Imported WebKit commit c60cfe0fc09efd257aa0111d7b133b02deb8a63e (http://svn.webkit.org/repository/webkit/trunk@136119)

New snapshot that includes the fix for installing the QtWebProcess into libexec

Change-Id: I01344e079cbdac5678c4cba6ffcc05f4597cf0d7
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

16 files changed, 261 insertions, 158 deletions

diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index b127aa96a..4bc7b084f 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -296,7 +296,6 @@ static const CSSPropertyID computedProperties[] = {
     CSSPropertyWebkitMarqueeIncrement,
     CSSPropertyWebkitMarqueeRepetition,
     CSSPropertyWebkitMarqueeStyle,
-    CSSPropertyWebkitMaskAttachment,
     CSSPropertyWebkitMaskBoxImage,
     CSSPropertyWebkitMaskBoxImageOutset,
     CSSPropertyWebkitMaskBoxImageRepeat,
@@ -1540,9 +1539,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
 
             return list.release();
         }
-        case CSSPropertyBackgroundAttachment:
-        case CSSPropertyWebkitMaskAttachment: {
-            const FillLayer* layers = propertyID == CSSPropertyWebkitMaskAttachment ? style->maskLayers() : style->backgroundLayers();
+        case CSSPropertyBackgroundAttachment: {
+            const FillLayer* layers = style->backgroundLayers();
             if (!layers->next())
                 return cssValuePool().createValue(layers->attachment());
 
@@ -1715,9 +1713,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(CSSPropert
         case CSSPropertyWebkitColumnRuleWidth:
             return zoomAdjustedPixelValue(style->columnRuleWidth(), style.get());
         case CSSPropertyWebkitColumnSpan:
-            if (style->columnSpan())
-                return cssValuePool().createIdentifierValue(CSSValueAll);
-            return cssValuePool().createValue(1, CSSPrimitiveValue::CSS_NUMBER);
+            return cssValuePool().createIdentifierValue(style->columnSpan() ? CSSValueAll : CSSValueNone);
         case CSSPropertyWebkitColumnBreakAfter:
             return cssValuePool().createValue(style->columnBreakAfter());
         case CSSPropertyWebkitColumnBreakBefore:
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 7ca155c5b..43a89e424 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -1086,8 +1086,16 @@ static bool parseKeywordValue(StylePropertySet* declaration, CSSPropertyID prope
 {
     ASSERT(!string.isEmpty());
 
-    if (!isKeywordPropertyID(propertyId))
-        return false;
+    if (!isKeywordPropertyID(propertyId)) {
+        // All properties accept the values of "initial" and "inherit".
+        String lowerCaseString = string.lower();
+        if (lowerCaseString != "initial" && lowerCaseString != "inherit")
+            return false;
+
+        // Parse initial/inherit shorthands using the CSSParser.
+        if (shorthandForProperty(propertyId).length())
+            return false;
+    }
 
     CSSParserString cssString;
     cssString.init(string);
@@ -1689,6 +1697,22 @@ inline PassRefPtr<CSSPrimitiveValue> CSSParser::parseValidPrimitive(int identifi
     return 0;
 }
 
+void CSSParser::addExpandedPropertyForValue(CSSPropertyID propId, PassRefPtr<CSSValue> prpValue, bool important)
+{
+    const StylePropertyShorthand& shorthand = shorthandForProperty(propId);
+    unsigned shorthandLength = shorthand.length();
+    if (!shorthandLength) {
+        addProperty(propId, prpValue, important);
+        return;
+    }
+
+    RefPtr<CSSValue> value = prpValue;
+    ShorthandScope scope(this, propId);
+    const CSSPropertyID* longhands = shorthand.properties();
+    for (unsigned i = 0; i < shorthandLength; ++i)
+        addProperty(longhands[i], value, important);
+}
+
 bool CSSParser::parseValue(CSSPropertyID propId, bool important)
 {
     if (!m_valueList)
@@ -1710,13 +1734,13 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
     if (id == CSSValueInherit) {
         if (num != 1)
             return false;
-        addProperty(propId, cssValuePool().createInheritedValue(), important);
+        addExpandedPropertyForValue(propId, cssValuePool().createInheritedValue(), important);
         return true;
     }
     else if (id == CSSValueInitial) {
         if (num != 1)
             return false;
-        addProperty(propId, cssValuePool().createExplicitInitialValue(), important);
+        addExpandedPropertyForValue(propId, cssValuePool().createExplicitInitialValue(), important);
         return true;
     }
 
@@ -1947,7 +1971,6 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
     case CSSPropertyBackgroundRepeat:
     case CSSPropertyBackgroundRepeatX:
     case CSSPropertyBackgroundRepeatY:
-    case CSSPropertyWebkitMaskAttachment:
     case CSSPropertyWebkitMaskClip:
     case CSSPropertyWebkitMaskComposite:
     case CSSPropertyWebkitMaskImage:
@@ -2497,8 +2520,8 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
         if (id == CSSValueNormal || id == CSSValueReverse)
             validPrimitive = true;
         break;
-    case CSSPropertyWebkitColumnSpan:        // all | 1
-        if (id == CSSValueAll)
+    case CSSPropertyWebkitColumnSpan: // none | all | 1 (will be dropped in the unprefixed property)
+        if (id == CSSValueAll || id == CSSValueNone)
             validPrimitive = true;
         else
             validPrimitive = validUnit(value, FNumber | FNonNeg) && value->fValue == 1;
@@ -2599,9 +2622,8 @@ bool CSSParser::parseValue(CSSPropertyID propId, bool important)
     }
     case CSSPropertyWebkitMask: {
         const CSSPropertyID properties[] = { CSSPropertyWebkitMaskImage, CSSPropertyWebkitMaskRepeat,
-                                   CSSPropertyWebkitMaskAttachment, CSSPropertyWebkitMaskPosition,
-                                   CSSPropertyWebkitMaskOrigin, CSSPropertyWebkitMaskClip };
-        return parseFillShorthand(propId, properties, 6, important);
+            CSSPropertyWebkitMaskPosition, CSSPropertyWebkitMaskOrigin, CSSPropertyWebkitMaskClip, CSSPropertyWebkitMaskSize };
+        return parseFillShorthand(propId, properties, WTF_ARRAY_LENGTH(properties), important);
     }
     case CSSPropertyBorder:
         // [ 'border-width' || 'border-style' || <color> ] | inherit
@@ -2948,7 +2970,7 @@ bool CSSParser::parseFillShorthand(CSSPropertyID propId, const CSSPropertyID* pr
     RefPtr<CSSValue> repeatYValue;
     bool foundClip = false;
     int i;
-    bool foundBackgroundPositionCSSProperty = false;
+    bool foundPositionCSSProperty = false;
 
     while (m_valueList->current()) {
         CSSParserValue* val = m_valueList->current();
@@ -2978,19 +3000,19 @@ bool CSSParser::parseFillShorthand(CSSPropertyID propId, const CSSPropertyID* pr
                 break;
         }
 
-        bool backgroundSizeCSSPropertyExpected = false;
-        if ((val->unit == CSSParserValue::Operator && val->iValue == '/') && foundBackgroundPositionCSSProperty) {
-            backgroundSizeCSSPropertyExpected = true;
+        bool sizeCSSPropertyExpected = false;
+        if ((val->unit == CSSParserValue::Operator && val->iValue == '/') && foundPositionCSSProperty) {
+            sizeCSSPropertyExpected = true;
             m_valueList->next();
         }
 
-        foundBackgroundPositionCSSProperty = false;
+        foundPositionCSSProperty = false;
         bool found = false;
         for (i = 0; !found && i < numProperties; ++i) {
 
-            if (backgroundSizeCSSPropertyExpected && properties[i] != CSSPropertyBackgroundSize)
+            if (sizeCSSPropertyExpected && (properties[i] != CSSPropertyBackgroundSize && properties[i] != CSSPropertyWebkitMaskSize))
                 continue;
-            if (!backgroundSizeCSSPropertyExpected && properties[i] == CSSPropertyBackgroundSize)
+            if (!sizeCSSPropertyExpected && (properties[i] == CSSPropertyBackgroundSize || properties[i] == CSSPropertyWebkitMaskSize))
                 continue;
 
             if (!parsedProperty[i]) {
@@ -3017,8 +3039,8 @@ bool CSSParser::parseFillShorthand(CSSPropertyID propId, const CSSPropertyID* pr
                         addFillValue(clipValue, val1.release());
                         foundClip = true;
                     }
-                    if (properties[i] == CSSPropertyBackgroundPosition)
-                        foundBackgroundPositionCSSProperty =  true;
+                    if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
+                        foundPositionCSSProperty = true;
                 }
             }
         }
@@ -3038,7 +3060,7 @@ bool CSSParser::parseFillShorthand(CSSPropertyID propId, const CSSPropertyID* pr
                 addFillValue(positionYValue, cssValuePool().createImplicitInitialValue());
             if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
                 addFillValue(repeatYValue, cssValuePool().createImplicitInitialValue());
-            if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin)) {
+            if (properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) {
                 // If background-origin wasn't present, then reset background-clip also.
                 addFillValue(clipValue, cssValuePool().createImplicitInitialValue());
             }
@@ -4067,7 +4089,6 @@ bool CSSParser::parseFillProperty(CSSPropertyID propId, CSSPropertyID& propId1,
                         m_valueList->next();
                     break;
                 case CSSPropertyBackgroundAttachment:
-                case CSSPropertyWebkitMaskAttachment:
                     if (val->id == CSSValueScroll || val->id == CSSValueFixed || val->id == CSSValueLocal) {
                         currValue = cssValuePool().createIdentifierValue(val->id);
                         m_valueList->next();
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 2b0d85419..d12f72bc5 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -92,6 +92,7 @@ public:
     void addProperty(CSSPropertyID, PassRefPtr<CSSValue>, bool important, bool implicit = false);
     void rollbackLastProperties(int num);
     bool hasProperties() const { return !m_parsedProperties.isEmpty(); }
+    void addExpandedPropertyForValue(CSSPropertyID propId, PassRefPtr<CSSValue>, bool);
 
     bool parseValue(CSSPropertyID, bool important);
     bool parseShorthand(CSSPropertyID, const StylePropertyShorthand&, bool important);
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index 22f9fb707..db10acadd 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -149,26 +149,32 @@ template<> inline CSSPrimitiveValue::operator LineClampValue() const
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ColumnSpan columnSpan)
     : CSSValue(PrimitiveClass)
 {
+    m_primitiveUnitType = CSS_IDENT;
     switch (columnSpan) {
     case ColumnSpanAll:
-        m_primitiveUnitType = CSS_IDENT;
         m_value.ident = CSSValueAll;
         break;
-    case ColumnSpanOne:
-        m_primitiveUnitType = CSS_NUMBER;
-        m_value.num = 1;
+    case ColumnSpanNone:
+        m_value.ident = CSSValueNone;
         break;
     }
 }
 
 template<> inline CSSPrimitiveValue::operator ColumnSpan() const
 {
-    if (m_primitiveUnitType == CSS_IDENT && m_value.ident == CSSValueAll)
-        return ColumnSpanAll;
+    // Map 1 to none for compatibility reasons.
     if (m_primitiveUnitType == CSS_NUMBER && m_value.num == 1)
-        return ColumnSpanOne;
+        return ColumnSpanNone;
+
+    switch (m_value.ident) {
+    case CSSValueAll:
+        return ColumnSpanAll;
+    case CSSValueNone:
+        return ColumnSpanNone;
+    }
+
     ASSERT_NOT_REACHED();
-    return ColumnSpanOne;
+    return ColumnSpanNone;
 }
 
 
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index 6128a1097..13d0b19e3 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -596,7 +596,6 @@ bool CSSProperty::isInheritedProperty(CSSPropertyID propertyID)
     case CSSPropertyWebkitMarqueeSpeed:
     case CSSPropertyWebkitMarqueeStyle:
     case CSSPropertyWebkitMask:
-    case CSSPropertyWebkitMaskAttachment:
     case CSSPropertyWebkitMaskBoxImage:
     case CSSPropertyWebkitMaskBoxImageOutset:
     case CSSPropertyWebkitMaskBoxImageRepeat:
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index ca359b521..d958c6b69 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -318,7 +318,6 @@ z-index
 -webkit-marquee-speed
 -webkit-marquee-style
 -webkit-mask
--webkit-mask-attachment
 -webkit-mask-box-image
 -webkit-mask-box-image-outset
 -webkit-mask-box-image-repeat
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index 38d41f784..d4841ca02 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -523,10 +523,9 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
         return checkSelector(nextContext, ignoreDynamicPseudo);
 
     case CSSSelector::DirectAdjacent:
-        if (m_mode == ResolvingStyle && context.element->parentElement()) {
-            RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : context.element->parentNode()->renderStyle();
-            if (parentStyle)
-                parentStyle->setChildrenAffectedByDirectAdjacentRules();
+        if (m_mode == ResolvingStyle) {
+            if (Element* parentElement = context.element->parentElement())
+                parentElement->setChildrenAffectedByDirectAdjacentRules();
         }
         nextContext.element = context.element->previousElementSibling();
         if (!nextContext.element)
@@ -537,10 +536,9 @@ SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorChec
         return checkSelector(nextContext, ignoreDynamicPseudo);
 
     case CSSSelector::IndirectAdjacent:
-        if (m_mode == ResolvingStyle && context.element->parentElement()) {
-            RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : context.element->parentNode()->renderStyle();
-            if (parentStyle)
-                parentStyle->setChildrenAffectedByForwardPositionalRules();
+        if (m_mode == ResolvingStyle) {
+            if (Element* parentElement = context.element->parentElement())
+                parentElement->setChildrenAffectedByForwardPositionalRules();
         }
         nextContext.element = context.element->previousElementSibling();
         nextContext.isSubSelector = false;
@@ -814,6 +812,7 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
                     }
                 }
                 if (m_mode == ResolvingStyle) {
+                    element->setStyleAffectedByEmpty();
                     if (context.elementStyle)
                         context.elementStyle->setEmptyState(result);
                     else if (element->renderStyle() && (element->document()->styleSheetCollection()->usesSiblingRules() || element->renderStyle()->unique()))
@@ -823,13 +822,11 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             }
         case CSSSelector::PseudoFirstChild:
             // first-child matches the first child that is an element
-            if (element->parentElement()) {
+            if (Element* parentElement = element->parentElement()) {
                 bool result = siblingTraversalStrategy.isFirstChild(element);
                 if (m_mode == ResolvingStyle) {
                     RenderStyle* childStyle = context.elementStyle ? context.elementStyle : element->renderStyle();
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : element->parentNode()->renderStyle();
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByFirstChildRules();
+                    parentElement->setChildrenAffectedByFirstChildRules();
                     if (result && childStyle)
                         childStyle->setFirstChildState();
                 }
@@ -838,13 +835,10 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             break;
         case CSSSelector::PseudoFirstOfType:
             // first-of-type matches the first element of its type
-            if (element->parentElement()) {
+            if (Element* parentElement = element->parentElement()) {
                 bool result = siblingTraversalStrategy.isFirstOfType(element, element->tagQName());
-                if (m_mode == ResolvingStyle) {
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : element->parentNode()->renderStyle();
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByForwardPositionalRules();
-                }
+                if (m_mode == ResolvingStyle)
+                    parentElement->setChildrenAffectedByForwardPositionalRules();
                 return result;
             }
             break;
@@ -854,9 +848,7 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
                 bool result = parentElement->isFinishedParsingChildren() && siblingTraversalStrategy.isLastChild(element);
                 if (m_mode == ResolvingStyle) {
                     RenderStyle* childStyle = context.elementStyle ? context.elementStyle : element->renderStyle();
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByLastChildRules();
+                    parentElement->setChildrenAffectedByLastChildRules();
                     if (result && childStyle)
                         childStyle->setLastChildState();
                 }
@@ -866,11 +858,8 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
         case CSSSelector::PseudoLastOfType:
             // last-of-type matches the last element of its type
             if (Element* parentElement = element->parentElement()) {
-                if (m_mode == ResolvingStyle) {
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByBackwardPositionalRules();
-                }
+                if (m_mode == ResolvingStyle)
+                    parentElement->setChildrenAffectedByBackwardPositionalRules();
                 if (!parentElement->isFinishedParsingChildren())
                     return false;
                 return siblingTraversalStrategy.isLastOfType(element, element->tagQName());
@@ -882,11 +871,8 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
                 bool onlyChild = firstChild && parentElement->isFinishedParsingChildren() && siblingTraversalStrategy.isLastChild(element);
                 if (m_mode == ResolvingStyle) {
                     RenderStyle* childStyle = context.elementStyle ? context.elementStyle : element->renderStyle();
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
-                    if (parentStyle) {
-                        parentStyle->setChildrenAffectedByFirstChildRules();
-                        parentStyle->setChildrenAffectedByLastChildRules();
-                    }
+                    parentElement->setChildrenAffectedByFirstChildRules();
+                    parentElement->setChildrenAffectedByLastChildRules();
                     if (firstChild && childStyle)
                         childStyle->setFirstChildState();
                     if (onlyChild && childStyle)
@@ -899,11 +885,8 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             // FIXME: This selector is very slow.
             if (Element* parentElement = element->parentElement()) {
                 if (m_mode == ResolvingStyle) {
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
-                    if (parentStyle) {
-                        parentStyle->setChildrenAffectedByForwardPositionalRules();
-                        parentStyle->setChildrenAffectedByBackwardPositionalRules();
-                    }
+                    parentElement->setChildrenAffectedByForwardPositionalRules();
+                    parentElement->setChildrenAffectedByBackwardPositionalRules();
                 }
                 if (!parentElement->isFinishedParsingChildren())
                     return false;
@@ -917,11 +900,10 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
                 int count = 1 + siblingTraversalStrategy.countElementsBefore(element);
                 if (m_mode == ResolvingStyle) {
                     RenderStyle* childStyle = context.elementStyle ? context.elementStyle : element->renderStyle();
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
+                    element->setChildIndex(count);
                     if (childStyle)
-                        childStyle->setChildIndex(count);
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByForwardPositionalRules();
+                        childStyle->setUnique();
+                    parentElement->setChildrenAffectedByForwardPositionalRules();
                 }
 
                 if (selector->matchNth(count))
@@ -933,11 +915,8 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
                 break;
             if (Element* parentElement = element->parentElement()) {
                 int count = 1 + siblingTraversalStrategy.countElementsOfTypeBefore(element, element->tagQName());
-                if (m_mode == ResolvingStyle) {
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByForwardPositionalRules();
-                }
+                if (m_mode == ResolvingStyle)
+                    parentElement->setChildrenAffectedByForwardPositionalRules();
 
                 if (selector->matchNth(count))
                     return true;
@@ -947,11 +926,8 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             if (!selector->parseNth())
                 break;
             if (Element* parentElement = element->parentElement()) {
-                if (m_mode == ResolvingStyle) {
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByBackwardPositionalRules();
-                }
+                if (m_mode == ResolvingStyle)
+                    parentElement->setChildrenAffectedByBackwardPositionalRules();
                 if (!parentElement->isFinishedParsingChildren())
                     return false;
                 int count = 1 + siblingTraversalStrategy.countElementsAfter(element);
@@ -963,11 +939,8 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             if (!selector->parseNth())
                 break;
             if (Element* parentElement = element->parentElement()) {
-                if (m_mode == ResolvingStyle) {
-                    RenderStyle* parentStyle = context.elementStyle ? context.elementParentStyle : parentElement->renderStyle();
-                    if (parentStyle)
-                        parentStyle->setChildrenAffectedByBackwardPositionalRules();
-                }
+                if (m_mode == ResolvingStyle)
+                    parentElement->setChildrenAffectedByBackwardPositionalRules();
                 if (!parentElement->isFinishedParsingChildren())
                     return false;
 
@@ -1005,10 +978,12 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             // ...except if :visited matching is disabled for ancestor/sibling matching.
             return element->isLink() && context.visitedMatchType == VisitedMatchEnabled;
         case CSSSelector::PseudoDrag:
-            if (context.elementStyle)
-                context.elementStyle->setAffectedByDragRules(true);
-            else if (element->renderStyle())
-                element->renderStyle()->setAffectedByDragRules(true);
+            if (m_mode == ResolvingStyle) {
+                if (context.elementStyle)
+                    context.elementStyle->setAffectedByDrag();
+                else
+                    element->setChildrenAffectedByDrag(true);
+            }
             if (element->renderer() && element->renderer()->isDragging())
                 return true;
             break;
@@ -1018,10 +993,12 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             // If we're in quirks mode, then hover should never match anchors with no
             // href and *:hover should not match anything. This is important for sites like wsj.com.
             if (m_strictParsing || context.isSubSelector || (selector->hasTag() && !element->hasTagName(aTag)) || element->isLink()) {
-                if (context.elementStyle)
-                    context.elementStyle->setAffectedByHoverRules(true);
-                else if (element->renderStyle())
-                    element->renderStyle()->setAffectedByHoverRules(true);
+                if (m_mode == ResolvingStyle) {
+                    if (context.elementStyle)
+                        context.elementStyle->setAffectedByHover();
+                    else
+                        element->setChildrenAffectedByHover(true);
+                }
                 if (element->hovered() || InspectorInstrumentation::forcePseudoState(element, CSSSelector::PseudoHover))
                     return true;
             }
@@ -1030,10 +1007,12 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             // If we're in quirks mode, then :active should never match anchors with no
             // href and *:active should not match anything.
             if (m_strictParsing || context.isSubSelector || (selector->hasTag() && !element->hasTagName(aTag)) || element->isLink()) {
-                if (context.elementStyle)
-                    context.elementStyle->setAffectedByActiveRules(true);
-                else if (element->renderStyle())
-                    element->renderStyle()->setAffectedByActiveRules(true);
+                if (m_mode == ResolvingStyle) {
+                    if (context.elementStyle)
+                        context.elementStyle->setAffectedByActive();
+                    else
+                        element->setChildrenAffectedByActive(true);
+                }
                 if (element->active() || InspectorInstrumentation::forcePseudoState(element, CSSSelector::PseudoActive))
                     return true;
             }
@@ -1052,13 +1031,9 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
                 return !element->isEnabledFormControl();
             break;
         case CSSSelector::PseudoReadOnly:
-            if (!element || !element->isFormControlElement())
-                return false;
-            return element->isTextFormControl() && element->shouldMatchReadOnlySelector();
+            return element && element->shouldMatchReadOnlySelector();
         case CSSSelector::PseudoReadWrite:
-            if (!element || !element->isFormControlElement())
-                return false;
-            return element->isTextFormControl() && element->shouldMatchReadWriteSelector();
+            return element && element->shouldMatchReadWriteSelector();
         case CSSSelector::PseudoOptional:
             return element && element->isOptionalFormControl();
         case CSSSelector::PseudoRequired:
@@ -1072,7 +1047,7 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, c
             if (!element)
                 return false;
             element->document()->setContainsValidityStyleRules();
-            return (element->willValidate() && !element->isValidFormControlElement()) || element->hasUnacceptableValue();
+            return element->willValidate() && !element->isValidFormControlElement();
         case CSSSelector::PseudoChecked:
             {
                 if (!element)
diff --git a/Source/WebCore/css/SiblingTraversalStrategies.h b/Source/WebCore/css/SiblingTraversalStrategies.h
index e583e6c13..bebfef8e5 100644
--- a/Source/WebCore/css/SiblingTraversalStrategies.h
+++ b/Source/WebCore/css/SiblingTraversalStrategies.h
@@ -80,8 +80,7 @@ inline int DOMSiblingTraversalStrategy::countElementsBefore(Element* element) co
 {
     int count = 0;
     for (const Element* sibling = element->previousElementSibling(); sibling; sibling = sibling->previousElementSibling()) {
-        RenderStyle* s = sibling->renderStyle();
-        unsigned index = s ? s->childIndex() : 0;
+        unsigned index = sibling->childIndex();
         if (index) {
             count += index;
             break;
diff --git a/Source/WebCore/css/StyleBuilder.cpp b/Source/WebCore/css/StyleBuilder.cpp
index 968b96f84..ea4766f5b 100644
--- a/Source/WebCore/css/StyleBuilder.cpp
+++ b/Source/WebCore/css/StyleBuilder.cpp
@@ -2021,7 +2021,6 @@ StyleBuilder::StyleBuilder()
     setPropertyHandler(CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBeforeCollapse);
     setPropertyHandler(CSSPropertyWebkitMarqueeDirection, ApplyPropertyDefault<EMarqueeDirection, &RenderStyle::marqueeDirection, EMarqueeDirection, &RenderStyle::setMarqueeDirection, EMarqueeDirection, &RenderStyle::initialMarqueeDirection>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMarqueeStyle, ApplyPropertyDefault<EMarqueeBehavior, &RenderStyle::marqueeBehavior, EMarqueeBehavior, &RenderStyle::setMarqueeBehavior, EMarqueeBehavior, &RenderStyle::initialMarqueeBehavior>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyWebkitMaskAttachment, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSToStyleMap::mapFillAttachment>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMaskBoxImage, ApplyPropertyBorderImage<BorderMask, CSSPropertyWebkitMaskBoxImage, &RenderStyle::maskBoxImage, &RenderStyle::setMaskBoxImage>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMaskBoxImageOutset, ApplyPropertyBorderImageModifier<BorderMask, Outset>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMaskBoxImageRepeat, ApplyPropertyBorderImageModifier<BorderMask, Repeat>::createHandler());
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index c3f6dc80d..f662ccacf 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -60,6 +60,13 @@ static size_t sizeForImmutableStylePropertySetWithPropertyCount(unsigned count)
     return sizeof(ImmutableStylePropertySet) - sizeof(void*) + sizeof(CSSValue*) * count + sizeof(StylePropertyMetadata) * count;
 }
 
+static bool isInitialOrInherit(const String& value)
+{
+    DEFINE_STATIC_LOCAL(String, initial, ("initial"));
+    DEFINE_STATIC_LOCAL(String, inherit, ("inherit"));
+    return value.length() == 7 && (value == initial || value == inherit);
+}
+
 PassRefPtr<StylePropertySet> StylePropertySet::createImmutable(const CSSProperty* properties, unsigned count, CSSParserMode cssParserMode)
 {
     void* slot = WTF::fastMalloc(sizeForImmutableStylePropertySetWithPropertyCount(count));
@@ -218,14 +225,16 @@ String StylePropertySet::borderSpacingValue(const StylePropertyShorthand& shorth
     return horizontalValueCSSText + ' ' + verticalValueCSSText;
 }
 
-bool StylePropertySet::appendFontLonghandValueIfExplicit(CSSPropertyID propertyID, StringBuilder& result) const
+bool StylePropertySet::appendFontLonghandValueIfExplicit(CSSPropertyID propertyID, StringBuilder& result, String& commonValue) const
 {
     int foundPropertyIndex = findPropertyIndex(propertyID);
     if (foundPropertyIndex == -1)
         return false; // All longhands must have at least implicit values if "font" is specified.
 
-    if (propertyAt(foundPropertyIndex).isImplicit())
+    if (propertyAt(foundPropertyIndex).isImplicit()) {
+        commonValue = String();
         return true;
+    }
 
     char prefix = '\0';
     switch (propertyID) {
@@ -245,7 +254,10 @@ bool StylePropertySet::appendFontLonghandValueIfExplicit(CSSPropertyID propertyI
 
     if (prefix && !result.isEmpty())
         result.append(prefix);
-    result.append(propertyAt(foundPropertyIndex).value()->cssText());
+    String value = propertyAt(foundPropertyIndex).value()->cssText();
+    result.append(value);
+    if (!commonValue.isNull() && commonValue != value)
+        commonValue = String();
 
     return true;
 }
@@ -260,22 +272,25 @@ String StylePropertySet::fontValue() const
     if (fontSizeProperty.isImplicit())
         return emptyString();
 
+    String commonValue = fontSizeProperty.value()->cssText();
     StringBuilder result;
     bool success = true;
-    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontStyle, result);
-    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontVariant, result);
-    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontWeight, result);
+    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontStyle, result, commonValue);
+    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontVariant, result, commonValue);
+    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontWeight, result, commonValue);
     if (!result.isEmpty())
         result.append(' ');
     result.append(fontSizeProperty.value()->cssText());
-    success &= appendFontLonghandValueIfExplicit(CSSPropertyLineHeight, result);
-    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontFamily, result);
+    success &= appendFontLonghandValueIfExplicit(CSSPropertyLineHeight, result, commonValue);
+    success &= appendFontLonghandValueIfExplicit(CSSPropertyFontFamily, result, commonValue);
     if (!success) {
         // An invalid "font" value has been built (should never happen, as at least implicit values
         // for mandatory longhands are always found in the style), report empty value instead.
         ASSERT_NOT_REACHED();
         return emptyString();
     }
+    if (isInitialOrInherit(commonValue))
+        return commonValue;
     return result.toString();
 }
 
@@ -298,8 +313,17 @@ String StylePropertySet::get4Values(const StylePropertyShorthand& shorthand) con
     // All 4 properties must be specified.
     if (!top.value() || !right.value() || !bottom.value() || !left.value())
         return String();
-    if (top.value()->isInitialValue() || right.value()->isInitialValue() || bottom.value()->isInitialValue() || left.value()->isInitialValue())
+
+    if (top.isInherited() && right.isInherited() && bottom.isInherited() && left.isInherited())
+        return getValueName(CSSValueInherit);
+
+    if (top.value()->isInitialValue() || right.value()->isInitialValue() || bottom.value()->isInitialValue() || left.value()->isInitialValue()) {
+        if (top.value()->isInitialValue() && right.value()->isInitialValue() && bottom.value()->isInitialValue() && left.value()->isInitialValue() && !top.isImplicit()) {
+            // All components are "initial" and "top" is not implicit.
+            return getValueName(CSSValueInitial);
+        }
         return String();
+    }
     if (top.isImportant() != right.isImportant() || right.isImportant() != bottom.isImportant() || bottom.isImportant() != left.isImportant())
         return String();
 
@@ -344,6 +368,9 @@ String StylePropertySet::getLayeredShorthandValue(const StylePropertyShorthand&
         }
     }
 
+    String commonValue;
+    bool commonValueInitialized = false;
+
     // Now stitch the properties together.  Implicit initial values are flagged as such and
     // can safely be omitted.
     for (size_t i = 0; i < numLayers; i++) {
@@ -351,7 +378,7 @@ String StylePropertySet::getLayeredShorthandValue(const StylePropertyShorthand&
         bool useRepeatXShorthand = false;
         bool useRepeatYShorthand = false;
         bool useSingleWordShorthand = false;
-        bool foundBackgroundPositionYCSSProperty = false;
+        bool foundPositionYCSSProperty = false;
         for (unsigned j = 0; j < size; j++) {
             RefPtr<CSSValue> value;
             if (values[j]) {
@@ -372,10 +399,12 @@ String StylePropertySet::getLayeredShorthandValue(const StylePropertyShorthand&
             // We need to report background-repeat as it was written in the CSS. If the property is implicit,
             // then it was written with only one value. Here we figure out which value that was so we can
             // report back correctly.
-            if (shorthand.properties()[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(shorthand.properties()[j])) {
+            if ((shorthand.properties()[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(shorthand.properties()[j]))
+                || (shorthand.properties()[j] == CSSPropertyWebkitMaskRepeatX && isPropertyImplicit(shorthand.properties()[j]))) {
 
                 // BUG 49055: make sure the value was not reset in the layer check just above.
-                if (j < size - 1 && shorthand.properties()[j + 1] == CSSPropertyBackgroundRepeatY && value) {
+                if ((j < size - 1 && shorthand.properties()[j + 1] == CSSPropertyBackgroundRepeatY && value)
+                    || (j < size - 1 && shorthand.properties()[j + 1] == CSSPropertyWebkitMaskRepeatY && value)) {
                     RefPtr<CSSValue> yValue;
                     RefPtr<CSSValue> nextValue = values[j + 1];
                     if (nextValue->isValueList())
@@ -400,12 +429,15 @@ String StylePropertySet::getLayeredShorthandValue(const StylePropertyShorthand&
                 }
             }
 
+            String valueText;
             if (value && !value->isImplicitInitialValue()) {
                 if (!layerResult.isEmpty())
                     layerResult.append(' ');
-                if (foundBackgroundPositionYCSSProperty && shorthand.properties()[j] == CSSPropertyBackgroundSize) 
+                if (foundPositionYCSSProperty
+                    && (shorthand.properties()[j] == CSSPropertyBackgroundSize || shorthand.properties()[j] == CSSPropertyWebkitMaskSize))
                     layerResult.appendLiteral("/ ");
-                if (!foundBackgroundPositionYCSSProperty && shorthand.properties()[j] == CSSPropertyBackgroundSize) 
+                if (!foundPositionYCSSProperty
+                    && (shorthand.properties()[j] == CSSPropertyBackgroundSize || shorthand.properties()[j] == CSSPropertyWebkitMaskSize))
                     continue;
 
                 if (useRepeatXShorthand) {
@@ -414,15 +446,29 @@ String StylePropertySet::getLayeredShorthandValue(const StylePropertyShorthand&
                 } else if (useRepeatYShorthand) {
                     useRepeatYShorthand = false;
                     layerResult.append(getValueName(CSSValueRepeatY));
-                } else if (useSingleWordShorthand) {
-                    useSingleWordShorthand = false;
-                    layerResult.append(value->cssText());
-                } else
-                    layerResult.append(value->cssText());
-
-                if (shorthand.properties()[j] == CSSPropertyBackgroundPositionY)
-                    foundBackgroundPositionYCSSProperty = true;
+                } else {
+                    if (useSingleWordShorthand)
+                        useSingleWordShorthand = false;
+                    valueText = value->cssText();
+                    layerResult.append(valueText);
+                }
+
+                if (shorthand.properties()[j] == CSSPropertyBackgroundPositionY
+                    || shorthand.properties()[j] == CSSPropertyWebkitMaskPositionY) {
+                    foundPositionYCSSProperty = true;
+
+                    // background-position is a special case: if only the first offset is specified,
+                    // the second one defaults to "center", not the same value.
+                    if (commonValueInitialized && commonValue != "initial" && commonValue != "inherit")
+                        commonValue = String();
+                }
             }
+
+            if (!commonValueInitialized) {
+                commonValue = valueText;
+                commonValueInitialized = true;
+            } else if (!commonValue.isNull() && commonValue != valueText)
+                commonValue = String();
         }
 
         if (!layerResult.isEmpty()) {
@@ -431,6 +477,10 @@ String StylePropertySet::getLayeredShorthandValue(const StylePropertyShorthand&
             result.append(layerResult);
         }
     }
+
+    if (isInitialOrInherit(commonValue))
+        return commonValue;
+
     if (result.isEmpty())
         return String();
     return result.toString();
@@ -438,19 +488,28 @@ String StylePropertySet::getLayeredShorthandValue(const StylePropertyShorthand&
 
 String StylePropertySet::getShorthandValue(const StylePropertyShorthand& shorthand) const
 {
+    String commonValue;
     StringBuilder result;
     for (unsigned i = 0; i < shorthand.length(); ++i) {
         if (!isPropertyImplicit(shorthand.properties()[i])) {
             RefPtr<CSSValue> value = getPropertyCSSValue(shorthand.properties()[i]);
             if (!value)
                 return String();
+            String valueText = value->cssText();
+            if (!i)
+                commonValue = valueText;
+            else if (!commonValue.isNull() && commonValue != valueText)
+                commonValue = String();
             if (value->isInitialValue())
                 continue;
             if (!result.isEmpty())
                 result.append(' ');
-            result.append(value->cssText());
-        }
+            result.append(valueText);
+        } else
+            commonValue = String();
     }
+    if (isInitialOrInherit(commonValue))
+        return commonValue;
     if (result.isEmpty())
         return String();
     return result.toString();
@@ -485,6 +544,7 @@ String StylePropertySet::getCommonValue(const StylePropertyShorthand& shorthand)
 String StylePropertySet::borderPropertyValue(CommonValueMode valueMode) const
 {
     const StylePropertyShorthand properties[3] = { borderWidthShorthand(), borderStyleShorthand(), borderColorShorthand() };
+    String commonValue;
     StringBuilder result;
     for (size_t i = 0; i < WTF_ARRAY_LENGTH(properties); ++i) {
         String value = getCommonValue(properties[i]);
@@ -494,12 +554,18 @@ String StylePropertySet::borderPropertyValue(CommonValueMode valueMode) const
             ASSERT(valueMode == OmitUncommonValues);
             continue;
         }
+        if (!i)
+            commonValue = value;
+        else if (!commonValue.isNull() && commonValue != value)
+            commonValue = String();
         if (value == "initial")
             continue;
         if (!result.isEmpty())
             result.append(' ');
         result.append(value);
     }
+    if (isInitialOrInherit(commonValue))
+        return commonValue;
     return result.isEmpty() ? String() : result.toString();
 }
 
@@ -796,7 +862,6 @@ String StylePropertySet::asText() const
         case CSSPropertyWebkitMaskRepeatY:
         case CSSPropertyWebkitMaskImage:
         case CSSPropertyWebkitMaskRepeat:
-        case CSSPropertyWebkitMaskAttachment:
         case CSSPropertyWebkitMaskPosition:
         case CSSPropertyWebkitMaskClip:
         case CSSPropertyWebkitMaskOrigin:
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index cbe7f1897..456f7ef2e 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -197,7 +197,7 @@ private:
     String get4Values(const StylePropertyShorthand&) const;
     String borderSpacingValue(const StylePropertyShorthand&) const;
     String fontValue() const;
-    bool appendFontLonghandValueIfExplicit(CSSPropertyID, StringBuilder& result) const;
+    bool appendFontLonghandValueIfExplicit(CSSPropertyID, StringBuilder& result, String& value) const;
 
     bool removeShorthandProperty(CSSPropertyID);
     bool propertyMatches(const PropertyReference&) const;
diff --git a/Source/WebCore/css/StylePropertyShorthand.cpp b/Source/WebCore/css/StylePropertyShorthand.cpp
index 38a91e3ba..b518e987c 100644
--- a/Source/WebCore/css/StylePropertyShorthand.cpp
+++ b/Source/WebCore/css/StylePropertyShorthand.cpp
@@ -370,11 +370,11 @@ const StylePropertyShorthand& webkitMaskShorthand()
 {
     static const CSSPropertyID maskProperties[] = {
         CSSPropertyWebkitMaskImage,
-        CSSPropertyWebkitMaskRepeatX,
-        CSSPropertyWebkitMaskRepeatY,
-        CSSPropertyWebkitMaskAttachment,
         CSSPropertyWebkitMaskPositionX,
         CSSPropertyWebkitMaskPositionY,
+        CSSPropertyWebkitMaskSize,
+        CSSPropertyWebkitMaskRepeatX,
+        CSSPropertyWebkitMaskRepeatY,
         CSSPropertyWebkitMaskOrigin,
         CSSPropertyWebkitMaskClip
     };
diff --git a/Source/WebCore/css/StyleResolver.cpp b/Source/WebCore/css/StyleResolver.cpp
index 30dbc56b6..c6d033241 100644
--- a/Source/WebCore/css/StyleResolver.cpp
+++ b/Source/WebCore/css/StyleResolver.cpp
@@ -716,7 +716,7 @@ void StyleResolver::sortAndTransferMatchedRules(MatchResult& result)
     bool swapVisitedUnvisited = InspectorInstrumentation::forcePseudoState(m_element, CSSSelector::PseudoVisited);
     for (unsigned i = 0; i < m_matchedRules.size(); i++) {
         if (m_style && m_matchedRules[i]->containsUncommonAttributeSelector())
-            m_style->setAffectedByUncommonAttributeSelectors();
+            m_style->setUnique();
         unsigned linkMatchType = m_matchedRules[i]->linkMatchType();
         if (swapVisitedUnvisited && linkMatchType && linkMatchType != SelectorChecker::MatchAll)
             linkMatchType = (linkMatchType == SelectorChecker::MatchVisited) ? SelectorChecker::MatchLink : SelectorChecker::MatchVisited;
@@ -1176,8 +1176,6 @@ bool StyleResolver::canShareStyleWithElement(StyledElement* element) const
 #endif
     if (element->isLink() != m_element->isLink())
         return false;
-    if (style->affectedByUncommonAttributeSelectors())
-        return false;
     if (element->hovered() != m_element->hovered())
         return false;
     if (element->active() != m_element->active())
@@ -1249,12 +1247,14 @@ inline StyledElement* StyleResolver::findSiblingForStyleSharing(Node* node, unsi
     return static_cast<StyledElement*>(node);
 }
 
-static inline bool parentStylePreventsSharing(const RenderStyle* parentStyle)
+static inline bool parentElementPreventsSharing(const Element* parentElement)
 {
-    return parentStyle->childrenAffectedByPositionalRules()
-        || parentStyle->childrenAffectedByFirstChildRules()
-        || parentStyle->childrenAffectedByLastChildRules() 
-        || parentStyle->childrenAffectedByDirectAdjacentRules();
+    if (!parentElement)
+        return false;
+    return parentElement->childrenAffectedByPositionalRules()
+        || parentElement->childrenAffectedByFirstChildRules()
+        || parentElement->childrenAffectedByLastChildRules()
+        || parentElement->childrenAffectedByDirectAdjacentRules();
 }
 
 RenderStyle* StyleResolver::locateSharedStyle()
@@ -1271,7 +1271,7 @@ RenderStyle* StyleResolver::locateSharedStyle()
     // Ids stop style sharing if they show up in the stylesheets.
     if (m_styledElement->hasID() && m_features.idsInRules.contains(m_styledElement->idForStyleResolution().impl()))
         return 0;
-    if (parentStylePreventsSharing(m_parentStyle))
+    if (parentElementPreventsSharing(m_element->parentElement()))
         return 0;
     if (m_styledElement->hasScopedHTMLStyleChild())
         return 0;
@@ -1306,7 +1306,7 @@ RenderStyle* StyleResolver::locateSharedStyle()
     if (styleSharingCandidateMatchesHostRules())
         return 0;
     // Tracking child index requires unique style for each node. This may get set by the sibling rule match above.
-    if (parentStylePreventsSharing(m_parentStyle))
+    if (parentElementPreventsSharing(m_element->parentElement()))
         return 0;
     return shareElement->renderStyle();
 }
@@ -1398,7 +1398,7 @@ PassRefPtr<RenderStyle> StyleResolver::styleForDocument(Document* document, CSSF
         documentStyle->setPageScaleTransform(frame ? frame->frameScaleFactor() : 1);
         documentStyle->setLocale(document->contentLanguage());
     }
-    // FIXME: This overrides any -webkit-user-modify inherited from the parent iframe.
+    // This overrides any -webkit-user-modify inherited from the parent iframe.
     documentStyle->setUserModify(document->inDesignMode() ? READ_WRITE : READ_ONLY);
 
     Element* docElement = document->documentElement();
@@ -3190,7 +3190,7 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
             m_style->resetColumnRule();
         return;
     case CSSPropertyWebkitMarquee:
-        if (!m_parentNode || !value->isInheritedValue())
+        if (!isInherit)
             return;
         m_style->setMarqueeDirection(m_parentStyle->marqueeDirection());
         m_style->setMarqueeIncrement(m_parentStyle->marqueeIncrement());
@@ -3776,7 +3776,6 @@ void StyleResolver::applyProperty(CSSPropertyID id, CSSValue* value)
     case CSSPropertyWebkitLineSnap:
     case CSSPropertyWebkitMarqueeDirection:
     case CSSPropertyWebkitMarqueeStyle:
-    case CSSPropertyWebkitMaskAttachment:
     case CSSPropertyWebkitMaskBoxImage:
     case CSSPropertyWebkitMaskBoxImageOutset:
     case CSSPropertyWebkitMaskBoxImageRepeat:
@@ -3958,7 +3957,7 @@ void StyleResolver::checkForGenericFamilyChange(RenderStyle* style, RenderStyle*
         size = fontSizeForKeyword(m_checker.document(), CSSValueXxSmall + childFont.keywordSize() - 1, childFont.useFixedDefaultSize());
     else {
         Settings* settings = documentSettings();
-        float fixedScaleFactor = settings
+        float fixedScaleFactor = (settings && settings->defaultFixedFontSize() && settings->defaultFontSize())
             ? static_cast<float>(settings->defaultFixedFontSize()) / settings->defaultFontSize()
             : 1;
         size = parentFont.useFixedDefaultSize() ?
diff --git a/Source/WebCore/css/WebKitCSSMixFunctionValue.idl b/Source/WebCore/css/WebKitCSSMixFunctionValue.idl
new file mode 100644
index 000000000..6026816a3
--- /dev/null
+++ b/Source/WebCore/css/WebKitCSSMixFunctionValue.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+[
+    Conditional=CSS_SHADERS,
+] interface WebKitCSSMixFunctionValue : CSSValueList {
+};
+
diff --git a/Source/WebCore/css/mediaControlsChromium.css b/Source/WebCore/css/mediaControlsChromium.css
index 4eef10909..fa45b6fb1 100644
--- a/Source/WebCore/css/mediaControlsChromium.css
+++ b/Source/WebCore/css/mediaControlsChromium.css
@@ -168,6 +168,11 @@ input[type="range"]::-webkit-media-slider-container {
     background-color: transparent; /* Background drawing is managed by C++ code to draw ranges. */
 }
 
+/* The negative right margin causes the track to overflow its container. */
+input[type="range"]::-webkit-media-slider-container > div {
+    margin-right: -14px;
+}
+
 input[type="range"]::-webkit-media-slider-thumb {
     margin-left: -7px;
     margin-right: -7px;
diff --git a/Source/WebCore/css/mediaControlsChromiumAndroid.css b/Source/WebCore/css/mediaControlsChromiumAndroid.css
index 8fcdca23b..f3aced951 100644
--- a/Source/WebCore/css/mediaControlsChromiumAndroid.css
+++ b/Source/WebCore/css/mediaControlsChromiumAndroid.css
@@ -185,6 +185,11 @@ input[type="range"]::-webkit-media-slider-container {
     background-color: transparent;
 }
 
+/* The negative right margin causes the track to overflow its container. */
+input[type="range"]::-webkit-media-slider-container > div {
+    margin-right: -14px;
+}
+
 input[type="range"]::-webkit-media-slider-thumb {
     margin-left: -7px;
     margin-right: -7px;