Imported WebKit commit 0fbd41c4e13f5a190faf160bf993eee614e6e18e (http://svn.webkit.org/repository/webkit/trunk@123477)

New snapshot that adapts to latest Qt API changes

59 files changed, 752 insertions, 437 deletions

diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index 1a766370d..d0ac82d31 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -56,7 +56,8 @@ enum CalcExpressionNodeType {
     CalcExpressionNodeUndefined,
     CalcExpressionNodeNumber,
     CalcExpressionNodeLength,
-    CalcExpressionNodeBinaryOperation
+    CalcExpressionNodeBinaryOperation,
+    CalcExpressionNodeBlendLength,
 };
         
 class CalcExpressionNode {
@@ -183,6 +184,37 @@ private:
     CalcOperator m_operator;
 };
 
+class CalcExpressionBlendLength : public CalcExpressionNode {
+public:
+    CalcExpressionBlendLength(Length from, Length to, float progress)
+        : m_from(from)
+        , m_to(to)
+        , m_progress(progress)
+    {
+        m_type = CalcExpressionNodeBlendLength;
+    }
+    
+    bool operator==(const CalcExpressionBlendLength& o) const
+    {
+        return m_progress == o.m_progress && m_from == o.m_from && m_to == o.m_to;
+    }
+    
+    virtual bool operator==(const CalcExpressionNode& o) const
+    {
+        return type() == o.type() && *this == static_cast<const CalcExpressionBlendLength&>(o);
+    }
+    
+    virtual float evaluate(float maxValue) const
+    {
+        return (1.0f - m_progress) * floatValueForLength(m_from, maxValue) + m_progress * floatValueForLength(m_to, maxValue);
+    }
+    
+private:  
+    Length m_from;
+    Length m_to;
+    float m_progress;
+};
+    
 } // namespace WebCore
 
 #endif // CalculationValue_h
diff --git a/Source/WebCore/platform/LayoutTestSupport.cpp b/Source/WebCore/platform/LayoutTestSupport.cpp
new file mode 100644
index 000000000..0c77f8702
--- /dev/null
+++ b/Source/WebCore/platform/LayoutTestSupport.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LayoutTestSupport.h"
+
+namespace WebCore {
+
+static bool s_isRunningLayoutTest = false;
+
+bool isRunningLayoutTest()
+{
+    return s_isRunningLayoutTest;
+}
+
+void setIsRunningLayoutTest(bool value)
+{
+    s_isRunningLayoutTest = value;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/LayoutTestSupport.h b/Source/WebCore/platform/LayoutTestSupport.h
new file mode 100644
index 000000000..48aa2191a
--- /dev/null
+++ b/Source/WebCore/platform/LayoutTestSupport.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LayoutTestSupport_h
+#define LayoutTestSupport_h
+
+namespace WebCore {
+
+bool isRunningLayoutTest();
+void setIsRunningLayoutTest(bool);
+
+} // namespace WebCore
+
+#endif // LayoutTestSupport_h
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index 9d93cc69f..110dbcd96 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -210,17 +210,7 @@ Length Length::blendCalculation(const Length& from, double progress) const
     if (progress >= 1.0)
         return *this;
         
-    // FIXME: https://webkit.org/b/90037 - some of these allocations can be eliminated
-    OwnPtr<CalcExpressionNode> startScale = adoptPtr(new CalcExpressionNumber(1.0 - progress));
-    OwnPtr<CalcExpressionNode> startLength = adoptPtr(new CalcExpressionLength(from));
-    OwnPtr<CalcExpressionNode> startNode = adoptPtr(new CalcExpressionBinaryOperation(startScale.release(), startLength.release(), CalcMultiply));
-    
-    OwnPtr<CalcExpressionNode> endScale = adoptPtr(new CalcExpressionNumber(progress));
-    OwnPtr<CalcExpressionNode> endLength = adoptPtr(new CalcExpressionLength(*this));
-    OwnPtr<CalcExpressionNode> endNode = adoptPtr(new CalcExpressionBinaryOperation(endScale.release(), endLength.release(), CalcMultiply));
-    
-    OwnPtr<CalcExpressionNode> blend = adoptPtr(new CalcExpressionBinaryOperation(startNode.release(), endNode.release(), CalcAdd));
-        
+    OwnPtr<CalcExpressionNode> blend = adoptPtr(new CalcExpressionBlendLength(from, *this, progress));
     return Length(CalculationValue::create(blend.release(), CalculationRangeAll));
 }
           
diff --git a/Source/WebCore/platform/ScrollbarTheme.h b/Source/WebCore/platform/ScrollbarTheme.h
index 5fe45b1a4..cccc2f925 100644
--- a/Source/WebCore/platform/ScrollbarTheme.h
+++ b/Source/WebCore/platform/ScrollbarTheme.h
@@ -86,6 +86,7 @@ public:
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { defaultPaintScrollCorner(context, cornerRect); }
     static void defaultPaintScrollCorner(GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB); }
 
+    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect&, const IntRect&, const IntRect&) { }
 
 #if USE(ACCELERATED_COMPOSITING) && ENABLE(RUBBER_BANDING)
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.h b/Source/WebCore/platform/ScrollbarThemeComposite.h
index 696db12b1..dfd15ed18 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.h
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.h
@@ -60,7 +60,6 @@ public:
     virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
     virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
     virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
-    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
 
     virtual IntRect constrainTrackRectToTrackPieces(ScrollbarThemeClient*, const IntRect& rect) { return rect; }
 };
diff --git a/Source/WebCore/platform/chromium/PlatformSupport.h b/Source/WebCore/platform/chromium/PlatformSupport.h
index c113f8ffd..0c43b9353 100644
--- a/Source/WebCore/platform/chromium/PlatformSupport.h
+++ b/Source/WebCore/platform/chromium/PlatformSupport.h
@@ -128,9 +128,6 @@ public:
     static void notifyJSOutOfMemory(Frame*);
     static bool allowScriptDespiteSettings(const KURL& documentURL);
 
-    // LayoutTestMode -----------------------------------------------------
-    static bool layoutTestMode();
-
     // Plugin -------------------------------------------------------------
     static bool plugins(bool refresh, Vector<PluginInfo>*);
     static NPObject* pluginScriptableObject(Widget*);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index 682d82d5b..4a4938ac8 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -113,14 +113,8 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, ScrollbarT
     if (!tickmarks.size())
         return;
 
-    // Get the image for the tickmarks.
-    DEFINE_STATIC_LOCAL(RefPtr<Image>, dash, (Image::loadPlatformResource("tickmarkDash")));
-    if (dash->isNull()) {
-        ASSERT_NOT_REACHED();
-        return;
-    }
-
-    context->save();
+    GraphicsContextStateSaver stateSaver(*context);
+    context->setShouldAntialias(false);
 
     for (Vector<IntRect>::const_iterator i = tickmarks.begin(); i != tickmarks.end(); ++i) {
         // Calculate how far down (in %) the tick-mark should appear.
@@ -129,11 +123,14 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, ScrollbarT
         // Calculate how far down (in pixels) the tick-mark should appear.
         const int yPos = rect.y() + (rect.height() * percent);
 
-        IntPoint tick(scrollbar->x(), yPos);
-        context->drawImage(dash.get(), ColorSpaceDeviceRGB, tick);
-    }
+        context->setFillColor(Color(0xCC, 0xAA, 0x00, 0xFF), ColorSpaceDeviceRGB);
+        FloatRect tickRect(rect.x(), yPos, rect.width(), 3);
+        context->fillRect(tickRect);
 
-    context->restore();
+        context->setFillColor(Color(0xFF, 0xDD, 0x00, 0xFF), ColorSpaceDeviceRGB);
+        FloatRect tickStroke(rect.x(), yPos + 1, rect.width(), 1);
+        context->fillRect(tickStroke);
+    }
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
index e1e55a1fc..35ce97833 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
@@ -26,18 +26,21 @@
 #include "config.h"
 #include "ScrollbarThemeChromiumAndroid.h"
 
+#include "LayoutTestSupport.h"
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformSupport.h"
 #include "Scrollbar.h"
 #include "TransformationMatrix.h"
 
+#include <algorithm>
+
+using namespace std;
+
 namespace WebCore {
 
-// On Android, the threaded compositor is in charge of drawing the scrollbar,
-// so set the internal scrollbar thickness and button length to be zero.
-static const int scrollbarThicknessValue = 0;
-static const int buttonLength = 0;
+static const int scrollbarWidth = 8;
+static const int scrollbarMargin = 5;
 
 ScrollbarTheme* ScrollbarTheme::nativeTheme()
 {
@@ -47,40 +50,107 @@ ScrollbarTheme* ScrollbarTheme::nativeTheme()
 
 int ScrollbarThemeChromiumAndroid::scrollbarThickness(ScrollbarControlSize controlSize)
 {
-    if (PlatformSupport::layoutTestMode()) {
+    if (isRunningLayoutTest()) {
         // Match Chromium-Linux for DumpRenderTree, so the layout test results
         // can be shared. The width of scrollbar down arrow should equal the
         // width of the vertical scrollbar.
         IntSize scrollbarSize = PlatformSupport::getThemePartSize(PlatformSupport::PartScrollbarDownArrow);
         return scrollbarSize.width();
     }
-    return scrollbarThicknessValue;
+
+    return scrollbarWidth + scrollbarMargin;
 }
 
-void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
+int ScrollbarThemeChromiumAndroid::thumbPosition(ScrollbarThemeClient* scrollbar)
 {
-    // Paint black background in DumpRenderTree, otherwise the pixels in the scrollbar area depend
-    // on their previous state, which makes the dumped result undetermined.
-    if (PlatformSupport::layoutTestMode())
-        context->fillRect(scrollbar->frameRect(), Color::black, ColorSpaceDeviceRGB);
+    if (!scrollbar->totalSize())
+        return 0;
+
+    int trackLen = trackLength(scrollbar);
+    float proportion = static_cast<float>(scrollbar->currentPos()) / scrollbar->totalSize();
+    return round(proportion * trackLen);
+}
+
+int ScrollbarThemeChromiumAndroid::thumbLength(ScrollbarThemeClient* scrollbar)
+{
+    int trackLen = trackLength(scrollbar);
+
+    if (!scrollbar->totalSize())
+        return trackLen;
+
+    float proportion = (float)scrollbar->visibleSize() / scrollbar->totalSize();
+    int length = round(proportion * trackLen);
+    length = min(max(length, minimumThumbLength(scrollbar)), trackLen);
+    return length;
+}
+
+IntRect ScrollbarThemeChromiumAndroid::backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool)
+{
+    return IntRect();
+}
+
+IntRect ScrollbarThemeChromiumAndroid::forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool)
+{
+    return IntRect();
 }
 
-bool ScrollbarThemeChromiumAndroid::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
+IntRect ScrollbarThemeChromiumAndroid::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
-    return true;
+    IntRect rect = scrollbar->frameRect();
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        rect.inflateX(-scrollbarMargin);
+    else
+        rect.inflateY(-scrollbarMargin);
+    return rect;
 }
 
-IntSize ScrollbarThemeChromiumAndroid::buttonSize(ScrollbarThemeClient* scrollbar)
+static void fillSmoothEdgedRect(GraphicsContext* context, const IntRect& rect, const Color& color)
 {
-    if (scrollbar->orientation() == VerticalScrollbar)
-        return IntSize(scrollbarThicknessValue, buttonLength);
+    Color halfColor(color.red(), color.green(), color.blue(), color.alpha() / 2);
+
+    IntRect topRect = rect;
+    topRect.inflateX(-1);
+    topRect.setHeight(1);
+    context->fillRect(topRect, halfColor, ColorSpaceDeviceRGB);
+
+    IntRect leftRect = rect;
+    leftRect.inflateY(-1);
+    leftRect.setWidth(1);
+    context->fillRect(leftRect, halfColor, ColorSpaceDeviceRGB);
+
+    IntRect centerRect = rect;
+    centerRect.inflate(-1);
+    context->fillRect(centerRect, color, ColorSpaceDeviceRGB);
+
+    IntRect rightRect = rect;
+    rightRect.inflateY(-1);
+    rightRect.setX(centerRect.maxX());
+    rightRect.setWidth(1);
+    context->fillRect(rightRect, halfColor, ColorSpaceDeviceRGB);
 
-    return IntSize(buttonLength, scrollbarThicknessValue);
+    IntRect bottomRect = rect;
+    bottomRect.inflateX(-1);
+    bottomRect.setY(centerRect.maxY());
+    bottomRect.setHeight(1);
+    context->fillRect(bottomRect, halfColor, ColorSpaceDeviceRGB);
 }
 
-int ScrollbarThemeChromiumAndroid::minimumThumbLength(ScrollbarThemeClient* scrollbar)
+void ScrollbarThemeChromiumAndroid::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
-    return 2 * scrollbarThickness(scrollbar->controlSize());
+    IntRect thumbRect = rect;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        thumbRect.setHeight(thumbRect.height() - scrollbarMargin);
+    else
+        thumbRect.setWidth(thumbRect.width() - scrollbarMargin);
+    fillSmoothEdgedRect(context, thumbRect, Color(128, 128, 128, 128));
+}
+
+void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
+{
+    // Paint black background in DumpRenderTree, otherwise the pixels in the scrollbar area depend
+    // on their previous state, which makes the dumped result undetermined.
+    if (isRunningLayoutTest())
+        context->fillRect(scrollbar->frameRect(), Color::black, ColorSpaceDeviceRGB);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
index f3db80e52..3b40ab9fb 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
@@ -30,15 +30,23 @@
 
 namespace WebCore {
 
-class ScrollbarThemeChromiumAndroid : public ScrollbarThemeChromium {
+class ScrollbarThemeChromiumAndroid : public ScrollbarThemeComposite {
 public:
     virtual int scrollbarThickness(ScrollbarControlSize);
+    virtual bool usesOverlayScrollbars() const { return true; }
 
-protected:
+    virtual int thumbPosition(ScrollbarThemeClient*);
+    virtual int thumbLength(ScrollbarThemeClient*);
+
+    virtual bool hasButtons(ScrollbarThemeClient*) { return false; };
+    virtual bool hasThumb(ScrollbarThemeClient*) { return true; };
+
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
+
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
     virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
-    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
-    virtual IntSize buttonSize(ScrollbarThemeClient*);
-    virtual int minimumThumbLength(ScrollbarThemeClient*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
index 19346e723..efbdd0992 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
@@ -39,6 +39,7 @@ public:
     virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
+    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) OVERRIDE;
     
 private:
     void paintGivenTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, const Vector<IntRect>&);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
index 75e4a29c8..73d79b0bc 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -227,7 +227,7 @@ bool ScrollbarThemeChromiumMac::paint(ScrollbarThemeClient* scrollbar, GraphicsC
     }
     // The ends are rounded and the thumb doesn't go there.
     tickmarkTrackRect.inflateY(-tickmarkTrackRect.width());
-    // Inset by 2 on the left and 3 on the right.
+    // Inset a bit.
     tickmarkTrackRect.setX(tickmarkTrackRect.x() + 2);
     tickmarkTrackRect.setWidth(tickmarkTrackRect.width() - 5);
     paintGivenTickmarks(drawingContext, scrollbar, tickmarkTrackRect, tickmarks);
@@ -409,5 +409,25 @@ void ScrollbarThemeChromiumMac::paintOverhangAreas(ScrollView* view, GraphicsCon
     }
 }
 
+void ScrollbarThemeChromiumMac::paintTickmarks(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
+{
+    // Note: This is only used for css-styled scrollbars on mac.
+    if (scrollbar->orientation() != VerticalScrollbar)
+        return;
+
+    if (rect.height() <= 0 || rect.width() <= 0)
+        return;
+
+    Vector<IntRect> tickmarks;
+    scrollbar->getTickmarks(tickmarks);
+    if (!tickmarks.size())
+        return;
+
+    // Inset a bit.
+    IntRect tickmarkTrackRect = rect;
+    tickmarkTrackRect.setX(tickmarkTrackRect.x() + 1);
+    tickmarkTrackRect.setWidth(tickmarkTrackRect.width() - 2);
+    paintGivenTickmarks(context, scrollbar, tickmarkTrackRect, tickmarks);
+}
 
 }
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index a08198347..33251ed6d 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -31,6 +31,7 @@
 #include <vsstyle.h>
 
 #include "GraphicsContext.h"
+#include "LayoutTestSupport.h"
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformSupport.h"
@@ -61,7 +62,7 @@ int ScrollbarThemeChromiumWin::scrollbarThickness(ScrollbarControlSize controlSi
 {
     static int thickness;
     if (!thickness) {
-        if (PlatformSupport::layoutTestMode())
+        if (isRunningLayoutTest())
             return kMacScrollbarSize[controlSize];
         thickness = GetSystemMetrics(SM_CXVSCROLL);
     }
@@ -256,7 +257,7 @@ IntSize ScrollbarThemeChromiumWin::buttonSize(ScrollbarThemeClient* scrollbar)
     // test mode so that should be enough to result in repeatable results, but
     // preserving this hack avoids having to rebaseline pixel tests.
     const int kLayoutTestModeGirth = 17;
-    int girth = PlatformSupport::layoutTestMode() ? kLayoutTestModeGirth : thickness;
+    int girth = isRunningLayoutTest() ? kLayoutTestModeGirth : thickness;
 
     if (scrollbar->orientation() == HorizontalScrollbar) {
         int width = scrollbar->width() < 2 * girth ? scrollbar->width() / 2 : girth;
diff --git a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
index 75a7689e3..e7b1a22cf 100644
--- a/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
+++ b/Source/WebCore/platform/chromium/support/Extensions3DChromium.cpp
@@ -176,4 +176,9 @@ void Extensions3DChromium::copyTextureCHROMIUM(GC3Denum target, Platform3DObject
     m_private->webContext()->copyTextureCHROMIUM(target, sourceId, destId, level, internalFormat);
 }
 
+void Extensions3DChromium::shallowFlushCHROMIUM()
+{
+    return m_private->webContext()->shallowFlushCHROMIUM();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index e5784af03..b466cbf0f 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -1105,7 +1105,9 @@ String RenderThemeEfl::formatMediaControlsCurrentTime(float currentTime, float d
 
 bool RenderThemeEfl::paintMediaFullscreenButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    Node* mediaNode = object->node() ? object->node()->shadowAncestorNode() : 0;
+    Node* mediaNode = object->node() ? object->node()->shadowHost() : 0;
+    if (!mediaNode)
+        mediaNode = object->node();
     if (!mediaNode || (!mediaNode->hasTagName(videoTag)))
         return false;
 
@@ -1117,7 +1119,9 @@ bool RenderThemeEfl::paintMediaFullscreenButton(RenderObject* object, const Pain
 
 bool RenderThemeEfl::paintMediaMuteButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    Node* mediaNode = object->node() ? object->node()->shadowAncestorNode() : 0;
+    Node* mediaNode = object->node() ? object->node()->shadowHost() : 0;
+    if (!mediaNode)
+        mediaNode = object->node();
     if (!mediaNode || !mediaNode->isElementNode() || !static_cast<Element*>(mediaNode)->isMediaElement())
         return false;
 
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index d80660da4..b3b61babb 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -38,7 +38,9 @@
 #if PLATFORM(QT)
 #if HAVE(QRAWFONT)
 #include <QRawFont>
+QT_BEGIN_NAMESPACE
 class QTextLayout;
+QT_END_NAMESPACE
 #else
 #include <QFont>
 #endif
diff --git a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
index ef8232c5d..2fe641476 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsLayerAnimation.cpp
@@ -48,6 +48,15 @@ static double normalizedAnimationValue(double runningTime, double duration, Anim
     return shouldReverseAnimationValue(direction, loopCount) ? 1 - normalized : normalized;
 }
 
+static double normalizedAnimationValueForFillsForwards(double iterationCount, Animation::AnimationDirection direction)
+{
+    if (direction == Animation::AnimationDirectionNormal)
+        return 1;
+    if (direction == Animation::AnimationDirectionReverse)
+        return 0;
+    return shouldReverseAnimationValue(direction, iterationCount) ? 1 : 0;
+}
+
 static float applyOpacityAnimation(float fromOpacity, float toOpacity, double progress)
 {
     // Optimization: special case the edge values (0 and 1).
@@ -206,14 +215,17 @@ bool GraphicsLayerAnimations::hasRunningAnimations() const
 
 void GraphicsLayerAnimation::apply(Client* client)
 {
-    if (state() == StoppedState)
+    if (!isActive())
         return;
 
     double totalRunningTime = m_state == PausedState ? m_pauseTime : WTF::currentTime() - m_startTime;
     double normalizedValue = normalizedAnimationValue(totalRunningTime, m_animation->duration(), m_animation->direction());
 
-    if (m_animation->iterationCount() != Animation::IterationCountInfinite && totalRunningTime >= m_animation->duration() * m_animation->iterationCount())
+    if (m_animation->iterationCount() != Animation::IterationCountInfinite && totalRunningTime >= m_animation->duration() * m_animation->iterationCount()) {
         setState(StoppedState);
+        if (m_animation->fillsForwards())
+            normalizedValue = normalizedAnimationValueForFillsForwards(m_animation->iterationCount(), m_animation->direction());
+    }
 
     if (!normalizedValue) {
         applyInternal(client, m_keyframes.at(0), m_keyframes.at(1), 0);
diff --git a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
index ff7ed7e29..805e20a79 100644
--- a/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Extensions3DChromium.h
@@ -38,6 +38,7 @@ public:
     virtual ~Extensions3DChromium();
 
     // Supported extensions:
+    //   GL_CHROMIUM_shallow_flush  : only supported if an ipc command buffer is used.
     //   GL_CHROMIUM_resource_safe  : indicating that textures/renderbuffers are always initialized before read/write.
     //   GL_CHROMIUM_strict_attribs : indicating a GL error is generated for out-of-bounds buffer accesses.
     //   GL_CHROMIUM_post_sub_buffer
@@ -122,6 +123,9 @@ public:
     // GL_CHROMIUM_copy_texture
     void copyTextureCHROMIUM(GC3Denum, Platform3DObject, Platform3DObject, GC3Dint, GC3Denum);
 
+    // GL_CHROMIUM_shallow_flush
+    virtual void shallowFlushCHROMIUM();
+
 private:
     // Instances of this class are strictly owned by the GraphicsContext3D implementation and do not
     // need to be instantiated by any other code.
diff --git a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
index d4d592e1b..156dcd3d1 100644
--- a/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
@@ -1,11 +1,11 @@
 /*
  * Copyright (C) 2006, 2007 Apple Computer, Inc.
  * Copyright (c) 2006, 2007, 2008, 2009, 2012 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -15,7 +15,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -35,6 +35,7 @@
 #include "Font.h"
 #include "FontUtilsChromiumWin.h"
 #include "HWndDC.h"
+#include "LayoutTestSupport.h"
 #include "PlatformSupport.h"
 #include "SimpleFontData.h"
 #include <unicode/uniset.h>
@@ -55,10 +56,10 @@ namespace WebCore
 // asked for a CJK font with a Romanized name under a CJK locale,
 // |GetTextFace| (after |CreateFont*|) returns a 'bogus' value (e.g. Arial).
 // This is not consistent with what MSDN says !!
-// Therefore, before we call |CreateFont*|, we have to map a Romanized name to 
-// the corresponding native name under a CJK locale and vice versa 
+// Therefore, before we call |CreateFont*|, we have to map a Romanized name to
+// the corresponding native name under a CJK locale and vice versa
 // under a non-CJK locale.
-// See the corresponding gecko bugs at 
+// See the corresponding gecko bugs at
 // https://bugzilla.mozilla.org/show_bug.cgi?id=373952
 // https://bugzilla.mozilla.org/show_bug.cgi?id=231426
 static bool LookupAltName(const String& name, String& altName)
@@ -206,11 +207,11 @@ static bool LookupAltName(const String& name, String& altName)
             fontNameMap->set(String(namePairs[i].name), &(namePairs[i].altNameCodepage));
     }
 
-    bool isAscii = false; 
+    bool isAscii = false;
     String n;
-    // use |lower| only for ASCII names 
-    // For non-ASCII names, we don't want to invoke an expensive 
-    // and unnecessary |lower|. 
+    // use |lower| only for ASCII names
+    // For non-ASCII names, we don't want to invoke an expensive
+    // and unnecessary |lower|.
     if (name.containsOnlyASCII()) {
         isAscii = true;
         n = name.lower();
@@ -257,7 +258,7 @@ static HFONT createFontIndirectAndGetWinName(const String& family, LOGFONT* winf
 // This maps font family names to their repertoires of supported Unicode
 // characters. Because it's family names rather than font faces we use
 // as keys, there might be edge cases where one face of a font family
-// has a different repertoire from another face of the same family. 
+// has a different repertoire from another face of the same family.
 typedef HashMap<const wchar_t*, icu::UnicodeSet*> FontCmapCache;
 
 static bool fontContainsCharacter(const FontPlatformData* fontData,
@@ -275,10 +276,10 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
         fontCmapCache = new FontCmapCache;
 
     HashMap<const wchar_t*, icu::UnicodeSet*>::iterator it = fontCmapCache->find(family);
-    if (it != fontCmapCache->end()) 
+    if (it != fontCmapCache->end())
         return it->second->contains(character);
-    
-    HFONT hfont = fontData->hfont(); 
+
+    HFONT hfont = fontData->hfont();
     HWndDC hdc(0);
     HGDIOBJ oldFont = static_cast<HFONT>(SelectObject(hdc, hfont));
     int count = GetFontUnicodeRanges(hdc, 0);
@@ -294,7 +295,7 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     glyphsetBuffer.resize(GetFontUnicodeRanges(hdc, 0));
     GLYPHSET* glyphset = reinterpret_cast<GLYPHSET*>(glyphsetBuffer.data());
     // In addition, refering to the OS/2 table and converting the codepage list
-    // to the coverage map might be faster. 
+    // to the coverage map might be faster.
     count = GetFontUnicodeRanges(hdc, glyphset);
     ASSERT(count > 0);
     SelectObject(hdc, oldFont);
@@ -305,14 +306,14 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     unsigned i = 0;
     icu::UnicodeSet* cmap = new icu::UnicodeSet;
     while (i < glyphset->cRanges) {
-        WCHAR start = glyphset->ranges[i].wcLow; 
+        WCHAR start = glyphset->ranges[i].wcLow;
         cmap->add(start, start + glyphset->ranges[i].cGlyphs - 1);
         i++;
     }
     cmap->freeze();
     // We don't lowercase |family| because all of them are under our control
-    // and they're already lowercased. 
-    fontCmapCache->set(family, cmap); 
+    // and they're already lowercased.
+    fontCmapCache->set(family, cmap);
     return cmap->contains(character);
 }
 
@@ -354,7 +355,7 @@ static void FillLogFont(const FontDescription& fontDescription, LOGFONT* winfont
     winfont->lfStrikeOut = false;
     winfont->lfCharSet = DEFAULT_CHARSET;
     winfont->lfOutPrecision = OUT_TT_ONLY_PRECIS;
-    winfont->lfQuality = PlatformSupport::layoutTestMode() ? NONANTIALIASED_QUALITY : DEFAULT_QUALITY; // Honor user's desktop settings.
+    winfont->lfQuality = isRunningLayoutTest() ? NONANTIALIASED_QUALITY : DEFAULT_QUALITY; // Honor user's desktop settings.
     winfont->lfPitchAndFamily = DEFAULT_PITCH | FF_DONTCARE;
     winfont->lfItalic = fontDescription.italic();
     winfont->lfWeight = toGDIFontWeight(fontDescription.weight());
@@ -433,7 +434,7 @@ const SimpleFontData* FontCache::getFontDataForCharacters(const Font& font, cons
         fontDescription.genericFamily(), &c, &script);
     FontPlatformData* data = 0;
     if (family)
-        data = getCachedFontPlatformData(font.fontDescription(),  AtomicString(family, wcslen(family)), false); 
+        data = getCachedFontPlatformData(font.fontDescription(),  AtomicString(family, wcslen(family)), false);
 
     // Last resort font list : PanUnicode. CJK fonts have a pretty
     // large repertoire. Eventually, we need to scan all the fonts
@@ -492,7 +493,7 @@ const SimpleFontData* FontCache::getFontDataForCharacters(const Font& font, cons
     // warrant an additional (real coverage) check with fontCotainsCharacter.
     int i;
     for (i = 0; (!data || !fontContainsCharacter(data, family, c)) && i < numFonts; ++i) {
-        family = panUniFonts[i]; 
+        family = panUniFonts[i];
         data = getCachedFontPlatformData(font.fontDescription(), AtomicString(family, wcslen(family)));
     }
     // When i-th font (0-base) in |panUniFonts| contains a character and
@@ -603,8 +604,8 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     LOGFONT winfont = {0};
     FillLogFont(fontDescription, &winfont);
 
-    // Windows will always give us a valid pointer here, even if the face name 
-    // is non-existent.  We have to double-check and see if the family name was 
+    // Windows will always give us a valid pointer here, even if the face name
+    // is non-existent. We have to double-check and see if the family name was
     // really used.
     String winName;
     HFONT hfont = createFontIndirectAndGetWinName(family, &winfont, &winName);
@@ -614,15 +615,14 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     // FIXME: Do we need to use predefined fonts "guaranteed" to exist
     // when we're running in layout-test mode?
     if (!equalIgnoringCase(family, winName)) {
-        // For CJK fonts with both English and native names, 
+        // For CJK fonts with both English and native names,
         // GetTextFace returns a native name under the font's "locale"
-        // and an English name under other locales regardless of 
+        // and an English name under other locales regardless of
         // lfFaceName field of LOGFONT. As a result, we need to check
         // if a font has an alternate name. If there is, we need to
         // compare it with what's requested in the first place.
         String altName;
-        if (!LookupAltName(family, altName) || 
-            !equalIgnoringCase(altName, winName)) {
+        if (!LookupAltName(family, altName) || !equalIgnoringCase(altName, winName)) {
             DeleteObject(hfont);
             return 0;
         }
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 03203bf1c..24827e946 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -77,7 +77,6 @@ LayerChromium::LayerChromium()
     , m_masksToBounds(false)
     , m_opaque(false)
     , m_doubleSided(true)
-    , m_usesLayerClipping(false)
     , m_isNonCompositedContent(false)
     , m_preserves3D(false)
     , m_useParentBackfaceVisibility(false)
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 83058e633..abd9e36f8 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -195,9 +195,6 @@ public:
     void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
     bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
 
-    void setUsesLayerClipping(bool usesLayerClipping) { m_usesLayerClipping = usesLayerClipping; }
-    bool usesLayerClipping() const { return m_usesLayerClipping; }
-
     virtual void setIsNonCompositedContent(bool);
     bool isNonCompositedContent() const { return m_isNonCompositedContent; }
 
@@ -236,8 +233,6 @@ public:
     bool drawOpacityIsAnimating() const { return m_drawOpacityIsAnimating; }
     void setDrawOpacityIsAnimating(bool drawOpacityIsAnimating) { m_drawOpacityIsAnimating = drawOpacityIsAnimating; }
 
-    const IntRect& clipRect() const { return m_clipRect; }
-    void setClipRect(const IntRect& clipRect) { m_clipRect = clipRect; }
     LayerChromium* renderTarget() const { ASSERT(!m_renderTarget || m_renderTarget->renderSurface()); return m_renderTarget; }
     void setRenderTarget(LayerChromium* target) { m_renderTarget = target; }
 
@@ -351,8 +346,7 @@ private:
     IntRect m_visibleContentRect;
 
     // During drawing, identifies the region outside of which nothing should be drawn.
-    // Currently this is set to layer's clipRect if usesLayerClipping is true, otherwise
-    // it's renderTarget's RenderSurface contentRect.
+    // This is the intersection of the layer's drawableContentRect and damage (if damage tracking is enabled).
     // Uses target surface's space.
     IntRect m_scissorRect;
     IntPoint m_scrollPosition;
@@ -378,7 +372,6 @@ private:
     bool m_masksToBounds;
     bool m_opaque;
     bool m_doubleSided;
-    bool m_usesLayerClipping;
     bool m_isNonCompositedContent;
     bool m_preserves3D;
     bool m_useParentBackfaceVisibility;
@@ -397,9 +390,8 @@ private:
     float m_drawOpacity;
     bool m_drawOpacityIsAnimating;
 
-    // Uses target surface space.
-    IntRect m_clipRect;
     LayerChromium* m_renderTarget;
+
     WebKit::WebTransformationMatrix m_drawTransform;
     WebKit::WebTransformationMatrix m_screenSpaceTransform;
     bool m_drawTransformIsAnimating;
diff --git a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
index 1681c5ba3..4749c130e 100644
--- a/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/RenderSurfaceChromium.h
@@ -116,8 +116,6 @@ private:
     IntRect m_clipRect;
 
     // During drawing, identifies the region outside of which nothing should be drawn.
-    // Currently this is set to layer's clipRect if usesLayerClipping is true, otherwise
-    // it's targetRenderSurface's contentRect.
     // Uses the space of the surface's target surface.
     IntRect m_scissorRect;
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
index d5a7d4295..ac2956a13 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 
 const double CCFrameRateCounter::kFrameTooFast = 1.0 / 70.0; // measured in seconds
 const double CCFrameRateCounter::kFrameTooSlow = 1.0 / 12.0;
+const double CCFrameRateCounter::kDroppedFrameTime = 1.0 / 50.0;
 
 // safeMod works on -1, returning m-1 in that case.
 static inline int safeMod(int number, int modulus)
@@ -42,13 +43,20 @@ static inline int safeMod(int number, int modulus)
     return (number + modulus) % modulus;
 }
 
-inline int CCFrameRateCounter::frameIndex(int frame) const
+inline double CCFrameRateCounter::frameInterval(int frameNumber) const
 {
-    return safeMod(frame, kTimeStampHistorySize);
+    return m_timeStampHistory[frameIndex(frameNumber)] -
+        m_timeStampHistory[frameIndex(frameNumber - 1)];
+}
+
+inline int CCFrameRateCounter::frameIndex(int frameNumber) const
+{
+    return safeMod(frameNumber, kTimeStampHistorySize);
 }
 
 CCFrameRateCounter::CCFrameRateCounter()
     : m_currentFrameNumber(1)
+    , m_droppedFrameCount(0)
 {
     m_timeStampHistory[0] = currentTime();
     m_timeStampHistory[1] = m_timeStampHistory[0];
@@ -67,6 +75,9 @@ void CCFrameRateCounter::markBeginningOfFrame(double timestamp)
     }
 
     m_timeStampHistory[frameIndex(m_currentFrameNumber)] = timestamp;
+    double delta = frameInterval(m_currentFrameNumber);
+    if (!isBadFrameInterval(delta) && delta > kDroppedFrameTime)
+        ++m_droppedFrameCount;
 }
 
 void CCFrameRateCounter::markEndOfFrame()
@@ -84,9 +95,7 @@ bool CCFrameRateCounter::isBadFrameInterval(double intervalBetweenConsecutiveFra
 
 bool CCFrameRateCounter::isBadFrame(int frameNumber) const
 {
-    double delta = m_timeStampHistory[frameIndex(frameNumber)] -
-            m_timeStampHistory[frameIndex(frameNumber - 1)];
-    return isBadFrameInterval(delta);
+    return isBadFrameInterval(frameInterval(frameNumber));
 }
 
 void CCFrameRateCounter::getAverageFPSAndStandardDeviation(double& averageFPS, double& standardDeviation) const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h
index c49f17c23..fc23e26e3 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCFrameRateCounter.h
@@ -56,9 +56,12 @@ public:
     // true if the given frame interval is too fast or too slow, based on constant thresholds.
     bool isBadFrameInterval(double intervalBetweenConsecutiveFrames) const;
 
+    int droppedFrameCount() const { return m_droppedFrameCount; }
+
 private:
     CCFrameRateCounter();
 
+    double frameInterval(int frameNumber) const;
     int frameIndex(int frameNumber) const;
     bool isBadFrame(int frameNumber) const;
 
@@ -68,10 +71,17 @@ private:
     static const double kFrameTooFast;
     static const double kFrameTooSlow;
 
+    // If a frame takes longer than this threshold (measured in seconds) then we
+    // (naively) assume that it missed a screen refresh; that is, we dropped a frame.
+    // FIXME: Determine this threshold based on monitor refresh rate, crbug.com/138642.
+    static const double kDroppedFrameTime;
+
     static const int kTimeStampHistorySize = 120;
 
     int m_currentFrameNumber;
     double m_timeStampHistory[kTimeStampHistorySize];
+
+    int m_droppedFrameCount;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
index be8c8a557..405885ffb 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCGraphicsContext.h
@@ -48,12 +48,6 @@ public:
 
     WebKit::WebGraphicsContext3D* context3D() { return m_context3D.get(); }
 
-    void flush()
-    {
-        if (m_context3D)
-            m_context3D->flush();
-    }
-
 private:
     CCGraphicsContext() { }
     explicit CCGraphicsContext(PassOwnPtr<WebKit::WebGraphicsContext3D> context3D)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 717d96d10..8a05a8807 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -64,7 +64,6 @@ CCLayerImpl::CCLayerImpl(int id)
     , m_preserves3D(false)
     , m_useParentBackfaceVisibility(false)
     , m_drawCheckerboardForMissingTiles(false)
-    , m_usesLayerClipping(false)
     , m_isNonCompositedContent(false)
     , m_drawsContent(false)
     , m_forceRenderSurface(false)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 6196c2c4d..25bedc220 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -148,9 +148,6 @@ public:
     void setUseParentBackfaceVisibility(bool useParentBackfaceVisibility) { m_useParentBackfaceVisibility = useParentBackfaceVisibility; }
     bool useParentBackfaceVisibility() const { return m_useParentBackfaceVisibility; }
 
-    void setUsesLayerClipping(bool usesLayerClipping) { m_usesLayerClipping = usesLayerClipping; }
-    bool usesLayerClipping() const { return m_usesLayerClipping; }
-
     void setIsNonCompositedContent(bool isNonCompositedContent) { m_isNonCompositedContent = isNonCompositedContent; }
     bool isNonCompositedContent() const { return m_isNonCompositedContent; }
 
@@ -178,10 +175,6 @@ public:
     bool drawOpacityIsAnimating() const { return m_drawOpacityIsAnimating; }
     void setDrawOpacityIsAnimating(bool drawOpacityIsAnimating) { m_drawOpacityIsAnimating = drawOpacityIsAnimating; }
 
-    // Usage: if this->usesLayerClipping() is false, then this clipRect should not be used.
-    const IntRect& clipRect() const { return m_clipRect; }
-    void setClipRect(const IntRect& rect) { m_clipRect = rect; }
-
     const IntRect& scissorRect() const { return m_scissorRect; }
     void setScissorRect(const IntRect& rect) { m_scissorRect = rect; }
 
@@ -343,7 +336,6 @@ private:
     bool m_drawCheckerboardForMissingTiles;
     WebKit::WebTransformationMatrix m_sublayerTransform;
     WebKit::WebTransformationMatrix m_transform;
-    bool m_usesLayerClipping;
     bool m_isNonCompositedContent;
 
     bool m_drawsContent;
@@ -389,12 +381,6 @@ private:
     bool m_betweenWillDrawAndDidDraw;
 #endif
 
-    // The rect that contributes to the scissor when this layer is drawn.
-    // Inherited by the parent layer and further restricted if this layer masks
-    // to bounds.
-    // Uses target surface's space.
-    IntRect m_clipRect;
-
     // During drawing, identifies the region outside of which nothing should be drawn.
     // Uses target surface's space.
     IntRect m_scissorRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 377f74d54..d2a79eb1b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -467,9 +467,6 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer, CCTextureUpdater& u
         rootLayer->createRenderSurface();
     rootLayer->renderSurface()->setContentRect(IntRect(IntPoint(0, 0), deviceViewportSize()));
 
-    IntRect rootClipRect(IntPoint(), deviceViewportSize());
-    rootLayer->setClipRect(rootClipRect);
-
     LayerList updateList;
     updateList.append(rootLayer);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index 3946c23dc..343766a6a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -72,11 +72,7 @@ static IntRect calculateLayerScissorRect(LayerType* layer, const FloatRect& root
     RenderSurfaceType* targetSurface = renderTarget->renderSurface();
 
     FloatRect rootScissorRectInTargetSurface = targetSurface->computeRootScissorRectInCurrentSurface(rootScissorRect);
-    FloatRect clipAndDamage;
-    if (layer->usesLayerClipping())
-        clipAndDamage = intersection(rootScissorRectInTargetSurface, layer->clipRect());
-    else
-        clipAndDamage = intersection(rootScissorRectInTargetSurface, targetSurface->contentRect());
+    FloatRect clipAndDamage = intersection(rootScissorRectInTargetSurface, layer->drawableContentRect());
 
     return enclosingIntRect(clipAndDamage);
 }
@@ -95,13 +91,21 @@ static IntRect calculateSurfaceScissorRect(LayerType* layer, const FloatRect& ro
 
     FloatRect clipRect = currentSurface->clipRect();
 
-    // For surfaces, empty clipRect means the same as CCLayerImpl::usesLayerClipping being false
+    // For surfaces, empty clipRect means that the surface does not clip anything.
     if (clipRect.isEmpty())
         clipRect = intersection(targetSurface->contentRect(), currentSurface->drawableContentRect());
+    else
+        clipRect.intersect(currentSurface->drawableContentRect());
 
     FloatRect rootScissorRectInTargetSurface = targetSurface->computeRootScissorRectInCurrentSurface(rootScissorRect);
 
     FloatRect clipAndDamage = intersection(rootScissorRectInTargetSurface, clipRect);
+
+    // If the layer has background filters that move pixels, we cannot scissor as tightly.
+    // FIXME: this should be able to be a tighter scissor, perhaps expanded by the filter outsets?
+    if (layer->backgroundFilters().hasFilterThatMovesPixels())
+        clipAndDamage = rootScissorRectInTargetSurface;
+
     return enclosingIntRect(clipAndDamage);
 }
 
@@ -156,14 +160,19 @@ static bool isSurfaceBackFaceVisible(LayerType* layer, const WebTransformationMa
 }
 
 template<typename LayerType>
+static inline bool layerClipsSubtree(LayerType* layer)
+{
+    return layer->masksToBounds() || layer->maskLayer();
+}
+
+template<typename LayerType>
 static IntRect calculateVisibleContentRect(LayerType* layer)
 {
     ASSERT(layer->renderTarget());
 
     IntRect targetSurfaceRect = layer->renderTarget()->renderSurface()->contentRect();
 
-    if (layer->usesLayerClipping())
-        targetSurfaceRect.intersect(layer->clipRect());
+    targetSurfaceRect.intersect(layer->drawableContentRect());
 
     if (targetSurfaceRect.isEmpty() || layer->contentBounds().isEmpty())
         return IntRect();
@@ -298,7 +307,7 @@ static bool subtreeShouldRenderToSeparateSurface(LayerType* layer, bool axisAlig
         return true;
 
     // If the layer clips its descendants but it is not axis-aligned with respect to its parent.
-    if (layer->masksToBounds() && !axisAlignedWithRespectToParent && descendantDrawsContent)
+    if (layerClipsSubtree(layer) && !axisAlignedWithRespectToParent && descendantDrawsContent)
         return true;
 
     // If the layer has opacity != 1 and does not have a preserves-3d transform style.
@@ -393,10 +402,11 @@ WebTransformationMatrix computeScrollCompensationMatrixForChildren(CCLayerImpl*
 // Recursively walks the layer tree starting at the given node and computes all the
 // necessary transformations, clipRects, render surfaces, etc.
 template<typename LayerType, typename LayerList, typename RenderSurfaceType, typename LayerSorter>
-static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLayer, const WebTransformationMatrix& parentMatrix,
-                                            const WebTransformationMatrix& fullHierarchyMatrix, const WebTransformationMatrix& currentScrollCompensationMatrix,
-                                            RenderSurfaceType* nearestAncestorThatMovesPixels, LayerList& renderSurfaceLayerList, LayerList& layerList,
-                                            LayerSorter* layerSorter, int maxTextureSize)
+static void calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLayer, const WebTransformationMatrix& parentMatrix,
+    const WebTransformationMatrix& fullHierarchyMatrix, const WebTransformationMatrix& currentScrollCompensationMatrix,
+    const IntRect& clipRectFromAncestor, bool ancestorClipsSubtree,
+    RenderSurfaceType* nearestAncestorThatMovesPixels, LayerList& renderSurfaceLayerList, LayerList& layerList,
+    LayerSorter* layerSorter, int maxTextureSize, IntRect& drawableContentRectOfSubtree)
 {
     // This function computes the new matrix transformations recursively for this
     // layer and all its descendants. It also computes the appropriate render surfaces.
@@ -488,9 +498,15 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     //        M[replica2root] = M[surface2root] * Tr[replica->position()] * Tr[replica] * Tr[origin2anchor].inverse()
     //
 
+    // If we early-exit anywhere in this function, the drawableContentRect of this subtree should be considered empty.
+    drawableContentRectOfSubtree = IntRect();
+
     if (subtreeShouldBeSkipped(layer))
-        return false;
+        return;
 
+    IntRect clipRectForSubtree;
+    bool subtreeShouldBeClipped = false;
+    
     float drawOpacity = layer->opacity();
     bool drawOpacityIsAnimating = layer->opacityIsAnimating();
     if (layer->parent() && layer->parent()->preserves3D()) {
@@ -544,13 +560,10 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     // nextHierarchyMatrix will only change if this layer uses a new RenderSurface, otherwise remains the same.
     WebTransformationMatrix nextHierarchyMatrix = fullHierarchyMatrix;
 
-    // FIXME: This seems like the wrong place to set this
-    layer->setUsesLayerClipping(false);
-
     if (subtreeShouldRenderToSeparateSurface(layer, isScaleOrTranslation(combinedTransform))) {
         // Check back-face visibility before continuing with this surface and its subtree
         if (!layer->doubleSided() && transformToParentIsKnown(layer) && isSurfaceBackFaceVisible(layer, combinedTransform))
-            return false;
+            return;
 
         if (!layer->renderSurface())
             layer->createRenderSurface();
@@ -594,14 +607,11 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
         // Update the aggregate hierarchy matrix to include the transform of the newly created RenderSurface.
         nextHierarchyMatrix.multiply(surfaceOriginTransform);
 
-        // The render surface clipRect contributes to the scissor rect that needs to
-        // be applied before drawing the render surface onto its containing
-        // surface and is therefore expressed in the parent's coordinate system.
-        renderSurface->setClipRect(layer->parent() ? layer->parent()->clipRect() : layer->clipRect());
-
-        // The layer's clipRect can be reset here. The renderSurface will correctly clip the subtree.
-        layer->setUsesLayerClipping(false);
-        layer->setClipRect(IntRect());
+        // The new renderSurface here will correctly clip the entire subtree. So, we do
+        // not need to continue propagating the clipping state further down the tree. This
+        // way, we can avoid transforming clipRects from ancestor target surface space to
+        // current target surface space that could cause more w < 0 headaches.
+        subtreeShouldBeClipped = false;
 
         if (layer->maskLayer())
             layer->maskLayer()->setRenderTarget(layer);
@@ -611,6 +621,7 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
         if (layer->filters().hasFilterThatMovesPixels())
             nearestAncestorThatMovesPixels = renderSurface;
+
         renderSurface->setNearestAncestorThatMovesPixels(nearestAncestorThatMovesPixels);
 
         renderSurfaceLayerList.append(layer);
@@ -627,26 +638,33 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
             ASSERT(layer->parent());
             layer->clearRenderSurface();
 
-            // Layers inherit the clip rect from their parent.
-            layer->setClipRect(layer->parent()->clipRect());
-            if (layer->parent()->usesLayerClipping())
-                layer->setUsesLayerClipping(true);
-
+            // Layers without renderSurfaces directly inherit the ancestor's clip status.
+            subtreeShouldBeClipped = ancestorClipsSubtree;
+            if (ancestorClipsSubtree)
+                clipRectForSubtree = clipRectFromAncestor;
+            
             // Layers that are not their own renderTarget will render into the target of their nearest ancestor.
             layer->setRenderTarget(layer->parent()->renderTarget());
+        } else {
+            // FIXME: This root layer special case code should eventually go away. But before that is truly possible,
+            //        tests (or code) related to CCOcclusionTracker need to be adjusted so that they do not require
+            //        the rootLayer to clip; the root layer's RenderSurface would already clip and should be enough.
+            ASSERT(!layer->parent());
+            ASSERT(layer->renderSurface());
+            ASSERT(ancestorClipsSubtree);
+            layer->renderSurface()->setClipRect(clipRectFromAncestor);
+            subtreeShouldBeClipped = true;
+            clipRectForSubtree = clipRectFromAncestor;
         }
     }
 
-    if (layer->masksToBounds()) {
-        IntRect clipRect = transformedLayerRect;
-
-        // If the layer already inherited a clipRect, we need to intersect with it before
-        // overriding the layer's clipRect and usesLayerClipping.
-        if (layer->usesLayerClipping())
-            clipRect.intersect(layer->clipRect());
-
-        layer->setClipRect(clipRect);
-        layer->setUsesLayerClipping(true);
+    if (layerClipsSubtree(layer)) {
+        subtreeShouldBeClipped = true;
+        if (ancestorClipsSubtree && !layer->renderSurface()) {
+            clipRectForSubtree = clipRectFromAncestor;
+            clipRectForSubtree.intersect(transformedLayerRect);
+        } else
+            clipRectForSubtree = transformedLayerRect;
     }
 
     // Note that at this point, layer->drawTransform() is not necessarily the same as local variable drawTransform.
@@ -656,16 +674,6 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     layerScreenSpaceTransform.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
     layer->setScreenSpaceTransform(layerScreenSpaceTransform);
 
-    // drawableContentRect() is always stored in the coordinate system of the
-    // RenderSurface the layer draws into.
-    if (layer->drawsContent()) {
-        IntRect drawableContentRect = transformedLayerRect;
-        if (layer->usesLayerClipping())
-            drawableContentRect.intersect(layer->clipRect());
-        layer->setDrawableContentRect(drawableContentRect);
-    } else
-        layer->setDrawableContentRect(IntRect());
-
     WebTransformationMatrix sublayerMatrix = layer->drawTransform();
 
     // Flatten to 2D if the layer doesn't preserve 3D.
@@ -695,36 +703,45 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
     WebTransformationMatrix nextScrollCompensationMatrix = computeScrollCompensationMatrixForChildren(layer, parentMatrix, currentScrollCompensationMatrix);;
 
+    IntRect accumulatedDrawableContentRectOfChildren;
     for (size_t i = 0; i < layer->children().size(); ++i) {
         LayerType* child = layer->children()[i].get();
-        bool drawsContent = calculateDrawTransformsInternal<LayerType, LayerList, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nextScrollCompensationMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
-
-        if (drawsContent) {
-            if (child->renderSurface()) {
-                RenderSurfaceType* childRenderSurface = child->renderSurface();
-                IntRect drawableContentRect = layer->drawableContentRect();
-                drawableContentRect.unite(enclosingIntRect(childRenderSurface->drawableContentRect()));
-                layer->setDrawableContentRect(drawableContentRect);
+        IntRect drawableContentRectOfChildSubtree;
+        calculateDrawTransformsInternal<LayerType, LayerList, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nextScrollCompensationMatrix,
+                                                                                              clipRectForSubtree, subtreeShouldBeClipped, nearestAncestorThatMovesPixels,
+                                                                                              renderSurfaceLayerList, descendants, layerSorter, maxTextureSize, drawableContentRectOfChildSubtree);
+        if (!drawableContentRectOfChildSubtree.isEmpty()) {
+            accumulatedDrawableContentRectOfChildren.unite(drawableContentRectOfChildSubtree);
+            if (child->renderSurface())
                 descendants.append(child);
-            } else {
-                IntRect drawableContentRect = layer->drawableContentRect();
-                drawableContentRect.unite(child->drawableContentRect());
-                layer->setDrawableContentRect(drawableContentRect);
-            }
         }
     }
 
-    if (layer->masksToBounds() || layer->maskLayer()) {
-        IntRect drawableContentRect = layer->drawableContentRect();
-        drawableContentRect.intersect(transformedLayerRect);
-        layer->setDrawableContentRect(drawableContentRect);
-    }
+    // Compute the total drawableContentRect for this subtree (the rect is in targetSurface space)
+    IntRect localDrawableContentRectOfSubtree = accumulatedDrawableContentRectOfChildren;
+    if (layer->drawsContent())
+        localDrawableContentRectOfSubtree.unite(transformedLayerRect);
+    if (subtreeShouldBeClipped)
+        localDrawableContentRectOfSubtree.intersect(clipRectForSubtree);
+
+    // Compute the layer's drawable content rect (the rect is in targetSurface space)
+    IntRect drawableContentRectOfLayer = transformedLayerRect;
+    if (subtreeShouldBeClipped)
+        drawableContentRectOfLayer.intersect(clipRectForSubtree);
+    layer->setDrawableContentRect(drawableContentRectOfLayer);
 
+    // Compute the remaining properties for the render surface, if the layer has one.
     if (layer->renderSurface() && layer != rootLayer) {
         RenderSurfaceType* renderSurface = layer->renderSurface();
-        IntRect clippedContentRect = layer->drawableContentRect();
+        IntRect clippedContentRect = localDrawableContentRectOfSubtree;
         FloatPoint surfaceCenter = FloatRect(clippedContentRect).center();
 
+        // The render surface clipRect is expressed in the space where this surface draws, i.e. the same space as clipRectFromAncestor.
+        if (ancestorClipsSubtree)
+            renderSurface->setClipRect(clipRectFromAncestor);
+        else
+            renderSurface->setClipRect(IntRect());
+
         // Restrict the RenderSurface size to the portion that's visible.
         FloatSize centerOffsetDueToClipping;
 
@@ -733,7 +750,8 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
         // its target is not known on the main thread, and we should not use it
         // to clip.
         if (!layer->replicaLayer() && transformToParentIsKnown(layer)) {
-            if (!renderSurface->clipRect().isEmpty() && !clippedContentRect.isEmpty()) {
+            // Note, it is correct to use ancestorClipsSubtree here, because we are looking at this layer's renderSurface, not the layer itself.
+            if (ancestorClipsSubtree && !clippedContentRect.isEmpty()) {
                 IntRect surfaceClipRect = CCLayerTreeHostCommon::calculateVisibleRect(renderSurface->clipRect(), clippedContentRect, renderSurface->originTransform());
                 clippedContentRect.intersect(surfaceClipRect);
             }
@@ -751,10 +769,6 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
 
         renderSurface->setContentRect(clippedContentRect);
 
-        // Since the layer starts a new render surface we need to adjust its
-        // clipRect to be expressed in the new surface's coordinate system.
-        layer->setClipRect(layer->drawableContentRect());
-
         // Adjust the origin of the transform to be the center of the render surface.
         WebTransformationMatrix drawTransform = renderSurface->originTransform();
         drawTransform.translate3d(surfaceCenter.x() + centerOffsetDueToClipping.width(), surfaceCenter.y() + centerOffsetDueToClipping.height(), 0);
@@ -813,13 +827,13 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
             ASSERT(renderSurfaceLayerList.last() == layer);
             renderSurfaceLayerList.removeLast();
             layer->clearRenderSurface();
-            return false;
+            return;
         }
     }
 
     // If neither this layer nor any of its children were added, early out.
     if (sortingStartIndex == descendants.size())
-        return false;
+        return;
 
     // If preserves-3d then sort all the descendants in 3D so that they can be
     // drawn from back to front. If the preserves-3d property is also set on the parent then
@@ -827,7 +841,12 @@ static bool calculateDrawTransformsInternal(LayerType* layer, LayerType* rootLay
     if (descendants.size() && layer->preserves3D() && (!layer->parent() || !layer->parent()->preserves3D()))
         sortLayers(&descendants.at(sortingStartIndex), descendants.end(), layerSorter);
 
-    return true;
+    if (layer->renderSurface())
+        drawableContentRectOfSubtree = enclosingIntRect(layer->renderSurface()->drawableContentRect());
+    else
+        drawableContentRectOfSubtree = localDrawableContentRectOfSubtree;
+
+    return;
 }
 
 // FIXME: Instead of using the following function to set visibility rects on a second
@@ -864,13 +883,19 @@ static void calculateVisibleAndScissorRectsInternal(const LayerList& renderSurfa
 void CCLayerTreeHostCommon::calculateDrawTransforms(LayerChromium* layer, LayerChromium* rootLayer, const WebTransformationMatrix& parentMatrix, const WebTransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize)
 {
     WebTransformationMatrix scrollCompensationMatrix;
-    WebCore::calculateDrawTransformsInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, void>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
+    IntRect drawableContentRect;
+    WebCore::calculateDrawTransformsInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, void>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix,
+                                                                                                                         rootLayer->renderSurface()->contentRect(), true, 0, renderSurfaceLayerList,
+                                                                                                                         layerList, 0, maxTextureSize, drawableContentRect);
 }
 
 void CCLayerTreeHostCommon::calculateDrawTransforms(CCLayerImpl* layer, CCLayerImpl* rootLayer, const WebTransformationMatrix& parentMatrix, const WebTransformationMatrix& fullHierarchyMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
 {
     WebTransformationMatrix scrollCompensationMatrix;
-    WebCore::calculateDrawTransformsInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
+    IntRect drawableContentRect;
+    WebCore::calculateDrawTransformsInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, scrollCompensationMatrix,
+                                                                                                                rootLayer->renderSurface()->contentRect(), true, 0, renderSurfaceLayerList,
+                                                                                                                layerList, layerSorter, maxTextureSize, drawableContentRect);
 }
 
 void CCLayerTreeHostCommon::calculateVisibleAndScissorRects(Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, const FloatRect& rootScissorRect)
@@ -909,10 +934,10 @@ static bool pointIsClippedBySurfaceOrClipRect(const IntPoint& viewportPoint, CCL
         if (currentLayer->renderSurface() && !pointHitsRect(viewportPoint, currentLayer->renderSurface()->screenSpaceTransform(), currentLayer->renderSurface()->contentRect()))
             return true;
 
-        // Note that clipRects are actually in targetSurface space, so the transform we
+        // Note that drawableContentRects are actually in targetSurface space, so the transform we
         // have to provide is the target surface's screenSpaceTransform.
         CCLayerImpl* renderTarget = currentLayer->renderTarget();
-        if (currentLayer->usesLayerClipping() && !pointHitsRect(viewportPoint, renderTarget->renderSurface()->screenSpaceTransform(), currentLayer->clipRect()))
+        if (!pointHitsRect(viewportPoint, renderTarget->renderSurface()->screenSpaceTransform(), currentLayer->drawableContentRect()))
             return true;
 
         currentLayer = currentLayer->parent();
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index 7f1240432..598ec6397 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -43,6 +43,7 @@
 #include "cc/CCPageScaleAnimation.h"
 #include "cc/CCPrioritizedTextureManager.h"
 #include "cc/CCRenderPassDrawQuad.h"
+#include "cc/CCRenderingStats.h"
 #include "cc/CCSettings.h"
 #include "cc/CCSingleThreadProxy.h"
 #include <wtf/CurrentTime.h>
@@ -114,7 +115,6 @@ PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHostImpl::create(const CCLayerTreeSet
 CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCLayerTreeSettings& settings, CCLayerTreeHostImplClient* client)
     : m_client(client)
     , m_sourceFrameNumber(-1)
-    , m_sourceAnimationFrameNumber(0)
     , m_rootScrollLayerImpl(0)
     , m_currentlyScrollingLayerImpl(0)
     , m_scrollingLayerIdFromPreviousTree(-1)
@@ -259,8 +259,6 @@ void CCLayerTreeHostImpl::calculateRenderSurfaceLayerList(CCLayerList& renderSur
     m_rootLayerImpl->renderSurface()->clearLayerList();
     m_rootLayerImpl->renderSurface()->setContentRect(IntRect(IntPoint(), deviceViewportSize()));
 
-    m_rootLayerImpl->setClipRect(IntRect(IntPoint(), deviceViewportSize()));
-
     {
         TRACE_EVENT0("cc", "CCLayerTreeHostImpl::calcDrawEtc");
         WebTransformationMatrix identityMatrix;
@@ -564,8 +562,6 @@ void CCLayerTreeHostImpl::drawLayers(const FrameData& frame)
     if (m_debugRectHistory->enabled(settings()))
         m_debugRectHistory->saveDebugRectsForCurrentFrame(m_rootLayerImpl.get(), *frame.renderSurfaceLayerList, frame.occludingScreenSpaceRects, settings());
 
-    ++m_sourceAnimationFrameNumber;
-
     // The next frame should start by assuming nothing has changed, and changes are noted as they occur.
     m_rootLayerImpl->resetAllChangeTrackingForSubtree();
 }
@@ -1189,4 +1185,15 @@ void CCLayerTreeHostImpl::animateGestures(double monotonicTime)
         m_activeGestureAnimation.clear();
 }
 
+int CCLayerTreeHostImpl::sourceAnimationFrameNumber() const
+{
+    return fpsCounter()->currentFrameNumber();
+}
+
+void CCLayerTreeHostImpl::renderingStats(CCRenderingStats& stats) const
+{
+    stats.numFramesSentToScreen = fpsCounter()->currentFrameNumber();
+    stats.droppedFrameCount = fpsCounter()->droppedFrameCount();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index f936e34dd..5587b3462 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -49,6 +49,7 @@ class CCRenderPassDrawQuad;
 class CCResourceProvider;
 class LayerRendererChromium;
 struct LayerRendererCapabilities;
+struct CCRenderingStats;
 
 // CCLayerTreeHost->CCProxy callback interface.
 class CCLayerTreeHostImplClient {
@@ -121,7 +122,7 @@ public:
     void setFontAtlas(PassOwnPtr<CCFontAtlas>);
 
     void finishAllRendering();
-    int sourceAnimationFrameNumber() const { return m_sourceAnimationFrameNumber; }
+    int sourceAnimationFrameNumber() const;
 
     bool initializeLayerRenderer(PassOwnPtr<CCGraphicsContext>, TextureUploaderOption);
     bool isContextLost();
@@ -174,6 +175,8 @@ public:
 
     void setNeedsRedraw();
 
+    void renderingStats(CCRenderingStats&) const;
+
     CCFrameRateCounter* fpsCounter() const { return m_fpsCounter.get(); }
     CCDebugRectHistory* debugRectHistory() const { return m_debugRectHistory.get(); }
     CCResourceProvider* resourceProvider() const { return m_resourceProvider.get(); }
@@ -225,7 +228,6 @@ protected:
 
     CCLayerTreeHostImplClient* m_client;
     int m_sourceFrameNumber;
-    int m_sourceAnimationFrameNumber;
 
 private:
     void computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
index 0083ad1dd..39461578f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -510,11 +510,9 @@ IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContribu
 template<typename LayerType, typename RenderSurfaceType>
 IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerScissorRectInTargetSurface(const LayerType* layer) const
 {
-    const LayerType* renderTarget = m_stack.last().target;
-    FloatRect totalScissor = renderTarget->renderSurface()->contentRect();
-    if (layer->usesLayerClipping())
-        totalScissor.intersect(layer->clipRect());
-    return enclosingIntRect(totalScissor);
+    // FIXME: we could remove this helper function, but unit tests currently override this
+    //        function, and they need to be verified/adjusted before this can be removed.
+    return layer->scissorRect();
 }
 
 // Declare the possible functions here for the linker.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index 79fdac4ec..16d8fa194 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -91,7 +91,6 @@ public:
     bool screenSpaceTransformsAreAnimating() const { return m_screenSpaceTransformsAreAnimating; }
     void setScreenSpaceTransformsAreAnimating(bool animating) { m_screenSpaceTransformsAreAnimating = animating; }
 
-    // Usage: this clipRect should not be used if one of the two conditions is true: (a) clipRect() is empty, or (b) owningLayer->parent()->usesLayerClipping() is false.
     void setClipRect(const IntRect&);
     const IntRect& clipRect() const { return m_clipRect; }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h
index f69c8e026..d8075aac2 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderingStats.h
@@ -28,12 +28,15 @@
 namespace WebCore {
 
 struct CCRenderingStats {
+    // FIXME: Rename these to animationFrameCount and screenFrameCount, crbug.com/138641.
     int numAnimationFrames;
     int numFramesSentToScreen;
+    int droppedFrameCount;
 
     CCRenderingStats()
         : numAnimationFrames(0)
         , numFramesSentToScreen(0)
+        , droppedFrameCount(0)
     {
     }
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
index ef82bf22a..49c3b243f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.cpp
@@ -195,6 +195,20 @@ void CCResourceProvider::flush()
     context3d->flush();
 }
 
+bool CCResourceProvider::shallowFlushIfSupported()
+{
+    ASSERT(CCProxy::isImplThread());
+    WebGraphicsContext3D* context3d = m_context->context3D();
+    if (!context3d) {
+        // FIXME: Implement this path for software compositing.
+        return false;
+    }
+
+    if (m_useShallowFlush)
+        context3d->shallowFlushCHROMIUM();
+    return m_useShallowFlush;
+}
+
 unsigned CCResourceProvider::lockForRead(ResourceId id)
 {
     ASSERT(CCProxy::isImplThread());
@@ -217,6 +231,7 @@ CCResourceProvider::CCResourceProvider(CCGraphicsContext* context)
     , m_nextId(1)
     , m_useTextureStorageExt(false)
     , m_useTextureUsageHint(false)
+    , m_useShallowFlush(false)
     , m_maxTextureSize(0)
 {
 }
@@ -240,6 +255,8 @@ bool CCResourceProvider::initialize()
             m_useTextureUsageHint = true;
         else if (extensions[i] == "GL_CHROMIUM_map_sub")
             useMapSub = true;
+        else if (extensions[i] == "GL_CHROMIUM_shallow_flush")
+            m_useShallowFlush = true;
     }
 
     m_texSubImage = adoptPtr(new LayerTextureSubImage(useMapSub));
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
index 0476f0e88..9b0b44caf 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCResourceProvider.h
@@ -85,6 +85,10 @@ public:
     // respect to other contexts.
     void flush();
 
+    // Only flush the command buffer if supported.
+    // Returns true if the shallow flush occurred, false otherwise.
+    bool shallowFlushIfSupported();
+
 private:
     friend class CCScopedLockResourceForRead;
     friend class CCScopedLockResourceForWrite;
@@ -117,6 +121,7 @@ private:
 
     bool m_useTextureStorageExt;
     bool m_useTextureUsageHint;
+    bool m_useShallowFlush;
     OwnPtr<LayerTextureSubImage> m_texSubImage;
     int m_maxTextureSize;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index 002c7a7bf..3550346ba 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -31,7 +31,6 @@
 #include "cc/CCFontAtlas.h"
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCLayerTreeHost.h"
-#include "cc/CCRenderingStats.h"
 #include "cc/CCTextureUpdater.h"
 #include "cc/CCTimer.h"
 #include <wtf/CurrentTime.h>
@@ -173,7 +172,7 @@ bool CCSingleThreadProxy::recreateContext()
 
 void CCSingleThreadProxy::implSideRenderingStats(CCRenderingStats& stats)
 {
-    stats.numFramesSentToScreen = m_layerTreeHostImpl->sourceAnimationFrameNumber();
+    m_layerTreeHostImpl->renderingStats(stats);
 }
 
 const LayerRendererCapabilities& CCSingleThreadProxy::layerRendererCapabilities() const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
index 967ad5e3f..c6f4929a8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTextureUpdater.cpp
@@ -102,12 +102,12 @@ void CCTextureUpdater::update(CCResourceProvider* resourceProvider, TextureCopie
             uploader->uploadTexture(entry.texture, resourceProvider, entry.sourceRect, entry.destRect);
             fullUploadCount++;
             if (!(fullUploadCount % kUploadFlushPeriod))
-                resourceProvider->flush();
+                resourceProvider->shallowFlushIfSupported();
         }
 
         // Make sure there are no dangling uploads without a flush.
         if (fullUploadCount % kUploadFlushPeriod)
-            resourceProvider->flush();
+            resourceProvider->shallowFlushIfSupported();
 
         bool moreUploads = maxIndex < m_fullEntries.size();
 
@@ -127,14 +127,14 @@ void CCTextureUpdater::update(CCResourceProvider* resourceProvider, TextureCopie
             UpdateEntry& entry = m_partialEntries[index];
             uploader->uploadTexture(entry.texture, resourceProvider, entry.sourceRect, entry.destRect);
             if (!((index+1) % kUploadFlushPeriod))
-                resourceProvider->flush();
+                resourceProvider->shallowFlushIfSupported();
         }
 
         // Make sure there are no dangling partial uploads without a flush.
         // Note: We don't need to use (index+1) in this case because index was
         // incremented at the end of the for loop.
         if (index % kUploadFlushPeriod)
-            resourceProvider->flush();
+            resourceProvider->shallowFlushIfSupported();
 
         uploader->endUploads();
     }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 9b6dfe3ac..e09d94c61 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -36,7 +36,6 @@
 #include "cc/CCGraphicsContext.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerTreeHost.h"
-#include "cc/CCRenderingStats.h"
 #include "cc/CCScheduler.h"
 #include "cc/CCScopedThreadProxy.h"
 #include "cc/CCTextureUpdater.h"
@@ -895,7 +894,7 @@ void CCThreadProxy::recreateContextOnImplThread(CCCompletionEvent* completion, C
 void CCThreadProxy::implSideRenderingStatsOnImplThread(CCCompletionEvent* completion, CCRenderingStats* stats)
 {
     ASSERT(isImplThread());
-    stats->numFramesSentToScreen = m_layerTreeHostImpl->sourceAnimationFrameNumber();
+    m_layerTreeHostImpl->renderingStats(*stats);
     completion->signal();
 }
 
diff --git a/Source/WebCore/platform/graphics/filters/FEBlend.cpp b/Source/WebCore/platform/graphics/filters/FEBlend.cpp
index 363a75b7f..f6dcf6396 100644
--- a/Source/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) 2012 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -62,71 +63,102 @@ bool FEBlend::setBlendMode(BlendModeType mode)
     return true;
 }
 
-static inline unsigned char normal(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char)
+static inline unsigned char fastDivideBy255(uint16_t value)
 {
-    return (((255 - alphaA) * colorB + colorA * 255) / 255);
+    // This is an approximate algorithm for division by 255, but it gives accurate results for 16bit values.
+    uint16_t quotient = value >> 8;
+    uint16_t remainder = value - (quotient * 255) + 1;
+    return quotient + (remainder >> 8);
 }
 
-static inline unsigned char multiply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
-{
-    return (((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA) / 255);
-}
+class BlendNormal {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char)
+    {
+        return fastDivideBy255((255 - alphaA) * colorB + colorA * 255);
+    }
+};
 
-static inline unsigned char screen(unsigned char colorA, unsigned char colorB, unsigned char, unsigned char)
-{
-    return (((colorB + colorA) * 255 - colorA * colorB) / 255);
-}
+class BlendMultiply {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+    {
+        return fastDivideBy255((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA);
+    }
+};
 
-static inline unsigned char darken(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
-{
-    return ((std::min((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
-}
+class BlendScreen {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char, unsigned char)
+    {
+        return fastDivideBy255((colorB + colorA) * 255 - colorA * colorB);
+    }
+};
+
+class BlendDarken {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+    {
+        return fastDivideBy255(std::min((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255));
+    }
+};
+
+class BlendLighten {
+public:
+    static unsigned char apply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+    {
+        return fastDivideBy255(std::max((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255));
+    }
+};
+
+class BlendUnknown {
+public:
+    static unsigned char apply(unsigned char, unsigned char, unsigned char, unsigned char)
+    {
+        return 0;
+    }
+};
 
-static inline unsigned char lighten(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+template<typename BlendFunctor>
+static void platformApply(unsigned char* sourcePixelA, unsigned char* sourcePixelB,
+                          unsigned char* destinationPixel, unsigned pixelArrayLength)
 {
-    return ((std::max((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+    unsigned len = pixelArrayLength / 4;
+    for (unsigned pixelOffset = 0; pixelOffset < len; pixelOffset++) {
+        unsigned char alphaA = sourcePixelA[3];
+        unsigned char alphaB = sourcePixelB[3];
+        destinationPixel[0] = BlendFunctor::apply(sourcePixelA[0], sourcePixelB[0], alphaA, alphaB);
+        destinationPixel[1] = BlendFunctor::apply(sourcePixelA[1], sourcePixelB[1], alphaA, alphaB);
+        destinationPixel[2] = BlendFunctor::apply(sourcePixelA[2], sourcePixelB[2], alphaA, alphaB);
+        destinationPixel[3] = 255 - fastDivideBy255((255 - alphaA) * (255 - alphaB));
+        sourcePixelA += 4;
+        sourcePixelB += 4;
+        destinationPixel += 4;
+    }
 }
 
-void FEBlend::platformApplyGeneric(PassRefPtr<Uint8ClampedArray> pixelArrayA, PassRefPtr<Uint8ClampedArray> pixelArrayB,
-                                   Uint8ClampedArray* dstPixelArray, unsigned pixelArrayLength)
+void FEBlend::platformApplyGeneric(unsigned char* sourcePixelA, unsigned char* sourcePixelB,
+                                   unsigned char* destinationPixel, unsigned pixelArrayLength)
 {
-    RefPtr<Uint8ClampedArray> srcPixelArrayA = pixelArrayA;
-    RefPtr<Uint8ClampedArray> srcPixelArrayB = pixelArrayB;
-
-    for (unsigned pixelOffset = 0; pixelOffset < pixelArrayLength; pixelOffset += 4) {
-        unsigned char alphaA = srcPixelArrayA->item(pixelOffset + 3);
-        unsigned char alphaB = srcPixelArrayB->item(pixelOffset + 3);
-        for (unsigned channel = 0; channel < 3; ++channel) {
-            unsigned char colorA = srcPixelArrayA->item(pixelOffset + channel);
-            unsigned char colorB = srcPixelArrayB->item(pixelOffset + channel);
-            unsigned char result;
-
-            switch (m_mode) {
-            case FEBLEND_MODE_NORMAL:
-                result = normal(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_MULTIPLY:
-                result = multiply(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_SCREEN:
-                result = screen(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_DARKEN:
-                result = darken(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_LIGHTEN:
-                result = lighten(colorA, colorB, alphaA, alphaB);
-                break;
-            case FEBLEND_MODE_UNKNOWN:
-            default:
-                result = 0;
-                break;
-            }
-
-            dstPixelArray->set(pixelOffset + channel, result);
-        }
-        unsigned char alphaR = 255 - ((255 - alphaA) * (255 - alphaB)) / 255;
-        dstPixelArray->set(pixelOffset + 3, alphaR);
+    switch (m_mode) {
+    case FEBLEND_MODE_NORMAL:
+        platformApply<BlendNormal>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_MULTIPLY:
+        platformApply<BlendMultiply>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_SCREEN:
+        platformApply<BlendScreen>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_DARKEN:
+        platformApply<BlendDarken>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_LIGHTEN:
+        platformApply<BlendLighten>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
+    case FEBLEND_MODE_UNKNOWN:
+        platformApply<BlendUnknown>(sourcePixelA, sourcePixelB, destinationPixel, pixelArrayLength);
+        break;
     }
 }
 
@@ -165,7 +197,7 @@ void FEBlend::platformApplySoftware()
         reinterpret_cast<uint32_t*>(dstPixelArray->data())[0] = sourceBAndDest[0];
     }
 #else
-    platformApplyGeneric(srcPixelArrayA, srcPixelArrayB, dstPixelArray, pixelArrayLength);
+    platformApplyGeneric(srcPixelArrayA->data(), srcPixelArrayB->data(), dstPixelArray->data(), pixelArrayLength);
 #endif
 }
 
diff --git a/Source/WebCore/platform/graphics/filters/FEBlend.h b/Source/WebCore/platform/graphics/filters/FEBlend.h
index cc72e4aca..fe5017c3e 100644
--- a/Source/WebCore/platform/graphics/filters/FEBlend.h
+++ b/Source/WebCore/platform/graphics/filters/FEBlend.h
@@ -45,8 +45,8 @@ public:
     BlendModeType blendMode() const;
     bool setBlendMode(BlendModeType);
 
-    void platformApplyGeneric(PassRefPtr<Uint8ClampedArray> pixelArrayA, PassRefPtr<Uint8ClampedArray> pixelArrayB,
-                              Uint8ClampedArray* dstPixelArray, unsigned pixelArrayLength);
+    void platformApplyGeneric(unsigned char* srcPixelArrayA, unsigned char* srcPixelArrayB, unsigned char* dstPixelArray,
+                           unsigned colorArrayLength);
     void platformApplyNEON(unsigned char* srcPixelArrayA, unsigned char* srcPixelArrayB, unsigned char* dstPixelArray,
                            unsigned colorArrayLength);
 
diff --git a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h
index f3c635af0..b6e91e2eb 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h
+++ b/Source/WebCore/platform/graphics/harfbuzz/ng/HarfBuzzNGFace.h
@@ -31,15 +31,11 @@
 #ifndef HarfBuzzNGFace_h
 #define HarfBuzzNGFace_h
 
+#include <hb.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
-struct _hb_face_t;
-typedef _hb_face_t hb_face_t;
-struct _hb_font_t;
-typedef _hb_font_t hb_font_t;
-
 namespace WebCore {
 
 class FontPlatformData;
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
index e7e8fc909..9ae500775 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
@@ -2,11 +2,11 @@
  * Copyright (C) 2007 Apple Computer, Inc.
  * Copyright (c) 2007, 2008, 2009, Google Inc. All rights reserved.
  * Copyright (C) 2010 Company 100, Inc.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -16,7 +16,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -35,12 +35,12 @@
 
 #if OS(WINDOWS)
 #include "OpenTypeUtilities.h"
-#include "PlatformSupport.h"
 #elif OS(UNIX)
 #include "SkStream.h"
 #endif
 
 #include "FontPlatformData.h"
+#include "LayoutTestSupport.h"
 #include "NotImplemented.h"
 #include "OpenTypeSanitizer.h"
 #include "SharedBuffer.h"
@@ -83,7 +83,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
            sizeof(logFont.lfFaceName[0]) * (1 + m_name.length()));
 
     // FIXME: almost identical to FillLogFont in FontCacheWin.cpp.
-    // Need to refactor. 
+    // Need to refactor.
     logFont.lfHeight = -size;
     logFont.lfWidth = 0;
     logFont.lfEscapement = 0;
@@ -92,7 +92,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
     logFont.lfStrikeOut = false;
     logFont.lfCharSet = DEFAULT_CHARSET;
     logFont.lfOutPrecision = OUT_TT_ONLY_PRECIS;
-    logFont.lfQuality = PlatformSupport::layoutTestMode() ?
+    logFont.lfQuality = isRunningLayoutTest() ?
                         NONANTIALIASED_QUALITY :
                         DEFAULT_QUALITY; // Honor user's desktop settings.
     logFont.lfPitchAndFamily = DEFAULT_PITCH | FF_DONTCARE;
diff --git a/Source/WebCore/platform/graphics/skia/FontSkia.cpp b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
index abd556c83..03f1417fb 100644
--- a/Source/WebCore/platform/graphics/skia/FontSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontSkia.cpp
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2011 Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -33,8 +33,8 @@
 
 #include "GlyphBuffer.h"
 #include "GraphicsContext.h"
+#include "LayoutTestSupport.h"
 #include "PlatformContextSkia.h"
-#include "PlatformSupport.h"
 #include "SimpleFontData.h"
 
 #include "SkCanvas.h"
@@ -83,7 +83,7 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
 
     bool shouldSmoothFonts = true;
     bool shouldAntialias = true;
-    
+
     switch (fontDescription().fontSmoothing()) {
     case Antialiased:
         shouldSmoothFonts = false;
@@ -96,10 +96,10 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
         break;
     case AutoSmoothing:
         // For the AutoSmooth case, don't do anything! Keep the default settings.
-        break; 
+        break;
     }
-    
-    if (!shouldUseSmoothing() || PlatformSupport::layoutTestMode())
+
+    if (!shouldUseSmoothing() || isRunningLayoutTest())
         shouldSmoothFonts = false;
 
     const GlyphBufferGlyph* glyphs = glyphBuffer.glyphs(from);
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 26aba108a..0af779c51 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -37,14 +37,17 @@
 #include "Gradient.h"
 #include "ImageBuffer.h"
 #include "IntRect.h"
+#include "KURL.h"
 #include "NativeImageSkia.h"
 #include "NotImplemented.h"
 #include "PlatformContextSkia.h"
 
+#include "SkAnnotation.h"
 #include "SkBitmap.h"
 #include "SkBlurMaskFilter.h"
 #include "SkColorFilter.h"
 #include "SkCornerPathEffect.h"
+#include "SkData.h"
 #include "SkLayerDrawLooper.h"
 #include "SkShader.h"
 #include "SkiaUtils.h"
@@ -998,6 +1001,11 @@ void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
 
 void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
 {
+    if (paintingDisabled())
+        return;
+
+    SkAutoDataUnref url(SkData::NewWithCString(link.string().utf8().data()));
+    SkAnnotateRectWithURL(platformContext()->canvas(), destRect, url.get());
 }
 
 void GraphicsContext::setPlatformShouldAntialias(bool enable)
diff --git a/Source/WebCore/platform/graphics/win/UniscribeController.cpp b/Source/WebCore/platform/graphics/win/UniscribeController.cpp
index 60f8d12a1..6158fe617 100644
--- a/Source/WebCore/platform/graphics/win/UniscribeController.cpp
+++ b/Source/WebCore/platform/graphics/win/UniscribeController.cpp
@@ -31,6 +31,8 @@
 #include "TextRun.h"
 #include <wtf/MathExtras.h>
 
+using namespace WTF;
+using namespace Unicode;
 using namespace std;
 
 namespace WebCore {
@@ -131,7 +133,7 @@ void UniscribeController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
     UChar newC = 0;
 
     bool isSmallCaps;
-    bool nextIsSmallCaps = m_font.isSmallCaps() && !(U_GET_GC_MASK(*curr) & U_GC_M_MASK) && (newC = u_toupper(*curr)) != *curr;
+    bool nextIsSmallCaps = m_font.isSmallCaps() && !(category(*curr) & (Mark_NonSpacing | Mark_Enclosing | Mark_SpacingCombining)) && (newC = toUpper(*curr)) != *curr;
 
     if (nextIsSmallCaps)
         smallCapsBuffer[curr - cp] = newC;
@@ -146,10 +148,10 @@ void UniscribeController::advance(unsigned offset, GlyphBuffer* glyphBuffer)
         int index = curr - cp;
         UChar c = *curr;
 
-        bool forceSmallCaps = isSmallCaps && (U_GET_GC_MASK(c) & U_GC_M_MASK);
+        bool forceSmallCaps = isSmallCaps && (category(c) & (Mark_NonSpacing | Mark_Enclosing | Mark_SpacingCombining));
         nextFontData = m_font.glyphDataForCharacter(*curr, false, forceSmallCaps ? SmallCapsVariant : AutoVariant).fontData;
         if (m_font.isSmallCaps()) {
-            nextIsSmallCaps = forceSmallCaps || (newC = u_toupper(c)) != c;
+            nextIsSmallCaps = forceSmallCaps || (newC = toUpper(c)) != c;
             if (nextIsSmallCaps)
                 smallCapsBuffer[index] = forceSmallCaps ? c : newC;
         }
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index a77077a05..22b54f651 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -64,7 +64,9 @@ using namespace HTMLNames;
 static HTMLMediaElement* getMediaElementFromRenderObject(RenderObject* o)
 {
     Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    Node* mediaNode = node ? node->shadowHost() : 0;
+    if (!mediaNode)
+        mediaNode = node;
     if (!mediaNode || !mediaNode->isElementNode() || !static_cast<Element*>(mediaNode)->isMediaElement())
         return 0;
 
@@ -313,7 +315,9 @@ void RenderThemeGtk::adjustSearchFieldResultsDecorationStyle(StyleResolver*, Ren
 static IntRect centerRectVerticallyInParentInputElement(RenderObject* renderObject, const IntRect& rect)
 {
     // Get the renderer of <input> element.
-    Node* input = renderObject->node()->shadowAncestorNode();
+    Node* input = renderObject->node()->shadowHost();
+    if (!input)
+        input = renderObject->node();
     if (!input->renderer()->isBox())
         return IntRect();
 
@@ -711,4 +715,18 @@ String RenderThemeGtk::fileListNameForWidth(const FileList* fileList, const Font
     return StringTruncator::centerTruncate(string, width, font, StringTruncator::EnableRoundingHacks);
 }
 
+#if ENABLE(DATALIST_ELEMENT)
+IntSize RenderThemeGtk::sliderTickSize() const
+{
+    // FIXME: We need to set this to the size of one tick mark.
+    return IntSize(0, 0);
+}
+
+int RenderThemeGtk::sliderTickOffsetFromTrackCenter() const
+{
+    // FIXME: We need to set this to the position of the tick marks.
+    return 0;
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index add959d9f..5b4fbe1aa 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -93,6 +93,14 @@ public:
 #endif
 #endif
 
+#if ENABLE(DATALIST_ELEMENT)
+    // Returns size of one slider tick mark for a horizontal track.
+    // For vertical tracks we rotate it and use it. i.e. Width is always length along the track.
+    virtual IntSize sliderTickSize() const;
+    // Returns the distance of slider tick origin from the slider track center.
+    virtual int sliderTickOffsetFromTrackCenter() const;
+#endif
+
 #ifdef GTK_API_VERSION_2
     GtkWidget* gtkContainer() const;
     GtkWidget* gtkEntry() const;
diff --git a/Source/WebCore/platform/network/ResourceHandleInternal.h b/Source/WebCore/platform/network/ResourceHandleInternal.h
index e4a4c3829..ecf648fce 100644
--- a/Source/WebCore/platform/network/ResourceHandleInternal.h
+++ b/Source/WebCore/platform/network/ResourceHandleInternal.h
@@ -54,7 +54,9 @@ class Frame;
 #endif
 
 #if PLATFORM(QT)
+QT_BEGIN_NAMESPACE
 class QWebNetworkJob;
+QT_END_NAMESPACE
 namespace WebCore {
 class QNetworkReplyHandler;
 }
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 3badb6fcc..09f518b86 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -48,7 +48,6 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "PaintInfo.h"
-#include "QWebPageClient.h"
 #include "RenderBox.h"
 #if ENABLE(PROGRESS_ELEMENT)
 #include "RenderProgress.h"
@@ -235,37 +234,27 @@ void RenderThemeQt::adjustRepaintRect(const RenderObject* o, IntRect& rect)
 
 Color RenderThemeQt::platformActiveSelectionBackgroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Active, QPalette::Highlight).color();
+    return colorPalette().brush(QPalette::Active, QPalette::Highlight).color();
 }
 
 Color RenderThemeQt::platformInactiveSelectionBackgroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Inactive, QPalette::Highlight).color();
+    return colorPalette().brush(QPalette::Inactive, QPalette::Highlight).color();
 }
 
 Color RenderThemeQt::platformActiveSelectionForegroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Active, QPalette::HighlightedText).color();
+    return colorPalette().brush(QPalette::Active, QPalette::HighlightedText).color();
 }
 
 Color RenderThemeQt::platformInactiveSelectionForegroundColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Inactive, QPalette::HighlightedText).color();
+    return colorPalette().brush(QPalette::Inactive, QPalette::HighlightedText).color();
 }
 
 Color RenderThemeQt::platformFocusRingColor() const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
-    return pal.brush(QPalette::Active, QPalette::Highlight).color();
+    return colorPalette().brush(QPalette::Active, QPalette::Highlight).color();
 }
 
 void RenderThemeQt::systemFont(int, FontDescription&) const
@@ -275,8 +264,7 @@ void RenderThemeQt::systemFont(int, FontDescription&) const
 
 Color RenderThemeQt::systemColor(int cssValueId) const
 {
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
+    QPalette pal = colorPalette();
     switch (cssValueId) {
     case CSSValueButtontext:
         return pal.brush(QPalette::Active, QPalette::ButtonText).color();
@@ -456,13 +444,20 @@ IntRect RenderThemeQt::convertToPaintingRect(RenderObject* inputRenderer, const
     return partRect;
 }
 
+QPalette RenderThemeQt::colorPalette() const
+{
+    return QGuiApplication::palette();
+}
+
 bool RenderThemeQt::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& pi,
                                                  const IntRect& r)
 {
     // Logic copied from RenderThemeChromium.cpp.
 
     // Get the renderer of <input> element.
-    Node* input = o->node()->shadowAncestorNode();
+    Node* input = o->node()->shadowHost();
+    if (!input)
+        input = o->node();
     if (!input->renderer()->isBox())
         return false;
     RenderBox* inputRenderBox = toRenderBox(input->renderer());
@@ -539,23 +534,6 @@ bool RenderThemeQt::supportsFocus(ControlPart appearance) const
     }
 }
 
-void RenderThemeQt::setPaletteFromPageClientIfExists(QPalette& palette) const
-{
-    // If the webview has a custom palette, use it
-    if (!m_page)
-        return;
-    Chrome* chrome = m_page->chrome();
-    if (!chrome)
-        return;
-    ChromeClient* chromeClient = chrome->client();
-    if (!chromeClient)
-        return;
-    QWebPageClient* pageClient = chromeClient->platformPageClient();
-    if (!pageClient)
-        return;
-    palette = pageClient->palette();
-}
-
 #if ENABLE(VIDEO)
 
 String RenderThemeQt::extraMediaControlsStyleSheet()
@@ -620,11 +598,8 @@ QColor RenderThemeQt::getMediaControlForegroundColor(RenderObject* o) const
     if (o->node()->active())
         fgColor = fgColor.lighter();
 
-    if (!mediaElementCanPlay(o)) {
-        QPalette pal = QGuiApplication::palette();
-        setPaletteFromPageClientIfExists(pal);
-        fgColor = pal.brush(QPalette::Disabled, QPalette::Text).color();
-    }
+    if (!mediaElementCanPlay(o))
+        fgColor = colorPalette().brush(QPalette::Disabled, QPalette::Text).color();
 
     return fgColor;
 }
@@ -759,9 +734,7 @@ bool RenderThemeQt::paintMediaVolumeSliderTrack(RenderObject *o, const PaintInfo
     int width = b.width();
     int height = b.height();
 
-    // Get the scale color from the page client
-    QPalette pal = QGuiApplication::palette();
-    setPaletteFromPageClientIfExists(pal);
+    QPalette pal = colorPalette();
     const QColor highlightText = pal.brush(QPalette::Active, QPalette::HighlightedText).color();
     const QColor scaleColor(highlightText.red(), highlightText.green(), highlightText.blue(), mediaControlsBaselineOpacity() * 255);
 
@@ -834,8 +807,9 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pain
 bool RenderThemeQt::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(o->node());
-    Node* hostNode = o->node()->shadowAncestorNode();
-    ASSERT(hostNode);
+    Node* hostNode = o->node()->shadowHost();
+    if (!hostNode)
+        hostNode = o->node();
     HTMLMediaElement* mediaElement = toParentMediaElement(hostNode);
     if (!mediaElement)
         return false;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index a7379140a..29ac33b59 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -25,6 +25,7 @@
 #include "RenderTheme.h"
 
 #include <QBrush>
+#include <QPalette>
 #include <QSharedPointer>
 #include <QString>
 
@@ -164,8 +165,6 @@ protected:
 
     virtual QRect inflateButtonRect(const QRect& originalRect) const;
 
-    void setPaletteFromPageClientIfExists(QPalette&) const;
-
     virtual void setPopupPadding(RenderStyle*) const = 0;
 
     virtual QSharedPointer<StylePainter> getStylePainter(const PaintInfo&) = 0;
@@ -174,6 +173,8 @@ protected:
 
     IntRect convertToPaintingRect(RenderObject* inputRenderer, const RenderObject* partRenderer, IntRect partRect, const IntRect& localOffset) const;
 
+    virtual QPalette colorPalette() const;
+
     Page* m_page;
 
     QString m_buttonFontFamily;
diff --git a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
index ac0847832..602f3fc99 100644
--- a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
@@ -202,6 +202,12 @@ QSharedPointer<StylePainter> RenderThemeQtMobile::getStylePainter(const PaintInf
     return QSharedPointer<StylePainter>(new StylePainterMobile(this, pi));
 }
 
+QPalette RenderThemeQtMobile::colorPalette() const
+{
+    static QPalette lightGrayPalette(Qt::lightGray);
+    return lightGrayPalette;
+}
+
 StylePainterMobile::StylePainterMobile(RenderThemeQtMobile* theme, const PaintInfo& paintInfo)
     : StylePainter(theme, paintInfo)
 {
@@ -896,13 +902,6 @@ bool RenderThemeQtMobile::checkMultiple(RenderObject* o) const
     return select ? select->multiple() : false;
 }
 
-void RenderThemeQtMobile::setPaletteFromPageClientIfExists(QPalette& palette) const
-{
-    static QPalette lightGrayPalette(Qt::lightGray);
-    palette = lightGrayPalette;
-    return;
-}
-
 void RenderThemeQtMobile::adjustSliderThumbSize(RenderStyle* style, Element* element) const
 {
     const ControlPart part = style->appearance();
diff --git a/Source/WebCore/platform/qt/RenderThemeQtMobile.h b/Source/WebCore/platform/qt/RenderThemeQtMobile.h
index 739e706ae..f2cc944bb 100644
--- a/Source/WebCore/platform/qt/RenderThemeQtMobile.h
+++ b/Source/WebCore/platform/qt/RenderThemeQtMobile.h
@@ -83,12 +83,12 @@ protected:
     virtual void computeSizeBasedOnStyle(RenderStyle*) const;
     virtual QSharedPointer<StylePainter> getStylePainter(const PaintInfo&);
 
+    virtual QPalette colorPalette() const;
+
 private:
     bool checkMultiple(RenderObject*) const;
     void setButtonPadding(RenderStyle*) const;
     void setPopupPadding(RenderStyle*) const;
-
-    void setPaletteFromPageClientIfExists(QPalette&) const;
 };
 
 struct KeyIdentifier {
diff --git a/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h b/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h
index bfe7e22e3..750b40f14 100644
--- a/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h
+++ b/Source/WebCore/platform/qt/ThirdPartyCookiesQt.h
@@ -20,8 +20,10 @@
 #ifndef ThirdPartyCookiesQt_h
 #define ThirdPartyCookiesQt_h
 
+QT_BEGIN_NAMESPACE
 class QNetworkCookieJar;
 class QUrl;
+QT_END_NAMESPACE
 
 namespace WebCore {
 class NetworkingContext;
diff --git a/Source/WebCore/platform/text/LocaleWin.cpp b/Source/WebCore/platform/text/LocaleWin.cpp
index be6685747..0f0e740e0 100644
--- a/Source/WebCore/platform/text/LocaleWin.cpp
+++ b/Source/WebCore/platform/text/LocaleWin.cpp
@@ -57,9 +57,9 @@ namespace WebCore {
 inline LocaleWin::LocaleWin(LCID lcid)
     : m_lcid(lcid)
 {
-    struct tm tm;
-    getCurrentLocalTime(&tm);
-    m_baseYear = tm.tm_year + 1900;
+    SYSTEMTIME systemTime;
+    GetLocalTime(&systemTime);
+    m_baseYear = systemTime.wYear;
 
 #if ENABLE(CALENDAR_PICKER)
     DWORD value = 0;
diff --git a/Source/WebCore/platform/text/TextEncodingRegistry.cpp b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
index 8281538bf..bd8b7a51e 100644
--- a/Source/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -52,7 +52,7 @@
 #include "gtk/TextCodecGtk.h"
 #endif
 #if USE(WINCE_UNICODE)
-#include "TextCodecWinCE.h"
+#include "win/TextCodecWin.h"
 #endif
 
 #include <wtf/CurrentTime.h>
@@ -312,8 +312,8 @@ static void extendTextCodecMaps()
 #endif
 
 #if USE(WINCE_UNICODE)
-    TextCodecWinCE::registerExtendedEncodingNames(addToTextEncodingNameMap);
-    TextCodecWinCE::registerExtendedCodecs(addToTextCodecMap);
+    TextCodecWin::registerExtendedEncodingNames(addToTextEncodingNameMap);
+    TextCodecWin::registerExtendedCodecs(addToTextCodecMap);
 #endif
 
     pruneBlacklistedCodecs();
diff --git a/Source/WebCore/platform/text/wince/TextCodecWinCE.cpp b/Source/WebCore/platform/text/win/TextCodecWin.cpp
index 0c4ec5012..e19237d68 100644
--- a/Source/WebCore/platform/text/wince/TextCodecWinCE.cpp
+++ b/Source/WebCore/platform/text/win/TextCodecWin.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved.
- * Copyright (C) 2010-2011 Patrick Gansterer <paroga@paroga.com>
+ * Copyright (C) 2010-2012 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,17 +23,16 @@
  */
 
 #include "config.h"
-#include "TextCodecWinCE.h"
+#include "TextCodecWin.h"
 
-#include "FontCache.h"
+#include "COMPtr.h"
 #include <mlang.h>
-#include <winbase.h>
-#include <winnls.h>
+#include <windows.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
-#include <wtf/text/WTFString.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -82,39 +81,42 @@ static LanguageManager& languageManager()
 
 LanguageManager::LanguageManager()
 {
-    IEnumCodePage* enumInterface;
-    IMultiLanguage* mli = FontCache::getMultiLanguageInterface();
-    if (mli && S_OK == mli->EnumCodePages(MIMECONTF_BROWSER, &enumInterface)) {
-        MIMECPINFO cpInfo;
-        ULONG ccpInfo;
-        while (S_OK == enumInterface->Next(1, &cpInfo, &ccpInfo) && ccpInfo) {
-            if (!IsValidCodePage(cpInfo.uiCodePage))
-                continue;
-
-            HashMap<UINT, CString>::iterator i = codePageCharsets().find(cpInfo.uiCodePage);
-
-            CString name(String(cpInfo.wszWebCharset).latin1());
-            if (i == codePageCharsets().end()) {
-                CharsetInfo info;
-                info.m_codePage = cpInfo.uiCodePage;
-                knownCharsets().set(name.data(), info);
-                i = codePageCharsets().set(cpInfo.uiCodePage, name).iterator;
-            }
-            if (i != codePageCharsets().end()) {
-                HashMap<String, CharsetInfo>::iterator j = knownCharsets().find(String(i->second.data(), i->second.length()));
-                ASSERT(j != knownCharsets().end());
-                CharsetInfo& info = j->second;
-                info.m_name = i->second.data();
-                info.m_friendlyName = cpInfo.wszDescription;
-                info.m_aliases.append(name);
-                info.m_aliases.append(String(cpInfo.wszHeaderCharset).latin1());
-                info.m_aliases.append(String(cpInfo.wszBodyCharset).latin1());
-                String cpName = "cp" + String::number(cpInfo.uiCodePage);
-                info.m_aliases.append(cpName.latin1());
-                supportedCharsets().add(i->second.data());
-            }
+    COMPtr<IMultiLanguage> multiLanguage;
+    if (FAILED(::CoCreateInstance(CLSID_CMultiLanguage, 0, CLSCTX_INPROC_SERVER, IID_IMultiLanguage, reinterpret_cast<LPVOID*>(&multiLanguage))))
+        return;
+
+    COMPtr<IEnumCodePage> enumInterface;
+    if (FAILED(multiLanguage->EnumCodePages(MIMECONTF_BROWSER, &enumInterface)))
+        return;
+
+    MIMECPINFO cpInfo;
+    ULONG ccpInfo;
+    while (SUCCEEDED(enumInterface->Next(1, &cpInfo, &ccpInfo)) && ccpInfo) {
+        if (!IsValidCodePage(cpInfo.uiCodePage))
+            continue;
+
+        HashMap<UINT, CString>::iterator i = codePageCharsets().find(cpInfo.uiCodePage);
+
+        CString name(String(cpInfo.wszWebCharset).latin1());
+        if (i == codePageCharsets().end()) {
+            CharsetInfo info;
+            info.m_codePage = cpInfo.uiCodePage;
+            knownCharsets().set(name.data(), info);
+            i = codePageCharsets().set(cpInfo.uiCodePage, name).iterator;
+        }
+        if (i != codePageCharsets().end()) {
+            HashMap<String, CharsetInfo>::iterator j = knownCharsets().find(String(i->second.data(), i->second.length()));
+            ASSERT(j != knownCharsets().end());
+            CharsetInfo& info = j->second;
+            info.m_name = i->second.data();
+            info.m_friendlyName = cpInfo.wszDescription;
+            info.m_aliases.append(name);
+            info.m_aliases.append(String(cpInfo.wszHeaderCharset).latin1());
+            info.m_aliases.append(String(cpInfo.wszBodyCharset).latin1());
+            String cpName = "cp" + String::number(cpInfo.uiCodePage);
+            info.m_aliases.append(cpName.latin1());
+            supportedCharsets().add(i->second.data());
         }
-        enumInterface->Release();
     }
 }
 
@@ -127,21 +129,21 @@ static UINT getCodePage(const char* name)
     return i == charsets.end() ? CP_ACP : i->second.m_codePage;
 }
 
-static PassOwnPtr<TextCodec> newTextCodecWinCE(const TextEncoding& encoding, const void*)
+static PassOwnPtr<TextCodec> newTextCodecWin(const TextEncoding& encoding, const void*)
 {
-    return adoptPtr(new TextCodecWinCE(getCodePage(encoding.name())));
+    return adoptPtr(new TextCodecWin(getCodePage(encoding.name())));
 }
 
-TextCodecWinCE::TextCodecWinCE(UINT codePage)
+TextCodecWin::TextCodecWin(UINT codePage)
     : m_codePage(codePage)
 {
 }
 
-TextCodecWinCE::~TextCodecWinCE()
+TextCodecWin::~TextCodecWin()
 {
 }
 
-void TextCodecWinCE::registerExtendedEncodingNames(EncodingNameRegistrar registrar)
+void TextCodecWin::registerExtendedEncodingNames(EncodingNameRegistrar registrar)
 {
     languageManager();
     for (CharsetSet::iterator i = supportedCharsets().begin(); i != supportedCharsets().end(); ++i) {
@@ -154,13 +156,13 @@ void TextCodecWinCE::registerExtendedEncodingNames(EncodingNameRegistrar registr
     }
 }
 
-void TextCodecWinCE::registerExtendedCodecs(TextCodecRegistrar registrar)
+void TextCodecWin::registerExtendedCodecs(TextCodecRegistrar registrar)
 {
     languageManager();
     for (CharsetSet::iterator i = supportedCharsets().begin(); i != supportedCharsets().end(); ++i) {
         HashMap<String, CharsetInfo>::iterator j = knownCharsets().find(*i);
         if (j != knownCharsets().end())
-            registrar(j->second.m_name.data(), newTextCodecWinCE, 0);
+            registrar(j->second.m_name.data(), newTextCodecWin, 0);
     }
 }
 
@@ -232,7 +234,7 @@ static void decodeInternal(Vector<UChar, 8192>& result, UINT codePage, const cha
     }
 }
 
-String TextCodecWinCE::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
+String TextCodecWin::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
 {
     if (!m_decodeBuffer.isEmpty()) {
         m_decodeBuffer.append(bytes, length);
@@ -274,7 +276,7 @@ String TextCodecWinCE::decode(const char* bytes, size_t length, bool flush, bool
     return String::adopt(result);
 }
 
-CString TextCodecWinCE::encode(const UChar* characters, size_t length, UnencodableHandling)
+CString TextCodecWin::encode(const UChar* characters, size_t length, UnencodableHandling)
 {
     if (!characters || !length)
         return CString();
@@ -294,7 +296,7 @@ CString TextCodecWinCE::encode(const UChar* characters, size_t length, Unencodab
     return result;
 }
 
-void TextCodecWinCE::enumerateSupportedEncodings(EncodingReceiver& receiver)
+void TextCodecWin::enumerateSupportedEncodings(EncodingReceiver& receiver)
 {
     languageManager();
     for (CharsetSet::iterator i = supportedCharsets().begin(); i != supportedCharsets().end(); ++i) {
diff --git a/Source/WebCore/platform/text/wince/TextCodecWinCE.h b/Source/WebCore/platform/text/win/TextCodecWin.h
index 500a8cdd9..15b2bc3d9 100644
--- a/Source/WebCore/platform/text/wince/TextCodecWinCE.h
+++ b/Source/WebCore/platform/text/win/TextCodecWin.h
@@ -2,7 +2,7 @@
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
- * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ * Copyright (C) 2010-2012 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,27 +23,27 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef TextCodecWinCE_h
-#define TextCodecWinCE_h
+#ifndef TextCodecWin_h
+#define TextCodecWin_h
 
 #include "PlatformString.h"
 #include "TextCodec.h"
 #include "TextEncoding.h"
-#include <wtf/Vector.h>
 #include <windows.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-class TextCodecWinCE : public TextCodec {
+class TextCodecWin : public TextCodec {
 public:
     static void registerExtendedEncodingNames(EncodingNameRegistrar);
     static void registerExtendedCodecs(TextCodecRegistrar);
 
-    TextCodecWinCE(UINT codePage);
-    virtual ~TextCodecWinCE();
+    TextCodecWin(UINT codePage);
+    virtual ~TextCodecWin();
 
     virtual String decode(const char*, size_t length, bool flush, bool stopOnError, bool& sawError);
     virtual CString encode(const UChar*, size_t length, UnencodableHandling);
@@ -58,7 +58,7 @@ public:
         virtual bool receive(const char* encoding, const wchar_t* friendlyName, unsigned int codePage) = 0;
     };
 
-    static void enumerateSupportedEncodings(EncodingReceiver& receiver);
+    static void enumerateSupportedEncodings(EncodingReceiver&);
 
 private:
     UINT m_codePage;
@@ -67,4 +67,4 @@ private:
 
 } // namespace WebCore
 
-#endif // TextCodecWinCE_h
+#endif // TextCodecWin_h
diff --git a/Source/WebCore/platform/win/PopupMenuWin.cpp b/Source/WebCore/platform/win/PopupMenuWin.cpp
index b18c53feb..eb5c5b1a0 100644
--- a/Source/WebCore/platform/win/PopupMenuWin.cpp
+++ b/Source/WebCore/platform/win/PopupMenuWin.cpp
@@ -378,10 +378,11 @@ void PopupMenuWin::calculatePositionAndSize(const IntRect& r, FrameView* v)
     }
 
     // Check that we don't go off the screen horizontally
-    if (popupRect.x() < screen.x()) {
-        popupRect.setWidth(popupRect.width() - (screen.x() - popupRect.x()));
+    if (popupRect.x() + popupRect.width() > screen.width())
+        popupRect.setX(screen.x() + screen.width() - popupRect.width());
+    if (popupRect.x() < screen.x())
         popupRect.setX(screen.x());
-    }
+
     m_windowRect = popupRect;
     return;
 }