dev/null
+++ b/Tools/qmake/configure.pri
@@ -0,0 +1,25 @@
+# -------------------------------------------------------------------
+# This file is used by build-webkit to compute the various feature
+# defines, which are then cached in .qmake.cache.
+#
+# See 'Tools/qmake/README' for an overview of the build system
+# -------------------------------------------------------------------
+
+haveQt(5):!quick_check {
+    load(configure)
+    QMAKE_CONFIG_TESTS_DIR = $$PWD/config.tests
+
+    CONFIG_TESTS = \
+        fontconfig \
+        gccdepends \
+        libpng \
+        libjpeg \
+        libwebp \
+        libxml2 \
+        libxslt \
+        libzlib
+
+    for(test, CONFIG_TESTS): qtCompileTest($$test)
+}
+
+load(features)
diff --git a/Tools/qmake/configure.pro b/Tools/qmake/configure.pro
index 2da6a1b5d..bb200d355 100644
--- a/Tools/qmake/configure.pro
+++ b/Tools/qmake/configure.pro
@@ -1,3 +1,18 @@
-load(features)
-message($$DEFINES)
+# -------------------------------------------------------------------
+# This file is used by build-webkit to compute the various feature
+# defines, which are then cached in .qmake.cache.
+#
+# See 'Tools/qmake/README' for an overview of the build system
+# -------------------------------------------------------------------
+
+# Will compute features based on command line arguments, config tests,
+# dependency availability, and defaults.
+include(configure.pri)
+
+# Compute delta
+CONFIG -= $$BASE_CONFIG
+DEFINES -= $$BASE_DEFINES
+
+message(CONFIG: $$CONFIG)
+message(DEFINES: $$DEFINES)
 error("Done computing defaults")
diff --git a/Tools/qmake/mkspecs/features/default_post.prf b/Tools/qmake/mkspecs/features/default_post.prf
index cf5e56357..da2efe8a0 100644
--- a/Tools/qmake/mkspecs/features/default_post.prf
+++ b/Tools/qmake/mkspecs/features/default_post.prf
@@ -5,8 +5,6 @@
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
-load(features)
-
 # Flag that we're now done processing the project file. This allows
 # a feature to distinguish between being processed due to a load()
 # or include() and a CONFIG += feature.
@@ -133,7 +131,7 @@ contains(TEMPLATE, lib) {
 
     # Prevent name clashes when building both debug and release. Qt5's module
     # system already takes care of this for the top level QtWebKit library.
-    !module:debug_and_release: TARGET = $$qtLibraryTarget($$TARGET)
+    !qt_install_module:debug_and_release: TARGET = $$qtLibraryTarget($$TARGET)
 
     isEmpty(DESTDIR): DESTDIR = $$activeBuildConfig()
 
@@ -212,8 +210,8 @@ for(library, WEBKIT) {
         LIBS += $$dependent_libs
     }
 
-    # Anything not linking dynamically to QtWebKit should make sure to have their export
-    # macros syncrhonized with the code that it will linked with statically.
+    # Anything not linking dynamically to QtWebKit should make sure to have its export
+    # macros syncrhonized with the code that it will be linked with statically.
     !contains(QT, webkit) {
         DEFINES += STATICALLY_LINKED_WITH_$$library
     }
@@ -238,8 +236,9 @@ for(subdir, SUBDIRS) {
     }
 }
 
-# Doing `$(MAKE) qmake' should recurse through all subdirs
-contains(TEMPLATE, subdirs):!no_recursive_qmake {
+# Doing '$(MAKE) qmake' should recurse through all subdirs. In Qt5, this is
+# automatic (for 'qmake_all', while 'qmake' does not enter subdirs at all).
+haveQt(4):contains(TEMPLATE, subdirs):!no_recursive_qmake {
     recursive_qmake.target = qmake_all
 
     # We could do this using CONFIG += recurse but that adds
@@ -275,7 +274,7 @@ contains(TEMPLATE, subdirs):!no_recursive_qmake {
 }
 
 incremental.target = incremental
-incremental.commands = $(MAKE) -f $(MAKEFILE) qmake && $(MAKE) -f $(MAKEFILE)
+incremental.commands = $(MAKE) -f $(MAKEFILE) qmake_all && $(MAKE) -f $(MAKEFILE)
 QMAKE_EXTRA_TARGETS += incremental
 
 # Don't set OBJECTS_DIR for subdirs, as that will unconditionally
diff --git a/Tools/qmake/mkspecs/features/default_pre.prf b/Tools/qmake/mkspecs/features/default_pre.prf
index bb82e15fe..a8bb75830 100644
--- a/Tools/qmake/mkspecs/features/default_pre.prf
+++ b/Tools/qmake/mkspecs/features/default_pre.prf
@@ -23,28 +23,25 @@ isEmpty(pro_file): CONFIG += recursive_include
 }
 
 # Resolve root directories for source and build
-ROOT_WEBKIT_DIR = $$replace(IN_PWD, /Tools/qmake/mkspecs/features$,)
+ROOT_WEBKIT_DIR = $$replace(PWD, /Tools/qmake/mkspecs/features$,)
 WEBKIT_SUBDIR = $$replace(_PRO_FILE_PWD_, $${ROOT_WEBKIT_DIR},)
 ROOT_BUILD_DIR = $$replace(OUT_PWD, $${WEBKIT_SUBDIR}$,)
 
-# We want the QtWebKit API forwarding includes to live in the root build dir,
-# except when we are running the config.tests in Tools/qmake.
+# Detect if we're running the initial configure step
 pro_file_name = $$basename(_PRO_FILE_)
-!equals(pro_file_name, configure.pro): QMAKE_SYNCQT_OUTDIR = $$ROOT_BUILD_DIR
-
-# Load Qt's defaults after we've resolved the build directory. This will also
-# run syncqt if there is a sync.profile in the $$_PRO_FILE_PWD_. We never want
-# to enable Qt's concept of a developer-build, since we take care of installing
-# our own module file. See api.pri for details about how we utilize this.
-old_qtdir=$$QTDIR
-QTDIR=no-developer-build-please
-load(default_pre)
-QTDIR=$$old_qtdir
+equals(pro_file_name, configure.pro): CONFIG += configure_pass
+
+# We want the QtWebKit API forwarding includes to live in the root build dir.
+MODULE_BASE_DIR = $$ROOT_WEBKIT_DIR
+MODULE_BASE_OUTDIR = $$ROOT_BUILD_DIR
 
-# Load results of config tests (only supported in Qt 5)
-haveQt(5): include($${ROOT_BUILD_DIR}/Tools/qmake/.qmake.cache, , true)
+# The qmake files on the other hand live in a subdirectory.
+MODULE_QMAKE_OUTDIR = $$ROOT_BUILD_DIR/Tools/qmake
+
+# Now we're ready to load default_pre from Qt
+load(default_pre)
 
-unix:contains(config_test_gccdepends, yes) {
+unix:config_gccdepends {
     # We have a compiler that supports the -MD option (and neither
     # teambuilder nor icecream is messing up the .d file output).
     CONFIG += GNUmake gcc_MD_depends
@@ -69,9 +66,11 @@ win32* {
     isEmpty(pwd_starts_with_slash): CONFIG += win_cmd_shell
 }
 
-# Make sure QMAKEPATH is set for recursive targets
-win_cmd_shell: QMAKE_QMAKE = \(set QMAKEPATH=$$(QMAKEPATH)\) && $$QMAKE_QMAKE
-else: QMAKE_QMAKE = QMAKEPATH=$$(QMAKEPATH) $$QMAKE_QMAKE
+haveQt(4) {
+    # Make sure QMAKEPATH is set for recursive targets
+    win_cmd_shell: QMAKE_QMAKE = \(set QMAKEPATH=$$(QMAKEPATH)\) && $$QMAKE_QMAKE
+    else: QMAKE_QMAKE = QMAKEPATH=$$(QMAKEPATH) $$QMAKE_QMAKE
+}
 
 # Default location of generated sources
 GENERATED_SOURCES_DESTDIR = generated
@@ -104,7 +103,7 @@ else: PYTHON = python
 }
 
 haveQt(5): {
-    isEmpty(QT.widgets.name)|isEmpty(QT.printsupport.name) {
+    !haveQtModule(widgets)|!haveQtModule(printsupport) {
         root_project_file: message("WebKit1 requires the QtWidgets and QtPrintSupport modules. Disabling WebKit1.")
         CONFIG += no_webkit1
     }
@@ -123,3 +122,30 @@ haveQt(4) {
 
 # Set some defaults for specific platforms
 CONFIG += include_webinspector
+
+# Try to locate sqlite3 source (for WebCore)
+SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
+isEmpty(SQLITE3SRCDIR) {
+    haveQt(5): SQLITE3SRCDIR = $$QT.core.sources/../3rdparty/sqlite/
+    else: SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
+}
+
+# --------- Make features available to JSC ------------
+
+## Forward enabled feature macros to JavaScript enabled features macros
+FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
+v8: FEATURE_DEFINES_JAVASCRIPT += V8_BINDING=1
+
+for(define, DEFINES) {
+    enabled_feature_define = $$find(define, ^ENABLE_.+=1$)
+    isEmpty(enabled_feature_define): next()
+
+    FEATURE_DEFINES_JAVASCRIPT += $$enabled_feature_define
+}
+
+configure_pass {
+    # Save the base config and defines so we can compute the delta between
+    # what features.prf introduced and what was already there.
+    BASE_CONFIG = $$CONFIG
+    BASE_DEFINES = $$DEFINES
+}
diff --git a/Tools/qmake/mkspecs/features/features.prf b/Tools/qmake/mkspecs/features/features.prf
index 29d41f033..325aeca0d 100644
--- a/Tools/qmake/mkspecs/features/features.prf
+++ b/Tools/qmake/mkspecs/features/features.prf
@@ -20,12 +20,6 @@
 ## load mobilityconfig if mobility is available
 load(mobilityconfig, true)
 
-# Try to locate sqlite3 source
-SQLITE3SRCDIR = $$(SQLITE3SRCDIR)
-isEmpty(SQLITE3SRCDIR) {
-    SQLITE3SRCDIR = $$[QT_INSTALL_PREFIX]/src/3rdparty/sqlite/
-}
-
 # ---------- Dynamically detect optional features -------------
 #
 # Please note, static feature defaults go in features.pri
@@ -53,7 +47,7 @@ haveQt(5):if(contains(QT_CONFIG,icu)|mac) {
 
 # We need fontconfig to set up the test fonts for DumpRenderTree and WebKitTestRunner.
 haveQt(5) {
-    contains(config_test_fontconfig, yes):!mac {
+    config_fontconfig:!mac {
         DEFINES += HAVE_FONTCONFIG=1
     }
 } else {
@@ -65,17 +59,17 @@ haveQt(5) {
 
 # We need libxml2 config test to determine to use libxml2 or not
 !contains(DEFINES, WTF_USE_LIBXML2=.) {
-    haveQt(5):contains(config_test_libxml2, yes): DEFINES += WTF_USE_LIBXML2=1
+    config_libxml2: DEFINES += WTF_USE_LIBXML2=1
 }
 
 # We need libxslt config test to determine to use libxslt or not
 !contains(DEFINES, ENABLE_XSLT=.) {
-    haveQt(5):contains(config_test_libxslt, yes): DEFINES += ENABLE_XSLT=1
+    config_libxslt: DEFINES += ENABLE_XSLT=1
 }
 
 # We need libzlib config test to determine to use enable websocket extension or not
 !contains(DEFINES, WTF_USE_ZLIB=.) {
-    haveQt(5):contains(config_test_libzlib, yes): DEFINES += WTF_USE_ZLIB=1
+    config_libzlib: DEFINES += WTF_USE_ZLIB=1
 }
 
 # Tiled Backing Store support
@@ -111,7 +105,7 @@ haveQt(5) {
 }
 
 # QStyle detection
-haveQt(4)|!isEmpty(QT.widgets.name): DEFINES += HAVE_QSTYLE=1
+haveQt(4)|haveQtModule(widgets): DEFINES += HAVE_QSTYLE=1
 
 # WebGL support
 !contains(DEFINES, ENABLE_WEBGL=.) {
@@ -135,7 +129,7 @@ haveQt(4)|!isEmpty(QT.widgets.name): DEFINES += HAVE_QSTYLE=1
 
 # orientation support
 haveQt(5) {
-    !isEmpty(QT.sensors.name) {
+    haveQtModule(sensors) {
         !contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=1
         !contains(DEFINES, ENABLE_DEVICE_ORIENTATION=.): DEFINES += ENABLE_DEVICE_ORIENTATION=1
     }
@@ -144,10 +138,6 @@ haveQt(5) {
     contains(MOBILITY_CONFIG, sensors) {
         !contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=1
         !contains(DEFINES, ENABLE_DEVICE_ORIENTATION=.): DEFINES += ENABLE_DEVICE_ORIENTATION=1
-
-        # FIXME: These should not be here, but in the target that needs them
-        CONFIG *= mobility
-        MOBILITY *= sensors
     }
 }
 
@@ -223,24 +213,14 @@ for(define, DEFINES) {
     contains(DEFINES, $$opposite): DEFINES -= $$define
 }
 
-# --------- Make features available to JSC ------------
-
-## Forward enabled feature macros to JavaScript enabled features macros
-FEATURE_DEFINES_JAVASCRIPT = LANGUAGE_JAVASCRIPT=1
-v8: FEATURE_DEFINES_JAVASCRIPT += V8_BINDING=1
-
-for(define, DEFINES) {
-    enabled_feature_define = $$find(define, ^ENABLE_.+=1$)
-    isEmpty(enabled_feature_define): next()
-
-    FEATURE_DEFINES_JAVASCRIPT += $$enabled_feature_define
+# Enable the USE(3D_GRAPHICS) flag for Qt5 or when QtOpenGL is enabled.
+!contains(DEFINES, WTF_USE_3D_GRAPHICS=.) {
+    # Disable USE(3D_GRAPHICS) on Windows temporarily, see https://bugs.webkit.org/show_bug.cgi?id=90850 for details.
+    !win32-* {
+        haveQt(5)|contains(QT_CONFIG, opengl): DEFINES += WTF_USE_3D_GRAPHICS=1
+    }
 }
 
-# ---------------------- The end ----------------------
-
-# Used to compute defaults for the build-webkit script
-# Don't place anything after this!
-CONFIG(compute_defaults) {
-    message($$DEFINES)
-    error("Done computing defaults")
+haveQt(4):contains(DEFINES, ENABLE_WEBGL=1):contains(DEFINES, WTF_USE_3D_GRAPHICS=0) {
+    error("WebGL requires Qt to be configured with OpenGL. Please reconfigure Qt with OpenGL, or build WebKit without WebGL.")
 }
diff --git a/Tools/qmake/mkspecs/features/features.pri b/Tools/qmake/mkspecs/features/features.pri
index 4143d3a9a..cb866b517 100644
--- a/Tools/qmake/mkspecs/features/features.pri
+++ b/Tools/qmake/mkspecs/features/features.pri
@@ -40,7 +40,6 @@ FEATURE_DEFAULTS = \
     ENABLE_FAST_MOBILE_SCROLLING=1 \
     ENABLE_FILE_SYSTEM=0 \
     ENABLE_FILTERS=1 \
-    ENABLE_FONT_BOOSTING=0 \
     ENABLE_FTPDIR=1 \
     ENABLE_FULLSCREEN_API=0 \
     ENABLE_GAMEPAD=0 \
@@ -91,6 +90,7 @@ FEATURE_DEFAULTS = \
     ENABLE_SVG=1 \
     ENABLE_SVG_DOM_OBJC_BINDINGS=0 \
     ENABLE_SVG_FONTS=1 \
+    ENABLE_TEXT_AUTOSIZING=0 \
     ENABLE_TEXT_NOTIFICATIONS_ONLY=0 \
     ENABLE_TOUCH_ADJUSTMENT=1 \
     ENABLE_TOUCH_EVENTS=1 \
diff --git a/Tools/qmake/mkspecs/features/functions.prf b/Tools/qmake/mkspecs/features/functions.prf
index 527e0d8fe..a086e769b 100644
--- a/Tools/qmake/mkspecs/features/functions.prf
+++ b/Tools/qmake/mkspecs/features/functions.prf
@@ -137,35 +137,50 @@ defineTest(addStrictSubdirOrderBetween) {
     first_base_target = sub-$$replace(firstSubdirFile, [^a-zA-Z0-9_], -)
     second_base_target = sub-$$replace(secondSubdirFile, [^a-zA-Z0-9_], -)
 
-    # Use a custom target for making the derived sources instead of the default ones,
-    # as the default ones depend on $(MAKEFILE), while we want to depend on *qmake_all.
-    # Without this rule we end up running qmake twice for the derived sources, as well as
-    # introducing a race condition where we run "qmake -o Makefile.DerivedSources" at the
-    # same time as we run "make -f Makefile.DerivedSources", resulting in make reading a
-    # half-written makefile.
-    derived_make_for_qmake.target = $${first_base_target}-make_for_qmake
-    derived_make_for_qmake.depends = $${first_base_target}-qmake_all
-    derived_make_for_qmake.commands = $(MAKE) -f $$eval($${firstSubdir}.makefile)
-    QMAKE_EXTRA_TARGETS += derived_make_for_qmake
-
-    # This target ensures that running "make qmake" will force both qmake and make
-    # to be run on the derived sources before running qmake on the target, so that
-    # qmake can pick up the right dependencies for the target based on the derived
-    # sources that were generated.
-    target_make_qmake.target = $${second_base_target}-qmake_all
-    target_make_qmake.depends = $${derived_make_for_qmake.target}
-    QMAKE_EXTRA_TARGETS += target_make_qmake
-
-    GNUmake {
-        # This target ensures that running make before any makefiles have been created
-        # will still force qmake and make to be run on the derived sources first.
-        target_make.target = $$eval($${secondSubdir}.makefile)
-
-        # We use order-only-prerequisites so that we can run make on the derived sources
-        # without triggering a qmake run on the target due to updated dependencies.
-        target_make.depends = "| $${first_base_target}-make_default-ordered"
-
-        QMAKE_EXTRA_TARGETS += target_make
+    haveQt(4) {
+        # Use a custom target for making the derived sources instead of the default ones,
+        # as the default ones depend on $(MAKEFILE), while we want to depend on *qmake_all.
+        # Without this rule we end up running qmake twice for the derived sources, as well as
+        # introducing a race condition where we run "qmake -o Makefile.DerivedSources" at the
+        # same time as we run "make -f Makefile.DerivedSources", resulting in make reading a
+        # half-written makefile.
+        derived_make_for_qmake.target = $${first_base_target}-make_for_qmake
+        derived_make_for_qmake.depends = $${first_base_target}-qmake_all
+        derived_make_for_qmake.commands = $(MAKE) -f $$eval($${firstSubdir}.makefile)
+        QMAKE_EXTRA_TARGETS += derived_make_for_qmake
+
+        # This target ensures that running "make qmake" will force both qmake and make
+        # to be run on the derived sources before running qmake on the target, so that
+        # qmake can pick up the right dependencies for the target based on the derived
+        # sources that were generated.
+        target_make_qmake.target = $${second_base_target}-qmake_all
+        target_make_qmake.depends = $${derived_make_for_qmake.target}
+        QMAKE_EXTRA_TARGETS += target_make_qmake
+
+        GNUmake {
+            # This target ensures that running make before any makefiles have been created
+            # will still force qmake and make to be run on the derived sources first.
+            target_make.target = $$eval($${secondSubdir}.makefile)
+
+            # We use order-only-prerequisites so that we can run make on the derived sources
+            # without triggering a qmake run on the target due to updated dependencies.
+            target_make.depends = "| $${first_base_target}-make_default-ordered"
+
+            QMAKE_EXTRA_TARGETS += target_make
+        }
+    } else {
+        # Qt5's qmake does most of the above for us already.
+
+        # This target ensures that running "make qmake_all" will force both qmake and make
+        # to be run on the derived sources before running qmake on the target, so that
+        # qmake can pick up the right dependencies for the target based on the derived
+        # sources that were generated. Just "make qmake" is non-recursive anyway.
+        target_make_qmake.target = $${second_base_target}-qmake_all
+        target_make_qmake.depends = $${first_base_target}
+        QMAKE_EXTRA_TARGETS += target_make_qmake
+
+        # Make things work even if qmake -r is used.
+        CONFIG += dont_recurse
     }
 
     export(SUBDIRS)
@@ -207,8 +222,9 @@ defineTest(haveQt) {
 defineTest(haveQtModule) {
     unset(module)
     module = $$1
-    haveQt(4):contains(QT_CONFIG, $$module): return(true)
-    haveQt(5):!isEmpty(QT.$$module.name): return(true)
+
+    haveQt(4):contains(QT_CONFIG, $${module}): return(true)
+    haveQt(5):!isEmpty(QT.$${module}.name): return(true)
     return(false)
 }
 
@@ -234,13 +250,13 @@ defineTest(prependEach) {
 defineReplace(resolveFinalLibraryName) {
     !debug_and_release: return($$1)
 
-    original_template = $$TEMPLATE
     original_framework_name = $$QMAKE_FRAMEWORK_BUNDLE_NAME
 
     TEMPLATE = lib # So that qtLibraryTarget works
     target = $$qtLibraryTarget($$1)
 
-    TEMPLATE = $$original_template
+    # qtLibraryTarget will export QMAKE_FRAMEWORK_BUNDLE_NAME, which gets
+    # exported not only to this function scope, but to our call site.
     QMAKE_FRAMEWORK_BUNDLE_NAME = $$original_framework_name
     export(QMAKE_FRAMEWORK_BUNDLE_NAME)
 
diff --git a/Tools/qmake/mkspecs/features/rpath.prf b/Tools/qmake/mkspecs/features/rpath.prf
index 46a82e1e9..8dbc42f13 100644
--- a/Tools/qmake/mkspecs/features/rpath.prf
+++ b/Tools/qmake/mkspecs/features/rpath.prf
@@ -1,23 +1,25 @@
 # -------------------------------------------------------------------
 # Set rpath for the application/library we're building
 #
-# Only used by Qt4.
-#
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
-haveQt(4) {
-    equals(ROOT_BUILD_DIR, $$dirname(DESTDIR)): RPATHDIR_RELATIVE_TO_DESTDIR = ../lib
+equals(ROOT_BUILD_DIR, $$dirname(DESTDIR)): RPATHDIR_RELATIVE_TO_DESTDIR = ../lib
 
-    linux-*:!isEmpty(RPATHDIR_RELATIVE_TO_DESTDIR) {
-        # Do the rpath by hand since it's not possible to use ORIGIN in QMAKE_RPATHDIR
-        # this expands to $ORIGIN (after qmake and make), it does NOT read a qmake var.
-        QMAKE_RPATHDIR = \$\$ORIGIN/$${RPATHDIR_RELATIVE_TO_DESTDIR} $${QMAKE_RPATHDIR}
-        RPATH = $$join(QMAKE_RPATHDIR, ":")
+linux-*:!isEmpty(RPATHDIR_RELATIVE_TO_DESTDIR) {
+    # Do the rpath by hand since it's not possible to use ORIGIN in QMAKE_RPATHDIR
+    # this expands to $ORIGIN (after qmake and make), it does NOT read a qmake var.
+    QMAKE_RPATHDIR = \$\$ORIGIN/$${RPATHDIR_RELATIVE_TO_DESTDIR} $${QMAKE_RPATHDIR}
+    RPATH = $$join(QMAKE_RPATHDIR, ":")
 
-        QMAKE_LFLAGS += -Wl,-z,origin \'-Wl,-rpath,$${RPATH}\'
-        QMAKE_RPATHDIR =
-    } else {
-        QMAKE_RPATHDIR = $${ROOT_BUILD_DIR}/lib $${QMAKE_RPATHDIR}
-    }
+    QMAKE_LFLAGS += -Wl,-z,origin \'-Wl,-rpath,$${RPATH}\'
+    QMAKE_RPATHDIR =
+} else {
+    QMAKE_RPATHDIR = $${ROOT_BUILD_DIR}/lib $${QMAKE_RPATHDIR}
 }
+
+# FIXME: For Qt5 this will only give correct rpath for the tools that come with WebKit
+# Any client application built against a developer-build of Qt + WebKit (that does
+# QT += webkit) will not get the rpath pointing to the stand-alone WebKit-build,
+# and will have to set LD_LIBRARY_PATH or do their own rpath logic. This needs
+# to be fixed on the Qt side.
diff --git a/Tools/qmake/qt_webkit.pri b/Tools/qmake/qt_webkit.pri
index 5ec50ab12..02b48bdfa 100644
--- a/Tools/qmake/qt_webkit.pri
+++ b/Tools/qmake/qt_webkit.pri
@@ -13,7 +13,6 @@ QT.webkit.private_includes = $$QT_MODULE_INCLUDE_BASE/$$QT.webkit.name/$$QT.webk
 QT.webkit.sources = $$QT_MODULE_BASE
 QT.webkit.libs = $$QT_MODULE_LIB_BASE
 QT.webkit.depends = core gui opengl network xmlpatterns script
-QT.webkit.module_pri = $$_FILE_
 
 !contains(QT_CONFIG, modular)|contains(QT_ELIGIBLE_MODULES, webkit) {
     QT_CONFIG += webkit
@@ -27,19 +26,3 @@ QT_WEBKIT_VERSION = $$QT.webkit.VERSION
 QT_WEBKIT_MAJOR_VERSION = $$QT.webkit.MAJOR_VERSION
 QT_WEBKIT_MINOR_VERSION = $$QT.webkit.MINOR_VERSION
 QT_WEBKIT_PATCH_VERSION = $$QT.webkit.PATCH_VERSION
-
-unix:!mac {
-    install_prefix = $$find(_FILE_, ^$$[QT_INSTALL_PREFIX])
-    module_prefix = $$find(QMAKE_EXTRA_MODULE_FORWARDS, ^$$dirname(QT_MODULE_BIN_BASE))
-    isEmpty(install_prefix):!isEmpty(module_prefix) {
-        # We are loading the qt_webkit.pri forwarding file from the
-        # local webkit build directory, so set up rpath to point to
-        # to the local build. This ensures that any of the WebKit tools
-        # such as WebKitTestRunner and QtTestBrowser will link to the
-        # non-installed QtWebKit library. The same applies to third-
-        # party applications that set QMAKE_EXTRA_MODULE_FORWARDS.
-        QMAKE_LFLAGS *= "$${QMAKE_LFLAGS_RPATH}$${QT_MODULE_LIB_BASE}"
-    }
-    unset(install_prefix)
-    unset(module_prefix)
-}
diff --git a/Tools/qmake/sync.profile b/Tools/qmake/sync.profile
deleted file mode 100644
index 136f9961c..000000000
--- a/Tools/qmake/sync.profile
+++ /dev/null
@@ -1,11 +0,0 @@
-# This file is only used for config tests
-%configtests = (
-    fontconfig => {},
-    gccdepends => {},
-    libpng => {},
-    libjpeg => {},
-    libwebp => {},
-    libxml2 => {},
-    libxslt => {},
-    libzlib => {},
-);
diff --git a/WebKit.pro b/WebKit.pro
index 9b4007b51..8d4cbbb56 100644
--- a/WebKit.pro
+++ b/WebKit.pro
@@ -5,17 +5,17 @@
 # See 'Tools/qmake/README' for an overview of the build system
 # -------------------------------------------------------------------
 
+haveQt(4) {
+    QMAKEPATH = $$(QMAKEPATH)
+    isEmpty(QMAKEPATH)|!exists($${QMAKEPATH}/mkspecs) {
+        error("The environment variable QMAKEPATH needs to point to $WEBKITSRC/Tools/qmake")
+        # Otherwise we won't pick up the feature prf files needed for the build
+    }
+}
+
 TEMPLATE = subdirs
 CONFIG += ordered
 
-load(features)
-
-QMAKEPATH = $$(QMAKEPATH)
-isEmpty(QMAKEPATH)|!exists($${QMAKEPATH}/mkspecs) {
-    error("The environment variable QMAKEPATH needs to point to $WEBKITSRC/Tools/qmake")
-    # Otherwise we won't pick up the feature prf files needed for the build
-}
-
 WTF.file = Source/WTF/WTF.pro
 WTF.makefile = Makefile.WTF
 SUBDIRS += WTF
@@ -30,18 +30,18 @@ WebCore.file = Source/WebCore/WebCore.pro
 WebCore.makefile = Makefile.WebCore
 SUBDIRS += WebCore
 
-!no_webkit2 {
-    webkit2.file = Source/WebKit2/WebKit2.pro
-    webkit2.makefile = Makefile.WebKit2
-    SUBDIRS += webkit2
-}
-
 !no_webkit1 {
     webkit1.file = Source/WebKit/WebKit1.pro
     webkit1.makefile = Makefile.WebKit1
     SUBDIRS += webkit1
 }
 
+!no_webkit2 {
+    webkit2.file = Source/WebKit2/WebKit2.pro
+    webkit2.makefile = Makefile.WebKit2
+    SUBDIRS += webkit2
+}
+
 QtWebKit.file = Source/QtWebKit.pro
 QtWebKit.makefile = Makefile.QtWebKit
 SUBDIRS += QtWebKit
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index d91872d37..5b3143eaf 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,53 @@
+2012-07-04  John Mellor  <johnme@chromium.org>
+
+        Text Autosizing: Add compile flag and runtime setting
+        https://bugs.webkit.org/show_bug.cgi?id=87394
+
+        This patch renames Font Boosting to Text Autosizing.
+
+        Reviewed by Adam Barth.
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
+2012-06-29  Mihai Balan  <mibalan@adobe.com>
+
+        [CSS Regions] Adding feature defines for CSS Regions for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=88645
+
+        Reviewed by Tony Chang.
+
+        Re-trying to enable CSS regions on Windows. This time only enabling
+        regions since exclusions lead to some very strange compiling/linking
+        problems.
+
+        * win/tools/vsprops/FeatureDefines.vsprops: Added default value for ENABLE_CSS_REGIONS
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops: ditto
+
+2012-06-28  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build correction.  Add two missing macro
+        declarations to vsprops file.
+
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops: Add missing
+        ENABLE_HIGH_DPI_CANVAS and ENABLE_REQUEST_ANIMATION_FRAME macros.
+
+2012-06-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build correction.  Accidentally turned on
+        CSS_FILTERS, which is not available in tree.
+
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops: Turn CSS_FILTERS
+        back off for WinCairo target.
+
+2012-06-27  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Unreviewed build correction.  Resync feature defines with
+        Apple port. Things have drifted apart a little.
+
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops: Update to match
+        Apple port, define some missing features.
+
 2012-06-19  Mike West  <mkwst@chromium.org>
 
         Introduce ENABLE_CSP_NEXT configuration flag.
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
index b9014105f..0fac5e27f 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
@@ -9,7 +9,7 @@
 	>
   <Tool
 		Name="VCCLCompilerTool"
-		PreprocessorDefinitions="$(ENABLE_IFRAME_SEAMLESS);$(ENABLE_REQUEST_ANIMATION_FRAME);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CSS3_FLEXBOX);$(ENABLE_CSS_BOX_DECORATION_BREAK);$(ENABLE_CSS_FILTERS);$(ENABLE_CSS_GRID_LAYOUT);$(ENABLE_CSS_SHADERS);$(ENABLE_CSS_REGIONS);$(ENABLE_CSS_EXCLUSIONS);$(ENABLE_CUSTOM_SCHEME_HANDLER);$(ENABLE_SQL_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DATA_TRANSFER_ITEMS);$(ENABLE_DETAILS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FONT_BOOSTING);$(ENABLE_FULLSCREEN_API);$(ENABLE_GAMEPAD);$(ENABLE_GEOLOCATION);$(ENABLE_HIGH_DPI_CANVAS);$(ENABLE_ICONDATABASE);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_TYPE_COLOR);$(ENABLE_INPUT_SPEECH);$(ENABLE_INPUT_TYPE_DATE);$(ENABLE_INPUT_TYPE_DATETIME);$(ENABLE_INPUT_TYPE_DATETIMELOCAL);$(ENABLE_INPUT_TYPE_MONTH);$(ENABLE_INPUT_TYPE_TIME);$(ENABLE_INPUT_TYPE_WEEK);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LEGACY_CSS_VENDOR_PREFIXES);$(ENABLE_LEGACY_NOTIFICATIONS);$(ENABLE_LINK_PREFETCH);$(ENABLE_LINK_PRERENDER);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_MICRODATA);$(ENABLE_MUTATION_OBSERVERS);$(ENABLE_NOTIFICATIONS);$(ENABLE_PAGE_VISIBILITY_API);$(ENABLE_PROGRESS_TAG);$(ENABLE_QUOTA);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SCRIPTED_SPEECH);$(ENABLE_SHADOW_DOM);$(ENABLE_SHARED_WORKERS);$(ENABLE_STYLE_SCOPED);$(ENABLE_SVG);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_UNDO_MANAGER);$(ENABLE_VIDEO);$(ENABLE_MEDIA_SOURCE);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WORKERS);$(ENABLE_XSLT)"
+		PreprocessorDefinitions="$(ENABLE_IFRAME_SEAMLESS);$(ENABLE_REQUEST_ANIMATION_FRAME);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CSS3_FLEXBOX);$(ENABLE_CSS_BOX_DECORATION_BREAK);$(ENABLE_CSS_FILTERS);$(ENABLE_CSS_GRID_LAYOUT);$(ENABLE_CSS_SHADERS);$(ENABLE_CSS_REGIONS);$(ENABLE_CSS_EXCLUSIONS);$(ENABLE_CUSTOM_SCHEME_HANDLER);$(ENABLE_SQL_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DATA_TRANSFER_ITEMS);$(ENABLE_DETAILS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FULLSCREEN_API);$(ENABLE_GAMEPAD);$(ENABLE_GEOLOCATION);$(ENABLE_HIGH_DPI_CANVAS);$(ENABLE_ICONDATABASE);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_TYPE_COLOR);$(ENABLE_INPUT_SPEECH);$(ENABLE_INPUT_TYPE_DATE);$(ENABLE_INPUT_TYPE_DATETIME);$(ENABLE_INPUT_TYPE_DATETIMELOCAL);$(ENABLE_INPUT_TYPE_MONTH);$(ENABLE_INPUT_TYPE_TIME);$(ENABLE_INPUT_TYPE_WEEK);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LEGACY_CSS_VENDOR_PREFIXES);$(ENABLE_LEGACY_NOTIFICATIONS);$(ENABLE_LINK_PREFETCH);$(ENABLE_LINK_PRERENDER);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_MICRODATA);$(ENABLE_MUTATION_OBSERVERS);$(ENABLE_NOTIFICATIONS);$(ENABLE_PAGE_VISIBILITY_API);$(ENABLE_PROGRESS_TAG);$(ENABLE_QUOTA);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SCRIPTED_SPEECH);$(ENABLE_SHADOW_DOM);$(ENABLE_SHARED_WORKERS);$(ENABLE_STYLE_SCOPED);$(ENABLE_SVG);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_TEXT_AUTOSIZING);$(ENABLE_UNDO_MANAGER);$(ENABLE_VIDEO);$(ENABLE_MEDIA_SOURCE);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WORKERS);$(ENABLE_XSLT)"
 	/>
   <UserMacro
 		Name="ENABLE_3D_RENDERING"
@@ -63,7 +63,7 @@
 	/>
   <UserMacro
 		Name="ENABLE_CSS_REGIONS"
-		Value=""
+		Value="ENABLE_CSS_REGIONS"
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
@@ -117,11 +117,6 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
-		Name="ENABLE_FONT_BOOSTING"
-		Value=""
-		PerformEnvironmentSet="true"
-	/>
-  <UserMacro
 		Name="ENABLE_FULLSCREEN_API"
 		Value="ENABLE_FULLSCREEN_API"
 		PerformEnvironmentSet="true"
@@ -322,6 +317,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_TEXT_AUTOSIZING"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_UNDO_MANAGER"
 		Value=""
 		PerformEnvironmentSet="true"
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
index 822ae3c86..ac062dbf0 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
@@ -9,7 +9,7 @@
 	>
   <Tool
 		Name="VCCLCompilerTool"
-		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CSS3_FLEXBOX);$(ENABLE_CSS_BOX_DECORATION_BREAK);$(ENABLE_CSS_FILTERS);$(ENABLE_CSS_GRID_LAYOUT);$(ENABLE_CSS_SHADERS);$(ENABLE_CSS_REGIONS);$(ENABLE_CSS_EXCLUSIONS);$(ENABLE_CUSTOM_SCHEME_HANDLER);$(ENABLE_SQL_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DATA_TRANSFER_ITEMS);$(ENABLE_DETAILS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FONT_BOOSTING);$(ENABLE_FULLSCREEN_API);$(ENABLE_GAMEPAD);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_TYPE_COLOR);$(ENABLE_INPUT_SPEECH);$(ENABLE_INPUT_TYPE_DATE);$(ENABLE_INPUT_TYPE_DATETIME);$(ENABLE_INPUT_TYPE_DATETIMELOCAL);$(ENABLE_INPUT_TYPE_MONTH);$(ENABLE_INPUT_TYPE_TIME);$(ENABLE_INPUT_TYPE_WEEK);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LEGACY_NOTIFICATIONS);$(ENABLE_LINK_PREFETCH);$(ENABLE_LINK_PRERENDER);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_MICRODATA);$(ENABLE_MUTATION_OBSERVERS);$(ENABLE_NOTIFICATIONS);$(ENABLE_PAGE_VISIBILITY_API);$(ENABLE_PROGRESS_TAG);$(ENABLE_QUOTA);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SCRIPTED_SPEECH);$(ENABLE_SHADOW_DOM);$(ENABLE_SHARED_WORKERS);$(ENABLE_STYLE_SCOPED);$(ENABLE_SVG);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_UNDO_MANAGER);$(ENABLE_VIDEO);$(ENABLE_MEDIA_SOURCE);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WORKERS);$(ENABLE_XSLT)"
+		PreprocessorDefinitions="$(ENABLE_IFRAME_SEAMLESS);$(ENABLE_REQUEST_ANIMATION_FRAME);$(ENABLE_3D_RENDERING);$(ENABLE_ACCELERATED_2D_CANVAS);$(ENABLE_BLOB);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CSS3_FLEXBOX);$(ENABLE_CSS_BOX_DECORATION_BREAK);$(ENABLE_CSS_FILTERS);$(ENABLE_CSS_GRID_LAYOUT);$(ENABLE_CSS_SHADERS);$(ENABLE_CSS_REGIONS);$(ENABLE_CSS_EXCLUSIONS);$(ENABLE_CUSTOM_SCHEME_HANDLER);$(ENABLE_SQL_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DATA_TRANSFER_ITEMS);$(ENABLE_DETAILS);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_FILTERS);$(ENABLE_FILE_SYSTEM);$(ENABLE_FULLSCREEN_API);$(ENABLE_GAMEPAD);$(ENABLE_GEOLOCATION);$(ENABLE_HIGH_DPI_CANVAS);$(ENABLE_ICONDATABASE);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_TYPE_COLOR);$(ENABLE_INPUT_SPEECH);$(ENABLE_INPUT_TYPE_DATE);$(ENABLE_INPUT_TYPE_DATETIME);$(ENABLE_INPUT_TYPE_DATETIMELOCAL);$(ENABLE_INPUT_TYPE_MONTH);$(ENABLE_INPUT_TYPE_TIME);$(ENABLE_INPUT_TYPE_WEEK);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_LEGACY_CSS_VENDOR_PREFIXES);$(ENABLE_LEGACY_NOTIFICATIONS);$(ENABLE_LINK_PREFETCH);$(ENABLE_LINK_PRERENDER);$(ENABLE_MATHML);$(ENABLE_METER_TAG);$(ENABLE_MICRODATA);$(ENABLE_MUTATION_OBSERVERS);$(ENABLE_NOTIFICATIONS);$(ENABLE_PAGE_VISIBILITY_API);$(ENABLE_PROGRESS_TAG);$(ENABLE_QUOTA);$(ENABLE_REGISTER_PROTOCOL_HANDLER);$(ENABLE_SCRIPTED_SPEECH);$(ENABLE_SHADOW_DOM);$(ENABLE_SHARED_WORKERS);$(ENABLE_STYLE_SCOPED);$(ENABLE_SVG);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_TEXT_AUTOSIZING);$(ENABLE_UNDO_MANAGER);$(ENABLE_VIDEO);$(ENABLE_MEDIA_SOURCE);$(ENABLE_MEDIA_STATISTICS);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WORKERS);$(ENABLE_XSLT)"
 	/>
   <UserMacro
 		Name="ENABLE_3D_RENDERING"
@@ -43,7 +43,7 @@
 	/>
   <UserMacro
 		Name="ENABLE_CSS_BOX_DECORATION_BREAK"
-		Value=""
+		Value="ENABLE_CSS_BOX_DECORATION_BREAK"
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
@@ -63,7 +63,7 @@
 	/>
   <UserMacro
 		Name="ENABLE_CSS_REGIONS"
-		Value=""
+		Value="ENABLE_CSS_REGIONS"
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
@@ -83,7 +83,7 @@
 	/>
   <UserMacro
 		Name="ENABLE_DATALIST"
-		Value="ENABLE_DATALIST"
+		Value=""
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
@@ -117,11 +117,6 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
-		Name="ENABLE_FONT_BOOSTING"
-		Value=""
-		PerformEnvironmentSet="true"
-	/>
-  <UserMacro
 		Name="ENABLE_FULLSCREEN_API"
 		Value=""
 		PerformEnvironmentSet="true"
@@ -137,11 +132,21 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_HIGH_DPI_CANVAS"
+		Value="ENABLE_HIGH_DPI_CANVAS"
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_ICONDATABASE"
 		Value="ENABLE_ICONDATABASE"
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_IFRAME_SEAMLESS"
+		Value="ENABLE_IFRAME_SEAMLESS"
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_INDEXED_DATABASE"
 		Value=""
 		PerformEnvironmentSet="true"
@@ -192,6 +197,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_LEGACY_CSS_VENDOR_PREFIXES"
+		Value="ENABLE_LEGACY_CSS_VENDOR_PREFIXES"
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_LEGACY_NOTIFICATIONS"
 		Value=""
 		PerformEnvironmentSet="true"
@@ -262,6 +272,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_REQUEST_ANIMATION_FRAME"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_SCRIPTED_SPEECH"
 		Value=""
 		PerformEnvironmentSet="true"
@@ -302,6 +317,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_TEXT_AUTOSIZING"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_UNDO_MANAGER"
 		Value=""
 		PerformEnvironmentSet="true"
diff --git a/configure.ac b/configure.ac
index e6cb220e1..a7e0982b2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -373,7 +373,7 @@ CAIRO_REQUIRED_VERSION=1.10
 FONTCONFIG_REQUIRED_VERSION=2.4
 FREETYPE2_REQUIRED_VERSION=9.0
 GLIB_REQUIRED_VERSION=2.32.0
-LIBSOUP_REQUIRED_VERSION=2.37.92
+LIBSOUP_REQUIRED_VERSION=2.39.2
 LIBXML_REQUIRED_VERSION=2.6
 PANGO_REQUIRED_VERSION=1.21.0
 
@@ -527,6 +527,14 @@ AC_ARG_ENABLE(optimizations,
               [if test "$enable_debug" = "yes"; then enable_optimizations="no"; else enable_optimizations="yes"; fi])
 AC_MSG_RESULT([$enable_optimizations])
 
+# check whether to enable unstable features
+AC_MSG_CHECKING([whether to enable unstable features])
+AC_ARG_ENABLE(unstable_features,
+              AC_HELP_STRING([--enable-unstable-features],
+                             [enable unstable features [default=no]]),
+              [],[enable_unstable_features="no"])
+AC_MSG_RESULT([$enable_unstable_features])
+
 found_opengl="no"
 if test "$with_target" = "x11"; then
     AC_CHECK_HEADERS([GL/gl.h], [found_opengl="yes"], [])
@@ -650,9 +658,14 @@ AC_MSG_CHECKING([whether to enable Gamepad support])
 AC_ARG_ENABLE(gamepad,
               AC_HELP_STRING([--enable-gamepad],
                              [enable Gamepad support [default=no]]),
-              [],[enable_gamepad="no"])
+              [],[enable_gamepad=$enable_unstable_features])
 AC_MSG_RESULT([$enable_gamepad])
 
+if test "$enable_gamepad" = "yes" && test "$os_linux" = no; then
+   AC_MSG_WARN([Gamepad support is only available on Linux. Disabling Gamepad support.])
+   enable_gamepad=no;
+fi
+
 # check whether to build with data transfer items support
 AC_MSG_CHECKING([whether to enable HTML5 data transfer items support])
 AC_ARG_ENABLE(data_transfer_items,
@@ -666,7 +679,7 @@ AC_MSG_CHECKING([whether to enable DOM mutation observer support])
 AC_ARG_ENABLE(mutation_observers,
               AC_HELP_STRING([--enable-mutation-observers],
                              [enable DOM mutation observer support [default=no]]),
-              [],[enable_mutation_observers="no"])
+              [],[enable_mutation_observers=$enable_unstable_features])
 AC_MSG_RESULT([$enable_mutation_observers])
 
 # check whether to enable the indexed database API
@@ -751,7 +764,7 @@ AC_MSG_CHECKING([whether to enable HTML5 video track support])
 AC_ARG_ENABLE(video_track,
               AC_HELP_STRING([--enable-video-track],
                              [enable HTML5 video track support [default=no]]),
-              [],[enable_video_track="no"])
+              [],[enable_video_track=$enable_unstable_features])
 AC_MSG_RESULT([$enable_video_track])
 
 # check whether to enable media source support
@@ -783,7 +796,7 @@ AC_MSG_CHECKING([whether to enable media stream support])
 AC_ARG_ENABLE(media_stream,
               AC_HELP_STRING([--enable-media-stream],
                              [enable media stream support (incomplete) [default=no]]),
-              [],[enable_media_stream="no"])
+              [],[enable_media_stream=$enable_unstable_features])
 AC_MSG_RESULT([$enable_media_stream])
 
 # check whether to enable XSLT support
@@ -941,7 +954,7 @@ AC_MSG_CHECKING([whether to enable Web Timing support])
 AC_ARG_ENABLE(web_timing,
               AC_HELP_STRING([--enable-web-timing],
                              [enable support for Web Timing [default=no]]),
-              [],[enable_web_timing="no"])
+              [],[enable_web_timing=$enable_unstable_features])
 AC_MSG_RESULT([$enable_web_timing])
 
 # check whether to enable Blob support
@@ -981,7 +994,7 @@ AC_MSG_CHECKING([whether to enable CSS3 flexbox support])
 AC_ARG_ENABLE(css3_flexbox,
               AC_HELP_STRING([--enable-css3-flexbox],
                              [enable CSS3 flexbox support [default=no]]),
-              [],[enable_css3_flexbox="no"])
+              [],[enable_css3_flexbox=$enable_unstable_features])
 AC_MSG_RESULT([$enable_css3_flexbox])
 
 # check whether to enable FastMalloc
@@ -1038,7 +1051,7 @@ fi
 AC_MSG_CHECKING([whether to enable link prefetch support])
 AC_ARG_ENABLE([link-prefetch],
   [AS_HELP_STRING([--enable-link-prefetch], [Enable Link prefetch support (default: disabled)])],
-  [],[enable_link_prefetch=no])
+  [],[enable_link_prefetch=$enable_unstable_features])
 AC_MSG_RESULT([$enable_link_prefetch])
 
 # GObject Introspection
@@ -1088,13 +1101,13 @@ AC_ARG_ENABLE(device_orientation,
               [],[enable_device_orientation="no"])
 AC_MSG_RESULT([$enable_device_orientation])
 
-# check whether to enable Font Boosting support
-AC_MSG_CHECKING([whether to enable Font Boosting])
-AC_ARG_ENABLE(font_boosting,
-              AC_HELP_STRING([--enable-font-boosting],
-                             [enable support for Font Boosting (incomplete) [default=no]]),
-              [],[enable_font_boosting="no"])
-AC_MSG_RESULT([$enable_font_boosting])
+# check whether to enable Text Autosizing support
+AC_MSG_CHECKING([whether to enable Text Autosizing])
+AC_ARG_ENABLE(text_autosizing,
+              AC_HELP_STRING([--enable-text-autosizing],
+                             [enable support for Text Autosizing (incomplete) [default=no]]),
+              [],[enable_text_autosizing="no"])
+AC_MSG_RESULT([$enable_text_autosizing])
 
 # check whether to enable CSS Exclusions support
 AC_MSG_CHECKING([whether to enable CSS Exclusions])
@@ -1276,6 +1289,13 @@ if test "$enable_webkit2" = "yes"; then
    AC_SUBST([ATSPI2_LIBS])
 fi
 
+if test "$enable_gamepad" = "yes"; then
+   PKG_CHECK_MODULES([GAMEPAD], [gio-unix-2.0 gudev-1.0])
+
+   AC_SUBST(GAMEPAD_CFLAGS)
+   AC_SUBST(GAMEPAD_LIBS)
+fi
+
 # check for code coverage support
 if test "$enable_coverage" = "yes"; then
    COVERAGE_CFLAGS="-MD"
@@ -1378,6 +1398,7 @@ AM_CONDITIONAL([USE_LEVELDB],[test "$enable_indexed_database" = "yes"])
 
 # WebKit feature conditionals
 AM_CONDITIONAL([ENABLE_DEBUG],[test "$enable_debug_features" = "yes"])
+AM_CONDITIONAL([ENABLE_UNSTABLE_FEATURES],[test "$enable_unstable_features" = "yes"])
 AM_CONDITIONAL([ENABLE_WEBGL],[test "$enable_webgl" = "yes"])
 AM_CONDITIONAL([ENABLE_BLOB],[test "$enable_blob" = "yes"])
 AM_CONDITIONAL([ENABLE_LEGACY_WEBKIT_BLOB_BUILDER],[test "$enable_legacy_webkit_blob_builder" = "yes"])
@@ -1441,7 +1462,7 @@ AM_CONDITIONAL([ENABLE_REGISTER_PROTOCOL_HANDLER],[test "$enable_register_protoc
 AM_CONDITIONAL([ENABLE_DEVICE_ORIENTATION],[test "$enable_device_orientation" = "yes"])
 AM_CONDITIONAL([ENABLE_MUTATION_OBSERVERS],[test "$enable_mutation_observers" = "yes"])
 AM_CONDITIONAL([ENABLE_IFRAME_SEAMLESS],[test "$enable_iframe_seamless" = "yes"])
-AM_CONDITIONAL([ENABLE_FONT_BOOSTING],[test "$enable_font_boosting" = "yes"])
+AM_CONDITIONAL([ENABLE_TEXT_AUTOSIZING],[test "$enable_text_autosizing" = "yes"])
 AM_CONDITIONAL([ENABLE_CSS_EXCLUSIONS],[test "$enable_css_exclusions" = "yes"])
 AM_CONDITIONAL([ENABLE_CSS_REGIONS],[test "$enable_css_regions" = "yes"])
 
@@ -1510,7 +1531,6 @@ Features:
  DOM mutation observer support                            : $enable_mutation_observers
  Fast Mobile Scrolling                                    : $enable_fast_mobile_scrolling
  Filters support                                          : $enable_filters
- Font Boosting support                                    : $enable_font_boosting
  Fullscreen API support                                   : $enable_fullscreen_api
  Gamepad support                                          : $enable_gamepad
  Geolocation support                                      : $enable_geolocation
@@ -1546,6 +1566,7 @@ Features:
  SQL client-side database storage support                 : $enable_sql_database
  SVG fonts support                                        : $enable_svg_fonts
  SVG support                                              : $enable_svg
+ Text Autosizing support                                  : $enable_text_autosizing
  Touch Icon Loading support                               : $enable_touch_icon_loading
  Web Audio support                                        : $enable_web_audio
  WebGL                                                    : $enable_webgl